@camstack/system 1.2.311 → 1.2.312

package/dist/index.mjs

@@ -16,7 +16,7 @@ import "./builtins/liveness-monitor/index.mjs";
 import { LocalAuthAddon, a as require_safe_buffer, i as require_ms, n as ScopedTokenManager, o as ApiKeyManager, r as AuthManager, t as UserManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
-import NativeMetricsAddon, { a as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
+import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
@@ -28,8 +28,8 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-IM-v7JV4.mjs";
-import { $ as localEndpointPath, $t as shouldReclaim, A as createUdsEventBus, An as createSocketPlaneReader, At as createAddonDataPlaneFacility, B as LocalChildClient, Bn as CAP_ACTION_OVERFLOW_LABEL, Bt as RSS_BUDGET_RELEASE_RATIO, C as brokerTransportLink, Cn as MESH_QUEUE_TOP_N, Ct as installManifestNativeDeps, D as localProviderLink, Dn as SOCKET_PLANE_TOP_N, Dt as runNpm, E as ipcParentLink, En as EMPTY_SOCKET_PLANE_BASELINE, Et as resolveNpmInvocation, F as AGENT_CAP_FWD_SERVICE, Fn as createSocketDirectionCounters, Ft as HEAP_WATCH_WARN_RATIO, G as PARENT_ROUTED_PROVIDER_ADDON_ID, Gn as createCapActionCensus, Gt as createDeferredHeapWatchSink, H as UDS_NO_ROUTE_PREFIX, Hn as EMPTY_CAP_ACTION_READING, Ht as RUNNER_RSS_BUDGET_ENV, I as CapRouteResolver, In as recordSocketFrame, It as HUB_MAIN_HEAP_WATCH_LABEL, J as createLocalTransport, Jn as createEventPlaneMeter, Jt as describeRss, K as __resetCapUsageRegistryForTests, Kn as diffCapActionCensus, Kt as createLoopDelayMeter, L as callWithServiceDiscovery, Ln as sampleSocketDirection, Lt as HUB_MAIN_RSS_BUDGET_MB, M as createUdsLogger, Mn as formatSocketPlane, Mt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, N as createUdsLoggerWithControl, Nn as readSocketQueues, Nt as HEAP_RECLAIM_TRIGGER_MB, O as createParentUnownedCallHandler, On as SOCKET_QUEUE_TOP_N, Ot as createAddonPeerBytesFacility, P as AGENT_CAP_FWD_ACTION, Pn as EMPTY_SOCKET_DIRECTION, Pt as HEAP_WATCH_INTERVAL_MS, Q as PeerAnsweredError, Qt as reclaimIntervalMs, R as CapRouteError, Rn as socketDirectionBytes, Rt as HUB_RSS_BUDGET_ENV, S as brokerCallForCap, Sn as formatOutboundQueueVerdict, St as copyBundledNativeModules, T as deviceCapResolverLink, Tn as formatMeshQueue, Tt as buildNpmChildEnv, U as readMoleculerFanoutMode, Un as MAX_CAP_ACTIONS_PER_PEER, Ut as ZERO_LOOP_DELAY, V as LocalChildRegistry, Vn as CAP_ACTION_UNLABELLED, Vt as RUNNER_HEAP_WATCH_INTERVAL_MS, W as CapUsageRegistry, Wn as capActionLabel, Wt as buildHeapSample, X as UdsLocalTransportServer, Xn as diffEventPlane, Xt as nextRssBudgetState, Y as UdsLocalTransportClient, Yn as createEventPlaneReader, Yt as hubMainRssBudget, Z as SocketChannel, Zn as formatEventPlane, Zt as parseRssBudgetMb, _ as setNodeEventInterest, _n as selectReportedSpaces, _t as deserializeTypedArrays, a as adaptBrokerToCluster, an as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, b as createKernelHwAccel, bn as OUTBOUND_QUEUE_THRESHOLD_BYTES, bt as CapabilityHandle, c as getWorkerDeviceRegistry, cn as createInspectorArrayBufferCensus, d as setHubConnected, dn as DECISIVE_HEAP_SPACES, dt as NATIVE_PROVIDER_SERVICE_INFIX, en as startHeapWatch, et as FrameDecoder, f as EVENT_TOPIC_PREFIX, fn as HEAP_SPACE_REPORT_MIN_MB, ft as capActionName, g as registerEventBusService, gn as readHeapSpaces, gt as parseCapAction, h as getMoleculerEventStats, hn as heapSpaceField, ht as capServiceName, i as installManifestPythonDeps, in as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, it as createBrokerDeviceManagerApi, j as udsChildLogToWorkerEntry, jn as diffSocketPlane, jt as HEAP_RECLAIM_MIN_INTERVAL_MS, k as createUdsEventBridge, kn as createSocketPlaneMeter, kt as hostNodeIdOf, l as getOrInitReadinessRegistry, ln as formatArrayBufferCensus, lt as createAddonService, m as getBrokerEventBus, mn as formatHeapSpaces, mt as capBareAction, nn as strandedMb, nt as buildNativeCapProxy, o as createAddonContext, on as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, p as clusterEventTopic, pn as emitHeapDiagnosticReport, pt as capActionSuffix, q as getCapUsageRegistry, qn as EVENT_PLANE_TOP_N, qt as createV8Reclaimer, r as installManifestSystemDeps, rn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, rt as buildUdsNativeCapProxy, s as createUdsAddonContext, sn as createArrayBufferCensusGate, st as mountNativeCapService, t as CAP_METHOD_NOT_IMPLEMENTED, tn as startRunnerHeapWatch, tt as encodeFrame, u as getOrInitReadinessRegistryForClient, un as isArrayBufferCensusReport, ut as validateProviderRegistrations, v as subscribePassthrough, vn as OUTBOUND_QUEUE_COOLDOWN_MS, vt as serializeTypedArrays, w as buildLinkChain, wn as createMeshQueueReader, wt as resolveAddonClass, x as resolveHwAccel, xn as createOutboundQueueGate, xt as CapabilityUnavailableError, y as AddonDepsManager, yn as OUTBOUND_QUEUE_SUSTAIN_MS, yt as DeviceRegistry, z as classifyCapRoute, zn as socketDirectionMessages, zt as RSS_BUDGET_REANNOUNCE_MIN_MS } from "./child-cap-dispatch-BCJjUtXV.mjs";
-import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
+import { $ as CapUsageRegistry, $n as capActionLabel, $t as buildHeapSample, A as resolveHwAccel, An as createOutboundQueueGate, At as CapabilityUnavailableError, B as udsChildLogToWorkerEntry, Bn as diffSocketPlane, Bt as HEAP_RECLAIM_MIN_INTERVAL_MS, C as getBrokerEventBus, Cn as formatHeapSpaces, Ct as capBareAction, D as subscribePassthrough, Dn as OUTBOUND_QUEUE_COOLDOWN_MS, Dt as serializeTypedArrays, E as setNodeEventInterest, En as selectReportedSpaces, Et as deserializeTypedArrays, F as ipcParentLink, Fn as EMPTY_SOCKET_PLANE_BASELINE, Ft as resolveNpmInvocation, G as CapRouteResolver, Gn as recordSocketFrame, Gt as HUB_MAIN_HEAP_WATCH_LABEL, H as createUdsLoggerWithControl, Hn as readSocketQueues, Ht as HEAP_RECLAIM_TRIGGER_MB, I as localProviderLink, In as SOCKET_PLANE_TOP_N, It as runNpm, J as classifyCapRoute, Jn as socketDirectionMessages, Jt as RSS_BUDGET_REANNOUNCE_MIN_MS, K as callWithServiceDiscovery, Kn as sampleSocketDirection, Kt as HUB_MAIN_RSS_BUDGET_MB, L as createParentUnownedCallHandler, Ln as SOCKET_QUEUE_TOP_N, Lt as createAddonPeerBytesFacility, M as brokerTransportLink, Mn as MESH_QUEUE_TOP_N, Mt as installManifestNativeDeps, N as buildLinkChain, Nn as createMeshQueueReader, Nt as resolveAddonClass, O as AddonDepsManager, On as OUTBOUND_QUEUE_SUSTAIN_MS, Ot as DeviceRegistry, P as deviceCapResolverLink, Pn as formatMeshQueue, Pt as buildNpmChildEnv, Q as readMoleculerFanoutMode, Qn as MAX_CAP_ACTIONS_PER_PEER, Qt as ZERO_LOOP_DELAY, R as createUdsEventBridge, Rn as createSocketPlaneMeter, Rt as hostNodeIdOf, S as clusterEventTopic, Sn as emitHeapDiagnosticReport, St as capActionSuffix, T as registerEventBusService, Tn as readHeapSpaces, Tt as parseCapAction, U as AGENT_CAP_FWD_ACTION, Un as EMPTY_SOCKET_DIRECTION, Ut as HEAP_WATCH_INTERVAL_MS, V as createUdsLogger, Vn as formatSocketPlane, Vt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, W as AGENT_CAP_FWD_SERVICE, Wn as createSocketDirectionCounters, Wt as HEAP_WATCH_WARN_RATIO, X as LocalChildRegistry, Xn as CAP_ACTION_UNLABELLED, Xt as RUNNER_HEAP_WATCH_INTERVAL_MS, Y as LocalChildClient, Yn as CAP_ACTION_OVERFLOW_LABEL, Yt as RSS_BUDGET_RELEASE_RATIO, Z as UDS_NO_ROUTE_PREFIX, Zn as EMPTY_CAP_ACTION_READING, Zt as RUNNER_RSS_BUDGET_ENV, _ as getWorkerDeviceRegistry, _n as createInspectorArrayBufferCensus, a as reapProcessGroup, an as nextRssBudgetState, ar as diffEventPlane, at as UdsLocalTransportServer, b as setHubConnected, bn as DECISIVE_HEAP_SPACES, bt as NATIVE_PROVIDER_SERVICE_INFIX, c as runnerOwnsProcessGroup, cn as shouldReclaim, ct as localEndpointPath, d as summarizeMembers, dn as strandedMb, dt as buildNativeCapProxy, en as createDeferredHeapWatchSink, er as createCapActionCensus, et as PARENT_ROUTED_PROVIDER_ADDON_ID, f as installManifestSystemDeps, fn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ft as buildUdsNativeCapProxy, g as createUdsAddonContext, gn as createArrayBufferCensusGate, gt as mountNativeCapService, h as createAddonContext, hn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, in as hubMainRssBudget, ir as createEventPlaneReader, it as UdsLocalTransportClient, j as brokerCallForCap, jn as formatOutboundQueueVerdict, jt as copyBundledNativeModules, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_THRESHOLD_BYTES, kt as CapabilityHandle, l as signalAllRunnerGroups, ln as startHeapWatch, lt as FrameDecoder, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, nn as createV8Reclaimer, nr as EVENT_PLANE_TOP_N, nt as getCapUsageRegistry, o as registerRunnerGroup, on as parseRssBudgetMb, or as formatEventPlane, ot as SocketChannel, p as installManifestPythonDeps, pn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, pt as createBrokerDeviceManagerApi, q as CapRouteError, qn as socketDirectionBytes, qt as HUB_RSS_BUDGET_ENV, r as defaultProcessGroupOps, rn as describeRss, rr as createEventPlaneMeter, rt as createLocalTransport, s as releaseRunnerGroup, sn as reclaimIntervalMs, st as PeerAnsweredError, t as CAP_METHOD_NOT_IMPLEMENTED, tn as createLoopDelayMeter, tr as diffCapActionCensus, tt as __resetCapUsageRegistryForTests, un as startRunnerHeapWatch, ut as encodeFrame, v as getOrInitReadinessRegistry, vn as formatArrayBufferCensus, vt as createAddonService, w as getMoleculerEventStats, wn as heapSpaceField, wt as capServiceName, x as EVENT_TOPIC_PREFIX, xn as HEAP_SPACE_REPORT_MIN_MB, xt as capActionName, y as getOrInitReadinessRegistryForClient, yn as isArrayBufferCensusReport, yt as validateProviderRegistrations, z as createUdsEventBus, zn as createSocketPlaneReader, zt as createAddonDataPlaneFacility } from "./child-cap-dispatch-CHTiHbsv.mjs";
+import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B1v6E07R.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -95008,7 +95008,10 @@ var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
 function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parentUdsPath) {
 	const spawnFn = deps?.spawnFn ?? spawn;
+	const groupOps = deps?.processGroups ?? defaultProcessGroupOps;
+	const runnersOwnGroups = runnerOwnsProcessGroup(deps?.platform ?? process.platform);
 	const processes = /* @__PURE__ */ new Map();
+	const pendingGroupReaps = /* @__PURE__ */ new Map();
 	const runnerLocks = /* @__PURE__ */ new Map();
 	function withRunnerLock(runnerId, fn) {
 		const result = (runnerLocks.get(runnerId) ?? Promise.resolve()).then(fn, fn);
@@ -95048,6 +95051,49 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		}, data));
 	}
 	/**
+	* One line per reap that found something, or that failed. An empty group is the
+	* normal case after a clean stop and stays quiet at debug. The kernel cannot say
+	* which device a child served — the runner id is the finest attribution it has.
+	*/
+	function logGroupReap(runnerId, result) {
+		const found = result.membersAtExit;
+		const killed = result.killed ?? [];
+		const line = `[${runnerId}] runner group reaped {pgid=${result.pgid}, members=${found === null ? "unreadable" : found.length}${found !== null && found.length > 0 ? ` (${summarizeMembers(found)})` : ""}, sigkilled=${killed.length}${killed.length > 0 ? ` (${summarizeMembers(killed)})` : ""}${result.error !== null ? `, error=${result.error}` : ""}}`;
+		const logger = capturedBroker?.logger;
+		if (result.error !== null || killed.length > 0) if (logger) logger.warn(line);
+		else console.error(line);
+		else if ((found?.length ?? 0) > 0 || found === null) logger?.info(line);
+		else logger?.debug(line);
+	}
+	/**
+	* Reap a runner's process group (D668): SIGTERM, a bounded grace, SIGKILL for what
+	* remains. Memoized on the entry so the `exit` handler and a stop/restart that timed
+	* out waiting for that exit share one reap, and registered in `pendingGroupReaps` so
+	* the next spawn under the same id waits for it. Never rejects.
+	*/
+	function reapRunnerGroup(entry) {
+		if (entry.groupReap !== null) return entry.groupReap;
+		if (!entry.ownsGroup) {
+			entry.groupReap = Promise.resolve();
+			return entry.groupReap;
+		}
+		const reap = reapProcessGroup(entry.pid, groupOps).then((result) => logGroupReap(entry.name, result)).catch((err) => {
+			capturedBroker?.logger.error(`[${entry.name}] runner group reap threw: ${err instanceof Error ? err.message : String(err)}`);
+		}).finally(() => {
+			releaseRunnerGroup(entry.pid);
+			if (pendingGroupReaps.get(entry.name) === tracked) pendingGroupReaps.delete(entry.name);
+		});
+		const previous = pendingGroupReaps.get(entry.name);
+		const tracked = previous ? Promise.all([previous, reap]).then(() => void 0) : reap;
+		pendingGroupReaps.set(entry.name, tracked);
+		entry.groupReap = reap;
+		return reap;
+	}
+	/** Resolves once every reap started for `runnerId` has finished. */
+	async function awaitPredecessorReap(runnerId) {
+		await pendingGroupReaps.get(runnerId);
+	}
+	/**
 	* Spawn ONE runner subprocess (`addon-runner.js`) that hosts the
 	* `addons` set sharing a single Moleculer broker. The normal case is
 	* a size-1 `addons` array — one addon, one process; the media group
@@ -95096,8 +95142,9 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				"pipe",
 				"pipe"
 			],
-			detached: false
+			detached: runnersOwnGroups
 		});
+		const ownsGroup = runnersOwnGroups && typeof child.pid === "number" && child.pid > 1;
 		const entry = {
 			pid: child.pid,
 			nodeId,
@@ -95108,16 +95155,23 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			startedAt: Date.now(),
 			restartCount: 0,
 			state: "starting",
-			child
+			child,
+			ownsGroup,
+			groupReap: null
 		};
+		if (ownsGroup) registerRunnerGroup(entry.pid, {
+			runnerId,
+			kill: groupOps.kill
+		});
 		child.stdout?.on("data", (data) => {
-			if (data.toString().includes(`READY:${nodeId}`)) entry.state = "running";
+			if (data.toString().includes(`READY:${nodeId}`) && entry.state === "starting") entry.state = "running";
 		});
 		child.stderr?.on("data", (data) => {
 			process.stderr.write(`[${runnerId}] ${data.toString()}`);
 		});
 		child.on("exit", (code, signal) => {
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
+			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
 			entry.state = "crashed";
 			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
@@ -95156,6 +95210,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
 			setTimeout(() => {
 				withRunnerLock(runnerId, async () => {
+					await groupReap;
 					if (processes.has(runnerId)) return;
 					const restarted = spawnRunner(runnerId, addons, env);
 					restarted.restartCount = entry.restartCount + 1;
@@ -95168,10 +95223,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	return {
 		name: "$process",
 		actions: {
-			spawnRunner: { handler(ctx) {
+			spawnRunner: { async handler(ctx) {
 				const { runnerId, addons, env } = ctx.params;
 				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				if (!Array.isArray(addons) || addons.length === 0) throw new Error(`spawnRunner requires non-empty addons array`);
+				await awaitPredecessorReap(runnerId);
+				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				invalidateHeapProfiles(addons);
 				const entry = spawnRunner(runnerId, addons, env);
 				return {
@@ -95208,6 +95265,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95244,6 +95302,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95303,6 +95362,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 								});
 							});
 						}
+						await reapRunnerGroup(entry);
 						processes.delete(name);
 						crashSupervisor.reset(name);
 						invalidateHeapProfiles(runnerAddons);
@@ -95353,19 +95413,28 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		started() {
 			capturedBroker = this.broker;
 		},
-		stopped() {
-			const survivors = [];
-			for (const entry of processes.values()) {
+		async stopped() {
+			const entries = [...processes.values()];
+			await Promise.all(entries.map(async (entry) => {
 				entry.state = "stopped";
-				entry.child.kill("SIGTERM");
-				survivors.push(entry);
-			}
-			setTimeout(() => {
-				for (const entry of survivors) if (entry.child.exitCode === null && entry.child.signalCode === null) {
-					capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
-					entry.child.kill("SIGKILL");
+				if (!(entry.child.exitCode !== null || entry.child.signalCode !== null)) {
+					entry.child.kill("SIGTERM");
+					await new Promise((resolve) => {
+						const timer = setTimeout(() => {
+							if (entry.child.exitCode === null && entry.child.signalCode === null) {
+								capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
+								entry.child.kill("SIGKILL");
+							}
+							resolve();
+						}, 3e3);
+						entry.child.once("exit", () => {
+							clearTimeout(timer);
+							resolve();
+						});
+					});
 				}
-			}, 3e3).unref();
+				await reapRunnerGroup(entry);
+			}));
 			processes.clear();
 			capturedBroker = null;
 		}
@@ -95849,4 +95918,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -73,6 +73,7 @@ export { localProviderLink, brokerTransportLink, deviceCapResolverLink, ipcParen
 export type { LocalProviderResolver, BrokerCapCallOpts } from './moleculer/trpc-links.js';
 export { createProcessService } from './moleculer/process-service.js';
 export type { ProcessInfo } from './moleculer/process-service.js';
+export { signalAllRunnerGroups } from './moleculer/runner-process-group.js';
 export { CapUsageRegistry, getCapUsageRegistry, PARENT_ROUTED_PROVIDER_ADDON_ID, __resetCapUsageRegistryForTests, } from './moleculer/cap-usage-registry.js';
 export type { CapUsageCallRecord, CapUsageEdge, CapUsageRegistryOptions, CapUsageStats, } from './moleculer/cap-usage-registry.js';
 export { createScopedProcessManager } from './moleculer/process-context.js';

package/dist/kernel/moleculer/process-service.d.ts

@@ -1,5 +1,6 @@
 import { ChildProcess, SpawnOptions } from 'node:child_process';
 import { ServiceSchema } from 'moleculer';
+import { ProcessGroupOps } from './runner-process-group.js';
 /** One addon hosted inside a runner subprocess. */
 interface RunnerAddonSpec {
     readonly addonId: string;
@@ -137,6 +138,10 @@ interface SpawnedProcess {
      */
     state: 'starting' | 'running' | 'stopping' | 'stopped' | 'crashed' | 'failed';
     child: ChildProcess;
+    /** The runner leads its own process group (POSIX, D668); its pgid is its `pid`. */
+    readonly ownsGroup: boolean;
+    /** The reap of this runner's group, once started. Memoized: every exit path shares it. */
+    groupReap: Promise<void> | null;
 }
 interface ProcessInfo {
     readonly pid: number;
@@ -174,6 +179,10 @@ interface ProcessInfo {
 type SpawnFn = (command: string, args: readonly string[], opts: SpawnOptions) => ChildProcess;
 interface ProcessServiceDeps {
     readonly spawnFn?: SpawnFn;
+    /** Group signalling + member listing. Tests inject a fake: a fake pid must never be signalled. */
+    readonly processGroups?: ProcessGroupOps;
+    /** Platform deciding whether a runner leads a process group. Defaults to `process.platform`. */
+    readonly platform?: NodeJS.Platform;
 }
 declare function createProcessService(parentNodeId: string, dataDir: string, deps?: ProcessServiceDeps, parentTcpPort?: number, parentUdsPath?: string): ServiceSchema;
 export type { ProcessInfo, SpawnedProcess };

package/dist/kernel/moleculer/runner-process-group.d.ts

@@ -0,0 +1,92 @@
+/** SIGTERM → SIGKILL grace for a runner's group, in ms. ffmpeg finalises a segment well inside it. */
+export declare const RUNNER_GROUP_REAP_GRACE_MS = 2000;
+/** Whether a runner is spawned as a process-group leader on this platform. */
+export declare function runnerOwnsProcessGroup(platform?: NodeJS.Platform): boolean;
+/** One live (non-zombie) member of a process group. */
+export interface GroupMember {
+    readonly pid: number;
+    /** Executable name (`ffmpeg`, `llama-server`, …). */
+    readonly command: string;
+}
+/**
+ * The OS surface a group reap needs. Injectable so a unit test never signals a real pid:
+ * the fake-spawn suites hand out pids like 70001, and a `kill(-70001)` on a developer's
+ * machine is not a test.
+ */
+export interface ProcessGroupOps {
+    /** `process.kill`. A negative pid addresses a group; signal 0 probes. Throws ESRCH when empty. */
+    readonly kill: (pid: number, signal: NodeJS.Signals | 0) => void;
+    /** Live members of `pgid`, or `null` when the table could not be read. */
+    readonly listMembers: (pgid: number) => Promise<readonly GroupMember[] | null>;
+    readonly sleep: (ms: number) => Promise<void>;
+    readonly graceMs: number;
+}
+/** What one reap did. `membersAtExit === null` means the table was unreadable, not empty. */
+export interface GroupReapResult {
+    readonly pgid: number;
+    readonly membersAtExit: readonly GroupMember[] | null;
+    /** Members still present after the grace, which were sent SIGKILL. */
+    readonly killed: readonly GroupMember[] | null;
+    /** The group was already empty when the reap began — the normal case after a clean stop. */
+    readonly alreadyEmpty: boolean;
+    /** A signal the OS refused for a reason other than ESRCH (EPERM). */
+    readonly error: string | null;
+}
+/**
+ * SIGTERM the whole group, wait up to `graceMs` for it to empty, SIGKILL what is left.
+ *
+ * pid reuse: POSIX never hands out a pid while a process group with that id exists, so
+ * the SIGTERM always lands on our group. The SIGKILL is sent only when the group is
+ * still populated at the end of the grace, which is the same group; the residual window
+ * (group empties, the pid wraps around AND is reused as a new group leader, all inside
+ * the grace) is not reachable in practice.
+ */
+export declare function reapProcessGroup(pgid: number, ops: ProcessGroupOps): Promise<GroupReapResult>;
+/** `ffmpeg×28 llama-server×1` — what a reap line says it removed. */
+export declare function summarizeMembers(members: readonly GroupMember[]): string;
+/** Parse `ps -A -o pid=,pgid=,stat=,comm=` for one group, zombies excluded. */
+export declare function parsePsGroupMembers(stdout: string, pgid: number): readonly GroupMember[];
+/** Live members of `pgid`: `/proc` on Linux, `ps` elsewhere; `null` when neither answers. */
+export declare function listProcessGroupMembers(pgid: number, platform?: NodeJS.Platform): Promise<readonly GroupMember[] | null>;
+export declare const defaultProcessGroupOps: ProcessGroupOps;
+interface OwnedGroup {
+    readonly runnerId: string;
+    readonly kill: ProcessGroupOps['kill'];
+}
+export declare function registerRunnerGroup(pgid: number, group: OwnedGroup): void;
+export declare function releaseRunnerGroup(pgid: number): void;
+/**
+ * Signal every runner group this process owns, synchronously. Hub-main's SIGTERM/SIGINT
+ * handler calls it: before D668 the runners were in hub-main's own group and its
+ * `kill -- -<pid>` reached them and their children; now each is its own group.
+ * Returns how many groups were signalled.
+ */
+export declare function signalAllRunnerGroups(signal: NodeJS.Signals): number;
+/** Test seam: the groups currently owned, by pgid. */
+export declare function ownedRunnerGroupIds(): readonly number[];
+export interface RunnerParentDeathWatchdogOptions {
+    readonly initialPpid?: number;
+    readonly readPpid?: () => number;
+    readonly intervalMs?: number;
+}
+/**
+ * Arm the runner's parent-death watchdog before addon code starts loading.
+ *
+ * A parent can die while an addon module or `initialize()` is still pending, so
+ * installing this only after READY leaves exactly the boot window where a detached
+ * runner can become an orphan. Any PPID change means the direct parent died and the
+ * kernel reparented us; checking for a change also covers a non-PID-1 subreaper.
+ */
+export declare function startRunnerParentDeathWatchdog(onParentDeath: () => void, options?: RunnerParentDeathWatchdogOptions): NodeJS.Timeout | null;
+/**
+ * Last resort for a detached runner whose direct parent disappeared without an
+ * `exit` hook (SIGKILL, native crash). The runner's own pid is also its pgid, so
+ * one SIGKILL removes the runner and every descendant in that group atomically.
+ *
+ * Calling `kill(-process.pid, ...)` from an ordinary, non-group-leading process
+ * returns ESRCH: while this pid exists, no unrelated process group can have the
+ * same id. That makes the failed call a safe compatibility fallback for an older
+ * parent that did not spawn the runner detached.
+ */
+export declare function killOwnRunnerGroupAfterParentLoss(platform?: NodeJS.Platform, kill?: ProcessGroupOps['kill']): boolean;
+export {};

package/dist/proc-stat-CbC55Kqi.mjs

@@ -0,0 +1,92 @@
+import { readFile, readdir } from "node:fs/promises";
+/**
+* Parse one `/proc/<pid>/stat` line. `null` for a line that does not parse —
+* a process that exited between the readdir and the read leaves a truncated
+* or empty file, and that is normal, not an error.
+*/
+function parseProcStat(line) {
+	const close = line.lastIndexOf(")");
+	const open = line.indexOf("(");
+	if (close < 0 || open < 0 || close < open) return null;
+	const pid = Number(line.slice(0, open).trim());
+	const comm = line.slice(open + 1, close);
+	const rest = line.slice(close + 1).trim().split(/\s+/);
+	const state = rest[0];
+	const ppid = Number(rest[1]);
+	const pgid = Number(rest[2]);
+	const utime = Number(rest[11]);
+	const stime = Number(rest[12]);
+	const startTicks = Number(rest[19]);
+	const rssPages = Number(rest[21]);
+	if (state === void 0 || state === "") return null;
+	if (![
+		pid,
+		ppid,
+		pgid,
+		utime,
+		stime,
+		startTicks,
+		rssPages
+	].every(Number.isFinite)) return null;
+	return {
+		pid,
+		comm,
+		state,
+		ppid,
+		pgid,
+		ticks: utime + stime,
+		startTicks,
+		rssPages
+	};
+}
+function statusKb(status, key) {
+	const match = status.match(new RegExp(`^${key}:\\s+(\\d+)`, "m"));
+	return match ? parseInt(match[1], 10) * 1024 : void 0;
+}
+/** Read `VmRSS` / `RssAnon` / `RssFile` (kB in the file) out of `/proc/<pid>/status`. */
+function parseProcStatusRss(status) {
+	return {
+		rssBytes: statusKb(status, "VmRSS"),
+		privateBytes: statusKb(status, "RssAnon"),
+		sharedBytes: statusKb(status, "RssFile")
+	};
+}
+/** Seconds the process has been alive — `ps etime`, whole seconds. */
+function elapsedSecSince(input) {
+	return Math.max(0, Math.floor(input.uptimeSec - input.startTicks / 100));
+}
+/**
+* `ps pcpu`: CPU time over elapsed time, as a percentage with one decimal.
+*
+* This is deliberately the LIFETIME average `ps` prints, not an instantaneous
+* rate: the columns fed from it have always shown that quantity, and the
+* instantaneous split is a different number with a different owner
+* (`cpuMainPercent` / `cpuGcPercent` from `thread-cpu-sampler.ts`). A process
+* with no elapsed window yet reports 0, never a division by zero.
+*/
+function lifetimeCpuPercent(input) {
+	const elapsedSec = input.uptimeSec - input.startTicks / 100;
+	if (!(elapsedSec > 0)) return 0;
+	const cpuSec = input.ticks / 100;
+	return Math.round(cpuSec / elapsedSec * 1e3) / 10;
+}
+var PID_RE = /^\d+$/;
+var nodeProcReader = {
+	listPids: async () => (await readdir("/proc")).filter((entry) => PID_RE.test(entry)).map((entry) => Number(entry)),
+	readStat: (pid) => readFile(`/proc/${pid}/stat`, "latin1"),
+	readStatus: (pid) => readFile(`/proc/${pid}/status`, "latin1"),
+	readCmdline: (pid) => readFile(`/proc/${pid}/cmdline`, "latin1"),
+	readUptimeSec: async () => {
+		const [first] = (await readFile("/proc/uptime", "latin1")).trim().split(/\s+/);
+		const seconds = Number(first);
+		if (!Number.isFinite(seconds)) throw new Error(`/proc/uptime unreadable: ${String(first)}`);
+		return seconds;
+	}
+};
+/** `ps command=`: argv joined by spaces, or `[comm]` when there is no argv. */
+function commandFromCmdline(cmdline, comm) {
+	const joined = cmdline.split("\0").filter((part) => part.length > 0).join(" ");
+	return joined.length > 0 ? joined : `[${comm}]`;
+}
+//#endregion
+export { parseProcStat as a, nodeProcReader as i, elapsedSecSince as n, parseProcStatusRss as o, lifetimeCpuPercent as r, commandFromCmdline as t };

package/dist/proc-stat-DL-WUOhl.js

@@ -0,0 +1,127 @@
+let node_fs_promises = require("node:fs/promises");
+/**
+* Parse one `/proc/<pid>/stat` line. `null` for a line that does not parse —
+* a process that exited between the readdir and the read leaves a truncated
+* or empty file, and that is normal, not an error.
+*/
+function parseProcStat(line) {
+	const close = line.lastIndexOf(")");
+	const open = line.indexOf("(");
+	if (close < 0 || open < 0 || close < open) return null;
+	const pid = Number(line.slice(0, open).trim());
+	const comm = line.slice(open + 1, close);
+	const rest = line.slice(close + 1).trim().split(/\s+/);
+	const state = rest[0];
+	const ppid = Number(rest[1]);
+	const pgid = Number(rest[2]);
+	const utime = Number(rest[11]);
+	const stime = Number(rest[12]);
+	const startTicks = Number(rest[19]);
+	const rssPages = Number(rest[21]);
+	if (state === void 0 || state === "") return null;
+	if (![
+		pid,
+		ppid,
+		pgid,
+		utime,
+		stime,
+		startTicks,
+		rssPages
+	].every(Number.isFinite)) return null;
+	return {
+		pid,
+		comm,
+		state,
+		ppid,
+		pgid,
+		ticks: utime + stime,
+		startTicks,
+		rssPages
+	};
+}
+function statusKb(status, key) {
+	const match = status.match(new RegExp(`^${key}:\\s+(\\d+)`, "m"));
+	return match ? parseInt(match[1], 10) * 1024 : void 0;
+}
+/** Read `VmRSS` / `RssAnon` / `RssFile` (kB in the file) out of `/proc/<pid>/status`. */
+function parseProcStatusRss(status) {
+	return {
+		rssBytes: statusKb(status, "VmRSS"),
+		privateBytes: statusKb(status, "RssAnon"),
+		sharedBytes: statusKb(status, "RssFile")
+	};
+}
+/** Seconds the process has been alive — `ps etime`, whole seconds. */
+function elapsedSecSince(input) {
+	return Math.max(0, Math.floor(input.uptimeSec - input.startTicks / 100));
+}
+/**
+* `ps pcpu`: CPU time over elapsed time, as a percentage with one decimal.
+*
+* This is deliberately the LIFETIME average `ps` prints, not an instantaneous
+* rate: the columns fed from it have always shown that quantity, and the
+* instantaneous split is a different number with a different owner
+* (`cpuMainPercent` / `cpuGcPercent` from `thread-cpu-sampler.ts`). A process
+* with no elapsed window yet reports 0, never a division by zero.
+*/
+function lifetimeCpuPercent(input) {
+	const elapsedSec = input.uptimeSec - input.startTicks / 100;
+	if (!(elapsedSec > 0)) return 0;
+	const cpuSec = input.ticks / 100;
+	return Math.round(cpuSec / elapsedSec * 1e3) / 10;
+}
+var PID_RE = /^\d+$/;
+var nodeProcReader = {
+	listPids: async () => (await (0, node_fs_promises.readdir)("/proc")).filter((entry) => PID_RE.test(entry)).map((entry) => Number(entry)),
+	readStat: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/stat`, "latin1"),
+	readStatus: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/status`, "latin1"),
+	readCmdline: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/cmdline`, "latin1"),
+	readUptimeSec: async () => {
+		const [first] = (await (0, node_fs_promises.readFile)("/proc/uptime", "latin1")).trim().split(/\s+/);
+		const seconds = Number(first);
+		if (!Number.isFinite(seconds)) throw new Error(`/proc/uptime unreadable: ${String(first)}`);
+		return seconds;
+	}
+};
+/** `ps command=`: argv joined by spaces, or `[comm]` when there is no argv. */
+function commandFromCmdline(cmdline, comm) {
+	const joined = cmdline.split("\0").filter((part) => part.length > 0).join(" ");
+	return joined.length > 0 ? joined : `[${comm}]`;
+}
+//#endregion
+Object.defineProperty(exports, "commandFromCmdline", {
+	enumerable: true,
+	get: function() {
+		return commandFromCmdline;
+	}
+});
+Object.defineProperty(exports, "elapsedSecSince", {
+	enumerable: true,
+	get: function() {
+		return elapsedSecSince;
+	}
+});
+Object.defineProperty(exports, "lifetimeCpuPercent", {
+	enumerable: true,
+	get: function() {
+		return lifetimeCpuPercent;
+	}
+});
+Object.defineProperty(exports, "nodeProcReader", {
+	enumerable: true,
+	get: function() {
+		return nodeProcReader;
+	}
+});
+Object.defineProperty(exports, "parseProcStat", {
+	enumerable: true,
+	get: function() {
+		return parseProcStat;
+	}
+});
+Object.defineProperty(exports, "parseProcStatusRss", {
+	enumerable: true,
+	get: function() {
+		return parseProcStatusRss;
+	}
+});

package/dist/{resource-monitor-Vp0bPV3U.mjs → resource-monitor-B1v6E07R.mjs}

@@ -1,5 +1,5 @@
 import { r as __exportAll } from "./chunk-CNf5ZN-e.mjs";
-import { i as parseProcStatusRss, n as nodeProcReader, r as parseProcStat, t as lifetimeCpuPercent } from "./builtins/native-metrics/native-metrics.addon.mjs";
+import { a as parseProcStat, i as nodeProcReader, o as parseProcStatusRss, r as lifetimeCpuPercent } from "./proc-stat-CbC55Kqi.mjs";
 import { execFile } from "node:child_process";
 import { platform } from "node:os";
 //#region src/process/resource-monitor.ts

package/dist/{resource-monitor-LVE1BoLs.js → resource-monitor-DzNn_IZK.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
+const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 //#region src/process/resource-monitor.ts
@@ -22,7 +22,7 @@ function execPsForPids(pids) {
 }
 var defaultDeps = {
 	platform: (0, node_os.platform)(),
-	reader: require_builtins_native_metrics_native_metrics_addon.nodeProcReader,
+	reader: require_proc_stat.nodeProcReader,
 	spawnPs: execPsForPids
 };
 function parsePsOutput(stdout) {
@@ -52,12 +52,12 @@ async function readProcPidStats(pid, uptimeSec, reader) {
 	} catch {
 		return null;
 	}
-	const parsed = require_builtins_native_metrics_native_metrics_addon.parseProcStat(stat);
+	const parsed = require_proc_stat.parseProcStat(stat);
 	if (parsed === null) return null;
-	const rss = require_builtins_native_metrics_native_metrics_addon.parseProcStatusRss(status);
+	const rss = require_proc_stat.parseProcStatusRss(status);
 	if (rss.rssBytes === void 0) return null;
 	return {
-		cpu: require_builtins_native_metrics_native_metrics_addon.lifetimeCpuPercent({
+		cpu: require_proc_stat.lifetimeCpuPercent({
 			ticks: parsed.ticks,
 			startTicks: parsed.startTicks,
 			uptimeSec