@camstack/system 1.2.390 → 1.2.391

package/dist/kernel/moleculer/runner-process-group.d.ts

@@ -1,46 +1,46 @@
 /** SIGTERM → SIGKILL grace for a runner's group, in ms. ffmpeg finalises a segment well inside it. */
-export declare const RUNNER_GROUP_REAP_GRACE_MS = 2000;
+export declare const RUNNER_GROUP_REAP_GRACE_MS = 2e3;
 /** Whether a runner is spawned as a process-group leader on this platform. */
 export declare function runnerOwnsProcessGroup(platform?: NodeJS.Platform): boolean;
 /** One live (non-zombie) member of a process group. */
 export interface GroupMember {
-    readonly pid: number;
-    /** Executable name (`ffmpeg`, `llama-server`, …). */
-    readonly command: string;
+	readonly pid: number;
+	/** Executable name (`ffmpeg`, `llama-server`, …). */
+	readonly command: string;
 }
 /**
- * The OS surface a group reap needs. Injectable so a unit test never signals a real pid:
- * the fake-spawn suites hand out pids like 70001, and a `kill(-70001)` on a developer's
- * machine is not a test.
- */
+* The OS surface a group reap needs. Injectable so a unit test never signals a real pid:
+* the fake-spawn suites hand out pids like 70001, and a `kill(-70001)` on a developer's
+* machine is not a test.
+*/
 export interface ProcessGroupOps {
-    /** `process.kill`. A negative pid addresses a group; signal 0 probes. Throws ESRCH when empty. */
-    readonly kill: (pid: number, signal: NodeJS.Signals | 0) => void;
-    /** Live members of `pgid`, or `null` when the table could not be read. */
-    readonly listMembers: (pgid: number) => Promise<readonly GroupMember[] | null>;
-    readonly sleep: (ms: number) => Promise<void>;
-    readonly graceMs: number;
+	/** `process.kill`. A negative pid addresses a group; signal 0 probes. Throws ESRCH when empty. */
+	readonly kill: (pid: number, signal: NodeJS.Signals | 0) => void;
+	/** Live members of `pgid`, or `null` when the table could not be read. */
+	readonly listMembers: (pgid: number) => Promise<readonly GroupMember[] | null>;
+	readonly sleep: (ms: number) => Promise<void>;
+	readonly graceMs: number;
 }
 /** What one reap did. `membersAtExit === null` means the table was unreadable, not empty. */
 export interface GroupReapResult {
-    readonly pgid: number;
-    readonly membersAtExit: readonly GroupMember[] | null;
-    /** Members still present after the grace, which were sent SIGKILL. */
-    readonly killed: readonly GroupMember[] | null;
-    /** The group was already empty when the reap began — the normal case after a clean stop. */
-    readonly alreadyEmpty: boolean;
-    /** A signal the OS refused for a reason other than ESRCH (EPERM). */
-    readonly error: string | null;
+	readonly pgid: number;
+	readonly membersAtExit: readonly GroupMember[] | null;
+	/** Members still present after the grace, which were sent SIGKILL. */
+	readonly killed: readonly GroupMember[] | null;
+	/** The group was already empty when the reap began — the normal case after a clean stop. */
+	readonly alreadyEmpty: boolean;
+	/** A signal the OS refused for a reason other than ESRCH (EPERM). */
+	readonly error: string | null;
 }
 /**
- * SIGTERM the whole group, wait up to `graceMs` for it to empty, SIGKILL what is left.
- *
- * pid reuse: POSIX never hands out a pid while a process group with that id exists, so
- * the SIGTERM always lands on our group. The SIGKILL is sent only when the group is
- * still populated at the end of the grace, which is the same group; the residual window
- * (group empties, the pid wraps around AND is reused as a new group leader, all inside
- * the grace) is not reachable in practice.
- */
+* SIGTERM the whole group, wait up to `graceMs` for it to empty, SIGKILL what is left.
+*
+* pid reuse: POSIX never hands out a pid while a process group with that id exists, so
+* the SIGTERM always lands on our group. The SIGKILL is sent only when the group is
+* still populated at the end of the grace, which is the same group; the residual window
+* (group empties, the pid wraps around AND is reused as a new group leader, all inside
+* the grace) is not reachable in practice.
+*/
 export declare function reapProcessGroup(pgid: number, ops: ProcessGroupOps): Promise<GroupReapResult>;
 /** `ffmpeg×28 llama-server×1` — what a reap line says it removed. */
 export declare function summarizeMembers(members: readonly GroupMember[]): string;
@@ -50,43 +50,43 @@ export declare function parsePsGroupMembers(stdout: string, pgid: number): reado
 export declare function listProcessGroupMembers(pgid: number, platform?: NodeJS.Platform): Promise<readonly GroupMember[] | null>;
 export declare const defaultProcessGroupOps: ProcessGroupOps;
 interface OwnedGroup {
-    readonly runnerId: string;
-    readonly kill: ProcessGroupOps['kill'];
+	readonly runnerId: string;
+	readonly kill: ProcessGroupOps["kill"];
 }
 export declare function registerRunnerGroup(pgid: number, group: OwnedGroup): void;
 export declare function releaseRunnerGroup(pgid: number): void;
 /**
- * Signal every runner group this process owns, synchronously. Hub-main's SIGTERM/SIGINT
- * handler calls it: before D668 the runners were in hub-main's own group and its
- * `kill -- -<pid>` reached them and their children; now each is its own group.
- * Returns how many groups were signalled.
- */
+* Signal every runner group this process owns, synchronously. Hub-main's SIGTERM/SIGINT
+* handler calls it: before D668 the runners were in hub-main's own group and its
+* `kill -- -<pid>` reached them and their children; now each is its own group.
+* Returns how many groups were signalled.
+*/
 export declare function signalAllRunnerGroups(signal: NodeJS.Signals): number;
 /** Test seam: the groups currently owned, by pgid. */
 export declare function ownedRunnerGroupIds(): readonly number[];
 export interface RunnerParentDeathWatchdogOptions {
-    readonly initialPpid?: number;
-    readonly readPpid?: () => number;
-    readonly intervalMs?: number;
+	readonly initialPpid?: number;
+	readonly readPpid?: () => number;
+	readonly intervalMs?: number;
 }
 /**
- * Arm the runner's parent-death watchdog before addon code starts loading.
- *
- * A parent can die while an addon module or `initialize()` is still pending, so
- * installing this only after READY leaves exactly the boot window where a detached
- * runner can become an orphan. Any PPID change means the direct parent died and the
- * kernel reparented us; checking for a change also covers a non-PID-1 subreaper.
- */
+* Arm the runner's parent-death watchdog before addon code starts loading.
+*
+* A parent can die while an addon module or `initialize()` is still pending, so
+* installing this only after READY leaves exactly the boot window where a detached
+* runner can become an orphan. Any PPID change means the direct parent died and the
+* kernel reparented us; checking for a change also covers a non-PID-1 subreaper.
+*/
 export declare function startRunnerParentDeathWatchdog(onParentDeath: () => void, options?: RunnerParentDeathWatchdogOptions): NodeJS.Timeout | null;
 /**
- * Last resort for a detached runner whose direct parent disappeared without an
- * `exit` hook (SIGKILL, native crash). The runner's own pid is also its pgid, so
- * one SIGKILL removes the runner and every descendant in that group atomically.
- *
- * Calling `kill(-process.pid, ...)` from an ordinary, non-group-leading process
- * returns ESRCH: while this pid exists, no unrelated process group can have the
- * same id. That makes the failed call a safe compatibility fallback for an older
- * parent that did not spawn the runner detached.
- */
-export declare function killOwnRunnerGroupAfterParentLoss(platform?: NodeJS.Platform, kill?: ProcessGroupOps['kill']): boolean;
+* Last resort for a detached runner whose direct parent disappeared without an
+* `exit` hook (SIGKILL, native crash). The runner's own pid is also its pgid, so
+* one SIGKILL removes the runner and every descendant in that group atomically.
+*
+* Calling `kill(-process.pid, ...)` from an ordinary, non-group-leading process
+* returns ESRCH: while this pid exists, no unrelated process group can have the
+* same id. That makes the failed call a safe compatibility fallback for an older
+* parent that did not spawn the runner detached.
+*/
+export declare function killOwnRunnerGroupAfterParentLoss(platform?: NodeJS.Platform, kill?: ProcessGroupOps["kill"]): boolean;
 export {};

package/dist/kernel/moleculer/runtime-state-load.d.ts

@@ -1,19 +1,29 @@
-import { IScopedLogger } from '@camstack/types';
+/**
+* The runtime-state load a worker hydrates a device from (D677).
+*
+* `deviceManager.loadRuntimeState` answers the device's stored slices. A load
+* that FAILED is not an empty row: hydrating a provider from `{}` builds the
+* device on cold-start defaults (Reolink's onboard AI "no restored state —
+* OFF"), and the provider's first writes then carry those defaults over the
+* restored values. So a build whose load did not answer is REFUSED, by name,
+* with `tags.deviceId` — never quietly started empty (D49, D391).
+*/
+import type { IScopedLogger } from "@camstack/types";
 /** Where the load was for — named on the refusal line. */
-export type RuntimeStateLoadPhase = 'create' | 'accessory-child' | 'rebuild' | 'context';
+export type RuntimeStateLoadPhase = "create" | "accessory-child" | "rebuild" | "context";
 /** A device build refused because its runtime state could not be loaded. */
 export declare class RuntimeStateLoadError extends Error {
-    readonly deviceId: number;
-    constructor(deviceId: number, reason: string, options?: ErrorOptions);
+	readonly deviceId: number;
+	constructor(deviceId: number, reason: string, options?: ErrorOptions);
 }
 export interface RuntimeStateLoadTarget {
-    readonly deviceId: number;
-    readonly stableId: string;
-    readonly phase: RuntimeStateLoadPhase;
+	readonly deviceId: number;
+	readonly stableId: string;
+	readonly phase: RuntimeStateLoadPhase;
 }
 /**
- * Load the device's runtime state, or throw {@link RuntimeStateLoadError}
- * after one warn naming the device. An answer that is not an object is a
- * failed load too — it would hydrate as nothing.
- */
+* Load the device's runtime state, or throw {@link RuntimeStateLoadError}
+* after one warn naming the device. An answer that is not an object is a
+* failed load too — it would hydrate as nothing.
+*/
 export declare function loadRuntimeStateOrRefuse(load: () => Promise<unknown>, logger: IScopedLogger, target: RuntimeStateLoadTarget): Promise<Record<string, unknown>>;

package/dist/kernel/moleculer/settings-read-guard.d.ts

@@ -1,49 +1,49 @@
 /**
- * Read-modify-write guard for the addon settings stores.
- *
- * ## The data loss this prevents
- *
- * Every settings mutation is `read current → merge patch → write back`. The
- * read used to answer `{}` for BOTH "this addon has no settings yet" and "the
- * read failed", so a failed read merged the patch onto nothing and the write
- * persisted a blob containing ONLY the patch. Everything else in it was gone.
- *
- * It happened on 2026-07-31. The UDS transport stalled, `settings write failed
- * (addon-settings/root) — transport error ... UDS request timed out after
- * 60000ms` appeared in the log, and the recording configuration for all three
- * recording cameras came back as `{"enabled": false, "bands": []}`. Two and a
- * half hours of footage were never written, and nothing looked broken: an
- * emptied config is indistinguishable from an operator switching recording off.
- *
- * The rule this module enforces: **a read that FAILED is not an empty value.**
- * A miss still merges onto `{}` — that is a real empty. A failure refuses the
- * write and says so, leaving the stored blob untouched so the next successful
- * write starts from the truth.
- */
+* Read-modify-write guard for the addon settings stores.
+*
+* ## The data loss this prevents
+*
+* Every settings mutation is `read current → merge patch → write back`. The
+* read used to answer `{}` for BOTH "this addon has no settings yet" and "the
+* read failed", so a failed read merged the patch onto nothing and the write
+* persisted a blob containing ONLY the patch. Everything else in it was gone.
+*
+* It happened on 2026-07-31. The UDS transport stalled, `settings write failed
+* (addon-settings/root) — transport error ... UDS request timed out after
+* 60000ms` appeared in the log, and the recording configuration for all three
+* recording cameras came back as `{"enabled": false, "bands": []}`. Two and a
+* half hours of footage were never written, and nothing looked broken: an
+* emptied config is indistinguishable from an operator switching recording off.
+*
+* The rule this module enforces: **a read that FAILED is not an empty value.**
+* A miss still merges onto `{}` — that is a real empty. A failure refuses the
+* write and says so, leaving the stored blob untouched so the next successful
+* write starts from the truth.
+*/
 /**
- * Outcome of a settings read. `missing` and `failed` are deliberately distinct
- * — collapsing them is the bug.
- */
+* Outcome of a settings read. `missing` and `failed` are deliberately distinct
+* — collapsing them is the bug.
+*/
 export type SettingsRead = {
-    readonly kind: 'value';
-    readonly value: Record<string, unknown>;
+	readonly kind: "value";
+	readonly value: Record<string, unknown>;
 } | {
-    readonly kind: 'missing';
+	readonly kind: "missing";
 } | {
-    readonly kind: 'failed';
-    readonly error: string;
+	readonly kind: "failed";
+	readonly error: string;
 };
 export interface ReadModifyWriteInput {
-    readonly read: () => Promise<SettingsRead>;
-    readonly write: (next: Record<string, unknown>) => Promise<void>;
-    readonly patch: Record<string, unknown>;
-    /** Called instead of writing when the read failed — always log this. */
-    readonly onRefused: (error: string) => void;
+	readonly read: () => Promise<SettingsRead>;
+	readonly write: (next: Record<string, unknown>) => Promise<void>;
+	readonly patch: Record<string, unknown>;
+	/** Called instead of writing when the read failed — always log this. */
+	readonly onRefused: (error: string) => void;
 }
 /**
- * Merge `patch` over the current value and write it — unless the read failed,
- * in which case write NOTHING.
- *
- * Returns whether the write was attempted, so a caller can surface the refusal.
- */
+* Merge `patch` over the current value and write it — unless the read failed,
+* in which case write NOTHING.
+*
+* Returns whether the write was attempted, so a caller can surface the refusal.
+*/
 export declare function readModifyWrite(input: ReadModifyWriteInput): Promise<boolean>;

package/dist/kernel/moleculer/stream-probe-service.d.ts

@@ -1,9 +1,28 @@
-import { ServiceSchema } from 'moleculer';
-import { IKernelStreamProbe } from '@camstack/types';
 /**
- * Hub-side dependencies for the `$stream-probe` broker service.
- * Matches `IKernelStreamProbe` exactly so the same function references
- * are reused for hub-direct injection and worker broker routing.
- */
+* Hub-side `$stream-probe` Moleculer service. Exposes the same two
+* operations the tRPC `streamProbe` router does — `probe(url, force?)`
+* and `probeField(key, value)` — but via a broker action name so that
+* forked workers / remote agents reach it through the already-wired
+* Moleculer transport without needing the HTTPS tRPC WSS link.
+*
+* Why not reuse the tRPC router? Workers default to
+* `brokerTransportLink` when `CAMSTACK_HUB_API_URL` isn't set; the link
+* naively maps every `op.path` to `<addonId>.<capName>.<method>` and
+* fails with "Service not found" for core (non-capability) routers.
+* `$stream-probe` is the canonical cross-process entrypoint — the
+* browser still reaches the tRPC flavour via HTTPS for the "Test"
+* button, but provider addons use this service so auto-profile
+* classification works from any forked worker.
+*
+* The service name is prefixed with `$` so it doesn't show up in the
+* addon / capability graph (same convention as `$hub`, `$readiness`).
+*/
+import type { ServiceSchema } from "moleculer";
+import type { IKernelStreamProbe } from "@camstack/types";
+/**
+* Hub-side dependencies for the `$stream-probe` broker service.
+* Matches `IKernelStreamProbe` exactly so the same function references
+* are reused for hub-direct injection and worker broker routing.
+*/
 export type StreamProbeBrokerDeps = IKernelStreamProbe;
 export declare function createStreamProbeBrokerService(deps: StreamProbeBrokerDeps): ServiceSchema;