@camstack/system 1.2.390 → 1.2.391

package/dist/builtins/remote-access-orchestrator/enabled-providers-reconcile.d.ts

@@ -1,96 +1,96 @@
 /**
- * Pure reconciliation core for the remote-access orchestrator's durable
- * `enabledProviders` set (D8 delivery-rule fix).
- *
- * Why this module exists
- * ----------------------
- * `enabledProviders: string[]` is the operator's "auto-start on boot"
- * intent — a DURABLE setting. Historically it was written ONLY from two
- * fire-and-forget bus events (`NetworkTunnelStarted` / `Stopped`). A
- * dropped event (hub restart, addon crash-respawn, hub↔orchestrator
- * partition) silently diverges the persisted set from reality:
- *   - dropped `Started` → tunnel running, not recorded → no auto-start
- *   - dropped `Stopped` → tunnel stopped, still recorded → boot restarts
- *     an operator-stopped tunnel.
- *
- * A durable setting must not be written by a lossy event. The fix is an
- * idempotent reconcile pass that pulls authoritative state via an
- * ACKNOWLEDGED RPC (`network-access` cap `getStatus`) on every provider
- * (re)connect — mirroring the kernel readiness-registry hydration via
- * `$readiness.getSnapshot`. The lifecycle events stay (still fine for
- * live UI dashboards); only the PERSISTENCE WRITE moves to the RPC pull.
- *
- * Reconcile semantics — ADD-ONLY (deliberately conservative)
- * ----------------------------------------------------------
- * `connected: true` from an acked RPC is UNAMBIGUOUS: the tunnel is up,
- * so the operator must have started it → safe to ADD to `enabledProviders`
- * (recovers a dropped `NetworkTunnelStarted` event).
- *
- * `connected: false` is AMBIGUOUS:
- *   - Provider registered but not yet started (normal cold-boot state,
- *     BEFORE `autoStartEnabledProviders` has called `start()`).
- *   - Provider transiently down (network blip, restart in progress).
- *   - Provider intentionally stopped by the operator.
- * `getStatus()` reports connectivity, NOT operator intent. Acting on
- * `connected: false` would wipe `enabledProviders` on every hub restart
- * (providers re-register ~15-20 s before `start()` is called), defeating
- * the purpose of the durable enabled-set. Therefore the reconcile pass
- * NEVER removes on `connected: false`.
- *
- * Removal of operator intent stays event-driven (`NetworkTunnelStopped`
- * → `markEnabled(id, false)`). That event is emitted synchronously by
- * the provider's own `stop()` call — it is the reliable signal that the
- * operator actually stopped the tunnel. A failed/absent RPC probe also
- * leaves the provider untouched.
- *
- * // Follow-up: covering the dropped-`Stopped` direction (a `Stopped`
- * // event lost → tunnel stopped but still in enabledProviders → boot
- * // wrongly restarts it) would require a provider-side persisted
- * // operator-intent flag that `getStatus()` surfaces. That is a larger
- * // multi-addon change (the audit's "approach 2") and is OUT OF SCOPE
- * // for this backstop. The current fix covers the higher-impact direction
- * // (dropped `Started` → operator's running tunnel not auto-restarted).
- *
- * The function is pure: the addon owns the RPC fan-out + the persist
- * call, so this core is unit-testable without a CapabilityRegistry.
- */
+* Pure reconciliation core for the remote-access orchestrator's durable
+* `enabledProviders` set (D8 delivery-rule fix).
+*
+* Why this module exists
+* ----------------------
+* `enabledProviders: string[]` is the operator's "auto-start on boot"
+* intent — a DURABLE setting. Historically it was written ONLY from two
+* fire-and-forget bus events (`NetworkTunnelStarted` / `Stopped`). A
+* dropped event (hub restart, addon crash-respawn, hub↔orchestrator
+* partition) silently diverges the persisted set from reality:
+*   - dropped `Started` → tunnel running, not recorded → no auto-start
+*   - dropped `Stopped` → tunnel stopped, still recorded → boot restarts
+*     an operator-stopped tunnel.
+*
+* A durable setting must not be written by a lossy event. The fix is an
+* idempotent reconcile pass that pulls authoritative state via an
+* ACKNOWLEDGED RPC (`network-access` cap `getStatus`) on every provider
+* (re)connect — mirroring the kernel readiness-registry hydration via
+* `$readiness.getSnapshot`. The lifecycle events stay (still fine for
+* live UI dashboards); only the PERSISTENCE WRITE moves to the RPC pull.
+*
+* Reconcile semantics — ADD-ONLY (deliberately conservative)
+* ----------------------------------------------------------
+* `connected: true` from an acked RPC is UNAMBIGUOUS: the tunnel is up,
+* so the operator must have started it → safe to ADD to `enabledProviders`
+* (recovers a dropped `NetworkTunnelStarted` event).
+*
+* `connected: false` is AMBIGUOUS:
+*   - Provider registered but not yet started (normal cold-boot state,
+*     BEFORE `autoStartEnabledProviders` has called `start()`).
+*   - Provider transiently down (network blip, restart in progress).
+*   - Provider intentionally stopped by the operator.
+* `getStatus()` reports connectivity, NOT operator intent. Acting on
+* `connected: false` would wipe `enabledProviders` on every hub restart
+* (providers re-register ~15-20 s before `start()` is called), defeating
+* the purpose of the durable enabled-set. Therefore the reconcile pass
+* NEVER removes on `connected: false`.
+*
+* Removal of operator intent stays event-driven (`NetworkTunnelStopped`
+* → `markEnabled(id, false)`). That event is emitted synchronously by
+* the provider's own `stop()` call — it is the reliable signal that the
+* operator actually stopped the tunnel. A failed/absent RPC probe also
+* leaves the provider untouched.
+*
+* // Follow-up: covering the dropped-`Stopped` direction (a `Stopped`
+* // event lost → tunnel stopped but still in enabledProviders → boot
+* // wrongly restarts it) would require a provider-side persisted
+* // operator-intent flag that `getStatus()` surfaces. That is a larger
+* // multi-addon change (the audit's "approach 2") and is OUT OF SCOPE
+* // for this backstop. The current fix covers the higher-impact direction
+* // (dropped `Started` → operator's running tunnel not auto-restarted).
+*
+* The function is pure: the addon owns the RPC fan-out + the persist
+* call, so this core is unit-testable without a CapabilityRegistry.
+*/
 /**
- * Outcome of one provider's `getStatus()` RPC probe.
- *
- * `ok: true`  → the RPC was acknowledged; `connected` is authoritative.
- * `ok: false` → the RPC threw / timed out; state is unknown and the
- *               provider's membership must be left as-is.
- */
+* Outcome of one provider's `getStatus()` RPC probe.
+*
+* `ok: true`  → the RPC was acknowledged; `connected` is authoritative.
+* `ok: false` → the RPC threw / timed out; state is unknown and the
+*               provider's membership must be left as-is.
+*/
 export type ProviderProbeResult = {
-    readonly addonId: string;
-    readonly ok: true;
-    readonly connected: boolean;
+	readonly addonId: string;
+	readonly ok: true;
+	readonly connected: boolean;
 } | {
-    readonly addonId: string;
-    readonly ok: false;
+	readonly addonId: string;
+	readonly ok: false;
 };
 export interface ReconcileResult {
-    /** The corrected enabled-set, sorted for stable persistence. */
-    readonly nextEnabled: readonly string[];
-    /** `true` when `nextEnabled` differs from the input — caller persists only then. */
-    readonly changed: boolean;
-    /** addonIds added because an acked RPC reported them connected. */
-    readonly added: readonly string[];
-    /**
-     * Always empty — reconcile is add-only. Removal of operator intent is
-     * event-driven (`NetworkTunnelStopped`). Kept in the type so callers
-     * that log `result.removed` continue to compile without changes.
-     */
-    readonly removed: readonly string[];
+	/** The corrected enabled-set, sorted for stable persistence. */
+	readonly nextEnabled: readonly string[];
+	/** `true` when `nextEnabled` differs from the input — caller persists only then. */
+	readonly changed: boolean;
+	/** addonIds added because an acked RPC reported them connected. */
+	readonly added: readonly string[];
+	/**
+	* Always empty — reconcile is add-only. Removal of operator intent is
+	* event-driven (`NetworkTunnelStopped`). Kept in the type so callers
+	* that log `result.removed` continue to compile without changes.
+	*/
+	readonly removed: readonly string[];
 }
 /**
- * Reconcile the durable `enabledProviders` set against authoritative
- * RPC probe results. Pure — no I/O. ADD-ONLY: only adds providers whose
- * acked `getStatus()` reports `connected: true`. Never removes on
- * `connected: false` — see module doc for the full rationale.
- *
- * @param currentEnabled - the persisted enabled-set before reconcile.
- * @param probes - one entry per provider whose `getStatus()` RPC was
- *   attempted this pass. Providers absent from this list are untouched.
- */
+* Reconcile the durable `enabledProviders` set against authoritative
+* RPC probe results. Pure — no I/O. ADD-ONLY: only adds providers whose
+* acked `getStatus()` reports `connected: true`. Never removes on
+* `connected: false` — see module doc for the full rationale.
+*
+* @param currentEnabled - the persisted enabled-set before reconcile.
+* @param probes - one entry per provider whose `getStatus()` RPC was
+*   attempted this pass. Providers absent from this list are untouched.
+*/
 export declare function reconcileEnabledProviders(currentEnabled: readonly string[], probes: readonly ProviderProbeResult[]): ReconcileResult;

package/dist/builtins/remote-access-orchestrator/index.d.ts

@@ -1 +1 @@
-export { RemoteAccessOrchestratorAddon, default } from './remote-access-orchestrator.addon.js';
+export { RemoteAccessOrchestratorAddon, default } from "./remote-access-orchestrator.addon.js";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.d.ts

@@ -1,40 +1,71 @@
-import { BaseAddon, ProviderRegistration } from '@camstack/types';
+/**
+* Remote-access orchestrator — backend-only boot-autostart service for
+* the `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).
+*
+* Retired its `remote-access` facade cap (2026-05-15): the admin UI now
+* talks to the `network-access` collection cap directly via generic
+* per-`addonId` routing, so this addon registers NO capability.
+*
+* What it still owns — the load-bearing logic:
+*   The orchestrator owns the "operator wants this provider running"
+*   intent — an `enabledProviders: string[]` slice in its addon-store
+*   blob (BaseAddon.config). On boot we iterate the list and call
+*   `provider.start()` for each enabled entry, so a tunnel set up once
+*   stays up across hub restarts.
+*
+*   Since start/stop no longer flow through this addon, the enabled-set
+*   is kept in sync from two sources:
+*     1. `NetworkTunnelStarted` / `NetworkTunnelStopped` bus events —
+*        fast, but lossy (fire-and-forget broadcasts). They drive both
+*        the live UI and removal from the durable set (`Stopped` is the
+*        only reliable "operator stopped it" signal).
+*     2. An RPC-driven ADD-ONLY RECONCILE pass (`reconcileEnabledProviders`)
+*        that pulls authoritative `connected` state via the `network-access`
+*        cap's `getStatus()` on every provider (re)connect. THIS covers
+*        dropped `NetworkTunnelStarted` events — if `connected: true` is
+*        acked, the provider is added to `enabledProviders`. It NEVER
+*        removes on `connected: false` because that signal is ambiguous
+*        (registered-not-yet-started vs transiently-down vs intentionally
+*        stopped). Running before `autoStartEnabledProviders` is safe:
+*        it can only add already-connected providers, never evict.
+*/
+import { BaseAddon, type ProviderRegistration } from "@camstack/types";
 interface RemoteAccessOrchestratorConfig {
-    /**
-     * addonIds the operator has explicitly Started. Auto-respawned on
-     * boot so a tunnel set up once stays up across hub restarts.
-     */
-    readonly enabledProviders: readonly string[];
+	/**
+	* addonIds the operator has explicitly Started. Auto-respawned on
+	* boot so a tunnel set up once stays up across hub restarts.
+	*/
+	readonly enabledProviders: readonly string[];
 }
 export declare class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {
-    constructor();
-    protected onInitialize(): Promise<ProviderRegistration[]>;
-    /**
-     * Maintain the persisted `enabledProviders` set from a tunnel
-     * lifecycle event. `source.id` is `string | number`; `network-access`
-     * providers emit with `type: 'addon'` so it is always the addonId
-     * string. Non-string / non-addon sources are ignored defensively.
-     */
-    private onTunnelLifecycle;
-    /**
-     * Probe every locally-visible `network-access` provider's
-     * `getStatus()` over RPC and reconcile the durable `enabledProviders`
-     * set against the result. This is the D8 backstop for dropped
-     * `NetworkTunnelStarted` events: if `connected: true` is acked, the
-     * provider is added to `enabledProviders`. ADD-ONLY — never removes on
-     * `connected: false` (see enabled-providers-reconcile.ts for rationale).
-     *
-     * `getStatus()` is an acknowledged cap RPC — a transport blip surfaces
-     * as a rejected promise (recorded as `ok: false`, membership left
-     * untouched), never as a silent lossy write. Runs on every provider
-     * (re)connect via the `watchCapability` hooks, mirroring the kernel
-     * readiness-registry hydration on `$node.connected`. Safe to call
-     * before `autoStartEnabledProviders`: add-only semantics mean it cannot
-     * wipe the enabled-set even when providers are registered-not-yet-started.
-     */
-    private reconcileAndPersist;
-    private autoStartEnabledProviders;
-    private markEnabled;
-    private resolveImpl;
+	constructor();
+	protected onInitialize(): Promise<ProviderRegistration[]>;
+	/**
+	* Maintain the persisted `enabledProviders` set from a tunnel
+	* lifecycle event. `source.id` is `string | number`; `network-access`
+	* providers emit with `type: 'addon'` so it is always the addonId
+	* string. Non-string / non-addon sources are ignored defensively.
+	*/
+	private onTunnelLifecycle;
+	/**
+	* Probe every locally-visible `network-access` provider's
+	* `getStatus()` over RPC and reconcile the durable `enabledProviders`
+	* set against the result. This is the D8 backstop for dropped
+	* `NetworkTunnelStarted` events: if `connected: true` is acked, the
+	* provider is added to `enabledProviders`. ADD-ONLY — never removes on
+	* `connected: false` (see enabled-providers-reconcile.ts for rationale).
+	*
+	* `getStatus()` is an acknowledged cap RPC — a transport blip surfaces
+	* as a rejected promise (recorded as `ok: false`, membership left
+	* untouched), never as a silent lossy write. Runs on every provider
+	* (re)connect via the `watchCapability` hooks, mirroring the kernel
+	* readiness-registry hydration on `$node.connected`. Safe to call
+	* before `autoStartEnabledProviders`: add-only semantics mean it cannot
+	* wipe the enabled-set even when providers are registered-not-yet-started.
+	*/
+	private reconcileAndPersist;
+	private autoStartEnabledProviders;
+	private markEnabled;
+	private resolveImpl;
 }
 export default RemoteAccessOrchestratorAddon;

package/dist/builtins/shared/device-state-changed.d.ts

@@ -1,15 +1,15 @@
 /**
- * The ONE cast-free narrowing of the `device.state-changed` payload. The
- * category is not part of the typed `EventCatalog` — every subscriber validates
- * at the boundary, and the builtins share this one narrowing instead of a
- * verbatim copy each (D659), like `./settle-sources.ts`; addons never import
- * each other, and its consumers live in this package.
- */
+* The ONE cast-free narrowing of the `device.state-changed` payload. The
+* category is not part of the typed `EventCatalog` — every subscriber validates
+* at the boundary, and the builtins share this one narrowing instead of a
+* verbatim copy each (D659), like `./settle-sources.ts`; addons never import
+* each other, and its consumers live in this package.
+*/
 /** Narrowed payload of a `DeviceStateChanged` bus event. */
 export interface DeviceStateChangedData {
-    readonly deviceId: number;
-    readonly capName: string;
-    readonly slice: Readonly<Record<string, unknown>>;
+	readonly deviceId: number;
+	readonly capName: string;
+	readonly slice: Readonly<Record<string, unknown>>;
 }
 /** Structural narrowing helper for untrusted bus payloads. */
 export declare function isRecord(value: unknown): value is Readonly<Record<string, unknown>>;

package/dist/builtins/shared/settle-sources.d.ts

@@ -1,22 +1,22 @@
 /**
- * settleSourcesWithTimeout — parallel, per-source-timeout fan-out shared by
- * the addon-pages / addon-widgets aggregators.
- *
- * Each source is called concurrently and raced against `timeoutMs`. A source
- * that rejects OR exceeds the timeout yields a `{ ok: false, error }` result
- * instead of blocking or failing the whole batch. This is the defense that
- * keeps ONE slow/unreachable source — e.g. an agent-hosted source whose cap
- * call sits in a 30s Moleculer `waitForServices` — from stalling the
- * aggregator's `listPages()/listWidgets()` (which otherwise hangs long enough
- * to trip the admin-ui WS keepalive → "server unreachable") or blanking the
- * sidebar. Entry order is preserved in the returned array.
- */
+* settleSourcesWithTimeout — parallel, per-source-timeout fan-out shared by
+* the addon-pages / addon-widgets aggregators.
+*
+* Each source is called concurrently and raced against `timeoutMs`. A source
+* that rejects OR exceeds the timeout yields a `{ ok: false, error }` result
+* instead of blocking or failing the whole batch. This is the defense that
+* keeps ONE slow/unreachable source — e.g. an agent-hosted source whose cap
+* call sits in a 30s Moleculer `waitForServices` — from stalling the
+* aggregator's `listPages()/listWidgets()` (which otherwise hangs long enough
+* to trip the admin-ui WS keepalive → "server unreachable") or blanking the
+* sidebar. Entry order is preserved in the returned array.
+*/
 /** Per-source outcome: the source's items, or the error that prevented them. */
 export type SourceResult<T> = {
-    readonly ok: true;
-    readonly value: readonly T[];
+	readonly ok: true;
+	readonly value: readonly T[];
 } | {
-    readonly ok: false;
-    readonly error: Error;
+	readonly ok: false;
+	readonly error: Error;
 };
 export declare function settleSourcesWithTimeout<T>(entries: ReadonlyArray<readonly [string, () => Promise<readonly T[]>]>, timeoutMs: number): Promise<ReadonlyArray<readonly [string, SourceResult<T>]>>;

package/dist/builtins/snapshot/index.d.ts

@@ -1,2 +1,2 @@
-export { SnapshotAddon } from './snapshot.addon.js';
-export { SnapshotAddon as default } from './snapshot.addon.js';
+export { SnapshotAddon } from "./snapshot.addon.js";
+export { SnapshotAddon as default } from "./snapshot.addon.js";

package/dist/builtins/snapshot/snapshot-cache.d.ts

@@ -1,108 +1,108 @@
 /**
- * The per-device snapshot cache, keyed by (device, STREAM).
- *
- * It used to be keyed by device alone, and `getSnapshot` served the hit before
- * it had resolved which stream the caller asked for — so `?streamId=low`
- * silently returned whatever was already cached. In production that meant the
- * 4K main frame: probing a live camera with `low`, `sub` and `high` returned
- * three byte-identical 1.2 MB responses. The parameter existed, was documented,
- * and did nothing.
- *
- * Two views still need to ask a device-wide question — "when did this camera
- * last produce a frame" (`getSnapshotOverview`, `getStatus`) — so
- * {@link SnapshotCache.latest} answers it across streams rather than making
- * every caller guess a key.
- */
+* The per-device snapshot cache, keyed by (device, STREAM).
+*
+* It used to be keyed by device alone, and `getSnapshot` served the hit before
+* it had resolved which stream the caller asked for — so `?streamId=low`
+* silently returned whatever was already cached. In production that meant the
+* 4K main frame: probing a live camera with `low`, `sub` and `high` returned
+* three byte-identical 1.2 MB responses. The parameter existed, was documented,
+* and did nothing.
+*
+* Two views still need to ask a device-wide question — "when did this camera
+* last produce a frame" (`getSnapshotOverview`, `getStatus`) — so
+* {@link SnapshotCache.latest} answers it across streams rather than making
+* every caller guess a key.
+*/
 /** The cached frame. Structurally the addon's `SnapshotImage` — declared here
- *  rather than imported so the cache does not depend on the 1,100-line addon. */
+*  rather than imported so the cache does not depend on the 1,100-line addon. */
 export interface SnapshotCacheImage {
-    readonly base64: string;
-    readonly contentType: string;
+	readonly base64: string;
+	readonly contentType: string;
 }
 export interface SnapshotCacheEntry {
-    readonly data: SnapshotCacheImage;
-    readonly ts: number;
-    /** Stream id resolved at capture time — 'high' | 'mid' | 'low' | custom | null. */
-    readonly streamId: string | null;
+	readonly data: SnapshotCacheImage;
+	readonly ts: number;
+	/** Stream id resolved at capture time — 'high' | 'mid' | 'low' | custom | null. */
+	readonly streamId: string | null;
 }
 /**
- * Byte budget across every cached frame.
- *
- * The cache shipped with NO bound of any kind: no TTL, no LRU, no size cap. It
- * holds base64 JPEG payloads — a 4K main-stream frame is ~1.6 MB as base64 —
- * keyed by (device, stream), so the ceiling was "every camera × every stream it
- * was ever asked for", which is not a ceiling.
- *
- * 64 MiB is roughly 40 main-stream frames, comfortably above the live 27-camera
- * roster's working set (the whole `snapshot` runner measures 185 MB RSS, of
- * which the node baseline is ~130 MB), so nothing an operator does today starts
- * evicting. It exists so a roster that grows, or a device that gets probed on
- * many stream ids, cannot walk this structure into the OOM.
- */
+* Byte budget across every cached frame.
+*
+* The cache shipped with NO bound of any kind: no TTL, no LRU, no size cap. It
+* holds base64 JPEG payloads — a 4K main-stream frame is ~1.6 MB as base64 —
+* keyed by (device, stream), so the ceiling was "every camera × every stream it
+* was ever asked for", which is not a ceiling.
+*
+* 64 MiB is roughly 40 main-stream frames, comfortably above the live 27-camera
+* roster's working set (the whole `snapshot` runner measures 185 MB RSS, of
+* which the node baseline is ~130 MB), so nothing an operator does today starts
+* evicting. It exists so a roster that grows, or a device that gets probed on
+* many stream ids, cannot walk this structure into the OOM.
+*/
 export declare const SNAPSHOT_CACHE_MAX_BYTES: number;
 /**
- * Drop an entry nobody has READ for this long.
- *
- * Deliberately an IDLE timeout and not a capture-age one. Capture age is
- * already governed per device by `snapshotMaxAgeS` (default 15s, but one HOUR
- * for battery cameras), so a TTL on age would either fight those rules or have
- * to sit above the largest of them and bound nothing. "Nobody has looked at
- * this in an hour" is orthogonal to freshness and is the actual condition under
- * which the bytes are dead weight — a removed camera, an unreachable one, a
- * stream id probed once by a debug view.
- */
-export declare const SNAPSHOT_CACHE_IDLE_TTL_MS = 3600000;
+* Drop an entry nobody has READ for this long.
+*
+* Deliberately an IDLE timeout and not a capture-age one. Capture age is
+* already governed per device by `snapshotMaxAgeS` (default 15s, but one HOUR
+* for battery cameras), so a TTL on age would either fight those rules or have
+* to sit above the largest of them and bound nothing. "Nobody has looked at
+* this in an hour" is orthogonal to freshness and is the actual condition under
+* which the bytes are dead weight — a removed camera, an unreachable one, a
+* stream id probed once by a debug view.
+*/
+export declare const SNAPSHOT_CACHE_IDLE_TTL_MS = 36e5;
 /** Why an entry was dropped. `budget` = the byte ceiling; `idle` = unread for
- *  {@link SNAPSHOT_CACHE_IDLE_TTL_MS}. */
-export type SnapshotCacheEvictReason = 'budget' | 'idle';
+*  {@link SNAPSHOT_CACHE_IDLE_TTL_MS}. */
+export type SnapshotCacheEvictReason = "budget" | "idle";
 /** Notified for every eviction so the owner can put it on the record with the
- *  device tag. A cached frame that vanishes is the explanation for a later
- *  capture that did not have to happen; silence reads as "never happened". */
+*  device tag. A cached frame that vanishes is the explanation for a later
+*  capture that did not have to happen; silence reads as "never happened". */
 export type SnapshotCacheEvictListener = (deviceId: number, streamId: string | null, reason: SnapshotCacheEvictReason) => void;
 export interface SnapshotCacheOptions {
-    /** Total base64 bytes held across all entries. Default {@link SNAPSHOT_CACHE_MAX_BYTES}. */
-    readonly maxBytes?: number;
-    /** Idle timeout. Default {@link SNAPSHOT_CACHE_IDLE_TTL_MS}. */
-    readonly idleTtlMs?: number;
-    /** Injected clock — the bounds must be testable without waiting an hour. */
-    readonly now?: () => number;
-    readonly onEvict?: SnapshotCacheEvictListener;
+	/** Total base64 bytes held across all entries. Default {@link SNAPSHOT_CACHE_MAX_BYTES}. */
+	readonly maxBytes?: number;
+	/** Idle timeout. Default {@link SNAPSHOT_CACHE_IDLE_TTL_MS}. */
+	readonly idleTtlMs?: number;
+	/** Injected clock — the bounds must be testable without waiting an hour. */
+	readonly now?: () => number;
+	readonly onEvict?: SnapshotCacheEvictListener;
 }
 export declare class SnapshotCache {
-    private readonly byKey;
-    /** deviceId → its live keys, so invalidation is O(streams) not O(cache). */
-    private readonly keysByDevice;
-    private readonly maxBytes;
-    private readonly idleTtlMs;
-    private readonly now;
-    private readonly onEvict;
-    private totalBytes;
-    constructor(options?: SnapshotCacheOptions);
-    get(deviceId: number, streamId: string | undefined): SnapshotCacheEntry | undefined;
-    set(deviceId: number, streamId: string | undefined, entry: SnapshotCacheEntry): void;
-    /** The newest entry for a device, whichever stream produced it. */
-    latest(deviceId: number): SnapshotCacheEntry | undefined;
-    /** Base64 bytes currently retained. The number the budget is enforced on. */
-    sizeBytes(): number;
-    /** Entries currently retained. */
-    entryCount(): number;
-    /** Read through the idle timeout: an entry nobody has touched inside
-     *  `idleTtlMs` is dropped here rather than on a sweep, so the cost is paid by
-     *  the caller that proves it was not wanted. */
-    private read;
-    /** Evict least-recently-ACCESSED first until the budget holds. `protectedKey`
-     *  is the entry just written — evicting it would make `set` a no-op. */
-    private enforceBudget;
-    private evict;
-    /** Remove a key and everything that indexes or accounts for it. */
-    private forget;
-    /**
-     * Drop every stream of one device.
-     *
-     * Device-wide on purpose: a settings change or an operator refresh
-     * invalidates the CAMERA, and leaving a sibling entry behind would keep
-     * serving the pre-change frame from the other key.
-     */
-    deleteDevice(deviceId: number): void;
-    clear(): void;
+	private readonly byKey;
+	/** deviceId → its live keys, so invalidation is O(streams) not O(cache). */
+	private readonly keysByDevice;
+	private readonly maxBytes;
+	private readonly idleTtlMs;
+	private readonly now;
+	private readonly onEvict;
+	private totalBytes;
+	constructor(options?: SnapshotCacheOptions);
+	get(deviceId: number, streamId: string | undefined): SnapshotCacheEntry | undefined;
+	set(deviceId: number, streamId: string | undefined, entry: SnapshotCacheEntry): void;
+	/** The newest entry for a device, whichever stream produced it. */
+	latest(deviceId: number): SnapshotCacheEntry | undefined;
+	/** Base64 bytes currently retained. The number the budget is enforced on. */
+	sizeBytes(): number;
+	/** Entries currently retained. */
+	entryCount(): number;
+	/** Read through the idle timeout: an entry nobody has touched inside
+	*  `idleTtlMs` is dropped here rather than on a sweep, so the cost is paid by
+	*  the caller that proves it was not wanted. */
+	private read;
+	/** Evict least-recently-ACCESSED first until the budget holds. `protectedKey`
+	*  is the entry just written — evicting it would make `set` a no-op. */
+	private enforceBudget;
+	private evict;
+	/** Remove a key and everything that indexes or accounts for it. */
+	private forget;
+	/**
+	* Drop every stream of one device.
+	*
+	* Device-wide on purpose: a settings change or an operator refresh
+	* invalidates the CAMERA, and leaving a sibling entry behind would keep
+	* serving the pre-change frame from the other key.
+	*/
+	deleteDevice(deviceId: number): void;
+	clear(): void;
 }