@camstack/system 1.2.425 → 1.2.426

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $t as looseSchema, Ar as expandCapMethods, Dn as scopesAllowAddon, Gr as readinessKey, Hr as parseJsonObject, Ht as isVoidInput, Jr as scopeKey, Jt as lifecycleJobSchema, K as addonSettingsCapability, Kr as resolveCapMount, Lt as isArrayOutputSchema, M as METHOD_ACCESS_MAP, On as scopesAllowDeviceCap, Or as emitDownForOwnedCaps, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Tr as createEvent$1, Ur as parseJsonUnknown, Ut as kebabToCamel$1, Vt as isObjectInput, br as asNumber, cn as objectInputDeclaresAddonId, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, gr as ReadinessTimeoutError, hr as ReadinessRegistry, jt as extractNestedAddonId, k as LOG_LEVEL_RANK, ln as objectInputDeclaresRequiredDeviceId, mn as procedureAuthKey, mr as RUNTIME_DEFAULTS, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory$1, ur as DATAPLANE_SECRET_HEADER$1, wn as resolveMethodAuth, xr as asString$1, yr as asJsonObject$1, zn as supportedRuntimes } from "./dist-DMWeqeTF.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-CCHXAtrs.mjs";
+import { $t as looseSchema, Ar as expandCapMethods, Dn as scopesAllowAddon, Gr as readinessKey, Hr as parseJsonObject, Ht as isVoidInput, Jr as scopeKey, Jt as lifecycleJobSchema, K as addonSettingsCapability, Kr as resolveCapMount, Lt as isArrayOutputSchema, M as METHOD_ACCESS_MAP, On as scopesAllowDeviceCap, Or as emitDownForOwnedCaps, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Tr as createEvent$1, Ur as parseJsonUnknown, Ut as kebabToCamel$1, Vt as isObjectInput, br as asNumber, cn as objectInputDeclaresAddonId, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, gr as ReadinessTimeoutError, hr as ReadinessRegistry, jt as extractNestedAddonId, k as LOG_LEVEL_RANK, ln as objectInputDeclaresRequiredDeviceId, mn as procedureAuthKey, mr as RUNTIME_DEFAULTS, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory$1, ur as DATAPLANE_SECRET_HEADER$1, wn as resolveMethodAuth, xr as asString$1, yr as asJsonObject$1, zn as supportedRuntimes } from "./dist-CGz9u2HD.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-C_w5ielw.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,12 +21,12 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-BtfyfuT5.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-BZhzoxqA.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CkNLi-XW.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-B6YTf0v2.mjs";
 import { A as AGENT_UI_UNLOCK_TTL_MS, B as isMeshAuthMode, C as generateMeshCa, D as loadMeshCa, E as issueMeshLeafFromCsr, F as parseAgentDashboardOrigins, G as setProcessMeshEnforcer, H as requestProcessMeshEnforcement, I as verifyAgentUiUnlockTicket, J as parseCidrList, K as createCidrMatcher, L as MESH_AUTH_MODE_FIELD, M as UnlockTicketJtiStore, N as isAllowedAgentDashboardReturnTo, O as AGENT_DASHBOARD_ORIGINS_FIELD, P as mintAgentUiUnlockTicket, R as getProcessMeshAuthMode, S as exportMeshPrivateKeyPem, SystemConfigAddon, T as issueMeshLeafForNode, U as setProcessMeshAuthMode, V as parseMeshAuthMode, W as setProcessMeshAuthStatusSource, Y as readCidrSetting, _ as getProcessMeshCaState, a as ServiceBroker, b as caFingerprintCompact, c as JoinTokenJtiStore, d as verifyMeshJoinToken, f as getProcessNodeMeshTransport, g as MeshCaKeeper, h as processMeshCrl, i as Errors, j as AGENT_UI_UNLOCK_VERSION, k as AGENT_UI_UNLOCK_DOMAIN, l as mintMeshJoinToken, m as MeshCrl, n as MESH_TLS_PORT_HELLO_FIELD, o as setProcessMeshTlsEnabler, p as setProcessMeshPeerTransportLookup, q as normalizeIp, r as TlsTcpTransporter, s as enrollMeshNode, u as processJoinTokenJtiStore, v as requireProcessMeshCa, w as generateMeshKeyPair, x as createMeshCsrPem, y as caFingerprint, z as getProcessMeshAuthStatus } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
@@ -34,7 +34,7 @@ import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-GevpOHw8.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CZyUM8Qf.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -25365,6 +25365,273 @@ var CrashSupervisor = class {
 		this.crashes.delete(runnerId);
 	}
 };
+//#endregion
+//#region src/kernel/moleculer/runner-heap-flags.ts
+var EMPTY_HEAP_DECLARATION = {
+	profile: void 0,
+	maxOldSpaceMb: void 0,
+	rssBudgetMb: void 0,
+	semiSpaceMb: void 0,
+	initialOldSpaceMb: void 0
+};
+/**
+* `execution.semiSpaceMb` is accepted in `[1, 256]` MB. V8 itself clamps the flag to its
+* own limits (the 64-bit default is 64 MB after Node 24's scavenger change, a 256 MB
+* semi-space is three times anything measured useful here); below 1 MB the flag is
+* meaningless. Outside the range the declaration is IGNORED (the runner keeps its class
+* default) rather than clamped: a clamped number silently becomes a different setting from
+* the one in the file, and the spawn log would then say something the manifest does not.
+*/
+var SEMI_SPACE_MB_RANGE = {
+	min: 1,
+	max: 256
+};
+/**
+* `execution.initialOldSpaceMb` is accepted in `[16, 65536]` MB. Below 16 MB V8's default
+* already starts larger; 64 GB clears any runner in this fleet. The accepted value is then
+* clamped at spawn to the runner's old-space CEILING (`runnerHeapFlags`) — V8 refuses an
+* initial size above `--max-old-space-size`, and the ceiling is the one number that belongs
+* to the runner as a whole.
+*/
+var INITIAL_OLD_SPACE_MB_RANGE = {
+	min: 16,
+	max: 65536
+};
+/** An integer MB inside `range`, else `undefined` — a non-integer is floored first. */
+function mbInRange(value, range) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return void 0;
+	const mb = Math.floor(value);
+	return mb >= range.min && mb <= range.max ? mb : void 0;
+}
+/**
+* Resolve the declared heap profile + old-space ceiling for one addon by reading its package.json
+* manifest (`camstack.addons[].execution.{heapProfile,maxOldSpaceMb}`). `addonDir` points at the
+* addon's built `dist`, so the manifest is one level up; we also try `addonDir` itself for layouts
+* where it IS the package root.
+* Result is cached per (dir,id) — spawns are infrequent but a runner may re-spawn on crash/restart.
+* Returns an empty declaration when the manifest is unreadable → treated as light, default ceiling.
+*/
+var heapProfileCache = /* @__PURE__ */ new Map();
+function readAddonHeapDeclaration(spec) {
+	const cacheKey = `${spec.addonDir}::${spec.addonId}`;
+	const cached = heapProfileCache.get(cacheKey);
+	if (cached !== void 0) return cached;
+	let declaration = EMPTY_HEAP_DECLARATION;
+	for (const manifestPath of [path$1.join(spec.addonDir, "package.json"), path$1.join(path$1.dirname(spec.addonDir), "package.json")]) try {
+		const raw = fs.readFileSync(manifestPath, "utf8");
+		const parsed = JSON.parse(raw);
+		const profile = extractHeapProfile(parsed, spec.addonId);
+		const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
+		const rssBudgetMb = extractRssBudgetMb(parsed, spec.addonId);
+		const semiSpaceMb = extractSemiSpaceMb(parsed, spec.addonId);
+		const initialOldSpaceMb = extractInitialOldSpaceMb(parsed, spec.addonId);
+		if (profile !== void 0 || maxOldSpaceMb !== void 0 || rssBudgetMb !== void 0 || semiSpaceMb !== void 0 || initialOldSpaceMb !== void 0) {
+			declaration = {
+				profile,
+				maxOldSpaceMb,
+				rssBudgetMb,
+				semiSpaceMb,
+				initialOldSpaceMb
+			};
+			break;
+		}
+		if (manifestHasAddon(parsed, spec.addonId)) break;
+	} catch {}
+	heapProfileCache.set(cacheKey, declaration);
+	return declaration;
+}
+/**
+* Drop the cached heap declaration for each addon so the NEXT `readAddonHeapDeclaration`
+* re-reads the manifest from disk. Called on operator-driven spawns / restarts
+* (a deploy may have changed `execution.heapProfile` / `execution.maxOldSpaceMb`); the
+* crash-respawn fast path deliberately does NOT invalidate — a crashing runner
+* has the same on-disk manifest, so re-reading it is pure overhead.
+*/
+function invalidateHeapProfiles(addons) {
+	for (const spec of addons) heapProfileCache.delete(`${spec.addonDir}::${spec.addonId}`);
+}
+function manifestHasAddon(parsed, addonId) {
+	return readManifestAddons(parsed).some((a) => a.id === addonId);
+}
+function extractHeapProfile(parsed, addonId) {
+	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.heapProfile;
+	return value === "heavy" || value === "light" ? value : void 0;
+}
+function extractMaxOldSpaceMb(parsed, addonId) {
+	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.maxOldSpaceMb;
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
+}
+/**
+* `execution.rssBudgetMb` for one addon. Only a POSITIVE finite number is a budget: unlike
+* `maxOldSpaceMb`, `0` here is not an escape hatch that lifts a cap, it is an absent budget —
+* and an absent budget is reported as "unwatched", never rounded into a default.
+*/
+function extractRssBudgetMb(parsed, addonId) {
+	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.rssBudgetMb;
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+}
+/** `execution.semiSpaceMb` for one addon — only a value inside {@link SEMI_SPACE_MB_RANGE}. */
+function extractSemiSpaceMb(parsed, addonId) {
+	return mbInRange(readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.semiSpaceMb, SEMI_SPACE_MB_RANGE);
+}
+/** `execution.initialOldSpaceMb` for one addon — only a value inside {@link INITIAL_OLD_SPACE_MB_RANGE}. */
+function extractInitialOldSpaceMb(parsed, addonId) {
+	return mbInRange(readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.initialOldSpaceMb, INITIAL_OLD_SPACE_MB_RANGE);
+}
+function readManifestAddons(parsed) {
+	if (typeof parsed !== "object" || parsed === null) return [];
+	const camstack = parsed.camstack;
+	if (typeof camstack !== "object" || camstack === null) return [];
+	const addons = camstack.addons;
+	return Array.isArray(addons) ? addons : [];
+}
+/**
+* A runner is heavy if ANY co-located addon declares `heapProfile: 'heavy'` in its manifest.
+* Everything else (the un-annotated default) is a light control-plane runner. No hard-coded names.
+*/
+function isHeavyRunner(addons) {
+	return addons.some((a) => readAddonHeapDeclaration(a).profile === "heavy");
+}
+/**
+* Default old-space ceiling for a HEAVY runner, in MB.
+*
+* ## Why a heavy runner needs a ceiling at all
+*
+* `heapProfile: 'heavy'` used to mean "V8 defaults", i.e. no `--max-old-space-size` — which on this
+* host is V8's own memory-derived default (multiple GB). Nothing then bounds a burst, and V8 does
+* not hand committed pages back (the long argument for that is in `kernel/heap-watch.ts`), so a
+* one-off burst becomes the runner's permanent RSS.
+*
+* Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
+* there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
+* **58 MB**.
+*
+* ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
+* and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
+* 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
+* index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
+* `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
+* 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
+* ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
+* segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
+*
+* The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
+* no reason to collect" is the explanation to reach for last, not first.
+*
+* ## Why 1024
+*
+* From the same live topology snapshot, every heavy runner's FULL RSS — which is a strict
+* over-estimate of its old space, since it also contains native allocations, `external` and
+* `arrayBuffers`, none of which `--max-old-space-size` bounds:
+*
+*   detection 471 MB · provider-reolink 507 MB · pipeline-orchestrator 238 MB · ml 218 MB ·
+*   snapshot 185 MB · decoder-nodeav 174 MB · audio-analyzer 170 MB
+*
+* 1024 MB clears the largest of those by ~2x while cutting the recorder's observed ratchet by
+* more than half. It is a CEILING, not a target: a runner that fits today keeps behaving exactly
+* as it does now, because V8 only collects harder as it approaches the limit.
+*
+* A runner whose working set genuinely does not fit declares its own number in its manifest
+* (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
+* `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+* from RSS.
+*
+* ## What this flag CANNOT do
+*
+* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
+*/
+var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
+/**
+* The runner's old-space ceiling in MB, or 0 for "uncapped".
+*
+* The runner takes the MAXIMUM ceiling any co-located addon declares — co-location must never
+* silence the hungriest member (D2/D29: a runner is respawned as a whole, so an OOM caused by
+* under-sizing one member kills every addon in the group). An addon declaring `0` therefore lifts
+* the cap for the whole runner, which is the intended escape hatch.
+*/
+function runnerMaxOldSpaceMb(addons, heavy) {
+	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
+	if (declared.length === 0) return envDefault;
+	if (declared.includes(0)) return 0;
+	return Math.max(...declared);
+}
+/**
+* The runner's declared RSS budget in MB, or `undefined` when NOBODY declared one.
+*
+* Same rule as the old-space ceiling, for the same reason (D2/D29): the runner takes the MAXIMUM
+* any co-located addon declares, because a runner is respawned as a whole and co-location must
+* never silence the hungriest member. It would be strictly worse here than for a heap ceiling —
+* an under-sized budget does not kill anything, it just cries wolf, and a watchdog that cries
+* wolf is a watchdog that gets muted.
+*
+* `undefined` propagates as an ABSENT env var, and the child then announces itself unwatched.
+* There is deliberately no class default: see `AddonExecution.rssBudgetMb`.
+*/
+function runnerRssBudgetMb(addons) {
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).rssBudgetMb).filter((mb) => mb !== void 0);
+	return declared.length === 0 ? void 0 : Math.max(...declared);
+}
+/**
+* Per-placement V8 flags (Block D). LIGHT runners cap their young generation
+* (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
+* V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
+* ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
+* hit) and carry no old-space cap unless a manifest declares one. HEAVY
+* runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
+* {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
+*
+* The per-addon overrides are the manifest's declared `maxOldSpaceMb` (`0` = uncapped),
+* `semiSpaceMb` (`--max-semi-space-size`, replacing the class default) and
+* `initialOldSpaceMb` (`--initial-old-space-size`, clamped to the ceiling) — each the MAXIMUM
+* across a runner's co-located addons. Shipped for `stream-broker` alone (8 / 512): with the
+* heavy class default the hub's broker ran ~166 major GCs a minute and not one scavenge, at
+* 45–60 % of a core. The environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill
+* switch were removed on 2026-10-06 — nothing had set them since the rollout. The flags must
+* be on the spawn command line: `v8.setFlagsFromString` at runtime changes neither space.
+*/
+function runnerHeapFlags(addons) {
+	const heavy = isHeavyRunner(addons);
+	const flags = [];
+	const semiMb = runnerSemiSpaceMb(addons) ?? (heavy ? void 0 : 2);
+	if (semiMb !== void 0) flags.push(`--max-semi-space-size=${semiMb}`);
+	if (!heavy) flags.push(`--v8-pool-size=2`);
+	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
+	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
+	const initialOldMb = runnerInitialOldSpaceMb(addons);
+	if (initialOldMb !== void 0) {
+		const bounded = oldMb > 0 ? Math.min(initialOldMb, oldMb) : initialOldMb;
+		flags.push(`--initial-old-space-size=${bounded}`);
+	}
+	return flags;
+}
+/**
+* The runner's declared young-generation semi-space in MB, or `undefined` when no
+* co-located addon declares one (→ the class default applies).
+*
+* The MAXIMUM across the group, like every other declaration here (D2/D29): the
+* member that measured its churn away must not be handed a smaller young
+* generation because a quieter co-tenant declared one.
+*/
+function runnerSemiSpaceMb(addons) {
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).semiSpaceMb).filter((mb) => mb !== void 0);
+	return declared.length === 0 ? void 0 : Math.max(...declared);
+}
+/**
+* The runner's declared initial old space in MB, or `undefined` when nobody declares
+* one (→ V8 grows it from the live set). MAXIMUM across the group, same rule and same
+* reason as {@link runnerSemiSpaceMb}; the clamp to the runner's ceiling happens in
+* {@link runnerHeapFlags}, where the ceiling is known.
+*/
+function runnerInitialOldSpaceMb(addons) {
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).initialOldSpaceMb).filter((mb) => mb !== void 0);
+	return declared.length === 0 ? void 0 : Math.max(...declared);
+}
 /**
 * Resolve the native-allocator env for a child runner from the parent's env.
 *
@@ -25694,199 +25961,6 @@ async function getPidStats$1(pids) {
 	});
 	return result;
 }
-var EMPTY_HEAP_DECLARATION = {
-	profile: void 0,
-	maxOldSpaceMb: void 0,
-	rssBudgetMb: void 0
-};
-/**
-* Resolve the declared heap profile + old-space ceiling for one addon by reading its package.json
-* manifest (`camstack.addons[].execution.{heapProfile,maxOldSpaceMb}`). `addonDir` points at the
-* addon's built `dist`, so the manifest is one level up; we also try `addonDir` itself for layouts
-* where it IS the package root.
-* Result is cached per (dir,id) — spawns are infrequent but a runner may re-spawn on crash/restart.
-* Returns an empty declaration when the manifest is unreadable → treated as light, default ceiling.
-*/
-var heapProfileCache = /* @__PURE__ */ new Map();
-function readAddonHeapDeclaration(spec) {
-	const cacheKey = `${spec.addonDir}::${spec.addonId}`;
-	const cached = heapProfileCache.get(cacheKey);
-	if (cached !== void 0) return cached;
-	let declaration = EMPTY_HEAP_DECLARATION;
-	for (const manifestPath of [path$1.join(spec.addonDir, "package.json"), path$1.join(path$1.dirname(spec.addonDir), "package.json")]) try {
-		const raw = fs.readFileSync(manifestPath, "utf8");
-		const parsed = JSON.parse(raw);
-		const profile = extractHeapProfile(parsed, spec.addonId);
-		const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
-		const rssBudgetMb = extractRssBudgetMb(parsed, spec.addonId);
-		if (profile !== void 0 || maxOldSpaceMb !== void 0 || rssBudgetMb !== void 0) {
-			declaration = {
-				profile,
-				maxOldSpaceMb,
-				rssBudgetMb
-			};
-			break;
-		}
-		if (manifestHasAddon(parsed, spec.addonId)) break;
-	} catch {}
-	heapProfileCache.set(cacheKey, declaration);
-	return declaration;
-}
-/**
-* Drop the cached heap declaration for each addon so the NEXT `readAddonHeapDeclaration`
-* re-reads the manifest from disk. Called on operator-driven spawns / restarts
-* (a deploy may have changed `execution.heapProfile` / `execution.maxOldSpaceMb`); the
-* crash-respawn fast path deliberately does NOT invalidate — a crashing runner
-* has the same on-disk manifest, so re-reading it is pure overhead.
-*/
-function invalidateHeapProfiles(addons) {
-	for (const spec of addons) heapProfileCache.delete(`${spec.addonDir}::${spec.addonId}`);
-}
-function manifestHasAddon(parsed, addonId) {
-	return readManifestAddons(parsed).some((a) => a.id === addonId);
-}
-function extractHeapProfile(parsed, addonId) {
-	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.heapProfile;
-	return value === "heavy" || value === "light" ? value : void 0;
-}
-function extractMaxOldSpaceMb(parsed, addonId) {
-	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.maxOldSpaceMb;
-	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
-}
-/**
-* `execution.rssBudgetMb` for one addon. Only a POSITIVE finite number is a budget: unlike
-* `maxOldSpaceMb`, `0` here is not an escape hatch that lifts a cap, it is an absent budget —
-* and an absent budget is reported as "unwatched", never rounded into a default.
-*/
-function extractRssBudgetMb(parsed, addonId) {
-	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.rssBudgetMb;
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
-}
-function readManifestAddons(parsed) {
-	if (typeof parsed !== "object" || parsed === null) return [];
-	const camstack = parsed.camstack;
-	if (typeof camstack !== "object" || camstack === null) return [];
-	const addons = camstack.addons;
-	return Array.isArray(addons) ? addons : [];
-}
-/**
-* A runner is heavy if ANY co-located addon declares `heapProfile: 'heavy'` in its manifest.
-* Everything else (the un-annotated default) is a light control-plane runner. No hard-coded names.
-*/
-function isHeavyRunner(addons) {
-	return addons.some((a) => readAddonHeapDeclaration(a).profile === "heavy");
-}
-/**
-* Default old-space ceiling for a HEAVY runner, in MB.
-*
-* ## Why a heavy runner needs a ceiling at all
-*
-* `heapProfile: 'heavy'` used to mean "V8 defaults", i.e. no `--max-old-space-size` — which on this
-* host is V8's own memory-derived default (multiple GB). Nothing then bounds a burst, and V8 does
-* not hand committed pages back (the long argument for that is in `kernel/heap-watch.ts`), so a
-* one-off burst becomes the runner's permanent RSS.
-*
-* Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
-* there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
-* **58 MB**.
-*
-* ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
-* and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
-* 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
-* index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
-* `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
-* 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
-* ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
-* segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
-*
-* The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
-* no reason to collect" is the explanation to reach for last, not first.
-*
-* ## Why 1024
-*
-* From the same live topology snapshot, every heavy runner's FULL RSS — which is a strict
-* over-estimate of its old space, since it also contains native allocations, `external` and
-* `arrayBuffers`, none of which `--max-old-space-size` bounds:
-*
-*   detection 471 MB · provider-reolink 507 MB · pipeline-orchestrator 238 MB · ml 218 MB ·
-*   snapshot 185 MB · decoder-nodeav 174 MB · audio-analyzer 170 MB
-*
-* 1024 MB clears the largest of those by ~2x while cutting the recorder's observed ratchet by
-* more than half. It is a CEILING, not a target: a runner that fits today keeps behaving exactly
-* as it does now, because V8 only collects harder as it approaches the limit.
-*
-* A runner whose working set genuinely does not fit declares its own number in its manifest
-* (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
-* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
-* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
-* from RSS.
-*
-* ## What this flag CANNOT do
-*
-* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
-* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
-* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
-* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
-*/
-var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
-/** Light runners' young-generation semi-space, in MB. */
-var LIGHT_SEMI_SPACE_MB = 2;
-/**
-* The runner's old-space ceiling in MB, or 0 for "uncapped".
-*
-* The runner takes the MAXIMUM ceiling any co-located addon declares — co-location must never
-* silence the hungriest member (D2/D29: a runner is respawned as a whole, so an OOM caused by
-* under-sizing one member kills every addon in the group). An addon declaring `0` therefore lifts
-* the cap for the whole runner, which is the intended escape hatch.
-*/
-function runnerMaxOldSpaceMb(addons, heavy) {
-	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
-	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
-	if (declared.length === 0) return envDefault;
-	if (declared.includes(0)) return 0;
-	return Math.max(...declared);
-}
-/**
-* The runner's declared RSS budget in MB, or `undefined` when NOBODY declared one.
-*
-* Same rule as the old-space ceiling, for the same reason (D2/D29): the runner takes the MAXIMUM
-* any co-located addon declares, because a runner is respawned as a whole and co-location must
-* never silence the hungriest member. It would be strictly worse here than for a heap ceiling —
-* an under-sized budget does not kill anything, it just cries wolf, and a watchdog that cries
-* wolf is a watchdog that gets muted.
-*
-* `undefined` propagates as an ABSENT env var, and the child then announces itself unwatched.
-* There is deliberately no class default: see `AddonExecution.rssBudgetMb`.
-*/
-function runnerRssBudgetMb(addons) {
-	const declared = addons.map((a) => readAddonHeapDeclaration(a).rssBudgetMb).filter((mb) => mb !== void 0);
-	return declared.length === 0 ? void 0 : Math.max(...declared);
-}
-/**
-* Per-placement V8 flags (Block D). LIGHT runners cap their young generation
-* (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
-* V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
-* ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
-* hit) and carry no old-space cap unless a manifest declares one. HEAVY
-* runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
-* {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
-*
-* The per-addon override is the manifest's declared `maxOldSpaceMb` (`0` = uncapped); the
-* environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill switch were removed on
-* 2026-10-06 — nothing had set them since the rollout.
-*/
-function runnerHeapFlags(addons) {
-	const heavy = isHeavyRunner(addons);
-	const flags = [];
-	if (!heavy) {
-		flags.push(`--max-semi-space-size=${LIGHT_SEMI_SPACE_MB}`);
-		flags.push(`--v8-pool-size=2`);
-	}
-	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
-	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
-	return flags;
-}
 var MAX_BACKOFF_MS = 3e4;
 var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;

package/dist/{jwt-signing-key-DeqG7LD9.js → jwt-signing-key-BdDy9ZJN.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DnALrQF-.js");
+const require_dist = require("./dist-K3WFop9Q.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-CCHXAtrs.mjs → jwt-signing-key-C_w5ielw.mjs}

@@ -1,4 +1,4 @@
-import { Sr as buildSecretRef } from "./dist-DMWeqeTF.mjs";
+import { Sr as buildSecretRef } from "./dist-CGz9u2HD.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/kernel/moleculer/process-service.d.ts

@@ -1,116 +1,7 @@
 import { type ChildProcess, type SpawnOptions } from "node:child_process";
 import type { ServiceSchema } from "moleculer";
+import { type RunnerAddonSpec } from "./runner-heap-flags.js";
 import { type ProcessGroupOps } from "./runner-process-group.js";
-/** One addon hosted inside a runner subprocess. */
-interface RunnerAddonSpec {
-	readonly addonId: string;
-	readonly addonDir: string;
-}
-/**
-* Default old-space ceiling for a HEAVY runner, in MB.
-*
-* ## Why a heavy runner needs a ceiling at all
-*
-* `heapProfile: 'heavy'` used to mean "V8 defaults", i.e. no `--max-old-space-size` — which on this
-* host is V8's own memory-derived default (multiple GB). Nothing then bounds a burst, and V8 does
-* not hand committed pages back (the long argument for that is in `kernel/heap-watch.ts`), so a
-* one-off burst becomes the runner's permanent RSS.
-*
-* Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
-* there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
-* **58 MB**.
-*
-* ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
-* and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
-* 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
-* index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
-* `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
-* 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
-* ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
-* segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
-*
-* The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
-* no reason to collect" is the explanation to reach for last, not first.
-*
-* ## Why 1024
-*
-* From the same live topology snapshot, every heavy runner's FULL RSS — which is a strict
-* over-estimate of its old space, since it also contains native allocations, `external` and
-* `arrayBuffers`, none of which `--max-old-space-size` bounds:
-*
-*   detection 471 MB · provider-reolink 507 MB · pipeline-orchestrator 238 MB · ml 218 MB ·
-*   snapshot 185 MB · decoder-nodeav 174 MB · audio-analyzer 170 MB
-*
-* 1024 MB clears the largest of those by ~2x while cutting the recorder's observed ratchet by
-* more than half. It is a CEILING, not a target: a runner that fits today keeps behaving exactly
-* as it does now, because V8 only collects harder as it approaches the limit.
-*
-* A runner whose working set genuinely does not fit declares its own number in its manifest
-* (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
-* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
-* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
-* from RSS.
-*
-* ## What this flag CANNOT do
-*
-* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
-* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
-* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
-* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
-*/
-export declare const HEAVY_MAX_OLD_MB_DEFAULT = 1024;
-/**
-* V8 platform worker threads for a LIGHT runner (`--v8-pool-size`).
-*
-* ## What this bounds
-*
-* Node gives every process a V8 platform thread pool — background compilation,
-* parallel marking and sweeping — defaulted to 4. It is not the libuv pool
-* (`UV_THREADPOOL_SIZE`, which serves `fs`/`dns`/`zlib`/`crypto`) and it is
-* deliberately not touched here; see below.
-*
-* ## Why it is worth a flag
-*
-* A container cgroup counts THREADS, not processes, and this cluster forks a
-* runner per addon (D2). Measured on the live hub 2026-09-18 (20 cores,
-* `pids.max=2048`), after 22 fork refusals in 45 minutes earlier that day:
-*
-*   pids.current 991 · 47 node processes holding 469 threads
-*   of those, 29 LIGHT runners holding 274 (mean 9.4 threads each)
-*
-* A light runner is a control-plane addon with a 2 MB young generation. It does
-* not generate the background GC work four marking threads exist for, and it
-* pays 4 threads of the cgroup's pid budget for them anyway. Two returns ~58
-* threads — ~6% of the container's live thread count — for background GC that
-* is, on these heaps, a few milliseconds a cycle.
-*
-* ## Why TWO and never ZERO
-*
-* `--v8-pool-size=0` does not disable the pool: it tells V8 to size it from the
-* detected parallelism. Measured locally 2026-09-18 on a node process holding
-* the libuv pool open:
-*
-*   default            11 threads
-*   --v8-pool-size=2    9 threads
-*   --v8-pool-size=0   18 threads
-*
-* So the flag is only ever passed with a value of at least 1 — the same trap as
-* `MALLOC_ARENA_MAX=0` in `runner-native-allocator.ts`.
-*
-* ## What is deliberately NOT bounded
-*
-* HEAVY runners keep V8's default: they hold real heaps (the recorder declares
-* 3072 MB) where parallel marking is the difference between a pause and a stall.
-*
-* `UV_THREADPOOL_SIZE` is left alone on every runner. Its 4 threads are lazily
-* spawned, and the measurement above says most light runners have spawned all
-* four — i.e. they really do run concurrent `fs` work. Halving that would trade
-* ~58 more threads for serialized filesystem I/O in runners whose I/O profile
-* has not been measured, on a media system. A thread saving is not worth a
-* media gap.
-*/
-export declare const LIGHT_V8_POOL_SIZE_DEFAULT = 2;
 interface SpawnedProcess {
 	readonly pid: number;
 	readonly nodeId: string;