@camstack/system 1.2.468 → 1.2.470

package/dist/builtins/device-history/retention/orphans.d.ts

@@ -0,0 +1,50 @@
+/**
+* Orphan series (D917): device series that are no longer linked to a device.
+*
+*  - `device-gone` — the device is absent from the successful device listings:
+*    the {@link DepartureTracker}'s clock is running for it. The same knowledge
+*    the week-long departure purge uses, but REPORTED here the moment the clock
+*    starts, so an admin can see it.
+*  - `undeclared` — a `cap:` key no capability declares any more (a cap field
+*    that was removed, such as the `vacuum-control` tank levels D915 moved into
+*    `consumables`). Capture never writes it again; only retention would age it.
+*
+* Nothing is deleted on this judgement alone (D49): an admin deletes, by id,
+* and each id is judged AGAIN at the moment of the delete — a device that came
+* back between the listing and the click keeps its history.
+*/
+import type { DeviceHistoryOrphanDeleteEntry, DeviceHistoryOrphanList, DeviceHistoryOrphanReason, IScopedLogger } from "@camstack/types";
+import type { HistoryStore, SeriesRecord } from "../store/history-store.js";
+import type { SeriesRegistry } from "../store/series-registry.js";
+import type { DepartureTracker } from "./departure-tracker.js";
+import type { RetentionJob } from "./retention.js";
+export interface OrphanVerdict {
+	readonly reason: DeviceHistoryOrphanReason;
+	readonly missingSince: number | null;
+}
+/**
+* The orphan verdict of one series, or `null` when it is linked. PURE. A node
+* series is never orphan here (its subject is a node, not a device).
+*/
+export declare function judgeOrphan(series: Pick<SeriesRecord, "key" | "deviceId">, declaredCapKeys: ReadonlySet<string>, missingSince: number | undefined): OrphanVerdict | null;
+export interface OrphanSeriesDeps {
+	readonly store: HistoryStore;
+	readonly registry: SeriesRegistry;
+	readonly departures: DepartureTracker;
+	readonly retention: RetentionJob;
+	/** Every `cap:` series key the catalogs declare (fields and keyed-item fields). */
+	readonly declaredCapKeys: ReadonlySet<string>;
+	readonly logger: IScopedLogger;
+	readonly clock: () => number;
+}
+export declare class OrphanSeries {
+	private readonly deps;
+	constructor(deps: OrphanSeriesDeps);
+	private verdictOf;
+	/** Every orphan, ordered by device, key and scope, the first {@link DEVICE_HISTORY_ORPHAN_LIST_MAX} counted. */
+	list(): Promise<DeviceHistoryOrphanList>;
+	private rowsOf;
+	/** Delete orphans by id, one at a time, each re-judged now. One entry per id, in order. */
+	delete(seriesIds: readonly number[]): Promise<readonly DeviceHistoryOrphanDeleteEntry[]>;
+	private deleteOne;
+}

package/dist/builtins/device-history/retention/retention.d.ts

@@ -54,8 +54,15 @@ export declare class RetentionJob {
 	/** Drop the visit markers of a purged series. */
 	forgetSeries(seriesId: number): void;
 	private deleteSliced;
-	/** Tier by tier in slices, then the series row (and whatever the slices missed). */
-	private purgeSeries;
+	/**
+	* Tier by tier in slices, then the series row (and whatever the slices missed).
+	* Answers the rows the slices deleted per tier. The caller removes the series
+	* from the registry, which releases its per-series state.
+	*/
+	purgeSeries(series: {
+		readonly id: number;
+		readonly firstTs: number;
+	}, now: number): Promise<Readonly<Record<StoredTier, number>>>;
 	/**
 	* Delete every series of a DELETED device now (D865). Driven by a tombstone
 	* through the `device-removal-hook`, never by a listing: the week-long

package/dist/builtins/device-history/runtime/history-runtime.d.ts

@@ -11,13 +11,14 @@
 * Then {@link HistoryRuntime.startTimers} arms flush (10 s), rollups (60 s),
 * reconcile (5 min), retention (10 min) and the row counts (30 min).
 */
-import type { DeviceHistoryStatus, IScopedLogger } from "@camstack/types";
-import { CaptureEngine, type HistoryCatalog, type SnapshotMap } from "../capture/capture-engine.js";
+import type { DeviceHistoryOrphanDeleteEntry, DeviceHistoryOrphanList, DeviceHistoryStatus, IScopedLogger } from "@camstack/types";
+import { CaptureEngine, type HistoryCatalog, type HistoryItemCatalog, type SnapshotMap } from "../capture/capture-engine.js";
 import { DeviceDirectory, type DeviceTypeSource } from "../capture/device-directory.js";
 import { PointWriter } from "../capture/point-writer.js";
 import { ProducerIngest } from "../ingest/producer-ingest.js";
 import { HistoryQuery } from "../query/history-query.js";
 import { DepartureTracker } from "../retention/departure-tracker.js";
+import { OrphanSeries } from "../retention/orphans.js";
 import { RetentionJob, type RetentionPolicy } from "../retention/retention.js";
 import { RollupEngine } from "../rollup/rollup-engine.js";
 import { HistoryCounters } from "../status/counters.js";
@@ -36,6 +37,8 @@ export declare const FIRST_COUNT_DELAY_MS: number;
 export interface HistoryRuntimeDeps {
 	readonly door: HistoryDoor;
 	readonly catalog: HistoryCatalog;
+	/** Keyed-array series (D917): the generated `HISTORY_ITEM_CATALOG`. */
+	readonly itemCatalog: HistoryItemCatalog;
 	readonly deviceSource: DeviceTypeSource;
 	readonly readSnapshots: () => Promise<SnapshotMap>;
 	readonly readCapSlice: (deviceId: number, capName: string) => Promise<Readonly<Record<string, unknown>> | null>;
@@ -56,6 +59,7 @@ export declare class HistoryRuntime {
 	readonly query: HistoryQuery;
 	readonly retentionJob: RetentionJob;
 	readonly departures: DepartureTracker;
+	readonly orphans: OrphanSeries;
 	private optedOutDevices;
 	private readonly tierCounts;
 	private readonly startedAt;
@@ -87,6 +91,10 @@ export declare class HistoryRuntime {
 	removeDevice(deviceId: number): Promise<{
 		series: number;
 	}>;
+	/** Device series no longer linked to a device — reported, never purged here. */
+	listOrphans(): Promise<DeviceHistoryOrphanList>;
+	/** Delete orphan series by id; a series that is not orphan NOW is refused. */
+	deleteOrphans(seriesIds: readonly number[]): Promise<readonly DeviceHistoryOrphanDeleteEntry[]>;
 	/** Series held per device, for the admin clean-up listing. */
 	seriesByDevice(): ReadonlyMap<number, number>;
 	status(): DeviceHistoryStatus;

package/dist/builtins/device-history/store/history-store.d.ts

@@ -83,6 +83,11 @@ export declare class HistoryStore {
 	deleteRange(tier: StoredTier, seriesId: number, lo: number, hiInclusive: number): Promise<number>;
 	/** Delete every row of one series, in every tier, then the series row. */
 	deleteSeries(seriesId: number): Promise<void>;
+	/**
+	* One series' rows of a tier: a range of the primary key (`series_id = ?`),
+	* never a scan of the tier (D447, asserted in `history-query-plans.spec.ts`).
+	*/
+	countSeriesRows(tier: StoredTier, seriesId: number): Promise<number>;
 	countRows(tier: StoredTier): Promise<number>;
 	loadOptOuts(): Promise<ReadonlySet<number>>;
 	setOptOut(deviceId: number, at: number): Promise<void>;

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
@@ -3780,7 +3780,7 @@ async function deriveDeviceConfigContribution(deps, registry, def, entry, device
 		title: ui.label,
 		tab: ui.tab,
 		order: ui.order ?? 0,
-		...ui.topTab ? { location: "top-tab" } : {},
+		...ui.placement === "hero" ? { location: "hero" } : ui.topTab ? { location: "top-tab" } : {},
 		fields: [{
 			type: "widget",
 			key: `${entry.capName}Widget`,

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $i as isKeychainStoredField, $r as BaseAddon, At as buildStreamParamsConfigSchema, Ca as userError, Ei as SECRET_CLEAR, F as DeviceTombstoneSchema, Fn as locationIconKey, Gi as defineRecordKinds, J as MINUTES_PER_DAY, Jt as defineExtensionSlotProvider, Kn as normalizeUnit, L as FieldClaimModeSchema, Nt as canonicalIconKey, P as DeviceStatusSchema, Qr as errMsg, Qt as deviceExtensionCapability, R as FieldClaimSchema, Sa as transformSecretWrite, Ta as EventCategory, Ut as createDeviceExtensionProvider, Vi as collectZodSecretPaths, Xr as DeviceRole, Yn as parseStreamParamsFormPatch, Yr as DeviceFeature, Zi as isDeviceConfigCap, Zr as DeviceType, _a as secretTreeFromPaths, an as enumerateItemArrayFields, at as STREAM_PROFILE_META, ea as isSecretClear, en as deviceManagerCapability, ha as resolveSecretMarkers, hn as formatMinutes, ji as WELL_KNOWN_TAB_MAP, jn as legacyAutoLinkIds, l as CAP_NAMES_WITH_STATUS, ln as expandContainer, na as isSecretMarkerLike, nn as deviceStateCapability, on as enumerateSchemaFields, pr as runtimeStatePolicyFor, r as ALL_CAPABILITY_DEFINITIONS, rn as deviceStatusCapability, s as CAMERA_SWITCH_ORDER, ta as isSecretMarker, w as DAY_NAMES, xa as toSecretFieldView, ya as sleep$1, yr as siteZoneKey } from "../../dist-BpUtAgqR.mjs";
+import { $i as isDeviceConfigCap, $r as errMsg, $t as deviceExtensionCapability, Ca as toSecretFieldView, Da as EventCategory, Di as SECRET_CLEAR, F as DeviceTombstoneSchema, Hi as collectZodSecretPaths, In as locationIconKey, Ki as defineRecordKinds, L as FieldClaimModeSchema, Mi as WELL_KNOWN_TAB_MAP, Mn as legacyAutoLinkIds, P as DeviceStatusSchema, Pt as canonicalIconKey, Qr as DeviceType, R as FieldClaimSchema, Ta as userError, Wt as createDeviceExtensionProvider, Xn as parseStreamParamsFormPatch, Xr as DeviceFeature, Y as MINUTES_PER_DAY, Yt as defineExtensionSlotProvider, Zr as DeviceRole, _a as resolveSecretMarkers, br as siteZoneKey, ei as BaseAddon, gn as formatMinutes, ia as isSecretMarkerLike, in as deviceStatusCapability, jt as buildStreamParamsConfigSchema, l as CAP_NAMES_WITH_STATUS, mr as runtimeStatePolicyFor, na as isSecretClear, on as enumerateItemArrayFields, ot as STREAM_PROFILE_META, qn as normalizeUnit, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretMarker, rn as deviceStateCapability, s as CAMERA_SWITCH_ORDER, sn as enumerateSchemaFields, ta as isKeychainStoredField, tn as deviceManagerCapability, un as expandContainer, w as DAY_NAMES, wa as transformSecretWrite, xa as sleep$1, ya as secretTreeFromPaths } from "../../dist-X1r44BdF.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
@@ -3775,7 +3775,7 @@ async function deriveDeviceConfigContribution(deps, registry, def, entry, device
 		title: ui.label,
 		tab: ui.tab,
 		order: ui.order ?? 0,
-		...ui.topTab ? { location: "top-tab" } : {},
+		...ui.placement === "hero" ? { location: "hero" } : ui.topTab ? { location: "top-tab" } : {},
 		fields: [{
 			type: "widget",
 			key: `${entry.capName}Widget`,

package/dist/builtins/device-manager/device-meta-types.d.ts

@@ -34,8 +34,8 @@ export interface ContributionShape {
 		defaultCollapsed?: boolean;
 		columns?: 1 | 2 | 3 | 4;
 		tab?: string;
-		/** Where the section renders. Default 'settings' (Config tab); 'top-tab' hoists into the device-detail tab bar via DeviceDetail discovery. */
-		location?: "settings" | "top-tab";
+		/** Where the section renders. Default 'settings' (Config tab); 'top-tab' hoists into the device-detail tab bar via DeviceDetail discovery; 'hero' shows it once directly under the device's hero card (D915). */
+		location?: "settings" | "top-tab" | "hero";
 		order?: number;
 		fields: unknown[];
 	}>;

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-BpUtAgqR.mjs";
+import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-X1r44BdF.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
-const require_device_ca = require("../../device-ca-CGcaSheI.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
+const require_device_ca = require("../../device-ca-R4MZZtc0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_constants = require("../../constants-CuO3rcw4.js");
+const require_constants = require("../../constants-WF1AqoKF.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,7 +1,7 @@
-import { $r as BaseAddon, An as keychainCapability, Gi as defineRecordKinds, H as KEYCHAIN_RESET_TRIGGER_ACTOR, Ta as EventCategory, U as KeychainAuditEntrySchema, W as KeychainResetRecordSchema, Yi as formatSecretScope, ca as normalizeSecretOwner, da as parseSecretRef, kn as keychainAdminCapability } from "../../dist-BpUtAgqR.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-C5cLlah1.mjs";
+import { An as keychainAdminCapability, Da as EventCategory, G as KeychainResetRecordSchema, Ki as defineRecordKinds, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Xi as formatSecretScope, ei as BaseAddon, jn as keychainCapability, pa as parseSecretRef, ua as normalizeSecretOwner } from "../../dist-X1r44BdF.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-DYmToMp8.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-BWli8Cju.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants--A505iuO.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as BaseAddon, Hi as createEvent, Qr as errMsg, Ta as EventCategory, rt as RecordingStatusSchema, tt as RECORDING_SOURCE_CAMSTACK_ADDON } from "../../dist-BpUtAgqR.mjs";
+import { $r as errMsg, Da as EventCategory, Ui as createEvent, ei as BaseAddon, it as RecordingStatusSchema, nt as RECORDING_SOURCE_CAMSTACK_ADDON } from "../../dist-X1r44BdF.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CGcaSheI.js");
+const require_device_ca = require("../../device-ca-R4MZZtc0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceNamespaceSchema, $r as BaseAddon, Ar as userManagementCapability, Ca as userError, Cn as isCredentialTokenPayload, Ct as authProviderCapability, E as DEVICE_ENROLLMENT_TTL_MS, Gi as defineRecordKinds, O as DEVICE_NONCE_TTL_MS, Ot as buildDeviceEnrollmentLink, Q as PreferenceDeviceIdSchema, Z as PREFERENCES_MAX_VALUE_BYTES, Zt as deviceCredentialsCapability, ct as SsoBridgeClaimsSchema, et as PreferenceValueSchema, h as CREDENTIAL_TOKEN_AUDIENCE, ht as UserRecordSchema, ia as makeSecretMarker, kt as buildDeviceSignatureMessage, mn as formatDeviceRevoker, ot as ScopedTokenSchema, pt as TokenScopeSchema, ta as isSecretMarker, y as CredentialTokenClaimsSchema } from "../../dist-BpUtAgqR.mjs";
+import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ki as defineRecordKinds, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, Ta as userError, ei as BaseAddon, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, jr as userManagementCapability, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, oa as makeSecretMarker, ra as isSecretMarker, st as ScopedTokenSchema, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-X1r44BdF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-C5cLlah1.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DYmToMp8.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CIno_SNn.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DUoTS6jN.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $r as BaseAddon, B as HUB_MDNS_SERVICE_TYPE, Mr as validateCustomAddress, Pn as localNetworkCapability, Pt as checkRoleAddress, Qr as errMsg, Ta as EventCategory, V as HUB_MDNS_TXT_KEYS, X as NetworkTunnelStartedDataSchema, Xn as pickAppLinkHub, ar as resolveAppConnections, bn as isAppLinkBase, c as CAMSTACK_APP_LINK_ORIGIN, fr as resolveNotificationTapAddress, lr as resolveHubAddressRoles, vr as shortHostname, wn as isDefaultAppConnectionEndpoint } from "../../dist-BpUtAgqR.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-0KWDyIMD.mjs";
+import { $r as errMsg, Da as EventCategory, Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Nr as validateCustomAddress, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, Zn as pickAppLinkHub, c as CAMSTACK_APP_LINK_ORIGIN, ei as BaseAddon, or as resolveAppConnections, pr as resolveNotificationTapAddress, ur as resolveHubAddressRoles, xn as isAppLinkBase, yr as shortHostname } from "../../dist-X1r44BdF.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CZV5Hion.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-BpUtAgqR.mjs";
+import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-X1r44BdF.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-l6zKmHEb.js");
+const require_dist = require("../../dist-DRL3rEfN.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as BaseAddon, Hi as createEvent, Hn as metricsProviderCapability, Qr as errMsg, Ta as EventCategory, mt as UNATTRIBUTED_BUCKET_KEY, nt as ROOT_BUCKET_KEY, or as resolveBucketMs, pn as foldSnapshotByFunction, rr as reducePoints } from "../../dist-BpUtAgqR.mjs";
+import { $r as errMsg, Da as EventCategory, Ui as createEvent, Un as metricsProviderCapability, ei as BaseAddon, ht as UNATTRIBUTED_BUCKET_KEY, ir as reducePoints, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, sr as resolveBucketMs } from "../../dist-X1r44BdF.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/accelerator-reprobe.d.ts

@@ -0,0 +1,23 @@
+import type { CoralInfo, InferenceDeviceDescriptor, PlatformCapabilities } from "@camstack/types";
+import type { CoralDetection } from "./coral-accelerators.js";
+/** Device keys that appeared and disappeared between two probes, sorted. */
+export interface InferenceDeviceSetChange {
+	readonly appeared: readonly string[];
+	readonly disappeared: readonly string[];
+}
+/** The result of one accelerator re-probe. */
+export interface AcceleratorReprobe {
+	readonly caps: PlatformCapabilities;
+	readonly change: InferenceDeviceSetChange;
+	readonly detection: CoralDetection;
+}
+/** A stable signature of a Coral answer — what decides "did it change". */
+export declare function coralSignature(coral: CoralInfo | null | undefined): string;
+/** Which device keys a new probe added and removed. */
+export declare function diffInferenceDevices(previous: readonly InferenceDeviceDescriptor[], next: readonly InferenceDeviceDescriptor[]): InferenceDeviceSetChange;
+/**
+* The capabilities with a new Coral answer: hardware, scores and the device
+* enumeration are all derived again from it, so the edgetpu runtime and its
+* devices follow the hardware rather than the boot-time snapshot.
+*/
+export declare function withCoral(caps: PlatformCapabilities, coral: CoralInfo | null): PlatformCapabilities;

package/dist/builtins/platform-probe/coral-accelerators.d.ts

@@ -6,8 +6,12 @@ import { type EdgetpuDelegateLookup } from "@camstack/types/node";
 * stays a pure, unit-testable function over injected reads.
 */
 export interface CoralFs {
-	/** USB device directory names under `/sys/bus/usb/devices` (e.g. `2-4`). */
-	listUsbDevices(): readonly string[];
+	/**
+	* USB device directory names under `/sys/bus/usb/devices` (e.g. `2-4`), or
+	* `null` when the bus cannot be read at all (no `/sys`, a restricted view).
+	* `null` and an empty listing both mean "the bus is not observable".
+	*/
+	listUsbDevices(): readonly string[] | null;
 	/** Read a `<sysfsNode>/<attr>` value (idVendor / idProduct), trimmed. */
 	readUsbAttr(device: string, attr: string): string;
 	/** PCI function names under `/sys/bus/pci/devices` (e.g. `0000:03:00.0`). */
@@ -29,20 +33,45 @@ export interface CoralFs {
 * `/data/deps/edgetpu/lib/libedgetpu.so.1`.
 */
 export type EdgetpuDelegateHost = Omit<EdgetpuDelegateLookup, "exists">;
+/** Whether this process could see the USB bus at all. */
+export type CoralUsbBusView = "observed" | "unobservable";
 /**
-* Detect Coral Edge TPUs on USB and PCIe/M.2.
+* Which evidence decided the Coral answer — logged by the probe so a node
+* that reports (or stops reporting) a Coral says WHY:
+*  - `usb-ids` — a Coral USB id is on the bus;
+*  - `pci` — a PCIe/M.2 Coral (usable or not) is on the PCI bus;
+*  - `delegate-fallback` — the USB bus is not observable and the libedgetpu
+*    delegate is installed, so one USB unit is ASSUMED;
+*  - `none` — no Coral.
+*/
+export type CoralDecision = "usb-ids" | "pci" | "delegate-fallback" | "none";
+export interface CoralDetection {
+	readonly info: CoralInfo | null;
+	readonly usbBus: CoralUsbBusView;
+	readonly decidedBy: CoralDecision;
+}
+/**
+* Detect Coral Edge TPUs on USB and PCIe/M.2 — the answer only. See
+* {@link detectCoralAccelerator} for the evidence that decided it.
+*/
+export declare function classifyCoralAccelerator(fsx: CoralFs, delegateHost?: EdgetpuDelegateHost): CoralInfo | null;
+/**
+* Detect Coral Edge TPUs on USB and PCIe/M.2, with the evidence that decided.
 *
 * - USB: every matching USB device counts (multiple Corals run concurrently).
 * - PCIe: the apex driver's units, each usable only if its device node opens;
 *   a Coral PCI function the driver did not bind is `driver-missing`.
-* - Fallback: when NO Coral signal of either bus is visible but the libedgetpu
-*   delegate is installed (a container whose `/sys` USB view is limited), one
-*   USB Coral is assumed — never when a PCI Coral was seen, since the delegate
-*   then says nothing about USB.
+* - Fallback: when the USB bus is NOT OBSERVABLE (`/sys/bus/usb/devices`
+*   missing, unreadable or empty — a macOS desktop, a restricted container)
+*   and no PCI Coral was seen, an installed libedgetpu delegate means one USB
+*   Coral is assumed. A bus that IS readable and lists no Coral id is the
+*   answer: no USB Coral. The delegate stays installed after a stick is
+*   unplugged or moved to another node, so it is evidence only where nothing
+*   better exists (D919).
 *
 * Returns `null` only when no Coral was found at all; a present-but-unusable
 * Coral is reported with its typed reason, never as absent (D393/D315).
 */
-export declare function classifyCoralAccelerator(fsx: CoralFs, delegateHost?: EdgetpuDelegateHost): CoralInfo | null;
+export declare function detectCoralAccelerator(fsx: CoralFs, delegateHost?: EdgetpuDelegateHost): CoralDetection;
 /** The real filesystem view: `/sys` for enumeration, `/dev` for access. */
 export declare const nodeCoralFs: CoralFs;

package/dist/builtins/platform-probe/index.d.ts

@@ -5,13 +5,19 @@
 * exposes the result via the `platform-probe` capability (singleton per
 * node).
 */
-import type { ProviderRegistration } from "@camstack/types";
+import type { ProviderRegistration, AcceleratorRescan } from "@camstack/types";
 import { BaseAddon } from "@camstack/types";
 export { PlatformScorer } from "./platform-scorer.js";
 export { InferenceConfigResolver } from "./inference-config-resolver.js";
+/** How often the accelerator part of the probe is re-run (D919). Cheap: `/sys` + `/dev` reads. */
+export declare const ACCELERATOR_REPROBE_INTERVAL_MS = 6e4;
+/** What started an accelerator re-probe — logged with every change. */
+export type AcceleratorReprobeTrigger = "periodic" | "operator";
 export declare class PlatformProbeNativeAddon extends BaseAddon {
 	private scorer;
 	private cachedCaps;
+	/** The periodic accelerator re-probe; started once the full probe completed. */
+	private reprobeTimer;
 	/**
 	* Per-boot generation stamp for the manual readiness emissions below.
 	* Constant for the lifetime of this addon instance (== one process boot);
@@ -36,6 +42,16 @@ export declare class PlatformProbeNativeAddon extends BaseAddon {
 	/** Emit a `system.ready-state` transition for the platform-probe cap. */
 	private emitProbeReadiness;
 	protected onInitialize(): Promise<ProviderRegistration[]>;
+	/** Start the periodic accelerator re-probe (idempotent). */
+	private startAcceleratorReprobe;
+	/**
+	* Re-run the accelerator part of the probe and serve its answer from now on.
+	* Every device that appeared or disappeared is logged, naming the node and
+	* what triggered the re-probe; the orchestrator sees the new list on its next
+	* `getCapabilities` read and re-elects through its device-set-change path.
+	* `null` when the scorer is gone or has not completed its first probe.
+	*/
+	reprobeAccelerators(trigger: AcceleratorReprobeTrigger): AcceleratorRescan | null;
 	protected onShutdown(): Promise<void>;
 }
 export default PlatformProbeNativeAddon;