@camstack/system 1.2.471 → 1.2.473

package/dist/addon-runner.js

@@ -7447,7 +7447,7 @@ function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
 }
 /**
-* Parse an `op.path` (e.g. `"pipelineExecutor.getDefaultSteps"`) into
+* Parse an `op.path` (e.g. `"pipelineExecutor.getAvailableEngines"`) into
 * the capability name (kebab-case) and the method name.
 */
 function parsePath(path) {
@@ -8094,6 +8094,148 @@ var nodeCoralFs = {
 	}
 };
 //#endregion
+//#region src/kernel/hwaccel/vaapi-init-probe.ts
+/**
+* Can libva initialise the VA driver on this node's render node? (D926)
+*
+* Measured 2026-10-23 (intel-1.2.509, hub + little-unraid): Intel's iHD 25.2.4
+* exports only `__vaDriverInit_1_22`, the container's Ubuntu libva 2.20 looks
+* for `_1_20`, and `vaInitialize` failed — while the resolver kept offering
+* `qsv, vaapi`. Every session tried, failed and fell back to software: 722
+* `hwaccel 'vaapi' failed` lines a day and nothing that named the cause.
+*
+* One `vainfo --display drm --device <node>` per process answers it. A failure
+* reads the driver's exported `__vaDriverInit_1_N` so the verdict names the gap
+* (`driver iHD needs VA-API >= 1.22, libva has 1.20`). No `vainfo` on the host
+* (a bare install) is `unknown` — the resolver then behaves as it always did.
+*/
+var VAINFO_TIMEOUT_MS = 1e4;
+var INIT_SYMBOL = /__vaDriverInit_(\d+)_(\d+)/g;
+var VA_API_VERSION = /VA-API version:? (\d+)\.(\d+)/;
+var DRIVER_OPEN = /Trying to open (\S+_drv_video\.so)/g;
+function newestInitVersion(symbols) {
+	let best = null;
+	for (const symbol of symbols) for (const m of symbol.matchAll(INIT_SYMBOL)) {
+		const v = {
+			major: Number(m[1]),
+			minor: Number(m[2])
+		};
+		if (!best || v.major > best.major || v.major === best.major && v.minor > best.minor) best = v;
+	}
+	return best;
+}
+function lastMatch(text, re) {
+	let last = null;
+	for (const m of text.matchAll(re)) last = m[1] ?? null;
+	return last;
+}
+function lastLine(text) {
+	const lines = text.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+	return lines[lines.length - 1] ?? "no output";
+}
+function driverName(driverPath) {
+	if (!driverPath) return "unknown";
+	return (0, node_path.basename)(driverPath).replace(/_drv_video\.so$/, "");
+}
+/** Classify one vainfo run plus the driver's exported init symbols. Pure. */
+function classifyVainfo(run, driverSymbols) {
+	const va = VA_API_VERSION.exec(run.output);
+	const vaApiVersion = va ? `${va[1]}.${va[2]}` : null;
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	const needs = newestInitVersion(driverSymbols);
+	const driverNeedsVaApi = needs ? `${needs.major}.${needs.minor}` : null;
+	const base = {
+		vaApiVersion,
+		driverPath,
+		driverNeedsVaApi
+	};
+	if (run.spawnError !== null) return {
+		...base,
+		state: "unknown",
+		summary: `vaapi: unknown (vainfo not run: ${run.spawnError})`
+	};
+	if (run.exitCode === 0) return {
+		...base,
+		state: "ok",
+		summary: `vaapi: ok (VA-API ${vaApiVersion ?? "?"}, driver ${driverName(driverPath)})`
+	};
+	const reason = needs !== null && va !== null && (needs.major > Number(va[1]) || needs.major === Number(va[1]) && needs.minor > Number(va[2])) ? `driver ${driverName(driverPath)} needs VA-API >= ${driverNeedsVaApi}, libva has ${vaApiVersion}` : lastLine(run.output);
+	return {
+		...base,
+		state: "init-failed",
+		summary: `vaapi: init-failed (${reason})`
+	};
+}
+/** Run `vainfo` against one render node; never throws. */
+function runVainfo(renderNode) {
+	return new Promise((resolve) => {
+		(0, node_child_process.execFile)("vainfo", [
+			"--display",
+			"drm",
+			"--device",
+			renderNode
+		], {
+			timeout: VAINFO_TIMEOUT_MS,
+			encoding: "utf8"
+		}, (err, stdout, stderr) => {
+			const output = `${stdout}\n${stderr}`;
+			if (err === null) {
+				resolve({
+					exitCode: 0,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			const code = err.code;
+			if (typeof code === "number") {
+				resolve({
+					exitCode: code,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			resolve({
+				exitCode: null,
+				output,
+				spawnError: code ?? (err.killed ? "timeout" : err.message)
+			});
+		});
+	});
+}
+/**
+* The `__vaDriverInit_N_M` names in a driver file, streamed (iHD is ~43 MB),
+* with an overlap so a name split across two chunks is still found.
+*/
+function readDriverInitSymbols(driverPath) {
+	return new Promise((resolve) => {
+		const found = /* @__PURE__ */ new Set();
+		let carry = "";
+		const stream = (0, node_fs.createReadStream)(driverPath, {
+			encoding: "latin1",
+			highWaterMark: 64 * 1024
+		});
+		stream.on("data", (chunk) => {
+			const text = carry + String(chunk);
+			for (const m of text.matchAll(INIT_SYMBOL)) if (m.index + m[0].length < text.length) found.add(m[0]);
+			carry = text.slice(-32);
+		});
+		stream.on("error", () => resolve([]));
+		stream.on("end", () => {
+			for (const m of carry.matchAll(INIT_SYMBOL)) found.add(m[0]);
+			resolve([...found].sort());
+		});
+	});
+}
+/** Probe one render node: vainfo, and on failure the driver's init symbols. */
+async function probeVaapiInit(renderNode) {
+	const run = await runVainfo(renderNode);
+	if (run.spawnError !== null || run.exitCode === 0) return classifyVainfo(run, []);
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	return classifyVainfo(run, driverPath ? await readDriverInitSymbols(driverPath) : []);
+}
+//#endregion
 //#region src/kernel/hwaccel/hwaccel-resolver.ts
 /**
 * Platform-probe for hardware video decode acceleration.
@@ -8163,7 +8305,23 @@ function probePlatform() {
 		coral: classifyCoralAccelerator(nodeCoralFs)
 	};
 }
-function pickBackendsForPlatform(signals) {
+/** The backends that open their device through libva on Linux. */
+var LIBVA_BACKENDS = ["vaapi", "qsv"];
+/**
+* The preference list for these signals. A `vaapi` verdict of `init-failed`
+* (libva cannot initialise the driver — D926) removes every libva-backed
+* backend and names the cause in the rationale; `ok`, `unknown` or `null`
+* change nothing.
+*/
+function pickBackendsForPlatform(signals, vaapi = null) {
+	const res = pickBackendsFromSignals(signals);
+	if (signals.platform !== "linux" || vaapi?.state !== "init-failed") return res;
+	return {
+		preferred: res.preferred.filter((b) => !LIBVA_BACKENDS.includes(b)),
+		rationale: `${res.rationale} ${vaapi.summary} — vaapi/qsv withheld, decode runs in software.`
+	};
+}
+function pickBackendsFromSignals(signals) {
 	switch (signals.platform) {
 		case "darwin": return {
 			preferred: ["videotoolbox"],
@@ -8224,13 +8382,49 @@ function resolveHwAccel(prefer) {
 	};
 	return pickBackendsForPlatform(probePlatform());
 }
+var RENDER_NODE = "/dev/dri/renderD128";
+/** Process-wide: the VA init failure is logged once per process, not per resolver. */
+var PROCESS_VAAPI_REPORT = { reported: false };
+/** Process-wide: hub-main builds one resolver per in-process addon; vainfo runs once. */
+var PROCESS_VAAPI_PROBES = /* @__PURE__ */ new Map();
+function probeVaapiOncePerProcess(renderNode) {
+	const known = PROCESS_VAAPI_PROBES.get(renderNode);
+	if (known) return known;
+	const probe = probeVaapiInit(renderNode);
+	PROCESS_VAAPI_PROBES.set(renderNode, probe);
+	return probe;
+}
 /**
 * Build the `IKernelHwAccel` provider used to populate `ctx.kernel.hwaccel`.
-* Thin async wrapper around the sync `resolveHwAccel` function so the
-* contract matches the per-node `$hwaccel.resolve` Moleculer action.
-*/
-function createKernelHwAccel() {
-	return { resolve: async (prefer) => resolveHwAccel(prefer) };
+* An auto resolve on a Linux host with a render node asks libva ONCE per
+* provider whether it can initialise the driver (D926); an explicit override
+* is never second-guessed.
+*/
+function createKernelHwAccel(options = {}) {
+	const probeSignals = options.probeSignals ?? probePlatform;
+	const probeVaapi = options.probeVaapi ?? probeVaapiOncePerProcess;
+	const reportOnce = options.reportOnce ?? PROCESS_VAAPI_REPORT;
+	let vaapi = null;
+	const vaapiVerdict = async () => {
+		if (vaapi === null) vaapi = probeVaapi(RENDER_NODE);
+		const status = await vaapi;
+		if (status.state === "init-failed" && !reportOnce.reported) {
+			reportOnce.reported = true;
+			options.logger?.error(`hwaccel: ${status.summary} — vaapi/qsv withheld, decode runs in software`, { meta: {
+				renderNode: RENDER_NODE,
+				vaApiVersion: status.vaApiVersion,
+				driverPath: status.driverPath,
+				driverNeedsVaApi: status.driverNeedsVaApi
+			} });
+		}
+		return status;
+	};
+	return { resolve: async (prefer) => {
+		if (prefer === "none" || prefer !== null && prefer !== void 0 && prefer.length > 0) return resolveHwAccel(prefer);
+		const signals = probeSignals();
+		if (signals.platform !== "linux" || !signals.hasRenderNode) return pickBackendsForPlatform(signals);
+		return pickBackendsForPlatform(signals, await vaapiVerdict());
+	} };
 }
 //#endregion
 //#region src/kernel/inference/inference-resolver.ts
@@ -10575,7 +10769,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 					value
 				})
 			};
-			const hwaccel = createKernelHwAccel();
+			const hwaccel = createKernelHwAccel({ logger: scopedLogger });
 			const inferenceEngine = createKernelInferenceEngine();
 			return {
 				localNodeId: nodeId,

package/dist/addon-runner.mjs

@@ -2,7 +2,7 @@ import { register } from "node:module";
 import * as fs$1 from "node:fs";
 import fs, { createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";
 import * as path from "node:path";
-import { dirname, isAbsolute, join } from "node:path";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { BOOT_RECOVERY_BACKOFF_MS, CALLER_STAMPED_CAPABILITIES, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, ErrorI18nPayloadSchema, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry, ReadinessTimeoutError, addonSliceHandleApi, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEventBusSliceSource, createRecordsAccess, createSecretsAccess, describeCustomActions, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, isCollectionArrayMethodName, isProviderOptionalMethodName, maskUrlCredentials, normalizeAddonInitResult, readErrorI18n, readNodePin, resolveSecretViewsIn, scopeKey, scrubKnownSecrets, withCapInputDefaults } from "@camstack/types/addon";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -7423,7 +7423,7 @@ function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
 }
 /**
-* Parse an `op.path` (e.g. `"pipelineExecutor.getDefaultSteps"`) into
+* Parse an `op.path` (e.g. `"pipelineExecutor.getAvailableEngines"`) into
 * the capability name (kebab-case) and the method name.
 */
 function parsePath(path) {
@@ -8070,6 +8070,148 @@ var nodeCoralFs = {
 	}
 };
 //#endregion
+//#region src/kernel/hwaccel/vaapi-init-probe.ts
+/**
+* Can libva initialise the VA driver on this node's render node? (D926)
+*
+* Measured 2026-10-23 (intel-1.2.509, hub + little-unraid): Intel's iHD 25.2.4
+* exports only `__vaDriverInit_1_22`, the container's Ubuntu libva 2.20 looks
+* for `_1_20`, and `vaInitialize` failed — while the resolver kept offering
+* `qsv, vaapi`. Every session tried, failed and fell back to software: 722
+* `hwaccel 'vaapi' failed` lines a day and nothing that named the cause.
+*
+* One `vainfo --display drm --device <node>` per process answers it. A failure
+* reads the driver's exported `__vaDriverInit_1_N` so the verdict names the gap
+* (`driver iHD needs VA-API >= 1.22, libva has 1.20`). No `vainfo` on the host
+* (a bare install) is `unknown` — the resolver then behaves as it always did.
+*/
+var VAINFO_TIMEOUT_MS = 1e4;
+var INIT_SYMBOL = /__vaDriverInit_(\d+)_(\d+)/g;
+var VA_API_VERSION = /VA-API version:? (\d+)\.(\d+)/;
+var DRIVER_OPEN = /Trying to open (\S+_drv_video\.so)/g;
+function newestInitVersion(symbols) {
+	let best = null;
+	for (const symbol of symbols) for (const m of symbol.matchAll(INIT_SYMBOL)) {
+		const v = {
+			major: Number(m[1]),
+			minor: Number(m[2])
+		};
+		if (!best || v.major > best.major || v.major === best.major && v.minor > best.minor) best = v;
+	}
+	return best;
+}
+function lastMatch(text, re) {
+	let last = null;
+	for (const m of text.matchAll(re)) last = m[1] ?? null;
+	return last;
+}
+function lastLine(text) {
+	const lines = text.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+	return lines[lines.length - 1] ?? "no output";
+}
+function driverName(driverPath) {
+	if (!driverPath) return "unknown";
+	return basename(driverPath).replace(/_drv_video\.so$/, "");
+}
+/** Classify one vainfo run plus the driver's exported init symbols. Pure. */
+function classifyVainfo(run, driverSymbols) {
+	const va = VA_API_VERSION.exec(run.output);
+	const vaApiVersion = va ? `${va[1]}.${va[2]}` : null;
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	const needs = newestInitVersion(driverSymbols);
+	const driverNeedsVaApi = needs ? `${needs.major}.${needs.minor}` : null;
+	const base = {
+		vaApiVersion,
+		driverPath,
+		driverNeedsVaApi
+	};
+	if (run.spawnError !== null) return {
+		...base,
+		state: "unknown",
+		summary: `vaapi: unknown (vainfo not run: ${run.spawnError})`
+	};
+	if (run.exitCode === 0) return {
+		...base,
+		state: "ok",
+		summary: `vaapi: ok (VA-API ${vaApiVersion ?? "?"}, driver ${driverName(driverPath)})`
+	};
+	const reason = needs !== null && va !== null && (needs.major > Number(va[1]) || needs.major === Number(va[1]) && needs.minor > Number(va[2])) ? `driver ${driverName(driverPath)} needs VA-API >= ${driverNeedsVaApi}, libva has ${vaApiVersion}` : lastLine(run.output);
+	return {
+		...base,
+		state: "init-failed",
+		summary: `vaapi: init-failed (${reason})`
+	};
+}
+/** Run `vainfo` against one render node; never throws. */
+function runVainfo(renderNode) {
+	return new Promise((resolve) => {
+		execFile("vainfo", [
+			"--display",
+			"drm",
+			"--device",
+			renderNode
+		], {
+			timeout: VAINFO_TIMEOUT_MS,
+			encoding: "utf8"
+		}, (err, stdout, stderr) => {
+			const output = `${stdout}\n${stderr}`;
+			if (err === null) {
+				resolve({
+					exitCode: 0,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			const code = err.code;
+			if (typeof code === "number") {
+				resolve({
+					exitCode: code,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			resolve({
+				exitCode: null,
+				output,
+				spawnError: code ?? (err.killed ? "timeout" : err.message)
+			});
+		});
+	});
+}
+/**
+* The `__vaDriverInit_N_M` names in a driver file, streamed (iHD is ~43 MB),
+* with an overlap so a name split across two chunks is still found.
+*/
+function readDriverInitSymbols(driverPath) {
+	return new Promise((resolve) => {
+		const found = /* @__PURE__ */ new Set();
+		let carry = "";
+		const stream = createReadStream(driverPath, {
+			encoding: "latin1",
+			highWaterMark: 64 * 1024
+		});
+		stream.on("data", (chunk) => {
+			const text = carry + String(chunk);
+			for (const m of text.matchAll(INIT_SYMBOL)) if (m.index + m[0].length < text.length) found.add(m[0]);
+			carry = text.slice(-32);
+		});
+		stream.on("error", () => resolve([]));
+		stream.on("end", () => {
+			for (const m of carry.matchAll(INIT_SYMBOL)) found.add(m[0]);
+			resolve([...found].sort());
+		});
+	});
+}
+/** Probe one render node: vainfo, and on failure the driver's init symbols. */
+async function probeVaapiInit(renderNode) {
+	const run = await runVainfo(renderNode);
+	if (run.spawnError !== null || run.exitCode === 0) return classifyVainfo(run, []);
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	return classifyVainfo(run, driverPath ? await readDriverInitSymbols(driverPath) : []);
+}
+//#endregion
 //#region src/kernel/hwaccel/hwaccel-resolver.ts
 /**
 * Platform-probe for hardware video decode acceleration.
@@ -8139,7 +8281,23 @@ function probePlatform() {
 		coral: classifyCoralAccelerator(nodeCoralFs)
 	};
 }
-function pickBackendsForPlatform(signals) {
+/** The backends that open their device through libva on Linux. */
+var LIBVA_BACKENDS = ["vaapi", "qsv"];
+/**
+* The preference list for these signals. A `vaapi` verdict of `init-failed`
+* (libva cannot initialise the driver — D926) removes every libva-backed
+* backend and names the cause in the rationale; `ok`, `unknown` or `null`
+* change nothing.
+*/
+function pickBackendsForPlatform(signals, vaapi = null) {
+	const res = pickBackendsFromSignals(signals);
+	if (signals.platform !== "linux" || vaapi?.state !== "init-failed") return res;
+	return {
+		preferred: res.preferred.filter((b) => !LIBVA_BACKENDS.includes(b)),
+		rationale: `${res.rationale} ${vaapi.summary} — vaapi/qsv withheld, decode runs in software.`
+	};
+}
+function pickBackendsFromSignals(signals) {
 	switch (signals.platform) {
 		case "darwin": return {
 			preferred: ["videotoolbox"],
@@ -8200,13 +8358,49 @@ function resolveHwAccel(prefer) {
 	};
 	return pickBackendsForPlatform(probePlatform());
 }
+var RENDER_NODE = "/dev/dri/renderD128";
+/** Process-wide: the VA init failure is logged once per process, not per resolver. */
+var PROCESS_VAAPI_REPORT = { reported: false };
+/** Process-wide: hub-main builds one resolver per in-process addon; vainfo runs once. */
+var PROCESS_VAAPI_PROBES = /* @__PURE__ */ new Map();
+function probeVaapiOncePerProcess(renderNode) {
+	const known = PROCESS_VAAPI_PROBES.get(renderNode);
+	if (known) return known;
+	const probe = probeVaapiInit(renderNode);
+	PROCESS_VAAPI_PROBES.set(renderNode, probe);
+	return probe;
+}
 /**
 * Build the `IKernelHwAccel` provider used to populate `ctx.kernel.hwaccel`.
-* Thin async wrapper around the sync `resolveHwAccel` function so the
-* contract matches the per-node `$hwaccel.resolve` Moleculer action.
-*/
-function createKernelHwAccel() {
-	return { resolve: async (prefer) => resolveHwAccel(prefer) };
+* An auto resolve on a Linux host with a render node asks libva ONCE per
+* provider whether it can initialise the driver (D926); an explicit override
+* is never second-guessed.
+*/
+function createKernelHwAccel(options = {}) {
+	const probeSignals = options.probeSignals ?? probePlatform;
+	const probeVaapi = options.probeVaapi ?? probeVaapiOncePerProcess;
+	const reportOnce = options.reportOnce ?? PROCESS_VAAPI_REPORT;
+	let vaapi = null;
+	const vaapiVerdict = async () => {
+		if (vaapi === null) vaapi = probeVaapi(RENDER_NODE);
+		const status = await vaapi;
+		if (status.state === "init-failed" && !reportOnce.reported) {
+			reportOnce.reported = true;
+			options.logger?.error(`hwaccel: ${status.summary} — vaapi/qsv withheld, decode runs in software`, { meta: {
+				renderNode: RENDER_NODE,
+				vaApiVersion: status.vaApiVersion,
+				driverPath: status.driverPath,
+				driverNeedsVaApi: status.driverNeedsVaApi
+			} });
+		}
+		return status;
+	};
+	return { resolve: async (prefer) => {
+		if (prefer === "none" || prefer !== null && prefer !== void 0 && prefer.length > 0) return resolveHwAccel(prefer);
+		const signals = probeSignals();
+		if (signals.platform !== "linux" || !signals.hasRenderNode) return pickBackendsForPlatform(signals);
+		return pickBackendsForPlatform(signals, await vaapiVerdict());
+	} };
 }
 //#endregion
 //#region src/kernel/inference/inference-resolver.ts
@@ -10551,7 +10745,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 					value
 				})
 			};
-			const hwaccel = createKernelHwAccel();
+			const hwaccel = createKernelHwAccel({ logger: scopedLogger });
 			const inferenceEngine = createKernelInferenceEngine();
 			return {
 				localNodeId: nodeId,

package/dist/addon-utils.mjs

@@ -1,3 +1,3 @@
-import { C as isModelDownloaded, S as isModelDownloadHttpError, _ as downloadFile, a as startEventLoopStallMonitor, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, p as ModelDownloadHttpError, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BGYDjTqY.mjs";
+import { C as isModelDownloaded, S as isModelDownloadHttpError, _ as downloadFile, a as startEventLoopStallMonitor, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, p as ModelDownloadHttpError, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/{agent-https-bH6bKDeK.js → agent-https-B9Q3-IKd.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BjcWEfRy.js");
+const require_dist = require("./dist-Bmah6waF.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -917,14 +917,11 @@ function installAgentHttps(dataDir, input) {
 	if (!leaf.verify(ca.publicKey)) throw new AgentHttpsInstallError("the certificate is not signed by the CA that came with it");
 	if (new Date(leaf.validTo).getTime() <= Date.now()) throw new AgentHttpsInstallError("the certificate is already expired");
 	(0, node_fs.mkdirSync)(paths.dir, { recursive: true });
-	const tmp = `${paths.bundlePath}.tmp`;
-	(0, _camstack_types_node.writeOwnerOnlyFileSync)(tmp, JSON.stringify({
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)(paths.bundlePath, JSON.stringify({
 		keyPem,
 		certPem: input.certPem,
 		caCertPem: input.caCertPem
 	}));
-	(0, node_fs.renameSync)(tmp, paths.bundlePath);
-	(0, node_fs.chmodSync)(paths.bundlePath, 384);
 	writeFileAtomic(paths.certPath, input.certPem.endsWith("\n") ? input.certPem : `${input.certPem}\n`);
 	return {
 		keyPem,

package/dist/{agent-https-DHBvFZJS.mjs → agent-https-DOwn4pqL.mjs}

@@ -1,4 +1,4 @@
-import { Ki as defineRecordKinds } from "./dist-5XUG7iYJ.mjs";
+import { qi as defineRecordKinds } from "./dist-C9lbdBL5.mjs";
 import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
@@ -6,7 +6,7 @@ import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
 import { join } from "node:path";
 import * as os$1 from "node:os";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 var MeshNodeCertificateBodySchema = z.object({
 	nodeId: z.string(),
 	serial: z.string(),
@@ -915,14 +915,11 @@ function installAgentHttps(dataDir, input) {
 	if (!leaf.verify(ca.publicKey)) throw new AgentHttpsInstallError("the certificate is not signed by the CA that came with it");
 	if (new Date(leaf.validTo).getTime() <= Date.now()) throw new AgentHttpsInstallError("the certificate is already expired");
 	mkdirSync(paths.dir, { recursive: true });
-	const tmp = `${paths.bundlePath}.tmp`;
-	writeOwnerOnlyFileSync(tmp, JSON.stringify({
+	writeOwnerOnlyFileSync(paths.bundlePath, JSON.stringify({
 		keyPem,
 		certPem: input.certPem,
 		caCertPem: input.caCertPem
 	}));
-	renameSync(tmp, paths.bundlePath);
-	chmodSync(paths.bundlePath, 384);
 	writeFileAtomic(paths.certPath, input.certPem.endsWith("\n") ? input.certPem : `${input.certPem}\n`);
 	return {
 		keyPem,

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,8 +1,8 @@
-import { $r as errMsg, Da as EventCategory, _t as addonPagesCapability, ei as BaseAddon } from "../../dist-5XUG7iYJ.mjs";
+import { Oa as EventCategory, _t as addonPagesCapability, ei as errMsg, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 //#region src/builtins/addon-pages-aggregator/dedupe-pages.ts
 /** Stable identity for an addon page, independent of which node reported it. */
 function pageKey(info) {
@@ -211,11 +211,11 @@ var AddonPagesAggregatorAddon = class extends BaseAddon {
 		const bundlePath = this.resolveBundlePath(addonId, bundle);
 		if (bundlePath === null) return `/api/addon-pages/${addonId}/${bundle}?v=${Math.floor(Date.now())}`;
 		try {
-			const stat = fs.statSync(bundlePath);
+			const stat = fs$1.statSync(bundlePath);
 			const cacheKey = `${bundlePath}:${stat.size}:${stat.mtimeMs}`;
 			let v = this.bundleHashCache.get(cacheKey);
 			if (v === void 0) {
-				v = createHash("sha1").update(fs.readFileSync(bundlePath)).digest("hex").slice(0, 12);
+				v = createHash("sha1").update(fs$1.readFileSync(bundlePath)).digest("hex").slice(0, 12);
 				this.bundleHashCache.set(cacheKey, v);
 			}
 			return `/api/addon-pages/${addonId}/${bundle}?v=${v}`;

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,8 +1,8 @@
-import { $r as errMsg, Da as EventCategory, ei as BaseAddon, yt as addonWidgetsCapability } from "../../dist-5XUG7iYJ.mjs";
+import { Oa as EventCategory, ei as errMsg, ti as BaseAddon, yt as addonWidgetsCapability } from "../../dist-C9lbdBL5.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 //#region src/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.ts
 /**
 * Addon Widgets Aggregator — hub-local builtin that owns the singleton
@@ -204,9 +204,9 @@ var AddonWidgetsAggregatorAddon = class extends BaseAddon {
 		if (entryPath === null) return String(Math.floor(Date.now()));
 		try {
 			const dir = path$1.dirname(entryPath);
-			const files = fs.readdirSync(dir).filter((f) => fs.statSync(path$1.join(dir, f)).isFile()).sort();
+			const files = fs$1.readdirSync(dir).filter((f) => fs$1.statSync(path$1.join(dir, f)).isFile()).sort();
 			const cacheKey = `${dir}#${files.map((f) => {
-				const s = fs.statSync(path$1.join(dir, f));
+				const s = fs$1.statSync(path$1.join(dir, f));
 				return `${f}:${s.size}:${s.mtimeMs}`;
 			}).join("|")}`;
 			const cached = this.bundleHashCache.get(cacheKey);
@@ -214,7 +214,7 @@ var AddonWidgetsAggregatorAddon = class extends BaseAddon {
 			const hash = createHash("sha1");
 			for (const f of files) {
 				hash.update(f);
-				hash.update(fs.readFileSync(path$1.join(dir, f)));
+				hash.update(fs$1.readFileSync(path$1.join(dir, f)));
 			}
 			const digest = hash.digest("hex").slice(0, 12);
 			this.bundleHashCache.set(cacheKey, digest);

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as errMsg, Da as EventCategory, Ki as defineRecordKinds, St as alertsCapability, Ui as createEvent, bn as isAlertEpisodeSeverity, bt as alertEpisodeId, ei as BaseAddon, i as AlertSchema, xt as alertEpisodePayload, yn as isAlertEpisodeOpen } from "../../dist-5XUG7iYJ.mjs";
+import { Oa as EventCategory, St as alertsCapability, Wi as createEvent, bn as isAlertEpisodeSeverity, bt as alertEpisodeId, ei as errMsg, i as AlertSchema, qi as defineRecordKinds, ti as BaseAddon, xt as alertEpisodePayload, yn as isAlertEpisodeOpen } from "../../dist-C9lbdBL5.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,