@camstack/system 1.2.471 → 1.2.473

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-BNXVX-ot.js");
+const require_wal_maintenance = require("./wal-maintenance-BT8Ns0W3.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Bl2I-ZcR.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BuB731DK.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-zD3JojB_.mjs → hub-mdns-ciao-BemeCNGe.mjs}

@@ -1,7 +1,7 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { Ta as userError } from "./dist-5XUG7iYJ.mjs";
+import { Ea as userError } from "./dist-C9lbdBL5.mjs";
 import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
-import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-DHBvFZJS.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-DOwn4pqL.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";

package/dist/{hub-mdns-ciao-vEWhJ_SD.js → hub-mdns-ciao-CUr6ewsX.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BjcWEfRy.js");
+const require_dist = require("./dist-Bmah6waF.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_agent_https = require("./agent-https-bH6bKDeK.js");
+const require_agent_https = require("./agent-https-B9Q3-IKd.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BjcWEfRy.js");
-const require_device_ca = require("./device-ca-nOCYVFS4.js");
+const require_dist = require("./dist-Bmah6waF.js");
+const require_device_ca = require("./device-ca-BXzQ1pYj.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
@@ -26,21 +26,21 @@ const require_builtins_loki_logging_index = require("./builtins/loki-logging/ind
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_device_history_device_history_addon = require("./builtins/device-history/device-history.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-BNXVX-ot.js");
+const require_wal_maintenance = require("./wal-maintenance-BT8Ns0W3.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-bH6bKDeK.js");
-const require_constants = require("./constants-CToE4OFp.js");
+const require_agent_https = require("./agent-https-B9Q3-IKd.js");
+const require_constants = require("./constants-XkWSVvgY.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-MRyes5j0.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-vEWhJ_SD.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-CUr6ewsX.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-B64m2nAj.js");
+const require_restore_archive = require("./restore-archive-DbPmyjiM.js");
 const require_coral_accelerators = require("./coral-accelerators-BSVsBVzt.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -21789,7 +21789,7 @@ function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
 }
 /**
-* Parse an `op.path` (e.g. `"pipelineExecutor.getDefaultSteps"`) into
+* Parse an `op.path` (e.g. `"pipelineExecutor.getAvailableEngines"`) into
 * the capability name (kebab-case) and the method name.
 */
 function parsePath(path) {
@@ -22299,6 +22299,148 @@ function buildLinkChain(target, localResolver, hookup) {
 	return links;
 }
 //#endregion
+//#region src/kernel/hwaccel/vaapi-init-probe.ts
+/**
+* Can libva initialise the VA driver on this node's render node? (D926)
+*
+* Measured 2026-10-23 (intel-1.2.509, hub + little-unraid): Intel's iHD 25.2.4
+* exports only `__vaDriverInit_1_22`, the container's Ubuntu libva 2.20 looks
+* for `_1_20`, and `vaInitialize` failed — while the resolver kept offering
+* `qsv, vaapi`. Every session tried, failed and fell back to software: 722
+* `hwaccel 'vaapi' failed` lines a day and nothing that named the cause.
+*
+* One `vainfo --display drm --device <node>` per process answers it. A failure
+* reads the driver's exported `__vaDriverInit_1_N` so the verdict names the gap
+* (`driver iHD needs VA-API >= 1.22, libva has 1.20`). No `vainfo` on the host
+* (a bare install) is `unknown` — the resolver then behaves as it always did.
+*/
+var VAINFO_TIMEOUT_MS = 1e4;
+var INIT_SYMBOL = /__vaDriverInit_(\d+)_(\d+)/g;
+var VA_API_VERSION = /VA-API version:? (\d+)\.(\d+)/;
+var DRIVER_OPEN = /Trying to open (\S+_drv_video\.so)/g;
+function newestInitVersion(symbols) {
+	let best = null;
+	for (const symbol of symbols) for (const m of symbol.matchAll(INIT_SYMBOL)) {
+		const v = {
+			major: Number(m[1]),
+			minor: Number(m[2])
+		};
+		if (!best || v.major > best.major || v.major === best.major && v.minor > best.minor) best = v;
+	}
+	return best;
+}
+function lastMatch(text, re) {
+	let last = null;
+	for (const m of text.matchAll(re)) last = m[1] ?? null;
+	return last;
+}
+function lastLine(text) {
+	const lines = text.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+	return lines[lines.length - 1] ?? "no output";
+}
+function driverName(driverPath) {
+	if (!driverPath) return "unknown";
+	return (0, node_path.basename)(driverPath).replace(/_drv_video\.so$/, "");
+}
+/** Classify one vainfo run plus the driver's exported init symbols. Pure. */
+function classifyVainfo(run, driverSymbols) {
+	const va = VA_API_VERSION.exec(run.output);
+	const vaApiVersion = va ? `${va[1]}.${va[2]}` : null;
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	const needs = newestInitVersion(driverSymbols);
+	const driverNeedsVaApi = needs ? `${needs.major}.${needs.minor}` : null;
+	const base = {
+		vaApiVersion,
+		driverPath,
+		driverNeedsVaApi
+	};
+	if (run.spawnError !== null) return {
+		...base,
+		state: "unknown",
+		summary: `vaapi: unknown (vainfo not run: ${run.spawnError})`
+	};
+	if (run.exitCode === 0) return {
+		...base,
+		state: "ok",
+		summary: `vaapi: ok (VA-API ${vaApiVersion ?? "?"}, driver ${driverName(driverPath)})`
+	};
+	const reason = needs !== null && va !== null && (needs.major > Number(va[1]) || needs.major === Number(va[1]) && needs.minor > Number(va[2])) ? `driver ${driverName(driverPath)} needs VA-API >= ${driverNeedsVaApi}, libva has ${vaApiVersion}` : lastLine(run.output);
+	return {
+		...base,
+		state: "init-failed",
+		summary: `vaapi: init-failed (${reason})`
+	};
+}
+/** Run `vainfo` against one render node; never throws. */
+function runVainfo(renderNode) {
+	return new Promise((resolve) => {
+		(0, node_child_process.execFile)("vainfo", [
+			"--display",
+			"drm",
+			"--device",
+			renderNode
+		], {
+			timeout: VAINFO_TIMEOUT_MS,
+			encoding: "utf8"
+		}, (err, stdout, stderr) => {
+			const output = `${stdout}\n${stderr}`;
+			if (err === null) {
+				resolve({
+					exitCode: 0,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			const code = err.code;
+			if (typeof code === "number") {
+				resolve({
+					exitCode: code,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			resolve({
+				exitCode: null,
+				output,
+				spawnError: code ?? (err.killed ? "timeout" : err.message)
+			});
+		});
+	});
+}
+/**
+* The `__vaDriverInit_N_M` names in a driver file, streamed (iHD is ~43 MB),
+* with an overlap so a name split across two chunks is still found.
+*/
+function readDriverInitSymbols(driverPath) {
+	return new Promise((resolve) => {
+		const found = /* @__PURE__ */ new Set();
+		let carry = "";
+		const stream = (0, node_fs.createReadStream)(driverPath, {
+			encoding: "latin1",
+			highWaterMark: 64 * 1024
+		});
+		stream.on("data", (chunk) => {
+			const text = carry + String(chunk);
+			for (const m of text.matchAll(INIT_SYMBOL)) if (m.index + m[0].length < text.length) found.add(m[0]);
+			carry = text.slice(-32);
+		});
+		stream.on("error", () => resolve([]));
+		stream.on("end", () => {
+			for (const m of carry.matchAll(INIT_SYMBOL)) found.add(m[0]);
+			resolve([...found].sort());
+		});
+	});
+}
+/** Probe one render node: vainfo, and on failure the driver's init symbols. */
+async function probeVaapiInit(renderNode) {
+	const run = await runVainfo(renderNode);
+	if (run.spawnError !== null || run.exitCode === 0) return classifyVainfo(run, []);
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	return classifyVainfo(run, driverPath ? await readDriverInitSymbols(driverPath) : []);
+}
+//#endregion
 //#region src/kernel/hwaccel/hwaccel-resolver.ts
 /**
 * Platform-probe for hardware video decode acceleration.
@@ -22368,7 +22510,23 @@ function probePlatform() {
 		coral: require_coral_accelerators.classifyCoralAccelerator(require_coral_accelerators.nodeCoralFs)
 	};
 }
-function pickBackendsForPlatform(signals) {
+/** The backends that open their device through libva on Linux. */
+var LIBVA_BACKENDS = ["vaapi", "qsv"];
+/**
+* The preference list for these signals. A `vaapi` verdict of `init-failed`
+* (libva cannot initialise the driver — D926) removes every libva-backed
+* backend and names the cause in the rationale; `ok`, `unknown` or `null`
+* change nothing.
+*/
+function pickBackendsForPlatform(signals, vaapi = null) {
+	const res = pickBackendsFromSignals(signals);
+	if (signals.platform !== "linux" || vaapi?.state !== "init-failed") return res;
+	return {
+		preferred: res.preferred.filter((b) => !LIBVA_BACKENDS.includes(b)),
+		rationale: `${res.rationale} ${vaapi.summary} — vaapi/qsv withheld, decode runs in software.`
+	};
+}
+function pickBackendsFromSignals(signals) {
 	switch (signals.platform) {
 		case "darwin": return {
 			preferred: ["videotoolbox"],
@@ -22429,13 +22587,49 @@ function resolveHwAccel(prefer) {
 	};
 	return pickBackendsForPlatform(probePlatform());
 }
+var RENDER_NODE = "/dev/dri/renderD128";
+/** Process-wide: the VA init failure is logged once per process, not per resolver. */
+var PROCESS_VAAPI_REPORT = { reported: false };
+/** Process-wide: hub-main builds one resolver per in-process addon; vainfo runs once. */
+var PROCESS_VAAPI_PROBES = /* @__PURE__ */ new Map();
+function probeVaapiOncePerProcess(renderNode) {
+	const known = PROCESS_VAAPI_PROBES.get(renderNode);
+	if (known) return known;
+	const probe = probeVaapiInit(renderNode);
+	PROCESS_VAAPI_PROBES.set(renderNode, probe);
+	return probe;
+}
 /**
 * Build the `IKernelHwAccel` provider used to populate `ctx.kernel.hwaccel`.
-* Thin async wrapper around the sync `resolveHwAccel` function so the
-* contract matches the per-node `$hwaccel.resolve` Moleculer action.
-*/
-function createKernelHwAccel() {
-	return { resolve: async (prefer) => resolveHwAccel(prefer) };
+* An auto resolve on a Linux host with a render node asks libva ONCE per
+* provider whether it can initialise the driver (D926); an explicit override
+* is never second-guessed.
+*/
+function createKernelHwAccel(options = {}) {
+	const probeSignals = options.probeSignals ?? probePlatform;
+	const probeVaapi = options.probeVaapi ?? probeVaapiOncePerProcess;
+	const reportOnce = options.reportOnce ?? PROCESS_VAAPI_REPORT;
+	let vaapi = null;
+	const vaapiVerdict = async () => {
+		if (vaapi === null) vaapi = probeVaapi(RENDER_NODE);
+		const status = await vaapi;
+		if (status.state === "init-failed" && !reportOnce.reported) {
+			reportOnce.reported = true;
+			options.logger?.error(`hwaccel: ${status.summary} — vaapi/qsv withheld, decode runs in software`, { meta: {
+				renderNode: RENDER_NODE,
+				vaApiVersion: status.vaApiVersion,
+				driverPath: status.driverPath,
+				driverNeedsVaApi: status.driverNeedsVaApi
+			} });
+		}
+		return status;
+	};
+	return { resolve: async (prefer) => {
+		if (prefer === "none" || prefer !== null && prefer !== void 0 && prefer.length > 0) return resolveHwAccel(prefer);
+		const signals = probeSignals();
+		if (signals.platform !== "linux" || !signals.hasRenderNode) return pickBackendsForPlatform(signals);
+		return pickBackendsForPlatform(signals, await vaapiVerdict());
+	} };
 }
 //#endregion
 //#region src/kernel/inference/inference-resolver.ts
@@ -23828,7 +24022,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 					value
 				})
 			};
-			const hwaccel = createKernelHwAccel();
+			const hwaccel = createKernelHwAccel({ logger: scopedLogger });
 			const inferenceEngine = createKernelInferenceEngine();
 			return {
 				localNodeId: nodeId,
@@ -25874,6 +26068,7 @@ function releaseRunnerGroup(pgid) {
 * Returns how many groups were signalled.
 */
 function signalAllRunnerGroups(signal) {
+	beginRunnerShutdown();
 	let signalled = 0;
 	for (const [pgid, group] of ownedGroups) try {
 		group.kill(-pgid, signal);
@@ -25881,6 +26076,21 @@ function signalAllRunnerGroups(signal) {
 	} catch {}
 	return signalled;
 }
+/**
+* Set once this process has begun an ORDERLY shutdown (hub-main's SIGTERM/SIGINT
+* handler, through {@link signalAllRunnerGroups}, which signals every runner
+* BEFORE the broker stops the process service). A runner that exits after this point is part of the
+* shutdown, not a crash: its exit is INFO and it is never respawned. Without it
+* a clean hub stop logged `ERROR Process exited (code=0)` once per runner and
+* scheduled a respawn into the dying node (CT200, 2026-10-23).
+*/
+var runnerShutdownInProgress = false;
+function beginRunnerShutdown() {
+	runnerShutdownInProgress = true;
+}
+function isRunnerShutdownInProgress() {
+	return runnerShutdownInProgress;
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -26118,6 +26328,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
 			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
+			if (isRunnerShutdownInProgress()) {
+				entry.state = "stopped";
+				emitStateChange(entry);
+				capturedBroker?.logger.info(`[${runnerId}] Process exited during shutdown (code=${code}, signal=${signal})`, { tags: { runnerId } });
+				return;
+			}
 			const announced = entry.announcedRefusal;
 			entry.announcedRefusal = null;
 			if (code === 78) {
@@ -26145,7 +26361,9 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			}
 			entry.state = "crashed";
 			emitStateChange(entry);
-			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
+			const exitLine = `[${runnerId}] Process exited (code=${code}, signal=${signal})`;
+			if (code === 0 && signal === null) capturedBroker?.logger.warn(`${exitLine} — unexpected clean exit, respawning`, { tags: { runnerId } });
+			else capturedBroker?.logger.error(exitLine, { tags: { runnerId } });
 			const decision = crashSupervisor.recordCrash(runnerId);
 			emitRunnerEvent(require_dist.EventCategory.ProcessCrashed, runnerId, {
 				processId: runnerId,
@@ -26967,6 +27185,7 @@ var en_default = {
 	"auth.session-ended": "Session ended — sign in again",
 	"auth.access-denied": "Access denied",
 	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
+	"auth.person-scopes-refused": "A person is an admin, with no scope rows, or holds exactly one viewer grant",
 	"device.certificates-unavailable": "Device certificates are not available",
 	"device.not-found": "Device {id} not found",
 	"device.credentials-unavailable": "Device credentials not available",
@@ -27218,6 +27437,7 @@ var it_default = {
 	"auth.session-ended": "Sessione terminata — accedi di nuovo",
 	"auth.access-denied": "Accesso negato",
 	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
+	"auth.person-scopes-refused": "Una persona è amministratore, senza righe di permesso, oppure ha esattamente un permesso visualizzatore",
 	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
 	"device.not-found": "Dispositivo {id} non trovato",
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",