@camstack/system 1.2.471 → 1.2.473

package/dist/builtins/liveness-monitor/storage-root-access.d.ts

@@ -0,0 +1,53 @@
+import { type StorageLocation } from "@camstack/types";
+import type { LivenessFinding } from "./liveness-checks.js";
+/** Owner and permission bits of a directory, as `stat` reports them. */
+export interface DirStat {
+	readonly uid: number;
+	readonly gid: number;
+	readonly mode: number;
+}
+/** The two filesystem reads the check makes; injected so a test can run without root. */
+export interface StorageRootProbe {
+	/** Resolves when the CURRENT process may write (and traverse) `dir`; rejects otherwise. */
+	readonly canWrite: (dir: string) => Promise<void>;
+	readonly stat: (dir: string) => Promise<DirStat>;
+	/** The process uid/gid, or `null` where the platform has none (Windows). */
+	readonly processUid: number | null;
+	readonly processGid: number | null;
+}
+/** One root this node must be able to write, and every location that writes under it. */
+export interface StorageRootTarget {
+	readonly path: string;
+	readonly locationIds: readonly string[];
+}
+export type StorageRootAccess = {
+	readonly kind: "writable";
+	readonly target: StorageRootTarget;
+} | {
+	readonly kind: "unwritable";
+	readonly target: StorageRootTarget;
+	/** The directory that refused: the root itself, or its nearest existing ancestor. */
+	readonly blockedAt: string;
+	readonly stat: DirStat;
+	readonly reason: string;
+} | {
+	readonly kind: "unknown";
+	readonly target: StorageRootTarget;
+	readonly reason: string;
+};
+/** The hub-local, writable filesystem roots among `locations`, deduplicated by path. */
+export declare function storageRootTargets(locations: readonly StorageLocation[], localNodeId: string): readonly StorageRootTarget[];
+/** Probe one root: the root itself, or the nearest ancestor that exists. */
+export declare function probeStorageRoot(target: StorageRootTarget, probe: StorageRootProbe): Promise<StorageRootAccess>;
+/**
+* One finding per DIRECTORY that refused — several roots under one unwritable
+* mount (`/recordings` holding recordings, event media and artifacts) are one
+* cause and one alert. Stable id = that directory.
+*/
+export declare function storageRootFindings(results: readonly StorageRootAccess[], probe: StorageRootProbe): readonly LivenessFinding[];
+export declare function isStorageRootFindingId(id: string): boolean;
+/** The real probe: `fs.access(W_OK | X_OK)` as THIS process, and `fs.stat`. */
+export declare function nodeStorageRootProbe(fs: {
+	readonly access: (p: string, mode: number) => Promise<void>;
+	readonly stat: (p: string) => Promise<DirStat>;
+}): StorageRootProbe;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-nOCYVFS4.js");
+const require_device_ca = require("../../device-ca-BXzQ1pYj.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -8821,6 +8821,19 @@ var UserManager = class {
 		return this.auth.comparePassword(password, user.passwordHash);
 	}
 };
+//#endregion
+//#region src/builtins/local-auth/person-scopes.ts
+/**
+* What `userManagement.setUserScopes` may store for a person (D921, amended
+* 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
+* is refused. There is no conversion of an older grant set (D900).
+*/
+function assertPersonScopes(scopes) {
+	if (scopes.length === 0) return;
+	const only = scopes[0];
+	if (scopes.length === 1 && only !== void 0 && only.type === "viewer") return;
+	throw require_dist.userError("auth.person-scopes-refused", void 0, "A person is an admin, with no scope rows, or holds exactly one viewer grant");
+}
 var JwtSigningKeyKeeper = class {
 	deps;
 	retryTimer = null;
@@ -12179,6 +12192,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			},
 			setUserScopes: async (input) => {
 				if (!this.userManager) throw new Error("User management not available");
+				assertPersonScopes(input.scopes);
 				await this.userManager.update(input.userId, { scopes: input.scopes });
 				return { success: true };
 			},

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,15 +1,15 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ki as defineRecordKinds, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, Ta as userError, ei as BaseAddon, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, jr as userManagementCapability, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, oa as makeSecretMarker, ra as isSecretMarker, st as ScopedTokenSchema, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-5XUG7iYJ.mjs";
+import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, Mr as userManagementCapability, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, ia as isSecretMarker, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, qi as defineRecordKinds, sa as makeSecretMarker, st as ScopedTokenSchema, ti as BaseAddon, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-C9lbdBL5.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-URrs1lxK.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DyUtcpf4.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
 import * as path$1 from "node:path";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 //#region ../../node_modules/bcryptjs/index.js
 /**
 * The random implementation to use as a fallback.
@@ -8810,6 +8810,19 @@ var UserManager = class {
 		return this.auth.comparePassword(password, user.passwordHash);
 	}
 };
+//#endregion
+//#region src/builtins/local-auth/person-scopes.ts
+/**
+* What `userManagement.setUserScopes` may store for a person (D921, amended
+* 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
+* is refused. There is no conversion of an older grant set (D900).
+*/
+function assertPersonScopes(scopes) {
+	if (scopes.length === 0) return;
+	const only = scopes[0];
+	if (scopes.length === 1 && only !== void 0 && only.type === "viewer") return;
+	throw userError("auth.person-scopes-refused", void 0, "A person is an admin, with no scope rows, or holds exactly one viewer grant");
+}
 var JwtSigningKeyKeeper = class {
 	deps;
 	retryTimer = null;
@@ -12064,8 +12077,8 @@ var LocalAuthAddon = class extends BaseAddon {
 					users: this.userManager,
 					dataDir: this.ctx.nodeDataDir,
 					fs: {
-						exists: (filePath) => fs.existsSync(filePath),
-						remove: (filePath) => fs.rmSync(filePath, { force: true })
+						exists: (filePath) => fs$1.existsSync(filePath),
+						remove: (filePath) => fs$1.rmSync(filePath, { force: true })
 					},
 					logger: this.ctx.logger
 				});
@@ -12168,6 +12181,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			setUserScopes: async (input) => {
 				if (!this.userManager) throw new Error("User management not available");
+				assertPersonScopes(input.scopes);
 				await this.userManager.update(input.userId, { scopes: input.scopes });
 				return { success: true };
 			},

package/dist/builtins/local-auth/person-scopes.d.ts

@@ -0,0 +1,7 @@
+/**
+* What `userManagement.setUserScopes` may store for a person (D921, amended
+* 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
+* is refused. There is no conversion of an older grant set (D900).
+*/
+import { type UserScope } from "@camstack/types";
+export declare function assertPersonScopes(scopes: readonly UserScope[]): void;

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-vEWhJ_SD.js");
+const require_dist = require("../../dist-Bmah6waF.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CUr6ewsX.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $r as errMsg, Da as EventCategory, Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Nr as validateCustomAddress, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, Zn as pickAppLinkHub, c as CAMSTACK_APP_LINK_ORIGIN, ei as BaseAddon, or as resolveAppConnections, pr as resolveNotificationTapAddress, ur as resolveHubAddressRoles, xn as isAppLinkBase, yr as shortHostname } from "../../dist-5XUG7iYJ.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-zD3JojB_.mjs";
+import { Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Oa as EventCategory, Pr as validateCustomAddress, Qn as pickAppLinkHub, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, br as shortHostname, c as CAMSTACK_APP_LINK_ORIGIN, dr as resolveHubAddressRoles, ei as errMsg, mr as resolveNotificationTapAddress, sr as resolveAppConnections, ti as BaseAddon, xn as isAppLinkBase } from "../../dist-C9lbdBL5.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BemeCNGe.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-5XUG7iYJ.mjs";
+import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,9 +1,9 @@
-import { $r as errMsg, Da as EventCategory, Ui as createEvent, Un as metricsProviderCapability, ei as BaseAddon, ht as UNATTRIBUTED_BUCKET_KEY, ir as reducePoints, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, sr as resolveBucketMs } from "../../dist-5XUG7iYJ.mjs";
+import { Oa as EventCategory, Un as metricsProviderCapability, Wi as createEvent, ar as reducePoints, cr as resolveBucketMs, ei as errMsg, ht as UNATTRIBUTED_BUCKET_KEY, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import { platform } from "node:os";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 import { constants, readFileSync } from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 //#region src/builtins/native-metrics/cgroup-memory.ts
@@ -1642,7 +1642,7 @@ var NativeMetricsProvider = class {
 		let swapUsedBytes = 0;
 		let swapTotalBytes = 0;
 		if (IS_LINUX) try {
-			const meminfo = fs.readFileSync("/proc/meminfo", "utf-8");
+			const meminfo = fs$1.readFileSync("/proc/meminfo", "utf-8");
 			const swapTotal = parseInt(meminfo.match(/SwapTotal:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
 			const swapFree = parseInt(meminfo.match(/SwapFree:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
 			swapTotalBytes = swapTotal;
@@ -1720,7 +1720,7 @@ function sampleMacMemory(provider) {
 }
 function getDiskSpaceInternal(dirPath) {
 	return new Promise((resolve, reject) => {
-		fs.statfs(dirPath, (err, stats) => {
+		fs$1.statfs(dirPath, (err, stats) => {
 			if (err) return reject(err);
 			const totalBytes = stats.blocks * stats.bsize;
 			const availableBytes = stats.bavail * stats.bsize;
@@ -1738,7 +1738,7 @@ function getDiskSpaceInternal(dirPath) {
 async function takeDiskIoSnapshot() {
 	const now = Date.now();
 	if (IS_LINUX) try {
-		const data = fs.readFileSync("/proc/diskstats", "utf-8");
+		const data = fs$1.readFileSync("/proc/diskstats", "utf-8");
 		let readOps = 0, readBytes = 0, writeOps = 0, writeBytes = 0;
 		for (const line of data.split("\n")) {
 			const parts = line.trim().split(/\s+/);
@@ -1769,7 +1769,7 @@ async function takeDiskIoSnapshot() {
 async function takeNetworkIoSnapshot() {
 	const now = Date.now();
 	if (IS_LINUX) try {
-		const data = fs.readFileSync("/proc/net/dev", "utf-8");
+		const data = fs$1.readFileSync("/proc/net/dev", "utf-8");
 		let rxBytes = 0, txBytes = 0, rxPackets = 0, txPackets = 0, rxErrors = 0, txErrors = 0;
 		for (const line of data.split("\n")) {
 			const match = line.match(/^\s*(\w+):\s+(.+)$/);
@@ -1830,7 +1830,7 @@ async function takeNetworkIoSnapshot() {
 }
 async function getCpuTemperatureInternal() {
 	if (IS_LINUX) for (const p of ["/sys/class/thermal/thermal_zone0/temp", "/sys/class/hwmon/hwmon0/temp1_input"]) try {
-		const raw = fs.readFileSync(p, "utf-8").trim();
+		const raw = fs$1.readFileSync(p, "utf-8").trim();
 		const millideg = parseInt(raw, 10);
 		if (!isNaN(millideg)) return Math.round(millideg / 100) / 10;
 	} catch {
@@ -1881,10 +1881,10 @@ function getProcessResources() {
 	let threadCount = 0;
 	if (IS_LINUX) {
 		try {
-			openFds = fs.readdirSync(`/proc/${process.pid}/fd`).length;
+			openFds = fs$1.readdirSync(`/proc/${process.pid}/fd`).length;
 		} catch {}
 		try {
-			const match = fs.readFileSync(`/proc/${process.pid}/status`, "utf-8").match(/Threads:\s+(\d+)/);
+			const match = fs$1.readFileSync(`/proc/${process.pid}/status`, "utf-8").match(/Threads:\s+(\d+)/);
 			if (match) threadCount = parseInt(match[1], 10);
 		} catch {}
 	}
@@ -1899,7 +1899,7 @@ function getProcessResources() {
 function getPressure(resource) {
 	if (!IS_LINUX) return null;
 	try {
-		const data = fs.readFileSync(`/proc/pressure/${resource}`, "utf-8");
+		const data = fs$1.readFileSync(`/proc/pressure/${resource}`, "utf-8");
 		const parseLine = (prefix) => {
 			const match = data.match(new RegExp(`${prefix} avg10=(\\d+\\.\\d+) avg60=(\\d+\\.\\d+) avg300=(\\d+\\.\\d+)`));
 			if (!match) return null;

package/dist/builtins/platform-probe/accelerator-facts-probe.d.ts

@@ -0,0 +1,24 @@
+import { type AcceleratorCompute } from "@camstack/types";
+/** Same name `accelerator_facts.FACTS_FILENAME` writes under the system temp dir. */
+export declare const ACCELERATOR_FACTS_FILENAME = "camstack-accelerator-facts.json";
+/** OpenVINO import is a few seconds; past this the estimate waits for the pool's file. */
+export declare const ACCELERATOR_FACTS_TIMEOUT_MS = 8e3;
+export declare function publishedAcceleratorFactsPath(): string;
+/** `null` when the file is absent, unreadable, or not a facts payload. */
+export declare function readPublishedAcceleratorFacts(filePath: string): readonly AcceleratorCompute[] | null;
+/** Where `accelerator_facts.py` lives, or null when this process cannot see the addon. */
+export declare function findAcceleratorFactsScript(dataDir: string | null | undefined, cwd?: string): string | null;
+export interface AcceleratorFactsExec {
+	(command: string, args: readonly string[], timeoutMs: number): Promise<string>;
+}
+export interface AcceleratorFactsProbeInput {
+	readonly pythonPath: string | null;
+	readonly scriptPath: string | null;
+	readonly exec?: AcceleratorFactsExec;
+	readonly timeoutMs?: number;
+}
+/**
+* Run the facts script. `null` when there is no interpreter, no script, or
+* the script could not ask the device (it prints `{"accelerators": null}`).
+*/
+export declare function runAcceleratorFactsProbe(input: AcceleratorFactsProbeInput): Promise<readonly AcceleratorCompute[] | null>;

package/dist/builtins/platform-probe/index.js

@@ -3,8 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_dist = require("../../dist-Bmah6waF.js");
 const require_coral_accelerators = require("../../coral-accelerators-BSVsBVzt.js");
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
 let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
@@ -313,7 +315,7 @@ var WINDOWS_PROBE_TIMEOUT_MS = 15e3;
 * entire Node process (WS handshakes, tRPC subscriptions, metrics — all
 * stalled). Keeping it async turns the probe into a true background task.
 */
-var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -341,7 +343,7 @@ async function getAvailableRAM_MB() {
 		const platform = node_os.platform();
 		try {
 			if (platform === "darwin") {
-				const { stdout: output } = await execFileAsync("vm_stat", [], {
+				const { stdout: output } = await execFileAsync$1("vm_stat", [], {
 					encoding: "utf8",
 					timeout: 3e3
 				});
@@ -375,10 +377,17 @@ var PlatformScorer = class {
 	embeddedPythonPath;
 	/** Where the Coral scan reads `/sys` and `/dev` (the host's, unless a spec fakes one). */
 	coralFs;
-	constructor(logger = noopLogger, embeddedPythonPath = null, coralFs = require_coral_accelerators.nodeCoralFs) {
+	/**
+	* Asks OpenVINO / WebGPU for compute (D930). Null in tests and when this
+	* process has no embedded interpreter — the pool's published file is the
+	* other way the same facts arrive.
+	*/
+	readAcceleratorFacts;
+	constructor(logger = noopLogger, embeddedPythonPath = null, coralFs = require_coral_accelerators.nodeCoralFs, readAcceleratorFacts = null) {
 		this.logger = logger;
 		this.embeddedPythonPath = embeddedPythonPath;
 		this.coralFs = coralFs;
+		this.readAcceleratorFacts = readAcceleratorFacts;
 	}
 	/**
 	* Probe hardware + derive scores from pure rules and score all backend combos.
@@ -569,7 +578,7 @@ var PlatformScorer = class {
 				} });
 			}
 		}
-		return {
+		const hardware = {
 			platform,
 			arch,
 			cpuModel,
@@ -580,6 +589,25 @@ var PlatformScorer = class {
 			npu,
 			coral
 		};
+		const accelerators = await this.readAcceleratorCompute();
+		return accelerators === null ? hardware : {
+			...hardware,
+			accelerators
+		};
+	}
+	/** Compute facts, or null when the probe did not run or could not ask. */
+	async readAcceleratorCompute() {
+		const read = this.readAcceleratorFacts;
+		if (read === null) return null;
+		try {
+			const facts = await read();
+			if (facts === null) return null;
+			this.logger.info("accelerator compute probed", { meta: { devices: facts.map((row) => row.deviceKey) } });
+			return facts;
+		} catch (err) {
+			this.logger.warn("accelerator compute probe failed", { meta: { error: require_dist.errMsg(err) } });
+			return null;
+		}
 	}
 	/**
 	* The Coral part of the probe, with the evidence that decided it logged —
@@ -645,7 +673,7 @@ var PlatformScorer = class {
 	/** NVIDIA's own tool: exact model and VRAM. Null when absent or failing. */
 	async probeNvidiaSmi() {
 		try {
-			const { stdout } = await execFileAsync("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
+			const { stdout } = await execFileAsync$1("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
 				encoding: "utf8",
 				timeout: 5e3,
 				windowsHide: true
@@ -666,7 +694,7 @@ var PlatformScorer = class {
 	/** Windows WMI probe; bounded, and a failure is a log line, never a boot failure. */
 	async probeWindowsHardwareSafely() {
 		const run = async (file, args) => {
-			const { stdout } = await execFileAsync(file, [...args], {
+			const { stdout } = await execFileAsync$1(file, [...args], {
 				encoding: "utf8",
 				timeout: WINDOWS_PROBE_TIMEOUT_MS,
 				windowsHide: true,
@@ -703,7 +731,7 @@ var PlatformScorer = class {
 			"python"
 		];
 		for (const cmd of candidates) try {
-			await execFileAsync(cmd, ["--version"], { timeout: 5e3 });
+			await execFileAsync$1(cmd, ["--version"], { timeout: 5e3 });
 			return cmd;
 		} catch (err) {
 			this.logger.debug(`Python command "${cmd}" not found`, { meta: { error: require_dist.errMsg(err) } });
@@ -801,6 +829,68 @@ var InferenceConfigResolver = class {
 	}
 };
 //#endregion
+//#region src/builtins/platform-probe/accelerator-facts-probe.ts
+/**
+* Read the accelerator compute the inference worker published (D930), or ask
+* the same script once when this process has the embedded interpreter.
+*
+* A missing file and a failed probe are `null` — not an empty list, and not
+* zeros. `getHardware` overlays a published file onto the cached probe so a
+* pool that starts later still reaches Auto tune.
+*/
+/** Same name `accelerator_facts.FACTS_FILENAME` writes under the system temp dir. */
+var ACCELERATOR_FACTS_FILENAME = "camstack-accelerator-facts.json";
+var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+function publishedAcceleratorFactsPath() {
+	return node_path.join(node_os.tmpdir(), ACCELERATOR_FACTS_FILENAME);
+}
+function jsonValue(text) {
+	return JSON.parse(text);
+}
+/** `null` when the file is absent, unreadable, or not a facts payload. */
+function readPublishedAcceleratorFacts(filePath) {
+	let text;
+	try {
+		text = node_fs.readFileSync(filePath, "utf8");
+	} catch {
+		return null;
+	}
+	try {
+		return require_dist.parseAcceleratorFactsJson(jsonValue(text));
+	} catch {
+		return null;
+	}
+}
+/** Where `accelerator_facts.py` lives, or null when this process cannot see the addon. */
+function findAcceleratorFactsScript(dataDir, cwd = process.cwd()) {
+	const candidates = [];
+	if (typeof dataDir === "string" && dataDir !== "") candidates.push(node_path.join(dataDir, "addons", "@camstack", "addon-pipeline", "python", "accelerator_facts.py"));
+	candidates.push(node_path.join(cwd, "packages", "addon-pipeline", "python", "accelerator_facts.py"));
+	for (const candidate of candidates) if (node_fs.existsSync(candidate)) return candidate;
+	return null;
+}
+async function defaultExec(command, args, timeoutMs) {
+	const { stdout } = await execFileAsync(command, [...args], {
+		encoding: "utf8",
+		timeout: timeoutMs,
+		windowsHide: true
+	});
+	return stdout;
+}
+/**
+* Run the facts script. `null` when there is no interpreter, no script, or
+* the script could not ask the device (it prints `{"accelerators": null}`).
+*/
+async function runAcceleratorFactsProbe(input) {
+	if (input.pythonPath === null || input.scriptPath === null) return null;
+	const exec = input.exec ?? defaultExec;
+	try {
+		return require_dist.parseAcceleratorFactsJson(jsonValue(await exec(input.pythonPath, [input.scriptPath], input.timeoutMs ?? 8e3)));
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/builtins/platform-probe/index.ts
 /**
 * The decode-hwaccel backends `ctx.kernel.hwaccel.resolve` accepts. The cap
@@ -889,7 +979,11 @@ var PlatformProbeNativeAddon = class extends require_dist.BaseAddon {
 			this.ctx.logger.debug("ensurePython unavailable for platform probe", { meta: { error: require_dist.errMsg(err) } });
 			return null;
 		});
-		this.scorer = new PlatformScorer(this.ctx.logger.withTags({ nodeId: this.bareLocalNodeId() }), embeddedPython);
+		const factsScript = findAcceleratorFactsScript(this.ctx.dataDir);
+		this.scorer = new PlatformScorer(this.ctx.logger.withTags({ nodeId: this.bareLocalNodeId() }), embeddedPython, require_coral_accelerators.nodeCoralFs, embeddedPython === null || factsScript === null ? null : () => runAcceleratorFactsProbe({
+			pythonPath: embeddedPython,
+			scriptPath: factsScript
+		}));
 		const emitPhase = (phase, payload) => {
 			this.ctx.eventBus?.emit({
 				id: `platform-probe-${phase}-${Date.now()}`,
@@ -935,7 +1029,13 @@ var PlatformProbeNativeAddon = class extends require_dist.BaseAddon {
 					return getCaps();
 				},
 				getHardware: async () => {
-					return (await getCaps()).hardware;
+					const caps = await getCaps();
+					const published = readPublishedAcceleratorFacts(publishedAcceleratorFactsPath());
+					if (published === null) return caps.hardware;
+					return {
+						...caps.hardware,
+						accelerators: published
+					};
 				},
 				resolveInferenceConfig: async (input) => {
 					const caps = await getCaps();