@camstack/system 1.2.472 → 1.2.474

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DX5Fu3mV.js");
+const require_dist = require("../../dist-Sn-HiZ4e.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CfiIg3a9.js");
+const require_device_ca = require("../../device-ca-Dg3rSU48.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -8821,6 +8821,19 @@ var UserManager = class {
 		return this.auth.comparePassword(password, user.passwordHash);
 	}
 };
+//#endregion
+//#region src/builtins/local-auth/person-scopes.ts
+/**
+* What `userManagement.setUserScopes` may store for a person (D921, amended
+* 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
+* is refused. There is no conversion of an older grant set (D900).
+*/
+function assertPersonScopes(scopes) {
+	if (scopes.length === 0) return;
+	const only = scopes[0];
+	if (scopes.length === 1 && only !== void 0 && only.type === "viewer") return;
+	throw require_dist.userError("auth.person-scopes-refused", void 0, "A person is an admin, with no scope rows, or holds exactly one viewer grant");
+}
 var JwtSigningKeyKeeper = class {
 	deps;
 	retryTimer = null;
@@ -12179,6 +12192,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			},
 			setUserScopes: async (input) => {
 				if (!this.userManager) throw new Error("User management not available");
+				assertPersonScopes(input.scopes);
 				await this.userManager.update(input.userId, { scopes: input.scopes });
 				return { success: true };
 			},

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ki as defineRecordKinds, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, Ta as userError, ei as BaseAddon, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, jr as userManagementCapability, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, oa as makeSecretMarker, ra as isSecretMarker, st as ScopedTokenSchema, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-CdFkkmXW.mjs";
+import { $ as PreferenceDeviceIdSchema, At as buildDeviceSignatureMessage, E as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, Mr as userManagementCapability, O as DEVICE_NONCE_TTL_MS, Q as PREFERENCES_MAX_VALUE_BYTES, Qt as deviceCredentialsCapability, et as PreferenceNamespaceSchema, gt as UserRecordSchema, h as CREDENTIAL_TOKEN_AUDIENCE, hn as formatDeviceRevoker, ia as isSecretMarker, kt as buildDeviceEnrollmentLink, lt as SsoBridgeClaimsSchema, mt as TokenScopeSchema, qi as defineRecordKinds, sa as makeSecretMarker, st as ScopedTokenSchema, ti as BaseAddon, tt as PreferenceValueSchema, wn as isCredentialTokenPayload, wt as authProviderCapability, y as CredentialTokenClaimsSchema } from "../../dist-BugavoVR.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BWTWWBcc.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-CHdsePe5.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
@@ -8810,6 +8810,19 @@ var UserManager = class {
 		return this.auth.comparePassword(password, user.passwordHash);
 	}
 };
+//#endregion
+//#region src/builtins/local-auth/person-scopes.ts
+/**
+* What `userManagement.setUserScopes` may store for a person (D921, amended
+* 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
+* is refused. There is no conversion of an older grant set (D900).
+*/
+function assertPersonScopes(scopes) {
+	if (scopes.length === 0) return;
+	const only = scopes[0];
+	if (scopes.length === 1 && only !== void 0 && only.type === "viewer") return;
+	throw userError("auth.person-scopes-refused", void 0, "A person is an admin, with no scope rows, or holds exactly one viewer grant");
+}
 var JwtSigningKeyKeeper = class {
 	deps;
 	retryTimer = null;
@@ -12168,6 +12181,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			setUserScopes: async (input) => {
 				if (!this.userManager) throw new Error("User management not available");
+				assertPersonScopes(input.scopes);
 				await this.userManager.update(input.userId, { scopes: input.scopes });
 				return { success: true };
 			},

package/dist/builtins/local-auth/person-scopes.d.ts

@@ -0,0 +1,7 @@
+/**
+* What `userManagement.setUserScopes` may store for a person (D921, amended
+* 2026-10-24): nothing (an admin) or exactly one viewer row. Any other row
+* is refused. There is no conversion of an older grant set (D900).
+*/
+import { type UserScope } from "@camstack/types";
+export declare function assertPersonScopes(scopes: readonly UserScope[]): void;

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DX5Fu3mV.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-C174UDzO.js");
+const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DkncLbg9.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $r as errMsg, Da as EventCategory, Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Nr as validateCustomAddress, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, Zn as pickAppLinkHub, c as CAMSTACK_APP_LINK_ORIGIN, ei as BaseAddon, or as resolveAppConnections, pr as resolveNotificationTapAddress, ur as resolveHubAddressRoles, xn as isAppLinkBase, yr as shortHostname } from "../../dist-CdFkkmXW.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CYp1Gipm.mjs";
+import { Fn as localNetworkCapability, Ft as checkRoleAddress, H as HUB_MDNS_TXT_KEYS, Oa as EventCategory, Pr as validateCustomAddress, Qn as pickAppLinkHub, Tn as isDefaultAppConnectionEndpoint, V as HUB_MDNS_SERVICE_TYPE, Z as NetworkTunnelStartedDataSchema, br as shortHostname, c as CAMSTACK_APP_LINK_ORIGIN, dr as resolveHubAddressRoles, ei as errMsg, mr as resolveNotificationTapAddress, sr as resolveAppConnections, ti as BaseAddon, xn as isAppLinkBase } from "../../dist-BugavoVR.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BDvqGIw4.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DX5Fu3mV.js");
+const require_dist = require("../../dist-Sn-HiZ4e.js");
 const require_log_read_filter = require("../../log-read-filter-Bi066jwU.js");
 let zod = require("zod");
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
+import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
 import { n as compileLogFilter, o as lineMatches } from "../../log-read-filter-D7Ev3zm-.mjs";
 import { z } from "zod";
 //#region src/builtins/loki-logging/loki-payload.ts

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DX5Fu3mV.js");
+const require_dist = require("../../dist-Sn-HiZ4e.js");
 let node_fs_promises = require("node:fs/promises");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { $r as errMsg, Da as EventCategory, Ui as createEvent, Un as metricsProviderCapability, ei as BaseAddon, ht as UNATTRIBUTED_BUCKET_KEY, ir as reducePoints, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, sr as resolveBucketMs } from "../../dist-CdFkkmXW.mjs";
+import { Oa as EventCategory, Un as metricsProviderCapability, Wi as createEvent, ar as reducePoints, cr as resolveBucketMs, ei as errMsg, ht as UNATTRIBUTED_BUCKET_KEY, mn as foldSnapshotByFunction, rt as ROOT_BUCKET_KEY, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";

package/dist/builtins/platform-probe/accelerator-facts-probe.d.ts

@@ -0,0 +1,24 @@
+import { type AcceleratorCompute } from "@camstack/types";
+/** Same name `accelerator_facts.FACTS_FILENAME` writes under the system temp dir. */
+export declare const ACCELERATOR_FACTS_FILENAME = "camstack-accelerator-facts.json";
+/** OpenVINO import is a few seconds; past this the estimate waits for the pool's file. */
+export declare const ACCELERATOR_FACTS_TIMEOUT_MS = 8e3;
+export declare function publishedAcceleratorFactsPath(): string;
+/** `null` when the file is absent, unreadable, or not a facts payload. */
+export declare function readPublishedAcceleratorFacts(filePath: string): readonly AcceleratorCompute[] | null;
+/** Where `accelerator_facts.py` lives, or null when this process cannot see the addon. */
+export declare function findAcceleratorFactsScript(dataDir: string | null | undefined, cwd?: string): string | null;
+export interface AcceleratorFactsExec {
+	(command: string, args: readonly string[], timeoutMs: number): Promise<string>;
+}
+export interface AcceleratorFactsProbeInput {
+	readonly pythonPath: string | null;
+	readonly scriptPath: string | null;
+	readonly exec?: AcceleratorFactsExec;
+	readonly timeoutMs?: number;
+}
+/**
+* Run the facts script. `null` when there is no interpreter, no script, or
+* the script could not ask the device (it prints `{"accelerators": null}`).
+*/
+export declare function runAcceleratorFactsProbe(input: AcceleratorFactsProbeInput): Promise<readonly AcceleratorCompute[] | null>;

package/dist/builtins/platform-probe/index.js

@@ -3,8 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DX5Fu3mV.js");
+const require_dist = require("../../dist-Sn-HiZ4e.js");
 const require_coral_accelerators = require("../../coral-accelerators-BSVsBVzt.js");
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
 let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
@@ -313,7 +315,7 @@ var WINDOWS_PROBE_TIMEOUT_MS = 15e3;
 * entire Node process (WS handshakes, tRPC subscriptions, metrics — all
 * stalled). Keeping it async turns the probe into a true background task.
 */
-var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -341,7 +343,7 @@ async function getAvailableRAM_MB() {
 		const platform = node_os.platform();
 		try {
 			if (platform === "darwin") {
-				const { stdout: output } = await execFileAsync("vm_stat", [], {
+				const { stdout: output } = await execFileAsync$1("vm_stat", [], {
 					encoding: "utf8",
 					timeout: 3e3
 				});
@@ -375,10 +377,17 @@ var PlatformScorer = class {
 	embeddedPythonPath;
 	/** Where the Coral scan reads `/sys` and `/dev` (the host's, unless a spec fakes one). */
 	coralFs;
-	constructor(logger = noopLogger, embeddedPythonPath = null, coralFs = require_coral_accelerators.nodeCoralFs) {
+	/**
+	* Asks OpenVINO / WebGPU for compute (D930). Null in tests and when this
+	* process has no embedded interpreter — the pool's published file is the
+	* other way the same facts arrive.
+	*/
+	readAcceleratorFacts;
+	constructor(logger = noopLogger, embeddedPythonPath = null, coralFs = require_coral_accelerators.nodeCoralFs, readAcceleratorFacts = null) {
 		this.logger = logger;
 		this.embeddedPythonPath = embeddedPythonPath;
 		this.coralFs = coralFs;
+		this.readAcceleratorFacts = readAcceleratorFacts;
 	}
 	/**
 	* Probe hardware + derive scores from pure rules and score all backend combos.
@@ -569,7 +578,7 @@ var PlatformScorer = class {
 				} });
 			}
 		}
-		return {
+		const hardware = {
 			platform,
 			arch,
 			cpuModel,
@@ -580,6 +589,25 @@ var PlatformScorer = class {
 			npu,
 			coral
 		};
+		const accelerators = await this.readAcceleratorCompute();
+		return accelerators === null ? hardware : {
+			...hardware,
+			accelerators
+		};
+	}
+	/** Compute facts, or null when the probe did not run or could not ask. */
+	async readAcceleratorCompute() {
+		const read = this.readAcceleratorFacts;
+		if (read === null) return null;
+		try {
+			const facts = await read();
+			if (facts === null) return null;
+			this.logger.info("accelerator compute probed", { meta: { devices: facts.map((row) => row.deviceKey) } });
+			return facts;
+		} catch (err) {
+			this.logger.warn("accelerator compute probe failed", { meta: { error: require_dist.errMsg(err) } });
+			return null;
+		}
 	}
 	/**
 	* The Coral part of the probe, with the evidence that decided it logged —
@@ -645,7 +673,7 @@ var PlatformScorer = class {
 	/** NVIDIA's own tool: exact model and VRAM. Null when absent or failing. */
 	async probeNvidiaSmi() {
 		try {
-			const { stdout } = await execFileAsync("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
+			const { stdout } = await execFileAsync$1("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
 				encoding: "utf8",
 				timeout: 5e3,
 				windowsHide: true
@@ -666,7 +694,7 @@ var PlatformScorer = class {
 	/** Windows WMI probe; bounded, and a failure is a log line, never a boot failure. */
 	async probeWindowsHardwareSafely() {
 		const run = async (file, args) => {
-			const { stdout } = await execFileAsync(file, [...args], {
+			const { stdout } = await execFileAsync$1(file, [...args], {
 				encoding: "utf8",
 				timeout: WINDOWS_PROBE_TIMEOUT_MS,
 				windowsHide: true,
@@ -703,7 +731,7 @@ var PlatformScorer = class {
 			"python"
 		];
 		for (const cmd of candidates) try {
-			await execFileAsync(cmd, ["--version"], { timeout: 5e3 });
+			await execFileAsync$1(cmd, ["--version"], { timeout: 5e3 });
 			return cmd;
 		} catch (err) {
 			this.logger.debug(`Python command "${cmd}" not found`, { meta: { error: require_dist.errMsg(err) } });
@@ -801,6 +829,68 @@ var InferenceConfigResolver = class {
 	}
 };
 //#endregion
+//#region src/builtins/platform-probe/accelerator-facts-probe.ts
+/**
+* Read the accelerator compute the inference worker published (D930), or ask
+* the same script once when this process has the embedded interpreter.
+*
+* A missing file and a failed probe are `null` — not an empty list, and not
+* zeros. `getHardware` overlays a published file onto the cached probe so a
+* pool that starts later still reaches Auto tune.
+*/
+/** Same name `accelerator_facts.FACTS_FILENAME` writes under the system temp dir. */
+var ACCELERATOR_FACTS_FILENAME = "camstack-accelerator-facts.json";
+var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+function publishedAcceleratorFactsPath() {
+	return node_path.join(node_os.tmpdir(), ACCELERATOR_FACTS_FILENAME);
+}
+function jsonValue(text) {
+	return JSON.parse(text);
+}
+/** `null` when the file is absent, unreadable, or not a facts payload. */
+function readPublishedAcceleratorFacts(filePath) {
+	let text;
+	try {
+		text = node_fs.readFileSync(filePath, "utf8");
+	} catch {
+		return null;
+	}
+	try {
+		return require_dist.parseAcceleratorFactsJson(jsonValue(text));
+	} catch {
+		return null;
+	}
+}
+/** Where `accelerator_facts.py` lives, or null when this process cannot see the addon. */
+function findAcceleratorFactsScript(dataDir, cwd = process.cwd()) {
+	const candidates = [];
+	if (typeof dataDir === "string" && dataDir !== "") candidates.push(node_path.join(dataDir, "addons", "@camstack", "addon-pipeline", "python", "accelerator_facts.py"));
+	candidates.push(node_path.join(cwd, "packages", "addon-pipeline", "python", "accelerator_facts.py"));
+	for (const candidate of candidates) if (node_fs.existsSync(candidate)) return candidate;
+	return null;
+}
+async function defaultExec(command, args, timeoutMs) {
+	const { stdout } = await execFileAsync(command, [...args], {
+		encoding: "utf8",
+		timeout: timeoutMs,
+		windowsHide: true
+	});
+	return stdout;
+}
+/**
+* Run the facts script. `null` when there is no interpreter, no script, or
+* the script could not ask the device (it prints `{"accelerators": null}`).
+*/
+async function runAcceleratorFactsProbe(input) {
+	if (input.pythonPath === null || input.scriptPath === null) return null;
+	const exec = input.exec ?? defaultExec;
+	try {
+		return require_dist.parseAcceleratorFactsJson(jsonValue(await exec(input.pythonPath, [input.scriptPath], input.timeoutMs ?? 8e3)));
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/builtins/platform-probe/index.ts
 /**
 * The decode-hwaccel backends `ctx.kernel.hwaccel.resolve` accepts. The cap
@@ -889,7 +979,11 @@ var PlatformProbeNativeAddon = class extends require_dist.BaseAddon {
 			this.ctx.logger.debug("ensurePython unavailable for platform probe", { meta: { error: require_dist.errMsg(err) } });
 			return null;
 		});
-		this.scorer = new PlatformScorer(this.ctx.logger.withTags({ nodeId: this.bareLocalNodeId() }), embeddedPython);
+		const factsScript = findAcceleratorFactsScript(this.ctx.dataDir);
+		this.scorer = new PlatformScorer(this.ctx.logger.withTags({ nodeId: this.bareLocalNodeId() }), embeddedPython, require_coral_accelerators.nodeCoralFs, embeddedPython === null || factsScript === null ? null : () => runAcceleratorFactsProbe({
+			pythonPath: embeddedPython,
+			scriptPath: factsScript
+		}));
 		const emitPhase = (phase, payload) => {
 			this.ctx.eventBus?.emit({
 				id: `platform-probe-${phase}-${Date.now()}`,
@@ -935,7 +1029,13 @@ var PlatformProbeNativeAddon = class extends require_dist.BaseAddon {
 					return getCaps();
 				},
 				getHardware: async () => {
-					return (await getCaps()).hardware;
+					const caps = await getCaps();
+					const published = readPublishedAcceleratorFacts(publishedAcceleratorFactsPath());
+					if (published === null) return caps.hardware;
+					return {
+						...caps.hardware,
+						accelerators: published
+					};
 				},
 				resolveInferenceConfig: async (input) => {
 					const caps = await getCaps();

package/dist/builtins/platform-probe/index.mjs

@@ -1,6 +1,7 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { $n as platformProbeCapability, $r as errMsg, Da as EventCategory, Ji as emitReadiness, _r as scoreRuntimes, an as enumerateInferenceDevices, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
+import { Oa as EventCategory, Xn as parseAcceleratorFactsJson, Yi as emitReadiness, an as enumerateInferenceDevices, ei as errMsg, er as platformProbeCapability, ti as BaseAddon, vr as scoreRuntimes } from "../../dist-BugavoVR.mjs";
 import { n as detectCoralAccelerator, r as nodeCoralFs } from "../../coral-accelerators-DBlgWB8k.mjs";
+import * as path$1 from "node:path";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import * as fs$1 from "node:fs";
@@ -307,7 +308,7 @@ var WINDOWS_PROBE_TIMEOUT_MS = 15e3;
 * entire Node process (WS handshakes, tRPC subscriptions, metrics — all
 * stalled). Keeping it async turns the probe into a true background task.
 */
-var execFileAsync = promisify(execFile);
+var execFileAsync$1 = promisify(execFile);
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -335,7 +336,7 @@ async function getAvailableRAM_MB() {
 		const platform = os$1.platform();
 		try {
 			if (platform === "darwin") {
-				const { stdout: output } = await execFileAsync("vm_stat", [], {
+				const { stdout: output } = await execFileAsync$1("vm_stat", [], {
 					encoding: "utf8",
 					timeout: 3e3
 				});
@@ -369,10 +370,17 @@ var PlatformScorer = class {
 	embeddedPythonPath;
 	/** Where the Coral scan reads `/sys` and `/dev` (the host's, unless a spec fakes one). */
 	coralFs;
-	constructor(logger = noopLogger, embeddedPythonPath = null, coralFs = nodeCoralFs) {
+	/**
+	* Asks OpenVINO / WebGPU for compute (D930). Null in tests and when this
+	* process has no embedded interpreter — the pool's published file is the
+	* other way the same facts arrive.
+	*/
+	readAcceleratorFacts;
+	constructor(logger = noopLogger, embeddedPythonPath = null, coralFs = nodeCoralFs, readAcceleratorFacts = null) {
 		this.logger = logger;
 		this.embeddedPythonPath = embeddedPythonPath;
 		this.coralFs = coralFs;
+		this.readAcceleratorFacts = readAcceleratorFacts;
 	}
 	/**
 	* Probe hardware + derive scores from pure rules and score all backend combos.
@@ -563,7 +571,7 @@ var PlatformScorer = class {
 				} });
 			}
 		}
-		return {
+		const hardware = {
 			platform,
 			arch,
 			cpuModel,
@@ -574,6 +582,25 @@ var PlatformScorer = class {
 			npu,
 			coral
 		};
+		const accelerators = await this.readAcceleratorCompute();
+		return accelerators === null ? hardware : {
+			...hardware,
+			accelerators
+		};
+	}
+	/** Compute facts, or null when the probe did not run or could not ask. */
+	async readAcceleratorCompute() {
+		const read = this.readAcceleratorFacts;
+		if (read === null) return null;
+		try {
+			const facts = await read();
+			if (facts === null) return null;
+			this.logger.info("accelerator compute probed", { meta: { devices: facts.map((row) => row.deviceKey) } });
+			return facts;
+		} catch (err) {
+			this.logger.warn("accelerator compute probe failed", { meta: { error: errMsg(err) } });
+			return null;
+		}
 	}
 	/**
 	* The Coral part of the probe, with the evidence that decided it logged —
@@ -639,7 +666,7 @@ var PlatformScorer = class {
 	/** NVIDIA's own tool: exact model and VRAM. Null when absent or failing. */
 	async probeNvidiaSmi() {
 		try {
-			const { stdout } = await execFileAsync("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
+			const { stdout } = await execFileAsync$1("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
 				encoding: "utf8",
 				timeout: 5e3,
 				windowsHide: true
@@ -660,7 +687,7 @@ var PlatformScorer = class {
 	/** Windows WMI probe; bounded, and a failure is a log line, never a boot failure. */
 	async probeWindowsHardwareSafely() {
 		const run = async (file, args) => {
-			const { stdout } = await execFileAsync(file, [...args], {
+			const { stdout } = await execFileAsync$1(file, [...args], {
 				encoding: "utf8",
 				timeout: WINDOWS_PROBE_TIMEOUT_MS,
 				windowsHide: true,
@@ -697,7 +724,7 @@ var PlatformScorer = class {
 			"python"
 		];
 		for (const cmd of candidates) try {
-			await execFileAsync(cmd, ["--version"], { timeout: 5e3 });
+			await execFileAsync$1(cmd, ["--version"], { timeout: 5e3 });
 			return cmd;
 		} catch (err) {
 			this.logger.debug(`Python command "${cmd}" not found`, { meta: { error: errMsg(err) } });
@@ -795,6 +822,68 @@ var InferenceConfigResolver = class {
 	}
 };
 //#endregion
+//#region src/builtins/platform-probe/accelerator-facts-probe.ts
+/**
+* Read the accelerator compute the inference worker published (D930), or ask
+* the same script once when this process has the embedded interpreter.
+*
+* A missing file and a failed probe are `null` — not an empty list, and not
+* zeros. `getHardware` overlays a published file onto the cached probe so a
+* pool that starts later still reaches Auto tune.
+*/
+/** Same name `accelerator_facts.FACTS_FILENAME` writes under the system temp dir. */
+var ACCELERATOR_FACTS_FILENAME = "camstack-accelerator-facts.json";
+var execFileAsync = promisify(execFile);
+function publishedAcceleratorFactsPath() {
+	return path$1.join(os$1.tmpdir(), ACCELERATOR_FACTS_FILENAME);
+}
+function jsonValue(text) {
+	return JSON.parse(text);
+}
+/** `null` when the file is absent, unreadable, or not a facts payload. */
+function readPublishedAcceleratorFacts(filePath) {
+	let text;
+	try {
+		text = fs$1.readFileSync(filePath, "utf8");
+	} catch {
+		return null;
+	}
+	try {
+		return parseAcceleratorFactsJson(jsonValue(text));
+	} catch {
+		return null;
+	}
+}
+/** Where `accelerator_facts.py` lives, or null when this process cannot see the addon. */
+function findAcceleratorFactsScript(dataDir, cwd = process.cwd()) {
+	const candidates = [];
+	if (typeof dataDir === "string" && dataDir !== "") candidates.push(path$1.join(dataDir, "addons", "@camstack", "addon-pipeline", "python", "accelerator_facts.py"));
+	candidates.push(path$1.join(cwd, "packages", "addon-pipeline", "python", "accelerator_facts.py"));
+	for (const candidate of candidates) if (fs$1.existsSync(candidate)) return candidate;
+	return null;
+}
+async function defaultExec(command, args, timeoutMs) {
+	const { stdout } = await execFileAsync(command, [...args], {
+		encoding: "utf8",
+		timeout: timeoutMs,
+		windowsHide: true
+	});
+	return stdout;
+}
+/**
+* Run the facts script. `null` when there is no interpreter, no script, or
+* the script could not ask the device (it prints `{"accelerators": null}`).
+*/
+async function runAcceleratorFactsProbe(input) {
+	if (input.pythonPath === null || input.scriptPath === null) return null;
+	const exec = input.exec ?? defaultExec;
+	try {
+		return parseAcceleratorFactsJson(jsonValue(await exec(input.pythonPath, [input.scriptPath], input.timeoutMs ?? 8e3)));
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/builtins/platform-probe/index.ts
 /**
 * The decode-hwaccel backends `ctx.kernel.hwaccel.resolve` accepts. The cap
@@ -883,7 +972,11 @@ var PlatformProbeNativeAddon = class extends BaseAddon {
 			this.ctx.logger.debug("ensurePython unavailable for platform probe", { meta: { error: errMsg(err) } });
 			return null;
 		});
-		this.scorer = new PlatformScorer(this.ctx.logger.withTags({ nodeId: this.bareLocalNodeId() }), embeddedPython);
+		const factsScript = findAcceleratorFactsScript(this.ctx.dataDir);
+		this.scorer = new PlatformScorer(this.ctx.logger.withTags({ nodeId: this.bareLocalNodeId() }), embeddedPython, nodeCoralFs, embeddedPython === null || factsScript === null ? null : () => runAcceleratorFactsProbe({
+			pythonPath: embeddedPython,
+			scriptPath: factsScript
+		}));
 		const emitPhase = (phase, payload) => {
 			this.ctx.eventBus?.emit({
 				id: `platform-probe-${phase}-${Date.now()}`,
@@ -929,7 +1022,13 @@ var PlatformProbeNativeAddon = class extends BaseAddon {
 					return getCaps();
 				},
 				getHardware: async () => {
-					return (await getCaps()).hardware;
+					const caps = await getCaps();
+					const published = readPublishedAcceleratorFacts(publishedAcceleratorFactsPath());
+					if (published === null) return caps.hardware;
+					return {
+						...caps.hardware,
+						accelerators: published
+					};
 				},
 				resolveInferenceConfig: async (input) => {
 					const caps = await getCaps();

package/dist/builtins/platform-probe/platform-scorer.d.ts

@@ -1,4 +1,4 @@
-import type { HardwareInfo, PlatformCapabilities, IScopedLogger } from "@camstack/types";
+import type { HardwareInfo, PlatformCapabilities, IScopedLogger, AcceleratorCompute } from "@camstack/types";
 import { type CoralFs } from "./coral-accelerators.js";
 import { type AcceleratorReprobe } from "./accelerator-reprobe.js";
 export declare class PlatformScorer {
@@ -15,7 +15,13 @@ export declare class PlatformScorer {
 	private readonly embeddedPythonPath;
 	/** Where the Coral scan reads `/sys` and `/dev` (the host's, unless a spec fakes one). */
 	private readonly coralFs;
-	constructor(logger?: IScopedLogger, embeddedPythonPath?: string | null, coralFs?: CoralFs);
+	/**
+	* Asks OpenVINO / WebGPU for compute (D930). Null in tests and when this
+	* process has no embedded interpreter — the pool's published file is the
+	* other way the same facts arrive.
+	*/
+	private readonly readAcceleratorFacts;
+	constructor(logger?: IScopedLogger, embeddedPythonPath?: string | null, coralFs?: CoralFs, readAcceleratorFacts?: (() => Promise<readonly AcceleratorCompute[] | null>) | null);
 	/**
 	* Probe hardware + derive scores from pure rules and score all backend combos.
 	*
@@ -30,6 +36,8 @@ export declare class PlatformScorer {
 	*/
 	probe(onPhase?: (phase: string, payload?: Record<string, unknown>) => void): Promise<PlatformCapabilities>;
 	probeHardware(): Promise<HardwareInfo>;
+	/** Compute facts, or null when the probe did not run or could not ask. */
+	private readAcceleratorCompute;
 	/**
 	* The Coral part of the probe, with the evidence that decided it logged —
 	* a node that reports a Coral, or stops reporting one, says WHY (D919).

package/dist/builtins/record-entries/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DX5Fu3mV.js");
+const require_dist = require("../../dist-Sn-HiZ4e.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/record-entries/index.mjs

@@ -1,4 +1,4 @@
-import { ei as BaseAddon, ha as recordSecretRef, ji as UnknownRecordKindError, nr as recordEntriesCapability, sa as mapSecretLeaves, ui as InvalidRecordError } from "../../dist-CdFkkmXW.mjs";
+import { Mi as UnknownRecordKindError, ca as mapSecretLeaves, di as InvalidRecordError, ga as recordSecretRef, rr as recordEntriesCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 //#region src/builtins/record-entries/entries-service.ts

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DX5Fu3mV.js");
+const require_dist = require("../../dist-Sn-HiZ4e.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Da as EventCategory, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
+import { Oa as EventCategory, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative