@camstack/system 1.2.91 → 1.2.92

package/dist/{dist-DhrTd8LL.mjs → dist-DXDvrBi0.mjs}

@@ -10158,6 +10158,18 @@ var LlmGenerateBaseInputSchema = z.object({
 * Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
 * watchdog — operator decision #3).
 */
+/**
+* A companion artifact that MUST land beside the main GGUF: the `mmproj`
+* projector of a vision model, or shards 2..N of a split GGUF. Carried on the
+* REF rather than looked up at install time, so what the operator approved in
+* the preview is exactly what the node downloads.
+*/
+var ManagedModelExtraFileSchema = z.object({
+	url: z.string(),
+	filename: z.string(),
+	sizeBytes: z.number(),
+	sha256: z.string().optional()
+});
 var ManagedModelRefSchema = z.discriminatedUnion("kind", [
 	z.object({
 		kind: z.literal("catalog"),
@@ -10166,7 +10178,11 @@ var ManagedModelRefSchema = z.discriminatedUnion("kind", [
 	z.object({
 		kind: z.literal("url"),
 		url: z.string(),
-		sha256: z.string().optional()
+		sha256: z.string().optional(),
+		/** Picker/status label; the file basename when absent. */
+		label: z.string().optional(),
+		sizeBytes: z.number().optional(),
+		extraFiles: z.array(ManagedModelExtraFileSchema).optional()
 	}),
 	z.object({
 		kind: z.literal("path"),
@@ -10227,11 +10243,39 @@ var ManagedRuntimeConfigSchema = z.object({
 		"q4_1",
 		"q4_0"
 	]).optional(),
+	/**
+	* Escape hatch for llama-server flags this schema does NOT model — `--jinja`
+	* (which most vision chat templates need and some language-only models
+	* dislike), `--cont-batching`, `--rope-scaling`, …
+	*
+	* It is NOT a second place to set the flags above. A token that collides
+	* with a typed field is REJECTED at start, naming the field that owns it
+	* (`assertNoOwnedFlags`), because two knobs writing the same argv is exactly
+	* the "two switches that disagree" failure this repo has already shipped
+	* twice (D62).
+	*/
+	extraArgs: z.array(z.string()).default([]),
 	/** Else lazy: first generate boots it. */
 	autoStart: z.boolean().default(false),
 	/** 0 = never; frees RAM after quiet periods. */
 	idleStopMinutes: z.number().int().default(30)
 });
+/**
+* Where a multi-GB install currently is. A single 0..1 fraction cannot answer
+* "is it stuck?" for an install that is three files (shards + mmproj) followed
+* by a sha256 pass over 22 GB — during which the fraction sat at 1.0 and the
+* node looked hung. Phase + file + bytes is the smallest shape that does.
+*/
+var LlmDownloadProgressSchema = z.object({
+	phase: z.enum(["downloading", "verifying"]),
+	/** The artifact currently moving, e.g. `mmproj-F16.gguf`. */
+	file: z.string(),
+	fileIndex: z.number().int(),
+	fileCount: z.number().int(),
+	/** Across the WHOLE install, not the current file. */
+	downloadedBytes: z.number(),
+	totalBytes: z.number().optional()
+});
 var LlmRuntimeStatusSchema = z.object({
 	/** Status is ALWAYS node-qualified. */
 	nodeId: z.string(),
@@ -10248,6 +10292,8 @@ var LlmRuntimeStatusSchema = z.object({
 	modelPath: z.string().optional(),
 	modelId: z.string().optional(),
 	downloadProgress: z.number().min(0).max(1).optional(),
+	/** Detail behind `downloadProgress`; present for the same lifetime. */
+	download: LlmDownloadProgressSchema.optional(),
 	lastError: z.string().optional(),
 	crashesInWindow: z.number(),
 	/** Child RSS (sampled best-effort). */
@@ -10258,7 +10304,14 @@ var LlmNodeModelSchema = z.object({
 	file: z.string(),
 	sizeBytes: z.number(),
 	catalogId: z.string().optional(),
-	installedAt: z.number().optional()
+	installedAt: z.number().optional(),
+	/**
+	* Absolute path on the node. Present so a file that is on disk but matches
+	* no catalog entry — a custom Hugging Face install, or a GGUF the operator
+	* copied in by hand — is still SELECTABLE, as a `{kind:'path'}` ref. Without
+	* it the picker could list such a file and do nothing with it.
+	*/
+	path: z.string().optional()
 });
 var LlmRuntimeDiskUsageSchema = z.object({
 	nodeId: z.string(),
@@ -10351,9 +10404,12 @@ var LlmProfileSchema = z.object({
 	systemPrompt: z.string().optional(),
 	/** Total generation bound — the only one a unary call has. */
 	timeoutMs: z.number().int().positive().default(6e4),
-	/** Wait for response headers only. */
+	/** The TCP handshake only — "is the port even open". NOT the wait for
+	*  response headers: on the LM Studio / llama-server wire those are written
+	*  once the model has finished loading, so they belong to the bound below. */
 	connectTimeoutMs: z.number().int().positive().default(1e4),
-	/** Accepted, but no output yet — a cold GPU load lives here. */
+	/** Accepted, but no output yet — response headers included, because a cold
+	*  GPU load is exactly what happens before them. */
 	firstTokenTimeoutMs: z.number().int().positive().default(12e4),
 	/** Output started then stopped. */
 	idleTimeoutMs: z.number().int().positive().default(6e4),
@@ -10416,6 +10472,36 @@ var ManagedModelCatalogEntrySchema = z.object({
 	/** Vision models: companion projector file. */
 	mmprojUrl: z.string().optional()
 });
+/**
+* The outcome of turning one operator-typed Hugging Face reference into a
+* download plan. A RESULT, never a throw: "this repo has 24 quantizations and
+* I will not pick for you" is a normal answer the UI has to render, not an
+* exception.
+*
+* `candidates` is the whole reason the refusal is usable — every string in it
+* is a tag that resolves when pasted back as `<org>/<repo>:<TAG>`.
+*/
+var HfModelResolutionSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	/** Ready to hand to `installModel` unchanged. */
+	model: ManagedModelRefSchema,
+	label: z.string(),
+	repo: z.string(),
+	quantization: z.string(),
+	purpose: z.enum(["text", "vision"]),
+	totalBytes: z.number(),
+	/** mmproj + shards, for the preview: an operator approving 23 GB should
+	*  see that 0.9 GB of it is a projector they did not name. */
+	extraFilenames: z.array(z.string())
+}), z.object({
+	ok: z.literal(false),
+	code: z.string(),
+	message: z.string(),
+	candidates: z.array(z.string()).optional(),
+	/** Set when the refusal was only the ceiling: re-calling with
+	*  `maxBytes: requiredBytes` is the operator's explicit override. */
+	requiredBytes: z.number().optional()
+})]);
 var LlmRuntimeNodeSchema = z.object({
 	nodeId: z.string(),
 	reachable: z.boolean(),
@@ -10483,6 +10569,25 @@ var llmCapability = {
 		listModelCatalog: method(z.object({}), z.array(ManagedModelCatalogEntrySchema)),
 		listRuntimeNodes: method(z.object({}), z.array(LlmRuntimeNodeSchema)),
 		listNodeModels: method(z.object({ nodeId: z.string() }), z.array(LlmNodeModelSchema)),
+		/**
+		* One typed Hugging Face reference → a pinned, verified `ManagedModelRef`.
+		*
+		* Runs on the HUB, not on the target node: resolution needs egress to
+		* huggingface.co, and an agent that cannot reach it still installs fine
+		* through the model-distributor relay. Nothing is downloaded here — this is
+		* a tree read plus a HEAD, so the operator sees the size, the quantization
+		* and the mmproj BEFORE approving a multi-GB pull.
+		*/
+		resolveModelRef: method(z.object({
+			/** `https://huggingface.co/<org>/<repo>/resolve/main/<f>.gguf`,
+			*  `<org>/<repo>/<f>.gguf`, `<org>/<repo>` or `<org>/<repo>:<QUANT>`. */
+			ref: z.string(),
+			/** Explicit ceiling override, in bytes. Absent = the built-in ceiling. */
+			maxBytes: z.number().positive().optional()
+		}), HfModelResolutionSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		installModel: method(z.object({
 			nodeId: z.string(),
 			model: ManagedModelRefSchema
@@ -12620,9 +12725,66 @@ var NcDeviceStateConditionSchema = z.object({
 	/** Any of these matches. */
 	states: z.array(z.string().min(1)).min(1)
 });
+/**
+* "This rule applies only while scene `sceneId` is `matched` / `diverged`."
+*
+* A GATE, not a trigger. `occupancy` and `audio` each DISCRIMINATE their rule —
+* carrying one makes the rule fire on that subject and nothing else. Scene is
+* the other shape entirely, the `deviceState` shape: it narrows a rule that
+* already has a trigger ("tell me about a person at the front door, but only
+* while the bin is still out"). That is why it composes with every delivery
+* instead of owning one, and why no new `NcDelivery` member and no new subject
+* kind exist for it — see D159.
+*
+* ── Identity ───────────────────────────────────────────────────────────────
+* `sceneId` is `SceneMonitor.id`, a `randomUUID()` minted by `createScene` —
+* globally unique, so it needs no device to disambiguate it. `deviceId` is
+* carried as a HINT for the editor and for the log line, never as part of the
+* lookup key: a rule whose hint drifted must still gate correctly.
+*
+* ── Which boolean ──────────────────────────────────────────────────────────
+* `latched` ABSENT means "whatever the scene itself says" — `SceneMonitor.emit`
+* already declares which boolean drives notification rules, and a second knob
+* that could disagree with it is exactly the D62 failure. Set it only to
+* override one rule against the scene's own default.
+*
+*  - LIVE reading (`emit`/`latched` resolve to live): passes iff
+*    `verdict === requiredState`. `unknown` — no reference for this light, view
+*    shifted, no snapshot — passes NEITHER. A scene that cannot judge is not
+*    evidence, in either direction.
+*  - LATCHED reading: passes iff `latched === (requiredState === 'diverged')`.
+*    The latch is a durable fact about the past ("it has diverged since I armed
+*    it"), so a camera that has gone dark does not clear it — that is the whole
+*    reason the operator asked for a latch.
+*
+* The gate reads an in-memory mirror (`NcSceneStateCache`) refreshed OFF the
+* event path, never the cap: D49. A mirror that has never loaded, or a scene it
+* does not carry, reads absent and the rule does NOT fire — fail closed, and
+* said out loud in the log rather than dropped in silence.
+*/
+var NcSceneConditionSchema = z.object({
+	/** `SceneMonitor.id` — the uuid the cap mints. The whole lookup key. */
+	sceneId: z.string().min(1),
+	/** The camera the scene lives on. A hint for the editor and the log line. */
+	deviceId: z.number().int().optional(),
+	/** The state the scene must be in for the rule to fire. */
+	requiredState: z.enum(["matched", "diverged"]),
+	/**
+	* Read the LATCH (`true`) or the LIVE verdict (`false`). Absent = follow the
+	* scene's own `emit` field, which is the only place that decision belongs.
+	*/
+	latched: z.boolean().optional()
+});
 var NcConditionsSchema = z.object({
 	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
 	deviceState: NcDeviceStateConditionSchema.optional(),
+	/**
+	* Gate on a SCENE's state — "only while the bin is still out". Composes with
+	* every trigger (detection, occupancy, audio, sensor, package, track-end);
+	* unlike `occupancy`/`audio` it discriminates nothing. See
+	* {@link NcSceneCondition} and D159.
+	*/
+	scene: NcSceneConditionSchema.optional(),
 	/** Device scope — absent = all devices. */
 	devices: z.array(z.number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -13260,6 +13422,7 @@ var NcConditionDescriptorSchema = z.object({
 		"occupancy",
 		"audio",
 		"deviceState",
+		"scene",
 		"systemEvent"
 	]),
 	operator: z.enum([
@@ -16485,6 +16648,17 @@ var maxSessionHoldMsField = {
 	default: 12e4,
 	step: 5e3
 };
+/**
+* Quiet period that closes an `audioMode: 'on-motion'` audio window. Floor of
+* 5s so a rearm can never degenerate into per-event stream churn; default 90s
+* comfortably outlives the gap between two PIR wakes on a battery camera.
+*/
+var audioMotionWindowMsField = {
+	min: 5e3,
+	max: 6e5,
+	default: 9e4,
+	step: 5e3
+};
 var motionFpsField = {
 	min: 1,
 	max: 30,
@@ -16661,6 +16835,27 @@ var RunnerCameraConfigSchema = z.object({
 	* resolved `CameraDetectionConfig`.
 	*/
 	maxSessionHoldMs: z.number().min(maxSessionHoldMsField.min).max(maxSessionHoldMsField.max).optional(),
+	/**
+	* Orchestrator-side quiet period (ms) that closes an `audioMode:
+	* 'on-motion'` audio window, measured from the LAST motion event.
+	*
+	* This exists because the falling edge cannot be relied on. Camera-native
+	* providers emit motion as a RISING EDGE ONLY (Reolink's Baichuan push and
+	* its email-push SMTP path both emit `detected: true` and never the
+	* counterpart); only the frame-diff analyzer emits falls. So on an
+	* onboard-only camera a window that closed only on `detected: false` never
+	* closed at all, and `on-motion` silently behaved as `always-on` — on a
+	* battery camera, the one failure mode the mode exists to prevent.
+	*
+	* Every motion event rearms this timer WITHOUT restarting the stream, so a
+	* burst of re-fires costs nothing. A falling edge, when one does arrive,
+	* still closes earlier via `motionCooldownMs` — whichever comes first wins.
+	*
+	* Not consumed by the runner: carried here so it shares the per-camera
+	* device-settings surface with `motionCooldownMs`, exactly like
+	* `maxSessionHoldMs`.
+	*/
+	audioMotionWindowMs: z.number().min(audioMotionWindowMsField.min).max(audioMotionWindowMsField.max).optional(),
 	motionFps: z.number().min(motionFpsField.min).max(motionFpsField.max).default(motionFpsField.default),
 	detectionFps: z.number().min(detectionFpsField.min).max(detectionFpsField.max).default(detectionFpsField.default),
 	motionStreamId: z.string(),
@@ -16756,7 +16951,7 @@ var RunnerCameraConfigSchema = z.object({
 	*/
 	inferenceDevices: z.array(RunnerInferenceDeviceSchema).readonly().optional()
 });
-motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
+motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, audioMotionWindowMsField.min, audioMotionWindowMsField.max, audioMotionWindowMsField.step, audioMotionWindowMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
 /**
 * Runtime load summary returned by `getLocalLoad`. Used by the orchestrator's
 * load-balancing levels (L2 capacity-based, L3 hardware-aware) to decide
@@ -26788,6 +26983,33 @@ var recordingExportCapability = {
 *  as `unknown`, never guessed. A day reference scored against an IR frame
 *  collapses the cosine and would latch a false alarm every single night. */
 var SceneConditionSchema = z.string();
+/**
+* What a scene does when the CURRENT light has no reference of its own.
+*
+* The lighting variants are not equally likely to exist. Almost every operator
+* captures daylight and then never stands outside at 22:00 to capture IR, and a
+* scene that is only ever going to be asked about a daytime question ("is the
+* bin still on the kerb at 08:00") does not need a night reference at all. The
+* night half must therefore be OPTIONAL, and optional means the scene keeps
+* working without it rather than degrading into a permanent complaint.
+*
+* - `skip` (default) — the check in that light is not made. Not a verdict, not
+*   an alarm, not even an `unknown`: the live state simply stays whatever the
+*   last covered light left it at, the latch is untouched, and the hysteresis
+*   run is neither spent nor cleared. The scene resumes by itself at first
+*   light. This is the only behaviour under which "I never captured IR" is a
+*   configuration choice instead of a nightly fault.
+* - `judge-anyway` — score against the OTHER conditions' references. Available
+*   for cameras whose IR frame is close enough to daylight (a floodlit
+*   driveway, an always-white-light doorbell), and wrong for everything else:
+*   cross-condition cosines are not comparable, so a day reference against a
+*   true IR frame collapses and the scene reports a theft at 21:40.
+*
+* Never applies when the scene has NO comparable reference at all — that is
+* "not armed yet", it is reported as `no-reference-for-condition`, and silence
+* there would hide a scene the operator never finished setting up.
+*/
+var SceneUncoveredPolicySchema = z.enum(["skip", "judge-anyway"]);
 /** `matched` = the baseline is what we see; `diverged` = it demonstrably is not;
 *  `unknown` = we cannot judge (no reference for this condition, encoder model
 *  changed, view shifted, no snapshot). `unknown` is a real value, not a null,
@@ -26843,6 +27065,9 @@ var SceneCheckSchema = z.discriminatedUnion("mode", [z.object({
 	hysteresisCount: z.number().int().positive()
 })]);
 var SCENE_DEFAULT_ANCHOR_THRESHOLD = .85;
+/** Night is OPTIONAL. A scene with only a daylight reference sits the IR hours
+*  out in silence rather than reporting a fault every night. */
+var SCENE_DEFAULT_UNCOVERED_POLICY = "skip";
 /**
 * Vision-model adjudication of a candidate flip. Field names deliberately
 * mirror `NcConfirmSchema` so an operator meets one vocabulary, not two.
@@ -26909,6 +27134,21 @@ var SceneMonitorSchema = z.object({
 	*  automation can react to the bin coming back without the operator's own
 	*  alarm silently clearing itself. */
 	autoRestore: z.boolean().default(false),
+	/** What to do when the current light has no reference of its own. See
+	*  {@link SceneUncoveredPolicySchema} — the default makes night OPTIONAL. */
+	onUncoveredCondition: SceneUncoveredPolicySchema.default(SCENE_DEFAULT_UNCOVERED_POLICY),
+	/**
+	* The light whose checks are currently being SAT OUT under
+	* `onUncoveredCondition: 'skip'` — `null` when the scene is checking normally.
+	*
+	* Engine-reported and advisory only: it moves no verdict, no latch and no
+	* hysteresis. It exists so the card can say *"night (IR) — checks paused,
+	* nothing captured in this light"* in the same calm voice as the coverage
+	* line, because the alternative is a scene that silently stops answering
+	* after sunset with nothing anywhere saying why. A skipped check must never
+	* read as a broken one.
+	*/
+	suspendedCondition: SceneConditionSchema.nullable().default(null),
 	/** Named cause when `verdict === 'unknown'`. */
 	unavailable: SceneUnavailableSchema.nullable(),
 	/** Conditions that have at least one comparable reference — the coverage line
@@ -26962,6 +27202,7 @@ var sceneMonitorCapability = {
 				minObservationSpacingSec: z.number().int().min(0).max(3600).optional(),
 				anchorThreshold: z.number().min(0).max(1).optional(),
 				autoRestore: z.boolean().optional(),
+				onUncoveredCondition: SceneUncoveredPolicySchema.optional(),
 				/** `null` clears the vision-model adjudicator. */
 				confirm: SceneConfirmSchema.nullable().optional()
 			})
@@ -31707,6 +31948,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.resolveModelRef": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.setDefault": {
 		capName: "llm",
 		capScope: "system",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-9Gfk4KOk.js");
+const require_dist = require("./dist-BH2tZ9ZN.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
-const require_manifest_python_deps = require("./manifest-python-deps-C0zkl1Ae.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BZO_eMn-.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -1181,6 +1181,11 @@ var LogManager = class {
 	subscribers = /* @__PURE__ */ new Map();
 	deviceNameLookup = null;
 	/**
+	* The bootstrap stdout sink, while one is attached. Detached — and its
+	* replay suppressed — when {@link STDOUT_DESTINATION_ADDON_ID} registers.
+	*/
+	bootstrapConsole = null;
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*
@@ -1282,13 +1287,34 @@ var LogManager = class {
 	setDestinationEnabledCheck(check) {
 		this.isDestinationEnabled = check ?? void 0;
 	}
+	/**
+	* Attach a minimal console sink that carries the boot log until the real
+	* `console-logging` builtin registers — see {@link STDOUT_DESTINATION_ADDON_ID}.
+	*
+	* Registered WITHOUT an `addonId` on purpose: the per-destination toggle
+	* could otherwise hide the one window an operator cannot read any other way
+	* (a hub that dies before pass 3 would emit nothing at all). It is detached
+	* the moment the stdout owner arrives, so stdout never carries two copies.
+	*
+	* Idempotent: a second call while one is attached is a no-op.
+	*/
+	attachBootstrapConsole(dest) {
+		if (this.bootstrapConsole !== null) return;
+		this.bootstrapConsole = dest;
+		this.destinations.push({ dest });
+	}
 	addDestination(dest, opts = {}) {
-		const replay = opts.replay ?? true;
+		const supersedesBootstrap = this.bootstrapConsole !== null && opts.addonId === "console-logging";
+		if (supersedesBootstrap && this.bootstrapConsole !== null) {
+			this.removeDestination(this.bootstrapConsole);
+			this.bootstrapConsole = null;
+		}
+		const replay = opts.replay ?? !supersedesBootstrap;
 		this.destinations.push(opts.addonId === void 0 ? { dest } : {
 			dest,
 			addonId: opts.addonId
 		});
-		if (replay) for (const entry of this.ringBuffer.query({})) try {
+		if (replay) for (const entry of [...this.ringBuffer.query({})].reverse()) try {
 			dest.write(entry);
 		} catch {}
 	}
@@ -93941,9 +93967,18 @@ function createStreamProbeBrokerService(deps) {
 */
 var HEALTH_MONITOR_TICK_MS = 3e4;
 var HEALTH_MONITOR_GRACE_PERIOD_MS = 5 * 6e4;
-/** Retry intervals after each failure (capped — never stops). */
+/**
+* Retry intervals after each failure (capped — never stops).
+*
+* The FIRST interval must not exceed {@link HEALTH_MONITOR_TICK_MS}: retries can
+* only fire on a tick, so anything larger just adds latency on top of a wait the
+* tick already imposes. It used to be 60 s, which meant an addon that failed to
+* load because the boot was still moving files around stayed down for 60–90 s
+* — a schedule that presumed a healthy hub (docs/design/boot-to-usable-camera.md,
+* item E). Pinned by `addon-health-monitor.spec.ts`.
+*/
 var HEALTH_MONITOR_RETRY_INTERVALS_MS = [
-	6e4,
+	3e4,
 	12e4,
 	3e5
 ];

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as objectInputDeclaresAddonId, At as createEvent, B as isArrayOutputSchema, Bt as resolveCapMount, Dt as asJsonObject$1, G as kebabToCamel, H as isObjectInput, K as lifecycleJobSchema, Lt as parseJsonObject, Nt as expandCapMethods, Ot as asNumber, R as extractNestedAddonId, Rt as parseJsonUnknown$1, Tt as ReadinessTimeoutError, Ut as EventCategory$1, V as isCollectionArrayMethod, Vt as scopeKey, W as isVoidInput, X as looseSchema, Y as logLevelAtMost, at as scopesAllowDeviceCap, bt as DEVICE_STATUS_METHOD, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, gt as errMsg$1, it as scopesAllowAddon, jt as emitDownForOwnedCaps, kt as asString$1, nt as procedureAuthKey, t as ALL_CAPABILITY_DEFINITIONS, vt as DATAPLANE_SECRET_HEADER$1, wt as ReadinessRegistry, y as addonSettingsCapability, yt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, zt as readinessKey } from "./dist-DhrTd8LL.mjs";
+import { $ as objectInputDeclaresAddonId, At as createEvent, B as isArrayOutputSchema, Bt as resolveCapMount, Dt as asJsonObject$1, G as kebabToCamel, H as isObjectInput, K as lifecycleJobSchema, Lt as parseJsonObject, Nt as expandCapMethods, Ot as asNumber, R as extractNestedAddonId, Rt as parseJsonUnknown$1, Tt as ReadinessTimeoutError, Ut as EventCategory$1, V as isCollectionArrayMethod, Vt as scopeKey, W as isVoidInput, X as looseSchema, Y as logLevelAtMost, at as scopesAllowDeviceCap, bt as DEVICE_STATUS_METHOD, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, gt as errMsg$1, it as scopesAllowAddon, jt as emitDownForOwnedCaps, kt as asString$1, nt as procedureAuthKey, t as ALL_CAPABILITY_DEFINITIONS, vt as DATAPLANE_SECRET_HEADER$1, wt as ReadinessRegistry, y as addonSettingsCapability, yt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, zt as readinessKey } from "./dist-DXDvrBi0.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-CuE_hBli.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-fWzdEasI.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-D3hP9W8D.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -1173,6 +1173,11 @@ var LogManager = class {
 	subscribers = /* @__PURE__ */ new Map();
 	deviceNameLookup = null;
 	/**
+	* The bootstrap stdout sink, while one is attached. Detached — and its
+	* replay suppressed — when {@link STDOUT_DESTINATION_ADDON_ID} registers.
+	*/
+	bootstrapConsole = null;
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*
@@ -1274,13 +1279,34 @@ var LogManager = class {
 	setDestinationEnabledCheck(check) {
 		this.isDestinationEnabled = check ?? void 0;
 	}
+	/**
+	* Attach a minimal console sink that carries the boot log until the real
+	* `console-logging` builtin registers — see {@link STDOUT_DESTINATION_ADDON_ID}.
+	*
+	* Registered WITHOUT an `addonId` on purpose: the per-destination toggle
+	* could otherwise hide the one window an operator cannot read any other way
+	* (a hub that dies before pass 3 would emit nothing at all). It is detached
+	* the moment the stdout owner arrives, so stdout never carries two copies.
+	*
+	* Idempotent: a second call while one is attached is a no-op.
+	*/
+	attachBootstrapConsole(dest) {
+		if (this.bootstrapConsole !== null) return;
+		this.bootstrapConsole = dest;
+		this.destinations.push({ dest });
+	}
 	addDestination(dest, opts = {}) {
-		const replay = opts.replay ?? true;
+		const supersedesBootstrap = this.bootstrapConsole !== null && opts.addonId === "console-logging";
+		if (supersedesBootstrap && this.bootstrapConsole !== null) {
+			this.removeDestination(this.bootstrapConsole);
+			this.bootstrapConsole = null;
+		}
+		const replay = opts.replay ?? !supersedesBootstrap;
 		this.destinations.push(opts.addonId === void 0 ? { dest } : {
 			dest,
 			addonId: opts.addonId
 		});
-		if (replay) for (const entry of this.ringBuffer.query({})) try {
+		if (replay) for (const entry of [...this.ringBuffer.query({})].reverse()) try {
 			dest.write(entry);
 		} catch {}
 	}
@@ -93933,9 +93959,18 @@ function createStreamProbeBrokerService(deps) {
 */
 var HEALTH_MONITOR_TICK_MS = 3e4;
 var HEALTH_MONITOR_GRACE_PERIOD_MS = 5 * 6e4;
-/** Retry intervals after each failure (capped — never stops). */
+/**
+* Retry intervals after each failure (capped — never stops).
+*
+* The FIRST interval must not exceed {@link HEALTH_MONITOR_TICK_MS}: retries can
+* only fire on a tick, so anything larger just adds latency on top of a wait the
+* tick already imposes. It used to be 60 s, which meant an addon that failed to
+* load because the boot was still moving files around stayed down for 60–90 s
+* — a schedule that presumed a healthy hub (docs/design/boot-to-usable-camera.md,
+* item E). Pinned by `addon-health-monitor.spec.ts`.
+*/
 var HEALTH_MONITOR_RETRY_INTERVALS_MS = [
-	6e4,
+	3e4,
 	12e4,
 	3e5
 ];

package/dist/kernel/addon-health-monitor.d.ts

@@ -35,7 +35,16 @@ import { IEventBus, IScopedLogger } from '@camstack/types';
  */
 export declare const HEALTH_MONITOR_TICK_MS = 30000;
 export declare const HEALTH_MONITOR_GRACE_PERIOD_MS: number;
-/** Retry intervals after each failure (capped — never stops). */
+/**
+ * Retry intervals after each failure (capped — never stops).
+ *
+ * The FIRST interval must not exceed {@link HEALTH_MONITOR_TICK_MS}: retries can
+ * only fire on a tick, so anything larger just adds latency on top of a wait the
+ * tick already imposes. It used to be 60 s, which meant an addon that failed to
+ * load because the boot was still moving files around stayed down for 60–90 s
+ * — a schedule that presumed a healthy hub (docs/design/boot-to-usable-camera.md,
+ * item E). Pinned by `addon-health-monitor.spec.ts`.
+ */
 export declare const HEALTH_MONITOR_RETRY_INTERVALS_MS: readonly number[];
 export type AddonHealthPhase = 'pending' | 'healthy' | 'failed';
 export interface AddonHealthState {

package/dist/logging/log-manager.d.ts

@@ -14,6 +14,17 @@ export interface ILogDestination {
  * SAME orchestrator toggle as every other destination.
  */
 export declare const LOG_BUFFER_DESTINATION_ID = "log-buffer";
+/**
+ * The addon that OWNS stdout. Every other shipped destination writes somewhere
+ * else (winston is file-only, loki is remote), so this is the single id whose
+ * arrival means "the real console is up now".
+ *
+ * It exists because the console destination is a core builtin that boots after
+ * the whole runner plan: a measured hub boot produced no stdout for ~40 s and
+ * then flushed the backlog newest-first. {@link LogManager.attachBootstrapConsole}
+ * covers that window, and this constant is how the handover is recognised.
+ */
+export declare const STDOUT_DESTINATION_ADDON_ID = "console-logging";
 export declare class LogManager {
     private readonly ringBuffer;
     /**
@@ -34,6 +45,11 @@ export declare class LogManager {
     private isDestinationEnabled?;
     private readonly subscribers;
     private deviceNameLookup;
+    /**
+     * The bootstrap stdout sink, while one is attached. Detached — and its
+     * replay suppressed — when {@link STDOUT_DESTINATION_ADDON_ID} registers.
+     */
+    private bootstrapConsole;
     /**
      * `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
      * evicts only its own lines, so quiet addons keep their sparse history.
@@ -78,6 +94,18 @@ export declare class LogManager {
     }): void;
     /** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
     setDestinationEnabledCheck(check: ((addonId: string) => boolean) | null): void;
+    /**
+     * Attach a minimal console sink that carries the boot log until the real
+     * `console-logging` builtin registers — see {@link STDOUT_DESTINATION_ADDON_ID}.
+     *
+     * Registered WITHOUT an `addonId` on purpose: the per-destination toggle
+     * could otherwise hide the one window an operator cannot read any other way
+     * (a hub that dies before pass 3 would emit nothing at all). It is detached
+     * the moment the stdout owner arrives, so stdout never carries two copies.
+     *
+     * Idempotent: a second call while one is attached is a no-op.
+     */
+    attachBootstrapConsole(dest: ILogDestination): void;
     addDestination(dest: ILogDestination, opts?: {
         replay?: boolean;
         addonId?: string;

package/dist/{manifest-python-deps-C0zkl1Ae.js → manifest-python-deps-BZO_eMn-.js}

@@ -1678,13 +1678,7 @@ function createBrokerDeviceManagerApi(opts) {
 		});
 		return child;
 	};
-	const PROBE_RETRY_BACKOFF_MS = [
-		5 * 6e4,
-		15 * 6e4,
-		30 * 6e4,
-		60 * 6e4,
-		60 * 6e4
-	];
+	const PROBE_RETRY_BACKOFF_MS = _camstack_types_addon.BOOT_RECOVERY_BACKOFF_MS;
 	const probeRetryTimers = /* @__PURE__ */ new Map();
 	const cancelProbeRetry = (deviceId) => {
 		const timer = probeRetryTimers.get(deviceId);