@camstack/types 1.2.116 → 1.2.118

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_event_category = require("./event-category-EY0GNjV9.js");
-const require_sleep = require("./sleep-CSodb2vQ.js");
+const require_event_category = require("./event-category-BaEgqJNv.js");
+const require_sleep = require("./sleep-9d8tJRbO.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -2767,6 +2767,145 @@ function pickClosestResolution(entries, target) {
 	return bestAbove?.entry ?? bestBelow?.entry;
 }
 //#endregion
+//#region src/metrics/load-series-fold.ts
+/** Bucket key for rows no addon owns. Stable, so its series is continuous. */
+var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
+var ROOT_BUCKET_KEY = "__root__";
+function bucketFor(row) {
+	if (row.addonId !== null) return {
+		key: row.addonId,
+		kind: "addon"
+	};
+	if (row.classification === "root") return {
+		key: ROOT_BUCKET_KEY,
+		kind: "root"
+	};
+	return {
+		key: UNATTRIBUTED_BUCKET_KEY,
+		kind: "unattributed"
+	};
+}
+/** Round to one decimal — the precision both producers already emit at. */
+function deci(value) {
+	return Math.round(value * 10) / 10;
+}
+/**
+* Fold one snapshot into one point per function.
+*
+* Produces a ONE-SAMPLE point: `min === max` on every field, `samples === 1`.
+* That is what lets a live event and a reduced server bucket sit in the same
+* series without the consumer knowing which is which.
+*/
+function foldSnapshotByFunction(rows, atMs) {
+	const acc = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const { key, kind } = bucketFor(row);
+		const cur = acc.get(key) ?? {
+			kind,
+			main: 0,
+			gc: 0,
+			lifetime: 0,
+			memory: 0,
+			count: 0,
+			splitKnown: true
+		};
+		const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
+		acc.set(key, {
+			kind: cur.kind,
+			main: cur.main + (row.cpuMainPercent ?? 0),
+			gc: cur.gc + (row.cpuGcPercent ?? 0),
+			lifetime: cur.lifetime + row.cpuPercent,
+			memory: cur.memory + row.memoryRssBytes,
+			count: cur.count + 1,
+			splitKnown: cur.splitKnown && known
+		});
+	}
+	return [...acc.entries()].map(([key, a]) => {
+		const main = a.splitKnown ? deci(a.main) : null;
+		const gc = a.splitKnown ? deci(a.gc) : null;
+		const lifetime = deci(a.lifetime);
+		return {
+			key,
+			kind: a.kind,
+			point: {
+				atMs,
+				samples: 1,
+				cpuMainPercent: main,
+				cpuMainPercentMin: main,
+				cpuGcPercent: gc,
+				cpuGcPercentMin: gc,
+				cpuLifetimePercent: lifetime,
+				cpuLifetimePercentMin: lifetime,
+				memoryRssBytes: a.memory,
+				memoryRssBytesMin: a.memory,
+				processCount: a.count,
+				processCountMin: a.count
+			}
+		};
+	});
+}
+/** The narrower of two bounds, treating `null` (UNKNOWN) as absorbing. */
+function minNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a < b ? a : b;
+}
+function maxNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a > b ? a : b;
+}
+/** Merge `next` into `held`, keeping the widest [min, max] of each field. */
+function mergePoints(held, next, atMs) {
+	return {
+		atMs,
+		samples: held.samples + next.samples,
+		cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
+		cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
+		cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
+		cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
+		cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
+		cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
+		memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
+		memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
+		processCount: Math.max(held.processCount, next.processCount),
+		processCountMin: Math.min(held.processCountMin, next.processCountMin)
+	};
+}
+/**
+* The bucket width that brings `spanMs` down to at most `maxPoints` points,
+* snapped up to a whole multiple of the sampling cadence.
+*
+* Returns `cadenceMs` (no reduction) when the span already fits. A caller that
+* asks for a `maxPoints` of 0 or less gets no reduction rather than an
+* infinite bucket — a nonsensical request must not produce a plausible chart.
+*/
+function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
+	if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
+	const wanted = spanMs / maxPoints;
+	if (wanted <= cadenceMs) return cadenceMs;
+	return Math.ceil(wanted / cadenceMs) * cadenceMs;
+}
+/**
+* Reduce one function's points into buckets of `bucketMs`, preserving the
+* extremes.
+*
+* Points are expected oldest-first and are returned oldest-first. A bucket
+* with no samples is ABSENT — not zero, not interpolated, not the previous
+* value held over.
+*/
+function reducePoints(points, bucketMs, origin) {
+	if (bucketMs <= 0 || points.length === 0) return points;
+	const buckets = /* @__PURE__ */ new Map();
+	for (const point of points) {
+		const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
+		const held = buckets.get(start);
+		buckets.set(start, held === void 0 ? {
+			...point,
+			atMs: start
+		} : mergePoints(held, point, start));
+	}
+	return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+}
+//#endregion
 //#region src/types/model-variant-groups.ts
 var FORMAT_KEYS = [
 	"onnx",
@@ -7719,6 +7858,19 @@ var SettingsRecordSchema = zod.z.object({
 	data: zod.z.record(zod.z.string(), zod.z.unknown())
 });
 /**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = zod.z.object({
+	id: zod.z.string().optional(),
+	data: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/**
 * Column declaration for a structured (SQL-backed) collection.
 *
 * Logical types — the backend translates each to the matching SQLite
@@ -7831,6 +7983,34 @@ var settingsStoreCapability = {
 			collection: zod.z.string(),
 			record: SettingsRecordSchema
 		}), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Insert MANY records in ONE transaction, returning how many landed.
+		*
+		* The write-side twin of {@link deleteWhere}, and it exists for the same
+		* reason: without it, appending a batch is N round trips and N COMMITs on
+		* the single shared connection that also serves every cluster-wide
+		* configuration read. The durable load series writes one process row per
+		* process per sample — 76 rows every 10 s on the live fleet — and the
+		* operator's rule for it is *one transaction per sample, never one per
+		* row*. `insert` cannot express that; nothing else could.
+		*
+		* **All or nothing.** A batch that fails on its fifth row leaves none of
+		* the five behind. A half-written sample is worse than a missing one: the
+		* missing one reads as "nobody reported", which is true, while the half
+		* one reads as "these were the only processes running", which is not.
+		*
+		* `id` is OPTIONAL per record, and that is the difference from
+		* {@link insert}. A collection whose primary key is an `INTEGER` rowid
+		* alias has no id to supply — SQLite assigns it, for free, and inventing a
+		* `randomUUID()` for such a column would write a 36-character string into
+		* an integer key. Omitted on a TEXT key, a uuid is generated exactly as
+		* `insert` does.
+		*/
+		insertMany: require_sleep.method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			records: zod.z.array(BulkRecordSchema).readonly()
+		}), zod.z.object({ inserted: zod.z.number().int() }), { kind: "mutation" }),
 		/** Update an existing record by ID. */
 		update: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -8070,6 +8250,15 @@ var dataStoreProviderCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** Insert many records in ONE transaction. All or nothing. */
+		insertMany: require_sleep.method(zod.z.object({
+			namespace: zod.z.string().optional(),
+			collection: zod.z.string(),
+			records: zod.z.array(BulkRecordSchema).readonly()
+		}), zod.z.object({ inserted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -10957,6 +11146,166 @@ var logDestinationCapability = {
 	mount: { kind: "skip" }
 };
 //#endregion
+//#region src/capabilities/load-contribution.cap.ts
+/**
+* `load-contribution` — the capability an addon reports its OWN cost through,
+* already attributed. It stores nothing.
+*
+* ## Why this exists, and why it is not a pid→camera map
+*
+* Four of the five load families in
+* `packages/addon-admin-ui/src/components/cluster/load/camera-load-attribution.ts`
+* are per-camera by construction — one forked decode worker per decode
+* session, one ffmpeg per (camera, encode plan), one ffmpeg per (camera,
+* recording profile), one ffmpeg ingest per camera source — and none could be
+* READ per camera. The obvious repair is to surface each child's pid so an
+* observer can join it against the OS process table. That repair is wrong
+* here, for a reason worth writing down:
+*
+*  - the join needs an entity with GLOBAL knowledge (which pid belongs to
+*    which camera, for every addon), and every such entity is a list that a
+*    new addon has to be added to — the failure mode of a central list is that
+*    nothing breaks, the operator simply never sees what somebody added;
+*  - the pair has to be shipped somewhere it can outlive the process it
+*    describes, and pids are recycled. A stale entry charges one camera for
+*    another camera's work, silently and plausibly. This repo has already paid
+*    for a registry that answered while the truth was elsewhere (D49).
+*
+* The recorder does not need to be told which camera its ffmpeg serves. It
+* spawned it. So each addon reports what it already knows, and no entity needs
+* global knowledge. The shape is copied from `log-channels.cap.ts` /
+* `log-destination.cap.ts` (`mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }`): no tRPC route, no generated hooks, while
+* `addons.listCapabilityProviders` still enumerates it and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider, so a forked
+* runner's entries reach hub-main over transport that already exists. No new
+* UDS message, no second registry (D3).
+*
+* ## The external observer still has a job
+*
+* `metrics.node-processes-snapshot` measures every camstack-shaped process on
+* the node whether or not anybody claims it. Contributions cover what the
+* addons know about; the snapshot covers what is actually running. **The
+* difference is the finding** — a process nobody claims is either a leak or a
+* cost family nobody has taught to report, and both are worth seeing. So an
+* unclaimed process stays in an "unattributed" bucket and is never folded into
+* a neighbour.
+*
+* ## Absent, never zero
+*
+* Every measurement here is optional. An addon that cannot produce a number
+* omits it, and the consumer reads UNKNOWN. A zero would say "this camera cost
+* nothing", which is a measurement, and a measurement nobody made is the one
+* thing this whole surface exists to prevent.
+*
+* ## Detection declares its own renunciation
+*
+* The shared inference pool is one process per (node, runtime, hardware
+* device) serving every camera. It contributes an entry with `deviceId: null`
+* and `attribution: 'unattributable'` — the giving-up is DATA, reported by the
+* only component that knows it, rather than a deduction an observer makes.
+* `isChartablePerCamera` keeps refusing it.
+*/
+/**
+* The load families an addon can report. Kept as a tuple so the Zod enum and
+* the TypeScript union have one source.
+*
+* `detection` is a member on purpose — see the module docblock. It is the one
+* role that reports itself as unattributable.
+*/
+var LOAD_CONTRIBUTION_ROLES = [
+	"decode",
+	"transcode",
+	"recording",
+	"streaming",
+	"detection"
+];
+/**
+* How well the reporting addon can tie this entry to ONE camera. The
+* contributor decides, because the contributor is the only one who knows.
+*
+* - `measured` — the numbers on this entry are this camera's, measured. The
+*   entry owns a process (or an equivalent exclusive resource) that serves
+*   exactly one camera.
+* - `accounted` — per-camera work really is COUNTED (frames submitted,
+*   inference milliseconds), but the cost is shared and can only ever be
+*   apportioned. A consumer must label it as a share, never as a cost.
+* - `unattributable` — no camera owns this. Reported anyway, with
+*   `deviceId: null`, so the shared cost is visible as shared instead of
+*   invisible.
+*/
+var LOAD_CONTRIBUTION_ATTRIBUTIONS = [
+	"measured",
+	"accounted",
+	"unattributable"
+];
+var LoadContributionSchema = zod.z.object({
+	role: zod.z.enum(LOAD_CONTRIBUTION_ROLES),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
+	* camera (a shared pool), NOT that the contributor forgot to look it up: a
+	* contributor that cannot name its camera must not emit the entry at all,
+	* because an unnamed per-camera entry is indistinguishable from a shared one
+	* and would quietly turn one camera's cost into everybody's.
+	*/
+	deviceId: zod.z.number().int().positive().nullable(),
+	attribution: zod.z.enum(LOAD_CONTRIBUTION_ATTRIBUTIONS),
+	/**
+	* What ONE entry is, in the contributor's own words — `615/high`,
+	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+	* family and inventing a common one would lose the only information that
+	* makes two entries for the same camera distinguishable.
+	*/
+	unit: zod.z.string(),
+	/**
+	* The OS process this cost lives in, when there is one. Present so a
+	* consumer can (a) tell two generations of the same unit apart across a
+	* restart, and (b) subtract claimed processes from the node's process
+	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
+	* process of its own.
+	*/
+	pid: zod.z.number().int().positive().optional(),
+	/**
+	* When this generation started. The pid's incarnation marker: a consumer
+	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+	* window when this changes, because the counter restarted from zero in a new
+	* process.
+	*/
+	startedAtMs: zod.z.number().optional(),
+	/**
+	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
+	* system, read from the child's own `/proc/<pid>/stat` at the moment the
+	* contribution is asked for.
+	*
+	* Cumulative and not a rate on purpose: a rate needs a window, a window
+	* needs a sampler, and a new per-node sampler is the defect half of
+	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
+	* by whoever already keeps a history; a rate cannot be un-averaged.
+	*
+	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
+	* an entry with no process.
+	*/
+	cpuSeconds: zod.z.number().optional(),
+	/** Resident bytes of this unit's process, same source and same rules. */
+	rssBytes: zod.z.number().optional()
+});
+var loadContributionCapability = {
+	name: "load-contribution",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* This addon's own cost entries, computed live from state it already
+	* holds. Inert: no persistence, no sampling, no timer. It is answered on
+	* whatever beat the caller already has.
+	*/
+list: require_sleep.method(zod.z.void(), zod.z.array(LoadContributionSchema).readonly()) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+//#endregion
 //#region src/capabilities/login-method.cap.ts
 /**
 * `login-method` — collection cap through which auth addons contribute
@@ -11191,8 +11540,7 @@ var NodeProcessSchema = zod.z.object({
 	classification: zod.z.enum([
 		"root",
 		"managed",
-		"system",
-		"ghost"
+		"system"
 	]),
 	/** `$process` addon binding when `managed`, else null. */
 	addonId: zod.z.string().nullable(),
@@ -11200,22 +11548,39 @@ var NodeProcessSchema = zod.z.object({
 	nodeId: zod.z.string().nullable(),
 	/** Truncated command line. */
 	command: zod.z.string(),
+	/**
+	* `ps pcpu` — CPU averaged over the process's WHOLE LIFETIME, not a rate.
+	* On a runner up for days it barely moves. Fine as a column, useless as a
+	* series: use `cpuMainPercent + cpuGcPercent` for anything time-varying.
+	*/
 	cpuPercent: zod.z.number(),
 	memoryRssBytes: zod.z.number(),
+	/**
+	* Instantaneous CPU% of the process's own threads over the last
+	* process-snapshot window, from a `/proc/<pid>/task/*` tick delta.
+	*
+	* `null` = UNKNOWN, never zero: no previous sample yet (first tick after
+	* boot), the pid was recycled, or this node is not Linux.
+	*/
+	cpuMainPercent: zod.z.number().nullable(),
+	/**
+	* Instantaneous CPU% of V8's `V8Worker` platform pool over the same window.
+	*
+	* This is the number that rewrote the 2026-08-27 diagnosis — hub-main 73%,
+	* `stream-broker` 61% (`docs/architecture/load-ledger.md`). A CPU chart that
+	* does not separate it from `cpuMainPercent` shows "busy" where the truth is
+	* "allocating too much".
+	*
+	* Concurrent GC is the dominant tenant of that pool but not the only one
+	* (background compilation runs there too), so it is reported as
+	* "GC / V8 helpers" rather than as pure collection time. `null` has the same
+	* meaning as on `cpuMainPercent`.
+	*/
+	cpuGcPercent: zod.z.number().nullable(),
+	/** Threads seen in the tick scan. `null` under the same conditions. */
+	threadCount: zod.z.number().nullable(),
 	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-	uptimeSec: zod.z.number(),
-	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-	orphaned: zod.z.boolean()
-});
-var KillProcessInputSchema = zod.z.object({
-	pid: zod.z.number(),
-	/** Force = SIGKILL. Default is SIGTERM. */
-	force: zod.z.boolean().optional()
-});
-var KillProcessResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	reason: zod.z.string().optional(),
-	signal: zod.z.enum(["SIGTERM", "SIGKILL"]).optional()
+	uptimeSec: zod.z.number()
 });
 var DumpHeapSnapshotInputSchema = zod.z.object({ 
 /** The addon whose runner should dump a heap snapshot. */
@@ -11228,6 +11593,104 @@ var DumpHeapSnapshotResultSchema = zod.z.object({
 	pid: zod.z.number().optional(),
 	reason: zod.z.string().optional()
 });
+/**
+* One point of one function's series.
+*
+* The unsuffixed fields are the bucket's **MAXIMUM**, and that choice is the
+* point of the whole surface. The two obvious reductions both lie: a mean per
+* bucket smears a spike away, and taking every Nth sample skips it outright.
+* Either would give us a tool built to find peaks that does not show peaks.
+* `...Min` carries the other end, `samples` says how many raw snapshots folded
+* into the bucket, and a mean stays derivable where it is wanted.
+*
+* An UNREDUCED point is a one-sample bucket: `samples === 1` and each `...Min`
+* equals its unsuffixed twin. Reduced and unreduced are the same shape, so a
+* caller cannot tell which it received — which is what "one reader" means.
+*/
+var LoadPointSchema = zod.z.object({
+	/** Bucket START, or the snapshot's own timestamp when unreduced. */
+	atMs: zod.z.number(),
+	/** Raw snapshots in this bucket. Never 0 — AN EMPTY BUCKET IS ABSENT. */
+	samples: zod.z.number().int(),
+	/**
+	* `null` = UNKNOWN and it PROPAGATES: a bucket is null unless every process
+	* of every snapshot in it reported a thread split. A partial sum is a
+	* smaller number that looks exactly as real as a complete one.
+	*/
+	cpuMainPercent: zod.z.number().nullable(),
+	cpuMainPercentMin: zod.z.number().nullable(),
+	cpuGcPercent: zod.z.number().nullable(),
+	cpuGcPercentMin: zod.z.number().nullable(),
+	/** Lifetime-average CPU%, summed. Always known — and never a rate. */
+	cpuLifetimePercent: zod.z.number(),
+	cpuLifetimePercentMin: zod.z.number(),
+	memoryRssBytes: zod.z.number(),
+	memoryRssBytesMin: zod.z.number(),
+	processCount: zod.z.number().int(),
+	processCountMin: zod.z.number().int()
+});
+/** One function's series. `key` is an addonId, `__root__` or `__unattributed__`. */
+var LoadFunctionSeriesSchema = zod.z.object({
+	key: zod.z.string(),
+	kind: zod.z.enum([
+		"addon",
+		"root",
+		"unattributed"
+	]),
+	/** Oldest-first. A missing interval is MISSING — never zero-filled. */
+	points: zod.z.array(LoadPointSchema).readonly()
+});
+var NodeLoadSeriesSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	/** One entry per function seen in the window, heaviest-first. */
+	series: zod.z.array(LoadFunctionSeriesSchema).readonly(),
+	/**
+	* Width of one returned bucket, in ms. Equals the sampling cadence when no
+	* reduction was needed — so a caller can always say what one point covers
+	* without having to know whether it was reduced.
+	*/
+	bucketMs: zod.z.number(),
+	/** Raw snapshots that went into this answer, across both tiers. */
+	retainedSamples: zod.z.number(),
+	/** Oldest snapshot represented, or `null` when nothing is retained. */
+	oldestAtMs: zod.z.number().nullable(),
+	/** The fixed sampling cadence in force on the cluster, in ms. */
+	cadenceMs: zod.z.number(),
+	/**
+	* Did the DURABLE tier contribute? `false` means the answer is the hot ring
+	* alone — an agent (which holds no table), or a store that refused.
+	* Reported because "the last hour" and "the last six hours" are different
+	* questions and an operator must not have to guess which was answered.
+	*/
+	durable: zod.z.boolean()
+});
+var GetLoadSeriesInputSchema = zod.z.object({
+	/**
+	* The node whose series is wanted.
+	*
+	* NOT named `nodeId`: the generated cap router strips a top-level
+	* `nodeId` from every method input and uses it to ROUTE the call to
+	* that node's provider (`generated-cap-routers.ts`). A series target
+	* called `nodeId` would silently become a routing pin and never reach
+	* the provider. The hub holds every node it hears from, so the
+	* ordinary call is unpinned — answered by the hub, for any node.
+	*/
+	forNodeId: zod.z.string(),
+	/**
+	* EXCLUSIVE lower bound. A caller passes the newest `atMs` it already
+	* holds and receives only what it is missing, so seeding a live chart
+	* from this method cannot double a point already drawn.
+	*/
+	sinceMs: zod.z.number().optional(),
+	/**
+	* Most points the caller wants PER FUNCTION. The window is reduced to fit,
+	* preserving min and max per bucket.
+	*
+	* Absent means NO reduction — legitimate for a short window and a trap for a
+	* long one, which is why a chart passes its own pixel width.
+	*/
+	maxPoints: zod.z.number().int().positive().optional()
+});
 var SystemMetricsSchema = zod.z.object({
 	cpuPercent: zod.z.number(),
 	memoryPercent: zod.z.number(),
@@ -11273,28 +11736,44 @@ var metricsProviderCapability = {
 		getAddonStats: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), PidResourceStatsSchema.nullable()),
 		/**
 		* Snapshot of every camstack-related process on this node with a
-		* ghost/managed/root classification. Powers the Cluster → Agent →
-		* Processes tab: cross-references `$process.list` against a `ps` scan
-		* so orphaned trees (PPID=1) or unknown children show up as `ghost`
-		* and can be killed from the UI.
+		* root/managed/system classification. Powers the Cluster → Agent →
+		* Processes tab: cross-references `$process.list` against a `ps` scan so
+		* per-addon CPU and RSS can be attributed, and so a process the cluster
+		* does not manage is still visible.
+		*
+		* **Read-only, by design.** This cap once carried a `killProcess`
+		* mutation; it was deleted on 2026-08-27. A runner's lifecycle belongs to
+		* `CrashSupervisor` and is driven through `addons.restartAddon` /
+		* `$process.restart` — signalling a raw pid went around the supervisor
+		* (D6), and the one class it was willing to signal turned out to be the
+		* container's own init and the operator's desktop app.
 		*/
 		listNodeProcesses: require_sleep.method(zod.z.void(), zod.z.array(NodeProcessSchema).readonly()),
 		/**
-		* Send SIGTERM (or SIGKILL when `force`) to a pid inside this node's
-		* process tree. The provider refuses pids that aren't in the live
-		* `listNodeProcesses()` snapshot — callers can't use this endpoint
-		* to kill arbitrary system processes.
+		* The retained per-node load series — the ONE reader over BOTH tiers.
+		*
+		* The in-memory ring is the HOT window (the last 180 snapshots, held by
+		* every node's `native-metrics`); the hub's `metrics:node-load-samples`
+		* table is the COLD one (the operator's retention, six hours by default).
+		* This method merges them and DEDUPES on `atMs`, so a snapshot present in
+		* both contributes once and the caller never learns which tier a point
+		* came from. There is deliberately no second read surface: two readers is
+		* how two charts start disagreeing about the same node.
+		*
+		* Reads only; nothing is sampled to answer it. Normally called UNPINNED —
+		* the hub hears every node's snapshot and holds every node's rows — and
+		* answers for any `forNodeId`. Pinned to an agent it answers from that
+		* agent's ring alone (`durable: false`). Empty is a legitimate answer: a
+		* node nobody has heard from has no series, and saying so is the truth.
 		*/
-		killProcess: require_sleep.method(KillProcessInputSchema, KillProcessResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
+		getLoadSeries: require_sleep.method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema),
 		/**
 		* Tell the addon's forked runner to write a V8 heap snapshot to disk (via
 		* SIGUSR2 — the runner's diagnostic handler). Also logs its
-		* `process.memoryUsage()` + heap-space breakdown. Refuses pids not in the
-		* live `listNodeProcesses()` snapshot. Use for deep per-addon memory
-		* attribution; copy the returned path off the node to analyze.
+		* `process.memoryUsage()` + heap-space breakdown. Resolves the pid from
+		* `$process.list`, so it can only reach a runner this node spawned. Use
+		* for deep per-addon memory attribution; copy the returned path off the
+		* node to analyze.
 		*/
 		dumpHeapSnapshot: require_sleep.method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
 			kind: "mutation",
@@ -31338,6 +31817,15 @@ var LoggingSettingsPatchSchema = zod.z.object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
+/**
+* One contribution, plus WHO reported it.
+*
+* The addon and node are added by the hub as it enumerates providers, never by
+* the contributor: an addon reporting its own identity could report somebody
+* else's, and the whole point of this surface is that no claim is made by
+* anyone but its owner.
+*/
+var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: zod.z.string() });
 var GetLoggingSettingsInputSchema = zod.z.object({
 	scopeNodeId: zod.z.string().optional(),
 	/**
@@ -31440,6 +31928,22 @@ var systemCapability = {
 		*/
 		getRequestCensus: require_sleep.method(zod.z.void(), RequestCensusStatusSchema, { auth: "admin" }),
 		/**
+		* Every `load-contribution` an addon on this cluster reports — each
+		* addon's OWN cost, already attributed by the addon that owns it.
+		*
+		* There is no central list of what costs what: an addon that spawns a
+		* per-camera child declares it, and one that cannot attribute its cost
+		* (the shared inference pool) declares THAT. So a new cost family appears
+		* here the moment its addon is redeployed, with nobody editing anything.
+		*
+		* What this does NOT do is measure the node. `metrics.node-processes-
+		* snapshot` still does that, and the difference between the two is the
+		* finding: a process no contribution claims is either a leak or a family
+		* nobody has taught to report. Both belong in the unattributed bucket, and
+		* neither may be folded into a camera.
+		*/
+		getLoadContributions: require_sleep.method(zod.z.void(), zod.z.array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }),
+		/**
 		* The logging settings document — levels and armed diagnostics — resolved
 		* for `nodeId`, or for the cluster when `nodeId` is absent.
 		*
@@ -32823,6 +33327,25 @@ function evaluateSensorEdge(input) {
 var HF_REPO = "camstack/camstack-models";
 var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
 /**
+* The ONE default session-JWT lifetime.
+*
+* There used to be three, and they disagreed: the `system-config` schema said
+* `30d`, `RUNTIME_DEFAULTS['auth.tokenExpiry']` said `7d`, and
+* `AuthManager.signToken` hardcoded `30d` as its own fallback. Because the
+* production signer (`AuthService extends AuthManager`, wired to
+* `ConfigManager`) resolves through `RUNTIME_DEFAULTS` BEFORE it can ever
+* reach the hardcoded fallback, the value actually in force was `7d` while
+* every surface an operator could read advertised `30d`.
+*
+* `30d` is the value the product documents and the one an operator decided on
+* (2026-07-17: the viewer's silent refresh rotates tokens long before expiry,
+* so a long lifetime only covers devices left unopened for weeks). It is
+* declared here once and imported by the schema, by the runtime defaults and
+* by the signer's fallback — a second default that disagrees with the first is
+* the same defect in miniature.
+*/
+var DEFAULT_TOKEN_EXPIRY = "30d";
+/**
 * Runtime defaults -- used by ConfigManager.get() for backward compatibility
 * until Plan B wires all runtime settings to the system_settings SQL table.
 *
@@ -32857,7 +33380,7 @@ var RUNTIME_DEFAULTS = {
 	"ffmpeg.binaryPath": "ffmpeg",
 	"ffmpeg.hwAccel": "auto",
 	"ffmpeg.threadCount": 0,
-	"auth.tokenExpiry": "7d"
+	"auth.tokenExpiry": "30d"
 };
 //#endregion
 //#region src/device/accessory.ts
@@ -35769,6 +36292,7 @@ var CAPABILITY_NAMES = {
 	lawnMowerControl: "lawn-mower-control",
 	llm: "llm",
 	llmRuntime: "llm-runtime",
+	loadContribution: "load-contribution",
 	localNetwork: "local-network",
 	lockControl: "lock-control",
 	logChannels: "log-channels",
@@ -36135,6 +36659,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "llmRuntime",
 		name: "llm-runtime"
 	},
+	{
+		key: "loadContribution",
+		name: "load-contribution"
+	},
 	{
 		key: "localNetwork",
 		name: "local-network"
@@ -36533,6 +37061,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	lawnMowerControlCapability,
 	llmCapability,
 	llmRuntimeCapability,
+	loadContributionCapability,
 	localNetworkCapability,
 	lockControlCapability,
 	logChannelsCapability,
@@ -37558,6 +38087,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.insertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.isEmpty": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -38872,6 +39407,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loadContribution.list": {
+		capName: "load-contribution",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
@@ -39172,17 +39713,17 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.getProcessStats": {
+	"metricsProvider.getLoadSeries": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.killProcess": {
+	"metricsProvider.getProcessStats": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
 	"metricsProvider.listAddonInstances": {
 		capName: "metrics-provider",
@@ -41194,6 +41735,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.insertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.isEmpty": {
 		capName: "settings-store",
 		capScope: "system",
@@ -41806,6 +42353,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoadContributions": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getLoggingSettings": {
 		capName: "system",
 		capScope: "system",
@@ -42499,6 +43052,7 @@ var KNOWN_CAP_NAMES = [
 	"lawn-mower-control",
 	"llm",
 	"llm-runtime",
+	"load-contribution",
 	"local-network",
 	"lock-control",
 	"log-channels",
@@ -42659,6 +43213,7 @@ var SYSTEM_CAP_NAMES = [
 	"integrations",
 	"llm",
 	"llm-runtime",
+	"load-contribution",
 	"local-network",
 	"log-channels",
 	"log-destination",
@@ -45340,7 +45895,7 @@ function createSystemProxy(api) {
 			listAddonInstances: (input) => dispatch("metricsProvider", "listAddonInstances", "query", input),
 			getAddonStats: (input) => dispatch("metricsProvider", "getAddonStats", "query", input),
 			listNodeProcesses: (input) => dispatch("metricsProvider", "listNodeProcesses", "query", input),
-			killProcess: (input) => dispatch("metricsProvider", "killProcess", "mutation", input),
+			getLoadSeries: (input) => dispatch("metricsProvider", "getLoadSeries", "query", input),
 			dumpHeapSnapshot: (input) => dispatch("metricsProvider", "dumpHeapSnapshot", "mutation", input)
 		},
 		mqttBroker: {
@@ -45519,6 +46074,7 @@ function createSystemProxy(api) {
 			set: (input) => dispatch("settingsStore", "set", "mutation", input),
 			query: (input) => dispatch("settingsStore", "query", "query", input),
 			insert: (input) => dispatch("settingsStore", "insert", "mutation", input),
+			insertMany: (input) => dispatch("settingsStore", "insertMany", "mutation", input),
 			update: (input) => dispatch("settingsStore", "update", "mutation", input),
 			delete: (input) => dispatch("settingsStore", "delete", "mutation", input),
 			deleteWhere: (input) => dispatch("settingsStore", "deleteWhere", "mutation", input),
@@ -45599,6 +46155,7 @@ function createSystemProxy(api) {
 			setSiteLocation: (input) => dispatch("system", "setSiteLocation", "mutation", input),
 			detectSiteLocation: (input) => dispatch("system", "detectSiteLocation", "mutation", input),
 			getRequestCensus: (input) => dispatch("system", "getRequestCensus", "query", input),
+			getLoadContributions: (input) => dispatch("system", "getLoadContributions", "query", input),
 			getLoggingSettings: (input) => dispatch("system", "getLoggingSettings", "query", input),
 			setLoggingSettings: (input) => dispatch("system", "setLoggingSettings", "mutation", input)
 		},
@@ -49702,6 +50259,7 @@ exports.BrokerSubscribeInputSchema = SubscribeInputSchema;
 exports.BrokerSubscribeResultSchema = SubscribeResultSchema;
 exports.BrokerTestConnectionResultSchema = TestConnectionResultSchema;
 exports.BrokerUnsubscribeInputSchema = UnsubscribeInputSchema;
+exports.BulkRecordSchema = BulkRecordSchema;
 exports.CAMERA_SWITCH_CATALOG = CAMERA_SWITCH_CATALOG;
 exports.CAMERA_SWITCH_ORDER = CAMERA_SWITCH_ORDER;
 exports.CAM_PROFILE_ORDER = require_sleep.CAM_PROFILE_ORDER;
@@ -49816,6 +50374,7 @@ exports.DEFAULT_RECORDING_PROFILES = DEFAULT_RECORDING_PROFILES;
 exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
 exports.DEFAULT_RUNTIME_STATE_DURABILITY = require_sleep.DEFAULT_RUNTIME_STATE_DURABILITY;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
+exports.DEFAULT_TOKEN_EXPIRY = DEFAULT_TOKEN_EXPIRY;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
 exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
 exports.DETAIL_CROP_SECTION_ID = DETAIL_CROP_SECTION_ID;
@@ -49975,6 +50534,8 @@ exports.IntercomAbilitySchema = IntercomAbilitySchema;
 exports.IntercomStatusSchema = IntercomStatusSchema;
 exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
 exports.KeyEventSchema = KeyEventSchema;
+exports.LOAD_CONTRIBUTION_ATTRIBUTIONS = LOAD_CONTRIBUTION_ATTRIBUTIONS;
+exports.LOAD_CONTRIBUTION_ROLES = LOAD_CONTRIBUTION_ROLES;
 exports.LOG_CHANNEL_TICK_MS = LOG_CHANNEL_TICK_MS;
 exports.LOG_LEVEL_RANK = LOG_LEVEL_RANK;
 exports.LabelAttributionSchema = LabelAttributionSchema;
@@ -50007,6 +50568,7 @@ exports.LlmRuntimeStatusSchema = LlmRuntimeStatusSchema;
 exports.LlmTimeoutDefaults = LlmTimeoutDefaults;
 exports.LlmUsageRollupSchema = LlmUsageRollupSchema;
 exports.LlmUsageSchema = LlmUsageSchema;
+exports.LoadContributionSchema = LoadContributionSchema;
 exports.LocateSegmentResultSchema = LocateSegmentResultSchema;
 exports.LocationStatSchema = LocationStatSchema;
 exports.LockControlStatusSchema = LockControlStatusSchema;
@@ -50289,6 +50851,7 @@ exports.RECOGNITION_TYPES = RECOGNITION_TYPES;
 exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
 exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
 exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
+exports.ROOT_BUCKET_KEY = ROOT_BUCKET_KEY;
 exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
 exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
 exports.RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS;
@@ -50331,6 +50894,7 @@ exports.RelocateJobStateSchema = RelocateJobStateSchema;
 exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
 exports.RenderedAsSchema = RenderedAsSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
+exports.ReportedLoadContributionSchema = ReportedLoadContributionSchema;
 exports.RequestCensusGroupSchema = RequestCensusGroupSchema;
 exports.RequestCensusProcedureSchema = RequestCensusProcedureSchema;
 exports.RequestCensusSnapshotSchema = RequestCensusSnapshotSchema;
@@ -50514,6 +51078,7 @@ exports.TrainingExportSummarySchema = TrainingExportSummarySchema;
 exports.TransportPlaneCountsSchema = TransportPlaneCountsSchema;
 exports.TransportPlaneSchema = TransportPlaneSchema;
 exports.TurnServerSchema = TurnServerSchema;
+exports.UNATTRIBUTED_BUCKET_KEY = UNATTRIBUTED_BUCKET_KEY;
 exports.UNIT_TABLE = UNIT_TABLE;
 exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
 exports.UnitConversionError = UnitConversionError;
@@ -50732,6 +51297,7 @@ exports.featureProbeCapability = featureProbeCapability;
 exports.filesystemBrowseCapability = filesystemBrowseCapability;
 exports.findTimezone = findTimezone;
 exports.floodCapability = floodCapability;
+exports.foldSnapshotByFunction = foldSnapshotByFunction;
 exports.formatForBackend = formatForBackend;
 exports.formatForRuntime = formatForRuntime;
 exports.gasCapability = gasCapability;
@@ -50789,6 +51355,7 @@ exports.lifecycleJobStateSchema = lifecycleJobStateSchema;
 exports.lifecycleTaskSchema = lifecycleTaskSchema;
 exports.llmCapability = llmCapability;
 exports.llmRuntimeCapability = llmRuntimeCapability;
+exports.loadContributionCapability = loadContributionCapability;
 exports.localNetworkCapability = localNetworkCapability;
 exports.locationSimilarity = locationSimilarity;
 exports.lockControlCapability = lockControlCapability;
@@ -50885,12 +51452,14 @@ exports.rebootCapability = rebootCapability;
 exports.recordingCapability = recordingCapability;
 exports.recordingExportCapability = recordingExportCapability;
 exports.rectsToCells = rectsToCells;
+exports.reducePoints = reducePoints;
 exports.requiresPython = requiresPython;
 exports.resetPoolBaseline = resetPoolBaseline;
 exports.resolveAddonExecution = resolveAddonExecution;
 exports.resolveAddonGroup = resolveAddonGroup;
 exports.resolveAddonPlacement = resolveAddonPlacement;
 exports.resolveAddonRuntime = resolveAddonRuntime;
+exports.resolveBucketMs = resolveBucketMs;
 exports.resolveCapMount = require_sleep.resolveCapMount;
 exports.resolveClusterStepModelId = resolveClusterStepModelId;
 exports.resolveDetectionRuntime = resolveDetectionRuntime;