camstack 1.2.49 → 1.2.51

package/dist/{chunk-U5U3EPIG.js → chunk-HPFKAZ3A.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-CdbM8ge4.mjs
+// ../types/dist/sleep-Dolp38qx.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -19106,6 +19106,10 @@ var SettingsRecordSchema = external_exports.object({
   id: external_exports.string(),
   data: external_exports.record(external_exports.string(), external_exports.unknown())
 });
+var BulkRecordSchema = external_exports.object({
+  id: external_exports.string().optional(),
+  data: external_exports.record(external_exports.string(), external_exports.unknown())
+});
 var CollectionColumnSchema = external_exports.object({
   name: external_exports.string(),
   type: external_exports.enum([
@@ -19180,6 +19184,34 @@ var settingsStoreCapability = {
       collection: external_exports.string(),
       record: SettingsRecordSchema
     }), external_exports.void(), { kind: "mutation" }),
+    /**
+    * Insert MANY records in ONE transaction, returning how many landed.
+    *
+    * The write-side twin of {@link deleteWhere}, and it exists for the same
+    * reason: without it, appending a batch is N round trips and N COMMITs on
+    * the single shared connection that also serves every cluster-wide
+    * configuration read. The durable load series writes one process row per
+    * process per sample — 76 rows every 10 s on the live fleet — and the
+    * operator's rule for it is *one transaction per sample, never one per
+    * row*. `insert` cannot express that; nothing else could.
+    *
+    * **All or nothing.** A batch that fails on its fifth row leaves none of
+    * the five behind. A half-written sample is worse than a missing one: the
+    * missing one reads as "nobody reported", which is true, while the half
+    * one reads as "these were the only processes running", which is not.
+    *
+    * `id` is OPTIONAL per record, and that is the difference from
+    * {@link insert}. A collection whose primary key is an `INTEGER` rowid
+    * alias has no id to supply — SQLite assigns it, for free, and inventing a
+    * `randomUUID()` for such a column would write a 36-character string into
+    * an integer key. Omitted on a TEXT key, a uuid is generated exactly as
+    * `insert` does.
+    */
+    insertMany: method(external_exports.object({
+      namespace: external_exports.string().optional(),
+      collection: external_exports.string(),
+      records: external_exports.array(BulkRecordSchema).readonly()
+    }), external_exports.object({ inserted: external_exports.number().int() }), { kind: "mutation" }),
     /** Update an existing record by ID. */
     update: method(external_exports.object({
       namespace: external_exports.string().optional(),
@@ -19369,6 +19401,15 @@ var dataStoreProviderCapability = {
       kind: "mutation",
       auth: "admin"
     }),
+    /** Insert many records in ONE transaction. All or nothing. */
+    insertMany: method(external_exports.object({
+      namespace: external_exports.string().optional(),
+      collection: external_exports.string(),
+      records: external_exports.array(BulkRecordSchema).readonly()
+    }), external_exports.object({ inserted: external_exports.number().int() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Update an existing record by ID. */
     update: method(external_exports.object({
       namespace: external_exports.string().optional(),
@@ -21642,6 +21683,85 @@ var logDestinationCapability = {
   /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
   mount: { kind: "skip" }
 };
+var LOAD_CONTRIBUTION_ROLES = [
+  "decode",
+  "transcode",
+  "recording",
+  "streaming",
+  "detection"
+];
+var LOAD_CONTRIBUTION_ATTRIBUTIONS = [
+  "measured",
+  "accounted",
+  "unattributable"
+];
+var LoadContributionSchema = external_exports.object({
+  role: external_exports.enum(LOAD_CONTRIBUTION_ROLES),
+  /**
+  * The NUMERIC device id — the same value every log line carries as
+  * `tags.deviceId`. `null` means this cost genuinely belongs to no single
+  * camera (a shared pool), NOT that the contributor forgot to look it up: a
+  * contributor that cannot name its camera must not emit the entry at all,
+  * because an unnamed per-camera entry is indistinguishable from a shared one
+  * and would quietly turn one camera's cost into everybody's.
+  */
+  deviceId: external_exports.number().int().positive().nullable(),
+  attribution: external_exports.enum(LOAD_CONTRIBUTION_ATTRIBUTIONS),
+  /**
+  * What ONE entry is, in the contributor's own words — `615/high`,
+  * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+  * family and inventing a common one would lose the only information that
+  * makes two entries for the same camera distinguishable.
+  */
+  unit: external_exports.string(),
+  /**
+  * The OS process this cost lives in, when there is one. Present so a
+  * consumer can (a) tell two generations of the same unit apart across a
+  * restart, and (b) subtract claimed processes from the node's process
+  * snapshot to see what NOBODY claimed. Absent for an entry that owns no
+  * process of its own.
+  */
+  pid: external_exports.number().int().positive().optional(),
+  /**
+  * When this generation started. The pid's incarnation marker: a consumer
+  * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+  * window when this changes, because the counter restarted from zero in a new
+  * process.
+  */
+  startedAtMs: external_exports.number().optional(),
+  /**
+  * CUMULATIVE CPU seconds this unit has consumed since it started — user +
+  * system, read from the child's own `/proc/<pid>/stat` at the moment the
+  * contribution is asked for.
+  *
+  * Cumulative and not a rate on purpose: a rate needs a window, a window
+  * needs a sampler, and a new per-node sampler is the defect half of
+  * `docs/architecture/load-ledger.md` documents. A counter can be differenced
+  * by whoever already keeps a history; a rate cannot be un-averaged.
+  *
+  * Absent — never zero — on a node with no `/proc`, on a read failure, and on
+  * an entry with no process.
+  */
+  cpuSeconds: external_exports.number().optional(),
+  /** Resident bytes of this unit's process, same source and same rules. */
+  rssBytes: external_exports.number().optional()
+});
+var loadContributionCapability = {
+  name: "load-contribution",
+  scope: "system",
+  mode: "collection",
+  internal: true,
+  methods: {
+    /**
+    * This addon's own cost entries, computed live from state it already
+    * holds. Inert: no persistence, no sampling, no timer. It is answered on
+    * whatever beat the caller already has.
+    */
+    list: method(external_exports.void(), external_exports.array(LoadContributionSchema).readonly())
+  },
+  /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+  mount: { kind: "skip" }
+};
 var LoginStageEnum = external_exports.enum(["primary", "second-factor"]);
 var RedirectLoginMethodSchema = external_exports.object({
   kind: external_exports.literal("redirect"),
@@ -21813,8 +21933,7 @@ var NodeProcessSchema = external_exports.object({
   classification: external_exports.enum([
     "root",
     "managed",
-    "system",
-    "ghost"
+    "system"
   ]),
   /** `$process` addon binding when `managed`, else null. */
   addonId: external_exports.string().nullable(),
@@ -21822,22 +21941,39 @@ var NodeProcessSchema = external_exports.object({
   nodeId: external_exports.string().nullable(),
   /** Truncated command line. */
   command: external_exports.string(),
+  /**
+  * `ps pcpu` — CPU averaged over the process's WHOLE LIFETIME, not a rate.
+  * On a runner up for days it barely moves. Fine as a column, useless as a
+  * series: use `cpuMainPercent + cpuGcPercent` for anything time-varying.
+  */
   cpuPercent: external_exports.number(),
   memoryRssBytes: external_exports.number(),
+  /**
+  * Instantaneous CPU% of the process's own threads over the last
+  * process-snapshot window, from a `/proc/<pid>/task/*` tick delta.
+  *
+  * `null` = UNKNOWN, never zero: no previous sample yet (first tick after
+  * boot), the pid was recycled, or this node is not Linux.
+  */
+  cpuMainPercent: external_exports.number().nullable(),
+  /**
+  * Instantaneous CPU% of V8's `V8Worker` platform pool over the same window.
+  *
+  * This is the number that rewrote the 2026-08-27 diagnosis — hub-main 73%,
+  * `stream-broker` 61% (`docs/architecture/load-ledger.md`). A CPU chart that
+  * does not separate it from `cpuMainPercent` shows "busy" where the truth is
+  * "allocating too much".
+  *
+  * Concurrent GC is the dominant tenant of that pool but not the only one
+  * (background compilation runs there too), so it is reported as
+  * "GC / V8 helpers" rather than as pure collection time. `null` has the same
+  * meaning as on `cpuMainPercent`.
+  */
+  cpuGcPercent: external_exports.number().nullable(),
+  /** Threads seen in the tick scan. `null` under the same conditions. */
+  threadCount: external_exports.number().nullable(),
   /** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-  uptimeSec: external_exports.number(),
-  /** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-  orphaned: external_exports.boolean()
-});
-var KillProcessInputSchema = external_exports.object({
-  pid: external_exports.number(),
-  /** Force = SIGKILL. Default is SIGTERM. */
-  force: external_exports.boolean().optional()
-});
-var KillProcessResultSchema = external_exports.object({
-  success: external_exports.boolean(),
-  reason: external_exports.string().optional(),
-  signal: external_exports.enum(["SIGTERM", "SIGKILL"]).optional()
+  uptimeSec: external_exports.number()
 });
 var DumpHeapSnapshotInputSchema = external_exports.object({
   /** The addon whose runner should dump a heap snapshot. */
@@ -21851,6 +21987,89 @@ var DumpHeapSnapshotResultSchema = external_exports.object({
   pid: external_exports.number().optional(),
   reason: external_exports.string().optional()
 });
+var LoadPointSchema = external_exports.object({
+  /** Bucket START, or the snapshot's own timestamp when unreduced. */
+  atMs: external_exports.number(),
+  /** Raw snapshots in this bucket. Never 0 — AN EMPTY BUCKET IS ABSENT. */
+  samples: external_exports.number().int(),
+  /**
+  * `null` = UNKNOWN and it PROPAGATES: a bucket is null unless every process
+  * of every snapshot in it reported a thread split. A partial sum is a
+  * smaller number that looks exactly as real as a complete one.
+  */
+  cpuMainPercent: external_exports.number().nullable(),
+  cpuMainPercentMin: external_exports.number().nullable(),
+  cpuGcPercent: external_exports.number().nullable(),
+  cpuGcPercentMin: external_exports.number().nullable(),
+  /** Lifetime-average CPU%, summed. Always known — and never a rate. */
+  cpuLifetimePercent: external_exports.number(),
+  cpuLifetimePercentMin: external_exports.number(),
+  memoryRssBytes: external_exports.number(),
+  memoryRssBytesMin: external_exports.number(),
+  processCount: external_exports.number().int(),
+  processCountMin: external_exports.number().int()
+});
+var LoadFunctionSeriesSchema = external_exports.object({
+  key: external_exports.string(),
+  kind: external_exports.enum([
+    "addon",
+    "root",
+    "unattributed"
+  ]),
+  /** Oldest-first. A missing interval is MISSING — never zero-filled. */
+  points: external_exports.array(LoadPointSchema).readonly()
+});
+var NodeLoadSeriesSchema = external_exports.object({
+  nodeId: external_exports.string(),
+  /** One entry per function seen in the window, heaviest-first. */
+  series: external_exports.array(LoadFunctionSeriesSchema).readonly(),
+  /**
+  * Width of one returned bucket, in ms. Equals the sampling cadence when no
+  * reduction was needed — so a caller can always say what one point covers
+  * without having to know whether it was reduced.
+  */
+  bucketMs: external_exports.number(),
+  /** Raw snapshots that went into this answer, across both tiers. */
+  retainedSamples: external_exports.number(),
+  /** Oldest snapshot represented, or `null` when nothing is retained. */
+  oldestAtMs: external_exports.number().nullable(),
+  /** The fixed sampling cadence in force on the cluster, in ms. */
+  cadenceMs: external_exports.number(),
+  /**
+  * Did the DURABLE tier contribute? `false` means the answer is the hot ring
+  * alone — an agent (which holds no table), or a store that refused.
+  * Reported because "the last hour" and "the last six hours" are different
+  * questions and an operator must not have to guess which was answered.
+  */
+  durable: external_exports.boolean()
+});
+var GetLoadSeriesInputSchema = external_exports.object({
+  /**
+  * The node whose series is wanted.
+  *
+  * NOT named `nodeId`: the generated cap router strips a top-level
+  * `nodeId` from every method input and uses it to ROUTE the call to
+  * that node's provider (`generated-cap-routers.ts`). A series target
+  * called `nodeId` would silently become a routing pin and never reach
+  * the provider. The hub holds every node it hears from, so the
+  * ordinary call is unpinned — answered by the hub, for any node.
+  */
+  forNodeId: external_exports.string(),
+  /**
+  * EXCLUSIVE lower bound. A caller passes the newest `atMs` it already
+  * holds and receives only what it is missing, so seeding a live chart
+  * from this method cannot double a point already drawn.
+  */
+  sinceMs: external_exports.number().optional(),
+  /**
+  * Most points the caller wants PER FUNCTION. The window is reduced to fit,
+  * preserving min and max per bucket.
+  *
+  * Absent means NO reduction — legitimate for a short window and a trap for a
+  * long one, which is why a chart passes its own pixel width.
+  */
+  maxPoints: external_exports.number().int().positive().optional()
+});
 var SystemMetricsSchema = external_exports.object({
   cpuPercent: external_exports.number(),
   memoryPercent: external_exports.number(),
@@ -21896,28 +22115,44 @@ var metricsProviderCapability = {
     getAddonStats: method(external_exports.object({ addonId: external_exports.string() }), PidResourceStatsSchema.nullable()),
     /**
     * Snapshot of every camstack-related process on this node with a
-    * ghost/managed/root classification. Powers the Cluster → Agent →
-    * Processes tab: cross-references `$process.list` against a `ps` scan
-    * so orphaned trees (PPID=1) or unknown children show up as `ghost`
-    * and can be killed from the UI.
+    * root/managed/system classification. Powers the Cluster → Agent →
+    * Processes tab: cross-references `$process.list` against a `ps` scan so
+    * per-addon CPU and RSS can be attributed, and so a process the cluster
+    * does not manage is still visible.
+    *
+    * **Read-only, by design.** This cap once carried a `killProcess`
+    * mutation; it was deleted on 2026-08-27. A runner's lifecycle belongs to
+    * `CrashSupervisor` and is driven through `addons.restartAddon` /
+    * `$process.restart` — signalling a raw pid went around the supervisor
+    * (D6), and the one class it was willing to signal turned out to be the
+    * container's own init and the operator's desktop app.
     */
     listNodeProcesses: method(external_exports.void(), external_exports.array(NodeProcessSchema).readonly()),
     /**
-    * Send SIGTERM (or SIGKILL when `force`) to a pid inside this node's
-    * process tree. The provider refuses pids that aren't in the live
-    * `listNodeProcesses()` snapshot — callers can't use this endpoint
-    * to kill arbitrary system processes.
+    * The retained per-node load series — the ONE reader over BOTH tiers.
+    *
+    * The in-memory ring is the HOT window (the last 180 snapshots, held by
+    * every node's `native-metrics`); the hub's `metrics:node-load-samples`
+    * table is the COLD one (the operator's retention, six hours by default).
+    * This method merges them and DEDUPES on `atMs`, so a snapshot present in
+    * both contributes once and the caller never learns which tier a point
+    * came from. There is deliberately no second read surface: two readers is
+    * how two charts start disagreeing about the same node.
+    *
+    * Reads only; nothing is sampled to answer it. Normally called UNPINNED —
+    * the hub hears every node's snapshot and holds every node's rows — and
+    * answers for any `forNodeId`. Pinned to an agent it answers from that
+    * agent's ring alone (`durable: false`). Empty is a legitimate answer: a
+    * node nobody has heard from has no series, and saying so is the truth.
     */
-    killProcess: method(KillProcessInputSchema, KillProcessResultSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
+    getLoadSeries: method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema),
     /**
     * Tell the addon's forked runner to write a V8 heap snapshot to disk (via
     * SIGUSR2 — the runner's diagnostic handler). Also logs its
-    * `process.memoryUsage()` + heap-space breakdown. Refuses pids not in the
-    * live `listNodeProcesses()` snapshot. Use for deep per-addon memory
-    * attribution; copy the returned path off the node to analyze.
+    * `process.memoryUsage()` + heap-space breakdown. Resolves the pid from
+    * `$process.list`, so it can only reach a runner this node spawned. Use
+    * for deep per-addon memory attribution; copy the returned path off the
+    * node to analyze.
     */
     dumpHeapSnapshot: method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
       kind: "mutation",
@@ -36938,6 +37173,7 @@ var LoggingSettingsPatchSchema = external_exports.object({
   */
   channels: external_exports.array(LogChannelWindowPatchSchema).readonly().optional()
 });
+var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: external_exports.string() });
 var GetLoggingSettingsInputSchema = external_exports.object({
   scopeNodeId: external_exports.string().optional(),
   /**
@@ -37031,6 +37267,22 @@ var systemCapability = {
     */
     getRequestCensus: method(external_exports.void(), RequestCensusStatusSchema, { auth: "admin" }),
     /**
+    * Every `load-contribution` an addon on this cluster reports — each
+    * addon's OWN cost, already attributed by the addon that owns it.
+    *
+    * There is no central list of what costs what: an addon that spawns a
+    * per-camera child declares it, and one that cannot attribute its cost
+    * (the shared inference pool) declares THAT. So a new cost family appears
+    * here the moment its addon is redeployed, with nobody editing anything.
+    *
+    * What this does NOT do is measure the node. `metrics.node-processes-
+    * snapshot` still does that, and the difference between the two is the
+    * finding: a process no contribution claims is either a leak or a family
+    * nobody has taught to report. Both belong in the unattributed bucket, and
+    * neither may be folded into a camera.
+    */
+    getLoadContributions: method(external_exports.void(), external_exports.array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }),
+    /**
     * The logging settings document — levels and armed diagnostics — resolved
     * for `nodeId`, or for the cluster when `nodeId` is absent.
     *
@@ -38937,6 +39189,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "dataStoreProvider.insertMany": {
+    capName: "data-store-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "dataStoreProvider.isEmpty": {
     capName: "data-store-provider",
     capScope: "system",
@@ -40251,6 +40509,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "loadContribution.list": {
+    capName: "load-contribution",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "localNetwork.downloadCa": {
     capName: "local-network",
     capScope: "system",
@@ -40551,17 +40815,17 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "metricsProvider.getProcessStats": {
+  "metricsProvider.getLoadSeries": {
     capName: "metrics-provider",
     capScope: "system",
     addonId: null,
     access: "view"
   },
-  "metricsProvider.killProcess": {
+  "metricsProvider.getProcessStats": {
     capName: "metrics-provider",
     capScope: "system",
     addonId: null,
-    access: "create"
+    access: "view"
   },
   "metricsProvider.listAddonInstances": {
     capName: "metrics-provider",
@@ -42573,6 +42837,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "settingsStore.insertMany": {
+    capName: "settings-store",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "settingsStore.isEmpty": {
     capName: "settings-store",
     capScope: "system",
@@ -43185,6 +43455,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "system.getLoadContributions": {
+    capName: "system",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "system.getLoggingSettings": {
     capName: "system",
     capScope: "system",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-U5U3EPIG.js";
+} from "./chunk-HPFKAZ3A.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-Y5UOZ2NP.js");
+  await import("./launcher-EJ6BGNVY.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-Y5UOZ2NP.js");
+  await import("./launcher-EJ6BGNVY.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-WF63I2OT.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-OVQWH2QN.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-WF63I2OT.js → discover-OVQWH2QN.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-U5U3EPIG.js";
+} from "./chunk-HPFKAZ3A.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,