camstack 1.2.59 → 1.2.61

package/dist/{chunk-UMNISWW6.js → chunk-ARTM5NDU.js}

@@ -33129,6 +33129,33 @@ var intercomCapability = {
   deviceNative: true,
   mode: "singleton",
   deviceTypes: [DeviceType.Camera],
+  /**
+  * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+  *
+  * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+  * cap has no configuration surface at all: all six methods open, feed and
+  * close one live audio session against one `deviceId`. That is the same
+  * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+  * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+  * `admin` because they change what the device IS.
+  *
+  * `protected` does not mean ungated: `protectedProcedure` runs the
+  * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+  * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+  * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+  * only) still cannot talk, and a grant on camera 5 cannot talk through
+  * camera 7.
+  *
+  * Every method was `auth: 'admin'` from the initial commit, which made the
+  * cap unreachable by every non-admin principal — `adminProcedure` throws
+  * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+  * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+  * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+  * `camera-operator` scope preset has promised "PTZ control, intercom,
+  * snapshots" since that same commit; the promise could not be kept. Recorded
+  * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+  * preset promises a cap no row of that preset can reach.
+  */
   methods: {
     /**
     * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -33141,7 +33168,7 @@ var intercomCapability = {
       sdpOffer: external_exports.string()
     }), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     handleAnswer: method(external_exports.object({
       deviceId: external_exports.number(),
@@ -33149,7 +33176,7 @@ var intercomCapability = {
       sdpAnswer: external_exports.string()
     }), external_exports.void(), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /** Close explicitly. Server also auto-closes on 30s idle. */
     stopSession: method(external_exports.object({
@@ -33157,7 +33184,7 @@ var intercomCapability = {
       sessionId: external_exports.string()
     }), external_exports.void(), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /**
     * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -33170,7 +33197,7 @@ var intercomCapability = {
     */
     startTalkSession: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.object({ sessionId: external_exports.string() }), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /**
     * Push one chunk of talk-back audio onto the active talk session.
@@ -33205,12 +33232,12 @@ var intercomCapability = {
       sequenceNumber: external_exports.number().int()
     }), external_exports.object({ accepted: external_exports.boolean() }), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /** Close the raw-PCM talk session. Idempotent. */
     endTalkSession: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.void(), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     })
   },
   events: { onStatusChanged: { data: external_exports.object({

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-UMNISWW6.js";
+} from "./chunk-ARTM5NDU.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-WK4Q3DVU.js");
+  await import("./launcher-AZ7QXACO.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-WK4Q3DVU.js");
+  await import("./launcher-AZ7QXACO.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-NCRIXDCA.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-UFN2BYNO.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-NCRIXDCA.js → discover-UFN2BYNO.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-UMNISWW6.js";
+} from "./chunk-ARTM5NDU.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,

package/dist/{launcher-WK4Q3DVU.js → launcher-AZ7QXACO.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-C7uZ_fOb.js
-var require_dist_C7uZ_fOb = __commonJS({
-  "../system/dist/dist-C7uZ_fOb.js"(exports) {
+// ../system/dist/dist-BPlfW-CG.js
+var require_dist_BPlfW_CG = __commonJS({
+  "../system/dist/dist-BPlfW-CG.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -43645,6 +43645,33 @@ var require_dist_C7uZ_fOb = __commonJS({
       deviceNative: true,
       mode: "singleton",
       deviceTypes: [DeviceType.Camera],
+      /**
+      * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+      *
+      * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+      * cap has no configuration surface at all: all six methods open, feed and
+      * close one live audio session against one `deviceId`. That is the same
+      * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+      * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+      * `admin` because they change what the device IS.
+      *
+      * `protected` does not mean ungated: `protectedProcedure` runs the
+      * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+      * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+      * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+      * only) still cannot talk, and a grant on camera 5 cannot talk through
+      * camera 7.
+      *
+      * Every method was `auth: 'admin'` from the initial commit, which made the
+      * cap unreachable by every non-admin principal — `adminProcedure` throws
+      * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+      * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+      * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+      * `camera-operator` scope preset has promised "PTZ control, intercom,
+      * snapshots" since that same commit; the promise could not be kept. Recorded
+      * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+      * preset promises a cap no row of that preset can reach.
+      */
       methods: {
         /**
         * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -43657,7 +43684,7 @@ var require_dist_C7uZ_fOb = __commonJS({
           sdpOffer: zod.z.string()
         }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         handleAnswer: method(zod.z.object({
           deviceId: zod.z.number(),
@@ -43665,7 +43692,7 @@ var require_dist_C7uZ_fOb = __commonJS({
           sdpAnswer: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close explicitly. Server also auto-closes on 30s idle. */
         stopSession: method(zod.z.object({
@@ -43673,7 +43700,7 @@ var require_dist_C7uZ_fOb = __commonJS({
           sessionId: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -43686,7 +43713,7 @@ var require_dist_C7uZ_fOb = __commonJS({
         */
         startTalkSession: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Push one chunk of talk-back audio onto the active talk session.
@@ -43721,12 +43748,12 @@ var require_dist_C7uZ_fOb = __commonJS({
           sequenceNumber: zod.z.number().int()
         }), zod.z.object({ accepted: zod.z.boolean() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close the raw-PCM talk session. Idempotent. */
         endTalkSession: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         })
       },
       events: { onStatusChanged: { data: zod.z.object({
@@ -58686,7 +58713,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59505,7 +59532,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59599,7 +59626,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60496,11 +60523,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-CBU4-TJO.js
-var require_retired_settings_keys_CBU4_TJO = __commonJS({
-  "../system/dist/retired-settings-keys-CBU4-TJO.js"(exports) {
+// ../system/dist/retired-settings-keys-DBY6ebwV.js
+var require_retired_settings_keys_DBY6ebwV = __commonJS({
+  "../system/dist/retired-settings-keys-DBY6ebwV.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62714,8 +62741,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
-    var require_retired_settings_keys = require_retired_settings_keys_CBU4_TJO();
+    var require_dist10 = require_dist_BPlfW_CG();
+    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67464,7 +67491,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67601,7 +67628,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67791,7 +67818,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75604,7 +75631,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76169,7 +76196,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -78791,7 +78818,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -79907,8 +79934,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
-    var require_retired_settings_keys = require_retired_settings_keys_CBU4_TJO();
+    var require_dist10 = require_dist_BPlfW_CG();
+    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -82187,7 +82214,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -84068,7 +84095,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -102129,7 +102156,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -114617,12 +114644,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-CRTx_j4k.js
-var require_manifest_python_deps_CRTx_j4k = __commonJS({
-  "../system/dist/manifest-python-deps-CRTx_j4k.js"(exports) {
+// ../system/dist/manifest-python-deps-w48vOhGR.js
+var require_manifest_python_deps_w48vOhGR = __commonJS({
+  "../system/dist/manifest-python-deps-w48vOhGR.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_C7uZ_fOb();
+    require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -114728,6 +114755,152 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
       const top = window2.top.map((d) => `${d.childId}:${d.sent}/${d.suppressed}`).join(",");
       return ` fanoutMode=uds:${window2.udsMode}/cross-node:${window2.crossNodeMode} children=${window2.childrenConnected} childrenUndeclared=${window2.childrenUndeclared} fanoutSent=${window2.fanoutSent} fanoutSuppressed=${window2.fanoutSuppressed} crossNodeDelivered=${window2.crossNodeDelivered} crossNodeSuppressed=${window2.crossNodeSuppressed}` + (top.length === 0 ? "" : ` fanoutTop=${top}`);
     }
+    function createSocketDirectionCounters() {
+      return {
+        reqMessages: 0,
+        reqBytes: 0,
+        resMessages: 0,
+        resBytes: 0,
+        evtMessages: 0,
+        evtBytes: 0
+      };
+    }
+    function recordSocketFrame(counters, kind, bytes) {
+      if (kind === "evt") {
+        counters.evtMessages += 1;
+        counters.evtBytes += bytes;
+        return;
+      }
+      if (kind === "req") {
+        counters.reqMessages += 1;
+        counters.reqBytes += bytes;
+        return;
+      }
+      counters.resMessages += 1;
+      counters.resBytes += bytes;
+    }
+    function sampleSocketDirection(counters) {
+      return {
+        reqMessages: counters.reqMessages,
+        reqBytes: counters.reqBytes,
+        resMessages: counters.resMessages,
+        resBytes: counters.resBytes,
+        evtMessages: counters.evtMessages,
+        evtBytes: counters.evtBytes
+      };
+    }
+    var EMPTY_SOCKET_DIRECTION = {
+      reqMessages: 0,
+      reqBytes: 0,
+      resMessages: 0,
+      resBytes: 0,
+      evtMessages: 0,
+      evtBytes: 0
+    };
+    function socketDirectionMessages(sample) {
+      return sample.reqMessages + sample.resMessages + sample.evtMessages;
+    }
+    function socketDirectionBytes(sample) {
+      return sample.reqBytes + sample.resBytes + sample.evtBytes;
+    }
+    function createSocketPlaneReader(sources) {
+      return () => {
+        try {
+          const registry = sources.registry();
+          if (registry === null) return void 0;
+          const listed = registry.listChildren();
+          const peers = [];
+          for (const child of listed) {
+            const traffic = registry.getChildSocketTraffic(child.childId);
+            if (traffic === null) continue;
+            peers.push({
+              peerId: child.childId,
+              tx: traffic.tx,
+              rx: traffic.rx
+            });
+          }
+          return {
+            peers,
+            peersConnected: listed.length
+          };
+        } catch {
+          return;
+        }
+      };
+    }
+    var SOCKET_PLANE_TOP_N = 5;
+    var EMPTY_SOCKET_PLANE_BASELINE = { peers: /* @__PURE__ */ new Map() };
+    function diffDirection(current, before) {
+      const previous = before ?? EMPTY_SOCKET_DIRECTION;
+      return {
+        reqMessages: Math.max(0, current.reqMessages - previous.reqMessages),
+        reqBytes: Math.max(0, current.reqBytes - previous.reqBytes),
+        resMessages: Math.max(0, current.resMessages - previous.resMessages),
+        resBytes: Math.max(0, current.resBytes - previous.resBytes),
+        evtMessages: Math.max(0, current.evtMessages - previous.evtMessages),
+        evtBytes: Math.max(0, current.evtBytes - previous.evtBytes)
+      };
+    }
+    function addDirection(into, add) {
+      return {
+        reqMessages: into.reqMessages + add.reqMessages,
+        reqBytes: into.reqBytes + add.reqBytes,
+        resMessages: into.resMessages + add.resMessages,
+        resBytes: into.resBytes + add.resBytes,
+        evtMessages: into.evtMessages + add.evtMessages,
+        evtBytes: into.evtBytes + add.evtBytes
+      };
+    }
+    function peerMessages(delta) {
+      return socketDirectionMessages(delta.tx) + socketDirectionMessages(delta.rx);
+    }
+    function diffSocketPlane(baseline, current, topN = 5) {
+      const deltas = [];
+      let tx = EMPTY_SOCKET_DIRECTION;
+      let rx = EMPTY_SOCKET_DIRECTION;
+      for (const sample of current.peers) {
+        const before = baseline.peers.get(sample.peerId);
+        const delta = {
+          peerId: sample.peerId,
+          tx: diffDirection(sample.tx, before?.tx),
+          rx: diffDirection(sample.rx, before?.rx)
+        };
+        tx = addDirection(tx, delta.tx);
+        rx = addDirection(rx, delta.rx);
+        if (peerMessages(delta) > 0) deltas.push(delta);
+      }
+      return {
+        peersConnected: current.peersConnected,
+        peersMeasured: current.peers.length,
+        tx,
+        rx,
+        top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN)
+      };
+    }
+    function createSocketPlaneMeter(reader, topN = 5) {
+      let baseline = EMPTY_SOCKET_PLANE_BASELINE;
+      return { read: () => {
+        const current = reader();
+        if (current === void 0) return void 0;
+        const window2 = diffSocketPlane(baseline, current, topN);
+        baseline = { peers: new Map(current.peers.map((p) => [p.peerId, p])) };
+        return window2;
+      } };
+    }
+    function kb(bytes) {
+      return Math.round(bytes / 1024);
+    }
+    function formatDirection(sample) {
+      return `req:${sample.reqMessages}/${kb(sample.reqBytes)}kB,res:${sample.resMessages}/${kb(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb(sample.evtBytes)}kB`;
+    }
+    function formatPeer(delta) {
+      return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:kB=${kb(socketDirectionBytes(delta.tx))}/${kb(socketDirectionBytes(delta.rx))}`;
+    }
+    function formatSocketPlane(window2) {
+      if (window2 === void 0) return "";
+      const top = window2.top.map(formatPeer).join(",");
+      return ` socketPeers=${window2.peersMeasured}/${window2.peersConnected} socketTx=${formatDirection(window2.tx)} socketRx=${formatDirection(window2.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`);
+    }
     var DECISIVE_HEAP_SPACES = ["old_space", "large_object_space"];
     var HEAP_SPACE_REPORT_MIN_MB = 32;
     var BYTES_PER_MB = 1048576;
@@ -114941,6 +115114,7 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
     function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv, announceCeilingOrigin = true, rssBudget, probes) {
       const readSpaces = probes?.readSpaces ?? readHeapSpaces;
       const eventPlane = probes?.eventPlane === void 0 ? void 0 : createEventPlaneMeter(probes.eventPlane);
+      const socketPlane = probes?.socketPlane === void 0 ? void 0 : createSocketPlaneMeter(probes.socketPlane);
       const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
       const now = reclaimOptions?.now ?? (() => Date.now());
       const triggerMb = reclaimOptions?.triggerMb ?? 1024;
@@ -114976,7 +115150,7 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
           return;
         }
         const after = read();
-        sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB\u2192${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB\u2192${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
+        sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB\u2192${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB\u2192${after.arrayBuffersMb}MB took=${now() - startedAt}ms heapUsed=${sample.heapUsedMb}MB\u2192${after.heapUsedMb}MB`);
         if (passesAtFloor >= 6 && !steadyStateAnnounced) {
           steadyStateAnnounced = true;
           const nextFloorMs = reclaimIntervalMs(passesAtFloor, minIntervalMs, steadyStateIntervalMs);
@@ -115018,7 +115192,7 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
           const due = at - lastLoggedAt >= intervalMs;
           if (mode === "escalated" || due) {
             lastLoggedAt = at;
-            const line = format2(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}`);
+            const line = format2(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()));
             if (sample.nearLimit) sink.warn(`${line} \u2014 APPROACHING HEAP LIMIT`);
             else if (mode === "escalated") sink.warn(`${line} \u2014 heap elevated, sampling every ${probeIntervalMs}ms`);
             else sink.info(line);
@@ -118232,6 +118406,33 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
       chunks = [];
       /** Sum of `chunks[i].byteLength` — tracked so length checks cost nothing. */
       buffered = 0;
+      /** Backing store for {@link lastFrameBytes}; see that getter. */
+      sizes = [];
+      /**
+      * On-the-wire byte length (4-byte prefix included) of each frame returned by
+      * the most recent {@link push}, index-aligned with the returned array.
+      *
+      * It exists because the frames come back DECODED, and a decoded value has no
+      * memory of how many bytes it cost — so a caller counting received bytes per
+      * message kind (`SocketChannel`, feeding the `[mem]` line's per-peer socket
+      * attribution) could otherwise only charge a whole `data` chunk, which may
+      * hold several frames of different kinds, or half of one.
+      *
+      * **Only the first `frames.length` entries are meaningful**, and the array is
+      * never truncated. That is deliberate and it was measured on Node 24.17:
+      * `sizes.length = 0` + `push` costs **35.1–35.9 ns** per call — V8 shrinks the
+      * backing store and the next call re-grows it — which is 3 % of
+      * `FrameDecoder.push` itself and 15× the counter it feeds. Writing in place
+      * costs **0.06–0.13 ns**. On a path that runs ~22 000 times a second, an
+      * instrument may not be the most expensive thing on the line it measures.
+      *
+      * Read it immediately after the `push` that produced it — it is a window onto
+      * the decoder, not a value. Safe because `push` is only ever driven by a
+      * socket `data` event, which Node never delivers re-entrantly.
+      */
+      get lastFrameBytes() {
+        return this.sizes;
+      }
       push(chunk) {
         if (chunk.byteLength > 0) {
           this.chunks.push(chunk);
@@ -118249,6 +118450,7 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
             body = Buffer.allocUnsafeSlow(len);
             frame.copy(body, 0, HEADER_BYTES);
           } else body = frame.subarray(HEADER_BYTES);
+          this.sizes[frames.length] = total;
           frames.push(decode(body));
         }
         return frames;
@@ -118328,6 +118530,11 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
       };
       closed = false;
       closeFired = false;
+      /** Frames written to the peer, cumulative, split by kind. See
+      *  {@link readTraffic} and `transport/socket-traffic.ts`. */
+      txCounters = createSocketDirectionCounters();
+      /** Frames read from the peer, cumulative, split by kind. */
+      rxCounters = createSocketDirectionCounters();
       constructor(socket) {
         this.socket = socket;
         socket.on("data", (chunk) => this.onData(chunk));
@@ -118395,14 +118602,41 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         this.closed = true;
         this.socket.destroy();
       }
+      /**
+      * This channel's cumulative traffic, both directions, split by frame kind.
+      *
+      * Cumulative for the life of the channel: the reporting layer subtracts the
+      * previous reading, because the question is a RATE ("which peer receives the
+      * 22 500 writes/s") and not a total since boot.
+      */
+      readTraffic() {
+        return {
+          tx: sampleSocketDirection(this.txCounters),
+          rx: sampleSocketDirection(this.rxCounters)
+        };
+      }
       send(frame) {
         if (this.closed) return;
-        this.socket.write(encodeFrame(frame));
+        const encoded = encodeFrame(frame);
+        recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
+        this.socket.write(encoded);
       }
       onData(chunk) {
-        for (const f of this.decoder.push(chunk)) this.handleFrame(f);
+        const frames = this.decoder.push(chunk);
+        const sizes = this.decoder.lastFrameBytes;
+        for (let i = 0; i < frames.length; i += 1) this.handleFrame(frames[i], sizes[i] ?? 0);
       }
-      async handleFrame(frame) {
+      /**
+      * `wireBytes` is the frame's on-the-wire length, counted HERE rather than in
+      * `onData` on purpose: a peer that sends a frame this decoder can parse but
+      * whose shape is not a `Frame` throws on `frame.k`, and inside this async
+      * method that stays the rejected promise it has always been. Reading `.k`
+      * one frame earlier, synchronously in the socket's `data` handler, would
+      * turn the same malformed frame into an uncaught exception on the transport
+      * — a diagnostic that can crash the process it watches.
+      */
+      async handleFrame(frame, wireBytes) {
+        recordSocketFrame(this.rxCounters, frame.k, wireBytes);
         if (frame.k === "req") {
           try {
             const result = await this.requestHandler(frame.body);
@@ -119123,6 +119357,22 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         };
       }
       /**
+      * This child's socket traffic — bytes and messages, both directions, split by
+      * frame kind — or `null` when the child is gone or its channel keeps no
+      * counters (an in-process or test transport).
+      *
+      * The event counters above cover ONE kind of frame and, once surfaced on
+      * 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
+      * is the same question asked of every frame the channel moves, and it is the
+      * only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
+      * pair for the whole process and has no per-socket breakdown.
+      */
+      getChildSocketTraffic(childId) {
+        const entry = this.children.get(childId);
+        if (entry === void 0) return null;
+        return entry.channel.readTraffic?.() ?? null;
+      }
+      /**
       * The regime the counters above were produced under, read once from
       * `CAMSTACK_UDS_EVENT_FANOUT` at construction.
       *
@@ -121618,6 +121868,18 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return DeviceRegistry;
       }
     });
+    Object.defineProperty(exports, "EMPTY_SOCKET_DIRECTION", {
+      enumerable: true,
+      get: function() {
+        return EMPTY_SOCKET_DIRECTION;
+      }
+    });
+    Object.defineProperty(exports, "EMPTY_SOCKET_PLANE_BASELINE", {
+      enumerable: true,
+      get: function() {
+        return EMPTY_SOCKET_PLANE_BASELINE;
+      }
+    });
     Object.defineProperty(exports, "EVENT_PLANE_TOP_N", {
       enumerable: true,
       get: function() {
@@ -121750,6 +122012,12 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return RUNNER_RSS_BUDGET_ENV;
       }
     });
+    Object.defineProperty(exports, "SOCKET_PLANE_TOP_N", {
+      enumerable: true,
+      get: function() {
+        return SOCKET_PLANE_TOP_N;
+      }
+    });
     Object.defineProperty(exports, "SocketChannel", {
       enumerable: true,
       get: function() {
@@ -121948,6 +122216,24 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return createParentUnownedCallHandler;
       }
     });
+    Object.defineProperty(exports, "createSocketDirectionCounters", {
+      enumerable: true,
+      get: function() {
+        return createSocketDirectionCounters;
+      }
+    });
+    Object.defineProperty(exports, "createSocketPlaneMeter", {
+      enumerable: true,
+      get: function() {
+        return createSocketPlaneMeter;
+      }
+    });
+    Object.defineProperty(exports, "createSocketPlaneReader", {
+      enumerable: true,
+      get: function() {
+        return createSocketPlaneReader;
+      }
+    });
     Object.defineProperty(exports, "createUdsAddonContext", {
       enumerable: true,
       get: function() {
@@ -122002,6 +122288,12 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return diffEventPlane;
       }
     });
+    Object.defineProperty(exports, "diffSocketPlane", {
+      enumerable: true,
+      get: function() {
+        return diffSocketPlane;
+      }
+    });
     Object.defineProperty(exports, "emitHeapDiagnosticReport", {
       enumerable: true,
       get: function() {
@@ -122026,6 +122318,12 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return formatHeapSpaces;
       }
     });
+    Object.defineProperty(exports, "formatSocketPlane", {
+      enumerable: true,
+      get: function() {
+        return formatSocketPlane;
+      }
+    });
     Object.defineProperty(exports, "getBrokerEventBus", {
       enumerable: true,
       get: function() {
@@ -122164,6 +122462,12 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return reclaimIntervalMs;
       }
     });
+    Object.defineProperty(exports, "recordSocketFrame", {
+      enumerable: true,
+      get: function() {
+        return recordSocketFrame;
+      }
+    });
     Object.defineProperty(exports, "registerEventBusService", {
       enumerable: true,
       get: function() {
@@ -122194,6 +122498,12 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return runNpm;
       }
     });
+    Object.defineProperty(exports, "sampleSocketDirection", {
+      enumerable: true,
+      get: function() {
+        return sampleSocketDirection;
+      }
+    });
     Object.defineProperty(exports, "selectReportedSpaces", {
       enumerable: true,
       get: function() {
@@ -122230,6 +122540,18 @@ var require_manifest_python_deps_CRTx_j4k = __commonJS({
         return shouldReclaim;
       }
     });
+    Object.defineProperty(exports, "socketDirectionBytes", {
+      enumerable: true,
+      get: function() {
+        return socketDirectionBytes;
+      }
+    });
+    Object.defineProperty(exports, "socketDirectionMessages", {
+      enumerable: true,
+      get: function() {
+        return socketDirectionMessages;
+      }
+    });
     Object.defineProperty(exports, "startHeapWatch", {
       enumerable: true,
       get: function() {
@@ -126068,7 +126390,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -126094,7 +126416,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_python_deps = require_manifest_python_deps_CRTx_j4k();
+    var require_manifest_python_deps = require_manifest_python_deps_w48vOhGR();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -206475,6 +206797,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
     exports.DeviceRegistry = require_manifest_python_deps.DeviceRegistry;
     exports.DeviceStore = require_builtins_sqlite_storage_index.DeviceStore$1;
+    exports.EMPTY_SOCKET_DIRECTION = require_manifest_python_deps.EMPTY_SOCKET_DIRECTION;
+    exports.EMPTY_SOCKET_PLANE_BASELINE = require_manifest_python_deps.EMPTY_SOCKET_PLANE_BASELINE;
     exports.EVENT_PLANE_TOP_N = require_manifest_python_deps.EVENT_PLANE_TOP_N;
     exports.EVENT_TOPIC_PREFIX = require_manifest_python_deps.EVENT_TOPIC_PREFIX;
     exports.EngineManagerResolver = EngineManagerResolver;
@@ -206548,6 +206872,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
     exports.SERVER_AUTH_OID = require_tls$1.SERVER_AUTH_OID;
+    exports.SOCKET_PLANE_TOP_N = require_manifest_python_deps.SOCKET_PLANE_TOP_N;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
     exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -206633,6 +206958,9 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.createReadinessService = createReadinessService;
     exports.createReadinessServiceForRegistry = createReadinessServiceForRegistry;
     exports.createScopedProcessManager = createScopedProcessManager;
+    exports.createSocketDirectionCounters = require_manifest_python_deps.createSocketDirectionCounters;
+    exports.createSocketPlaneMeter = require_manifest_python_deps.createSocketPlaneMeter;
+    exports.createSocketPlaneReader = require_manifest_python_deps.createSocketPlaneReader;
     exports.createStreamProbeBrokerService = createStreamProbeBrokerService;
     exports.createUdsAddonContext = require_manifest_python_deps.createUdsAddonContext;
     exports.createUdsEventBridge = require_manifest_python_deps.createUdsEventBridge;
@@ -206646,6 +206974,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.describeRss = require_manifest_python_deps.describeRss;
     exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
     exports.diffEventPlane = require_manifest_python_deps.diffEventPlane;
+    exports.diffSocketPlane = require_manifest_python_deps.diffSocketPlane;
     Object.defineProperty(exports, "downloadBinary", {
       enumerable: true,
       get: function() {
@@ -206693,6 +207022,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.formatEventPlane = require_manifest_python_deps.formatEventPlane;
     exports.formatHeapSpaces = require_manifest_python_deps.formatHeapSpaces;
     exports.formatLogLine = require_formatter.formatLogLine;
+    exports.formatSocketPlane = require_manifest_python_deps.formatSocketPlane;
     exports.getBrokerEventBus = require_manifest_python_deps.getBrokerEventBus;
     exports.getCapUsageRegistry = require_manifest_python_deps.getCapUsageRegistry;
     Object.defineProperty(exports, "getFfmpegDownloadUrl", {
@@ -206772,6 +207102,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.readTlsMode = require_tls$1.readTlsMode;
     exports.readinessKey = require_dist10.readinessKey;
     exports.reclaimIntervalMs = require_manifest_python_deps.reclaimIntervalMs;
+    exports.recordSocketFrame = require_manifest_python_deps.recordSocketFrame;
     exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
     exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
     exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
@@ -206780,6 +207111,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
     exports.runHubAddonBoot = runHubAddonBoot;
     exports.runNpm = require_manifest_python_deps.runNpm;
+    exports.sampleSocketDirection = require_manifest_python_deps.sampleSocketDirection;
     exports.scheduleSelfRestart = scheduleSelfRestart;
     exports.scopeKey = require_dist10.scopeKey;
     exports.scopesAllowAddon = require_dist10.scopesAllowAddon;
@@ -206790,6 +207122,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.setHubConnected = require_manifest_python_deps.setHubConnected;
     exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
     exports.shouldReclaim = require_manifest_python_deps.shouldReclaim;
+    exports.socketDirectionBytes = require_manifest_python_deps.socketDirectionBytes;
+    exports.socketDirectionMessages = require_manifest_python_deps.socketDirectionMessages;
     exports.startHeapWatch = require_manifest_python_deps.startHeapWatch;
     exports.startRunnerHeapWatch = require_manifest_python_deps.startRunnerHeapWatch;
     exports.strandedMb = require_manifest_python_deps.strandedMb;
@@ -227689,6 +228023,33 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       deviceNative: true,
       mode: "singleton",
       deviceTypes: [require_sleep.DeviceType.Camera],
+      /**
+      * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+      *
+      * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+      * cap has no configuration surface at all: all six methods open, feed and
+      * close one live audio session against one `deviceId`. That is the same
+      * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+      * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+      * `admin` because they change what the device IS.
+      *
+      * `protected` does not mean ungated: `protectedProcedure` runs the
+      * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+      * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+      * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+      * only) still cannot talk, and a grant on camera 5 cannot talk through
+      * camera 7.
+      *
+      * Every method was `auth: 'admin'` from the initial commit, which made the
+      * cap unreachable by every non-admin principal — `adminProcedure` throws
+      * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+      * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+      * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+      * `camera-operator` scope preset has promised "PTZ control, intercom,
+      * snapshots" since that same commit; the promise could not be kept. Recorded
+      * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+      * preset promises a cap no row of that preset can reach.
+      */
       methods: {
         /**
         * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -227701,7 +228062,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sdpOffer: zod.z.string()
         }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         handleAnswer: require_sleep.method(zod.z.object({
           deviceId: zod.z.number(),
@@ -227709,7 +228070,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sdpAnswer: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close explicitly. Server also auto-closes on 30s idle. */
         stopSession: require_sleep.method(zod.z.object({
@@ -227717,7 +228078,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sessionId: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -227730,7 +228091,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         startTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Push one chunk of talk-back audio onto the active talk session.
@@ -227765,12 +228126,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sequenceNumber: zod.z.number().int()
         }), zod.z.object({ accepted: zod.z.boolean() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close the raw-PCM talk session. Idempotent. */
         endTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         })
       },
       events: { onStatusChanged: { data: zod.z.object({
@@ -245028,7 +245389,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       {
         id: "camera-operator",
         label: "Camera operator",
-        description: "Everything `camera-viewer` does plus PTZ control, intercom, snapshots and recording start/stop. Cannot delete devices or recordings.",
+        description: "Everything `camera-viewer` does plus live control of every granted camera \u2014 PTZ movement, intercom talk-back and on-demand snapshots. Cannot delete devices, and grants nothing on system-scope caps (recording control, users, addons).",
         rows: [{
           type: "category",
           target: "device",
@@ -401628,6 +401989,7 @@ var require_scope_access = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.DEVICE_ENUMERATION_METHODS = void 0;
+    exports.referencedDeviceIds = referencedDeviceIds;
     exports.checkScopeAccess = checkScopeAccess;
     var system_1 = require_dist3();
     var types_1 = require_dist4();
@@ -413553,6 +413915,25 @@ var require_trpc_router = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/trpc/trpc-error-device-tags.js
+var require_trpc_error_device_tags = __commonJS({
+  "../../server/backend/dist/api/trpc/trpc-error-device-tags.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.trpcErrorDeviceTags = trpcErrorDeviceTags;
+    var scope_access_js_1 = require_scope_access();
+    function trpcErrorDeviceTags(path, input) {
+      if (path === void 0)
+        return {};
+      const ids = (0, scope_access_js_1.referencedDeviceIds)(path, input);
+      const first = ids[0];
+      if (first === void 0)
+        return {};
+      return ids.length > 1 ? { deviceId: first, deviceCount: ids.length } : { deviceId: first };
+    }
+  }
+});
+
 // ../../server/backend/dist/api/trpc/ws-request-census.js
 var require_ws_request_census = __commonJS({
   "../../server/backend/dist/api/trpc/ws-request-census.js"(exports) {
@@ -421635,6 +422016,7 @@ var require_main4 = __commonJS({
     var trpc_context_1 = require_trpc_context();
     var trpc_router_1 = require_trpc_router();
     var trpc_error_principal_1 = require_trpc_error_principal();
+    var trpc_error_device_tags_1 = require_trpc_error_device_tags();
     var ws_request_census_1 = require_ws_request_census();
     var addon_route_jwt_gate_js_1 = require_addon_route_jwt_gate();
     var session_cookie_js_1 = require_session_cookie();
@@ -421748,6 +422130,17 @@ var require_main4 = __commonJS({
             return broker === void 0 ? null : (0, system_1.getMoleculerEventStats)(broker);
           },
           crossNodeMode: () => (0, system_1.readMoleculerFanoutMode)()
+        }),
+        // The fan-out counters above answered their own question and sharpened
+        // this one: the event plane is 4% of this process's ~44 000 socket
+        // syscalls/s. The other 96% had no instrument — `/proc` reports one
+        // rchar/wchar pair per PROCESS and has no per-socket breakdown, so the
+        // best attribution available was a correlation with `hub/pipeline-
+        // analytics` computed from a runner whose rchar also counts page-cache
+        // reads. These counters live on the channel itself, so the attribution is
+        // per peer and per frame kind. Same lazy registry, same reason.
+        socketPlane: (0, system_1.createSocketPlaneReader)({
+          registry: () => moleculerForEventPlane?.childRegistry ?? null
         })
       });
       cleanupOrphanProcesses();
@@ -421933,9 +422326,13 @@ var require_main4 = __commonJS({
               (0, http_request_census_hook_1.recordTrpcHttpRequest)(httpRequestCensus, req, trpcCtx.user);
               return trpcCtx;
             },
-            onError: ({ path: trpcPath, error, ctx }) => {
+            onError: ({ path: trpcPath, error, ctx, input }) => {
               const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC");
               trpcLogger.warn("tRPC error", {
+                // WHICH camera. A refusal on a device-scoped path that names no
+                // deviceId cannot answer "one camera or all of them?" — the
+                // question always asked first (2026-08-29, `intercom.startSession`).
+                tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
                 meta: {
                   code: error.code,
                   path: trpcPath ?? "?",
@@ -422334,9 +422731,12 @@ var require_main4 = __commonJS({
             (0, ws_request_census_1.identifyWsCensusSession)(opts.res, (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user));
             return wsCtx;
           },
-          onError: ({ path: trpcPath, error, ctx }) => {
+          onError: ({ path: trpcPath, error, ctx, input }) => {
             const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC:ws");
             trpcLogger.warn("tRPC error", {
+              // The socket the viewer uses — this is the transport that logged the
+              // four `intercom.startSession` refusals with no camera on them.
+              tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
               meta: {
                 code: error.code,
                 path: trpcPath ?? "?",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.59",
+  "version": "1.2.61",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",