@camstack/server 1.0.5 → 1.0.7

package/dist/core/addon/addon-package.service.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AddonPackageService = exports.SYSTEM_PACKAGE = void 0;
 exports.isFrameworkPackage = isFrameworkPackage;
+exports.extractTgzStripped = extractTgzStripped;
 exports.sweepStaleFrameworkBackups = sweepStaleFrameworkBackups;
 exports.swapInFrameworkPackage = swapInFrameworkPackage;
 const fs = __importStar(require("node:fs"));
@@ -812,6 +813,112 @@ class AddonPackageService {
             return { success: false, version: '', requiresRestart: false, error: msg };
         }
     }
+    /**
+     * Apply a staged addon update without running npm — the fast swap-from-staged
+     * path. Mirrors the addon branch of `updatePackage` exactly, but calls
+     * `addonInstaller.applyUpdateFromStaged(name, version, stagedPath)` instead
+     * of `applyUpdate`/`installFromNpm`.
+     *
+     * The staged directory must already be validated and unpacked by the caller
+     * (e.g. the upload handler that previously called `installFromTgz`). This
+     * method performs the atomic swap, restarts the addon, and clears the backup
+     * on success — identical lifecycle to `updatePackage` addon branch.
+     */
+    async applyStagedAddonUpdate(name, version, stagedPath) {
+        if (!this.isAllowedPackage(name)) {
+            return {
+                success: false,
+                version: '',
+                requiresRestart: false,
+                error: `Package "${name}" is not an allowed @camstack/* package`,
+            };
+        }
+        const category = this.categorize(name);
+        this.logger.info('Applying staged addon update', { meta: { name, version, category } });
+        try {
+            if (category !== 'addon') {
+                return {
+                    success: false,
+                    version: '',
+                    requiresRestart: false,
+                    error: `applyStagedAddonUpdate only supports addon packages; "${name}" categorized as "${category}"`,
+                };
+            }
+            this.requireInstaller();
+            const addonInstaller = this.installer;
+            const previousVersion = this.getInstalledPackageVersion(name);
+            const r = await addonInstaller.applyUpdateFromStaged(name, version, stagedPath);
+            const updatedVersion = r.version;
+            // Update version in registry so UI reflects the change immediately
+            this.addonRegistry.refreshPackageVersion(name, updatedVersion);
+            // Emit addon.updated lifecycle event
+            this.addonRegistry.emitUpdateEvent(name, previousVersion, updatedVersion);
+            this.logger.info('Staged addon swap complete, triggering hot-reload', {
+                meta: { name, updatedVersion },
+            });
+            const addonId = this.extractAddonId(name);
+            if (addonId) {
+                try {
+                    await this.addonRegistry.restartAddon(addonId);
+                    this.logger.info('Addon restarted after staged update', { tags: { addonId } });
+                    // Restart succeeded — drop the backup
+                    addonInstaller.clearBackup(name);
+                }
+                catch (reloadError) {
+                    const msg = (0, types_1.errMsg)(reloadError);
+                    this.logger.warn('Hot-reload failed for addon — backup retained for rollback', {
+                        tags: { addonId },
+                        meta: { error: msg, backupDir: r.backupDir },
+                    });
+                }
+            }
+            // Clear update cache so next check reflects new state
+            this.cachedUpdates = null;
+            this.sendUpdateNotification(name, updatedVersion);
+            return { success: true, version: updatedVersion, requiresRestart: false };
+        }
+        catch (error) {
+            const msg = (0, types_1.errMsg)(error);
+            this.logger.error('Failed to apply staged addon update', { meta: { name, error: msg } });
+            return { success: false, version: '', requiresRestart: false, error: msg };
+        }
+    }
+    /**
+     * Download the npm tarball for `name@version` as a Buffer.
+     *
+     * Wraps the module-level `httpsDownloadTarball` for use by the
+     * lifecycle job engine (TarballFetcher signature). The `signal` is
+     * forwarded to the underlying fetch calls so the AbortController
+     * timeout wired in LifecycleJobEngine fires correctly.
+     */
+    async fetchAddonTarball(name, version, signal) {
+        const registry = process.env['CAMSTACK_NPM_REGISTRY'];
+        const reg = (registry ?? 'https://registry.npmjs.org').replace(/\/+$/, '');
+        const metaUrl = `${reg}/${encodeURIComponent(name).replace(/^%40/, '@')}`;
+        const metaRes = await fetch(metaUrl, { signal });
+        if (!metaRes.ok)
+            throw new Error(`registry GET ${metaUrl} → ${metaRes.status}`);
+        const meta = (await metaRes.json());
+        const tarballUrl = meta.versions?.[version]?.dist?.tarball;
+        if (typeof tarballUrl !== 'string') {
+            throw new Error(`no tarball url for ${name}@${version}`);
+        }
+        const tarRes = await fetch(tarballUrl, { signal });
+        if (!tarRes.ok)
+            throw new Error(`tarball GET ${tarballUrl} → ${tarRes.status}`);
+        return Buffer.from(await tarRes.arrayBuffer());
+    }
+    /**
+     * Extract a gzipped tarball Buffer into `destDir`.
+     *
+     * Wraps the existing `tar -xzf` shell call for use by the lifecycle job
+     * engine (ExtractFn signature). The Buffer is written to a temp file,
+     * extracted with `--strip-components=1` (removes the npm `package/` prefix),
+     * then the temp file is removed.
+     */
+    async extractTarball(tgz, destDir) {
+        await extractTgzStripped(tgz, destDir);
+    }
     /**
      * Gracefully restart the server process.
      *
@@ -981,19 +1088,94 @@ class AddonPackageService {
             fs.rmSync(tmpRoot, { recursive: true, force: true });
         }
     }
+    /**
+     * Resolve a version specifier (`'latest'`, semver tag, exact) for a
+     * framework package to a concrete version via `npm view`.
+     * Delegates to the module-level `resolveNpmVersion` helper.
+     * Exposed as a public method so the lifecycle job engine wiring in
+     * cap-providers can pass it as `resolveVersion` without duplicating the
+     * npm-view/manifest logic.
+     */
+    async resolveFrameworkVersion(packageName, versionSpec) {
+        return resolveNpmVersion(packageName, versionSpec, process.env['CAMSTACK_NPM_REGISTRY']);
+    }
+    /**
+     * Return the currently-installed version of a framework package, or `null`
+     * when it cannot be determined (not installed / no manifest).
+     * Delegates to the module-level `readResolvedPackageManifest` helper.
+     * Exposed as a public method for use by the lifecycle job engine wiring.
+     */
+    currentFrameworkVersionOf(packageName) {
+        const manifest = readResolvedPackageManifest(packageName);
+        if (manifest !== null && typeof manifest['version'] === 'string') {
+            return manifest['version'];
+        }
+        return null;
+    }
+    /**
+     * Update a framework package via the staged launcher-swap engine.
+     *
+     * New path (when `runner` is provided):
+     *   1. Resolve toVersion via `npm view`.
+     *   2. Delegate to `runner.startJob` with a `target:'framework'` task.
+     *      The engine calls `stageFramework` → downloads+stages the 4 lockstep
+     *      packages → calls the wired `requestFrameworkSwap`
+     *      (`requestFrameworkSwapAndRestart`), which writes the
+     *      `.pending-framework-swap.json` marker AND schedules the self-restart.
+     *      The hub exits; the launcher applies the swap on the next boot. The
+     *      restart is owned by that seam, so this method does NOT schedule one.
+     *   3. Return `{ packageName, fromVersion, toVersion, restartingAt }`.
+     *      `restartingAt = 0` only on the legacy in-hub path when `deferRestart`
+     *      is set (engine path always restarts once the framework is staged).
+     *
+     * Legacy path (when no `runner`): keeps the original in-hub live-swap for
+     * backward compatibility with callers (e.g. tests) that have not wired the
+     * engine deps.
+     */
     async updateFrameworkPackage(input) {
         const { packageName } = input;
         if (packageName !== exports.SYSTEM_PACKAGE) {
             throw new Error(`updateFrameworkPackage: '${packageName}' is not a framework package. Allowed: ${exports.SYSTEM_PACKAGE}`);
         }
-        const appRoot = resolveFrameworkPackageAppRoot(packageName, this.logger);
-        const fromManifest = readResolvedPackageManifest(packageName);
-        const fromVersion = fromManifest !== null && typeof fromManifest['version'] === 'string'
-            ? fromManifest['version']
-            : 'unknown';
+        const fromVersion = this.currentFrameworkVersionOf(packageName) ?? 'unknown';
         const requestedVersion = input.version ?? 'latest';
-        const toVersion = await resolveNpmVersion(packageName, requestedVersion, process.env['CAMSTACK_NPM_REGISTRY']);
-        this.logger.info('updateFrameworkPackage: installing', {
+        const toVersion = await this.resolveFrameworkVersion(packageName, requestedVersion);
+        // ── New staged-swap engine path ──────────────────────────────────
+        if (input.runner !== undefined) {
+            this.logger.info('updateFrameworkPackage: delegating to staged swap engine', {
+                meta: { packageName, fromVersion, toVersion, deferRestart: input.deferRestart ?? false },
+            });
+            await input.runner.startJob({
+                kind: 'update',
+                targets: [{ name: packageName, version: toVersion, target: 'framework' }],
+                createdBy: input.requestedBy ?? 'system',
+            });
+            // The engine's framework task already wrote the pending-swap marker AND
+            // scheduled the self-restart via the wired `requestFrameworkSwap`
+            // (`requestFrameworkSwapAndRestart`) — that is the single restart owner,
+            // so we must NOT schedule a second one here. We only surface the
+            // pre-restart toast event for the interactive single-update path.
+            if (input.deferRestart !== true) {
+                this.eventBusService.emit({
+                    id: (0, node_crypto_1.randomUUID)(),
+                    timestamp: new Date(),
+                    source: { type: 'core', id: 'addon-package-service' },
+                    category: types_1.EventCategory.SystemRestarting,
+                    data: {
+                        kind: 'framework-update',
+                        packageName,
+                        fromVersion,
+                        toVersion,
+                        requestedAt: Date.now(),
+                    },
+                });
+            }
+            const restartingAt = input.deferRestart === true ? 0 : Date.now() + 500;
+            return { packageName, fromVersion, toVersion, restartingAt };
+        }
+        // ── Legacy in-hub live-swap path (no runner injected) ───────────
+        const appRoot = resolveFrameworkPackageAppRoot(packageName, this.logger);
+        this.logger.info('updateFrameworkPackage: installing (legacy in-hub path)', {
             meta: { packageName, fromVersion, toVersion, appRoot },
         });
         await this.installFrameworkPackages(packageName, toVersion, appRoot);
@@ -1118,11 +1300,22 @@ class AddonPackageService {
             });
         }, intervalMs);
     }
-    /** Run auto-update: check each installed package against its configured channel */
+    /**
+     * Run auto-update: check each installed package against its configured
+     * channel, then route ALL packages that have a newer version through ONE
+     * durable engine bulk job (F3 Task 5). The framework (`@camstack/system`) is
+     * auto-detected by the engine and ordered LAST; auto-updates survive a reboot
+     * via the boot reconcile, exactly like a manual "Update all".
+     *
+     * Candidate selection (channel resolution + npm metadata fetch + "is there a
+     * newer version?" comparison) is unchanged from the previous per-item loop;
+     * only the EXECUTION moved from sequential `updatePackage` calls to a single
+     * `startJob`.
+     */
     async runAutoUpdate() {
         this.logger.info('Running auto-update check...');
         const installed = this.listInstalled();
-        let updatedCount = 0;
+        const targets = [];
         for (const pkg of installed) {
             try {
                 // Determine effective channel for this addon
@@ -1147,7 +1340,7 @@ class AddonPackageService {
                     : asString(distTags['latest']);
                 if (!targetVersion || targetVersion === pkg.version)
                     continue;
-                this.logger.info('Auto-updating package', {
+                this.logger.info('Auto-update candidate', {
                     meta: {
                         name: pkg.name,
                         currentVersion: pkg.version,
@@ -1155,18 +1348,34 @@ class AddonPackageService {
                         channel: effectiveChannel,
                     },
                 });
-                await this.updatePackage(pkg.name, targetVersion);
-                updatedCount++;
+                targets.push({ name: pkg.name, version: targetVersion });
             }
             catch (err) {
-                this.logger.warn('Auto-update failed', { meta: { name: pkg.name, error: (0, types_1.errMsg)(err) } });
+                this.logger.warn('Auto-update check failed', {
+                    meta: { name: pkg.name, error: (0, types_1.errMsg)(err) },
+                });
             }
         }
-        if (updatedCount > 0) {
-            this.logger.info('Auto-update complete', { meta: { updatedCount } });
-        }
-        else {
+        if (targets.length === 0) {
             this.logger.debug('Auto-update: all packages up-to-date');
+            return;
+        }
+        // Execute as ONE durable engine bulk job. The runner singleton is resolved
+        // lazily via a dynamic import (the singleton module transitively imports
+        // SYSTEM_PACKAGE back from this module) to avoid an init-order cycle. The
+        // singleton is initialized at boot, before the scheduler timer fires. The
+        // framework target, if present, is ordered last by the engine. Wrap so a
+        // failure is logged, not thrown out of the timer callback.
+        try {
+            const { getLifecycleRunner } = await Promise.resolve().then(() => __importStar(require('../lifecycle/lifecycle-runner.singleton.js')));
+            const runner = getLifecycleRunner();
+            const { jobId } = await runner.startJob({ kind: 'update', targets, createdBy: 'system' });
+            this.logger.info('Auto-update job started', {
+                meta: { jobId, packageCount: targets.length },
+            });
+        }
+        catch (err) {
+            this.logger.error('Auto-update job failed to start', { meta: { error: (0, types_1.errMsg)(err) } });
         }
     }
     // =========================================================================
@@ -1484,6 +1693,35 @@ class AddonPackageService {
 }
 exports.AddonPackageService = AddonPackageService;
 // ---------------------------------------------------------------------------
+// Tarball extraction helper (exported for regression tests)
+// ---------------------------------------------------------------------------
+/**
+ * Extract a gzipped tarball Buffer into `destDir`, stripping the npm
+ * `package/` top-level prefix so that the extracted `package.json` lands at
+ * `destDir/package.json` (not `destDir/package/package.json`).
+ *
+ * Uses `tar --strip-components=1` which mirrors what `installFromTgz` does
+ * when it reads `path.join(tmpDir, 'package')` after a plain extract and
+ * then uses that sub-directory as the source root.
+ *
+ * Exported so the regression spec in
+ * `src/core/addon/__tests__/extract-tarball-strip.spec.ts` can test the real
+ * implementation without instantiating `AddonPackageService`.
+ */
+async function extractTgzStripped(tgz, destDir) {
+    fs.mkdirSync(destDir, { recursive: true });
+    const tmpFile = path.join(os.tmpdir(), `camstack-tgz-${(0, node_crypto_1.randomUUID)()}.tgz`);
+    try {
+        fs.writeFileSync(tmpFile, tgz);
+        await execFileAsync('tar', ['--strip-components=1', '-xzf', tmpFile, '-C', destDir], {
+            timeout: 60_000,
+        });
+    }
+    finally {
+        fs.rmSync(tmpFile, { force: true });
+    }
+}
+// ---------------------------------------------------------------------------
 // Framework live-update helpers
 // ---------------------------------------------------------------------------
 /**

package/dist/core/addon/addon-registry.service.js

@@ -1358,13 +1358,27 @@ class AddonRegistryService {
                     // the group-runner crashed for real, `$node.disconnected`
                     // surfaces it through the health monitor; the operator can
                     // always click Cancel on the UI mutation.
-                    const waits = declared.map((cap) => this.capabilityRegistry.waitForProvider(cap.name, addonId, Number.POSITIVE_INFINITY));
+                    // Wait for declared caps to re-register, but BOUNDED — and on timeout
+                    // do NOT throw. DEVICE-SCOPED caps (e.g. a camera provider's
+                    // `device-provider` / `snapshot-provider`) only ever register once
+                    // devices exist; on a hub with none they NEVER come back, so an
+                    // infinite wait hangs the whole update — and the lifecycle job that
+                    // drives it (apply task stuck at `applying`, framework-last blocked,
+                    // the job uncancellable). The on-disk swap + runner restart have
+                    // already succeeded here; any caps still pending re-register
+                    // asynchronously as their devices come online. We only WARN which
+                    // caps were still pending (the comment's original objection was a
+                    // *misleading error* on timeout — a warning avoids that while still
+                    // letting the update finalize).
+                    const REGISTER_WAIT_MS = 120_000;
+                    const waits = declared.map((cap) => this.capabilityRegistry.waitForProvider(cap.name, addonId, REGISTER_WAIT_MS));
                     const settled = await Promise.all(waits);
                     const missing = declared
                         .map((cap, i) => (settled[i] == null ? cap.name : null))
                         .filter((name) => name !== null);
                     if (missing.length > 0) {
-                        throw new Error(`Addon "${addonId}" restarted but did not re-register capabilities in time: ${missing.join(', ')}`);
+                        this.logger.warn(`Addon "${addonId}" restarted; ${missing.length} capability(ies) not yet re-registered ` +
+                            `(re-register asynchronously — e.g. device-scoped caps awaiting devices): ${missing.join(', ')}`, { tags: { addonId } });
                     }
                 }
                 // Re-register the addon's custom-action catalog. `$process.restart`

package/dist/core/agent/agent-registry.service.js

@@ -39,6 +39,36 @@ const os = __importStar(require("node:os"));
 const types_1 = require("@camstack/types");
 /** Per-call timeout for `$agent.*` RPC during reconciliation. */
 const AGENT_RECONCILE_RPC_TIMEOUT_MS = 8_000;
+/**
+ * Package name of the system/infrastructure builtins. Addons shipped in
+ * `@camstack/system` (filesystem-storage, storage-orchestrator,
+ * sqlite-settings, hub-forwarder, metrics-native, console-logging, …) are
+ * bootstrap infrastructure that EVERY node — hub and agent alike — runs
+ * in-process. They are never `$agent.deploy`-pushed and must NEVER be
+ * undeployed by reconciliation: tearing them down on an agent destroys its
+ * own storage/settings/metrics/logging and bricks the node. This is the
+ * same canonical "core builtin" predicate the hub uses in
+ * `AddonRegistryService.buildAddonGroupPlan`.
+ */
+/**
+ * Agent bootstrap-infrastructure packages — seeded by the agent's own
+ * `AGENT_PACKAGES` bootstrap, NEVER hub-managed deploy targets, so the
+ * reconcile must never undeploy them (they are absent from the hub's
+ * installed-addon set and would otherwise look "stale"):
+ *   - `@camstack/system`        — storage/settings/metrics/logging builtins.
+ *   - `@camstack/addon-agent-ui` — the agent's own status dashboard
+ *     (placement: agent-only; the hub never installs it, so it is missing
+ *     from `hubPlacements`). The hub's deploy planner already SKIPS
+ *     agent-only addons, so undeploying one is a reconcile asymmetry bug.
+ *
+ * The hub cannot consult `AddonInstaller.AGENT_PACKAGES` directly: it
+ * derives from `@camstack/agent`, which is not installed in a hub image,
+ * so that list is empty hub-side. Hence this explicit allowlist.
+ */
+const AGENT_BOOTSTRAP_PACKAGES = new Set([
+    '@camstack/system',
+    '@camstack/addon-agent-ui',
+]);
 class AgentRegistryService {
     eventBus;
     moleculer;
@@ -229,6 +259,16 @@ class AgentRegistryService {
                 hubPlacements.set(declId, (0, types_1.resolveAddonPlacement)(decl));
             }
             const stale = agentAddons.filter((addon) => {
+                // Agent bootstrap infrastructure (storage/settings/metrics/logging from
+                // `@camstack/system`, plus the agent-only `addon-agent-ui` dashboard)
+                // runs on every node as bootstrap infrastructure — never hub-managed
+                // deploy targets, must never be undeployed. Without this guard the
+                // reconcile tears down the agent's own builtins (they aren't in the
+                // hub's installed-addon set, so they look "stale"), which bricks the
+                // agent and makes it permanently unroutable. See AGENT_BOOTSTRAP_PACKAGES.
+                if (addon.packageName !== undefined && AGENT_BOOTSTRAP_PACKAGES.has(addon.packageName)) {
+                    return false;
+                }
                 const placement = hubPlacements.get(addon.id);
                 // Not installed on the hub → stale.
                 if (placement === undefined)
@@ -281,7 +321,9 @@ class AgentRegistryService {
             const id = entry.id;
             if (typeof id !== 'string' || id.length === 0)
                 continue;
-            result.push({ id });
+            // Preserve `packageName` — the reconcile uses it to skip system builtins.
+            const packageName = entry.packageName;
+            result.push({ id, packageName: typeof packageName === 'string' ? packageName : undefined });
         }
         return result;
     }

package/dist/core/lifecycle/lifecycle-runner.singleton.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Process-wide singleton holder for the lifecycle job runner.
+ *
+ * The runner used to be built per-tRPC-request inside the `addons` cap factory,
+ * so there was no stable instance for boot-reconcile (F3 Task 4) or the
+ * auto-update scheduler (F3 Task 5) to use. This module builds the runner ONCE
+ * at boot (from the `AddonPackageService` + event bus, wired in `manual-boot`)
+ * and exposes it to every consumer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initLifecycleRunner = initLifecycleRunner;
+exports.getLifecycleRunner = getLifecycleRunner;
+exports.__resetLifecycleRunnerForTests = __resetLifecycleRunnerForTests;
+const lifecycle_job_runner_js_1 = require("../../api/core/lifecycle-job-runner.js");
+let instance = null;
+/**
+ * Build the runner once. Idempotent: a second call returns the already-built
+ * instance and ignores the new deps (it does NOT rebuild).
+ */
+function initLifecycleRunner(deps) {
+    if (instance === null) {
+        instance = (0, lifecycle_job_runner_js_1.createLifecycleJobRunner)(deps);
+    }
+    return instance;
+}
+/**
+ * Return the process-wide runner. Throws if `initLifecycleRunner` has not been
+ * called yet (boot wiring is expected to init it before any consumer runs).
+ */
+function getLifecycleRunner() {
+    if (instance === null) {
+        throw new Error('lifecycle runner not initialized — call initLifecycleRunner(deps) at boot before use');
+    }
+    return instance;
+}
+/** Test-only: reset the singleton between specs. */
+function __resetLifecycleRunnerForTests() {
+    instance = null;
+}

package/dist/framework-nodepath.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.frameworkNodePaths = frameworkNodePaths;
+const path = __importStar(require("node:path"));
+/**
+ * The framework's node_modules path to prepend to NODE_PATH so the CJS hub
+ * resolves @camstack/system (+ hoisted server deps) from /data/framework.
+ * CJS honors NODE_PATH (unlike ESM `import`, which is why addons use the
+ * resolver hook instead). Empty when unset or absent.
+ */
+function frameworkNodePaths(frameworkDir, exists) {
+    if (!frameworkDir)
+        return [];
+    const nm = path.join(frameworkDir, 'node_modules');
+    return exists(nm) ? [nm] : [];
+}