@camstack/server 1.2.274 → 1.2.276

package/dist/api/trpc/trpc.router.js

@@ -52,6 +52,14 @@ function enrichInputWithUserAgent(input, userAgent) {
  * candidate LEAK in the forced-relay SDP — and does nothing for relay
  * media-forward, so the connected-but-black regression remains unproven-fixed.
  *
+ * And until 2026-09-12 that patch was not even RUNNING on a live node: it is
+ * applied by `patch-package` in a dev tree only, and the closure installed
+ * werift from npm unpatched (D478). So the leak this gate's re-enable path
+ * assumes is fixed was, in fact, present in production the whole time — do not
+ * run the one-real-remote-relay-session validation against a closure that
+ * predates the closure-postinstall applier, or it will fail for that reason
+ * rather than for the media-forward one it is meant to test.
+ *
  * Until an operator confirms that ONE real remote relay session (4G /
  * Cloudflare-tunnel) actually delivers media, remote viewers stay on the same
  * `relayOnly:false` path as everyone else. Set `CAMSTACK_FORCE_RELAY_REMOTE=1`

package/dist/closure-patches/patch-reach.json

@@ -0,0 +1,105 @@
+{
+  "$schema-version": 1,
+  "$why": [
+    "A patch under `patches/` is applied by `patch-package` on the repo root's",
+    "`postinstall` — which runs HERE, in a developer's or a CI runner's",
+    "`node_modules`, and NOWHERE ELSE. Whether the patched behaviour exists in",
+    "production is a separate question with a different answer per package, and",
+    "for eight weeks nothing in this repository asked it (D478).",
+    "",
+    "This file is the answer, per patch, and it is the single authority for:",
+    "  - `scripts/check-patches-reach-production.ts` (CI: is the claim TRUE?),",
+    "  - `server/backend/scripts/closure-postinstall.mjs` (applies the",
+    "    `closure-postinstall` patches inside the installed framework closure),",
+    "  - `findUnappliedClosurePatches` in `@camstack/node-root` (refuses to swap",
+    "    into a closure where one did not land).",
+    "",
+    "Adding a patch to `patches/` without an entry here FAILS CI. There is no",
+    "default reach: a patch nobody can say ships is a patch that does not."
+  ],
+  "patches": [
+    {
+      "patch": "moleculer+0.15.0.patch",
+      "package": "moleculer",
+      "version": "0.15.0",
+      "reach": "bundled",
+      "bundledInto": ["packages/system/dist/index.js", "packages/system/dist/index.mjs"],
+      "markers": ["rest.buffer.byteLength"],
+      "why": [
+        "`moleculer` is NOT in the vite preset's externals, so rolldown inlines",
+        "its whole tree — parser included — into `@camstack/system/dist`, and the",
+        "patch travels inside the published tarball. Verified 2026-09-12 in the",
+        "`@camstack/system@1.2.224` tarball and in the live closure on both the",
+        "hub and the little-unraid agent.",
+        "",
+        "The closure ALSO carries an unpatched `node_modules/moleculer` — npm",
+        "installs it for `@camstack/system`'s dependency entry — and exactly one",
+        "file requires it: `@camstack/server/dist/agent/agent-service.js`, for",
+        "`Errors`. Nothing constructs a `ServiceBroker` from it; every real broker",
+        "on hub and agent comes from `createBroker` in `@camstack/system`, so the",
+        "TCP `Parser` that runs is the bundled, patched one. That unused copy is",
+        "why a grep of the closure's `node_modules/moleculer` reads as unpatched",
+        "and means nothing.",
+        "",
+        "The marker is `rest.buffer.byteLength`, NOT the `pinsTooMuch` identifier",
+        "the patch spells: rolldown inlines a single-use const, so `pinsTooMuch`",
+        "is absent from every bundle including the correct ones. A marker that a",
+        "bundler can erase cannot answer this question."
+      ]
+    },
+    {
+      "patch": "werift+0.22.9.patch",
+      "package": "werift",
+      "version": "0.22.9",
+      "reach": "closure-postinstall",
+      "markers": {
+        "lib/ice/src/ice.js": ["camstack: relay-only SDP under forceTurn"],
+        "lib/index.mjs": ["camstack: relay-only SDP under forceTurn", "RTP_HISTORY_SIZE = 4096"],
+        "lib/webrtc/src/media/rtpSender.js": ["RTP_HISTORY_SIZE = 4096"]
+      },
+      "declaredBy": [
+        "packages/addon-pipeline",
+        "packages/addon-provider-reolink",
+        "packages/addon-provider-hikvision"
+      ],
+      "why": [
+        "`werift` is the opposite case, and it is the one that was broken. It is",
+        "deliberately NOT bundled: the three addons that use it declare it and",
+        "`session.ts` resolves it at RUNTIME out of the framework closure, so the",
+        "installer's closure-dedupe (D343) links all three at ONE copy. That copy",
+        "is a plain npm tarball. The closure has no `patches/` directory and had",
+        "no lifecycle step that could apply one, so production ran werift 0.22.9",
+        "UNPATCHED — verified 2026-09-12 on the hub, the little-unraid agent and",
+        "the Mac-mini Electron agent, all three showing `RTP_HISTORY_SIZE = 128`",
+        "and no forceTurn guard.",
+        "",
+        "It now reaches production because `@camstack/server` ships these patches",
+        "in `dist/closure-patches/` and applies them from its own `postinstall`,",
+        "which runs inside the staging closure (the closure install passes no",
+        "`--ignore-scripts`). A closure where a marker did not land is refused by",
+        "`findUnappliedClosurePatches` before it can be swapped in.",
+        "",
+        "The version is EXACT, in this file and in all three declaring packages.",
+        "A caret would let npm resolve 0.22.10 into the closure, the patch would",
+        "not apply, and the only honest outcome of that is a refused update — so",
+        "the range that could cause it is not allowed to exist."
+      ]
+    },
+    {
+      "patch": "node-turn+0.0.6.patch",
+      "package": "node-turn",
+      "reach": "dev-only",
+      "why": [
+        "`node-turn` is a devDependency of exactly one workspace package,",
+        "`@camstack/werift-turn-fix` — `private: true`, `camstack: false`, no",
+        "addons, never published and never deployed. It exists to stand up a real",
+        "TURN server for the relay specs. Nothing in production loads it, so the",
+        "patch has nothing to reach.",
+        "",
+        "The guard keeps this honest: if any publishable package ever declares",
+        "`node-turn` in `dependencies` or `peerDependencies`, `dev-only` becomes",
+        "a false claim and CI fails."
+      ]
+    }
+  ]
+}

package/dist/closure-patches/werift+0.22.9.patch

@@ -0,0 +1,74 @@
+diff --git a/node_modules/werift/lib/ice/src/ice.js b/node_modules/werift/lib/ice/src/ice.js
+index 74cf126..0c5cedf 100644
+--- a/node_modules/werift/lib/ice/src/ice.js
++++ b/node_modules/werift/lib/ice/src/ice.js
+@@ -635,7 +635,10 @@ class Connection {
+                 const candidateAddress = [address, protocol.getExtraInfo()[1]];
+                 protocol.localCandidate = new candidate_1.Candidate((0, candidate_1.candidateFoundation)("host", "udp", candidateAddress[0]), 1, "udp", (0, candidate_1.candidatePriority)("host"), candidateAddress[0], candidateAddress[1], "host", undefined, undefined, undefined, this.generation, this.localUsername);
+                 this.pairLocalProtocol(protocol);
+-                this.appendLocalCandidate(protocol.localCandidate);
++                // camstack: relay-only SDP under forceTurn (werift forceTurn candidate leak) — see werift-turn-fix spec
++                if (!this.options.forceTurn) {
++                    this.appendLocalCandidate(protocol.localCandidate);
++                }
+                 return protocol;
+             }
+             catch (error) {
+@@ -656,7 +659,8 @@ class Connection {
+                         const candidate = await (0, iceBase_1.serverReflexiveCandidate)(protocol, stunServer).catch((error) => {
+                             log("error", error);
+                         });
+-                        if (candidate) {
++                        // camstack: relay-only SDP under forceTurn (werift forceTurn candidate leak) — see werift-turn-fix spec
++                        if (candidate && !this.options.forceTurn) {
+                             this.appendLocalCandidate(candidate);
+                         }
+                         clearTimeout(timer);
+diff --git a/node_modules/werift/lib/index.mjs b/node_modules/werift/lib/index.mjs
+index 3e8b013..48823e7 100644
+--- a/node_modules/werift/lib/index.mjs
++++ b/node_modules/werift/lib/index.mjs
+@@ -7940,7 +7940,10 @@ var Connection = class {
+           this.localUsername
+         );
+         this.pairLocalProtocol(protocol);
+-        this.appendLocalCandidate(protocol.localCandidate);
++        // camstack: relay-only SDP under forceTurn (werift forceTurn candidate leak) — see werift-turn-fix spec
++        if (!this.options.forceTurn) {
++          this.appendLocalCandidate(protocol.localCandidate);
++        }
+         return protocol;
+       } catch (error) {
+         log22("error protocol STUN", error);
+@@ -7967,7 +7970,8 @@ var Connection = class {
+                 ).catch((error) => {
+                   log22("error", error);
+                 });
+-                if (candidate) {
++                // camstack: relay-only SDP under forceTurn (werift forceTurn candidate leak) — see werift-turn-fix spec
++                if (candidate && !this.options.forceTurn) {
+                   this.appendLocalCandidate(candidate);
+                 }
+                 clearTimeout(timer2);
+@@ -13565,7 +13569,7 @@ var SenderBandwidthEstimator = class {
+ 
+ // src/media/rtpSender.ts
+ var log33 = debug("werift:packages/webrtc/src/media/rtpSender.ts");
+-var RTP_HISTORY_SIZE = 128;
++var RTP_HISTORY_SIZE = 4096;
+ var RTT_ALPHA = 0.85;
+ var RTCRtpSender = class {
+   constructor(trackOrKind) {
+diff --git a/node_modules/werift/lib/webrtc/src/media/rtpSender.js b/node_modules/werift/lib/webrtc/src/media/rtpSender.js
+index bc85968..64a5304 100644
+--- a/node_modules/werift/lib/webrtc/src/media/rtpSender.js
++++ b/node_modules/werift/lib/webrtc/src/media/rtpSender.js
+@@ -33,7 +33,7 @@ const utils_1 = require("../utils");
+ const senderBWE_1 = require("./sender/senderBWE");
+ const stats_1 = require("./stats");
+ const log = (0, rtp_1.debug)("werift:packages/webrtc/src/media/rtpSender.ts");
+-const RTP_HISTORY_SIZE = 128;
++const RTP_HISTORY_SIZE = 4096;
+ const RTT_ALPHA = 0.85;
+ class RTCRtpSender {
+     constructor(trackOrKind) {

package/dist/server-root/index.js

@@ -101,6 +101,7 @@ var require_dist = __commonJS({
       devUploadsDir: /* @__PURE__ */ __name(() => devUploadsDir, "devUploadsDir"),
       emptyServerRootState: /* @__PURE__ */ __name(() => emptyServerRootState, "emptyServerRootState"),
       findMissingNativePrebuilds: /* @__PURE__ */ __name(() => findMissingNativePrebuilds, "findMissingNativePrebuilds"),
+      findUnappliedClosurePatches: /* @__PURE__ */ __name(() => findUnappliedClosurePatches, "findUnappliedClosurePatches"),
       isDevChannelVersion: /* @__PURE__ */ __name(() => isDevChannelVersion, "isDevChannelVersion"),
       isHostExternal: /* @__PURE__ */ __name(() => isHostExternal, "isHostExternal"),
       isServerRootState: /* @__PURE__ */ __name(() => isServerRootState, "isServerRootState"),
@@ -505,6 +506,58 @@ var require_dist = __commonJS({
       return missing;
     }
     __name(findMissingNativePrebuilds, "findMissingNativePrebuilds");
+    var CLOSURE_PATCH_PAYLOAD = [
+      "node_modules",
+      "@camstack",
+      "server",
+      "dist",
+      "closure-patches"
+    ];
+    var CLOSURE_PATCH_MANIFEST = "patch-reach.json";
+    function fileContains(file, marker) {
+      try {
+        return fs3.readFileSync(file, "utf-8").includes(marker);
+      } catch {
+        return false;
+      }
+    }
+    __name(fileContains, "fileContains");
+    function findUnappliedClosurePatches(closureDir) {
+      const payloadDir = path3.join(closureDir, ...CLOSURE_PATCH_PAYLOAD);
+      let manifest;
+      try {
+        const raw = JSON.parse(fs3.readFileSync(path3.join(payloadDir, CLOSURE_PATCH_MANIFEST), "utf-8"));
+        if (typeof raw !== "object" || raw === null) return [];
+        manifest = raw;
+      } catch {
+        return [];
+      }
+      if (!Array.isArray(manifest.patches)) return [];
+      const nm = path3.join(closureDir, "node_modules");
+      const missing = [];
+      for (const raw of manifest.patches) {
+        if (raw.reach !== "closure-postinstall") continue;
+        const pkg = raw.package;
+        const markers = raw.markers;
+        if (typeof pkg !== "string" || typeof markers !== "object" || markers === null) continue;
+        const pkgDir = path3.join(nm, pkg);
+        if (!fs3.existsSync(pkgDir)) {
+          continue;
+        }
+        for (const [rel, list] of Object.entries(markers)) {
+          if (!Array.isArray(list)) continue;
+          const target = path3.join(pkgDir, ...rel.split("/"));
+          for (const marker of list) {
+            if (typeof marker !== "string") continue;
+            if (!fileContains(target, marker)) {
+              missing.push(`${pkg}/${rel}: ${marker}`);
+            }
+          }
+        }
+      }
+      return missing;
+    }
+    __name(findUnappliedClosurePatches, "findUnappliedClosurePatches");
     function rmrf(target) {
       try {
         fs3.rmSync(target, {
@@ -1441,6 +1494,10 @@ var require_dist = __commonJS({
           if (missingNatives.length > 0) {
             throw new Error(`staged closure missing native prebuilds: ${missingNatives.join(", ")} \u2014 refusing to arm a swap that would break the forked runners`);
           }
+          const unpatched = findUnappliedClosurePatches(stagingDir);
+          if (unpatched.length > 0) {
+            throw new Error(`staged closure did not apply its shipped patches: ${unpatched.join(", ")} \u2014 refusing to arm a swap into an unpatched closure`);
+          }
           return stagingDir;
         } catch (err) {
           await fs6.promises.rm(stagingDir, {

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.274",
+  "version": "1.2.276",
   "private": false,
   "files": [
     "dist",
+    "scripts/closure-postinstall.mjs",
     ".env.example"
   ],
   "exports": {
@@ -13,7 +14,8 @@
     "./starter.js": "./dist/starter.js"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && tsup",
+    "build": "tsc -p tsconfig.build.json && tsup && node scripts/copy-closure-patches.mjs",
+    "postinstall": "node scripts/closure-postinstall.mjs",
     "dev": "npx concurrently -n server,ui -c blue,magenta \"CAMSTACK_RESTART_TOUCH_FILE=src/launcher.ts tsx watch --env-file=.env --ignore=./camstack-data --ignore=../../packages/core/dist --ignore=../../packages/sdk/dist --ignore=../../packages/ui-library/dist --ignore=../../packages/shm-ring/dist src/launcher.ts\" \"cd ../../packages/addon-admin-ui && npx vite --port 3001\"",
     "serve": "CAMSTACK_RESTART_TOUCH_FILE=src/launcher.ts tsx watch --env-file=.env --ignore=./camstack-data --ignore=../../packages/core/dist --ignore=../../packages/sdk/dist --ignore=../../packages/ui-library/dist --ignore=../../packages/shm-ring/dist src/launcher.ts",
     "serve:once": "tsx --env-file=.env src/launcher.ts",

package/scripts/closure-postinstall.mjs

@@ -0,0 +1,274 @@
+#!/usr/bin/env node
+/**
+ * `@camstack/server`'s `postinstall` — apply the `closure-postinstall` patches
+ * to the framework closure this package was just installed into. (D478)
+ *
+ * ## Why a lifecycle script and not a bundler
+ *
+ * A patch under `patches/` reaches production only if the patched package is
+ * BUNDLED at build time. `moleculer` is (into `@camstack/system/dist`), so its
+ * patch travels inside a published tarball and needs nothing here. `werift` is
+ * not, on purpose: three addons resolve it at runtime from the closure so the
+ * installer's dedupe (D343) links them all at ONE 5.3 MB copy, and that copy
+ * arrives from npm unpatched. Production ran it unpatched from the day the
+ * patch was written until 2026-09-12.
+ *
+ * The closure is an `npm install` into a staging dir and it passes no
+ * `--ignore-scripts`, so this package's own `postinstall` is the one place that
+ * (a) runs inside the closure, (b) runs with the NEW release's patch files,
+ * and (c) needs no new dependency, no diff library and no change to the update
+ * service. Every node gets it identically — hub, Docker agent, Electron agent
+ * — because all three stage the closure through the same `RootUpdateService`.
+ *
+ * ## Failure policy, deliberately split in two
+ *
+ * This script is BEST-EFFORT: it exits 0 on anything it cannot do, including a
+ * missing patch payload (the workspace dev tree, where `patch-package` already
+ * did the work and `dist/` may not exist yet) and an `ignore-scripts` npmrc it
+ * cannot see from inside. It must never be the reason an install fails, and it
+ * must never leave a package half-patched — every hunk is applied to an
+ * in-memory copy and the file is written once, or not at all.
+ *
+ * The FAIL-CLOSED half lives elsewhere, in `@camstack/node-root`'s
+ * `findUnappliedClosurePatches`, which refuses to swap into a closure whose
+ * markers are absent. Silence here is therefore never silence overall: either
+ * the patch landed, or the update visibly does not apply. A best-effort applier
+ * plus a fail-closed validator is the only arrangement where a skipped patch
+ * cannot look like a working one.
+ *
+ * ## Idempotence
+ *
+ * npm may run this more than once, and the repo root's `patch-package` already
+ * applies the same patches to the dev tree. Every hunk therefore recognises its
+ * own output: `before` present exactly once ⇒ apply; `before` absent and
+ * `after` present exactly once ⇒ already applied, skip. Anything else refuses
+ * that FILE (never a partial write) and the validator turns it into a refused
+ * update.
+ */
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+
+/** Where the build step (`copy-closure-patches.mjs`) puts the shipped payload. */
+const PAYLOAD_DIRS = [
+  // `scripts/` and `dist/` are siblings inside the package in BOTH layouts —
+  // the published tarball and a workspace checkout with a built dist.
+  path.resolve(HERE, '..', 'dist', 'closure-patches'),
+]
+
+const log = (msg) => process.stdout.write(`[closure-patches] ${msg}\n`)
+
+function findPayloadDir() {
+  for (const dir of PAYLOAD_DIRS) {
+    if (fs.existsSync(path.join(dir, 'patch-reach.json'))) return dir
+  }
+  return null
+}
+
+/**
+ * The `node_modules` the closure hoisted `werift` into. This script runs from
+ * `<closure>/node_modules/@camstack/server/scripts`, so the closure's own
+ * `node_modules` is three levels up — and a nested one (npm chose not to hoist)
+ * is checked first, because that is the copy this package would resolve.
+ */
+function moduleRootsFor(pkg) {
+  const own = path.resolve(HERE, '..', 'node_modules')
+  const closure = path.resolve(HERE, '..', '..', '..')
+  // `closure` is only a module root in the PUBLISHED layout
+  // (`<closure>/node_modules/@camstack/server/scripts` → `<closure>/node_modules`).
+  // From a workspace checkout the same walk lands on the repo root, which is
+  // not one — the basename check is what keeps this script inert in the dev
+  // tree instead of hunting for `<repo>/werift`.
+  const roots = [own, ...(path.basename(closure) === 'node_modules' ? [closure] : [])]
+  return roots.filter((root) => {
+    try {
+      return fs.statSync(path.join(root, pkg)).isDirectory()
+    } catch {
+      return false
+    }
+  })
+}
+
+/**
+ * Parse a `patch-package` unified diff into `{ file, before, after }` hunks.
+ *
+ * Line NUMBERS are ignored on purpose. A hunk is identified by its content —
+ * context plus removed lines — and applied only when that text occurs exactly
+ * once in the file. That is stricter than a positional apply (a hunk whose
+ * context appears twice refuses rather than guessing) and it survives an
+ * upstream file that shifted by a line, which a positional apply would not.
+ */
+function parsePatch(text, pkg) {
+  const hunks = []
+  let file = null
+  let before = null
+  let after = null
+  const flush = () => {
+    if (file !== null && before !== null && before.length > 0) {
+      hunks.push({ file, before: before.join('\n'), after: after.join('\n') })
+    }
+    before = null
+    after = null
+  }
+  const prefix = `node_modules/${pkg}/`
+  // A patch file ends with a newline, so `split` yields one trailing '' that is
+  // NOT a blank context line. Dropping it matters: the branch below treats a
+  // bare empty line as context (git can emit a blank context line with its
+  // leading space stripped), and letting the file's own terminator through
+  // would append a phantom newline requirement to the last hunk.
+  const lines = text.split('\n')
+  if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop()
+  for (const raw of lines) {
+    if (raw.startsWith('diff --git ')) {
+      flush()
+      file = null
+      continue
+    }
+    if (raw.startsWith('+++ ')) {
+      const spec = raw.slice(4).trim().replace(/^b\//, '')
+      file = spec.startsWith(prefix) ? spec.slice(prefix.length) : null
+      continue
+    }
+    if (raw.startsWith('@@')) {
+      flush()
+      before = []
+      after = []
+      continue
+    }
+    if (before === null || after === null) continue
+    if (raw.startsWith('+')) {
+      after.push(raw.slice(1))
+    } else if (raw.startsWith('-')) {
+      before.push(raw.slice(1))
+    } else if (raw.startsWith(' ')) {
+      before.push(raw.slice(1))
+      after.push(raw.slice(1))
+    } else if (raw === '') {
+      // A context line for a blank source line — patch-package emits it bare.
+      before.push('')
+      after.push('')
+    } else {
+      // `` and anything else: not content.
+      continue
+    }
+  }
+  flush()
+  return hunks
+}
+
+function countOf(haystack, needle) {
+  if (needle.length === 0) return 0
+  let n = 0
+  let at = haystack.indexOf(needle)
+  while (at !== -1) {
+    n += 1
+    at = haystack.indexOf(needle, at + needle.length)
+  }
+  return n
+}
+
+/** Apply every hunk for one file, in memory. Returns the new text, or null. */
+function applyHunks(original, hunks) {
+  let text = original
+  let changed = false
+  for (const hunk of hunks) {
+    const hits = countOf(text, hunk.before)
+    if (hits === 1) {
+      text = text.replace(hunk.before, hunk.after)
+      changed = true
+      continue
+    }
+    if (hits === 0 && countOf(text, hunk.after) >= 1) continue // already applied
+    return { error: `hunk matched ${hits} times (expected 1) and its result is absent` }
+  }
+  return { text, changed }
+}
+
+function applyPatchFile(payloadDir, entry) {
+  const patchPath = path.join(payloadDir, entry.patch)
+  let diff
+  try {
+    diff = fs.readFileSync(patchPath, 'utf-8')
+  } catch {
+    log(`SKIP ${entry.patch} — payload missing`)
+    return
+  }
+  const roots = moduleRootsFor(entry.package)
+  if (roots.length === 0) {
+    log(`SKIP ${entry.package} — not installed in this closure`)
+    return
+  }
+  const hunks = parsePatch(diff, entry.package)
+  const byFile = new Map()
+  for (const hunk of hunks) {
+    if (hunk.file === null) continue
+    const list = byFile.get(hunk.file) ?? []
+    list.push(hunk)
+    byFile.set(hunk.file, list)
+  }
+  for (const root of roots) {
+    const pkgDir = path.join(root, entry.package)
+    let installed = null
+    try {
+      installed = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf-8')).version
+    } catch {
+      /* unreadable — reported below */
+    }
+    if (installed !== entry.version) {
+      // Never patch a version the diff was not taken from. The validator turns
+      // this into a refused update rather than a silently-unpatched closure.
+      log(`REFUSE ${entry.package}@${String(installed)} in ${root} — patch is for ${entry.version}`)
+      continue
+    }
+    for (const [rel, fileHunks] of byFile) {
+      const target = path.join(pkgDir, rel)
+      let original
+      try {
+        original = fs.readFileSync(target, 'utf-8')
+      } catch {
+        log(`REFUSE ${entry.package} ${rel} — file absent`)
+        continue
+      }
+      const result = applyHunks(original, fileHunks)
+      if (result.error !== undefined) {
+        log(`REFUSE ${entry.package} ${rel} — ${result.error}`)
+        continue
+      }
+      if (!result.changed) {
+        log(`OK ${entry.package} ${rel} — already applied`)
+        continue
+      }
+      fs.writeFileSync(target, result.text)
+      log(`APPLIED ${entry.package}@${entry.version} ${rel} (${fileHunks.length} hunks)`)
+    }
+  }
+}
+
+function main() {
+  const payloadDir = findPayloadDir()
+  if (payloadDir === null) {
+    // The workspace dev tree: `patch-package` at the repo root owns this, and
+    // `dist/` may not be built yet. Not an error.
+    return
+  }
+  let manifest
+  try {
+    manifest = JSON.parse(fs.readFileSync(path.join(payloadDir, 'patch-reach.json'), 'utf-8'))
+  } catch (err) {
+    log(`SKIP — manifest unreadable: ${err instanceof Error ? err.message : String(err)}`)
+    return
+  }
+  const entries = Array.isArray(manifest.patches) ? manifest.patches : []
+  for (const entry of entries) {
+    if (entry?.reach !== 'closure-postinstall') continue
+    try {
+      applyPatchFile(payloadDir, entry)
+    } catch (err) {
+      log(`SKIP ${entry.patch} — ${err instanceof Error ? err.message : String(err)}`)
+    }
+  }
+}
+
+main()