@camstack/server 1.2.594 → 1.2.596

package/dist/agent/agent-update-service.js

@@ -1,3 +1,43 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentUpdateService = exports.AgentRestartAnnouncer = exports.AGENT_RESTART_GRACE_MS = exports.AGENT_RUNTIME_ADDON_ID = void 0;
+exports.isRunningInContainer = isRunningInContainer;
+exports.resolveAgentPackageJsonPath = resolveAgentPackageJsonPath;
+exports.scheduleAgentRestart = scheduleAgentRestart;
+exports.agentRuntimeManifestEntry = agentRuntimeManifestEntry;
 /**
  * AgentUpdateService — agent-side adapter over the SHARED `RootUpdateService`
  * (`@camstack/node-root`, bundled into the `@camstack/server` dist by tsup).
@@ -20,33 +60,33 @@
  *
  * Spec: docs/superpowers/specs/2026-07-18-single-framework-copy-collapse-design.md
  */
-import { randomUUID } from 'node:crypto';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { readPendingRestart, writePendingRestart } from '@camstack/system';
-import { EventCategory } from '@camstack/types';
-import { buildSystemEnsureNativePrebuilds, } from '../core/server-update/system-ensure-prebuilds.js';
-import { buildSystemApplyClosurePatches, } from '../core/server-update/system-apply-closure-patches.js';
-import { buildSystemExecNpm } from '../core/server-update/system-exec-npm.js';
-import { UpdateAvailabilityEmitter } from '../core/update-availability-emitter.js';
-import { FileUpdateAvailabilityStore } from '../core/update-availability-store.js';
-import { HUB_ROOT_SPEC, RootUpdateService, serverRootDir, writeRestartIntentMarker, } from '../server-root/index.js';
-import { buildRestartMarker } from '../core/updates/restart-marker.js';
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const system_ensure_prebuilds_js_1 = require("../core/server-update/system-ensure-prebuilds.js");
+const system_apply_closure_patches_js_1 = require("../core/server-update/system-apply-closure-patches.js");
+const system_exec_npm_js_1 = require("../core/server-update/system-exec-npm.js");
+const update_availability_emitter_js_1 = require("../core/update-availability-emitter.js");
+const update_availability_store_js_1 = require("../core/update-availability-store.js");
+const index_js_1 = require("../server-root/index.js");
+const restart_marker_js_1 = require("../core/updates/restart-marker.js");
 /**
  * The synthetic addonId the agent's OWN runtime registers infra providers
  * under (no addon owns them — the bootstrap does). Appears in the agent's
  * `$hub.registerNode` manifest so the hub's cap routing can reach the
  * agent-hosted `server-management` provider via `nodeId` pinning.
  */
-export const AGENT_RUNTIME_ADDON_ID = 'agent-runtime';
+exports.AGENT_RUNTIME_ADDON_ID = 'agent-runtime';
 /** Grace before the self-SIGTERM so the tRPC reply can flush to the hub. */
-export const AGENT_RESTART_GRACE_MS = 2_000;
+exports.AGENT_RESTART_GRACE_MS = 2_000;
 /**
  * Best-effort container detection for the restart-policy startup warning
  * (security review #3). `/.dockerenv` is present in Docker/Podman containers;
  * this is diagnostic only — never gates any logic.
  */
-export function isRunningInContainer(existsSyncFn) {
+function isRunningInContainer(existsSyncFn) {
     return existsSyncFn('/.dockerenv');
 }
 /**
@@ -55,7 +95,7 @@ export function isRunningInContainer(existsSyncFn) {
  * `<pkg>/dist/*.js`, so `../package.json` is the normal hit; the second
  * candidate covers a nested layout.
  */
-export function resolveAgentPackageJsonPath(fromDir) {
+function resolveAgentPackageJsonPath(fromDir) {
     const candidates = [
         path.resolve(fromDir, '..', 'package.json'),
         path.resolve(fromDir, '..', '..', 'package.json'),
@@ -63,7 +103,7 @@ export function resolveAgentPackageJsonPath(fromDir) {
     for (const candidate of candidates) {
         try {
             const raw = JSON.parse(fs.readFileSync(candidate, 'utf-8'));
-            if (raw.name === HUB_ROOT_SPEC.packageName)
+            if (raw.name === index_js_1.HUB_ROOT_SPEC.packageName)
                 return candidate;
         }
         catch {
@@ -85,10 +125,10 @@ export function resolveAgentPackageJsonPath(fromDir) {
  * marker (it relaunches regardless), so this is a no-op there. Best-effort: a
  * marker-write failure must never block the restart.
  */
-export function scheduleAgentRestart(logger, requestedBy, dataDir) {
+function scheduleAgentRestart(logger, requestedBy, dataDir) {
     if (dataDir !== undefined && dataDir.length > 0) {
         try {
-            writeRestartIntentMarker(serverRootDir(dataDir), {
+            (0, index_js_1.writeRestartIntentMarker)((0, index_js_1.serverRootDir)(dataDir), {
                 requestedAtMs: Date.now(),
                 reason: requestedBy,
             });
@@ -100,13 +140,13 @@ export function scheduleAgentRestart(logger, requestedBy, dataDir) {
         }
     }
     logger.warn('agent restart requested — exiting for supervisor relaunch', {
-        meta: { requestedBy, graceMs: AGENT_RESTART_GRACE_MS },
+        meta: { requestedBy, graceMs: exports.AGENT_RESTART_GRACE_MS },
     });
     const grace = setTimeout(() => {
         process.kill(process.pid, 'SIGTERM');
         const hard = setTimeout(() => process.exit(0), 15_000);
         hard.unref();
-    }, AGENT_RESTART_GRACE_MS);
+    }, exports.AGENT_RESTART_GRACE_MS);
     grace.unref();
 }
 /**
@@ -121,7 +161,7 @@ export function scheduleAgentRestart(logger, requestedBy, dataDir) {
  * once the mesh is up). A restart before that has nobody to tell — said, never
  * silent.
  */
-export class AgentRestartAnnouncer {
+class AgentRestartAnnouncer {
     logger;
     eventBus;
     nodeId;
@@ -145,10 +185,10 @@ export class AgentRestartAnnouncer {
         const payload = { ...marker, nodeId: this.nodeId };
         try {
             bus.emit({
-                id: randomUUID(),
+                id: (0, node_crypto_1.randomUUID)(),
                 timestamp: new Date(),
                 source: { type: 'core', id: 'agent-update-service' },
-                category: EventCategory.SystemRestarting,
+                category: types_1.EventCategory.SystemRestarting,
                 data: payload,
             });
         }
@@ -161,7 +201,8 @@ export class AgentRestartAnnouncer {
         }
     }
 }
-export class AgentUpdateService extends RootUpdateService {
+exports.AgentRestartAnnouncer = AgentRestartAnnouncer;
+class AgentUpdateService extends index_js_1.RootUpdateService {
     restartAnnouncer;
     updateAvailability;
     eventBus;
@@ -179,7 +220,7 @@ export class AgentUpdateService extends RootUpdateService {
         const nodeId = options.nodeId ?? process.env['CAMSTACK_NODE_ID'] ?? 'agent';
         const restartAnnouncer = new AgentRestartAnnouncer(options.logger, options.eventBus ?? null, nodeId);
         super({
-            spec: HUB_ROOT_SPEC,
+            spec: index_js_1.HUB_ROOT_SPEC,
             nodeId,
             // The agent's on-disk root IS `@camstack/server` (booted via
             // CAMSTACK_ROLE=agent by the shared starter), so it reads the SAME
@@ -202,19 +243,19 @@ export class AgentUpdateService extends RootUpdateService {
             // bare Node with no system npm, so the raw `execFile('npm')` default would
             // ENOENT. `cacheDir` mirrors AddonInstaller's `<dataDir>/addons/.npm-bootstrap`.
             execNpm: options.execNpm ??
-                buildSystemExecNpm({
+                (0, system_exec_npm_js_1.buildSystemExecNpm)({
                     cacheDir: path.join(options.dataDir, 'addons', '.npm-bootstrap'),
                     logger: options.logger,
                 }),
             // Same native-prebuild ensure step as the hub — a packaged desktop AGENT
             // ships the identical bare Node, so its `applyServerUpdate` staging would
             // hit the same source-only `better-sqlite3` miss without this.
-            ensureNativePrebuilds: options.ensureNativePrebuilds ?? buildSystemEnsureNativePrebuilds(options.logger),
+            ensureNativePrebuilds: options.ensureNativePrebuilds ?? (0, system_ensure_prebuilds_js_1.buildSystemEnsureNativePrebuilds)(options.logger),
             // Apply the closure patches ourselves. npm 12 blocks the root package's
             // postinstall by default, and a silently-unpatched closure is refused by
             // the validator — an update that can never apply. Idempotent, so this
             // costs nothing where npm did run the lifecycle.
-            applyClosurePatches: options.applyClosurePatches ?? buildSystemApplyClosurePatches(options.logger),
+            applyClosurePatches: options.applyClosurePatches ?? (0, system_apply_closure_patches_js_1.buildSystemApplyClosurePatches)(options.logger),
             env: options.env,
             now: options.now,
             ...(options.runnerBootCheck !== undefined
@@ -228,7 +269,7 @@ export class AgentUpdateService extends RootUpdateService {
         this.eventBus = options.eventBus ?? null;
         this.updateAvailability =
             options.eventBus !== undefined
-                ? new UpdateAvailabilityEmitter(options.eventBus, { type: 'core', id: 'agent-update-service' }, options.updateAvailabilityStore)
+                ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, { type: 'core', id: 'agent-update-service' }, options.updateAvailabilityStore)
                 : null;
     }
     /**
@@ -240,7 +281,7 @@ export class AgentUpdateService extends RootUpdateService {
         this.eventBus = eventBus;
         this.nodeId = nodeId;
         this.restartAnnouncer.bind(eventBus, nodeId);
-        this.updateAvailability = new UpdateAvailabilityEmitter(eventBus, { type: 'core', id: 'agent-update-service' }, new FileUpdateAvailabilityStore(this.agentDataDir, 'agent-update', this.agentLogger));
+        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(eventBus, { type: 'core', id: 'agent-update-service' }, new update_availability_store_js_1.FileUpdateAvailabilityStore(this.agentDataDir, 'agent-update', this.agentLogger));
     }
     async checkServerUpdate() {
         const result = await super.checkServerUpdate();
@@ -264,7 +305,7 @@ export class AgentUpdateService extends RootUpdateService {
         const bus = this.eventBus;
         if (bus === null)
             return;
-        const marker = readPendingRestart(this.agentDataDir);
+        const marker = (0, system_1.readPendingRestart)(this.agentDataDir);
         if (marker === null)
             return;
         const payload = {
@@ -277,25 +318,26 @@ export class AgentUpdateService extends RootUpdateService {
             ...(marker.requestedBy !== undefined ? { requestedBy: marker.requestedBy } : {}),
         };
         bus.emit({
-            id: randomUUID(),
+            id: (0, node_crypto_1.randomUUID)(),
             timestamp: new Date(),
             source: { type: 'core', id: 'agent-update-service' },
-            category: EventCategory.SystemRestartCompleted,
+            category: types_1.EventCategory.SystemRestartCompleted,
             data: payload,
         });
     }
 }
+exports.AgentUpdateService = AgentUpdateService;
 /** Write the marker and return it — the same payload is the announcement (D723). */
 function writeAgentRestartMarker(dataDir, requestedBy, update) {
     // Same builder as the hub: an agent's "Server aggiornato" notification must
     // name both versions too — see `core/updates/restart-marker.ts`.
-    const marker = buildRestartMarker({
+    const marker = (0, restart_marker_js_1.buildRestartMarker)({
         requestedAt: Date.now(),
         requestedBy,
         ...(update !== undefined ? { update } : {}),
     });
     try {
-        writePendingRestart(dataDir, marker);
+        (0, system_1.writePendingRestart)(dataDir, marker);
     }
     catch {
         // Marker write must never block the restart.
@@ -308,9 +350,9 @@ function writeAgentRestartMarker(dataDir, requestedBy, update) {
  * `HubNodeRegistry` (and therefore `createCapabilityProxy` node routing) even
  * though no `loadedAddons` entry owns it.
  */
-export function agentRuntimeManifestEntry() {
+function agentRuntimeManifestEntry() {
     return {
-        addonId: AGENT_RUNTIME_ADDON_ID,
+        addonId: exports.AGENT_RUNTIME_ADDON_ID,
         capabilities: ['server-management', 'node-certificates'],
     };
 }

package/dist/agent/apply-model-distribution.js

@@ -1,9 +1,12 @@
+"use strict";
 /**
  * Agent-side model distribution (P2): pull a staged model tarball from the hub
  * and untar it into this node's modelsDir. Factored behind a seam so the
  * fetch/extract/fs effects are injectable in tests.
  */
-export async function applyModelDistribution(seam, params) {
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyModelDistribution = applyModelDistribution;
+async function applyModelDistribution(seam, params) {
     seam.mkdirp(seam.modelsDir);
     const buffer = await seam.fetchBundle(params.source);
     await seam.extract(buffer, seam.modelsDir);

package/dist/agent/apply-stage-dev-uploads.js

@@ -1,18 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyStageDevUploads = applyStageDevUploads;
 /**
  * Pure seam for `$agent.stageDevUploads` — fetch a hub-staged pack of
  * `dev-uploads/<version>/` and write it under this node's server-root.
  */
-import { createHash } from 'node:crypto';
-import { isDevChannelVersion, serverRootDir } from '../server-root/index.js';
-export async function applyStageDevUploads(seam, params) {
+const node_crypto_1 = require("node:crypto");
+const index_js_1 = require("../server-root/index.js");
+async function applyStageDevUploads(seam, params) {
     const { version, source } = params;
-    if (!isDevChannelVersion(version)) {
+    if (!(0, index_js_1.isDevChannelVersion)(version)) {
         throw new Error(`$agent.stageDevUploads: version "${version}" is not dev-channel shaped`);
     }
     const bundle = await seam.fetchBundle(source);
-    const appliedSha256 = createHash('sha256').update(bundle).digest('hex');
+    const appliedSha256 = (0, node_crypto_1.createHash)('sha256').update(bundle).digest('hex');
     const unpacked = await seam.unpack({
-        serverRoot: serverRootDir(seam.dataDir),
+        serverRoot: (0, index_js_1.serverRootDir)(seam.dataDir),
         version,
         bundle,
     });

package/dist/agent/derive-hub-url.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Derive the agent's `CAMSTACK_HUB_URL` from its friendly `hubAddress`.
  *
@@ -23,8 +24,12 @@
  * Because every current consumer keeps only the host, the port is convention;
  * a future full-URL consumer must treat it as the default, not authoritative.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveHubUrlFromHubAddress = deriveHubUrlFromHubAddress;
+exports.deriveHubUrlForExport = deriveHubUrlForExport;
+exports.pickIpv4 = pickIpv4;
 const HUB_API_PORT = 4443;
-export function deriveHubUrlFromHubAddress(hubAddress) {
+function deriveHubUrlFromHubAddress(hubAddress) {
     const trimmed = hubAddress.trim();
     if (trimmed.length === 0)
         return undefined;
@@ -44,7 +49,7 @@ export function deriveHubUrlFromHubAddress(hubAddress) {
  * today's working deployments. Kept pure (env is passed in) so both the
  * boot-time derivation and the reconnect path can be unit-tested.
  */
-export function deriveHubUrlForExport(hubUrlWasExplicit, hubAddress) {
+function deriveHubUrlForExport(hubUrlWasExplicit, hubAddress) {
     if (hubUrlWasExplicit)
         return undefined;
     if (hubAddress === undefined)
@@ -70,7 +75,7 @@ function extractHostFromAuthority(authority) {
  * Canonical home of this helper — `resolveHubEndpoint` in `agent-http.ts`
  * (UI-facing `resolvedHubAddress`) re-exports and reuses it.
  */
-export function pickIpv4(ipList) {
+function pickIpv4(ipList) {
     if (!ipList)
         return null;
     for (const ip of ipList) {

package/dist/agent/fetch-bundle-from-hub.js

@@ -1,10 +1,13 @@
-import { createHash } from 'node:crypto';
-import { Agent, fetch as undicicFetch } from 'undici';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchBundleFromHub = fetchBundleFromHub;
+const node_crypto_1 = require("node:crypto");
+const undici_1 = require("undici");
 /**
  * Stream a staged addon tgz from the hub's one-time-token bundle route and
  * verify integrity (byte count + sha256) before handing it to the installer.
  */
-export async function fetchBundleFromHub(opts) {
+async function fetchBundleFromHub(opts) {
     // When a fetchImpl is injected (tests), call it as-is — the stub ignores dispatcher.
     // For production (global fetch against the real hub's self-signed TLS cert), use
     // undici.fetch with an Agent that disables CA verification. The hub serves HTTPS with a
@@ -24,9 +27,9 @@ export async function fetchBundleFromHub(opts) {
     const authHeader = { Authorization: `Bearer ${opts.token}`, 'accept-encoding': 'identity' };
     const res = opts.fetchImpl
         ? await opts.fetchImpl(opts.url, { headers: authHeader })
-        : await undicicFetch(opts.url, {
+        : await (0, undici_1.fetch)(opts.url, {
             headers: authHeader,
-            dispatcher: new Agent({ connect: { rejectUnauthorized: false } }),
+            dispatcher: new undici_1.Agent({ connect: { rejectUnauthorized: false } }),
         });
     if (!res.ok) {
         throw new Error(`bundle fetch failed: HTTP ${res.status}`);
@@ -35,7 +38,7 @@ export async function fetchBundleFromHub(opts) {
     if (buffer.length !== opts.bytes) {
         throw new Error(`bundle bytes mismatch: expected ${opts.bytes}, got ${buffer.length}`);
     }
-    const sha = createHash('sha256').update(buffer).digest('hex');
+    const sha = (0, node_crypto_1.createHash)('sha256').update(buffer).digest('hex');
     if (sha !== opts.sha256) {
         throw new Error(`bundle sha256 mismatch: expected ${opts.sha256}, got ${sha}`);
     }

package/dist/agent/hubs-found.js

@@ -1,6 +1,43 @@
-import { deriveHubUrlFromHubAddress } from './derive-hub-url.js';
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIGURED_HUB_SOURCE = void 0;
+exports.createHubsFinder = createHubsFinder;
+const derive_hub_url_js_1 = require("./derive-hub-url.js");
 /** Label of the configured hub in {@link FoundHub.sources}. */
-export const CONFIGURED_HUB_SOURCE = 'configured hub address';
+exports.CONFIGURED_HUB_SOURCE = 'configured hub address';
 /** A scan newer than this answers a refresh without scanning again. */
 const MIN_RESCAN_INTERVAL_MS = 5_000;
 const BROWSE_TIMEOUT_MS = 3_000;
@@ -15,10 +52,10 @@ function toFoundHub(candidate) {
 }
 async function defaultDiscover(deps) {
     // Lazy: the socket library is only loaded when an operator asks.
-    const { discoverHubs } = await import('@camstack/develop/hub-discovery');
+    const { discoverHubs } = await Promise.resolve().then(() => __importStar(require('@camstack/develop/hub-discovery')));
     return discoverHubs(deps);
 }
-export function createHubsFinder(deps) {
+function createHubsFinder(deps) {
     const discover = deps.discover ?? defaultDiscover;
     const now = deps.now ?? Date.now;
     let hubs = [];
@@ -27,13 +64,13 @@ export function createHubsFinder(deps) {
     const snapshot = () => ({ hubs, scannedAt, scanning: inFlight !== null });
     const scan = async () => {
         const configured = deps.getConfiguredHubAddress();
-        const configuredUrl = configured === null ? undefined : deriveHubUrlFromHubAddress(configured);
+        const configuredUrl = configured === null ? undefined : (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(configured);
         try {
             const found = await discover({
                 mdnsTimeoutMs: BROWSE_TIMEOUT_MS,
                 known: configuredUrl === undefined
                     ? []
-                    : [{ url: configuredUrl, source: CONFIGURED_HUB_SOURCE }],
+                    : [{ url: configuredUrl, source: exports.CONFIGURED_HUB_SOURCE }],
                 onProblem: (message) => deps.log?.(`hub browse problem: ${message}`),
             });
             hubs = found.map(toFoundHub);

package/dist/agent/infra-boot-guard.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * infra-boot-guard.ts — the agent's "did my infrastructure actually load?" gate.
  *
@@ -32,6 +33,8 @@
  * first — an operator staring at a crash-loop needs the whole list, and the
  * four that vanished together on little-unraid vanished for one single reason.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertRequiredInfraResolved = assertRequiredInfraResolved;
 /**
  * Throw when any `required` infra capability resolved to no addon at all.
  *
@@ -40,7 +43,7 @@
  * `metrics-provider`, `log-destination`) are the caller's business — they are
  * already logged individually and are legitimately absent on some nodes.
  */
-export function assertRequiredInfraResolved(resolutions, addonsDir) {
+function assertRequiredInfraResolved(resolutions, addonsDir) {
     const missing = resolutions.filter((r) => r.required && r.addonId === null).map((r) => r.name);
     if (missing.length === 0)
         return;

package/dist/agent/infra-boot-plan.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planInfraBoot = planInfraBoot;
+exports.planToResolutions = planToResolutions;
 /**
  * `log-destination` prefers `hub-forwarder` (ships agent logs to the hub)
  * over a local winston — mirrors the historical inline choice.
@@ -8,7 +12,7 @@ function pickCandidate(capName, candidates) {
     }
     return candidates[0];
 }
-export function planInfraBoot(addons, infraList) {
+function planInfraBoot(addons, infraList) {
     const initialized = new Set();
     const steps = [];
     for (const infra of infraList) {
@@ -36,6 +40,6 @@ export function planInfraBoot(addons, infraList) {
     return steps;
 }
 /** Project a plan onto the guard's resolution shape. */
-export function planToResolutions(steps) {
+function planToResolutions(steps) {
     return steps.map((s) => ({ name: s.capName, required: s.required, addonId: s.addonId }));
 }