@camstack/server 1.2.594 → 1.2.596

package/dist/agent/main.js

@@ -1,43 +1,79 @@
-import * as fs from 'node:fs';
-import { RunnerBootCheckService, } from '../core/runner-health/runner-boot-check.js';
-import * as path from 'node:path';
-import { AddonInstaller, AddonLoader, AGENT_READINESS_SERVICE_NAME, buildNodeManifest, CapabilityRegistry, createAddonContext, createAddonService, buildTransporter, connectBrokerTransport, createAgentTransport, createBroker, currentBrokerTransporter, disconnectBrokerTransport, installBrokerTransporter, isInstalledTransporter, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessServiceForRegistry, createUdsEventBridge, deriveAgentListenPort, detectWorkspacePackagesDir, getBrokerEventBus, getOrInitReadinessRegistry, HUB_CAP_FWD_ACTION, HubNodeRegistry, LocalChildRegistry, localEndpointPath, registerEventBusService, setNodeEventInterest, subscribePassthrough, udsChildLogToWorkerEntry, redactLogMeta, redactLogText, AgentMdnsAdvertiser, AgentPairing, createCiaoPublisher, TlsTcpTransporter, } from '@camstack/system';
-import { EventCategory } from '@camstack/types';
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startAgent = startAgent;
+const fs = __importStar(require("node:fs"));
+const runner_boot_check_js_1 = require("../core/runner-health/runner-boot-check.js");
+const path = __importStar(require("node:path"));
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
 // Capability definitions — must be declared before addon registerProvider() calls
-import { ALL_CAPABILITY_DEFINITIONS, audioAnalyzerCapability, dataStoreProviderCapability, decoderCapability, errMsg, filesystemBrowseCapability, isDeployableToAgent, logDestinationCapability, metricsProviderCapability, motionDetectionCapability, nodeCertificatesCapability, normalizeAddonInitResult, pipelineExecutorCapability, pipelineRunnerCapability, platformProbeCapability, resolveAddonPlacement, resolveRunnerId, serverManagementCapability, settingsStoreCapability, storageCapability, storageProviderCapability, } from '@camstack/types';
-import { buildServerManagementProvider } from '../api/core/server-management.provider.js';
-import { resolveHubClosurePackageDir } from '../core/addon/package-dir-utils.js';
-import { runSingleCopyCleanup } from '../single-copy-cleanup-runner.js';
-import { BUILTINS_PACKAGE, planAgentAddonScan, resolveAddonPackageDirs } from './addon-scan.js';
-import { buildAgentAddonUpdateReport } from './agent-addon-updates.js';
-import { createAgentHubRegistration } from './agent-hub-registration.js';
-import { createAgentMeshGate } from './agent-mesh-gate.js';
-import { createLocalPairingAnnouncer } from './agent-pairing-local.js';
-import { forgetPairing, isAgentPaired, pairedLeafFingerprint, persistPairing, } from './agent-pairing-store.js';
-import { loadAgentConfig } from './agent-config.js';
-import { ensureGroupRunner, isGroupRunnerAddon, readPackageManifestAddons, registerGroupRunnerProviders, } from './agent-group-runner.js';
-import { startAgentHttpServer } from './agent-http.js';
-import { createAgentNodeCertificates } from './agent-node-certificates.js';
-import { createReconnectRunner } from './agent-reconnect.js';
-import { createSerialQueue } from './serial-queue.js';
-import { resolveAgentInfraCapabilities } from './agent-infra-capabilities.js';
-import { createAgentService } from './agent-service.js';
-import { createAgentHubAddonControls } from './agent-hub-addon-update.js';
-import { createAgentServerUpdateControls } from './agent-update-routes.js';
-import { AGENT_RUNTIME_ADDON_ID, AgentUpdateService, agentRuntimeManifestEntry, } from './agent-update-service.js';
-import { deriveHubUrlForExport } from './derive-hub-url.js';
-import { assertRequiredInfraResolved } from './infra-boot-guard.js';
-import { planInfraBoot, planToResolutions } from './infra-boot-plan.js';
-import { registerAgentCapDispatch } from './register-agent-cap-dispatch.js';
+const types_2 = require("@camstack/types");
+const server_management_provider_js_1 = require("../api/core/server-management.provider.js");
+const package_dir_utils_js_1 = require("../core/addon/package-dir-utils.js");
+const single_copy_cleanup_runner_js_1 = require("../single-copy-cleanup-runner.js");
+const addon_scan_js_1 = require("./addon-scan.js");
+const agent_addon_updates_js_1 = require("./agent-addon-updates.js");
+const agent_hub_registration_js_1 = require("./agent-hub-registration.js");
+const agent_mesh_gate_js_1 = require("./agent-mesh-gate.js");
+const agent_pairing_local_js_1 = require("./agent-pairing-local.js");
+const agent_pairing_store_js_1 = require("./agent-pairing-store.js");
+const agent_config_js_1 = require("./agent-config.js");
+const agent_group_runner_js_1 = require("./agent-group-runner.js");
+const agent_http_js_1 = require("./agent-http.js");
+const agent_node_certificates_js_1 = require("./agent-node-certificates.js");
+const agent_reconnect_js_1 = require("./agent-reconnect.js");
+const serial_queue_js_1 = require("./serial-queue.js");
+const agent_infra_capabilities_js_1 = require("./agent-infra-capabilities.js");
+const agent_service_js_1 = require("./agent-service.js");
+const agent_hub_addon_update_js_1 = require("./agent-hub-addon-update.js");
+const agent_update_routes_js_1 = require("./agent-update-routes.js");
+const agent_update_service_js_1 = require("./agent-update-service.js");
+const derive_hub_url_js_1 = require("./derive-hub-url.js");
+const infra_boot_guard_js_1 = require("./infra-boot-guard.js");
+const infra_boot_plan_js_1 = require("./infra-boot-plan.js");
+const register_agent_cap_dispatch_js_1 = require("./register-agent-cap-dispatch.js");
 // ---------------------------------------------------------------------------
 // Agent LogManager — shared log pipeline for all addon loggers.
 // The hub-forwarder addon registers as a destination, so all log
 // entries flow through it (console output + hub forwarding).
 // ---------------------------------------------------------------------------
-import { LogManager, systemHostFacts } from '@camstack/system';
+const system_2 = require("@camstack/system");
 /** A reconnect (stop + rebuild + start) that takes longer than this is abandoned. */
 const RECONNECT_DEADLINE_MS = 90_000;
-const agentLogManager = new LogManager(5000);
+const agentLogManager = new system_2.LogManager(5000);
 /**
  * Caps whose `nodeId` arg is provider DATA (`nodeIdMode: 'data'` —
  * `addon-settings`, `addons`, `nodes`, `pipeline-orchestrator`), never a
@@ -49,12 +85,12 @@ const agentLogManager = new LogManager(5000);
  * the hub singleton (which reads `nodeId` as data) instead of being pinned to
  * a node with no provider (dead broker fallback → ServiceNotFoundError).
  */
-const DATA_NODEID_CAPS = new Set(ALL_CAPABILITY_DEFINITIONS.filter((c) => c.nodeIdMode === 'data').map((c) => c.name));
+const DATA_NODEID_CAPS = new Set(types_2.ALL_CAPABILITY_DEFINITIONS.filter((c) => c.nodeIdMode === 'data').map((c) => c.name));
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 async function startAgent(configPath) {
-    const config = loadAgentConfig(configPath);
+    const config = (0, agent_config_js_1.loadAgentConfig)(configPath);
     // Derive CAMSTACK_HUB_URL from the configured hub address so remote agents
     // no longer need a second, redundant env var set by hand (the cross-node
     // source trap). An explicit operator value ALWAYS wins — capture whether it
@@ -63,7 +99,7 @@ async function startAgent(configPath) {
     // loadDeployedAddons below), and process-service spreads `process.env` into
     // child env, so pipeline-runner + recorder children inherit it for free.
     const hubUrlWasExplicit = process.env['CAMSTACK_HUB_URL'] !== undefined;
-    const derivedHubUrl = deriveHubUrlForExport(hubUrlWasExplicit, config.hubAddress);
+    const derivedHubUrl = (0, derive_hub_url_js_1.deriveHubUrlForExport)(hubUrlWasExplicit, config.hubAddress);
     if (derivedHubUrl !== undefined) {
         process.env['CAMSTACK_HUB_URL'] = derivedHubUrl;
         console.log(`[Agent] Derived CAMSTACK_HUB_URL=${derivedHubUrl} from hub address "${config.hubAddress}"`);
@@ -94,14 +130,14 @@ async function startAgent(configPath) {
         console.log(`[Agent] Using bundled addons from ${bundledDir}`);
     }
     else if (explicitSource === 'local') {
-        workspaceDir = detectWorkspacePackagesDir(config.dataDir);
+        workspaceDir = (0, system_1.detectWorkspacePackagesDir)(config.dataDir);
     }
-    const installer = new AddonInstaller({
+    const installer = new system_1.AddonInstaller({
         addonsDir: config.addonsDir,
         workspacePackagesDir: workspaceDir ?? undefined,
         installSource: resolvedSource,
     });
-    await installer.ensureRequiredPackages(AddonInstaller.AGENT_PACKAGES);
+    await installer.ensureRequiredPackages(system_1.AddonInstaller.AGENT_PACKAGES);
     // Restore repair, mirroring the hub launcher (D338): reinstall ONLY the
     // runtime deps that are neither present nor resolvable from the closure.
     if (typeof installer.ensureAddonRuntimeDeps === 'function') {
@@ -123,11 +159,11 @@ async function startAgent(configPath) {
     // D802, D857: the inbound mesh gate. Only the hub may call this agent, and the hub is
     // recognised by the certificate the agent's own TLS listener verified. The transport is
     // read at call time because a reconnect replaces it.
-    const meshGate = createAgentMeshGate({
+    const meshGate = (0, agent_mesh_gate_js_1.createAgentMeshGate)({
         nodeId: config.nodeId,
         isVerifiedPeer: (nodeId) => {
-            const tx = currentBrokerTransporter(broker).tx;
-            return tx instanceof TlsTcpTransporter && tx.verifiedPeer(nodeId) !== undefined;
+            const tx = (0, system_1.currentBrokerTransporter)(broker).tx;
+            return tx instanceof system_1.TlsTcpTransporter && tx.verifiedPeer(nodeId) !== undefined;
         },
         log: (msg) => console.log(`[Agent] ${msg}`),
     });
@@ -137,7 +173,7 @@ async function startAgent(configPath) {
     // The HTTP/HTTPS listener on the agent port (D856); set once it is up.
     let agentHttpListener = null;
     console.log(`[Agent] Mesh transport: ${currentMeshTls !== null ? 'tls (paired)' : 'none (unpaired)'}`);
-    const broker = createBroker({
+    const broker = (0, system_1.createBroker)({
         nodeID: config.nodeId,
         mode: 'agent',
         hubAddress: config.hubAddress,
@@ -155,7 +191,7 @@ async function startAgent(configPath) {
      */
     // ONE reconnect at a time (serial-queue.ts): the UI, a mesh leaf swap and its rollback can
     // all ask for one, and two interleaved disconnect/connect cycles would leave two wires or none.
-    const reconnect = createSerialQueue(() => reconnectNow(), {
+    const reconnect = (0, serial_queue_js_1.createSerialQueue)(() => reconnectNow(), {
         deadlineMs: RECONNECT_DEADLINE_MS,
         onTimeout: () => {
             // A transport whose connect never settles must not hold every later reconnect (including
@@ -164,26 +200,26 @@ async function startAgent(configPath) {
             consoleLogger.error('Reconnect did not finish in time - dropping the half-connected transport', {
                 meta: { deadlineMs: RECONNECT_DEADLINE_MS },
             });
-            void disconnectBrokerTransport(broker).catch(() => undefined);
+            void (0, system_1.disconnectBrokerTransport)(broker).catch(() => undefined);
         },
     });
     // The cycle itself runs through a generation guard: a run the queue abandoned at its deadline
     // that resumes later installs nothing (agent-reconnect.ts), so two transports never share a broker.
     let pendingConfig = null;
-    const reconnectNow = createReconnectRunner({
-        current: () => currentBrokerTransporter(broker),
-        assign: (next) => installBrokerTransporter(broker, next),
+    const reconnectNow = (0, agent_reconnect_js_1.createReconnectRunner)({
+        current: () => (0, system_1.currentBrokerTransporter)(broker),
+        assign: (next) => (0, system_1.installBrokerTransporter)(broker, next),
         stop: async (target) => {
             // Only the transport installed right now: a late, abandoned run must not tear down a
             // newer run's transport.
-            if (isInstalledTransporter(broker, target)) {
-                await disconnectBrokerTransport(broker);
+            if ((0, system_1.isInstalledTransporter)(broker, target)) {
+                await (0, system_1.disconnectBrokerTransport)(broker);
             }
         },
         prepare: () => {
             console.log('[Agent] Reconnecting with updated config...');
             // Reload config from file (pairing, the UI or a local call may have written it)
-            const fresh = loadAgentConfig(undefined, config.dataDir);
+            const fresh = (0, agent_config_js_1.loadAgentConfig)(undefined, config.dataDir);
             pendingConfig = fresh;
             console.log(`[Agent] New config: hub=${fresh.hubAddress ?? 'none'}, ` +
                 `mesh=${fresh.meshTls !== undefined ? 'tls (paired)' : 'none (unpaired)'}`);
@@ -193,7 +229,7 @@ async function startAgent(configPath) {
             // keep the env they inherited; picking up a changed hub address in live
             // children would need a runner respawn. Boot-time — the actual trap — is
             // fully covered.
-            const freshHubUrl = deriveHubUrlForExport(hubUrlWasExplicit, fresh.hubAddress);
+            const freshHubUrl = (0, derive_hub_url_js_1.deriveHubUrlForExport)(hubUrlWasExplicit, fresh.hubAddress);
             if (freshHubUrl !== undefined && process.env['CAMSTACK_HUB_URL'] !== freshHubUrl) {
                 process.env['CAMSTACK_HUB_URL'] = freshHubUrl;
                 console.log(`[Agent] Derived CAMSTACK_HUB_URL=${freshHubUrl} from hub address "${fresh.hubAddress}"`);
@@ -204,7 +240,7 @@ async function startAgent(configPath) {
             const fresh = pendingConfig;
             if (fresh === null)
                 throw new Error('reconnect: no configuration was prepared');
-            return buildTransporter(createAgentTransport({
+            return (0, system_1.buildTransporter)((0, system_1.createAgentTransport)({
                 nodeID: config.nodeId,
                 mode: 'agent',
                 hubAddress: fresh.hubAddress,
@@ -215,7 +251,7 @@ async function startAgent(configPath) {
         // The new wire's hub connection re-sends the manifest (`registration.onHubConnected`):
         // the subtree union, every child included (D3).
         start: async () => {
-            await connectBrokerTransport(broker);
+            await (0, system_1.connectBrokerTransport)(broker);
             console.log('[Agent] Reconnected successfully');
         },
         onSuperseded: (stage) => consoleLogger.warn('A superseded reconnect stopped without installing a second transport', {
@@ -226,7 +262,7 @@ async function startAgent(configPath) {
     // D3 subtree registry: accumulates manifests from every group-runner child
     // that calls `$agent.registerNode`. The agent re-registers the UNION of its
     // own in-process addons + all children with the hub on every child update.
-    const subtree = new HubNodeRegistry();
+    const subtree = new system_1.HubNodeRegistry();
     // ---------------------------------------------------------------------------
     // Hub connection state tracking (for richer UI status)
     // ---------------------------------------------------------------------------
@@ -250,7 +286,7 @@ async function startAgent(configPath) {
         catch {
             /* fall through */
         }
-        if (!isAgentPaired(config.configPath))
+        if (!(0, agent_pairing_store_js_1.isAgentPaired)(config.configPath))
             return 'unpaired';
         const configNow = readConfigFile(config.configPath);
         const hubAddressConfigured = typeof configNow.hubAddress === 'string' && configNow.hubAddress.length > 0;
@@ -312,7 +348,7 @@ async function startAgent(configPath) {
         // The agent runtime's OWN providers (server-management) are registered by
         // the bootstrap, not an addon — append their synthetic manifest entry so
         // the hub's HubNodeRegistry (and nodeId-pinned cap routing) sees them.
-        result.push(agentRuntimeManifestEntry());
+        result.push((0, agent_update_service_js_1.agentRuntimeManifestEntry)());
         return result;
     }
     /**
@@ -337,7 +373,7 @@ async function startAgent(configPath) {
         // carries the agent's root-package identity so the hub's HubNodeRegistry
         // (and the Server management UI) sees every node's exact version.
         const rootPackage = agentUpdateService.getRunningRootPackage();
-        return buildNodeManifest(config.nodeId, allAddons, allNativeCaps.length > 0 ? allNativeCaps : undefined, rootPackage.version === null
+        return (0, system_1.buildNodeManifest)(config.nodeId, allAddons, allNativeCaps.length > 0 ? allNativeCaps : undefined, rootPackage.version === null
             ? undefined
             : { name: rootPackage.name, version: rootPackage.version });
     }
@@ -351,7 +387,7 @@ async function startAgent(configPath) {
      * D857: no join to wait for and no secret in the manifest — the hub knows
      * who this agent is from its certificate.
      */
-    const registration = createAgentHubRegistration({
+    const registration = (0, agent_hub_registration_js_1.createAgentHubRegistration)({
         buildManifest: () => aggregateManifest(),
         broker: () => broker,
         signal: registerAbortController.signal,
@@ -379,36 +415,36 @@ async function startAgent(configPath) {
         child: () => consoleLogger,
         withTags: () => consoleLogger,
     };
-    const capabilityRegistry = new CapabilityRegistry(consoleLogger);
+    const capabilityRegistry = new system_1.CapabilityRegistry(consoleLogger);
     // Declare all capabilities the agent uses — required before registerProvider()
     const agentCapabilities = [
-        storageCapability,
-        storageProviderCapability,
+        types_2.storageCapability,
+        types_2.storageProviderCapability,
         // The path browser for "add a storage location on this node" — the agent
         // registers the provider since day one, but without DECLARING the cap
         // here the hub's manifest never learns of it and node-routed browse
         // answers "not available on node X" (2026-07-30 fix).
-        filesystemBrowseCapability,
+        types_2.filesystemBrowseCapability,
         // The agent runs the same two-addon data topology as the hub (D44):
         // `settings-store` is the door served by storage-orchestrator,
         // `data-store-provider` is the engine sqlite-settings registers. BOTH
         // must be declared here — this array is hand-curated and nothing else
         // teaches an agent a capability, so omitting the engine leaves the
         // agent's door with nothing behind it.
-        settingsStoreCapability,
-        dataStoreProviderCapability,
-        logDestinationCapability,
-        metricsProviderCapability,
-        decoderCapability,
-        motionDetectionCapability,
-        pipelineExecutorCapability,
-        pipelineRunnerCapability,
-        audioAnalyzerCapability,
-        platformProbeCapability,
-        serverManagementCapability,
+        types_2.settingsStoreCapability,
+        types_2.dataStoreProviderCapability,
+        types_2.logDestinationCapability,
+        types_2.metricsProviderCapability,
+        types_2.decoderCapability,
+        types_2.motionDetectionCapability,
+        types_2.pipelineExecutorCapability,
+        types_2.pipelineRunnerCapability,
+        types_2.audioAnalyzerCapability,
+        types_2.platformProbeCapability,
+        types_2.serverManagementCapability,
         // Certificates of THIS node, called by the hub (D856): mesh leaf renewal and the
         // hub-issued HTTPS leaf. Provided by the runtime, like `server-management`.
-        nodeCertificatesCapability,
+        types_2.nodeCertificatesCapability,
     ];
     for (const cap of agentCapabilities) {
         capabilityRegistry.declareCapability(cap);
@@ -424,16 +460,16 @@ async function startAgent(configPath) {
     // agent runs, so the agent compares what its process service holds (a runner
     // that failed or refused is named; one that never spawned is not knowable here).
     let agentRunnerBootCheck = null;
-    const agentUpdateService = new AgentUpdateService({
+    const agentUpdateService = new agent_update_service_js_1.AgentUpdateService({
         logger: consoleLogger,
         dataDir: config.dataDir,
         runnerBootCheck: () => agentRunnerBootCheck?.current(),
     });
-    capabilityRegistry.registerProvider('server-management', AGENT_RUNTIME_ADDON_ID, buildServerManagementProvider(agentUpdateService));
+    capabilityRegistry.registerProvider('server-management', agent_update_service_js_1.AGENT_RUNTIME_ADDON_ID, (0, server_management_provider_js_1.buildServerManagementProvider)(agentUpdateService));
     // The agent's certificates (D856): mesh leaf swap with automatic rollback, and the
     // hub-issued HTTPS leaf hot-swapped into the sniffing listener. The listener is
     // created later in boot, so it is read through a getter.
-    capabilityRegistry.registerProvider('node-certificates', AGENT_RUNTIME_ADDON_ID, createAgentNodeCertificates({
+    capabilityRegistry.registerProvider('node-certificates', agent_update_service_js_1.AGENT_RUNTIME_ADDON_ID, (0, agent_node_certificates_js_1.createAgentNodeCertificates)({
         nodeId: config.nodeId,
         dataDir: config.dataDir,
         configPath: config.configPath,
@@ -444,7 +480,7 @@ async function startAgent(configPath) {
             timer.unref?.();
         },
         getHttpsListener: () => agentHttpListener,
-        hostFacts: systemHostFacts(),
+        hostFacts: (0, system_2.systemHostFacts)(),
         log: {
             info: (message, extras) => consoleLogger.info(message, extras),
             warn: (message, extras) => consoleLogger.warn(message, extras),
@@ -476,7 +512,7 @@ async function startAgent(configPath) {
         // — a copy nothing loads (both roles pass `['@camstack/system']` as the
         // loader's skip list) and that WINS over the closure for anything resolving
         // through it.
-        void runSingleCopyCleanup({
+        void (0, single_copy_cleanup_runner_js_1.runSingleCopyCleanup)({
             dataDir: config.dataDir,
             addonRoot: config.addonsDir,
             log: (line) => consoleLogger.info(line),
@@ -487,7 +523,7 @@ async function startAgent(configPath) {
     // No scope — the brand bracket `[agent/addonId]` already identifies the addon.
     // `addonId` tag is required for the brand bracket resolver.
     const loggerFactory = (addonId) => agentLogManager.createLogger().withTags({ addonId });
-    const agentServiceSchema = createAgentService({
+    const agentServiceSchema = (0, agent_service_js_1.createAgentService)({
         addonsDir: config.addonsDir,
         dataDir: config.dataDir,
         agentName: config.name,
@@ -545,7 +581,7 @@ async function startAgent(configPath) {
         bootstrapPackages: new Set([
             '@camstack/system',
             '@camstack/addon-agent-ui',
-            ...AddonInstaller.AGENT_PACKAGES,
+            ...system_1.AddonInstaller.AGENT_PACKAGES,
         ]),
         unregisterProvider: (capName, addonId) => {
             if (capabilityRegistry.hasProvider(capName, addonId)) {
@@ -559,7 +595,7 @@ async function startAgent(configPath) {
     // back here instead of falling back to port 6000 (the hub). Bug-4:
     // without this, runners called `$agent.registerNode` through the hub
     // which has no `$agent` service → retry storm (attempt 80+).
-    const agentTcpPort = deriveAgentListenPort(broker.nodeID);
+    const agentTcpPort = (0, system_1.deriveAgentListenPort)(broker.nodeID);
     // UDS local transport — the agent hosts a LocalChildRegistry so its
     // forked addon-runners route cap calls over a Unix-domain socket. The
     // broker stays as the no-route fallback. On failure the children fall
@@ -578,7 +614,7 @@ async function startAgent(configPath) {
         // mesh (and any cluster node) via the same service-discovery + action-name
         // convention the child's brokerTransportLink used before F0. F1+F2 removes
         // the child broker, so the agent must own this outbound path.
-        const onUnownedCall = createParentUnownedCallHandler({
+        const onUnownedCall = (0, system_1.createParentUnownedCallHandler)({
             getResolver: () => null,
             broker: broker,
             // The agent's subtree registry — lets the broker fallback pin a
@@ -601,7 +637,7 @@ async function startAgent(configPath) {
             // makes an agent's forked addon reach a hub-hosted cap (`stream-broker`,
             // `settings-store`, …) instead of 30s-deadlining on raw `${cap}.*`
             // discovery (hub-local addon runners expose no Moleculer service).
-            forwardToHub: (input) => broker.call(HUB_CAP_FWD_ACTION, {
+            forwardToHub: (input) => broker.call(system_1.HUB_CAP_FWD_ACTION, {
                 capName: input.capName,
                 method: input.method,
                 args: input.args,
@@ -620,8 +656,8 @@ async function startAgent(configPath) {
             }, { timeout: 60_000 }),
             logger: { warn: (msg) => consoleLogger.warn(`[uds-fallback] ${msg}`) },
         });
-        agentUdsRegistry = new LocalChildRegistry({
-            server: createLocalTransport().createServer(agentNodeId),
+        agentUdsRegistry = new system_1.LocalChildRegistry({
+            server: (0, system_1.createLocalTransport)().createServer(agentNodeId),
             // `WorkerOnline` / `WorkerOffline` `<agent>/<childId>` for a forked runner
             // (no broker of its own, so no `$node.connected`), on the agent's
             // cluster-broadcasting bus. The bus exists only after `broker.start()`;
@@ -688,11 +724,11 @@ async function startAgent(configPath) {
         agentUdsRegistry.onChildLog((childId, entry) => {
             // Key names and URL credentials redacted before the line leaves this
             // node (D787 §8). The child already scrubbed the values it resolved.
-            const raw = udsChildLogToWorkerEntry(childId, entry);
+            const raw = (0, system_1.udsChildLogToWorkerEntry)(childId, entry);
             const workerEntry = {
                 ...raw,
-                message: redactLogText(raw.message),
-                ...(raw.meta !== undefined ? { meta: redactLogMeta(raw.meta) } : {}),
+                message: (0, system_1.redactLogText)(raw.message),
+                ...(raw.meta !== undefined ? { meta: (0, system_1.redactLogMeta)(raw.meta) } : {}),
             };
             broker.call('log-receiver.ingest', workerEntry).catch(() => {
                 // Hub unreachable or not yet discovered — silently drop.
@@ -700,13 +736,13 @@ async function startAgent(configPath) {
                 // child UDS logs emitted before hub connection are not buffered here.
             });
         });
-        agentParentUdsPath = localEndpointPath(agentNodeId);
+        agentParentUdsPath = (0, system_1.localEndpointPath)(agentNodeId);
         consoleLogger.info(`UDS child registry listening on ${agentParentUdsPath}`);
     }
     catch (err) {
         consoleLogger.warn(`UDS child registry failed to start; children stay broker-only: ${err instanceof Error ? err.message : String(err)}`);
     }
-    const processServiceSchema = createProcessService(broker.nodeID, config.dataDir, undefined, agentTcpPort, agentParentUdsPath);
+    const processServiceSchema = (0, system_1.createProcessService)(broker.nodeID, config.dataDir, undefined, agentTcpPort, agentParentUdsPath);
     broker.createService(processServiceSchema);
     // Slice-5, Task 7 — register the agent-side cap-dispatch service so the hub
     // can route `agent-child-forward` cap calls to this agent's UDS children.
@@ -734,14 +770,14 @@ async function startAgent(configPath) {
             },
         };
     };
-    registerAgentCapDispatch(broker, agentUdsRegistry, agentInProcessLookup, consoleLogger);
+    (0, register_agent_cap_dispatch_js_1.registerAgentCapDispatch)(broker, agentUdsRegistry, agentInProcessLookup, consoleLogger);
     // $addonHost — REMOVED (Sprint 6). Three-level settings are now
     // exposed per-addon via `settings.*` actions in createAddonService.
     // Register $event-bus BEFORE start so the service subscription
     // is announced during discovery. See addon-context-factory.ts for
     // the rationale — post-start registration propagates via heartbeat
     // and is unreliable for the first ~10s.
-    registerEventBusService(broker);
+    (0, system_1.registerEventBusService)(broker);
     // Start broker BEFORE bootCoreAddons. Core infra addons (storage,
     // sqlite-settings, ...) run their own BaseAddon.initialize() which
     // calls `ctx.settings.readAddonStore()` on every addon; that call
@@ -751,7 +787,7 @@ async function startAgent(configPath) {
     // discovery resolve (or time out cleanly via the read-blob fallback)
     // so agent boot completes instead of hanging on the first infra addon.
     await broker.start();
-    agentRunnerBootCheck = new RunnerBootCheckService({
+    agentRunnerBootCheck = new runner_boot_check_js_1.RunnerBootCheckService({
         logger: consoleLogger,
         nodeId: config.nodeId,
         planned: () => null,
@@ -763,25 +799,25 @@ async function startAgent(configPath) {
     });
     agentRunnerBootCheck.scheduleAfterBoot();
     // Re-evaluate a verdict that still had runners on their way, on each runner state change.
-    getBrokerEventBus(broker).subscribe({ category: EventCategory.ProcessStateChanged }, () => agentRunnerBootCheck?.noteRunnerChange());
+    (0, system_1.getBrokerEventBus)(broker).subscribe({ category: types_1.EventCategory.ProcessStateChanged }, () => agentRunnerBootCheck?.noteRunnerChange());
     // C2: wire the UDS ↔ Moleculer event bridge so events emitted by UDS
     // children fan to siblings and reach the cluster, and cluster / parent-
     // local events propagate to every UDS child. Inert when agentUdsRegistry
     // was not started (no UDS children). Wired after broker.start() so
     // getBrokerEventBus returns the fully operational shared bus.
-    const agentBrokerEventBus = getBrokerEventBus(broker);
+    const agentBrokerEventBus = (0, system_1.getBrokerEventBus)(broker);
     agentLifecycleBus = agentBrokerEventBus;
     agentUpdateService.bindAvailability(agentBrokerEventBus, broker.nodeID);
     let udsEventBridgeDispose = null;
     if (agentUdsRegistry !== undefined) {
-        udsEventBridgeDispose = createUdsEventBridge({
+        udsEventBridgeDispose = (0, system_1.createUdsEventBridge)({
             registry: agentUdsRegistry,
             parentBus: agentBrokerEventBus,
             parentNodeId: broker.nodeID,
             // D2: relay to children via the pass-through subscription so the bridge's
             // wildcard does NOT count toward this node's local interest (otherwise the
             // gate could never filter anything).
-            subscribePassthrough: (handler) => subscribePassthrough(broker, handler),
+            subscribePassthrough: (handler) => (0, system_1.subscribePassthrough)(broker, handler),
         });
         // D2: teach the agent's `$event-bus` inbound handler which cross-node
         // (Moleculer) event categories any of its UDS children actually want, so the
@@ -790,7 +826,7 @@ async function startAgent(configPath) {
         // (un)subscribing takes effect immediately. Fails OPEN when a child is
         // undeclared (aggregateEventInterest → null).
         const interestRegistry = agentUdsRegistry;
-        setNodeEventInterest(broker, () => interestRegistry.aggregateEventInterest());
+        (0, system_1.setNodeEventInterest)(broker, () => interestRegistry.aggregateEventInterest());
         // D1: answer readiness-snapshot requests from UDS children over the
         // agent's own readiness registry view. The agent hydrates its registry
         // from the hub's `$readiness.getSnapshot` Moleculer action (broker
@@ -801,7 +837,7 @@ async function startAgent(configPath) {
         // uses, so the shared per-broker instance is returned on the first call
         // and reused on subsequent calls — no separate registry is created.
         // Wired after broker.start() so the broker event bus is operational.
-        const agentReadinessRegistry = getOrInitReadinessRegistry(broker, agentBrokerEventBus, consoleLogger);
+        const agentReadinessRegistry = (0, system_1.getOrInitReadinessRegistry)(broker, agentBrokerEventBus, consoleLogger);
         agentUdsRegistry.onReadinessSnapshotRequest(() => agentReadinessRegistry.getSnapshotForTransport());
         // D8 reverse leg: expose THIS agent's readiness snapshot so the hub can
         // snapshot-reconcile agent-origin records on every (re)connect and
@@ -811,7 +847,7 @@ async function startAgent(configPath) {
         // the synthesized `down` forever. Registered under
         // `$agent-readiness` (NOT `$readiness`) so the agent's own unqualified
         // `$readiness.getSnapshot` hub-hydrate call is never shadowed locally.
-        broker.createService(createReadinessServiceForRegistry(agentReadinessRegistry, AGENT_READINESS_SERVICE_NAME));
+        broker.createService((0, system_1.createReadinessServiceForRegistry)(agentReadinessRegistry, system_1.AGENT_READINESS_SERVICE_NAME));
     }
     // ── HTTP server (Fastify) — status API + process management + UI ──
     // Started early (before addon boot) so the status page is reachable
@@ -823,21 +859,21 @@ async function startAgent(configPath) {
     // repair its own version. Addons: report only (the install is a hub push;
     // see `agent-addon-updates.ts`).
     const updateControls = {
-        server: createAgentServerUpdateControls(agentUpdateService, (message) => {
+        server: (0, agent_update_routes_js_1.createAgentServerUpdateControls)(agentUpdateService, (message) => {
             // A refused/failed update that logs nothing reads as "never happened".
             consoleLogger.warn(`framework update not applied: ${message}`, {
                 tags: { nodeId: config.nodeId },
             });
         }),
         addons: {
-            hub: createAgentHubAddonControls({
+            hub: (0, agent_hub_addon_update_js_1.createAgentHubAddonControls)({
                 nodeId: config.nodeId,
                 // The mesh channel the agent already holds; the hub names this caller
                 // `node:<id>` and answers per its remote privilege grant.
                 callHub: (action, params, timeoutMs) => broker.call(action, params, { nodeID: 'hub', timeout: timeoutMs }),
                 onProblem: (message) => consoleLogger.warn(message, { tags: { nodeId: config.nodeId } }),
             }),
-            getReport: () => buildAgentAddonUpdateReport({
+            getReport: () => (0, agent_addon_updates_js_1.buildAgentAddonUpdateReport)({
                 addonsDir: config.addonsDir,
                 ...(process.env['CAMSTACK_NPM_REGISTRY'] !== undefined
                     ? { registryUrl: process.env['CAMSTACK_NPM_REGISTRY'] }
@@ -851,8 +887,8 @@ async function startAgent(configPath) {
     // A hub pairs this agent from outside; the agent installs the certificate only after
     // its own operator confirmed the code. Its pairing state is advertised over mDNS.
     const agentVersion = process.env['CAMSTACK_AGENT_APP_VERSION'] ?? agentUpdateService.getRunningRootPackage().version;
-    const agentMdns = new AgentMdnsAdvertiser({
-        publisher: createCiaoPublisher(),
+    const agentMdns = new system_1.AgentMdnsAdvertiser({
+        publisher: (0, system_1.createCiaoPublisher)(),
         logger: consoleLogger,
     });
     const advertise = () => {
@@ -861,16 +897,16 @@ async function startAgent(configPath) {
             version: agentVersion,
             port: config.statusPort ?? 4444,
             state: pairing.state(),
-            leafFingerprint: pairedLeafFingerprint(config.configPath),
+            leafFingerprint: (0, agent_pairing_store_js_1.pairedLeafFingerprint)(config.configPath),
         });
     };
-    const localPairing = createLocalPairingAnnouncer(config.dataDir, consoleLogger);
-    const pairing = new AgentPairing({
+    const localPairing = (0, agent_pairing_local_js_1.createLocalPairingAnnouncer)(config.dataDir, consoleLogger);
+    const pairing = new system_1.AgentPairing({
         nodeId: config.nodeId,
         version: agentVersion,
-        isPaired: () => isAgentPaired(config.configPath),
+        isPaired: () => (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath),
         install: async (installed) => {
-            persistPairing(config.configPath, installed);
+            (0, agent_pairing_store_js_1.persistPairing)(config.configPath, installed);
             hubConnectionStateOverride = null;
             consoleLogger.info('Paired with the hub - reconnecting with the new certificate', {
                 meta: { hubUrl: installed.hubUrl, hubAddress: installed.hubAddress },
@@ -888,14 +924,14 @@ async function startAgent(configPath) {
     });
     const forgetHubNow = async (why) => {
         consoleLogger.warn(`Leaving the hub: ${why}. This agent is unpaired and advertises again`);
-        forgetPairing(config.configPath, config.dataDir);
+        (0, agent_pairing_store_js_1.forgetPairing)(config.configPath, config.dataDir);
         pairing.noteUnpaired();
         hubConnectionStateOverride = null;
-        await reconnect().catch((err) => consoleLogger.error(`reconnect after unpairing failed: ${errMsg(err)}`));
+        await reconnect().catch((err) => consoleLogger.error(`reconnect after unpairing failed: ${(0, types_2.errMsg)(err)}`));
         advertise();
     };
     advertise();
-    void startAgentHttpServer(getBrokerFn, {
+    void (0, agent_http_js_1.startAgentHttpServer)(getBrokerFn, {
         log: {
             info: (message, extras) => consoleLogger.info(message, extras),
             warn: (message, extras) => consoleLogger.warn(message, extras),
@@ -1004,7 +1040,7 @@ async function startAgent(configPath) {
 // here would only open a database nothing reads. See
 // `agent-infra-capabilities.ts` for the measurement behind that and for the
 // one-env-var rollback (`CAMSTACK_AGENT_LOCAL_DATA_STORE=1`).
-const AGENT_INFRA = resolveAgentInfraCapabilities(process.env);
+const AGENT_INFRA = (0, agent_infra_capabilities_js_1.resolveAgentInfraCapabilities)(process.env);
 async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFactory) {
     // Builtins come from the CLOSURE this process is running, exactly as the hub
     // has done since 2026-07-18 — never from a `<addonsDir>/@camstack/system`
@@ -1012,27 +1048,27 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
     // 17 versions behind on 2026-08-11). `planAgentAddonScan` owns the decision
     // and the fallback; see `addon-scan.ts`. Non-framework infra providers
     // (e.g. `@camstack/addon-platform-probe-native`) still come from the scan.
-    const closureSystemDir = resolveHubClosurePackageDir(BUILTINS_PACKAGE);
+    const closureSystemDir = (0, package_dir_utils_js_1.resolveHubClosurePackageDir)(addon_scan_js_1.BUILTINS_PACKAGE);
     if (closureSystemDir === null) {
         // Louder than the hub's warn: on an agent the builtins ARE the infra, so
         // this is pre-fatal. Boot continues to the D87 guard, which names every
         // required cap it could not resolve.
-        console.error(`[Agent] ${BUILTINS_PACKAGE} not resolvable from the running closure — ` +
+        console.error(`[Agent] ${addon_scan_js_1.BUILTINS_PACKAGE} not resolvable from the running closure — ` +
             'falling back to the addon-root copy, if there is one');
     }
-    const packageDirs = planAgentAddonScan(config.addonsDir, closureSystemDir);
+    const packageDirs = (0, addon_scan_js_1.planAgentAddonScan)(config.addonsDir, closureSystemDir);
     if (packageDirs.length === 0) {
         console.warn('[Agent] No addon packages found — running without infrastructure addons');
         return;
     }
     console.log(`[Agent] Scanning ${packageDirs.length} addon package(s) for infra providers`);
-    const loader = new AddonLoader();
+    const loader = new system_1.AddonLoader();
     for (const dir of packageDirs) {
         try {
             await loader.loadFromAddonDir(dir);
         }
         catch (err) {
-            console.warn(`[Agent] Failed to scan ${dir}: ${errMsg(err)}`);
+            console.warn(`[Agent] Failed to scan ${dir}: ${(0, types_2.errMsg)(err)}`);
         }
     }
     // Resolution is per-CAPABILITY (the guard names every missing required
@@ -1044,11 +1080,11 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
     // 2026-08-08 the moment D87 promoted infra failures to fatal. The plan
     // makes the dedupe explicit and testable (see `infra-boot-plan.ts`).
     const byId = new Map(loader.listAddons().map((a) => [a.declaration.id, a]));
-    const plan = planInfraBoot(loader.listAddons().map((a) => ({
+    const plan = (0, infra_boot_plan_js_1.planInfraBoot)(loader.listAddons().map((a) => ({
         id: a.declaration.id,
         capabilities: (a.declaration.capabilities ?? []).map((c) => typeof c === 'string' ? c : c.name),
     })), AGENT_INFRA);
-    const resolutions = planToResolutions(plan);
+    const resolutions = (0, infra_boot_plan_js_1.planToResolutions)(plan);
     for (const step of plan) {
         if (step.addonId === null) {
             // Say it per-capability (an OPTIONAL miss is the only thing this line
@@ -1074,7 +1110,7 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
             // in the registry (the storage addon declares itself before the
             // addons that depend on it per AGENT_INFRA order).
             const storageProvider = registry.getSingleton('storage') ?? undefined;
-            const context = await createAddonContext(broker, addon.declaration, config.dataDir, {
+            const context = await (0, system_1.createAddonContext)(broker, addon.declaration, config.dataDir, {
                 storageProvider,
                 addonConfig: { rootPath: config.dataDir },
                 createLogger: loggerFactory,
@@ -1085,7 +1121,7 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
                 // configured for type addons-data" → fatal crash-loop.
                 listStorageLocationDeclarations: () => loader.listStorageLocationDeclarations(),
             });
-            const initResult = normalizeAddonInitResult(await instance.initialize(context));
+            const initResult = (0, types_2.normalizeAddonInitResult)(await instance.initialize(context));
             for (const reg of initResult?.providers ?? []) {
                 const capName = reg.capability.name;
                 registry.registerProvider(capName, addonId, reg.provider);
@@ -1103,7 +1139,7 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
             console.log(`[Agent] Core addon "${addonId}" initialized`);
         }
         catch (err) {
-            const msg = errMsg(err);
+            const msg = (0, types_2.errMsg)(err);
             console.error(`[Agent] Failed to initialize core addon "${addonId}": ${msg}`);
             if (step.required) {
                 throw new Error(`Required infrastructure addon "${addonId}" failed: ${msg}`, { cause: err });
@@ -1115,7 +1151,7 @@ async function bootCoreAddons(broker, config, registry, loadedAddons, loggerFact
     // the SILENT branch. Abort here instead of booting a node that cannot
     // store, configure or probe itself and whose manifest then makes every hub
     // routing decision about it wrong. See `infra-boot-guard.ts`.
-    assertRequiredInfraResolved(resolutions, config.addonsDir);
+    (0, infra_boot_guard_js_1.assertRequiredInfraResolved)(resolutions, config.addonsDir);
 }
 // ---------------------------------------------------------------------------
 // Phase 1.5: Load cluster-capable addon packages
@@ -1127,7 +1163,7 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
     // the single-copy collapse removes. The closure dir is deliberately NOT added:
     // adding it would newly expose `hub-forwarder` / `platform-probe` (the only
     // builtins carrying `execution`) as spawn candidates.
-    const addonPackageDirs = resolveAddonPackageDirs(config.addonsDir, systemSkipList());
+    const addonPackageDirs = (0, addon_scan_js_1.resolveAddonPackageDirs)(config.addonsDir, systemSkipList());
     if (addonPackageDirs.length === 0)
         return;
     // ── Phase 0 (cross-package): collect every group-eligible addon
@@ -1141,12 +1177,12 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
     // so each dir is parsed once.
     const dirToLoader = new Map();
     for (const dir of addonPackageDirs) {
-        const loader = new AddonLoader();
+        const loader = new system_1.AddonLoader();
         try {
             await loader.loadFromAddonDir(dir);
         }
         catch (err) {
-            console.warn(`[Agent] Skipping ${dir}: ${errMsg(err)}`);
+            console.warn(`[Agent] Skipping ${dir}: ${(0, types_2.errMsg)(err)}`);
             continue;
         }
         dirToLoader.set(dir, loader);
@@ -1155,11 +1191,11 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
                 continue;
             if (registered.declaration.execution === undefined)
                 continue;
-            const placement = resolveAddonPlacement(registered.declaration);
+            const placement = (0, types_2.resolveAddonPlacement)(registered.declaration);
             if (placement === 'hub-only')
                 continue;
             allGroupCandidates.push({
-                groupId: resolveRunnerId(registered.declaration, registered.declaration.id),
+                groupId: (0, types_2.resolveRunnerId)(registered.declaration, registered.declaration.id),
                 addonId: registered.declaration.id,
                 addonDir: dir,
                 version: registered.declaration.version ?? '0.0.0',
@@ -1185,7 +1221,7 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
                 // Shared with the reload path (`ensureGroupRunner`) so the boot and
                 // reload registrations can never drift — the drift was the in-process
                 // reload-wedge's root cause.
-                registerGroupRunnerProviders({ broker, capabilityRegistry, loadedAddons }, addons);
+                (0, agent_group_runner_js_1.registerGroupRunnerProviders)({ broker, capabilityRegistry, loadedAddons }, addons);
                 console.log(`[Agent] Group "${groupId}" spawned with ${addons.length} addon(s): ${addons.map((a) => a.addonId).join(', ')}`);
             }
             catch (err) {
@@ -1207,7 +1243,7 @@ async function loadClusterCapableAddons(broker, config, capabilityRegistry, load
             const addonId = registered.declaration.id;
             if (loadedAddons.has(addonId))
                 continue;
-            if (!isDeployableToAgent(registered.declaration))
+            if (!(0, types_2.isDeployableToAgent)(registered.declaration))
                 continue;
             console.warn(`[Agent] Addon "${addonId}" is deployable but missing from any spawned group — verify package.json execution field`);
         }
@@ -1227,25 +1263,25 @@ async function loadDeployedAddons(broker, addonsDir, dataDir, loadedAddons, stor
     // (re)dispatched to a subprocess, which loads the real module itself.
     // Same skip: a `$agent.deploy` of `@camstack/system` still lands bytes in the
     // addon root, but a reload must not adopt them over the closure.
-    const packageDirs = resolveAddonPackageDirs(addonsDir, systemSkipList());
+    const packageDirs = (0, addon_scan_js_1.resolveAddonPackageDirs)(addonsDir, systemSkipList());
     const groupCandidates = [];
     // Dirs holding a deployable NON-group addon — and ONLY these — need the
     // importing loader. None exist under the default `hub-only` placement
     // (deployable ⟹ cluster-capable), so the heavy import path is never taken.
     const inProcessDirs = new Set();
     for (const dir of packageDirs) {
-        const manifest = readPackageManifestAddons(dir);
+        const manifest = (0, agent_group_runner_js_1.readPackageManifestAddons)(dir);
         if (!manifest)
             continue;
         for (const decl of manifest.declarations) {
             const addonId = decl.id;
             if (loadedAddons.has(addonId))
                 continue;
-            if (!isDeployableToAgent(decl))
+            if (!(0, types_2.isDeployableToAgent)(decl))
                 continue;
-            if (isGroupRunnerAddon(decl)) {
+            if ((0, agent_group_runner_js_1.isGroupRunnerAddon)(decl)) {
                 groupCandidates.push({
-                    groupId: resolveRunnerId(decl, addonId),
+                    groupId: (0, types_2.resolveRunnerId)(decl, addonId),
                     addonId,
                     addonDir: dir,
                     version: decl.version ?? '0.0.0',
@@ -1280,7 +1316,7 @@ async function loadDeployedAddons(broker, addonsDir, dataDir, loadedAddons, stor
     }
     const deployLogger = loggerFactory('agent-group-runner');
     for (const [groupId, addons] of grouped) {
-        await ensureGroupRunner({ broker, capabilityRegistry, loadedAddons, logger: deployLogger }, groupId, addons);
+        await (0, agent_group_runner_js_1.ensureGroupRunner)({ broker, capabilityRegistry, loadedAddons, logger: deployLogger }, groupId, addons);
     }
 }
 /**
@@ -1302,28 +1338,28 @@ async function loadInProcessDeployedAddons(broker, dirs, dataDir, loadedAddons,
         capabilityRegistry,
     };
     for (const dir of dirs) {
-        const loader = new AddonLoader();
+        const loader = new system_1.AddonLoader();
         try {
             await loader.loadFromAddonDir(dir);
         }
         catch (err) {
-            console.warn(`[Agent] Skipping ${dir}: ${errMsg(err)}`);
+            console.warn(`[Agent] Skipping ${dir}: ${(0, types_2.errMsg)(err)}`);
             continue;
         }
         for (const registered of loader.listAddons()) {
             const addonId = registered.declaration.id;
             if (loadedAddons.has(addonId))
                 continue;
-            if (!isDeployableToAgent(registered.declaration))
+            if (!(0, types_2.isDeployableToAgent)(registered.declaration))
                 continue;
             // Group-runner addons are dispatched to subprocesses by the caller.
-            if (isGroupRunnerAddon(registered.declaration))
+            if ((0, agent_group_runner_js_1.isGroupRunnerAddon)(registered.declaration))
                 continue;
             try {
                 const instance = new registered.addonClass();
-                const context = await createAddonContext(broker, registered.declaration, dataDir, contextOptions);
+                const context = await (0, system_1.createAddonContext)(broker, registered.declaration, dataDir, contextOptions);
                 await instance.initialize(context);
-                const serviceSchema = createAddonService(instance, registered.declaration);
+                const serviceSchema = (0, system_1.createAddonService)(instance, registered.declaration);
                 broker.createService(serviceSchema);
                 loadedAddons.set(addonId, {
                     id: addonId,
@@ -1336,7 +1372,7 @@ async function loadInProcessDeployedAddons(broker, dirs, dataDir, loadedAddons,
                 console.log(`[Agent] Deployed addon "${addonId}" loaded in-process`);
             }
             catch (err) {
-                const msg = errMsg(err);
+                const msg = (0, types_2.errMsg)(err);
                 console.error(`[Agent] Failed to load deployed addon "${addonId}": ${msg}`);
                 loadedAddons.set(addonId, { id: addonId, status: 'error' });
             }
@@ -1378,7 +1414,7 @@ function readAgentVersion() {
  * copy is authoritative.
  */
 function systemSkipList() {
-    return resolveHubClosurePackageDir(BUILTINS_PACKAGE) === null ? [] : [BUILTINS_PACKAGE];
+    return (0, package_dir_utils_js_1.resolveHubClosurePackageDir)(addon_scan_js_1.BUILTINS_PACKAGE) === null ? [] : [addon_scan_js_1.BUILTINS_PACKAGE];
 }
 // ---------------------------------------------------------------------------
 // E1 helper — agent-local UDS child manifest adaptation
@@ -1415,4 +1451,3 @@ function buildAgentChildUdsManifest(nodeId, childId, caps) {
     const addons = [...capsByAddon.entries()].map(([addonId, capNames]) => ({ addonId, capabilities: [...capNames] }));
     return { nodeId, addons };
 }
-export { startAgent };