@camstack/system 1.0.6 → 1.0.8

package/dist/index.js

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_resource_monitor = require("./resource-monitor-IIEanuJt.js");
+const require_model_download_service = require("./model-download-service-JtVQtbb6.js");
+const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
@@ -19,7 +20,8 @@ const require_builtins_local_auth_local_auth_addon = require("./builtins/local-a
 require("./builtins/local-auth/index.js");
 const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
 require("./builtins/device-manager/index.js");
-const require_manifest_python_deps = require("./manifest-python-deps-B4BmMoGT.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BWURo7dc.js");
+const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 const require_graceful_fs$1 = require("./graceful-fs-lg19SZNz.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
@@ -39,6 +41,7 @@ let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs_promises = require("node:fs/promises");
 let zod = require("zod");
+let _camstack_types_addon = require("@camstack/types/addon");
 let fs = require("fs");
 fs = require_chunk.__toESM(fs, 1);
 let node_events = require("node:events");
@@ -79,216 +82,6 @@ var EventBus = class {
 	}
 };
 //#endregion
-//#region src/http/authenticated-file-server.ts
-/**
-* Authenticated data-plane file-server — a shared host primitive for addons that
-* must serve files (media segments, scrub-frame stores, exported clips) directly
-* to browsers/players, node-direct (NOT through the hub tRPC, per the recording
-* design's "no media bytes traverse the hub").
-*
-* It bundles the three things every such server needs so addons don't re-roll
-* them: CORS (the data plane is cross-origin from the admin-ui — a native
-* `<video src>` is exempt but hls.js / WebCodecs fetch via XHR and are blocked
-* without it), HTTP `Range` (seeking / partial fetch), and a SCOPED TOKEN check.
-*
-* The token rides as the FIRST path segment (`<urlPrefix><token>/<relPath>`) so
-* a player resolving a manifest's RELATIVE child URIs carries it on every
-* sub-request automatically — no per-URI rewriting, no cookies/headers a dumb
-* player can't set. The caller supplies `verifyToken(token, relPath)`; the
-* primitive stays auth-scheme-agnostic.
-*
-* Pure helpers (`parseTokenizedUrl`, `resolveFilePath`, `contentTypeFor`,
-* `parseRangeHeader`) are exported for unit testing; `createAuthenticatedFileServer`
-* is the thin `node:http` glue.
-*/
-function corsHeaders(origin) {
-	return {
-		"access-control-allow-origin": origin,
-		"access-control-allow-methods": "GET, HEAD, OPTIONS",
-		"access-control-allow-headers": "range",
-		"access-control-expose-headers": "content-length, content-range, accept-ranges",
-		"access-control-max-age": "86400"
-	};
-}
-/**
-* Split a request URL (`<urlPrefix><token>/<relPath>`) into its token + rel
-* path. Returns null for anything outside the prefix or missing either part.
-* `relPath` is URL-decoded; a decode failure → null.
-*/
-function parseTokenizedUrl(urlPrefix, urlPath) {
-	if (!urlPath.startsWith(urlPrefix)) return null;
-	const after = urlPath.slice(urlPrefix.length);
-	const slash = after.indexOf("/");
-	if (slash <= 0) return null;
-	const token = after.slice(0, slash);
-	let rel;
-	try {
-		rel = decodeURIComponent(after.slice(slash + 1));
-	} catch {
-		return null;
-	}
-	if (rel.length === 0) return null;
-	return {
-		token,
-		rel
-	};
-}
-/**
-* Map a rel path to one candidate absolute path PER root, keeping only roots the
-* path stays within (traversal guard). The handler serves the first candidate
-* that exists. Rejects a path that escapes every root.
-*/
-function resolveFilePath(roots, rel) {
-	if (rel.length === 0) return { error: "forbidden" };
-	const candidates = [];
-	for (const rootDir of roots) {
-		const root = node_path.default.resolve(rootDir);
-		const abs = node_path.default.resolve(root, rel);
-		if (abs === root || abs.startsWith(root + node_path.default.sep)) candidates.push(abs);
-	}
-	if (candidates.length === 0) return { error: "forbidden" };
-	return { candidates };
-}
-var DEFAULT_CONTENT_TYPES = {
-	".m3u8": "application/vnd.apple.mpegurl",
-	".m4s": "video/mp4",
-	".mp4": "video/mp4",
-	".idx": "application/octet-stream",
-	".html": "text/html; charset=utf-8",
-	".js": "application/javascript; charset=utf-8",
-	".mjs": "application/javascript; charset=utf-8",
-	".css": "text/css; charset=utf-8",
-	".json": "application/json; charset=utf-8",
-	".map": "application/json; charset=utf-8",
-	".svg": "image/svg+xml",
-	".png": "image/png",
-	".jpg": "image/jpeg",
-	".jpeg": "image/jpeg",
-	".ico": "image/x-icon",
-	".woff2": "font/woff2",
-	".woff": "font/woff",
-	".ttf": "font/ttf"
-};
-function contentTypeFor(filePath, overrides) {
-	const ext = node_path.default.extname(filePath).toLowerCase();
-	return overrides?.[ext] ?? DEFAULT_CONTENT_TYPES[ext] ?? "application/octet-stream";
-}
-/** Parse an HTTP `Range` header against a known size. Null = serve whole file. */
-function parseRangeHeader(header, size) {
-	if (!header) return null;
-	const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
-	if (!m) return null;
-	const [, rawStart, rawEnd] = m;
-	if (rawStart === "" && rawEnd === "") return null;
-	let start;
-	let end;
-	if (rawStart === "") {
-		const n = Number(rawEnd);
-		if (n <= 0) return null;
-		start = Math.max(0, size - n);
-		end = size - 1;
-	} else {
-		start = Number(rawStart);
-		end = rawEnd === "" ? size - 1 : Number(rawEnd);
-	}
-	if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || start >= size) return null;
-	return {
-		start,
-		end: Math.min(end, size - 1)
-	};
-}
-/**
-* Start an authenticated file-server. Returns the bound port so the caller can
-* build URLs. `getRoots`/`verifyToken` are invoked per request, so they always
-* reflect the live config.
-*/
-async function createAuthenticatedFileServer(opts) {
-	const cors = corsHeaders(opts.corsOrigin ?? "*");
-	const server = (0, node_http.createServer)((req, res) => {
-		handle(opts, cors, req, res);
-	});
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(opts.port, () => resolve());
-	});
-	const addr = server.address();
-	return {
-		port: typeof addr === "object" && addr ? addr.port : opts.port,
-		close: () => new Promise((resolve) => server.close(() => resolve()))
-	};
-}
-async function handle(opts, cors, req, res) {
-	if (req.method === "OPTIONS") {
-		res.writeHead(204, cors).end();
-		return;
-	}
-	if (req.method !== "GET" && req.method !== "HEAD") {
-		res.writeHead(405, cors).end();
-		return;
-	}
-	const urlPath = (req.url ?? "").split("?")[0] ?? "";
-	const parsed = parseTokenizedUrl(opts.urlPrefix, urlPath);
-	if (!parsed) {
-		res.writeHead(403, cors).end();
-		return;
-	}
-	if (!opts.verifyToken(parsed.token, parsed.rel)) {
-		res.writeHead(401, cors).end();
-		return;
-	}
-	const resolved = resolveFilePath(opts.getRoots(), parsed.rel);
-	if ("error" in resolved) {
-		res.writeHead(403, cors).end();
-		return;
-	}
-	let absPath = null;
-	let size = 0;
-	for (const candidate of resolved.candidates) try {
-		const st = await node_fs.promises.stat(candidate);
-		if (st.isFile()) {
-			absPath = candidate;
-			size = st.size;
-			break;
-		}
-	} catch {}
-	if (absPath === null) {
-		res.writeHead(404, cors).end();
-		return;
-	}
-	const baseHeaders = {
-		...cors,
-		"content-type": contentTypeFor(absPath, opts.contentTypes),
-		"accept-ranges": "bytes",
-		"cache-control": "no-cache"
-	};
-	const range = parseRangeHeader(req.headers.range, size);
-	if (range) {
-		res.writeHead(206, {
-			...baseHeaders,
-			"content-range": `bytes ${range.start}-${range.end}/${size}`,
-			"content-length": String(range.end - range.start + 1)
-		});
-		if (req.method === "HEAD") {
-			res.end();
-			return;
-		}
-		(0, node_fs.createReadStream)(absPath, {
-			start: range.start,
-			end: range.end
-		}).pipe(res);
-		return;
-	}
-	res.writeHead(200, {
-		...baseHeaders,
-		"content-length": String(size)
-	});
-	if (req.method === "HEAD") {
-		res.end();
-		return;
-	}
-	(0, node_fs.createReadStream)(absPath).pipe(res);
-}
-//#endregion
 //#region src/http/data-plane-registry.ts
 function trimSlashes(s) {
 	return s.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -389,459 +182,8 @@ function proxyToUpstream(opts) {
 	clientReq.pipe(upstream);
 }
 //#endregion
-//#region src/http/file-data-plane.ts
-/**
-* A ready-made data-plane request handler that serves files from a set of roots
-* with HTTP `Range`, for addons whose data-plane is "stream files off disk"
-* (recording playback, scrub-frame stores, exported clips).
-*
-* This is the addon-side handler the addon hands to `ctx.dataPlane.serve({ handler })`.
-* It receives the REAL Node `req`/`res`, resolves the request path against the
-* addon's roots (traversal-guarded), and streams the file. NO token and NO CORS:
-* the hub already authenticated the caller and the data plane is same-origin
-* through the hub's port. Reuses the shared Range/content-type/traversal helpers
-* so there is one implementation across the standalone file-server and this.
-*/
-/** Build a `(req, res)` handler that serves `getRoots()` files with Range. */
-function createFileDataPlaneHandler(opts) {
-	return async (req, res) => {
-		if (req.method !== "GET" && req.method !== "HEAD") {
-			res.writeHead(405).end();
-			return;
-		}
-		const urlPath = (req.url ?? "/").split("?")[0] ?? "/";
-		let rel;
-		try {
-			rel = decodeURIComponent(urlPath.replace(/^\/+/, ""));
-		} catch {
-			res.writeHead(400).end();
-			return;
-		}
-		if (rel.length === 0) {
-			res.writeHead(404).end();
-			return;
-		}
-		const resolved = resolveFilePath(opts.getRoots(), rel);
-		if ("error" in resolved) {
-			res.writeHead(403).end();
-			return;
-		}
-		let absPath = null;
-		let size = 0;
-		for (const candidate of resolved.candidates) try {
-			const st = await node_fs.promises.stat(candidate);
-			if (st.isFile()) {
-				absPath = candidate;
-				size = st.size;
-				break;
-			}
-		} catch {}
-		if (absPath === null) {
-			res.writeHead(404).end();
-			return;
-		}
-		const baseHeaders = {
-			"content-type": contentTypeFor(absPath, opts.contentTypes),
-			"accept-ranges": "bytes",
-			"cache-control": "no-cache"
-		};
-		const range = parseRangeHeader(req.headers.range, size);
-		if (range) {
-			res.writeHead(206, {
-				...baseHeaders,
-				"content-range": `bytes ${range.start}-${range.end}/${size}`,
-				"content-length": String(range.end - range.start + 1)
-			});
-			if (req.method === "HEAD") {
-				res.end();
-				return;
-			}
-			(0, node_fs.createReadStream)(absPath, {
-				start: range.start,
-				end: range.end
-			}).pipe(res);
-			return;
-		}
-		res.writeHead(200, {
-			...baseHeaders,
-			"content-length": String(size)
-		});
-		if (req.method === "HEAD") {
-			res.end();
-			return;
-		}
-		(0, node_fs.createReadStream)(absPath).pipe(res);
-	};
-}
-//#endregion
-//#region src/download/model-downloader.ts
-/** Build fetch headers, including HF auth token for huggingface.co URLs */
-function buildHeaders(url) {
-	const headers = { "User-Agent": "CamStack/1.0" };
-	const hfToken = process.env["HF_TOKEN"] ?? process.env["HUGGING_FACE_HUB_TOKEN"];
-	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
-	return headers;
-}
-/**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
-*/
-async function downloadFile(url, destPath, onProgress) {
-	if (node_fs.existsSync(destPath)) return destPath;
-	node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
-	const tmpPath = destPath + ".downloading";
-	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
-		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
-		if (!response.body) throw new Error(`No response body from ${url}`);
-		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
-		let downloaded = 0;
-		const fileStream = node_fs.createWriteStream(tmpPath);
-		const reader = response.body.getReader();
-		try {
-			for (;;) {
-				const { done, value } = await reader.read();
-				if (done || !value) break;
-				fileStream.write(value);
-				downloaded += value.length;
-				onProgress?.(downloaded, total);
-			}
-		} finally {
-			fileStream.end();
-			await new Promise((resolve, reject) => {
-				fileStream.on("finish", resolve);
-				fileStream.on("error", reject);
-			});
-		}
-		node_fs.renameSync(tmpPath, destPath);
-		return destPath;
-	} catch (err) {
-		try {
-			node_fs.unlinkSync(tmpPath);
-		} catch {}
-		throw err;
-	}
-}
-/**
-* Fetch JSON from a URL using native fetch().
-*/
-async function fetchJson(url) {
-	const response = await fetch(url, {
-		redirect: "follow",
-		headers: buildHeaders(url)
-	});
-	if (!response.ok) throw new Error(`HTTP ${response.status} fetching ${url}`);
-	return response.json();
-}
-/**
-* Download a model with fallback URLs and optional SHA256 verification.
-* Legacy API preserved for backward compatibility -- delegates to downloadFile().
-*/
-async function downloadModel(options) {
-	const { url, fallbackUrls = [], destDir, filename, expectedSha256, onProgress } = options;
-	const fname = filename ?? url.split("/").pop() ?? "model.bin";
-	const destPath = node_path.join(destDir, fname);
-	if (node_fs.existsSync(destPath)) return {
-		filePath: destPath,
-		downloadedBytes: 0,
-		fromCache: true
-	};
-	node_fs.mkdirSync(destDir, { recursive: true });
-	const urls = [url, ...fallbackUrls];
-	let lastError = null;
-	for (const tryUrl of urls) try {
-		await downloadFile(tryUrl, destPath, onProgress);
-		if (expectedSha256) {
-			const hash = await computeSha256(destPath);
-			if (hash !== expectedSha256) {
-				node_fs.unlinkSync(destPath);
-				throw new Error(`SHA256 mismatch: expected ${expectedSha256}, got ${hash}`);
-			}
-		}
-		return {
-			filePath: destPath,
-			downloadedBytes: node_fs.statSync(destPath).size,
-			fromCache: false
-		};
-	} catch (e) {
-		lastError = e;
-		if (node_fs.existsSync(destPath)) node_fs.unlinkSync(destPath);
-	}
-	throw lastError ?? /* @__PURE__ */ new Error(`Failed to download model from ${url}`);
-}
-async function computeSha256(filePath) {
-	return new Promise((resolve, reject) => {
-		const hash = (0, node_crypto.createHash)("sha256");
-		const stream = node_fs.createReadStream(filePath);
-		stream.on("data", (chunk) => hash.update(chunk));
-		stream.on("end", () => resolve(hash.digest("hex")));
-		stream.on("error", reject);
-	});
-}
-/**
-* Download every file in a HuggingFace directory bundle (e.g.,
-* `.mlpackage` / OpenVINO IR pair) atomically. `knownFiles` lists the
-* relative paths inside the directory; the function fetches each from
-* `${url}/${file}` and renames the staging directory only on full
-* success. Mirrors `ModelDownloadService.downloadDirectory` but
-* exposed as a standalone for catalog-less callers.
-*/
-async function downloadDirectory(url, destDir, knownFiles, onProgress) {
-	const match = url.match(/huggingface\.co\/([^/]+\/[^/]+)\/resolve\/main\/(.+)/);
-	if (!match) throw new Error(`Cannot parse HuggingFace URL: ${url}`);
-	const [, repo, dirPath] = match;
-	const files = (knownFiles ?? []).map((f) => ({
-		relativePath: f,
-		fileUrl: `https://huggingface.co/${repo}/resolve/main/${dirPath}/${f}`
-	}));
-	if (files.length === 0) throw new Error(`Directory bundle requires explicit \`files\` list (got none for ${url})`);
-	const tmpDir = destDir + ".downloading";
-	node_fs.rmSync(tmpDir, {
-		recursive: true,
-		force: true
-	});
-	node_fs.mkdirSync(tmpDir, { recursive: true });
-	let totalDownloaded = 0;
-	try {
-		for (const file of files) {
-			const destPath = node_path.join(tmpDir, file.relativePath);
-			node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
-			await downloadFile(file.fileUrl, destPath, (downloaded, _total) => {
-				onProgress?.(totalDownloaded + downloaded, void 0);
-			});
-			totalDownloaded += node_fs.statSync(destPath).size;
-		}
-		node_fs.rmSync(destDir, {
-			recursive: true,
-			force: true
-		});
-		node_fs.renameSync(tmpDir, destDir);
-	} catch (err) {
-		node_fs.rmSync(tmpDir, {
-			recursive: true,
-			force: true
-		});
-		throw err;
-	}
-}
-/**
-* Resolve a `ModelCatalogEntry` against `modelsDir`: download model file
-* (or directory bundle) + extra files (labels JSON, charset dict, …),
-* skip if already on disk. Returns the local model path.
-*/
-async function ensureModel(modelsDir, entry, format, onProgress) {
-	const formatEntry = entry.formats[format];
-	if (!formatEntry) throw new Error(`Model "${entry.id}" has no ${format} format. Available: ${Object.keys(entry.formats).join(", ")}`);
-	if (entry.extraFiles) for (const extra of entry.extraFiles) await downloadFile(extra.url, node_path.join(modelsDir, extra.filename));
-	const filename = formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`;
-	const modelPath = node_path.join(modelsDir, filename);
-	if (node_fs.existsSync(modelPath)) if (formatEntry.isDirectory && !node_fs.existsSync(node_path.join(modelPath, "Manifest.json"))) node_fs.rmSync(modelPath, {
-		recursive: true,
-		force: true
-	});
-	else return modelPath;
-	node_fs.mkdirSync(modelsDir, { recursive: true });
-	if (formatEntry.isDirectory) await downloadDirectory(formatEntry.url, modelPath, formatEntry.files, onProgress);
-	else await downloadFile(formatEntry.url, modelPath, (downloaded, total) => onProgress?.(downloaded, total === 0 ? void 0 : total));
-	return modelPath;
-}
-/** Compute the on-disk path for a given model + format, even when not yet downloaded. */
-function getModelFilePath(modelsDir, entry, format) {
-	const formatEntry = entry.formats[format];
-	if (!formatEntry) return null;
-	const filename = formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`;
-	return node_path.join(modelsDir, filename);
-}
-/** True iff the model file (or `Manifest.json` for directory bundles) exists and is non-empty. */
-function isModelDownloaded(modelsDir, entry, format) {
-	const formatEntry = entry.formats[format];
-	if (!formatEntry) return false;
-	const modelPath = getModelFilePath(modelsDir, entry, format);
-	if (!modelPath || !node_fs.existsSync(modelPath)) return false;
-	if (formatEntry.isDirectory) return node_fs.existsSync(node_path.join(modelPath, "Manifest.json"));
-	return node_fs.statSync(modelPath).size > 0;
-}
-/** Remove the on-disk model file/directory. Returns true if something was deleted. */
-function deleteModelFromDisk(modelsDir, entry, format) {
-	const modelPath = getModelFilePath(modelsDir, entry, format);
-	if (!modelPath || !node_fs.existsSync(modelPath)) return false;
-	if (entry.formats[format]?.isDirectory) node_fs.rmSync(modelPath, {
-		recursive: true,
-		force: true
-	});
-	else node_fs.unlinkSync(modelPath);
-	return true;
-}
-//#endregion
-//#region src/download/model-download-service.ts
-/**
-* Unified model download service.
-*
-* Handles downloading model files and extra files (labels, dicts) from a
-* catalog of ModelCatalogEntry items. Supports single-file models and
-* directory bundles (e.g., .mlpackage for CoreML).
-*
-* Addons use this via `context.models.ensure(modelId, format)`.
-*/
-var ModelDownloadService = class {
-	modelsDir;
-	onProgress;
-	catalog;
-	constructor(modelsDir, catalog, onProgress) {
-		this.modelsDir = modelsDir;
-		this.onProgress = onProgress;
-		const map = /* @__PURE__ */ new Map();
-		for (const entry of catalog) map.set(entry.id, entry);
-		this.catalog = map;
-	}
-	/**
-	* Ensure a model (and its extra files) is downloaded.
-	* Returns the local filesystem path to the model file/directory.
-	*/
-	async ensure(modelId, format) {
-		const entry = this.catalog.get(modelId);
-		if (!entry) throw new Error(`ModelDownloadService: unknown model "${modelId}"`);
-		const selectedFormat = format ?? this.pickDefaultFormat(entry);
-		const formatEntry = entry.formats[selectedFormat];
-		if (!formatEntry) throw new Error(`ModelDownloadService: model "${modelId}" has no ${selectedFormat} format`);
-		await this.ensureExtraFiles(modelId);
-		const modelPath = this.modelFilePath(entry, selectedFormat);
-		if (node_fs.existsSync(modelPath)) if (formatEntry.isDirectory) if (!node_fs.existsSync(node_path.join(modelPath, "Manifest.json"))) node_fs.rmSync(modelPath, {
-			recursive: true,
-			force: true
-		});
-		else return modelPath;
-		else return modelPath;
-		node_fs.mkdirSync(this.modelsDir, { recursive: true });
-		if (formatEntry.isDirectory) await this.downloadDirectory(formatEntry.url, modelPath, formatEntry.files, modelId);
-		else await downloadFile(formatEntry.url, modelPath, this.onProgress ? (downloaded, total) => this.onProgress(modelId, downloaded, total) : void 0);
-		return modelPath;
-	}
-	/**
-	* Ensure extra files for a model are downloaded.
-	* Returns the local paths of all extra files.
-	*/
-	async ensureExtraFiles(modelId) {
-		const entry = this.catalog.get(modelId);
-		if (!entry) throw new Error(`ModelDownloadService: unknown model "${modelId}"`);
-		const extras = entry.extraFiles;
-		if (!extras || extras.length === 0) return [];
-		const paths = [];
-		for (const extra of extras) {
-			const destPath = node_path.join(this.modelsDir, extra.filename);
-			await downloadFile(extra.url, destPath);
-			paths.push(destPath);
-		}
-		return paths;
-	}
-	/** Absolute path to the shared models directory. */
-	getModelsDir() {
-		return this.modelsDir;
-	}
-	/** Check if a model file is already present on disk. */
-	isDownloaded(modelId, format) {
-		const entry = this.catalog.get(modelId);
-		if (!entry) return false;
-		const selectedFormat = format ?? this.pickDefaultFormat(entry);
-		const formatEntry = entry.formats[selectedFormat];
-		if (!formatEntry) return false;
-		const modelPath = this.modelFilePath(entry, selectedFormat);
-		if (!node_fs.existsSync(modelPath)) return false;
-		if (formatEntry.isDirectory) return node_fs.existsSync(node_path.join(modelPath, "Manifest.json"));
-		return node_fs.statSync(modelPath).size > 0;
-	}
-	/** Get the catalog entry for a model by ID. */
-	getEntry(modelId) {
-		return this.catalog.get(modelId);
-	}
-	pickDefaultFormat(entry) {
-		for (const fmt of [
-			"onnx",
-			"coreml",
-			"openvino",
-			"tflite",
-			"pt"
-		]) if (entry.formats[fmt]) return fmt;
-		const first = Object.keys(entry.formats)[0];
-		if (first) return first;
-		throw new Error(`ModelDownloadService: model "${entry.id}" has no formats`);
-	}
-	modelFilePath(entry, format) {
-		const formatEntry = entry.formats[format];
-		if (!formatEntry) throw new Error(`Model ${entry.id} has no ${format} format`);
-		const urlParts = formatEntry.url.split("/");
-		const filename = urlParts[urlParts.length - 1] ?? `${entry.id}.${format}`;
-		return node_path.join(this.modelsDir, filename);
-	}
-	/**
-	* Download a directory bundle (e.g., .mlpackage) from HuggingFace.
-	* ATOMIC: downloads to temp dir, renames only on complete success.
-	*/
-	async downloadDirectory(url, destDir, knownFiles, _modelId) {
-		const match = url.match(/huggingface\.co\/([^/]+\/[^/]+)\/resolve\/main\/(.+)/);
-		if (!match) throw new Error(`Cannot parse HuggingFace URL: ${url}`);
-		const [, repo, dirPath] = match;
-		let filesToDownload;
-		if (knownFiles && knownFiles.length > 0) filesToDownload = knownFiles.map((f) => ({
-			relativePath: f,
-			fileUrl: `https://huggingface.co/${repo}/resolve/main/${dirPath}/${f}`
-		}));
-		else {
-			const hfFiles = await this.listHfFiles(repo, dirPath);
-			if (hfFiles.length === 0) throw new Error(`No files found in HuggingFace directory: ${dirPath}`);
-			filesToDownload = hfFiles.map((f) => ({
-				relativePath: f.path.substring(dirPath.length + 1),
-				fileUrl: `https://huggingface.co/${repo}/resolve/main/${f.path}`
-			}));
-		}
-		const tmpDir = destDir + ".downloading";
-		node_fs.rmSync(tmpDir, {
-			recursive: true,
-			force: true
-		});
-		node_fs.mkdirSync(tmpDir, { recursive: true });
-		try {
-			for (const file of filesToDownload) {
-				const destPath = node_path.join(tmpDir, file.relativePath);
-				node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
-				await downloadFile(file.fileUrl, destPath);
-			}
-			node_fs.rmSync(destDir, {
-				recursive: true,
-				force: true
-			});
-			node_fs.renameSync(tmpDir, destDir);
-		} catch (err) {
-			node_fs.rmSync(tmpDir, {
-				recursive: true,
-				force: true
-			});
-			throw err;
-		}
-	}
-	/** Recursively list all files in a HuggingFace directory via API. */
-	async listHfFiles(repo, dirPath) {
-		const entries = await fetchJson(`https://huggingface.co/api/models/${repo}/tree/main/${dirPath}`);
-		const files = [];
-		for (const entry of entries) if (entry.type === "file") files.push({
-			path: entry.path,
-			size: entry.size ?? entry.lfs?.size ?? 0
-		});
-		else if (entry.type === "directory") {
-			const subFiles = await this.listHfFiles(repo, entry.path);
-			files.push(...subFiles);
-		}
-		return files;
-	}
-};
-//#endregion
 //#region src/python/python-env-manager.ts
-var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
 var PythonEnvManager = class {
 	venvPath;
 	cachedProbe = null;
@@ -851,12 +193,12 @@ var PythonEnvManager = class {
 	async probe() {
 		if (this.cachedProbe) return this.cachedProbe;
 		for (const cmd of ["python3", "python"]) try {
-			const { stdout } = await execFileAsync$2(cmd, ["--version"]);
+			const { stdout } = await execFileAsync$3(cmd, ["--version"]);
 			const version = stdout.trim().replace("Python ", "");
 			const major = parseInt(version.split(".")[0] ?? "0", 10);
 			const minor = parseInt(version.split(".")[1] ?? "0", 10);
 			if (major < 3 || major === 3 && minor < 10) continue;
-			const { stdout: pathOut } = await execFileAsync$2(cmd, ["-c", "import sys; print(sys.executable)"]);
+			const { stdout: pathOut } = await execFileAsync$3(cmd, ["-c", "import sys; print(sys.executable)"]);
 			this.cachedProbe = {
 				available: true,
 				version,
@@ -872,13 +214,13 @@ var PythonEnvManager = class {
 	async ensure(options) {
 		const probe = await this.probe();
 		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$2(probe.path, [
+		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$3(probe.path, [
 			"-m",
 			"venv",
 			this.venvPath
 		]);
 		const venvPython = node_path.join(this.venvPath, "bin", "python");
-		if (options.packages.length > 0) await execFileAsync$2(venvPython, [
+		if (options.packages.length > 0) await execFileAsync$3(venvPython, [
 			"-m",
 			"pip",
 			"install",
@@ -2077,12 +1419,11 @@ var StorageManager = class {
 		return namespace ? this.createNamespacedLocation(location, namespace) : location;
 	}
 	createLegacyShim() {
-		const self = this;
 		return {
 			async initialize() {},
 			async shutdown() {},
-			getLocation(name) {
-				return self.getLocation(name);
+			getLocation: (name) => {
+				return this.getLocation(name);
 			}
 		};
 	}
@@ -2358,7 +1699,7 @@ function matchPath(pattern, path) {
 }
 //#endregion
 //#region src/tls/cert-manager.ts
-var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Ensure a self-signed TLS certificate exists in the given directory.
 * Generates one if missing. Returns paths to cert and key files.
@@ -2395,7 +1736,7 @@ async function ensureTlsCert(dataDir, options) {
 	for (const dns of sanDns) sanParts.push(`DNS:${dns}`);
 	for (const ip of sanIps) sanParts.push(`IP:${ip}`);
 	const sanString = sanParts.join(",");
-	await execFileAsync$1("openssl", [
+	await execFileAsync$2("openssl", [
 		"req",
 		"-x509",
 		"-newkey",
@@ -3228,6 +2569,7 @@ var AddonEngineManager = class {
 };
 //#endregion
 //#region src/kernel/fs-utils.ts
+var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Ensure a directory exists (recursive).
 * Single source of truth — replaces scattered mkdirSync calls.
@@ -3236,18 +2578,20 @@ function ensureDir(dirPath) {
 	node_fs.mkdirSync(dirPath, { recursive: true });
 }
 /**
-* Copy a directory recursively.
-* Single source of truth — extracted from addon-installer + first-boot-installer.
+* Copy a directory recursively — ASYNC so it never blocks the event loop.
+*
+* The hub installs addons into `/data/addons`, which on Unraid is a slow
+* shfs/FUSE mount. The former synchronous `fs.copyFileSync`-per-file loop
+* blocked the Node event loop for the whole copy of a large bundle (e.g.
+* `addon-pipeline`), which froze the hub's HTTP listener mid-`camstack deploy`
+* (accept backlog piling up, existing connections stuck in CLOSE_WAIT). Using
+* `fs.promises.cp` keeps the I/O off the event loop. (Node ≥18 stable.)
 */
-function copyDirRecursive(src, dest) {
-	ensureDir(dest);
-	const entries = node_fs.readdirSync(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = node_path.join(src, entry.name);
-		const destPath = node_path.join(dest, entry.name);
-		if (entry.isDirectory()) copyDirRecursive(srcPath, destPath);
-		else node_fs.copyFileSync(srcPath, destPath);
-	}
+async function copyDirRecursive(src, dest) {
+	await node_fs.promises.cp(src, dest, {
+		recursive: true,
+		force: true
+	});
 }
 /**
 * Strip @camstack/* dependencies and devDependencies from a package.json object.
@@ -3277,7 +2621,7 @@ function stripCamstackDeps(pkg) {
 * Copies directories (not individual files) from source to destination.
 * Skips "dist" (already handled) and glob patterns.
 */
-function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
+async function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 	const rawFiles = pkgJson.files;
 	if (!Array.isArray(rawFiles)) return;
 	for (const fileEntry of rawFiles) {
@@ -3286,11 +2630,11 @@ function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 		const srcPath = node_path.join(sourceDir, fileEntry);
 		if (!node_fs.existsSync(srcPath)) continue;
 		const destPath = node_path.join(destDir, fileEntry);
-		const stat = node_fs.statSync(srcPath);
-		if (stat.isDirectory()) copyDirRecursive(srcPath, destPath);
+		const stat = await node_fs.promises.stat(srcPath);
+		if (stat.isDirectory()) await copyDirRecursive(srcPath, destPath);
 		else if (stat.isFile()) {
 			ensureDir(node_path.dirname(destPath));
-			node_fs.copyFileSync(srcPath, destPath);
+			await node_fs.promises.copyFile(srcPath, destPath);
 		}
 	}
 }
@@ -3335,12 +2679,16 @@ function ensureLibraryBuilt(packageName, packagesDir) {
 /**
 * Install a single npm package into a target directory (package.json + dist/).
 * No validation on camstack.addons -- works for any @camstack/* package.
-* Uses synchronous child_process calls (suitable for first-boot and update paths).
+*
+* ASYNC: uses `execFile`/`fs.promises` throughout so a package install on a
+* live node never blocks the event loop (the `npm pack` + tar extract + copy to
+* the slow shfs/FUSE `/data` would otherwise freeze the HTTP listener). See
+* `copyDirRecursive` for the wedge this prevents.
 */
-function installPackageFromNpmSync(packageName, targetDir) {
-	const tmpDir = node_fs.mkdtempSync(node_path.join(node_os.tmpdir(), "camstack-install-"));
+async function installPackageFromNpm(packageName, targetDir) {
+	const tmpDir = await node_fs.promises.mkdtemp(node_path.join(node_os.tmpdir(), "camstack-install-"));
 	try {
-		const tgzFilename = (0, node_child_process.execFileSync)("npm", [
+		const { stdout } = await execFileAsync$1("npm", [
 			"pack",
 			packageName,
 			"--pack-destination",
@@ -3348,12 +2696,13 @@ function installPackageFromNpmSync(packageName, targetDir) {
 		], {
 			timeout: 12e4,
 			encoding: "utf-8"
-		}).trim().split("\n").pop()?.trim();
+		});
+		const tgzFilename = stdout.trim().split("\n").pop()?.trim();
 		if (!tgzFilename) throw new Error("npm pack produced no output");
 		const tgzPath = node_path.join(tmpDir, tgzFilename);
 		const extractDir = node_path.join(tmpDir, "extracted");
 		ensureDir(extractDir);
-		(0, node_child_process.execFileSync)("tar", [
+		await execFileAsync$1("tar", [
 			"-xzf",
 			tgzPath,
 			"-C",
@@ -3361,20 +2710,20 @@ function installPackageFromNpmSync(packageName, targetDir) {
 		], { timeout: 3e4 });
 		const packageSubDir = node_path.join(extractDir, "package");
 		const srcPkgJsonDir = node_fs.existsSync(node_path.join(packageSubDir, "package.json")) ? packageSubDir : extractDir;
-		node_fs.rmSync(targetDir, {
+		await node_fs.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		node_fs.copyFileSync(node_path.join(srcPkgJsonDir, "package.json"), node_path.join(targetDir, "package.json"));
+		await node_fs.promises.copyFile(node_path.join(srcPkgJsonDir, "package.json"), node_path.join(targetDir, "package.json"));
 		const distSrc = node_path.join(srcPkgJsonDir, "dist");
-		if (node_fs.existsSync(distSrc)) copyDirRecursive(distSrc, node_path.join(targetDir, "dist"));
+		if (node_fs.existsSync(distSrc)) await copyDirRecursive(distSrc, node_path.join(targetDir, "dist"));
 		try {
-			const npmPkg = (0, _camstack_types.asJsonObject)((0, _camstack_types.parseJsonUnknown)(node_fs.readFileSync(node_path.join(srcPkgJsonDir, "package.json"), "utf-8")));
-			if (npmPkg) copyExtraFileDirs(npmPkg, srcPkgJsonDir, targetDir);
+			const npmPkg = (0, _camstack_types.asJsonObject)((0, _camstack_types.parseJsonUnknown)(await node_fs.promises.readFile(node_path.join(srcPkgJsonDir, "package.json"), "utf-8")));
+			if (npmPkg) await copyExtraFileDirs(npmPkg, srcPkgJsonDir, targetDir);
 		} catch {}
 	} finally {
-		node_fs.rmSync(tmpDir, {
+		await node_fs.promises.rm(tmpDir, {
 			recursive: true,
 			force: true
 		});
@@ -3824,15 +3173,15 @@ var AddonInstaller = class AddonInstaller {
 		await this.ensureBuilt(packageName, sourceDir, pkgData);
 		const distDir = node_path.join(sourceDir, "dist");
 		if (!node_fs.existsSync(distDir)) throw new Error(`${packageName} has no dist/ after build`);
-		node_fs.rmSync(targetDir, {
+		await node_fs.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		node_fs.writeFileSync(node_path.join(targetDir, "package.json"), JSON.stringify(stripCamstackDeps(pkgData), null, 2));
-		copyDirRecursive(distDir, node_path.join(targetDir, "dist"));
-		copyExtraFileDirs(pkgData, sourceDir, targetDir);
-		node_fs.writeFileSync(node_path.join(targetDir, ".install-source"), "local");
+		await node_fs.promises.writeFile(node_path.join(targetDir, "package.json"), JSON.stringify(stripCamstackDeps(pkgData), null, 2));
+		await copyDirRecursive(distDir, node_path.join(targetDir, "dist"));
+		await copyExtraFileDirs(pkgData, sourceDir, targetDir);
+		await node_fs.promises.writeFile(node_path.join(targetDir, ".install-source"), "local");
 		const localPkgVersion = (0, _camstack_types.asString)(pkgData.version, "0.0.0");
 		this.manifest.upsert(packageName, {
 			version: localPkgVersion,
@@ -3952,17 +3301,17 @@ var AddonInstaller = class AddonInstaller {
 			if (!pkgView) throw new Error(`Invalid package.json at ${pkgJsonPath}`);
 			if (!pkgView.camstackAddons) throw new Error(`Package ${pkgView.name} has no camstack.addons manifest`);
 			const targetDir = node_path.join(this.addonsDir, pkgView.name);
-			node_fs.rmSync(targetDir, {
+			await node_fs.promises.rm(targetDir, {
 				recursive: true,
 				force: true
 			});
 			ensureDir(targetDir);
 			const sourceDir = node_path.dirname(pkgJsonPath);
 			const strippedManifest = stripCamstackDeps(pkgView.raw);
-			node_fs.writeFileSync(node_path.join(targetDir, "package.json"), JSON.stringify(strippedManifest, null, 2));
+			await node_fs.promises.writeFile(node_path.join(targetDir, "package.json"), JSON.stringify(strippedManifest, null, 2));
 			const sourceDist = node_path.join(sourceDir, "dist");
-			if (node_fs.existsSync(sourceDist)) copyDirRecursive(sourceDist, node_path.join(targetDir, "dist"));
-			copyExtraFileDirs(pkgView.raw, sourceDir, targetDir);
+			if (node_fs.existsSync(sourceDist)) await copyDirRecursive(sourceDist, node_path.join(targetDir, "dist"));
+			await copyExtraFileDirs(pkgView.raw, sourceDir, targetDir);
 			const strippedRuntimeDeps = strippedManifest["dependencies"];
 			if (strippedRuntimeDeps != null && typeof strippedRuntimeDeps === "object" && Object.keys(strippedRuntimeDeps).length > 0) {
 				this.logger.info(`${pkgView.name} — installing runtime dependencies`, { meta: { targetDir } });
@@ -3986,7 +3335,7 @@ var AddonInstaller = class AddonInstaller {
 			try {
 				await require_manifest_python_deps.installManifestNativeDeps(targetDir, pkgView.raw, this.logger, this.registry);
 			} catch (nativeErr) {
-				node_fs.rmSync(targetDir, {
+				await node_fs.promises.rm(targetDir, {
 					recursive: true,
 					force: true
 				});
@@ -4001,7 +3350,7 @@ var AddonInstaller = class AddonInstaller {
 				version: pkgView.version
 			};
 		} finally {
-			node_fs.rmSync(tmpDir, {
+			await node_fs.promises.rm(tmpDir, {
 				recursive: true,
 				force: true
 			});
@@ -4769,7 +4118,7 @@ var CapabilityRegistry = class CapabilityRegistry {
 		const bare = this.bareAddonId(addonId);
 		const nodeMap = this.singletonNodeOverrides.get(capabilityName);
 		if (nodeMap) {
-			for (const [nodeId, ov] of [...nodeMap]) if (ov === bare) nodeMap.delete(nodeId);
+			for (const [nodeId, ov] of Array.from(nodeMap)) if (ov === bare) nodeMap.delete(nodeId);
 			if (nodeMap.size === 0) this.singletonNodeOverrides.delete(capabilityName);
 		}
 		this.logger.info("Provider unregistered from capability", {
@@ -8031,7 +7380,7 @@ var ConfigManager = class ConfigManager {
 	constructor(configPath) {
 		this.configPath = configPath;
 		const rawYaml = this.loadYaml();
-		const merged = this.applyEnvOverrides((0, _camstack_types.asJsonObject)(rawYaml) ?? {});
+		const merged = this.applyEnvOverrides((0, _camstack_types_addon.asJsonObject)(rawYaml) ?? {});
 		this.bootstrapConfig = bootstrapSchema.parse(merged);
 		this.warnDefaultCredentials();
 		const dataPath = this.bootstrapConfig.server.dataPath ?? "camstack-data";
@@ -8046,20 +7395,20 @@ var ConfigManager = class ConfigManager {
 	setSettingsStore(store) {
 		this.settingsStore = store;
 	}
-	get(path) {
-		return this.resolveConfigValue(path);
+	get(configPath) {
+		return this.resolveConfigValue(configPath);
 	}
-	resolveConfigValue(path) {
-		const bootstrapValue = this.getFromBootstrap(path);
+	resolveConfigValue(configPath) {
+		const bootstrapValue = this.getFromBootstrap(configPath);
 		if (bootstrapValue !== void 0) return bootstrapValue;
 		if (this.settingsStore !== null) {
-			const storeValue = this.settingsStore.getSystem(path);
+			const storeValue = this.settingsStore.getSystem(configPath);
 			if (storeValue !== void 0) return storeValue;
-			const nested = this.getNestedFromSystemSettings(path);
+			const nested = this.getNestedFromSystemSettings(configPath);
 			if (nested !== null) return nested;
 		}
-		if (path in _camstack_types.RUNTIME_DEFAULTS) return _camstack_types.RUNTIME_DEFAULTS[path];
-		return this.getFromRuntimeDefaults(path) ?? void 0;
+		if (configPath in _camstack_types.RUNTIME_DEFAULTS) return _camstack_types.RUNTIME_DEFAULTS[configPath];
+		return this.getFromRuntimeDefaults(configPath) ?? void 0;
 	}
 	/**
 	* Write a value to the settings-store.
@@ -8086,9 +7435,9 @@ var ConfigManager = class ConfigManager {
 	*/
 	getSection(section) {
 		const merged = {};
-		const defaults = (0, _camstack_types.asJsonObject)(this.getFromRuntimeDefaults(section));
+		const defaults = (0, _camstack_types_addon.asJsonObject)(this.getFromRuntimeDefaults(section));
 		if (defaults) Object.assign(merged, defaults);
-		const bootstrapSection = (0, _camstack_types.asJsonObject)({ ...this.bootstrapConfig }[section]);
+		const bootstrapSection = (0, _camstack_types_addon.asJsonObject)({ ...this.bootstrapConfig }[section]);
 		if (bootstrapSection) Object.assign(merged, bootstrapSection);
 		if (this.settingsStore !== null) {
 			const nested = this.getNestedFromSystemSettings(section);
@@ -8107,7 +7456,7 @@ var ConfigManager = class ConfigManager {
 	/** Read all config for an addon from addon_settings. */
 	getAddonConfig(addonId) {
 		if (this.settingsStore !== null) return this.settingsStore.getAllAddon(addonId);
-		return (0, _camstack_types.asJsonObject)(this.getFromBootstrap(`addons.${addonId}`)) ?? {};
+		return (0, _camstack_types_addon.asJsonObject)(this.getFromBootstrap(`addons.${addonId}`)) ?? {};
 	}
 	/** Write (bulk-replace) config for an addon to addon_settings. */
 	setAddonConfig(addonId, config) {
@@ -8275,8 +7624,8 @@ var ConfigManager = class ConfigManager {
 		};
 		this.saveRuntimeState();
 	}
-	getBootstrap(path) {
-		return this.getFromBootstrap(path);
+	getBootstrap(configPath) {
+		return this.getFromBootstrap(configPath);
 	}
 	/** Features accessor -- reads from settings-store when available, falls back to RUNTIME_DEFAULTS */
 	get features() {
@@ -8345,8 +7694,8 @@ var ConfigManager = class ConfigManager {
 	update(section, data) {
 		if (!ConfigManager.BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
 		let raw = {};
-		if (node_fs.existsSync(this.configPath)) raw = (0, _camstack_types.asJsonObject)(load$1(node_fs.readFileSync(this.configPath, "utf-8"))) ?? {};
-		const existing = (0, _camstack_types.asJsonObject)(raw[section]) ?? {};
+		if (node_fs.existsSync(this.configPath)) raw = (0, _camstack_types_addon.asJsonObject)(load$1(node_fs.readFileSync(this.configPath, "utf-8"))) ?? {};
+		const existing = (0, _camstack_types_addon.asJsonObject)(raw[section]) ?? {};
 		raw[section] = {
 			...existing,
 			...data
@@ -8366,8 +7715,8 @@ var ConfigManager = class ConfigManager {
 	* Deep-set a value in a nested plain object using a dot-notation path.
 	* Returns a new object (immutable).
 	*/
-	setNested(obj, path, value) {
-		const [head, ...rest] = path.split(".");
+	setNested(obj, configPath, value) {
+		const [head, ...rest] = configPath.split(".");
 		if (!head) return obj;
 		if (rest.length === 0) return {
 			...obj,
@@ -8407,8 +7756,8 @@ var ConfigManager = class ConfigManager {
 	warnDefaultCredentials() {
 		if (this.bootstrapConfig.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
 	}
-	getFromBootstrap(path) {
-		const keys = path.split(".");
+	getFromBootstrap(configPath) {
+		const keys = configPath.split(".");
 		let current = this.bootstrapConfig;
 		for (const key of keys) {
 			if (!isRecord(current)) return void 0;
@@ -8416,8 +7765,8 @@ var ConfigManager = class ConfigManager {
 		}
 		return current;
 	}
-	getFromRuntimeDefaults(path) {
-		const prefix = path + ".";
+	getFromRuntimeDefaults(configPath) {
+		const prefix = configPath + ".";
 		const result = {};
 		let found = false;
 		for (const [key, value] of Object.entries(_camstack_types.RUNTIME_DEFAULTS)) if (key.startsWith(prefix)) {
@@ -8432,10 +7781,10 @@ var ConfigManager = class ConfigManager {
 	* e.g. path='features' matches keys 'features.streaming', 'features.notifications', etc.
 	* Returns an object keyed by the sub-key, or undefined if nothing is found.
 	*/
-	getNestedFromSystemSettings(path) {
+	getNestedFromSystemSettings(configPath) {
 		if (this.settingsStore === null) return null;
 		const all = this.settingsStore.getAllSystem();
-		const prefix = path + ".";
+		const prefix = configPath + ".";
 		const result = {};
 		let found = false;
 		for (const [key, value] of Object.entries(all)) if (key.startsWith(prefix)) {
@@ -8447,13 +7796,13 @@ var ConfigManager = class ConfigManager {
 	loadRuntimeState() {
 		if (!node_fs.existsSync(this.runtimeStatePath)) return EMPTY_RUNTIME_STATE;
 		try {
-			const parsed = (0, _camstack_types.asJsonObject)((0, _camstack_types.parseJsonUnknown)(node_fs.readFileSync(this.runtimeStatePath, "utf-8")));
+			const parsed = (0, _camstack_types_addon.asJsonObject)((0, _camstack_types_addon.parseJsonUnknown)(node_fs.readFileSync(this.runtimeStatePath, "utf-8")));
 			if (parsed === null) return EMPTY_RUNTIME_STATE;
-			const systemActivation = (0, _camstack_types.asJsonObject)(parsed.systemActivation) ?? {};
-			const deviceActivationRaw = (0, _camstack_types.asJsonObject)(parsed.deviceActivation) ?? {};
+			const systemActivation = (0, _camstack_types_addon.asJsonObject)(parsed.systemActivation) ?? {};
+			const deviceActivationRaw = (0, _camstack_types_addon.asJsonObject)(parsed.deviceActivation) ?? {};
 			const deviceActivation = {};
 			for (const [deviceId, entry] of Object.entries(deviceActivationRaw)) {
-				const nested = (0, _camstack_types.asJsonObject)(entry);
+				const nested = (0, _camstack_types_addon.asJsonObject)(entry);
 				if (nested === null) continue;
 				const bools = {};
 				for (const [k, v] of Object.entries(nested)) if (typeof v === "boolean") bools[k] = v;
@@ -28768,8 +28117,8 @@ var require_utils$3 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, mod
 		* @param {*} value
 		* @returns {Object}
 		*/
-		dotSet(obj, path$45, value) {
-			const parts = path$45.split(".");
+		dotSet(obj, path$44, value) {
+			const parts = path$44.split(".");
 			const part = parts.shift();
 			if (part && parts.length > 0) {
 				if (!Object.prototype.hasOwnProperty.call(obj, part)) obj[part] = {};
@@ -28778,7 +28127,7 @@ var require_utils$3 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, mod
 				obj[part] = utils.dotSet(obj[part], parts.join("."), value);
 				return obj;
 			}
-			obj[path$45] = value;
+			obj[path$44] = value;
 			return obj;
 		},
 		/**
@@ -42944,8 +42293,8 @@ var require_utimes = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, modu
 		else if (timestamp instanceof Date) return /* @__PURE__ */ new Date(Math.floor(timestamp.getTime() / 1e3) * 1e3);
 		else throw new Error("fs-extra: timeRemoveMillis() unknown parameter type");
 	}
-	function utimesMillis(path$43, atime, mtime, callback) {
-		fs.open(path$43, "r+", (err, fd) => {
+	function utimesMillis(path$42, atime, mtime, callback) {
+		fs.open(path$42, "r+", (err, fd) => {
 			if (err) return callback(err);
 			fs.futimes(fd, atime, mtime, (futimesErr) => {
 				fs.close(fd, (closeErr) => {
@@ -42954,8 +42303,8 @@ var require_utimes = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, modu
 			});
 		});
 	}
-	function utimesMillisSync(path$44, atime, mtime) {
-		const fd = fs.openSync(path$44, "r+");
+	function utimesMillisSync(path$43, atime, mtime) {
+		const fd = fs.openSync(path$43, "r+");
 		fs.futimesSync(fd, atime, mtime);
 		return fs.closeSync(fd);
 	}
@@ -43958,10 +43307,10 @@ var require_jsonfile$1 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 		}
 		if (typeof options === "string") options = { encoding: options };
 		options = options || {};
-		var fs$21 = options.fs || _fs;
+		var fs$19 = options.fs || _fs;
 		var shouldThrow = true;
 		if ("throws" in options) shouldThrow = options.throws;
-		fs$21.readFile(file, options, function(err, data) {
+		fs$19.readFile(file, options, function(err, data) {
 			if (err) return callback(err);
 			data = stripBom(data);
 			var obj;
@@ -43979,11 +43328,11 @@ var require_jsonfile$1 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 	function readFileSync(file, options) {
 		options = options || {};
 		if (typeof options === "string") options = { encoding: options };
-		var fs$22 = options.fs || _fs;
+		var fs$20 = options.fs || _fs;
 		var shouldThrow = true;
 		if ("throws" in options) shouldThrow = options.throws;
 		try {
-			var content = fs$22.readFileSync(file, options);
+			var content = fs$20.readFileSync(file, options);
 			content = stripBom(content);
 			return JSON.parse(content, options.reviver);
 		} catch (err) {
@@ -44008,7 +43357,7 @@ var require_jsonfile$1 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 			options = {};
 		}
 		options = options || {};
-		var fs$23 = options.fs || _fs;
+		var fs$21 = options.fs || _fs;
 		var str = "";
 		try {
 			str = stringify(obj, options);
@@ -44016,13 +43365,13 @@ var require_jsonfile$1 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 			if (callback) callback(err, null);
 			return;
 		}
-		fs$23.writeFile(file, str, options, callback);
+		fs$21.writeFile(file, str, options, callback);
 	}
 	function writeFileSync(file, obj, options) {
 		options = options || {};
-		var fs$24 = options.fs || _fs;
+		var fs$22 = options.fs || _fs;
 		var str = stringify(obj, options);
-		return fs$24.writeFileSync(file, str, options);
+		return fs$22.writeFileSync(file, str, options);
 	}
 	function stripBom(content) {
 		if (Buffer.isBuffer(content)) content = content.toString("utf8");
@@ -86620,11 +85969,11 @@ var require_main = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module
 		}
 		let lastError;
 		const parsedAll = {};
-		for (const path$42 of optionPaths) try {
-			const parsed = DotenvModule.parse(fs$4.readFileSync(path$42, { encoding }));
+		for (const path$41 of optionPaths) try {
+			const parsed = DotenvModule.parse(fs$4.readFileSync(path$41, { encoding }));
 			DotenvModule.populate(parsedAll, parsed, options);
 		} catch (e) {
-			if (debug) _debug(`failed to load ${path$42} ${e.message}`);
+			if (debug) _debug(`failed to load ${path$41} ${e.message}`);
 			lastError = e;
 		}
 		const populated = DotenvModule.populate(processEnv, parsedAll, options);
@@ -91596,7 +90945,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						respawned.restartCount = prevRestartCount + 1;
 					});
 					restarted.push(name);
-				} catch (err) {
+				} catch {
 					failed.push(name);
 				}
 				return {
@@ -91991,8 +91340,8 @@ var LifecycleJobEngine = class {
 			} finally {
 				clearTimeout(timer);
 			}
-			if (packages.length === 0) throw new Error("stageFramework returned no packages");
 			const [firstPackage] = packages;
+			if (!firstPackage) throw new Error("stageFramework returned no packages");
 			this.advance(job.jobId, task, "staged", { stagedPath: firstPackage.stagedPath });
 			requestFrameworkSwap({
 				jobId: job.jobId,
@@ -92015,14 +91364,15 @@ var LifecycleJobEngine = class {
 	*/
 	async fetchAddonsBounded(job, addonTasks) {
 		const limit = Math.max(1, this.deps.fetchConcurrency ?? DEFAULT_FETCH_CONCURRENCY);
-		const outcomes = new Array(addonTasks.length);
+		const outcomes = Array.from({ length: addonTasks.length });
 		let nextIndex = 0;
 		const worker = async () => {
 			for (;;) {
 				const index = nextIndex;
 				nextIndex += 1;
-				if (index >= addonTasks.length) return;
-				outcomes[index] = await this.fetchAddonTask(job, addonTasks[index]);
+				const addonTask = addonTasks[index];
+				if (addonTask === void 0) return;
+				outcomes[index] = await this.fetchAddonTask(job, addonTask);
 			}
 		};
 		const workerCount = Math.min(limit, addonTasks.length);
@@ -92174,7 +91524,7 @@ exports.ConfigManager = ConfigManager;
 exports.ConfigStore = require_builtins_sqlite_storage_index.ConfigStore$1;
 exports.ConsoleDestination = require_builtins_console_logging_index.ConsoleDestination$1;
 exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLoggingAddon$1;
-exports.CustomActionRegistry = require_manifest_python_deps.CustomActionRegistry;
+exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DataPlaneRegistry = DataPlaneRegistry;
 exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
@@ -92206,7 +91556,7 @@ exports.LocalChildClient = require_manifest_python_deps.LocalChildClient;
 exports.LocalChildRegistry = require_manifest_python_deps.LocalChildRegistry;
 exports.LogManager = LogManager;
 exports.LogRingBuffer = LogRingBuffer;
-exports.ModelDownloadService = ModelDownloadService;
+exports.ModelDownloadService = require_model_download_service.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
 exports.NativeMetricsAddon = require_builtins_native_metrics_native_metrics_addon.default;
 exports.NativeMetricsProvider = require_builtins_native_metrics_native_metrics_addon.NativeMetricsProvider;
@@ -92286,16 +91636,16 @@ exports.capServiceName = require_manifest_python_deps.capServiceName;
 exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
 exports.clearPendingRestart = clearPendingRestart;
 exports.clusterSecretMatches = clusterSecretMatches;
-exports.contentTypeFor = contentTypeFor;
+exports.contentTypeFor = require_model_download_service.contentTypeFor;
 exports.copyDirRecursive = copyDirRecursive;
 exports.copyExtraFileDirs = copyExtraFileDirs;
 exports.createAddonContext = require_manifest_python_deps.createAddonContext;
 exports.createAddonService = require_manifest_python_deps.createAddonService;
-exports.createAuthenticatedFileServer = createAuthenticatedFileServer;
+exports.createAuthenticatedFileServer = require_model_download_service.createAuthenticatedFileServer;
 exports.createBroker = createBroker;
 exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBrokerDeviceManagerApi;
 exports.createCoreCapService = createCoreCapService;
-exports.createFileDataPlaneHandler = createFileDataPlaneHandler;
+exports.createFileDataPlaneHandler = require_model_download_service.createFileDataPlaneHandler;
 exports.createHubService = createHubService;
 exports.createHwAccelService = require_manifest_python_deps.createHwAccelService;
 exports.createKernelHwAccel = require_manifest_python_deps.createKernelHwAccel;
@@ -92311,7 +91661,7 @@ exports.createUdsEventBridge = require_manifest_python_deps.createUdsEventBridge
 exports.createUdsEventBus = require_manifest_python_deps.createUdsEventBus;
 exports.createUdsLogger = require_manifest_python_deps.createUdsLogger;
 exports.createUdsLoggerWithControl = require_manifest_python_deps.createUdsLoggerWithControl;
-exports.deleteModelFromDisk = deleteModelFromDisk;
+exports.deleteModelFromDisk = require_model_download_service.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeProviderKindDrift = describeProviderKindDrift;
 exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
@@ -92321,8 +91671,8 @@ Object.defineProperty(exports, "downloadBinary", {
 		return _camstack_types_node.downloadBinary;
 	}
 });
-exports.downloadFile = downloadFile;
-exports.downloadModel = downloadModel;
+exports.downloadFile = require_model_download_service.downloadFile;
+exports.downloadModel = require_model_download_service.downloadModel;
 Object.defineProperty(exports, "emitDownForOwnedCaps", {
 	enumerable: true,
 	get: function() {
@@ -92344,7 +91694,7 @@ Object.defineProperty(exports, "ensureFfmpeg", {
 	}
 });
 exports.ensureLibraryBuilt = ensureLibraryBuilt;
-exports.ensureModel = ensureModel;
+exports.ensureModel = require_model_download_service.ensureModel;
 Object.defineProperty(exports, "ensurePython", {
 	enumerable: true,
 	get: function() {
@@ -92352,7 +91702,7 @@ Object.defineProperty(exports, "ensurePython", {
 	}
 });
 exports.ensureTlsCert = ensureTlsCert;
-exports.fetchJson = fetchJson;
+exports.fetchJson = require_model_download_service.fetchJson;
 Object.defineProperty(exports, "findInPath", {
 	enumerable: true,
 	get: function() {
@@ -92368,7 +91718,7 @@ Object.defineProperty(exports, "getFfmpegDownloadUrl", {
 		return _camstack_types_node.getFfmpegDownloadUrl;
 	}
 });
-exports.getModelFilePath = getModelFilePath;
+exports.getModelFilePath = require_model_download_service.getModelFilePath;
 exports.getOrInitReadinessRegistry = require_manifest_python_deps.getOrInitReadinessRegistry;
 exports.getOrInitReadinessRegistryForClient = require_manifest_python_deps.getOrInitReadinessRegistryForClient;
 exports.getPidStats = require_resource_monitor.getPidStats;
@@ -92390,7 +91740,7 @@ exports.getWorkerDeviceRegistry = require_manifest_python_deps.getWorkerDeviceRe
 exports.hashClusterSecret = hashClusterSecret;
 exports.installManifestNativeDeps = require_manifest_python_deps.installManifestNativeDeps;
 exports.installManifestPythonDeps = require_manifest_python_deps.installManifestPythonDeps;
-exports.installPackageFromNpmSync = installPackageFromNpmSync;
+exports.installPackageFromNpm = installPackageFromNpm;
 Object.defineProperty(exports, "installPythonPackages", {
 	enumerable: true,
 	get: function() {
@@ -92407,15 +91757,15 @@ exports.ipcChildLink = require_manifest_python_deps.ipcChildLink;
 exports.ipcParentLink = require_manifest_python_deps.ipcParentLink;
 exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
 exports.isInfraCapability = isInfraCapability;
-exports.isModelDownloaded = isModelDownloaded;
+exports.isModelDownloaded = require_model_download_service.isModelDownloaded;
 exports.isSourceNewer = isSourceNewer;
 exports.loadTlsCert = loadTlsCert;
 exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
 exports.localProviderLink = require_manifest_python_deps.localProviderLink;
 exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
 exports.parseCapAction = require_manifest_python_deps.parseCapAction;
-exports.parseRangeHeader = parseRangeHeader;
-exports.parseTokenizedUrl = parseTokenizedUrl;
+exports.parseRangeHeader = require_model_download_service.parseRangeHeader;
+exports.parseTokenizedUrl = require_model_download_service.parseTokenizedUrl;
 exports.proxyToUpstream = proxyToUpstream;
 exports.readPendingRestart = readPendingRestart;
 Object.defineProperty(exports, "readinessKey", {
@@ -92425,7 +91775,7 @@ Object.defineProperty(exports, "readinessKey", {
 	}
 });
 exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
-exports.resolveFilePath = resolveFilePath;
+exports.resolveFilePath = require_model_download_service.resolveFilePath;
 exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
 exports.scheduleSelfRestart = scheduleSelfRestart;
 Object.defineProperty(exports, "scopeKey", {