@camstack/system 1.0.7 → 1.1.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { a as ensureModel, c as isModelDownloaded, d as createAuthenticatedFileServer, f as parseRangeHeader, i as downloadModel, l as createFileDataPlaneHandler, m as resolveFilePath, n as deleteModelFromDisk, o as fetchJson, p as parseTokenizedUrl, r as downloadFile, s as getModelFilePath, t as ModelDownloadService, u as contentTypeFor } from "./model-download-service-C7AjBsX9.mjs";
+import { a as ensureModel, c as isModelDownloaded, d as createAuthenticatedFileServer, f as parseRangeHeader, i as downloadModel, l as createFileDataPlaneHandler, m as resolveFilePath, n as deleteModelFromDisk, o as fetchJson, p as parseTokenizedUrl, r as downloadFile, s as getModelFilePath, t as ModelDownloadService, u as contentTypeFor } from "./model-download-service-RxAOiYvX.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
@@ -19,7 +19,7 @@ import { LocalAuthAddon, a as require_safe_buffer, i as AuthManager, n as ApiKey
 import "./builtins/local-auth/index.mjs";
 import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
-import { A as createUdsLoggerWithControl, B as createLocalTransport, C as ipcParentLink, D as createUdsEventBus, E as createUdsEventBridge, F as CapRouteError, G as FrameDecoder, H as UdsLocalTransportServer, I as classifyCapRoute, J as buildUdsNativeCapProxy, K as encodeFrame, L as LocalChildClient, M as AGENT_CAP_FWD_SERVICE, N as CapRouteResolver, O as udsChildLogToWorkerEntry, P as callWithServiceDiscovery, Q as mountNativeCapService, R as LocalChildRegistry, S as ipcChildLink, T as createParentUnownedCallHandler, U as SocketChannel, V as UdsLocalTransportClient, W as localEndpointPath, Y as createBrokerDeviceManagerApi, _ as __resetCapUsageRegistryForTests, a as getWorkerDeviceRegistry, at as capBareAction, b as brokerTransportLink, c as setHubConnected, ct as deserializeTypedArrays, d as registerEventBusService, dt as CapabilityHandle, et as createAddonService, f as AddonDepsManager, ft as CapabilityUnavailableError, g as CapUsageRegistry, h as createHwAccelService, i as createUdsAddonContext, it as capActionSuffix, j as AGENT_CAP_FWD_ACTION, k as createUdsLogger, l as EVENT_TOPIC_PREFIX, lt as serializeTypedArrays, m as resolveHwAccel, mt as resolveAddonClass, n as adaptBrokerToCluster, nt as NATIVE_PROVIDER_SERVICE_INFIX, o as getOrInitReadinessRegistry, ot as capServiceName, p as createKernelHwAccel, pt as installManifestNativeDeps, q as buildNativeCapProxy, r as createAddonContext, rt as capActionName, s as getOrInitReadinessRegistryForClient, st as parseCapAction, t as installManifestPythonDeps, tt as validateProviderRegistrations, u as getBrokerEventBus, ut as DeviceRegistry, v as getCapUsageRegistry, w as localProviderLink, x as buildLinkChain, y as brokerCallForCap, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-CoJXeb9u.mjs";
+import { A as createUdsLoggerWithControl, B as createLocalTransport, C as ipcParentLink, D as createUdsEventBus, E as createUdsEventBridge, F as CapRouteError, G as FrameDecoder, H as UdsLocalTransportServer, I as classifyCapRoute, J as buildUdsNativeCapProxy, K as encodeFrame, L as LocalChildClient, M as AGENT_CAP_FWD_SERVICE, N as CapRouteResolver, O as udsChildLogToWorkerEntry, P as callWithServiceDiscovery, Q as mountNativeCapService, R as LocalChildRegistry, S as ipcChildLink, T as createParentUnownedCallHandler, U as SocketChannel, V as UdsLocalTransportClient, W as localEndpointPath, Y as createBrokerDeviceManagerApi, _ as __resetCapUsageRegistryForTests, a as getWorkerDeviceRegistry, at as capBareAction, b as brokerTransportLink, c as setHubConnected, ct as deserializeTypedArrays, d as registerEventBusService, dt as CapabilityHandle, et as createAddonService, f as AddonDepsManager, ft as CapabilityUnavailableError, g as CapUsageRegistry, h as createHwAccelService, i as createUdsAddonContext, it as capActionSuffix, j as AGENT_CAP_FWD_ACTION, k as createUdsLogger, l as EVENT_TOPIC_PREFIX, lt as serializeTypedArrays, m as resolveHwAccel, mt as resolveAddonClass, n as adaptBrokerToCluster, nt as NATIVE_PROVIDER_SERVICE_INFIX, o as getOrInitReadinessRegistry, ot as capServiceName, p as createKernelHwAccel, pt as installManifestNativeDeps, q as buildNativeCapProxy, r as createAddonContext, rt as capActionName, s as getOrInitReadinessRegistryForClient, st as parseCapAction, t as installManifestPythonDeps, tt as validateProviderRegistrations, u as getBrokerEventBus, ut as DeviceRegistry, v as getCapUsageRegistry, w as localProviderLink, x as buildLinkChain, y as brokerCallForCap, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-BcrTzHH_.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { n as require_src, t as require_graceful_fs } from "./graceful-fs-BoR9GuPS.mjs";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -30,7 +30,7 @@ import * as path$40 from "node:path";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { DATAPLANE_SECRET_HEADER, EventCategory, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, asJsonObject, asNumber, asString, createEvent, emitDownForOwnedCaps, errMsg, lifecycleJobSchema, parseJsonObject, parseJsonUnknown, readinessKey, scopeKey } from "@camstack/types";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
-import { execFile, execFileSync, spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import * as util$8 from "node:util";
 import { promisify } from "node:util";
 import * as vm from "node:vm";
@@ -177,7 +177,7 @@ function proxyToUpstream(opts) {
 }
 //#endregion
 //#region src/python/python-env-manager.ts
-var execFileAsync$2 = promisify(execFile);
+var execFileAsync$3 = promisify(execFile);
 var PythonEnvManager = class {
 	venvPath;
 	cachedProbe = null;
@@ -187,12 +187,12 @@ var PythonEnvManager = class {
 	async probe() {
 		if (this.cachedProbe) return this.cachedProbe;
 		for (const cmd of ["python3", "python"]) try {
-			const { stdout } = await execFileAsync$2(cmd, ["--version"]);
+			const { stdout } = await execFileAsync$3(cmd, ["--version"]);
 			const version = stdout.trim().replace("Python ", "");
 			const major = parseInt(version.split(".")[0] ?? "0", 10);
 			const minor = parseInt(version.split(".")[1] ?? "0", 10);
 			if (major < 3 || major === 3 && minor < 10) continue;
-			const { stdout: pathOut } = await execFileAsync$2(cmd, ["-c", "import sys; print(sys.executable)"]);
+			const { stdout: pathOut } = await execFileAsync$3(cmd, ["-c", "import sys; print(sys.executable)"]);
 			this.cachedProbe = {
 				available: true,
 				version,
@@ -208,13 +208,13 @@ var PythonEnvManager = class {
 	async ensure(options) {
 		const probe = await this.probe();
 		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-		if (!fs$17.existsSync(path$40.join(this.venvPath, "bin", "python"))) await execFileAsync$2(probe.path, [
+		if (!fs$17.existsSync(path$40.join(this.venvPath, "bin", "python"))) await execFileAsync$3(probe.path, [
 			"-m",
 			"venv",
 			this.venvPath
 		]);
 		const venvPython = path$40.join(this.venvPath, "bin", "python");
-		if (options.packages.length > 0) await execFileAsync$2(venvPython, [
+		if (options.packages.length > 0) await execFileAsync$3(venvPython, [
 			"-m",
 			"pip",
 			"install",
@@ -1413,12 +1413,11 @@ var StorageManager = class {
 		return namespace ? this.createNamespacedLocation(location, namespace) : location;
 	}
 	createLegacyShim() {
-		const self = this;
 		return {
 			async initialize() {},
 			async shutdown() {},
-			getLocation(name) {
-				return self.getLocation(name);
+			getLocation: (name) => {
+				return this.getLocation(name);
 			}
 		};
 	}
@@ -1694,7 +1693,7 @@ function matchPath(pattern, path) {
 }
 //#endregion
 //#region src/tls/cert-manager.ts
-var execFileAsync$1 = promisify(execFile);
+var execFileAsync$2 = promisify(execFile);
 /**
 * Ensure a self-signed TLS certificate exists in the given directory.
 * Generates one if missing. Returns paths to cert and key files.
@@ -1731,7 +1730,7 @@ async function ensureTlsCert(dataDir, options) {
 	for (const dns of sanDns) sanParts.push(`DNS:${dns}`);
 	for (const ip of sanIps) sanParts.push(`IP:${ip}`);
 	const sanString = sanParts.join(",");
-	await execFileAsync$1("openssl", [
+	await execFileAsync$2("openssl", [
 		"req",
 		"-x509",
 		"-newkey",
@@ -2564,6 +2563,7 @@ var AddonEngineManager = class {
 };
 //#endregion
 //#region src/kernel/fs-utils.ts
+var execFileAsync$1 = promisify(execFile);
 /**
 * Ensure a directory exists (recursive).
 * Single source of truth — replaces scattered mkdirSync calls.
@@ -2572,18 +2572,20 @@ function ensureDir(dirPath) {
 	fs$17.mkdirSync(dirPath, { recursive: true });
 }
 /**
-* Copy a directory recursively.
-* Single source of truth — extracted from addon-installer + first-boot-installer.
+* Copy a directory recursively — ASYNC so it never blocks the event loop.
+*
+* The hub installs addons into `/data/addons`, which on Unraid is a slow
+* shfs/FUSE mount. The former synchronous `fs.copyFileSync`-per-file loop
+* blocked the Node event loop for the whole copy of a large bundle (e.g.
+* `addon-pipeline`), which froze the hub's HTTP listener mid-`camstack deploy`
+* (accept backlog piling up, existing connections stuck in CLOSE_WAIT). Using
+* `fs.promises.cp` keeps the I/O off the event loop. (Node ≥18 stable.)
 */
-function copyDirRecursive(src, dest) {
-	ensureDir(dest);
-	const entries = fs$17.readdirSync(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = path$40.join(src, entry.name);
-		const destPath = path$40.join(dest, entry.name);
-		if (entry.isDirectory()) copyDirRecursive(srcPath, destPath);
-		else fs$17.copyFileSync(srcPath, destPath);
-	}
+async function copyDirRecursive(src, dest) {
+	await fs$17.promises.cp(src, dest, {
+		recursive: true,
+		force: true
+	});
 }
 /**
 * Strip @camstack/* dependencies and devDependencies from a package.json object.
@@ -2613,7 +2615,7 @@ function stripCamstackDeps(pkg) {
 * Copies directories (not individual files) from source to destination.
 * Skips "dist" (already handled) and glob patterns.
 */
-function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
+async function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 	const rawFiles = pkgJson.files;
 	if (!Array.isArray(rawFiles)) return;
 	for (const fileEntry of rawFiles) {
@@ -2622,11 +2624,11 @@ function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 		const srcPath = path$40.join(sourceDir, fileEntry);
 		if (!fs$17.existsSync(srcPath)) continue;
 		const destPath = path$40.join(destDir, fileEntry);
-		const stat = fs$17.statSync(srcPath);
-		if (stat.isDirectory()) copyDirRecursive(srcPath, destPath);
+		const stat = await fs$17.promises.stat(srcPath);
+		if (stat.isDirectory()) await copyDirRecursive(srcPath, destPath);
 		else if (stat.isFile()) {
 			ensureDir(path$40.dirname(destPath));
-			fs$17.copyFileSync(srcPath, destPath);
+			await fs$17.promises.copyFile(srcPath, destPath);
 		}
 	}
 }
@@ -2671,12 +2673,16 @@ function ensureLibraryBuilt(packageName, packagesDir) {
 /**
 * Install a single npm package into a target directory (package.json + dist/).
 * No validation on camstack.addons -- works for any @camstack/* package.
-* Uses synchronous child_process calls (suitable for first-boot and update paths).
+*
+* ASYNC: uses `execFile`/`fs.promises` throughout so a package install on a
+* live node never blocks the event loop (the `npm pack` + tar extract + copy to
+* the slow shfs/FUSE `/data` would otherwise freeze the HTTP listener). See
+* `copyDirRecursive` for the wedge this prevents.
 */
-function installPackageFromNpmSync(packageName, targetDir) {
-	const tmpDir = fs$17.mkdtempSync(path$40.join(os$17.tmpdir(), "camstack-install-"));
+async function installPackageFromNpm(packageName, targetDir) {
+	const tmpDir = await fs$17.promises.mkdtemp(path$40.join(os$17.tmpdir(), "camstack-install-"));
 	try {
-		const tgzFilename = execFileSync("npm", [
+		const { stdout } = await execFileAsync$1("npm", [
 			"pack",
 			packageName,
 			"--pack-destination",
@@ -2684,12 +2690,13 @@ function installPackageFromNpmSync(packageName, targetDir) {
 		], {
 			timeout: 12e4,
 			encoding: "utf-8"
-		}).trim().split("\n").pop()?.trim();
+		});
+		const tgzFilename = stdout.trim().split("\n").pop()?.trim();
 		if (!tgzFilename) throw new Error("npm pack produced no output");
 		const tgzPath = path$40.join(tmpDir, tgzFilename);
 		const extractDir = path$40.join(tmpDir, "extracted");
 		ensureDir(extractDir);
-		execFileSync("tar", [
+		await execFileAsync$1("tar", [
 			"-xzf",
 			tgzPath,
 			"-C",
@@ -2697,20 +2704,20 @@ function installPackageFromNpmSync(packageName, targetDir) {
 		], { timeout: 3e4 });
 		const packageSubDir = path$40.join(extractDir, "package");
 		const srcPkgJsonDir = fs$17.existsSync(path$40.join(packageSubDir, "package.json")) ? packageSubDir : extractDir;
-		fs$17.rmSync(targetDir, {
+		await fs$17.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		fs$17.copyFileSync(path$40.join(srcPkgJsonDir, "package.json"), path$40.join(targetDir, "package.json"));
+		await fs$17.promises.copyFile(path$40.join(srcPkgJsonDir, "package.json"), path$40.join(targetDir, "package.json"));
 		const distSrc = path$40.join(srcPkgJsonDir, "dist");
-		if (fs$17.existsSync(distSrc)) copyDirRecursive(distSrc, path$40.join(targetDir, "dist"));
+		if (fs$17.existsSync(distSrc)) await copyDirRecursive(distSrc, path$40.join(targetDir, "dist"));
 		try {
-			const npmPkg = asJsonObject(parseJsonUnknown(fs$17.readFileSync(path$40.join(srcPkgJsonDir, "package.json"), "utf-8")));
-			if (npmPkg) copyExtraFileDirs(npmPkg, srcPkgJsonDir, targetDir);
+			const npmPkg = asJsonObject(parseJsonUnknown(await fs$17.promises.readFile(path$40.join(srcPkgJsonDir, "package.json"), "utf-8")));
+			if (npmPkg) await copyExtraFileDirs(npmPkg, srcPkgJsonDir, targetDir);
 		} catch {}
 	} finally {
-		fs$17.rmSync(tmpDir, {
+		await fs$17.promises.rm(tmpDir, {
 			recursive: true,
 			force: true
 		});
@@ -3160,15 +3167,15 @@ var AddonInstaller = class AddonInstaller {
 		await this.ensureBuilt(packageName, sourceDir, pkgData);
 		const distDir = path$40.join(sourceDir, "dist");
 		if (!fs$17.existsSync(distDir)) throw new Error(`${packageName} has no dist/ after build`);
-		fs$17.rmSync(targetDir, {
+		await fs$17.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		fs$17.writeFileSync(path$40.join(targetDir, "package.json"), JSON.stringify(stripCamstackDeps(pkgData), null, 2));
-		copyDirRecursive(distDir, path$40.join(targetDir, "dist"));
-		copyExtraFileDirs(pkgData, sourceDir, targetDir);
-		fs$17.writeFileSync(path$40.join(targetDir, ".install-source"), "local");
+		await fs$17.promises.writeFile(path$40.join(targetDir, "package.json"), JSON.stringify(stripCamstackDeps(pkgData), null, 2));
+		await copyDirRecursive(distDir, path$40.join(targetDir, "dist"));
+		await copyExtraFileDirs(pkgData, sourceDir, targetDir);
+		await fs$17.promises.writeFile(path$40.join(targetDir, ".install-source"), "local");
 		const localPkgVersion = asString(pkgData.version, "0.0.0");
 		this.manifest.upsert(packageName, {
 			version: localPkgVersion,
@@ -3271,6 +3278,66 @@ var AddonInstaller = class AddonInstaller {
 		fs$17.writeFileSync(tgzPath, buf);
 		return tgzPath;
 	}
+	/**
+	* Evict an existing install dir by atomic rename-aside, then best-effort
+	* delete the aside copy.
+	*
+	* Why not a plain `fs.promises.rm(targetDir, {recursive})`: during a
+	* `camstack deploy` the addon's live runner still holds its native
+	* prebuilds (`.node`/`.so`) open. On the hub's shfs/FUSE `/data/addons`,
+	* a recursive rm of a held subdir fails `ENOTEMPTY` mid-walk and leaves
+	* the dir gutted. A rename only touches the dirent (metadata), so it
+	* succeeds with the inodes still open — the old runner keeps its fds on
+	* the moved inodes until it restarts.
+	*
+	* The aside copy is removed best-effort: the held native libs are only
+	* released once the post-install `restartAddon` recycles the runner, so a
+	* failure to delete it now must NOT fail the install. Any residue is swept
+	* on the next deploy.
+	*/
+	async evictInstallDir(targetDir) {
+		if (!fs$17.existsSync(targetDir)) return;
+		const graveyard = path$40.join(this.addonsDir, ".evicting");
+		ensureDir(graveyard);
+		await this.sweepGraveyard(graveyard);
+		const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+		const flatName = path$40.relative(this.addonsDir, targetDir).replace(/[/\\]/g, "-");
+		const asideDir = path$40.join(graveyard, `${flatName}-${ts}`);
+		try {
+			fs$17.renameSync(targetDir, asideDir);
+		} catch (renameErr) {
+			if (renameErr.code === "EXDEV") {
+				await fs$17.promises.rm(targetDir, {
+					recursive: true,
+					force: true
+				});
+				return;
+			}
+			throw renameErr;
+		}
+		await fs$17.promises.rm(asideDir, {
+			recursive: true,
+			force: true
+		}).catch((cleanupErr) => {
+			this.logger.debug("evictInstallDir: aside cleanup deferred (likely held open)", { meta: {
+				asideDir,
+				error: errMsg(cleanupErr)
+			} });
+		});
+	}
+	/** Best-effort removal of leftover `.evicting/*` dirs from earlier deploys. */
+	async sweepGraveyard(graveyard) {
+		let entries;
+		try {
+			entries = fs$17.readdirSync(graveyard);
+		} catch {
+			return;
+		}
+		await Promise.all(entries.map((name) => fs$17.promises.rm(path$40.join(graveyard, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0)));
+	}
 	/** Install addon from a tgz file (uploaded or downloaded) */
 	async installFromTgz(tgzPath) {
 		const tmpDir = fs$17.mkdtempSync(path$40.join(os$17.tmpdir(), "camstack-addon-install-"));
@@ -3288,17 +3355,14 @@ var AddonInstaller = class AddonInstaller {
 			if (!pkgView) throw new Error(`Invalid package.json at ${pkgJsonPath}`);
 			if (!pkgView.camstackAddons) throw new Error(`Package ${pkgView.name} has no camstack.addons manifest`);
 			const targetDir = path$40.join(this.addonsDir, pkgView.name);
-			fs$17.rmSync(targetDir, {
-				recursive: true,
-				force: true
-			});
+			await this.evictInstallDir(targetDir);
 			ensureDir(targetDir);
 			const sourceDir = path$40.dirname(pkgJsonPath);
 			const strippedManifest = stripCamstackDeps(pkgView.raw);
-			fs$17.writeFileSync(path$40.join(targetDir, "package.json"), JSON.stringify(strippedManifest, null, 2));
+			await fs$17.promises.writeFile(path$40.join(targetDir, "package.json"), JSON.stringify(strippedManifest, null, 2));
 			const sourceDist = path$40.join(sourceDir, "dist");
-			if (fs$17.existsSync(sourceDist)) copyDirRecursive(sourceDist, path$40.join(targetDir, "dist"));
-			copyExtraFileDirs(pkgView.raw, sourceDir, targetDir);
+			if (fs$17.existsSync(sourceDist)) await copyDirRecursive(sourceDist, path$40.join(targetDir, "dist"));
+			await copyExtraFileDirs(pkgView.raw, sourceDir, targetDir);
 			const strippedRuntimeDeps = strippedManifest["dependencies"];
 			if (strippedRuntimeDeps != null && typeof strippedRuntimeDeps === "object" && Object.keys(strippedRuntimeDeps).length > 0) {
 				this.logger.info(`${pkgView.name} — installing runtime dependencies`, { meta: { targetDir } });
@@ -3322,7 +3386,7 @@ var AddonInstaller = class AddonInstaller {
 			try {
 				await installManifestNativeDeps(targetDir, pkgView.raw, this.logger, this.registry);
 			} catch (nativeErr) {
-				fs$17.rmSync(targetDir, {
+				await fs$17.promises.rm(targetDir, {
 					recursive: true,
 					force: true
 				});
@@ -3337,7 +3401,7 @@ var AddonInstaller = class AddonInstaller {
 				version: pkgView.version
 			};
 		} finally {
-			fs$17.rmSync(tmpDir, {
+			await fs$17.promises.rm(tmpDir, {
 				recursive: true,
 				force: true
 			});
@@ -4105,7 +4169,7 @@ var CapabilityRegistry = class CapabilityRegistry {
 		const bare = this.bareAddonId(addonId);
 		const nodeMap = this.singletonNodeOverrides.get(capabilityName);
 		if (nodeMap) {
-			for (const [nodeId, ov] of [...nodeMap]) if (ov === bare) nodeMap.delete(nodeId);
+			for (const [nodeId, ov] of Array.from(nodeMap)) if (ov === bare) nodeMap.delete(nodeId);
 			if (nodeMap.size === 0) this.singletonNodeOverrides.delete(capabilityName);
 		}
 		this.logger.info("Provider unregistered from capability", {
@@ -7382,20 +7446,20 @@ var ConfigManager = class ConfigManager {
 	setSettingsStore(store) {
 		this.settingsStore = store;
 	}
-	get(path) {
-		return this.resolveConfigValue(path);
+	get(configPath) {
+		return this.resolveConfigValue(configPath);
 	}
-	resolveConfigValue(path) {
-		const bootstrapValue = this.getFromBootstrap(path);
+	resolveConfigValue(configPath) {
+		const bootstrapValue = this.getFromBootstrap(configPath);
 		if (bootstrapValue !== void 0) return bootstrapValue;
 		if (this.settingsStore !== null) {
-			const storeValue = this.settingsStore.getSystem(path);
+			const storeValue = this.settingsStore.getSystem(configPath);
 			if (storeValue !== void 0) return storeValue;
-			const nested = this.getNestedFromSystemSettings(path);
+			const nested = this.getNestedFromSystemSettings(configPath);
 			if (nested !== null) return nested;
 		}
-		if (path in RUNTIME_DEFAULTS) return RUNTIME_DEFAULTS[path];
-		return this.getFromRuntimeDefaults(path) ?? void 0;
+		if (configPath in RUNTIME_DEFAULTS) return RUNTIME_DEFAULTS[configPath];
+		return this.getFromRuntimeDefaults(configPath) ?? void 0;
 	}
 	/**
 	* Write a value to the settings-store.
@@ -7611,8 +7675,8 @@ var ConfigManager = class ConfigManager {
 		};
 		this.saveRuntimeState();
 	}
-	getBootstrap(path) {
-		return this.getFromBootstrap(path);
+	getBootstrap(configPath) {
+		return this.getFromBootstrap(configPath);
 	}
 	/** Features accessor -- reads from settings-store when available, falls back to RUNTIME_DEFAULTS */
 	get features() {
@@ -7702,8 +7766,8 @@ var ConfigManager = class ConfigManager {
 	* Deep-set a value in a nested plain object using a dot-notation path.
 	* Returns a new object (immutable).
 	*/
-	setNested(obj, path, value) {
-		const [head, ...rest] = path.split(".");
+	setNested(obj, configPath, value) {
+		const [head, ...rest] = configPath.split(".");
 		if (!head) return obj;
 		if (rest.length === 0) return {
 			...obj,
@@ -7743,8 +7807,8 @@ var ConfigManager = class ConfigManager {
 	warnDefaultCredentials() {
 		if (this.bootstrapConfig.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
 	}
-	getFromBootstrap(path) {
-		const keys = path.split(".");
+	getFromBootstrap(configPath) {
+		const keys = configPath.split(".");
 		let current = this.bootstrapConfig;
 		for (const key of keys) {
 			if (!isRecord(current)) return void 0;
@@ -7752,8 +7816,8 @@ var ConfigManager = class ConfigManager {
 		}
 		return current;
 	}
-	getFromRuntimeDefaults(path) {
-		const prefix = path + ".";
+	getFromRuntimeDefaults(configPath) {
+		const prefix = configPath + ".";
 		const result = {};
 		let found = false;
 		for (const [key, value] of Object.entries(RUNTIME_DEFAULTS)) if (key.startsWith(prefix)) {
@@ -7768,10 +7832,10 @@ var ConfigManager = class ConfigManager {
 	* e.g. path='features' matches keys 'features.streaming', 'features.notifications', etc.
 	* Returns an object keyed by the sub-key, or undefined if nothing is found.
 	*/
-	getNestedFromSystemSettings(path) {
+	getNestedFromSystemSettings(configPath) {
 		if (this.settingsStore === null) return null;
 		const all = this.settingsStore.getAllSystem();
-		const prefix = path + ".";
+		const prefix = configPath + ".";
 		const result = {};
 		let found = false;
 		for (const [key, value] of Object.entries(all)) if (key.startsWith(prefix)) {
@@ -89891,6 +89955,15 @@ function normalizeHubUrl(raw, defaultPort) {
 	return `${/:\d+$/.test(hostPort) ? hostPort : `${hostPort}:${defaultPort}`}/${nodeId}`;
 }
 //#endregion
+//#region src/kernel/moleculer/addon-deploy-source.ts
+function isAddonDeploySource(v) {
+	if (!v || typeof v !== "object") return false;
+	const o = v;
+	if (o["kind"] === "npm") return typeof o["version"] === "string";
+	if (o["kind"] === "hub-http") return typeof o["url"] === "string" && typeof o["token"] === "string" && typeof o["sha256"] === "string" && typeof o["bytes"] === "number";
+	return false;
+}
+//#endregion
 //#region src/kernel/moleculer/core-cap-service.ts
 /**
 * Default Moleculer service name for the hub core-capability bridge.
@@ -90932,7 +91005,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						respawned.restartCount = prevRestartCount + 1;
 					});
 					restarted.push(name);
-				} catch (err) {
+				} catch {
 					failed.push(name);
 				}
 				return {
@@ -91327,8 +91400,8 @@ var LifecycleJobEngine = class {
 			} finally {
 				clearTimeout(timer);
 			}
-			if (packages.length === 0) throw new Error("stageFramework returned no packages");
 			const [firstPackage] = packages;
+			if (!firstPackage) throw new Error("stageFramework returned no packages");
 			this.advance(job.jobId, task, "staged", { stagedPath: firstPackage.stagedPath });
 			requestFrameworkSwap({
 				jobId: job.jobId,
@@ -91351,14 +91424,15 @@ var LifecycleJobEngine = class {
 	*/
 	async fetchAddonsBounded(job, addonTasks) {
 		const limit = Math.max(1, this.deps.fetchConcurrency ?? DEFAULT_FETCH_CONCURRENCY);
-		const outcomes = new Array(addonTasks.length);
+		const outcomes = Array.from({ length: addonTasks.length });
 		let nextIndex = 0;
 		const worker = async () => {
 			for (;;) {
 				const index = nextIndex;
 				nextIndex += 1;
-				if (index >= addonTasks.length) return;
-				outcomes[index] = await this.fetchAddonTask(job, addonTasks[index]);
+				const addonTask = addonTasks[index];
+				if (addonTask === void 0) return;
+				outcomes[index] = await this.fetchAddonTask(job, addonTask);
 			}
 		};
 		const workerCount = Math.min(limit, addonTasks.length);
@@ -91484,4 +91558,4 @@ async function stageFrameworkLockstep(input) {
 	return results;
 }
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FRAMEWORK_LOCKSTEP, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyCapRoute, clearPendingRestart, clusterSecretMatches, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubService, createHwAccelService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensurePython, ensureTlsCert, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpmSync, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isClusterSecretMismatchError, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, scheduleSelfRestart, scopeKey, scopesAllowDeviceCap, serializeTypedArrays, setHubConnected, stageFrameworkLockstep, stripCamstackDeps, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FRAMEWORK_LOCKSTEP, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyCapRoute, clearPendingRestart, clusterSecretMatches, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubService, createHwAccelService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensurePython, ensureTlsCert, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isClusterSecretMismatchError, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, scheduleSelfRestart, scopeKey, scopesAllowDeviceCap, serializeTypedArrays, setHubConnected, stageFrameworkLockstep, stripCamstackDeps, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };

package/dist/kernel/addon-installer.d.ts

@@ -167,6 +167,26 @@ export declare class AddonInstaller {
      * the legacy fallback path remains the right answer for those.
      */
     private downloadNpmTarball;
+    /**
+     * Evict an existing install dir by atomic rename-aside, then best-effort
+     * delete the aside copy.
+     *
+     * Why not a plain `fs.promises.rm(targetDir, {recursive})`: during a
+     * `camstack deploy` the addon's live runner still holds its native
+     * prebuilds (`.node`/`.so`) open. On the hub's shfs/FUSE `/data/addons`,
+     * a recursive rm of a held subdir fails `ENOTEMPTY` mid-walk and leaves
+     * the dir gutted. A rename only touches the dirent (metadata), so it
+     * succeeds with the inodes still open — the old runner keeps its fds on
+     * the moved inodes until it restarts.
+     *
+     * The aside copy is removed best-effort: the held native libs are only
+     * released once the post-install `restartAddon` recycles the runner, so a
+     * failure to delete it now must NOT fail the install. Any residue is swept
+     * on the next deploy.
+     */
+    private evictInstallDir;
+    /** Best-effort removal of leftover `.evicting/*` dirs from earlier deploys. */
+    private sweepGraveyard;
     /** Install addon from a tgz file (uploaded or downloaded) */
     installFromTgz(tgzPath: string): Promise<{
         name: string;

package/dist/kernel/config-manager.d.ts

@@ -79,8 +79,8 @@ export declare class ConfigManager {
      * as a convenience alias for legacy call sites; it performs NO runtime
      * check and is the one documented type-level bridge in this function.
      */
-    get(path: string): unknown;
-    get<T>(path: string): T | undefined;
+    get(configPath: string): unknown;
+    get<T>(configPath: string): T | undefined;
     private resolveConfigValue;
     /**
      * Write a value to the settings-store.
@@ -171,8 +171,8 @@ export declare class ConfigManager {
     /** Get a value from the parsed bootstrap config.
      *  Generic overload is a documented type-level bridge — callers are responsible
      *  for passing a T that matches the config.yaml shape. */
-    getBootstrap(path: string): unknown;
-    getBootstrap<T>(path: string): T | undefined;
+    getBootstrap(configPath: string): unknown;
+    getBootstrap<T>(configPath: string): T | undefined;
     /** Features accessor -- reads from settings-store when available, falls back to RUNTIME_DEFAULTS */
     get features(): FeatureManifest;
     /**

package/dist/kernel/fs-utils.d.ts

@@ -4,10 +4,16 @@
  */
 export declare function ensureDir(dirPath: string): void;
 /**
- * Copy a directory recursively.
- * Single source of truth — extracted from addon-installer + first-boot-installer.
+ * Copy a directory recursively — ASYNC so it never blocks the event loop.
+ *
+ * The hub installs addons into `/data/addons`, which on Unraid is a slow
+ * shfs/FUSE mount. The former synchronous `fs.copyFileSync`-per-file loop
+ * blocked the Node event loop for the whole copy of a large bundle (e.g.
+ * `addon-pipeline`), which froze the hub's HTTP listener mid-`camstack deploy`
+ * (accept backlog piling up, existing connections stuck in CLOSE_WAIT). Using
+ * `fs.promises.cp` keeps the I/O off the event loop. (Node ≥18 stable.)
  */
-export declare function copyDirRecursive(src: string, dest: string): void;
+export declare function copyDirRecursive(src: string, dest: string): Promise<void>;
 /**
  * Strip @camstack/* dependencies and devDependencies from a package.json object.
  * Used when installing addons into the addons directory — @camstack packages
@@ -21,7 +27,7 @@ export declare function stripCamstackDeps(pkg: Record<string, unknown>): Record<
  * Copies directories (not individual files) from source to destination.
  * Skips "dist" (already handled) and glob patterns.
  */
-export declare function copyExtraFileDirs(pkgJson: Record<string, unknown>, sourceDir: string, destDir: string): void;
+export declare function copyExtraFileDirs(pkgJson: Record<string, unknown>, sourceDir: string, destDir: string): Promise<void>;
 /**
  * Check if any file in src/ is newer than dist/.
  * Returns true if rebuild is needed.
@@ -36,6 +42,10 @@ export declare function ensureLibraryBuilt(packageName: string, packagesDir: str
 /**
  * Install a single npm package into a target directory (package.json + dist/).
  * No validation on camstack.addons -- works for any @camstack/* package.
- * Uses synchronous child_process calls (suitable for first-boot and update paths).
+ *
+ * ASYNC: uses `execFile`/`fs.promises` throughout so a package install on a
+ * live node never blocks the event loop (the `npm pack` + tar extract + copy to
+ * the slow shfs/FUSE `/data` would otherwise freeze the HTTP listener). See
+ * `copyDirRecursive` for the wedge this prevents.
  */
-export declare function installPackageFromNpmSync(packageName: string, targetDir: string): void;
+export declare function installPackageFromNpm(packageName: string, targetDir: string): Promise<void>;

package/dist/kernel/index.d.ts

@@ -5,7 +5,7 @@ export type { AddonInstallerConfig, InstallSource, InstalledPackage } from './ad
 export { AddonInstaller } from './addon-installer.js';
 export type { AddonInstallSource, AddonManifestEntry, AddonManifestFile } from './addon-manifest.js';
 export { AddonManifest } from './addon-manifest.js';
-export { copyDirRecursive, ensureDir, stripCamstackDeps, copyExtraFileDirs, ensureLibraryBuilt, installPackageFromNpmSync, isSourceNewer, } from './fs-utils.js';
+export { copyDirRecursive, ensureDir, stripCamstackDeps, copyExtraFileDirs, ensureLibraryBuilt, installPackageFromNpm, isSourceNewer, } from './fs-utils.js';
 export { detectWorkspacePackagesDir } from './workspace-detect.js';
 export { RESTART_MARKER_FILE, clearPendingRestart, getRestartMarkerPath, readPendingRestart, scheduleSelfRestart, writePendingRestart, } from './restart-coordinator.js';
 export type { PendingRestartMarker, RestartKind, ScheduleSelfRestartOptions, } from './restart-coordinator.js';
@@ -27,6 +27,7 @@ export { buildStorageLocationRegistry } from './storage-location-registry.js';
 export type { StorageLocationRegistry } from './storage-location-registry.js';
 export { createBroker, deriveAgentListenPort } from './moleculer/broker-factory.js';
 export type { BrokerConfig } from './moleculer/broker-factory.js';
+export { type AddonDeploySource, isAddonDeploySource } from './moleculer/addon-deploy-source.js';
 export { createAddonService, validateProviderRegistrations, } from './moleculer/addon-service-factory.js';
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-cap-service.js';
 export type { CoreCapAction, CoreCapServiceOptions } from './moleculer/core-cap-service.js';

package/dist/kernel/moleculer/addon-deploy-source.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Where an agent should fetch an addon's bytes from for a `$agent.deploy`.
+ * `npm`: the agent runs its own AddonInstaller pull. `hub-http`: the agent
+ * streams the staged tgz from the hub's one-time-token bundle route.
+ */
+export type AddonDeploySource = {
+    readonly kind: 'npm';
+    readonly version: string;
+} | {
+    readonly kind: 'hub-http';
+    readonly url: string;
+    readonly token: string;
+    readonly sha256: string;
+    readonly bytes: number;
+};
+export declare function isAddonDeploySource(v: unknown): v is AddonDeploySource;