@camstack/system 1.1.35 → 1.1.37

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-jZA_Qorz.js");
+const require_manifest_python_deps = require("./manifest-python-deps-B6ahe90k.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
@@ -115,6 +115,17 @@ function isCapMethod(value) {
 	return typeof value === "function";
 }
 /**
+* Extract a string `addonId` out of arbitrary method args — the fallback
+* provider-selection hint for calls that arrive WITHOUT the out-of-band
+* `CapCallMessage.addonId` (e.g. a sibling child's unowned collection call
+* forwarded by the parent, where the raw input still carries `addonId`).
+*/
+function extractArgsAddonId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "addonId");
+	return typeof raw === "string" ? raw : void 0;
+}
+/**
 * Creates a unified dispatcher that routes a {@link CapCallInput} to either a
 * device-scoped or singleton provider, then invokes the requested method.
 *
@@ -123,12 +134,13 @@ function isCapMethod(value) {
 function createChildCapDispatch(deps) {
 	return async (call) => {
 		const { capName, method, args, deviceId } = call;
+		const addonId = call.addonId ?? extractArgsAddonId(args);
 		let provider;
 		if (deviceId !== void 0) {
-			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName);
+			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName, addonId);
 			if (provider == null) throw new Error(`child-cap-dispatch: no provider for '${capName}' (device '${String(deviceId)}' or singleton)`);
 		} else {
-			provider = deps.getSingletonProvider(capName);
+			provider = deps.getSingletonProvider(capName, addonId);
 			if (provider == null) throw new Error(`child-cap-dispatch: no singleton provider for '${capName}'`);
 		}
 		const fn = Reflect.get(provider, method);
@@ -137,6 +149,51 @@ function createChildCapDispatch(deps) {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/child-cap-descriptors.ts
+/**
+* Builds the {@link ChildCapDescriptor} array that the UDS child transport
+* sends to the parent on registration.
+*
+* - Singleton caps come from the runner UNION manifest (all caps registered by
+*   every addon in this runner). One descriptor per unique (addonId, capName)
+*   pair, mode `'singleton'` and no `deviceId`. The `addonId` stamp lets the
+*   parent's manifest builder register each hosted addon's caps under the
+*   REAL addon id — a GROUPED runner (`execution.group`) hosts several addons,
+*   and deduplicating by capName alone would collapse two co-located providers
+*   of the same collection cap (e.g. `network-access` from cloudflare-tunnel
+*   AND tailscale-ingress) into one descriptor registered under a synthetic
+*   `addonId = childId` (the group name) — the "@camstack/addon-net-access"
+*   admin-UI bug.
+* - Device-scoped caps come from the native-cap snapshot — one descriptor per
+*   (capName, deviceId) pair, mode `'collection'`, stamped with the owning
+*   addon's id.
+*
+* Pure module — extracted from `addon-runner.ts` (whose `main()` runs at
+* import time) so it is unit-testable.
+*/
+function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
+	const descriptors = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of manifest) for (const capName of entry.capabilities) {
+		const key = `${entry.addonId}::${capName}`;
+		if (!seen.has(key)) {
+			seen.add(key);
+			descriptors.push({
+				capName,
+				mode: "singleton",
+				addonId: entry.addonId
+			});
+		}
+	}
+	for (const { capName, addonId, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
+		capName,
+		mode: "collection",
+		deviceId,
+		addonId
+	});
+	return descriptors;
+}
+//#endregion
 //#region src/kernel/moleculer/child-addon-call-dispatch.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -333,33 +390,6 @@ async function loadAddonModule(addonId, addonDir) {
 		AddonClass
 	};
 }
-/**
-* Builds the {@link ChildCapDescriptor} array that the UDS child transport
-* sends to the parent on registration.
-*
-* - Singleton caps come from the runner UNION manifest (all caps registered by
-*   every addon in this runner). One descriptor per unique cap name, mode
-*   `'singleton'` and no `deviceId`.
-* - Device-scoped caps come from the native-cap snapshot — one descriptor per
-*   (capName, deviceId) pair, mode `'collection'`.
-*/
-function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
-	const descriptors = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of manifest) for (const capName of entry.capabilities) if (!seen.has(capName)) {
-		seen.add(capName);
-		descriptors.push({
-			capName,
-			mode: "singleton"
-		});
-	}
-	for (const { capName, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
-		capName,
-		mode: "collection",
-		deviceId
-	});
-	return descriptors;
-}
 async function main() {
 	const runnerId = process.env["CAMSTACK_RUNNER_ID"];
 	const addonsJson = process.env["CAMSTACK_RUNNER_ADDONS"];
@@ -427,14 +457,34 @@ async function main() {
 	const runnerManifest = [];
 	/**
 	* Aggregated singleton (system-scoped) providers across ALL addons in this
-	* runner — keyed by capName. Read by the UDS child-cap dispatch to resolve
-	* singleton calls (no Moleculer). Populated during the addon-init loop; a
-	* cap-call that arrives before its addon initialises is rejected by the
+	* runner — keyed capName → (addonId → provider). Read by the UDS child-cap
+	* dispatch to resolve singleton calls (no Moleculer). The nested per-addon
+	* keying matters for GROUPED runners (`execution.group`): two co-located
+	* addons can register the SAME collection cap (e.g. `network-access` from
+	* cloudflare-tunnel AND tailscale-ingress) — a flat capName map would keep
+	* only the last-registered provider. Populated during the addon-init loop;
+	* a cap-call that arrives before its addon initialises is rejected by the
 	* dispatcher (the parent only routes caps the child has registered via the
 	* UDS `register`/`updateCaps` handshake).
 	*/
 	const allSingletonProviders = /* @__PURE__ */ new Map();
 	/**
+	* Resolve a singleton provider for the dispatcher: exact (capName, addonId)
+	* match when the hint names a hosted provider, else the cap's first
+	* registered provider (an unmatched `addonId` is method DATA — e.g.
+	* `addons.restartAddon({ addonId })` — not a routing key).
+	*/
+	const resolveSingletonProvider = (capName, addonId) => {
+		const byAddon = allSingletonProviders.get(capName);
+		if (!byAddon || byAddon.size === 0) return null;
+		if (addonId !== void 0) {
+			const exact = byAddon.get(addonId);
+			if (exact !== void 0) return exact;
+		}
+		const first = byAddon.values().next();
+		return first.done ? null : first.value;
+	};
+	/**
 	* Per-addon route-provider map — keyed by addonId → the addon's live
 	* `addon-routes` provider object. Resolves `getRouteProvider(addonId)`
 	* per-addon rather than returning a single global provider. Populated
@@ -473,7 +523,7 @@ async function main() {
 		childId: runnerId,
 		caps: buildChildCapDescriptors(runnerManifest, require_manifest_python_deps.getWorkerNativeCapSnapshot()),
 		dispatch: createChildCapDispatch({
-			getSingletonProvider: (capName) => allSingletonProviders.get(capName) ?? null,
+			getSingletonProvider: (capName, addonId) => resolveSingletonProvider(capName, addonId),
 			getDeviceProvider: (capName, deviceId) => require_manifest_python_deps.getWorkerNativeCapProvider(capName, deviceId) ?? null
 		})
 	});
@@ -538,7 +588,9 @@ async function main() {
 			context.registerProvider(capName, reg.provider);
 			const prov = reg.provider;
 			if (prov !== null && typeof prov === "object" && !Array.isArray(prov)) {
-				allSingletonProviders.set(capName, prov);
+				const byAddon = allSingletonProviders.get(capName) ?? /* @__PURE__ */ new Map();
+				byAddon.set(spec.addonId, prov);
+				allSingletonProviders.set(capName, byAddon);
 				if (capName === "addon-routes") addonRouteProviders.set(spec.addonId, prov);
 			}
 		}

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-MUu1e33G.mjs";
+import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-4QvOLiBn.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { register } from "node:module";
 import * as fs from "node:fs";
@@ -111,6 +111,17 @@ function isCapMethod(value) {
 	return typeof value === "function";
 }
 /**
+* Extract a string `addonId` out of arbitrary method args — the fallback
+* provider-selection hint for calls that arrive WITHOUT the out-of-band
+* `CapCallMessage.addonId` (e.g. a sibling child's unowned collection call
+* forwarded by the parent, where the raw input still carries `addonId`).
+*/
+function extractArgsAddonId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "addonId");
+	return typeof raw === "string" ? raw : void 0;
+}
+/**
 * Creates a unified dispatcher that routes a {@link CapCallInput} to either a
 * device-scoped or singleton provider, then invokes the requested method.
 *
@@ -119,12 +130,13 @@ function isCapMethod(value) {
 function createChildCapDispatch(deps) {
 	return async (call) => {
 		const { capName, method, args, deviceId } = call;
+		const addonId = call.addonId ?? extractArgsAddonId(args);
 		let provider;
 		if (deviceId !== void 0) {
-			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName);
+			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName, addonId);
 			if (provider == null) throw new Error(`child-cap-dispatch: no provider for '${capName}' (device '${String(deviceId)}' or singleton)`);
 		} else {
-			provider = deps.getSingletonProvider(capName);
+			provider = deps.getSingletonProvider(capName, addonId);
 			if (provider == null) throw new Error(`child-cap-dispatch: no singleton provider for '${capName}'`);
 		}
 		const fn = Reflect.get(provider, method);
@@ -133,6 +145,51 @@ function createChildCapDispatch(deps) {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/child-cap-descriptors.ts
+/**
+* Builds the {@link ChildCapDescriptor} array that the UDS child transport
+* sends to the parent on registration.
+*
+* - Singleton caps come from the runner UNION manifest (all caps registered by
+*   every addon in this runner). One descriptor per unique (addonId, capName)
+*   pair, mode `'singleton'` and no `deviceId`. The `addonId` stamp lets the
+*   parent's manifest builder register each hosted addon's caps under the
+*   REAL addon id — a GROUPED runner (`execution.group`) hosts several addons,
+*   and deduplicating by capName alone would collapse two co-located providers
+*   of the same collection cap (e.g. `network-access` from cloudflare-tunnel
+*   AND tailscale-ingress) into one descriptor registered under a synthetic
+*   `addonId = childId` (the group name) — the "@camstack/addon-net-access"
+*   admin-UI bug.
+* - Device-scoped caps come from the native-cap snapshot — one descriptor per
+*   (capName, deviceId) pair, mode `'collection'`, stamped with the owning
+*   addon's id.
+*
+* Pure module — extracted from `addon-runner.ts` (whose `main()` runs at
+* import time) so it is unit-testable.
+*/
+function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
+	const descriptors = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of manifest) for (const capName of entry.capabilities) {
+		const key = `${entry.addonId}::${capName}`;
+		if (!seen.has(key)) {
+			seen.add(key);
+			descriptors.push({
+				capName,
+				mode: "singleton",
+				addonId: entry.addonId
+			});
+		}
+	}
+	for (const { capName, addonId, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
+		capName,
+		mode: "collection",
+		deviceId,
+		addonId
+	});
+	return descriptors;
+}
+//#endregion
 //#region src/kernel/moleculer/child-addon-call-dispatch.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -329,33 +386,6 @@ async function loadAddonModule(addonId, addonDir) {
 		AddonClass
 	};
 }
-/**
-* Builds the {@link ChildCapDescriptor} array that the UDS child transport
-* sends to the parent on registration.
-*
-* - Singleton caps come from the runner UNION manifest (all caps registered by
-*   every addon in this runner). One descriptor per unique cap name, mode
-*   `'singleton'` and no `deviceId`.
-* - Device-scoped caps come from the native-cap snapshot — one descriptor per
-*   (capName, deviceId) pair, mode `'collection'`.
-*/
-function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
-	const descriptors = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of manifest) for (const capName of entry.capabilities) if (!seen.has(capName)) {
-		seen.add(capName);
-		descriptors.push({
-			capName,
-			mode: "singleton"
-		});
-	}
-	for (const { capName, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
-		capName,
-		mode: "collection",
-		deviceId
-	});
-	return descriptors;
-}
 async function main() {
 	const runnerId = process.env["CAMSTACK_RUNNER_ID"];
 	const addonsJson = process.env["CAMSTACK_RUNNER_ADDONS"];
@@ -423,14 +453,34 @@ async function main() {
 	const runnerManifest = [];
 	/**
 	* Aggregated singleton (system-scoped) providers across ALL addons in this
-	* runner — keyed by capName. Read by the UDS child-cap dispatch to resolve
-	* singleton calls (no Moleculer). Populated during the addon-init loop; a
-	* cap-call that arrives before its addon initialises is rejected by the
+	* runner — keyed capName → (addonId → provider). Read by the UDS child-cap
+	* dispatch to resolve singleton calls (no Moleculer). The nested per-addon
+	* keying matters for GROUPED runners (`execution.group`): two co-located
+	* addons can register the SAME collection cap (e.g. `network-access` from
+	* cloudflare-tunnel AND tailscale-ingress) — a flat capName map would keep
+	* only the last-registered provider. Populated during the addon-init loop;
+	* a cap-call that arrives before its addon initialises is rejected by the
 	* dispatcher (the parent only routes caps the child has registered via the
 	* UDS `register`/`updateCaps` handshake).
 	*/
 	const allSingletonProviders = /* @__PURE__ */ new Map();
 	/**
+	* Resolve a singleton provider for the dispatcher: exact (capName, addonId)
+	* match when the hint names a hosted provider, else the cap's first
+	* registered provider (an unmatched `addonId` is method DATA — e.g.
+	* `addons.restartAddon({ addonId })` — not a routing key).
+	*/
+	const resolveSingletonProvider = (capName, addonId) => {
+		const byAddon = allSingletonProviders.get(capName);
+		if (!byAddon || byAddon.size === 0) return null;
+		if (addonId !== void 0) {
+			const exact = byAddon.get(addonId);
+			if (exact !== void 0) return exact;
+		}
+		const first = byAddon.values().next();
+		return first.done ? null : first.value;
+	};
+	/**
 	* Per-addon route-provider map — keyed by addonId → the addon's live
 	* `addon-routes` provider object. Resolves `getRouteProvider(addonId)`
 	* per-addon rather than returning a single global provider. Populated
@@ -469,7 +519,7 @@ async function main() {
 		childId: runnerId,
 		caps: buildChildCapDescriptors(runnerManifest, getWorkerNativeCapSnapshot()),
 		dispatch: createChildCapDispatch({
-			getSingletonProvider: (capName) => allSingletonProviders.get(capName) ?? null,
+			getSingletonProvider: (capName, addonId) => resolveSingletonProvider(capName, addonId),
 			getDeviceProvider: (capName, deviceId) => getWorkerNativeCapProvider(capName, deviceId) ?? null
 		})
 	});
@@ -534,7 +584,9 @@ async function main() {
 			context.registerProvider(capName, reg.provider);
 			const prov = reg.provider;
 			if (prov !== null && typeof prov === "object" && !Array.isArray(prov)) {
-				allSingletonProviders.set(capName, prov);
+				const byAddon = allSingletonProviders.get(capName) ?? /* @__PURE__ */ new Map();
+				byAddon.set(spec.addonId, prov);
+				allSingletonProviders.set(capName, byAddon);
 				if (capName === "addon-routes") addonRouteProviders.set(spec.addonId, prov);
 			}
 		}

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.d.ts

@@ -2,6 +2,8 @@ import { BaseAddon, ProviderRegistration } from '@camstack/types';
 export declare class AddonPagesAggregatorAddon extends BaseAddon {
     readonly id = "addon-pages-aggregator";
     private resolvedPaths;
+    /** Content-hash cache-buster memo, keyed `path:size:mtime`. */
+    private readonly bundleHashCache;
     /**
      * Last successful `listPages()` snapshot per source. Used as the
      * "stale-but-valid" fallback when a source transiently fails — drops
@@ -27,10 +29,12 @@ export declare class AddonPagesAggregatorAddon extends BaseAddon {
     private scheduleRetry;
     private retrySource;
     /**
-     * Build `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. Falls back
-     * to `Date.now()` when the bundle path can't be stat'd (remote addon
-     * with no local file, addon not yet on disk, etc.) — the browser
-     * just gets a fresh URL on each call instead of cache-friendly mtime.
+     * Build `/api/addon-pages/<addonId>/<bundle>?v=<contentHash>`. A CONTENT
+     * hash, NOT mtime: reproducible builds stamp a FIXED mtime (observed
+     * 1985-10-26) so an mtime `?v=` never changes across redeploys and a
+     * caching proxy (Cloudflare tunnel) serves a STALE bundle. Hashing the
+     * (small) MF entry file busts the cache exactly when the bundle changes.
+     * Memoised per (path,size,mtime); `Date.now()` when the file is absent.
      */
     private makeBundleUrl;
     /**

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DriXJoVg.js");
+const require_dist = require("../../dist-fRVWwrkF.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
@@ -88,6 +88,8 @@ var PER_SOURCE_TIMEOUT_MS = 2500;
 var AddonPagesAggregatorAddon = class extends require_dist.BaseAddon {
 	id = "addon-pages-aggregator";
 	resolvedPaths = null;
+	/** Content-hash cache-buster memo, keyed `path:size:mtime`. */
+	bundleHashCache = /* @__PURE__ */ new Map();
 	/**
 	* Last successful `listPages()` snapshot per source. Used as the
 	* "stale-but-valid" fallback when a source transiently fails — drops
@@ -205,18 +207,28 @@ var AddonPagesAggregatorAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	/**
-	* Build `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. Falls back
-	* to `Date.now()` when the bundle path can't be stat'd (remote addon
-	* with no local file, addon not yet on disk, etc.) — the browser
-	* just gets a fresh URL on each call instead of cache-friendly mtime.
+	* Build `/api/addon-pages/<addonId>/<bundle>?v=<contentHash>`. A CONTENT
+	* hash, NOT mtime: reproducible builds stamp a FIXED mtime (observed
+	* 1985-10-26) so an mtime `?v=` never changes across redeploys and a
+	* caching proxy (Cloudflare tunnel) serves a STALE bundle. Hashing the
+	* (small) MF entry file busts the cache exactly when the bundle changes.
+	* Memoised per (path,size,mtime); `Date.now()` when the file is absent.
 	*/
 	makeBundleUrl(addonId, bundle) {
 		const bundlePath = this.resolveBundlePath(addonId, bundle);
-		let mtime = Date.now();
-		if (bundlePath !== null) try {
-			mtime = node_fs.statSync(bundlePath).mtimeMs;
-		} catch {}
-		return `/api/addon-pages/${addonId}/${bundle}?v=${Math.floor(mtime)}`;
+		if (bundlePath === null) return `/api/addon-pages/${addonId}/${bundle}?v=${Math.floor(Date.now())}`;
+		try {
+			const stat = node_fs.statSync(bundlePath);
+			const cacheKey = `${bundlePath}:${stat.size}:${stat.mtimeMs}`;
+			let v = this.bundleHashCache.get(cacheKey);
+			if (v === void 0) {
+				v = (0, node_crypto.createHash)("sha1").update(node_fs.readFileSync(bundlePath)).digest("hex").slice(0, 12);
+				this.bundleHashCache.set(cacheKey, v);
+			}
+			return `/api/addon-pages/${addonId}/${bundle}?v=${v}`;
+		} catch {
+			return `/api/addon-pages/${addonId}/${bundle}?v=${Math.floor(Date.now())}`;
+		}
 	}
 	/**
 	* Resolve the local filesystem path for an addon's bundle. Mirrors

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,8 +1,8 @@
-import { $ as errMsg, et as BaseAddon, f as addonPagesCapability, st as EventCategory } from "../../dist-DlGZpWo8.mjs";
+import { $ as errMsg, et as BaseAddon, f as addonPagesCapability, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 //#region src/builtins/addon-pages-aggregator/dedupe-pages.ts
 /** Stable identity for an addon page, independent of which node reported it. */
 function pageKey(info) {
@@ -81,6 +81,8 @@ var PER_SOURCE_TIMEOUT_MS = 2500;
 var AddonPagesAggregatorAddon = class extends BaseAddon {
 	id = "addon-pages-aggregator";
 	resolvedPaths = null;
+	/** Content-hash cache-buster memo, keyed `path:size:mtime`. */
+	bundleHashCache = /* @__PURE__ */ new Map();
 	/**
 	* Last successful `listPages()` snapshot per source. Used as the
 	* "stale-but-valid" fallback when a source transiently fails — drops
@@ -198,18 +200,28 @@ var AddonPagesAggregatorAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* Build `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. Falls back
-	* to `Date.now()` when the bundle path can't be stat'd (remote addon
-	* with no local file, addon not yet on disk, etc.) — the browser
-	* just gets a fresh URL on each call instead of cache-friendly mtime.
+	* Build `/api/addon-pages/<addonId>/<bundle>?v=<contentHash>`. A CONTENT
+	* hash, NOT mtime: reproducible builds stamp a FIXED mtime (observed
+	* 1985-10-26) so an mtime `?v=` never changes across redeploys and a
+	* caching proxy (Cloudflare tunnel) serves a STALE bundle. Hashing the
+	* (small) MF entry file busts the cache exactly when the bundle changes.
+	* Memoised per (path,size,mtime); `Date.now()` when the file is absent.
 	*/
 	makeBundleUrl(addonId, bundle) {
 		const bundlePath = this.resolveBundlePath(addonId, bundle);
-		let mtime = Date.now();
-		if (bundlePath !== null) try {
-			mtime = fs.statSync(bundlePath).mtimeMs;
-		} catch {}
-		return `/api/addon-pages/${addonId}/${bundle}?v=${Math.floor(mtime)}`;
+		if (bundlePath === null) return `/api/addon-pages/${addonId}/${bundle}?v=${Math.floor(Date.now())}`;
+		try {
+			const stat = fs.statSync(bundlePath);
+			const cacheKey = `${bundlePath}:${stat.size}:${stat.mtimeMs}`;
+			let v = this.bundleHashCache.get(cacheKey);
+			if (v === void 0) {
+				v = createHash("sha1").update(fs.readFileSync(bundlePath)).digest("hex").slice(0, 12);
+				this.bundleHashCache.set(cacheKey, v);
+			}
+			return `/api/addon-pages/${addonId}/${bundle}?v=${v}`;
+		} catch {
+			return `/api/addon-pages/${addonId}/${bundle}?v=${Math.floor(Date.now())}`;
+		}
 	}
 	/**
 	* Resolve the local filesystem path for an addon's bundle. Mirrors

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.d.ts

@@ -2,6 +2,8 @@ import { BaseAddon, ProviderRegistration } from '@camstack/types';
 export declare class AddonWidgetsAggregatorAddon extends BaseAddon {
     readonly id = "addon-widgets-aggregator";
     private resolvedPaths;
+    /** Content-hash cache-buster memo, keyed `path:size:mtime`. */
+    private readonly bundleHashCache;
     /**
      * Last successful `listWidgets()` snapshot per source. Used as the
      * "stale-but-valid" fallback when a source transiently fails — drops
@@ -41,6 +43,8 @@ export declare class AddonWidgetsAggregatorAddon extends BaseAddon {
      * just gets a fresh URL on each call instead of cache-friendly mtime.
      */
     private makeBundleUrl;
+    /** sha1(content) 12-hex of a bundle entry file, memoised; `Date.now()` when absent. */
+    private bundleVersionTag;
     private resolveBundlePath;
     private resolvePaths;
 }

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DriXJoVg.js");
+const require_dist = require("../../dist-fRVWwrkF.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
@@ -18,9 +18,10 @@ let node_crypto = require("node:crypto");
 * Mirrors `addon-pages-aggregator` exactly: walks every registered
 * `addon-widgets-source` (collection) provider and emits an enriched
 * widget metadata list with versioned `bundleUrl`s pointing at
-* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
-* `mtime` cache-buster lets the browser pick up addon rebuilds without
-* manual reload.
+* `/api/addon-widgets/<addonId>/<bundle>?v=<contentHash>`. The
+* content-hash cache-buster lets the browser (and any caching proxy)
+* pick up addon rebuilds without manual reload — see `makeBundleUrl`
+* for why mtime is unusable (reproducible builds fix it).
 *
 * The static file endpoint (`/api/addon-widgets/:addonId/*`) is served
 * by `AddonWidgetsService.resolveBundle()` on the server side; this
@@ -57,6 +58,8 @@ var PER_SOURCE_TIMEOUT_MS = 2500;
 var AddonWidgetsAggregatorAddon = class extends require_dist.BaseAddon {
 	id = "addon-widgets-aggregator";
 	resolvedPaths = null;
+	/** Content-hash cache-buster memo, keyed `path:size:mtime`. */
+	bundleHashCache = /* @__PURE__ */ new Map();
 	/**
 	* Last successful `listWidgets()` snapshot per source. Used as the
 	* "stale-but-valid" fallback when a source transiently fails — drops
@@ -195,11 +198,22 @@ var AddonWidgetsAggregatorAddon = class extends require_dist.BaseAddon {
 	*/
 	makeBundleUrl(addonId, bundle) {
 		const bundlePath = this.resolveBundlePath(addonId, bundle);
-		let mtime = Date.now();
-		if (bundlePath !== null) try {
-			mtime = node_fs.statSync(bundlePath).mtimeMs;
-		} catch {}
-		return `/api/addon-widgets/${addonId}/${bundle}?v=${Math.floor(mtime)}`;
+		return `/api/addon-widgets/${addonId}/${bundle}?v=${this.bundleVersionTag(bundlePath)}`;
+	}
+	/** sha1(content) 12-hex of a bundle entry file, memoised; `Date.now()` when absent. */
+	bundleVersionTag(bundlePath) {
+		if (bundlePath === null) return String(Math.floor(Date.now()));
+		try {
+			const stat = node_fs.statSync(bundlePath);
+			const cacheKey = `${bundlePath}:${stat.size}:${stat.mtimeMs}`;
+			const cached = this.bundleHashCache.get(cacheKey);
+			if (cached !== void 0) return cached;
+			const hash = (0, node_crypto.createHash)("sha1").update(node_fs.readFileSync(bundlePath)).digest("hex").slice(0, 12);
+			this.bundleHashCache.set(cacheKey, hash);
+			return hash;
+		} catch {
+			return String(Math.floor(Date.now()));
+		}
 	}
 	resolveBundlePath(addonId, bundle) {
 		const paths = this.resolvedPaths;

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,8 +1,8 @@
-import { $ as errMsg, et as BaseAddon, m as addonWidgetsCapability, st as EventCategory } from "../../dist-DlGZpWo8.mjs";
+import { $ as errMsg, et as BaseAddon, m as addonWidgetsCapability, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 //#region src/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.ts
 /**
 * Addon Widgets Aggregator — hub-local builtin that owns the singleton
@@ -11,9 +11,10 @@ import { randomUUID } from "node:crypto";
 * Mirrors `addon-pages-aggregator` exactly: walks every registered
 * `addon-widgets-source` (collection) provider and emits an enriched
 * widget metadata list with versioned `bundleUrl`s pointing at
-* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
-* `mtime` cache-buster lets the browser pick up addon rebuilds without
-* manual reload.
+* `/api/addon-widgets/<addonId>/<bundle>?v=<contentHash>`. The
+* content-hash cache-buster lets the browser (and any caching proxy)
+* pick up addon rebuilds without manual reload — see `makeBundleUrl`
+* for why mtime is unusable (reproducible builds fix it).
 *
 * The static file endpoint (`/api/addon-widgets/:addonId/*`) is served
 * by `AddonWidgetsService.resolveBundle()` on the server side; this
@@ -50,6 +51,8 @@ var PER_SOURCE_TIMEOUT_MS = 2500;
 var AddonWidgetsAggregatorAddon = class extends BaseAddon {
 	id = "addon-widgets-aggregator";
 	resolvedPaths = null;
+	/** Content-hash cache-buster memo, keyed `path:size:mtime`. */
+	bundleHashCache = /* @__PURE__ */ new Map();
 	/**
 	* Last successful `listWidgets()` snapshot per source. Used as the
 	* "stale-but-valid" fallback when a source transiently fails — drops
@@ -188,11 +191,22 @@ var AddonWidgetsAggregatorAddon = class extends BaseAddon {
 	*/
 	makeBundleUrl(addonId, bundle) {
 		const bundlePath = this.resolveBundlePath(addonId, bundle);
-		let mtime = Date.now();
-		if (bundlePath !== null) try {
-			mtime = fs.statSync(bundlePath).mtimeMs;
-		} catch {}
-		return `/api/addon-widgets/${addonId}/${bundle}?v=${Math.floor(mtime)}`;
+		return `/api/addon-widgets/${addonId}/${bundle}?v=${this.bundleVersionTag(bundlePath)}`;
+	}
+	/** sha1(content) 12-hex of a bundle entry file, memoised; `Date.now()` when absent. */
+	bundleVersionTag(bundlePath) {
+		if (bundlePath === null) return String(Math.floor(Date.now()));
+		try {
+			const stat = fs.statSync(bundlePath);
+			const cacheKey = `${bundlePath}:${stat.size}:${stat.mtimeMs}`;
+			const cached = this.bundleHashCache.get(cacheKey);
+			if (cached !== void 0) return cached;
+			const hash = createHash("sha1").update(fs.readFileSync(bundlePath)).digest("hex").slice(0, 12);
+			this.bundleHashCache.set(cacheKey, hash);
+			return hash;
+		} catch {
+			return String(Math.floor(Date.now()));
+		}
 	}
 	resolveBundlePath(addonId, bundle) {
 		const paths = this.resolvedPaths;

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DriXJoVg.js");
+const require_dist = require("../../dist-fRVWwrkF.js");
 //#region src/builtins/alerts/alerts.addon.ts
 var CATEGORY_MAPPINGS = {
 	"addon.crashed": {