@camstack/system 1.1.38 → 1.1.40

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-B6ahe90k.js");
+const require_manifest_python_deps = require("./manifest-python-deps-Cp9WdXiT.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-4QvOLiBn.mjs";
+import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-6u3YnO2u.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { register } from "node:module";
 import * as fs from "node:fs";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, f as addonPagesCapability, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, f as addonPagesCapability, st as EventCategory } from "../../dist-C0d3UidT.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, m as addonWidgetsCapability, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, m as addonWidgetsCapability, st as EventCategory } from "../../dist-C0d3UidT.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 //#region src/builtins/alerts/alerts.addon.ts
 var CATEGORY_MAPPINGS = {
 	"addon.crashed": {

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, h as alertsCapability, mt as createEvent, n as AlertSchema, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, h as alertsCapability, mt as createEvent, n as AlertSchema, st as EventCategory } from "../../dist-C0d3UidT.mjs";
 //#region src/builtins/alerts/alerts.addon.ts
 var CATEGORY_MAPPINGS = {
 	"addon.crashed": {

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);
@@ -3021,6 +3021,7 @@ var DEFAULT_BACKUP_LOCATIONS = [
 ];
 /** Path of the manifest file embedded inside every archive. */
 var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
+var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
 /**
 * System-level archive primitives. Construct one per server boot;
 * methods are pure I/O.
@@ -3028,33 +3029,55 @@ var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 var SystemBackupService = class {
 	dataDir;
 	logger;
-	constructor(dataDir, logger) {
+	statCacheTtlMs;
+	statCache = /* @__PURE__ */ new Map();
+	constructor(dataDir, logger, opts) {
 		this.dataDir = dataDir;
 		this.logger = logger;
+		this.statCacheTtlMs = opts?.statCacheTtlMs ?? DEFAULT_STAT_CACHE_TTL_MS;
 	}
 	/**
 	* Snapshot the current size + file count of each well-known
 	* location. Used by the admin UI to render an opt-in checklist
 	* before triggering a backup, and by `createArchive` to derive the
 	* embedded manifest.
+	*
+	* The walk is async (yields to the event loop per directory) and
+	* per-location results are cached + single-flighted: the service
+	* runs in-process in the hub, and a synchronous walk of the 70k+
+	* file `addons` location blocked the event loop long enough to kill
+	* WS keepalives cluster-wide.
 	*/
 	statLocations(locations = DEFAULT_BACKUP_LOCATIONS) {
-		return locations.map((loc) => {
-			const abs = node_path.isAbsolute(loc) ? loc : node_path.join(this.dataDir, loc);
-			if (!node_fs.existsSync(abs)) return {
-				name: loc,
-				sizeBytes: 0,
-				fileCount: 0,
-				present: false
-			};
-			const walked = walkAbs(abs, abs);
-			return {
-				name: loc,
-				sizeBytes: walked.reduce((acc, e) => acc + e.sizeBytes, 0),
-				fileCount: walked.filter((e) => e.kind === "file").length,
-				present: true
-			};
+		return Promise.all(locations.map((loc) => this.statLocationCached(loc)));
+	}
+	statLocationCached(loc) {
+		const now = Date.now();
+		const hit = this.statCache.get(loc);
+		if (hit && now - hit.at < this.statCacheTtlMs) return hit.value;
+		const value = this.statLocation(loc);
+		this.statCache.set(loc, {
+			at: now,
+			value
 		});
+		value.catch(() => this.statCache.delete(loc));
+		return value;
+	}
+	async statLocation(loc) {
+		const abs = node_path.isAbsolute(loc) ? loc : node_path.join(this.dataDir, loc);
+		if (!node_fs.existsSync(abs)) return {
+			name: loc,
+			sizeBytes: 0,
+			fileCount: 0,
+			present: false
+		};
+		const walked = await walkAbs(abs, abs);
+		return {
+			name: loc,
+			sizeBytes: walked.reduce((acc, e) => acc + e.sizeBytes, 0),
+			fileCount: walked.filter((e) => e.kind === "file").length,
+			present: true
+		};
 	}
 	/**
 	* Create a tar.gz of the given locations. Uses the `tar` npm package
@@ -3082,8 +3105,8 @@ var SystemBackupService = class {
 		const entries = [];
 		for (const loc of present) {
 			const abs = node_path.join(this.dataDir, loc);
-			const stat = node_fs.statSync(abs);
-			if (stat.isDirectory()) for (const e of walkAbs(abs, this.dataDir)) entries.push(e);
+			const stat = await node_fs_promises.stat(abs);
+			if (stat.isDirectory()) for (const e of await walkAbs(abs, this.dataDir)) entries.push(e);
 			else entries.push(toArchiveEntry(abs, this.dataDir, stat));
 		}
 		const manifest = {
@@ -3258,15 +3281,15 @@ var SystemBackupService = class {
 * path. Symlinks are dereferenced (matches the `follow: true` flag we
 * pass to tar.create).
 */
-function walkAbs(absRoot, dataDir) {
+async function walkAbs(absRoot, dataDir) {
 	const out = [];
-	walkRec(absRoot, dataDir, out);
+	await walkRec(absRoot, dataDir, out);
 	return out;
 }
-function walkRec(abs, dataDir, out) {
+async function walkRec(abs, dataDir, out) {
 	let stat;
 	try {
-		stat = node_fs.statSync(abs);
+		stat = await node_fs_promises.stat(abs);
 	} catch {
 		return;
 	}
@@ -3274,11 +3297,11 @@ function walkRec(abs, dataDir, out) {
 	if (stat.isDirectory()) {
 		let children;
 		try {
-			children = node_fs.readdirSync(abs);
+			children = await node_fs_promises.readdir(abs);
 		} catch {
 			return;
 		}
-		for (const child of children) walkRec(node_path.join(abs, child), dataDir, out);
+		for (const child of children) await walkRec(node_path.join(abs, child), dataDir, out);
 	}
 }
 function toArchiveEntry(abs, dataDir, stat) {

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { et as BaseAddon, st as EventCategory, v as backupCapability } from "../../dist-CU3lb_Ys.mjs";
+import { et as BaseAddon, st as EventCategory, v as backupCapability } from "../../dist-C0d3UidT.mjs";
 import * as fs from "node:fs";
 import Kt from "node:fs";
 import * as path$1 from "node:path";
@@ -3006,6 +3006,7 @@ var DEFAULT_BACKUP_LOCATIONS = [
 ];
 /** Path of the manifest file embedded inside every archive. */
 var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
+var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
 /**
 * System-level archive primitives. Construct one per server boot;
 * methods are pure I/O.
@@ -3013,33 +3014,55 @@ var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 var SystemBackupService = class {
 	dataDir;
 	logger;
-	constructor(dataDir, logger) {
+	statCacheTtlMs;
+	statCache = /* @__PURE__ */ new Map();
+	constructor(dataDir, logger, opts) {
 		this.dataDir = dataDir;
 		this.logger = logger;
+		this.statCacheTtlMs = opts?.statCacheTtlMs ?? DEFAULT_STAT_CACHE_TTL_MS;
 	}
 	/**
 	* Snapshot the current size + file count of each well-known
 	* location. Used by the admin UI to render an opt-in checklist
 	* before triggering a backup, and by `createArchive` to derive the
 	* embedded manifest.
+	*
+	* The walk is async (yields to the event loop per directory) and
+	* per-location results are cached + single-flighted: the service
+	* runs in-process in the hub, and a synchronous walk of the 70k+
+	* file `addons` location blocked the event loop long enough to kill
+	* WS keepalives cluster-wide.
 	*/
 	statLocations(locations = DEFAULT_BACKUP_LOCATIONS) {
-		return locations.map((loc) => {
-			const abs = path$1.isAbsolute(loc) ? loc : path$1.join(this.dataDir, loc);
-			if (!fs.existsSync(abs)) return {
-				name: loc,
-				sizeBytes: 0,
-				fileCount: 0,
-				present: false
-			};
-			const walked = walkAbs(abs, abs);
-			return {
-				name: loc,
-				sizeBytes: walked.reduce((acc, e) => acc + e.sizeBytes, 0),
-				fileCount: walked.filter((e) => e.kind === "file").length,
-				present: true
-			};
+		return Promise.all(locations.map((loc) => this.statLocationCached(loc)));
+	}
+	statLocationCached(loc) {
+		const now = Date.now();
+		const hit = this.statCache.get(loc);
+		if (hit && now - hit.at < this.statCacheTtlMs) return hit.value;
+		const value = this.statLocation(loc);
+		this.statCache.set(loc, {
+			at: now,
+			value
 		});
+		value.catch(() => this.statCache.delete(loc));
+		return value;
+	}
+	async statLocation(loc) {
+		const abs = path$1.isAbsolute(loc) ? loc : path$1.join(this.dataDir, loc);
+		if (!fs.existsSync(abs)) return {
+			name: loc,
+			sizeBytes: 0,
+			fileCount: 0,
+			present: false
+		};
+		const walked = await walkAbs(abs, abs);
+		return {
+			name: loc,
+			sizeBytes: walked.reduce((acc, e) => acc + e.sizeBytes, 0),
+			fileCount: walked.filter((e) => e.kind === "file").length,
+			present: true
+		};
 	}
 	/**
 	* Create a tar.gz of the given locations. Uses the `tar` npm package
@@ -3067,8 +3090,8 @@ var SystemBackupService = class {
 		const entries = [];
 		for (const loc of present) {
 			const abs = path$1.join(this.dataDir, loc);
-			const stat = fs.statSync(abs);
-			if (stat.isDirectory()) for (const e of walkAbs(abs, this.dataDir)) entries.push(e);
+			const stat = await fsp.stat(abs);
+			if (stat.isDirectory()) for (const e of await walkAbs(abs, this.dataDir)) entries.push(e);
 			else entries.push(toArchiveEntry(abs, this.dataDir, stat));
 		}
 		const manifest = {
@@ -3243,15 +3266,15 @@ var SystemBackupService = class {
 * path. Symlinks are dereferenced (matches the `follow: true` flag we
 * pass to tar.create).
 */
-function walkAbs(absRoot, dataDir) {
+async function walkAbs(absRoot, dataDir) {
 	const out = [];
-	walkRec(absRoot, dataDir, out);
+	await walkRec(absRoot, dataDir, out);
 	return out;
 }
-function walkRec(abs, dataDir, out) {
+async function walkRec(abs, dataDir, out) {
 	let stat;
 	try {
-		stat = fs.statSync(abs);
+		stat = await fsp.stat(abs);
 	} catch {
 		return;
 	}
@@ -3259,11 +3282,11 @@ function walkRec(abs, dataDir, out) {
 	if (stat.isDirectory()) {
 		let children;
 		try {
-			children = fs.readdirSync(abs);
+			children = await fsp.readdir(abs);
 		} catch {
 			return;
 		}
-		for (const child of children) walkRec(path$1.join(abs, child), dataDir, out);
+		for (const child of children) await walkRec(path$1.join(abs, child), dataDir, out);
 	}
 }
 function toArchiveEntry(abs, dataDir, stat) {

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { P as logDestinationCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { P as logDestinationCapability, et as BaseAddon } from "../../dist-C0d3UidT.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, C as enumerateItemArrayFields, D as getByPath, Q as validateExpressionSource, R as normalizeUnit, S as deviceStatusCapability, T as evaluateLinkExpression, Tt as sleep, W as setByPath, X as toExpressionValue, a as DeviceStatusSchema, at as DeviceRole, b as deviceManagerCapability, c as STREAM_PROFILE_META, et as BaseAddon, g as applyTransform, i as CAP_NAMES_WITH_STATUS, it as DeviceFeature, ot as DeviceType, st as EventCategory, t as ALL_CAPABILITY_DEFINITIONS, ut as WELL_KNOWN_TAB_MAP, w as enumerateSchemaFields, x as deviceStateCapability, y as buildStreamParamsConfigSchema, yt as isDeviceConfigCap, z as parseStreamParamsFormPatch } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, C as enumerateItemArrayFields, D as getByPath, Q as validateExpressionSource, R as normalizeUnit, S as deviceStatusCapability, T as evaluateLinkExpression, Tt as sleep, W as setByPath, X as toExpressionValue, a as DeviceStatusSchema, at as DeviceRole, b as deviceManagerCapability, c as STREAM_PROFILE_META, et as BaseAddon, g as applyTransform, i as CAP_NAMES_WITH_STATUS, it as DeviceFeature, ot as DeviceType, st as EventCategory, t as ALL_CAPABILITY_DEFINITIONS, ut as WELL_KNOWN_TAB_MAP, w as enumerateSchemaFields, x as deviceStateCapability, y as buildStreamParamsConfigSchema, yt as isDeviceConfigCap, z as parseStreamParamsFormPatch } from "../../dist-C0d3UidT.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { P as logDestinationCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { P as logDestinationCapability, et as BaseAddon } from "../../dist-C0d3UidT.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,4 +1,4 @@
-import { Z as userManagementCapability, _ as authProviderCapability, d as UserRecordSchema, et as BaseAddon, l as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-CU3lb_Ys.mjs";
+import { Z as userManagementCapability, _ as authProviderCapability, d as UserRecordSchema, et as BaseAddon, l as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-C0d3UidT.mjs";
 import { createRequire } from "node:module";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { N as localNetworkCapability, et as BaseAddon, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { N as localNetworkCapability, et as BaseAddon, st as EventCategory } from "../../dist-C0d3UidT.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { I as metricsProviderCapability, et as BaseAddon, mt as createEvent, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { I as metricsProviderCapability, et as BaseAddon, mt as createEvent, st as EventCategory } from "../../dist-C0d3UidT.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, B as platformProbeCapability, U as scoreRuntimes, et as BaseAddon, gt as emitReadiness, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, B as platformProbeCapability, U as scoreRuntimes, et as BaseAddon, gt as emitReadiness, st as EventCategory } from "../../dist-C0d3UidT.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { et as BaseAddon, st as EventCategory } from "../../dist-CU3lb_Ys.mjs";
+import { et as BaseAddon, st as EventCategory } from "../../dist-C0d3UidT.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot.addon.ts
 /** Default cache window for non-battery cams (seconds). 10s feels live. */

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, K as snapshotCapability, L as nodePin, Y as streamQualityLabel, et as BaseAddon, it as DeviceFeature, ot as DeviceType } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, K as snapshotCapability, L as nodePin, Y as streamQualityLabel, et as BaseAddon, it as DeviceFeature, ot as DeviceType } from "../../dist-C0d3UidT.mjs";
 import { execFile } from "node:child_process";
 //#region src/builtins/snapshot/snapshot.addon.ts
 /** Default cache window for non-battery cams (seconds). 10s feels live. */

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { E as filesystemBrowseCapability, J as storageProviderCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { E as filesystemBrowseCapability, J as storageProviderCapability, et as BaseAddon } from "../../dist-C0d3UidT.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_crypto = require("node:crypto");
 let better_sqlite3 = require("better-sqlite3");
 better_sqlite3 = require_chunk.__toESM(better_sqlite3);

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, G as settingsStoreCapability, dt as asJsonObject, et as BaseAddon, s as RUNTIME_DEFAULTS, xt as parseJsonUnknown } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, G as settingsStoreCapability, dt as asJsonObject, et as BaseAddon, s as RUNTIME_DEFAULTS, xt as parseJsonUnknown } from "../../dist-C0d3UidT.mjs";
 import { randomUUID } from "node:crypto";
 import Database from "better-sqlite3";
 //#region src/builtins/sqlite-storage/sqlite-settings-backend.ts

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { bt as parseJsonObject, et as BaseAddon, q as storageCapability, u as StorageLocationTypeSchema } from "../../dist-CU3lb_Ys.mjs";
+import { bt as parseJsonObject, et as BaseAddon, q as storageCapability, u as StorageLocationTypeSchema } from "../../dist-C0d3UidT.mjs";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
 import { buildStorageLocationRegistry } from "@camstack/system";

package/dist/builtins/system-backup/system-backup.service.d.ts

@@ -64,6 +64,14 @@ export interface LocationStat {
     /** False when the location doesn't exist under dataDir. */
     readonly present: boolean;
 }
+export interface SystemBackupServiceOptions {
+    /**
+     * How long a `statLocations` walk result stays fresh. The `addons`
+     * location holds tens of thousands of files; without a cache every
+     * admin-UI visit re-walks it.
+     */
+    readonly statCacheTtlMs?: number;
+}
 /**
  * System-level archive primitives. Construct one per server boot;
  * methods are pure I/O.
@@ -71,14 +79,24 @@ export interface LocationStat {
 export declare class SystemBackupService {
     private readonly dataDir;
     private readonly logger;
-    constructor(dataDir: string, logger: IScopedLogger);
+    private readonly statCacheTtlMs;
+    private readonly statCache;
+    constructor(dataDir: string, logger: IScopedLogger, opts?: SystemBackupServiceOptions);
     /**
      * Snapshot the current size + file count of each well-known
      * location. Used by the admin UI to render an opt-in checklist
      * before triggering a backup, and by `createArchive` to derive the
      * embedded manifest.
+     *
+     * The walk is async (yields to the event loop per directory) and
+     * per-location results are cached + single-flighted: the service
+     * runs in-process in the hub, and a synchronous walk of the 70k+
+     * file `addons` location blocked the event loop long enough to kill
+     * WS keepalives cluster-wide.
      */
-    statLocations(locations?: readonly string[]): readonly LocationStat[];
+    statLocations(locations?: readonly string[]): Promise<readonly LocationStat[]>;
+    private statLocationCached;
+    private statLocation;
     /**
      * Create a tar.gz of the given locations. Uses the `tar` npm package
      * (used by npm itself) instead of shelling out — gives us:

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, et as BaseAddon, vt as hydrateSchema } from "../../dist-CU3lb_Ys.mjs";
+import { $ as errMsg, et as BaseAddon, vt as hydrateSchema } from "../../dist-C0d3UidT.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-fRVWwrkF.js");
+const require_dist = require("../../dist-D_ijwYtl.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { P as logDestinationCapability, et as BaseAddon } from "../../dist-CU3lb_Ys.mjs";
+import { P as logDestinationCapability, et as BaseAddon } from "../../dist-C0d3UidT.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-CU3lb_Ys.mjs → dist-C0d3UidT.mjs}

@@ -16578,6 +16578,19 @@ getTurnServers: method(z.void(), z.array(TurnServerSchema).readonly()) }
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -16634,6 +16647,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(z.object({}), z.object({ optionsJSON: z.record(z.string(), z.unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(z.object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: z.record(z.string(), z.unknown()) }), z.object({
+			verified: z.boolean(),
+			userId: z.string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(z.object({ userId: z.string() }), z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(z.object({
 			userId: z.string(),
@@ -24532,6 +24558,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -24544,6 +24576,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",

package/dist/{dist-fRVWwrkF.js → dist-D_ijwYtl.js}

@@ -16578,6 +16578,19 @@ getTurnServers: method(zod.z.void(), zod.z.array(TurnServerSchema).readonly()) }
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
@@ -16634,6 +16647,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(zod.z.object({}), zod.z.object({ optionsJSON: zod.z.record(zod.z.string(), zod.z.unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(zod.z.object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: zod.z.record(zod.z.string(), zod.z.unknown()) }), zod.z.object({
+			verified: zod.z.boolean(),
+			userId: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(zod.z.object({ userId: zod.z.string() }), zod.z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(zod.z.object({
 			userId: zod.z.string(),
@@ -24532,6 +24558,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -24544,6 +24576,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-fRVWwrkF.js");
+const require_dist = require("./dist-D_ijwYtl.js");
 const require_model_download_service = require("./model-download-service-D-Umz4-L.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
@@ -21,7 +21,7 @@ const require_builtins_local_auth_local_auth_addon = require("./builtins/local-a
 require("./builtins/local-auth/index.js");
 const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
 require("./builtins/device-manager/index.js");
-const require_manifest_python_deps = require("./manifest-python-deps-B6ahe90k.js");
+const require_manifest_python_deps = require("./manifest-python-deps-Cp9WdXiT.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
@@ -2587,6 +2587,71 @@ async function copyDirRecursive(src, dest) {
 	});
 }
 /**
+* Runtime natives that must stay installable even when an addon forgets to
+* declare them: the mirror of the build preset's `COMMON_NATIVE_DEPS`
+* (tools/build/vite-lib.preset.ts — build tooling, not loadable at runtime).
+* These are the ONLY packages a self-contained dist genuinely `require()`s
+* from node_modules; everything else is already inlined by the bundle.
+*/
+var RUNTIME_NATIVE_KEEP = [
+	"better-sqlite3",
+	"node-av",
+	"onnxruntime-node",
+	"sharp",
+	"ssh2",
+	"werift",
+	"systeminformation"
+];
+/** Read `camstack.runtimeDependencies` (extra non-native deps the dist
+*  requires at runtime — versions come from the manifest's own dep maps). */
+function readRuntimeDependencies(pkg) {
+	const camstack = pkg.camstack;
+	if (camstack === null || typeof camstack !== "object" || Array.isArray(camstack)) return [];
+	const raw = camstack.runtimeDependencies;
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((entry) => typeof entry === "string");
+}
+/**
+* Strip every dependency an addon's self-contained dist has already bundled,
+* keeping ONLY what must resolve from node_modules at runtime:
+*
+*   keep = RUNTIME_NATIVE_KEEP ∪ camstack.runtimeDependencies (minus @camstack/*)
+*
+* Addon dists are fully bundled (vite `externals: 'self-contained'`), yet the
+* blanket `npm install` of the manifest's dependencies re-installed the whole
+* tree the dist already contains — 98% of the deployed addons dir was
+* redundant node_modules (74k files / 1.34 GB on the live hub; it stalled the
+* backup walk and bloated every deploy). Kept PEER deps are folded into
+* `dependencies` so `--omit=peer` installs can't drop them (pipeline's
+* patched `werift`).
+*
+* Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
+* (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
+*
+* Returns a new object (immutable).
+*/
+function stripBundledDeps(pkg) {
+	if (process.env.CAMSTACK_INSTALL_FULL_DEPS === "1") return stripCamstackDeps(pkg);
+	const camstack = pkg.camstack;
+	if (camstack !== null && typeof camstack === "object" && !Array.isArray(camstack) && camstack.system === true) return stripCamstackDeps(pkg);
+	const keep = new Set([...RUNTIME_NATIVE_KEEP, ...readRuntimeDependencies(pkg)]);
+	const kept = {};
+	for (const depType of ["dependencies", "peerDependencies"]) {
+		const rawDeps = pkg[depType];
+		if (rawDeps === null || typeof rawDeps !== "object" || Array.isArray(rawDeps)) continue;
+		for (const [name, version] of Object.entries(rawDeps)) {
+			if (name.startsWith("@camstack/")) continue;
+			if (!keep.has(name) || typeof version !== "string") continue;
+			if (!(name in kept)) kept[name] = version;
+		}
+	}
+	const result = { ...pkg };
+	result.dependencies = Object.keys(kept).length > 0 ? kept : void 0;
+	result.peerDependencies = void 0;
+	delete result.devDependencies;
+	return result;
+}
+/**
 * Strip @camstack/* dependencies and devDependencies from a package.json object.
 * Used when installing addons into the addons directory — @camstack packages
 * are provided by the host runtime, not installed per-addon.
@@ -3171,7 +3236,7 @@ var AddonInstaller = class AddonInstaller {
 			force: true
 		});
 		ensureDir(targetDir);
-		await node_fs.promises.writeFile(node_path.join(targetDir, "package.json"), JSON.stringify(stripCamstackDeps(pkgData), null, 2));
+		await node_fs.promises.writeFile(node_path.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
 		await copyDirRecursive(distDir, node_path.join(targetDir, "dist"));
 		await copyExtraFileDirs(pkgData, sourceDir, targetDir);
 		await node_fs.promises.writeFile(node_path.join(targetDir, ".install-source"), "local");
@@ -3180,7 +3245,7 @@ var AddonInstaller = class AddonInstaller {
 			version: localPkgVersion,
 			source: "local"
 		});
-		const strippedDeps = stripCamstackDeps(pkgData);
+		const strippedDeps = stripBundledDeps(pkgData);
 		if (strippedDeps["dependencies"] && typeof strippedDeps["dependencies"] === "object" && Object.keys(strippedDeps["dependencies"]).length > 0) try {
 			await execFileAsync("npm", [
 				"install",
@@ -3358,7 +3423,7 @@ var AddonInstaller = class AddonInstaller {
 			if (!pkgView) throw new Error(`Invalid package.json at ${pkgJsonPath}`);
 			if (!pkgView.camstackAddons) throw new Error(`Package ${pkgView.name} has no camstack.addons manifest`);
 			const targetDir = node_path.join(this.addonsDir, pkgView.name);
-			const strippedManifest = stripCamstackDeps(pkgView.raw);
+			const strippedManifest = stripBundledDeps(pkgView.raw);
 			await node_fs.promises.writeFile(pkgJsonPath, JSON.stringify(strippedManifest, null, 2));
 			const strippedRuntimeDeps = strippedManifest["dependencies"];
 			if (strippedRuntimeDeps != null && typeof strippedRuntimeDeps === "object" && Object.keys(strippedRuntimeDeps).length > 0) {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg$1, A as isVoidInput, Ct as resolveCapMount, F as looseSchema, M as lifecycleJobSchema, O as isArrayOutputSchema, St as readinessKey, V as procedureAuthKey, _t as expandCapMethods, bt as parseJsonObject, ct as ReadinessRegistry, dt as asJsonObject$1, ft as asNumber, ht as emitDownForOwnedCaps, j as kebabToCamel, k as isObjectInput, lt as ReadinessTimeoutError, mt as createEvent, nt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, o as METHOD_ACCESS_MAP, p as addonSettingsCapability, pt as asString$1, rt as DEVICE_STATUS_METHOD, s as RUNTIME_DEFAULTS, st as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tt as DATAPLANE_SECRET_HEADER$1, wt as scopeKey, xt as parseJsonUnknown$1 } from "./dist-CU3lb_Ys.mjs";
+import { $ as errMsg$1, A as isVoidInput, Ct as resolveCapMount, F as looseSchema, M as lifecycleJobSchema, O as isArrayOutputSchema, St as readinessKey, V as procedureAuthKey, _t as expandCapMethods, bt as parseJsonObject, ct as ReadinessRegistry, dt as asJsonObject$1, ft as asNumber, ht as emitDownForOwnedCaps, j as kebabToCamel, k as isObjectInput, lt as ReadinessTimeoutError, mt as createEvent, nt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, o as METHOD_ACCESS_MAP, p as addonSettingsCapability, pt as asString$1, rt as DEVICE_STATUS_METHOD, s as RUNTIME_DEFAULTS, st as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tt as DATAPLANE_SECRET_HEADER$1, wt as scopeKey, xt as parseJsonUnknown$1 } from "./dist-C0d3UidT.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-C-IHWnXx.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Le3l0qS2.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
@@ -19,7 +19,7 @@ import { LocalAuthAddon, a as require_ms, c as __esmMin, d as __toCommonJS, f as
 import "./builtins/local-auth/index.mjs";
 import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
-import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, B as AGENT_CAP_FWD_SERVICE, C as buildLinkChain, D as HUB_CAP_FWD_ACTION, E as localProviderLink, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, N as udsChildLogToWorkerEntry, O as HUB_CAP_FWD_SERVICE, P as createUdsLogger, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerTransportLink, T as ipcParentLink, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as resolveHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as getCapUsageRegistry, c as setHubConnected, ct as capActionName, d as getMoleculerEventStats, dt as capServiceName, et as createBrokerDeviceManagerApi, f as registerEventBusService, ft as parseCapAction, g as createKernelHwAccel, gt as CapabilityHandle, h as AddonDepsManager, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, k as createHubCapForwardService, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as subscribePassthrough, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as setNodeEventInterest, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as getBrokerEventBus, ut as capBareAction, v as CapUsageRegistry, vt as installManifestNativeDeps, w as ipcChildLink, x as brokerCallForCap, y as __resetCapUsageRegistryForTests, yt as resolveAddonClass, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-4QvOLiBn.mjs";
+import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, B as AGENT_CAP_FWD_SERVICE, C as buildLinkChain, D as HUB_CAP_FWD_ACTION, E as localProviderLink, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, N as udsChildLogToWorkerEntry, O as HUB_CAP_FWD_SERVICE, P as createUdsLogger, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerTransportLink, T as ipcParentLink, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as resolveHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as getCapUsageRegistry, c as setHubConnected, ct as capActionName, d as getMoleculerEventStats, dt as capServiceName, et as createBrokerDeviceManagerApi, f as registerEventBusService, ft as parseCapAction, g as createKernelHwAccel, gt as CapabilityHandle, h as AddonDepsManager, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, k as createHubCapForwardService, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as subscribePassthrough, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as setNodeEventInterest, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as getBrokerEventBus, ut as capBareAction, v as CapUsageRegistry, vt as installManifestNativeDeps, w as ipcChildLink, x as brokerCallForCap, y as __resetCapUsageRegistryForTests, yt as resolveAddonClass, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-6u3YnO2u.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { z } from "zod";
@@ -2579,6 +2579,71 @@ async function copyDirRecursive(src, dest) {
 	});
 }
 /**
+* Runtime natives that must stay installable even when an addon forgets to
+* declare them: the mirror of the build preset's `COMMON_NATIVE_DEPS`
+* (tools/build/vite-lib.preset.ts — build tooling, not loadable at runtime).
+* These are the ONLY packages a self-contained dist genuinely `require()`s
+* from node_modules; everything else is already inlined by the bundle.
+*/
+var RUNTIME_NATIVE_KEEP = [
+	"better-sqlite3",
+	"node-av",
+	"onnxruntime-node",
+	"sharp",
+	"ssh2",
+	"werift",
+	"systeminformation"
+];
+/** Read `camstack.runtimeDependencies` (extra non-native deps the dist
+*  requires at runtime — versions come from the manifest's own dep maps). */
+function readRuntimeDependencies(pkg) {
+	const camstack = pkg.camstack;
+	if (camstack === null || typeof camstack !== "object" || Array.isArray(camstack)) return [];
+	const raw = camstack.runtimeDependencies;
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((entry) => typeof entry === "string");
+}
+/**
+* Strip every dependency an addon's self-contained dist has already bundled,
+* keeping ONLY what must resolve from node_modules at runtime:
+*
+*   keep = RUNTIME_NATIVE_KEEP ∪ camstack.runtimeDependencies (minus @camstack/*)
+*
+* Addon dists are fully bundled (vite `externals: 'self-contained'`), yet the
+* blanket `npm install` of the manifest's dependencies re-installed the whole
+* tree the dist already contains — 98% of the deployed addons dir was
+* redundant node_modules (74k files / 1.34 GB on the live hub; it stalled the
+* backup walk and bloated every deploy). Kept PEER deps are folded into
+* `dependencies` so `--omit=peer` installs can't drop them (pipeline's
+* patched `werift`).
+*
+* Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
+* (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
+*
+* Returns a new object (immutable).
+*/
+function stripBundledDeps(pkg) {
+	if (process.env.CAMSTACK_INSTALL_FULL_DEPS === "1") return stripCamstackDeps(pkg);
+	const camstack = pkg.camstack;
+	if (camstack !== null && typeof camstack === "object" && !Array.isArray(camstack) && camstack.system === true) return stripCamstackDeps(pkg);
+	const keep = new Set([...RUNTIME_NATIVE_KEEP, ...readRuntimeDependencies(pkg)]);
+	const kept = {};
+	for (const depType of ["dependencies", "peerDependencies"]) {
+		const rawDeps = pkg[depType];
+		if (rawDeps === null || typeof rawDeps !== "object" || Array.isArray(rawDeps)) continue;
+		for (const [name, version] of Object.entries(rawDeps)) {
+			if (name.startsWith("@camstack/")) continue;
+			if (!keep.has(name) || typeof version !== "string") continue;
+			if (!(name in kept)) kept[name] = version;
+		}
+	}
+	const result = { ...pkg };
+	result.dependencies = Object.keys(kept).length > 0 ? kept : void 0;
+	result.peerDependencies = void 0;
+	delete result.devDependencies;
+	return result;
+}
+/**
 * Strip @camstack/* dependencies and devDependencies from a package.json object.
 * Used when installing addons into the addons directory — @camstack packages
 * are provided by the host runtime, not installed per-addon.
@@ -3163,7 +3228,7 @@ var AddonInstaller = class AddonInstaller {
 			force: true
 		});
 		ensureDir(targetDir);
-		await fs$17.promises.writeFile(path$39.join(targetDir, "package.json"), JSON.stringify(stripCamstackDeps(pkgData), null, 2));
+		await fs$17.promises.writeFile(path$39.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
 		await copyDirRecursive(distDir, path$39.join(targetDir, "dist"));
 		await copyExtraFileDirs(pkgData, sourceDir, targetDir);
 		await fs$17.promises.writeFile(path$39.join(targetDir, ".install-source"), "local");
@@ -3172,7 +3237,7 @@ var AddonInstaller = class AddonInstaller {
 			version: localPkgVersion,
 			source: "local"
 		});
-		const strippedDeps = stripCamstackDeps(pkgData);
+		const strippedDeps = stripBundledDeps(pkgData);
 		if (strippedDeps["dependencies"] && typeof strippedDeps["dependencies"] === "object" && Object.keys(strippedDeps["dependencies"]).length > 0) try {
 			await execFileAsync("npm", [
 				"install",
@@ -3350,7 +3415,7 @@ var AddonInstaller = class AddonInstaller {
 			if (!pkgView) throw new Error(`Invalid package.json at ${pkgJsonPath}`);
 			if (!pkgView.camstackAddons) throw new Error(`Package ${pkgView.name} has no camstack.addons manifest`);
 			const targetDir = path$39.join(this.addonsDir, pkgView.name);
-			const strippedManifest = stripCamstackDeps(pkgView.raw);
+			const strippedManifest = stripBundledDeps(pkgView.raw);
 			await fs$17.promises.writeFile(pkgJsonPath, JSON.stringify(strippedManifest, null, 2));
 			const strippedRuntimeDeps = strippedManifest["dependencies"];
 			if (strippedRuntimeDeps != null && typeof strippedRuntimeDeps === "object" && Object.keys(strippedRuntimeDeps).length > 0) {

package/dist/kernel/fs-utils.d.ts

@@ -14,6 +14,34 @@ export declare function ensureDir(dirPath: string): void;
  * `fs.promises.cp` keeps the I/O off the event loop. (Node ≥18 stable.)
  */
 export declare function copyDirRecursive(src: string, dest: string): Promise<void>;
+/**
+ * Runtime natives that must stay installable even when an addon forgets to
+ * declare them: the mirror of the build preset's `COMMON_NATIVE_DEPS`
+ * (tools/build/vite-lib.preset.ts — build tooling, not loadable at runtime).
+ * These are the ONLY packages a self-contained dist genuinely `require()`s
+ * from node_modules; everything else is already inlined by the bundle.
+ */
+export declare const RUNTIME_NATIVE_KEEP: readonly string[];
+/**
+ * Strip every dependency an addon's self-contained dist has already bundled,
+ * keeping ONLY what must resolve from node_modules at runtime:
+ *
+ *   keep = RUNTIME_NATIVE_KEEP ∪ camstack.runtimeDependencies (minus @camstack/*)
+ *
+ * Addon dists are fully bundled (vite `externals: 'self-contained'`), yet the
+ * blanket `npm install` of the manifest's dependencies re-installed the whole
+ * tree the dist already contains — 98% of the deployed addons dir was
+ * redundant node_modules (74k files / 1.34 GB on the live hub; it stalled the
+ * backup walk and bloated every deploy). Kept PEER deps are folded into
+ * `dependencies` so `--omit=peer` installs can't drop them (pipeline's
+ * patched `werift`).
+ *
+ * Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
+ * (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
+ *
+ * Returns a new object (immutable).
+ */
+export declare function stripBundledDeps(pkg: Record<string, unknown>): Record<string, unknown>;
 /**
  * Strip @camstack/* dependencies and devDependencies from a package.json object.
  * Used when installing addons into the addons directory — @camstack packages

package/dist/{manifest-python-deps-4QvOLiBn.mjs → manifest-python-deps-6u3YnO2u.mjs}

@@ -1,4 +1,4 @@
-import { H as readNodePin } from "./dist-CU3lb_Ys.mjs";
+import { H as readNodePin } from "./dist-C0d3UidT.mjs";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { createServer } from "node:http";
 import * as fs from "node:fs";
@@ -4527,7 +4527,8 @@ var LocalChildClient = class {
 				capName: msg.capName,
 				method: msg.method,
 				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {}
+				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
+				...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
 			});
 			if (msg.kind === "addon-call") {
 				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);

package/dist/{manifest-python-deps-B6ahe90k.js → manifest-python-deps-Cp9WdXiT.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-fRVWwrkF.js");
+const require_dist = require("./dist-D_ijwYtl.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
 let node_fs = require("node:fs");
@@ -4529,7 +4529,8 @@ var LocalChildClient = class {
 				capName: msg.capName,
 				method: msg.method,
 				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {}
+				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
+				...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
 			});
 			if (msg.kind === "addon-call") {
 				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.1.38",
+  "version": "1.1.40",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",