@camstack/system 1.2.157 → 1.2.160

package/dist/{manifest-python-deps-DVODn-qc.js → manifest-system-deps-oJMkWSX-.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-require("./dist-CDgIzo82.js");
+require("./dist-CcvXUhHK.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let _camstack_types_node = require("@camstack/types/node");
@@ -1607,7 +1607,7 @@ function createAddonDataPlaneFacility(args) {
 * Failures THROW with an actionable message — a caller must never proceed as
 * if dependencies were installed when they were not.
 */
-var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 /** Where the bootstrap lands inside `cacheDir` (npm tgz carries a `package/` prefix). */
 function bootstrappedCliPath(cacheDir) {
@@ -1615,7 +1615,7 @@ function bootstrappedCliPath(cacheDir) {
 }
 async function defaultProbeSystemNpm() {
 	try {
-		await execFileAsync$1("npm", ["--version"], { timeout: 15e3 });
+		await execFileAsync$2("npm", ["--version"], { timeout: 15e3 });
 		return true;
 	} catch {
 		return false;
@@ -1633,7 +1633,7 @@ async function defaultDownloadTarball(url, destTgz) {
 	await node_fs.promises.writeFile(destTgz, bytes);
 }
 async function defaultExtractTarball(tgzPath, destDir) {
-	await execFileAsync$1("tar", [
+	await execFileAsync$2("tar", [
 		"-xzf",
 		tgzPath,
 		"-C",
@@ -1672,7 +1672,7 @@ async function runNpm(args, options) {
 		registry: options.registry,
 		logger: options.logger
 	});
-	return execFileAsync$1(invocation.command, [...invocation.argsPrefix, ...args], {
+	return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
 		...options.cwd !== void 0 ? { cwd: options.cwd } : {},
 		timeout: options.timeout ?? 3e5
 	});
@@ -1752,7 +1752,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/deps/manifest-native-deps.ts
-var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Fallback bootstrap-cache location when the caller doesn't thread one
 * through (the forked addon-runner's spawn-time install). tmpdir survives the
@@ -2061,7 +2061,7 @@ async function rebuildNativeDeps(addonDir, packageNames, logger, npmCacheDir, re
 				return;
 			}
 			logger.warn("@electron/rebuild not available — falling back to npx", { meta: { addonDir } });
-			await execFileAsync("npx", [
+			await execFileAsync$1("npx", [
 				"--yes",
 				"electron-rebuild",
 				"-m",
@@ -5550,6 +5550,246 @@ function createLocalTransport() {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/cap-usage-registry.ts
+/**
+* In-memory observation of tRPC cap calls between addons — the store behind
+* `nodes.getCapUsageGraph`.
+*
+* Storage: `Map<callerAddonId, Map<providerAddonId, Map<capName, RollingWindow>>>`.
+* `RollingWindow` is a fixed-size ring of 1-second buckets — default 300
+* buckets = 5 minutes retention. Queries narrower than the retention window
+* filter buckets at read time.
+*
+* ── The ring ages, and that is not free decoration ─────────────────────────
+* Buckets are indexed `second % retention`, so a bucket written at second S is
+* hit again at S + retention·k forever. Until 2026-08-30 nothing ever zeroed
+* them: the `lastCallAtMs` guard hid it while a triple was fully idle, but ONE
+* fresh call re-armed the entire stale ring. A triple that made 1000 calls and
+* then one call five minutes later reported **1001 calls/min instead of 1**.
+* An over-counted edge is worse than the empty graph this instrument shipped
+* with — silence invites doubt, a confident wrong number sends the next
+* investigation at the wrong addon.
+*
+* The fix is clear-forward: on each record, zero the buckets the ring has
+* ADVANCED over since the previous write, and never read past the last written
+* second. Amortised O(1) — a busy triple clears 0–1 buckets per call, and an
+* idle one clears at most `retention` once, when it wakes.
+*
+* ── Cardinality is bounded, because this map lives on hub-main ─────────────
+* The previous docblock claimed "~22 MB worst case … under 200 KB at ~10 active
+* triples". Both numbers were written for a smaller machine and the second was
+* an assumption, not a bound: the key space is caller × provider × cap, and on
+* the live hub that is 64 addons × 64 runners × ~150 caps. Nothing capped it.
+*
+* Today a ring is one `Uint32Array(retention)` — 1.2 KB of ArrayBuffer at the
+* default — plus the three Map entries that reach it. MEASURED (`heapUsed` +
+* `arrayBuffers`, node 24, `--expose-gc`): **1.7 KB per triple**, so ≈1.0 MB at
+* the realistic hub figure (64 callers × a handful of caps each, ≈600 triples)
+* and **6.3 MB at the {@link DEFAULT_MAX_TRIPLES} ceiling**. `recordCall` costs
+* ≈46 ns (1e6 calls in 46 ms) — at the 39 717 calls/min that started this
+* investigation, ≈30 µs of hub-main per second.
+*
+* Reclamation is what keeps it at the low end: a triple whose ring has entirely
+* aged out is dead data and is dropped on the next admission sweep. The hard
+* cap only exists so that a pathological key space (a caller id derived from
+* something unbounded) cannot take hub-main's heap with it — and when it bites,
+* {@link CapUsageRegistry.getStats} says how often, because an instrument that
+* truncates silently is the defect this whole file exists to fix (D237).
+*/
+/** Ring length in seconds when the caller does not pick one. */
+var DEFAULT_RETENTION_SECONDS = 300;
+/**
+* Ceiling on live `(caller, provider, cap)` triples. ≈1.5 KB each → ≈6 MB.
+* Roughly 6× the realistic hub figure, so it is a backstop against an
+* unbounded key space, not a working limit.
+*/
+var DEFAULT_MAX_TRIPLES = 4e3;
+/**
+* Provider placeholder for a call the PARENT routed rather than short-
+* circuiting to a sibling runner: hub-in-process (`settings-store`,
+* `device-manager`, the `$core-caps` bridge), or a remote node. At the layer
+* that records — the parent's `cap-call-out` handler — the sibling id IS the
+* provider and everything else has not been resolved yet.
+*
+* It is a NAMED unknown, not a dropped observation, for the reason D237 was
+* written: the caller is always known, and "who is hammering `settings-store`"
+* is the question this graph exists to answer. Sibling to
+* `UNRESOLVED_PROVIDER_ADDON_ID` in `trpc-links.ts`, which names the same kind
+* of unknown one layer up.
+*/
+var PARENT_ROUTED_PROVIDER_ADDON_ID = "(unresolved: parent-routed)";
+var CapUsageRegistry = class {
+	retentionSeconds;
+	maxTriples;
+	map = /* @__PURE__ */ new Map();
+	triples = 0;
+	droppedTriples = 0;
+	constructor(opts) {
+		this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? DEFAULT_RETENTION_SECONDS);
+		this.maxTriples = Math.max(1, opts?.maxTriples ?? DEFAULT_MAX_TRIPLES);
+	}
+	/**
+	* Record one observed cap call.
+	*
+	* On the hot path: this runs once per cross-process cap call on hub-main's
+	* event loop, which is the cluster's only queue (D181). Three Map lookups, an
+	* integer increment, and — only when the wall clock has moved on — a bounded
+	* clear. No allocation once a triple exists, and it NEVER throws into the
+	* call it observes.
+	*/
+	recordCall(rec) {
+		try {
+			if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
+			if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
+			const window = this.windowFor(rec);
+			if (window === null) return;
+			const sec = Math.floor(rec.atMs / 1e3);
+			if (window.lastCallAtMs !== 0) {
+				const lastSec = Math.floor(window.lastCallAtMs / 1e3);
+				const advanced = Math.min(sec - lastSec, this.retentionSeconds);
+				for (let k = 1; k <= advanced; k++) window.buckets[(lastSec + k) % this.retentionSeconds] = 0;
+			}
+			const idx = sec % this.retentionSeconds;
+			window.buckets[idx] = (window.buckets[idx] ?? 0) + 1;
+			if (rec.atMs > window.lastCallAtMs) window.lastCallAtMs = rec.atMs;
+		} catch {}
+	}
+	getGraph(opts) {
+		const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
+		const minMs = opts.nowMs - windowSeconds * 1e3;
+		const nowSec = Math.floor(opts.nowMs / 1e3);
+		const out = [];
+		for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window] of byCap) {
+			if (window.lastCallAtMs < minMs) continue;
+			const count = this.sumWindow(window, nowSec, windowSeconds);
+			if (count === 0) continue;
+			const callsPerMin = count / windowSeconds * 60;
+			out.push({
+				callerAddonId: caller,
+				providerAddonId: provider,
+				capName,
+				callsPerMin,
+				lastCallAtMs: window.lastCallAtMs
+			});
+		}
+		return out;
+	}
+	/** See {@link CapUsageStats}. Cheap — three counters, no scan. */
+	getStats() {
+		return {
+			triples: this.triples,
+			maxTriples: this.maxTriples,
+			droppedTriples: this.droppedTriples
+		};
+	}
+	/** Test / diagnostic helper — drops all recorded calls. */
+	clear() {
+		this.map.clear();
+		this.triples = 0;
+		this.droppedTriples = 0;
+	}
+	/**
+	* Sum the buckets covering `(nowSec - windowSeconds, nowSec]`.
+	*
+	* The scan starts at `lastSec`, never at `nowSec`. `recordCall` clears the
+	* buckets the ring has advanced OVER, which by definition stops at the last
+	* write: the buckets for the seconds since then still hold whatever the
+	* previous pass left in them, and reading `nowSec` down would count it. A
+	* triple that went quiet for a couple of minutes and then made one call would
+	* report the burst it made five minutes earlier.
+	*
+	* No lower bound is needed beyond the window itself: every bucket at or below
+	* `lastSec - retention` was cleared by the advance that reached `lastSec`, so
+	* it reads zero anyway. The loop is bounded by `windowSeconds ≤ retention`.
+	*/
+	sumWindow(window, nowSec, windowSeconds) {
+		const lastSec = Math.floor(window.lastCallAtMs / 1e3);
+		const from = Math.min(nowSec, lastSec);
+		const floorSec = nowSec - windowSeconds;
+		let count = 0;
+		for (let s = from; s > floorSec; s--) count += window.buckets[s % this.retentionSeconds] ?? 0;
+		return count;
+	}
+	/**
+	* The ring for this triple, creating it if the ceiling allows. `null` means
+	* the observation is dropped — counted, never silent (see
+	* {@link CapUsageStats.droppedTriples}).
+	*/
+	windowFor(rec) {
+		let byProvider = this.map.get(rec.callerAddonId);
+		if (!byProvider) {
+			byProvider = /* @__PURE__ */ new Map();
+			this.map.set(rec.callerAddonId, byProvider);
+		}
+		let byCap = byProvider.get(rec.providerAddonId);
+		if (!byCap) {
+			byCap = /* @__PURE__ */ new Map();
+			byProvider.set(rec.providerAddonId, byCap);
+		}
+		const existing = byCap.get(rec.capName);
+		if (existing) return existing;
+		if (this.triples >= this.maxTriples) {
+			this.reclaimExpired(rec.atMs);
+			if (this.triples >= this.maxTriples) {
+				this.droppedTriples++;
+				return null;
+			}
+			byProvider = this.map.get(rec.callerAddonId);
+			if (!byProvider) {
+				byProvider = /* @__PURE__ */ new Map();
+				this.map.set(rec.callerAddonId, byProvider);
+			}
+			byCap = byProvider.get(rec.providerAddonId);
+			if (!byCap) {
+				byCap = /* @__PURE__ */ new Map();
+				byProvider.set(rec.providerAddonId, byCap);
+			}
+		}
+		const created = {
+			buckets: new Uint32Array(this.retentionSeconds),
+			lastCallAtMs: 0
+		};
+		byCap.set(rec.capName, created);
+		this.triples++;
+		return created;
+	}
+	/**
+	* Drop every triple whose whole ring has aged out — its last call is older
+	* than the retention window, so it can contribute to no query. O(triples),
+	* and only reachable when the ceiling is full, so it is amortised away by the
+	* admissions it enables.
+	*/
+	reclaimExpired(nowMs) {
+		const cutoff = nowMs - this.retentionSeconds * 1e3;
+		for (const [caller, byProvider] of this.map) {
+			for (const [provider, byCap] of byProvider) {
+				for (const [capName, window] of byCap) {
+					if (window.lastCallAtMs >= cutoff) continue;
+					byCap.delete(capName);
+					this.triples--;
+				}
+				if (byCap.size === 0) byProvider.delete(provider);
+			}
+			if (byProvider.size === 0) this.map.delete(caller);
+		}
+	}
+};
+var singleton = null;
+/**
+* The registry for THIS process. Deliberately per-process: the reader
+* (`nodes.getCapUsageGraph` → `cap-providers.ts`) runs on hub-main, so only
+* writes made on hub-main are ever visible. See the blind-spot list on
+* `LocalChildRegistryOptions.capUsageObserver` for what that excludes.
+*/
+function getCapUsageRegistry() {
+	if (!singleton) singleton = new CapUsageRegistry();
+	return singleton;
+}
+/** Test helper — clears the singleton (kept module-private elsewhere). */
+function __resetCapUsageRegistryForTests() {
+	singleton = null;
+}
+//#endregion
 //#region src/kernel/moleculer/event-bus-core.ts
 /**
 * @param retainRecent - `true` ONLY for the hub main broker bus (it serves
@@ -6241,6 +6481,8 @@ var LocalChildRegistry = class {
 	isAddonPinnedCall;
 	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
 	capTimeoutMs;
+	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+	capUsageObserver;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
 	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -6272,6 +6514,7 @@ var LocalChildRegistry = class {
 			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
 			this.isAddonPinnedCall = opts.isAddonPinnedCall;
 			this.capTimeoutMs = opts.capTimeoutMs;
+			this.capUsageObserver = opts.capUsageObserver;
 		} else {
 			this.server = serverOrOptions;
 			this.onUnownedCall = onUnownedCallArg;
@@ -6438,6 +6681,29 @@ var LocalChildRegistry = class {
 		}
 		return candidates[0];
 	}
+	/**
+	* Publish one cap-usage observation, if a sink is wired.
+	*
+	* Cost discipline — this is on the hot path (D181: hub-main's event loop is
+	* the cluster's only queue): no sink means one undefined check; with a sink
+	* it is one object literal and one `Date.now()`, and the sink itself is O(1).
+	* Wrapped so a broken observer can never fail the call it observes — the
+	* registry swallows too, and BOTH matter: this catch also covers a sink that
+	* is not the registry.
+	*/
+	recordCapUsage(callerChildId, providerChildId, capName, methodName) {
+		const sink = this.capUsageObserver;
+		if (sink === void 0 || callerChildId === null) return;
+		try {
+			sink({
+				callerAddonId: callerChildId,
+				providerAddonId: providerChildId ?? "(unresolved: parent-routed)",
+				capName,
+				methodName,
+				atMs: Date.now()
+			});
+		} catch {}
+	}
 	/** First child whose cap manifest contains a descriptor matching `predicate`. */
 	findChildId(predicate) {
 		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
@@ -6707,7 +6973,9 @@ var LocalChildRegistry = class {
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
 				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
 				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
-				if ((!(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
+				this.recordCapUsage(childId, target, out.capName, out.method);
+				if (target !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -7859,80 +8127,6 @@ function buildLinkChain(target, localResolver, hookup) {
 	return links;
 }
 //#endregion
-//#region src/kernel/moleculer/cap-usage-registry.ts
-var CapUsageRegistry = class {
-	retentionSeconds;
-	map = /* @__PURE__ */ new Map();
-	constructor(opts) {
-		this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? 300);
-	}
-	recordCall(rec) {
-		try {
-			if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
-			if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
-			let byProvider = this.map.get(rec.callerAddonId);
-			if (!byProvider) {
-				byProvider = /* @__PURE__ */ new Map();
-				this.map.set(rec.callerAddonId, byProvider);
-			}
-			let byCap = byProvider.get(rec.providerAddonId);
-			if (!byCap) {
-				byCap = /* @__PURE__ */ new Map();
-				byProvider.set(rec.providerAddonId, byCap);
-			}
-			let window = byCap.get(rec.capName);
-			if (!window) {
-				window = {
-					buckets: Array.from({ length: this.retentionSeconds }, () => 0),
-					lastCallAtMs: 0
-				};
-				byCap.set(rec.capName, window);
-			}
-			const bucketIdx = Math.floor(rec.atMs / 1e3) % this.retentionSeconds;
-			window.buckets[bucketIdx] = (window.buckets[bucketIdx] ?? 0) + 1;
-			if (rec.atMs > window.lastCallAtMs) window.lastCallAtMs = rec.atMs;
-		} catch {}
-	}
-	getGraph(opts) {
-		const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
-		const minMs = opts.nowMs - windowSeconds * 1e3;
-		const out = [];
-		for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window] of byCap) {
-			if (window.lastCallAtMs < minMs) continue;
-			const nowBucket = Math.floor(opts.nowMs / 1e3);
-			let count = 0;
-			for (let i = 0; i < windowSeconds; i++) {
-				const b = (nowBucket - i + this.retentionSeconds * 1e6) % this.retentionSeconds;
-				count += window.buckets[b] ?? 0;
-			}
-			if (count === 0) continue;
-			const callsPerMin = count / windowSeconds * 60;
-			out.push({
-				callerAddonId: caller,
-				providerAddonId: provider,
-				capName,
-				callsPerMin,
-				lastCallAtMs: window.lastCallAtMs
-			});
-		}
-		return out;
-	}
-	/** Test / diagnostic helper — drops all recorded calls. */
-	clear() {
-		this.map.clear();
-	}
-};
-var singleton = null;
-/** Hub-side singleton. The first caller seeds it; subsequent calls return the same. */
-function getCapUsageRegistry() {
-	if (!singleton) singleton = new CapUsageRegistry();
-	return singleton;
-}
-/** Test helper — clears the singleton (kept module-private elsewhere). */
-function __resetCapUsageRegistryForTests() {
-	singleton = null;
-}
-//#endregion
 //#region src/kernel/hwaccel/hwaccel-resolver.ts
 /**
 * Platform-probe for hardware video decode acceleration.
@@ -9504,6 +9698,195 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
+//#region src/kernel/deps/manifest-system-deps.ts
+/**
+* Auto-install the host binaries declared in an addon's manifest
+* (`camstack.addons[].systemDependencies`) before `onInitialize()` runs.
+*
+* ── Why this is framework and not addon-local ──────────────────────────────
+* The Python precedent (`camstack.addons[].python.requirements` →
+* `installManifestPythonDeps`, called from the same place in
+* `addon-runner.ts`) already answers "this addon needs something installed,
+* satisfy it before its caps register". A binary is the same question with a
+* different package manager, so it gets the same mechanism rather than a
+* second one per addon — CLAUDE.md forbids a parallel answer where one exists,
+* and the next addon that needs `rclone` or `mediainfo` inherits this for
+* free instead of copying a startup routine.
+*
+* ── The four things this has to get right ──────────────────────────────────
+*  1. **Cheap on the common path.** The binary is probed first; the package
+*     manager is only invoked when it is genuinely absent. Runners respawn
+*     routinely (deploys, updates, crash recovery) and a network round-trip on
+*     every boot is a cost the Python mechanism does not impose either.
+*  2. **Runs every boot, not once.** The install lands INSIDE the container
+*     and is lost on every image update. That is expected. "Already
+*     installed" is a success, not an error.
+*  3. **Honest, not fatal.** A failure warns and returns. The addon still
+*     loads; the capability that wraps the binary is responsible for refusing
+*     loudly on its own surface. Aborting the runner here would take the
+*     addon's SIBLINGS down with it (they share `execution.group`).
+*  4. **Platform reality is stated, not assumed.** An unsupported host logs
+*     which manager it looked for and continues. Silence would read as
+*     "installed".
+*
+* Every branch that declines to install SAYS SO. A dependency step that
+* produced no line at all is indistinguishable from one that never ran, and
+* the failure it precedes ("smbclient: ENOENT") arrives minutes later in a
+* different addon's logs.
+*/
+var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+/** How long a single package-manager invocation may take. */
+var INSTALL_TIMEOUT_MS = 300 * 1e3;
+/** How long the `command -v <binary>` presence probe may take. */
+var PROBE_TIMEOUT_MS = 1e4;
+/**
+* Satisfy every `systemDependencies` entry the declaration carries.
+* Resolves regardless of outcome — see the docblock.
+*/
+async function installManifestSystemDeps(declaration, logger, options = {}) {
+	const deps = declaration.systemDependencies;
+	if (!deps || deps.length === 0) return;
+	const hasBinary = options.hasBinary ?? defaultHasBinary;
+	const detectManager = options.detectManager ?? defaultDetectManager;
+	const run = options.run ?? defaultRun;
+	const platform = options.platform ?? process.platform;
+	for (const dep of deps) try {
+		await satisfyOne(dep, declaration.id, {
+			hasBinary,
+			detectManager,
+			run,
+			platform
+		}, logger);
+	} catch (err) {
+		logger.warn("system dependency step failed", { meta: {
+			addonId: declaration.id,
+			binary: dep.binary,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+	}
+}
+async function satisfyOne(dep, addonId, rt, logger) {
+	if (await rt.hasBinary(dep.binary)) {
+		logger.debug("system dependency already present", { meta: {
+			addonId,
+			binary: dep.binary
+		} });
+		return;
+	}
+	const manager = await rt.detectManager();
+	if (manager === null) {
+		logger.warn("system dependency missing and no supported package manager on this host", { meta: {
+			addonId,
+			binary: dep.binary,
+			platform: rt.platform,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
+	const packageName = dep.packages[manager];
+	if (packageName === void 0 || packageName.length === 0) {
+		logger.warn("system dependency missing and the addon declares no package for this manager", { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
+	const plan = planFor(manager, packageName);
+	logger.info("installing system dependency", { meta: {
+		addonId,
+		binary: dep.binary,
+		manager,
+		package: packageName
+	} });
+	try {
+		for (const [command, args] of plan.steps) await rt.run(command, args);
+	} catch (err) {
+		logger.warn("system dependency install failed — the addon loads, its capability must refuse", { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName,
+			error: err instanceof Error ? err.message : String(err),
+			...dep.reason !== void 0 ? { reason: dep.reason } : {}
+		} });
+		return;
+	}
+	if (!await rt.hasBinary(dep.binary)) {
+		logger.warn("system dependency installed but the binary still does not resolve", { meta: {
+			addonId,
+			binary: dep.binary,
+			manager,
+			package: packageName
+		} });
+		return;
+	}
+	logger.info("system dependency installed", { meta: {
+		addonId,
+		binary: dep.binary,
+		manager,
+		package: packageName
+	} });
+}
+function planFor(manager, packageName) {
+	switch (manager) {
+		case "apt": return {
+			manager,
+			steps: [["apt-get", ["update"]], ["apt-get", [
+				"install",
+				"-y",
+				"--no-install-recommends",
+				packageName
+			]]]
+		};
+		case "apk": return {
+			manager,
+			steps: [["apk", [
+				"add",
+				"--no-cache",
+				packageName
+			]]]
+		};
+		case "dnf": return {
+			manager,
+			steps: [["dnf", [
+				"install",
+				"-y",
+				packageName
+			]]]
+		};
+		case "brew": return {
+			manager,
+			steps: [["brew", ["install", packageName]]]
+		};
+	}
+}
+async function defaultHasBinary(binary) {
+	try {
+		await execFileAsync("command", ["-v", binary], {
+			timeout: PROBE_TIMEOUT_MS,
+			shell: process.platform === "win32" ? false : "/bin/sh"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function defaultDetectManager() {
+	const candidates = node_os.platform() === "darwin" ? ["brew"] : [
+		"apt",
+		"apk",
+		"dnf",
+		"brew"
+	];
+	for (const candidate of candidates) if (await defaultHasBinary(candidate === "apt" ? "apt-get" : candidate)) return candidate;
+	return null;
+}
+async function defaultRun(command, args) {
+	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+}
+//#endregion
 Object.defineProperty(exports, "AGENT_CAP_FWD_ACTION", {
 	enumerable: true,
 	get: function() {
@@ -9678,6 +10061,12 @@ Object.defineProperty(exports, "NATIVE_PROVIDER_SERVICE_INFIX", {
 		return NATIVE_PROVIDER_SERVICE_INFIX;
 	}
 });
+Object.defineProperty(exports, "PARENT_ROUTED_PROVIDER_ADDON_ID", {
+	enumerable: true,
+	get: function() {
+		return PARENT_ROUTED_PROVIDER_ADDON_ID;
+	}
+});
 Object.defineProperty(exports, "RSS_BUDGET_REANNOUNCE_MIN_MS", {
 	enumerable: true,
 	get: function() {
@@ -10098,6 +10487,12 @@ Object.defineProperty(exports, "installManifestPythonDeps", {
 		return installManifestPythonDeps;
 	}
 });
+Object.defineProperty(exports, "installManifestSystemDeps", {
+	enumerable: true,
+	get: function() {
+		return installManifestSystemDeps;
+	}
+});
 Object.defineProperty(exports, "ipcParentLink", {
 	enumerable: true,
 	get: function() {

package/dist/{retired-settings-keys-CV4QVdXj.mjs → retired-settings-keys-C3eONTvV.mjs}

@@ -1,4 +1,4 @@
-import { zt as asJsonObject } from "./dist-LvKus-mT.mjs";
+import { Ht as asJsonObject } from "./dist-DKs---Vx.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-BfAzWvPC.js → retired-settings-keys-DXZ2xe7C.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CDgIzo82.js");
+const require_dist = require("./dist-CcvXUhHK.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.157",
+  "version": "1.2.160",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -135,6 +135,7 @@
             "displayName": "Backups",
             "description": "Backup archives.",
             "cardinality": "multi",
+            "access": "cap-mediated",
             "defaultRoot": "backup"
           }
         ]