@camstack/system 1.2.179 → 1.2.180

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_system_deps = require("./manifest-system-deps-PAIfmNun.js");
+const require_manifest_system_deps = require("./manifest-system-deps-BVIr3MYJ.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { A as createUdsLoggerWithControl, Ft as RUNNER_RSS_BUDGET_ENV, Jt as startRunnerHeapWatch, Qt as emitHeapDiagnosticReport, a as createUdsAddonContext, bt as resolveAddonClass, it as setWorkerNativeCapsChangeListener, j as LocalChildClient, n as installManifestPythonDeps, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestSystemDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-system-deps-CMOGc5nC.mjs";
+import { A as createUdsLoggerWithControl, Ft as RUNNER_RSS_BUDGET_ENV, Jt as startRunnerHeapWatch, Qt as emitHeapDiagnosticReport, a as createUdsAddonContext, bt as resolveAddonClass, it as setWorkerNativeCapsChangeListener, j as LocalChildClient, n as installManifestPythonDeps, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestSystemDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-system-deps-Ci-jhrxY.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C7qWwrK1.js");
+const require_dist = require("../../dist-TEwQZL3g.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { E as addonPagesCapability, Ft as BaseAddon, Pt as errMsg, sn as EventCategory } from "../../dist-L_39vRmH.mjs";
+import { E as addonPagesCapability, Ft as BaseAddon, Pt as errMsg, sn as EventCategory } from "../../dist-DqNTelT4.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C7qWwrK1.js");
+const require_dist = require("../../dist-TEwQZL3g.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, O as addonWidgetsCapability, Pt as errMsg, sn as EventCategory } from "../../dist-L_39vRmH.mjs";
+import { Ft as BaseAddon, O as addonWidgetsCapability, Pt as errMsg, sn as EventCategory } from "../../dist-DqNTelT4.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C7qWwrK1.js");
+const require_dist = require("../../dist-TEwQZL3g.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, Jt as createEvent, Pt as errMsg, k as alertsCapability, n as AlertSchema, sn as EventCategory } from "../../dist-L_39vRmH.mjs";
+import { Ft as BaseAddon, Jt as createEvent, Pt as errMsg, k as alertsCapability, n as AlertSchema, sn as EventCategory } from "../../dist-DqNTelT4.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.d.ts

@@ -7,10 +7,12 @@ export declare class BackupOrchestratorAddon extends BaseAddon<Record<string, ne
     /**
      * Transient build buffer for archive fan-out. The tar is built here
      * ONCE, streamed to every destination via the storage cap's chunked
-     * upload, then removed. Lives in the addon's private `ctx.dataDir`
-     * (never `api.storage.resolve`, per the AddonContext contract) — a
-     * `cache` storage location is never declared, so resolving one threw
-     * and aborted every run before a byte was written.
+     * upload, then removed. Lives at `<nodeDataDir>/backup-staging` —
+     * OUTSIDE every backed-up location, so a backup can never contain a
+     * backup (the old `ctx.dataDir/staging` sat inside `addons-data` and
+     * compounded 175M → 4.5G before Jul 28), and distinct from
+     * `<nodeDataDir>/backups` where the default `backups` destination
+     * seeds when `CAMSTACK_BACKUP_ROOT` is unset. See staging-paths.ts.
      */
     private stagingDir;
     private scheduleTimer;
@@ -22,6 +24,15 @@ export declare class BackupOrchestratorAddon extends BaseAddon<Record<string, ne
      */
     private scheduleBaselineAt;
     private readonly manifestLock;
+    /**
+     * Global execution queue — at most ONE archive build at a time,
+     * cluster-node-wide (D342). Replaces the earlier invisible
+     * single-flight `buildLock`: same serialisation guarantee (two
+     * schedules due one tick apart built 8.2 GB + 3.7 GB side by side on
+     * the hub, 2026-09-04), but every run is now observable via
+     * `listRuns`, joinable when identical, and cancellable mid-stream.
+     */
+    private runQueue;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
     protected onShutdown(): Promise<void>;
@@ -59,14 +70,49 @@ export declare class BackupOrchestratorAddon extends BaseAddon<Record<string, ne
     private aggregatedList;
     private stagingPath;
     /**
-     * Build a single archive in the private staging dir, then push
-     * it to every selected destination via the storage cap's chunked
-     * upload protocol. Per-destination errors are logged and counted
-     * via allSettled semantics — one bad sink doesn't kill the run. The
-     * staging file is deleted in `finally` so a crash mid-fanout doesn't
-     * leak.
+     * Boot-time staging hygiene. Sweeps the staging dir (sparing an
+     * archive a pending-restore marker references — the boot hook has
+     * not consumed it yet), then reports — without touching — the LEGACY
+     * staging dir inside `addons-data`, where pre-move leaks live. The
+     * legacy dir held 5.1 GB on the hub; deleting operator-visible
+     * gigabytes silently is not this addon's call, so it warns with the
+     * footprint instead.
+     */
+    private cleanStagingArea;
+    /**
+     * Trigger a backup run through the global execution queue (D342):
+     * at most one archive build at a time, a trigger that arrives while
+     * one is in flight WAITS (or joins an identical queued run), and the
+     * result says which happened. The call still resolves when the run
+     * terminates; a cancelled run resolves with `cancelled: true` and
+     * whatever entries landed before the stop — a deliberate operator
+     * cancel is an outcome, not an error.
      */
     private triggerBackup;
+    /** Wire `backup.listRuns` — queued + active + bounded history. */
+    private listRuns;
+    /**
+     * Wire `backup.cancel`. Delegates to the queue: a queued run is
+     * removed before it starts; the running run's abort signal fires and
+     * `runBackupBuild` stops the tar/upload streams and deletes its
+     * staging archive on the way out.
+     */
+    private cancelRun;
+    /**
+     * Execute ONE backup run — only ever called by the queue, never
+     * directly (the queue is the single serialisation authority).
+     * Builds the archive in the private staging dir, then pushes it to
+     * every selected destination via the storage cap's chunked upload
+     * protocol. Per-destination errors are logged and recorded on the
+     * run — one bad sink doesn't kill the run.
+     *
+     * Cleanup contract (D342): the staging file is deleted in `finally`,
+     * which covers success, per-destination failure, build failure AND
+     * cancellation alike. The only leak this cannot cover — the process
+     * dying inside the run — is reclaimed by the boot sweep in
+     * `cleanStagingArea`.
+     */
+    private runBackupBuild;
     /**
      * Push the staged archive to a single destination via chunked
      * upload, then update the per-location manifest. Applies the