@camstack/system 1.2.179 → 1.2.181

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as isArrayOutputSchema, Ct as scopesAllowDeviceCap, D as addonSettingsCapability, Gt as asJsonObject$1, Ht as ReadinessRegistry, It as DATAPLANE_SECRET_HEADER$1, Jt as createEvent, Kt as asNumber, Lt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Pt as errMsg$1, Rt as DEVICE_STATUS_METHOD, St as scopesAllowAddon, Ut as ReadinessTimeoutError, X as extractNestedAddonId, Yt as emitDownForOwnedCaps, Zt as expandCapMethods, an as scopeKey, at as kebabToCamel, bt as resolveMethodAuth, et as isCollectionArrayMethod, g as RUNTIME_DEFAULTS, gt as procedureAuthKey, in as resolveCapMount, it as isVoidInput, lt as logLevelAtMost, m as METHOD_ACCESS_MAP, nn as parseJsonUnknown, ot as lifecycleJobSchema, p as LOG_LEVEL_RANK, pt as objectInputDeclaresAddonId, qt as asString$1, rn as readinessKey, sn as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tn as parseJsonObject, tt as isObjectInput, ut as looseSchema } from "./dist-L_39vRmH.mjs";
+import { $ as isArrayOutputSchema, Ct as scopesAllowDeviceCap, D as addonSettingsCapability, Gt as asJsonObject$1, Ht as ReadinessRegistry, It as DATAPLANE_SECRET_HEADER$1, Jt as createEvent, Kt as asNumber, Lt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Pt as errMsg$1, Rt as DEVICE_STATUS_METHOD, St as scopesAllowAddon, Ut as ReadinessTimeoutError, X as extractNestedAddonId, Yt as emitDownForOwnedCaps, Zt as expandCapMethods, an as scopeKey, at as kebabToCamel, bt as resolveMethodAuth, et as isCollectionArrayMethod, g as RUNTIME_DEFAULTS, gt as procedureAuthKey, in as resolveCapMount, it as isVoidInput, lt as logLevelAtMost, m as METHOD_ACCESS_MAP, nn as parseJsonUnknown, ot as lifecycleJobSchema, p as LOG_LEVEL_RANK, pt as objectInputDeclaresAddonId, qt as asString$1, rn as readinessKey, sn as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, tn as parseJsonObject, tt as isObjectInput, ut as looseSchema } from "./dist-DbnNk4Lw.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -26,7 +26,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DOTmtLCW.mjs";
-import { $ as buildUdsNativeCapProxy, $t as formatHeapSpaces, A as createUdsLoggerWithControl, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bt as createV8Reclaimer, C as ipcParentLink, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, Et as HEAP_RECLAIM_TRIGGER_MB, F as AGENT_CAP_FWD_SERVICE, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Ht as hubMainRssBudget, I as CapRouteResolver, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as CapRouteError, Lt as buildHeapSample, M as LocalChildRegistry, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as UDS_NO_ROUTE_PREFIX, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, Ot as HEAP_WATCH_WARN_RATIO, P as AGENT_CAP_FWD_ACTION, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as emitHeapDiagnosticReport, R as classifyCapRoute, Rt as createDeferredHeapWatchSink, S as buildLinkChain, St as runNpm, T as createParentUnownedCallHandler, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Ut as nextRssBudgetState, V as CapUsageRegistry, Vt as describeRss, W as getCapUsageRegistry, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as DECISIVE_HEAP_SPACES, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as HEAP_SPACE_REPORT_MIN_MB, _ as AddonDepsManager, _n as createEventPlaneReader, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as createSocketPlaneMeter, at as createAddonService, b as brokerCallForCap, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as formatSocketPlane, ct as capActionName, d as clusterEventTopic, dn as recordSocketFrame, dt as capServiceName, en as heapSpaceField, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as sampleSocketDirection, ft as parseCapAction, g as subscribePassthrough, gn as createEventPlaneMeter, gt as CapabilityHandle, h as setNodeEventInterest, hn as EVENT_PLANE_TOP_N, ht as DeviceRegistry, i as createAddonContext, in as SOCKET_PLANE_TOP_N, j as LocalChildClient, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as EMPTY_SOCKET_DIRECTION, lt as capActionSuffix, m as registerEventBusService, mn as socketDirectionMessages, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as selectReportedSpaces, o as getWorkerDeviceRegistry, on as createSocketPlaneReader, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as socketDirectionBytes, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as EMPTY_SOCKET_PLANE_BASELINE, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as diffSocketPlane, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as readHeapSpaces, u as EVENT_TOPIC_PREFIX, un as createSocketDirectionCounters, ut as capBareAction, v as createKernelHwAccel, vn as diffEventPlane, vt as copyBundledNativeModules, w as localProviderLink, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xt as resolveNpmInvocation, y as resolveHwAccel, yn as formatEventPlane, yt as installManifestNativeDeps, z as callWithServiceDiscovery, zt as createLoopDelayMeter } from "./manifest-system-deps-CMOGc5nC.mjs";
+import { $ as buildUdsNativeCapProxy, $t as formatHeapSpaces, A as createUdsLoggerWithControl, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bt as createV8Reclaimer, C as ipcParentLink, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, Et as HEAP_RECLAIM_TRIGGER_MB, F as AGENT_CAP_FWD_SERVICE, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Ht as hubMainRssBudget, I as CapRouteResolver, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as CapRouteError, Lt as buildHeapSample, M as LocalChildRegistry, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as UDS_NO_ROUTE_PREFIX, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, Ot as HEAP_WATCH_WARN_RATIO, P as AGENT_CAP_FWD_ACTION, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as emitHeapDiagnosticReport, R as classifyCapRoute, Rt as createDeferredHeapWatchSink, S as buildLinkChain, St as runNpm, T as createParentUnownedCallHandler, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Ut as nextRssBudgetState, V as CapUsageRegistry, Vt as describeRss, W as getCapUsageRegistry, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as DECISIVE_HEAP_SPACES, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as HEAP_SPACE_REPORT_MIN_MB, _ as AddonDepsManager, _n as createEventPlaneReader, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as createSocketPlaneMeter, at as createAddonService, b as brokerCallForCap, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as formatSocketPlane, ct as capActionName, d as clusterEventTopic, dn as recordSocketFrame, dt as capServiceName, en as heapSpaceField, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as sampleSocketDirection, ft as parseCapAction, g as subscribePassthrough, gn as createEventPlaneMeter, gt as CapabilityHandle, h as setNodeEventInterest, hn as EVENT_PLANE_TOP_N, ht as DeviceRegistry, i as createAddonContext, in as SOCKET_PLANE_TOP_N, j as LocalChildClient, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as EMPTY_SOCKET_DIRECTION, lt as capActionSuffix, m as registerEventBusService, mn as socketDirectionMessages, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as selectReportedSpaces, o as getWorkerDeviceRegistry, on as createSocketPlaneReader, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as socketDirectionBytes, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as EMPTY_SOCKET_PLANE_BASELINE, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as diffSocketPlane, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as readHeapSpaces, u as EVENT_TOPIC_PREFIX, un as createSocketDirectionCounters, ut as capBareAction, v as createKernelHwAccel, vn as diffEventPlane, vt as copyBundledNativeModules, w as localProviderLink, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xt as resolveNpmInvocation, y as resolveHwAccel, yn as formatEventPlane, yt as installManifestNativeDeps, z as callWithServiceDiscovery, zt as createLoopDelayMeter } from "./manifest-system-deps-DOcMuUWK.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -3671,8 +3671,362 @@ var AddonManifest = class {
 	}
 };
 //#endregion
+//#region src/kernel/deps/closure-dedupe.ts
+/**
+* Closure dedupe — stop copying into every addon the libraries the server
+* closure already provides.
+*
+* `installRuntimeDependencies` materialises each addon's declared
+* `camstack.runtimeDependencies` (and their whole transitive tree) under
+* `<addonsDir>/<pkg>/node_modules`. Measured on the live hub (2026-09-04):
+* 196 MB across 23 addons, largely re-copies of libraries sitting one
+* directory away in `/data/server-root/current/node_modules` — `mediabunny`
+* (11 MB) twice, `werift` (~5 MB) three times, plus their shared subtrees
+* (`@noble`, `@peculiar`, `werift-*`).
+*
+* The fix: after an addon tree's npm install completes, every top-level
+* `node_modules` entry the closure ALSO provides at a compatible version is
+* replaced by a SYMLINK into the closure's `node_modules`. Symlinks preserve
+* standard Node resolution for BOTH module systems at ANY depth (verified on
+* the hub: `require()` and `import()` through a symlink on `/data/addons`
+* both resolve), and a dependency the closure later drops fails LOUDLY
+* (dangling link → `Cannot find module`) instead of silently degrading.
+*
+* Version compatibility is the sharp edge, measured live: the closure ships
+* `zod@4.5.4` while `@apocaliss92/nodelink-js` (provider-reolink) requires
+* `zod@^3` and carries `3.25.76`. A link there would silently downgrade a
+* dependent to an incompatible major — worse than the disk it saves. So a
+* link happens ONLY when the closure version satisfies EVERY requirement
+* range recorded for that package in the addon's own tree, under a
+* deliberately conservative range parser (exact / caret / tilde; anything
+* else refuses). Identical versions always link.
+*
+* Everything here is dependency-free on purpose (no `semver` package in the
+* kernel): the parser handles only the forms it can prove, and refusal keeps
+* the addon's own copy — never a wrong resolution.
+*/
+function parseVersion(value) {
+	const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(value.trim());
+	if (!m) return null;
+	return {
+		major: Number(m[1]),
+		minor: Number(m[2]),
+		patch: Number(m[3]),
+		prerelease: m[4] ?? null
+	};
+}
+/** -1 / 0 / 1 over the numeric triple only (callers gate prereleases first). */
+function compareTriple(a, b) {
+	if (a.major !== b.major) return a.major < b.major ? -1 : 1;
+	if (a.minor !== b.minor) return a.minor < b.minor ? -1 : 1;
+	if (a.patch !== b.patch) return a.patch < b.patch ? -1 : 1;
+	return 0;
+}
+/**
+* Does `version` satisfy `range`, for the range forms this module is willing
+* to vouch for?
+*
+* Supported: exact (`1.2.3`, `=1.2.3`), caret (`^1.2.3`, incl. the 0.x rules)
+* and tilde (`~1.2.3`). EVERYTHING else — `*`, `>=`, unions, hyphen ranges,
+* dist-tags, bases with prereleases — returns false: an unprovable range must
+* keep the addon's own copy, never borrow the closure's.
+*
+* A prerelease `version` satisfies only an exact string match — semver range
+* semantics around prereleases are precisely the kind of subtlety a
+* hand-rolled parser must refuse rather than approximate.
+*/
+function closureSatisfiesRange(range, version) {
+	const trimmedRange = range.trim();
+	const v = parseVersion(version);
+	if (v === null) return false;
+	if (v.prerelease !== null) return trimmedRange === version.trim() || trimmedRange === `=${version.trim()}`;
+	const exactBase = parseVersion(trimmedRange.startsWith("=") ? trimmedRange.slice(1) : trimmedRange);
+	if (exactBase !== null) return exactBase.prerelease === null && compareTriple(v, exactBase) === 0;
+	const operator = trimmedRange[0];
+	if (operator !== "^" && operator !== "~") return false;
+	const base = parseVersion(trimmedRange.slice(1));
+	if (base === null || base.prerelease !== null) return false;
+	if (operator === "~") return v.major === base.major && v.minor === base.minor && compareTriple(v, base) >= 0;
+	if (base.major > 0) return v.major === base.major && compareTriple(v, base) >= 0;
+	if (base.minor > 0) return v.major === 0 && v.minor === base.minor && compareTriple(v, base) >= 0;
+	return compareTriple(v, base) === 0;
+}
+/**
+* Belt over the range check: the closure copy must live in the same major
+* line as the copy npm actually materialised (same minor while major is 0).
+* The range check should already guarantee this; if the two ever disagree
+* the safe answer is "do not link".
+*/
+function sameCompatLine(a, b) {
+	const pa = parseVersion(a);
+	const pb = parseVersion(b);
+	if (pa === null || pb === null) return false;
+	if (pa.major !== pb.major) return false;
+	if (pa.major === 0) return pa.minor === pb.minor;
+	return true;
+}
+/**
+* Decide, per top-level entry, whether the closure's copy can serve in place
+* of the addon's own. Identical versions always link; otherwise every
+* recorded requirement range must accept the closure version, and the two
+* copies must share a compat line. Anything unprovable keeps the local copy.
+*/
+function planClosureDedupe(input) {
+	const links = [];
+	const keeps = [];
+	for (const candidate of input.candidates) {
+		if (candidate.name.startsWith("@camstack/")) {
+			keeps.push({
+				name: candidate.name,
+				reason: "camstack-package"
+			});
+			continue;
+		}
+		if (input.neverLink.has(candidate.name)) {
+			keeps.push({
+				name: candidate.name,
+				reason: "never-link"
+			});
+			continue;
+		}
+		const closureVersion = input.closureVersions.get(candidate.name);
+		if (closureVersion === void 0) {
+			keeps.push({
+				name: candidate.name,
+				reason: "not-in-closure"
+			});
+			continue;
+		}
+		if (closureVersion === candidate.version) {
+			links.push({
+				name: candidate.name,
+				closureVersion
+			});
+			continue;
+		}
+		const ranges = input.requirements.get(candidate.name) ?? [];
+		if (ranges.length > 0 && ranges.every((range) => closureSatisfiesRange(range, closureVersion)) && sameCompatLine(closureVersion, candidate.version)) links.push({
+			name: candidate.name,
+			closureVersion
+		});
+		else keeps.push({
+			name: candidate.name,
+			reason: "version-incompatible"
+		});
+	}
+	return {
+		links,
+		keeps
+	};
+}
+function readTreeManifest(pkgJsonPath) {
+	let raw;
+	try {
+		raw = asJsonObject$1(parseJsonUnknown(fs$17.readFileSync(pkgJsonPath, "utf-8")));
+	} catch {
+		return null;
+	}
+	if (raw === null) return null;
+	const ranges = /* @__PURE__ */ new Map();
+	for (const key of [
+		"dependencies",
+		"optionalDependencies",
+		"peerDependencies"
+	]) {
+		const deps = asJsonObject$1(raw[key]);
+		if (deps === null) continue;
+		for (const [name, range] of Object.entries(deps)) if (typeof range === "string" && !ranges.has(name)) ranges.set(name, range);
+	}
+	const version = asString$1(raw["version"]);
+	return {
+		version: version.length > 0 ? version : null,
+		ranges
+	};
+}
+/** Top-level entries of a node_modules dir (scoped names flattened). */
+function listTopLevelEntries(nodeModulesDir) {
+	let entries;
+	try {
+		entries = fs$17.readdirSync(nodeModulesDir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const names = [];
+	for (const entry of entries) {
+		if (entry.name.startsWith(".")) continue;
+		if (entry.name.startsWith("@")) {
+			let inner;
+			try {
+				inner = fs$17.readdirSync(path$39.join(nodeModulesDir, entry.name), { withFileTypes: true });
+			} catch {
+				continue;
+			}
+			for (const sub of inner) if (!sub.name.startsWith(".")) names.push(`${entry.name}/${sub.name}`);
+		} else names.push(entry.name);
+	}
+	return names;
+}
+/**
+* Read an addon tree's dedupe-relevant state: which top-level packages exist
+* (and their versions), and which requirement ranges apply to each. A
+* dependent's range for `X` is recorded only when that dependent resolves to
+* the TOP-LEVEL `X` — a nested override copy (`dep/node_modules/X`) means the
+* flat copy is not what that dependent loads, so its range must not block the
+* flat copy's dedupe.
+*/
+function collectAddonTreeState(addonDir) {
+	const nodeModulesDir = path$39.join(addonDir, "node_modules");
+	const requirements = /* @__PURE__ */ new Map();
+	const addRange = (name, range) => {
+		const existing = requirements.get(name);
+		if (existing === void 0) requirements.set(name, [range]);
+		else existing.push(range);
+	};
+	const rootManifest = readTreeManifest(path$39.join(addonDir, "package.json"));
+	if (rootManifest !== null) for (const [name, range] of rootManifest.ranges) addRange(name, range);
+	const candidates = [];
+	const existingLinks = [];
+	for (const name of listTopLevelEntries(nodeModulesDir)) {
+		const entryDir = path$39.join(nodeModulesDir, name);
+		let isLink = false;
+		try {
+			isLink = fs$17.lstatSync(entryDir).isSymbolicLink();
+		} catch {
+			continue;
+		}
+		if (isLink) {
+			let target = "";
+			try {
+				target = fs$17.readlinkSync(entryDir);
+			} catch {}
+			existingLinks.push({
+				name,
+				target
+			});
+		}
+		const manifest = readTreeManifest(path$39.join(entryDir, "package.json"));
+		if (manifest === null) continue;
+		if (!isLink && manifest.version !== null) candidates.push({
+			name,
+			version: manifest.version
+		});
+		for (const [depName, range] of manifest.ranges) {
+			if (fs$17.existsSync(path$39.join(entryDir, "node_modules", depName))) continue;
+			addRange(depName, range);
+		}
+	}
+	return {
+		candidates,
+		requirements,
+		existingLinks
+	};
+}
+/** Read `name → version` from a closure node_modules for the given names. */
+function readClosureVersions(closureNodeModulesDir, names) {
+	const versions = /* @__PURE__ */ new Map();
+	for (const name of names) {
+		const manifest = readTreeManifest(path$39.join(closureNodeModulesDir, name, "package.json"));
+		if (manifest !== null && manifest.version !== null) versions.set(name, manifest.version);
+	}
+	return versions;
+}
+/**
+* Where the running node's server closure keeps its node_modules, or null
+* when there is none to dedupe against (dev workspace, tests without a
+* closure). `CAMSTACK_FRAMEWORK_DIR` is set by the starter/launcher on every
+* deployed node — the same directory the framework resolver hook and
+* NODE_PATH extension already point at.
+*/
+function resolveClosureNodeModulesDir(explicitDir) {
+	const frameworkDir = explicitDir ?? process.env["CAMSTACK_FRAMEWORK_DIR"];
+	if (frameworkDir === void 0 || frameworkDir.length === 0) return null;
+	const nodeModulesDir = explicitDir ?? path$39.join(frameworkDir, "node_modules");
+	return fs$17.existsSync(nodeModulesDir) ? nodeModulesDir : null;
+}
+function symlinkType() {
+	return process.platform === "win32" ? "junction" : "dir";
+}
+/**
+* Replace each planned entry with a symlink into the closure. Probes symlink
+* support once (Windows without developer mode cannot create them — in that
+* case every copy is kept, which is exactly today's behaviour). Each link
+* re-verifies the closure version right before the swap so a closure updated
+* mid-flight can only cause a KEEP, never a wrong link.
+*
+* Returns the names actually linked.
+*/
+function executeClosureDedupe(addonDir, closureNodeModulesDir, plan, logger) {
+	if (plan.links.length === 0) return [];
+	const nodeModulesDir = path$39.join(addonDir, "node_modules");
+	const probePath = path$39.join(nodeModulesDir, ".closure-link-probe");
+	try {
+		fs$17.mkdirSync(nodeModulesDir, { recursive: true });
+		fs$17.rmSync(probePath, { force: true });
+		fs$17.symlinkSync(closureNodeModulesDir, probePath, symlinkType());
+		fs$17.rmSync(probePath, { force: true });
+	} catch (err) {
+		logger.warn("closure dedupe skipped — symlinks unavailable on this volume", { meta: {
+			addonDir,
+			error: errMsg$1(err)
+		} });
+		return [];
+	}
+	const linked = [];
+	for (const link of plan.links) {
+		const target = path$39.join(closureNodeModulesDir, link.name);
+		const manifest = readTreeManifest(path$39.join(target, "package.json"));
+		if (manifest === null || manifest.version !== link.closureVersion) {
+			logger.warn("closure dedupe — closure changed under the plan; keeping own copy", { meta: {
+				name: link.name,
+				planned: link.closureVersion,
+				found: manifest?.version ?? null
+			} });
+			continue;
+		}
+		const entryDir = path$39.join(nodeModulesDir, link.name);
+		try {
+			fs$17.rmSync(entryDir, {
+				recursive: true,
+				force: true
+			});
+			fs$17.mkdirSync(path$39.dirname(entryDir), { recursive: true });
+			fs$17.symlinkSync(target, entryDir, symlinkType());
+			linked.push(link.name);
+		} catch (err) {
+			logger.warn("closure dedupe — link failed; entry removed copy may need reinstall", { meta: {
+				name: link.name,
+				error: errMsg$1(err)
+			} });
+		}
+	}
+	return linked;
+}
+/**
+* Is `linkTarget` (as read from `readlink`) a path inside the closure's
+* node_modules? Only such links belong to this mechanism — workspace/npm
+* `file:` links must never be touched by dedupe maintenance.
+*/
+function isClosureLinkTarget(linkTarget, closureNodeModulesDir) {
+	if (linkTarget.length === 0) return false;
+	const normalized = path$39.resolve(linkTarget);
+	const root = path$39.resolve(closureNodeModulesDir);
+	return normalized === root || normalized.startsWith(`${root}${path$39.sep}`);
+}
+//#endregion
 //#region src/kernel/addon-installer.ts
 var execFileAsync = promisify(execFile);
+/**
+* Names declared in `camstack.nativeDependencies` — per-addon natives that
+* the closure dedupe must never replace with a link (their install path owns
+* ABI/prebuild handling; see `deps/manifest-native-deps.ts`).
+*/
+function readNativeDependencyNames(pkg) {
+	if (pkg === void 0) return /* @__PURE__ */ new Set();
+	const camstack = asJsonObject$1(pkg["camstack"]);
+	if (camstack === null) return /* @__PURE__ */ new Set();
+	const native = asJsonObject$1(camstack["nativeDependencies"]);
+	return native === null ? /* @__PURE__ */ new Set() : new Set(Object.keys(native));
+}
 function parseInstallSource(value) {
 	switch (value) {
 		case "npm":
@@ -3769,6 +4123,8 @@ var AddonInstaller = class AddonInstaller {
 	installSource;
 	logger;
 	isPackageResolvable;
+	/** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
+	closureNodeModulesDir;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -3790,6 +4146,7 @@ var AddonInstaller = class AddonInstaller {
 		this.logger = logger;
 		this.manifest = new AddonManifest(config.addonsDir);
 		this.isPackageResolvable = config.isPackageResolvable;
+		this.closureNodeModulesDir = config.closureNodeModulesDir;
 		if (config.installSource) this.installSource = config.installSource;
 		else this.installSource = "npm";
 	}
@@ -3977,6 +4334,140 @@ var AddonInstaller = class AddonInstaller {
 		return changes;
 	}
 	/**
+	* Make every INSTALLED addon's runtime dependencies resolvable — doing the
+	* least work that achieves it. Runs at boot on hub and agent, which is what
+	* turns a restore back into a working node: a system backup archives no
+	* node_modules (D338), so before this pass every restored non-bootstrap
+	* addon failed its first import until someone redeployed it by hand.
+	*
+	* Per addon, in order:
+	*  1. drop closure links that no longer hold (dangling, or the closure
+	*     moved to a version the addon tree's recorded ranges refuse) — those
+	*     addons get a reinstall;
+	*  2. a declared dep that already resolves in the addon tree costs nothing;
+	*  3. a missing declared dep the closure provides at a COMPATIBLE version
+	*     becomes a link — no npm, no network;
+	*  4. only an addon left with a genuinely unresolvable dep gets an npm
+	*     install (then dedupe + native ensure, same tail as a fresh install).
+	*
+	* "Only when necessary" is the contract: an addon whose deps are all
+	* satisfied is not touched at all. Failures are per-addon and non-fatal —
+	* a dep that cannot be re-fetched leaves that addon exactly as broken as
+	* it already was, but LOUDLY, and never blocks the rest of the boot.
+	*/
+	async ensureAddonRuntimeDeps() {
+		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+		const linked = [];
+		const reinstalled = [];
+		const failed = [];
+		const installedPackages = this.listInstalled();
+		for (const pkg of installedPackages) {
+			try {
+				if (fs$17.lstatSync(pkg.dir).isSymbolicLink()) continue;
+			} catch {
+				continue;
+			}
+			try {
+				const outcome = this.ensureOneAddonDeps(pkg.dir, pkg.name, closureNodeModules);
+				for (const dep of outcome.linked) linked.push(`${pkg.name}:${dep}`);
+				if (outcome.needsInstall) {
+					await this.reinstallAddonDeps(pkg.dir, pkg.name);
+					reinstalled.push(pkg.name);
+				}
+			} catch (err) {
+				failed.push(pkg.name);
+				this.logger.error(`${pkg.name} — runtime dependencies could NOT be ensured; the addon will fail to load until its deps install`, { meta: {
+					dir: pkg.dir,
+					error: errMsg$1(err)
+				} });
+			}
+		}
+		return {
+			checked: installedPackages.length,
+			linked,
+			reinstalled,
+			failed
+		};
+	}
+	/**
+	* One addon's dependency audit (steps 1–3 of `ensureAddonRuntimeDeps`).
+	* Pure decision + link creation; the npm fallback is the caller's.
+	*/
+	ensureOneAddonDeps(addonDir, packageName, closureNodeModules) {
+		const pkgView = readPackageJson(path$39.join(addonDir, "package.json"));
+		const declared = pkgView === null ? null : asJsonObject$1(pkgView.raw["dependencies"]);
+		const declaredEntries = declared === null ? [] : Object.entries(declared);
+		const state = collectAddonTreeState(addonDir);
+		const nodeModulesDir = path$39.join(addonDir, "node_modules");
+		let needsInstall = false;
+		if (closureNodeModules !== null) for (const link of state.existingLinks) {
+			if (!isClosureLinkTarget(link.target, closureNodeModules)) continue;
+			const linkDir = path$39.join(nodeModulesDir, link.name);
+			const targetManifest = fs$17.existsSync(path$39.join(linkDir, "package.json"));
+			const ranges = state.requirements.get(link.name) ?? [];
+			let holds = targetManifest;
+			if (holds && ranges.length > 0) {
+				const version = readClosureVersions(closureNodeModules, [link.name]).get(link.name);
+				holds = version !== void 0 && ranges.every((range) => closureSatisfiesRange(range, version));
+			}
+			if (!holds) {
+				this.logger.warn(`${packageName} — closure link for ${link.name} no longer holds; reinstalling this addon's deps`, { meta: { target: link.target } });
+				fs$17.rmSync(linkDir, { force: true });
+				needsInstall = true;
+			}
+		}
+		const linked = [];
+		for (const [depName, range] of declaredEntries) {
+			if (typeof range !== "string") continue;
+			if (fs$17.existsSync(path$39.join(nodeModulesDir, depName, "package.json"))) continue;
+			const closureVersion = closureNodeModules === null ? void 0 : readClosureVersions(closureNodeModules, [depName]).get(depName);
+			if (closureNodeModules !== null && closureVersion !== void 0 && closureSatisfiesRange(range, closureVersion)) {
+				if (executeClosureDedupe(addonDir, closureNodeModules, {
+					links: [{
+						name: depName,
+						closureVersion
+					}],
+					keeps: []
+				}, this.logger).length === 1) {
+					this.logger.info(`${packageName} — ${depName} linked from the server closure`, { meta: { closureVersion } });
+					linked.push(depName);
+					continue;
+				}
+			}
+			needsInstall = true;
+		}
+		return {
+			linked,
+			needsInstall
+		};
+	}
+	/**
+	* npm-install an installed addon's runtime deps IN PLACE (the restore /
+	* repair path — the tree is not yet running at boot), then the same tail
+	* every fresh install gets: closure dedupe + native deps + prebuild ensure.
+	* Closure links are stripped first so npm reifies against plain missing
+	* dirs instead of symlinks it does not own.
+	*/
+	async reinstallAddonDeps(addonDir, packageName) {
+		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+		if (closureNodeModules !== null) {
+			const state = collectAddonTreeState(addonDir);
+			for (const link of state.existingLinks) if (isClosureLinkTarget(link.target, closureNodeModules)) fs$17.rmSync(path$39.join(addonDir, "node_modules", link.name), { force: true });
+		}
+		this.logger.info(`${packageName} — reinstalling runtime dependencies`, { meta: { addonDir } });
+		await runNpm([
+			"install",
+			"--omit=dev",
+			"--omit=peer",
+			"--no-audit",
+			"--no-fund",
+			"--no-package-lock",
+			...this.registry ? ["--registry", this.registry] : []
+		], this.npmRunOptions(addonDir, 24e4));
+		this.dedupeTreeAgainstClosure(addonDir, packageName);
+		await this.installNativeDependencies(addonDir, packageName);
+	}
+	/**
 	* Install a single addon — on-demand installer used by AddonPackageService
 	* (admin UI "Install addon" / "Reinstall" buttons).
 	*
@@ -4084,6 +4575,7 @@ var AddonInstaller = class AddonInstaller {
 			logger: this.logger,
 			bundledSourceDir: sourceDir
 		});
+		this.dedupeTreeAgainstClosure(targetDir, packageName);
 		this.logger.info(`${packageName} — copied from ${sourceDir}`);
 		return {
 			name: pkgData.name,
@@ -4387,6 +4879,40 @@ var AddonInstaller = class AddonInstaller {
 			logger: this.logger
 		});
 	}
+	/**
+	* Stop copying what the server closure already provides: replace each
+	* top-level `node_modules` entry the closure serves at a COMPATIBLE version
+	* with a symlink into the closure (see `deps/closure-dedupe.ts` for the
+	* plan rules and the live measurements). Runs LAST in tree
+	* materialisation — after the runtime-dep npm install AND the native-dep
+	* steps — so no later npm invocation can fight the links.
+	*
+	* Non-fatal by design: dedupe is an optimisation, and its failure mode is
+	* "the addon keeps its own copies", which is exactly today's behaviour. A
+	* refusal on version grounds is logged loudly — that line is the answer to
+	* "why does this addon still carry its own zod".
+	*/
+	dedupeTreeAgainstClosure(pkgDir, packageName) {
+		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+		if (closureNodeModules === null) return;
+		try {
+			const state = collectAddonTreeState(pkgDir);
+			if (state.candidates.length === 0) return;
+			const pkgView = readPackageJson(path$39.join(pkgDir, "package.json"));
+			const plan = planClosureDedupe({
+				candidates: state.candidates,
+				closureVersions: readClosureVersions(closureNodeModules, state.candidates.map((c) => c.name)),
+				requirements: state.requirements,
+				neverLink: readNativeDependencyNames(pkgView?.raw)
+			});
+			const linked = executeClosureDedupe(pkgDir, closureNodeModules, plan, this.logger);
+			if (linked.length > 0) this.logger.info(`${packageName} — ${linked.length} node_modules entr${linked.length === 1 ? "y" : "ies"} now resolve from the server closure`, { meta: { linked } });
+			const refused = plan.keeps.filter((k) => k.reason === "version-incompatible");
+			if (refused.length > 0) this.logger.info(`${packageName} — kept own copy where the closure version is incompatible`, { meta: { kept: refused.map((k) => k.name) } });
+		} catch (err) {
+			this.logger.warn(`${packageName} — closure dedupe failed (copies kept)`, { meta: { error: errMsg$1(err) } });
+		}
+	}
 	/** Install addon from a tgz file (uploaded or downloaded) */
 	async installFromTgz(tgzPath) {
 		const stagingRoot = path$39.join(this.addonsDir, ".staging");
@@ -4412,6 +4938,7 @@ var AddonInstaller = class AddonInstaller {
 			const targetDir = path$39.join(this.addonsDir, pkgView.name);
 			await this.installRuntimeDependencies(pkgDir, pkgView.name);
 			await this.installNativeDependencies(pkgDir, pkgView.name);
+			this.dedupeTreeAgainstClosure(pkgDir, pkgView.name);
 			await this.evictInstallDir(targetDir);
 			ensureDir(path$39.dirname(targetDir));
 			await fs$17.promises.rename(pkgDir, targetDir);
@@ -4544,6 +5071,7 @@ var AddonInstaller = class AddonInstaller {
 		if (!fs$17.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
 		await this.installRuntimeDependencies(stagedPath, packageName);
 		await this.installNativeDependencies(stagedPath, packageName);
+		this.dedupeTreeAgainstClosure(stagedPath, packageName);
 		const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 		const backupRoot = path$39.join(this.addonsDir, ".backups", packageName);
 		ensureDir(backupRoot);
@@ -33208,7 +33736,7 @@ var require_transit = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	var P = require_packets();
 	var { Packet } = require_packets();
 	var E = require_errors$2();
-	var { Transform } = __require("stream");
+	var { Transform: Transform$1 } = __require("stream");
 	var { METRIC } = require_metrics$1();
 	var C = require_constants$7();
 	/**
@@ -33579,7 +34107,7 @@ var require_transit = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 			if (!payload.stream && !stream && !payload.seq) return false;
 			if (!stream) {
 				this.logger.debug(`<= New stream is received from '${payload.sender}'. Seq: ${payload.seq}`);
-				stream = new Transform({
+				stream = new Transform$1({
 					objectMode: payload.headers?.$streamObjectMode,
 					transform: function(chunk, encoding, done) {
 						this.push(chunk);
@@ -33675,7 +34203,7 @@ var require_transit = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 			if (!stream && !packet.stream && !packet.seq) return false;
 			if (!stream) {
 				this.logger.debug(`<= New stream is received from '${packet.sender}'. Seq: ${packet.seq}`);
-				stream = new Transform({
+				stream = new Transform$1({
 					objectMode: packet.headers?.$streamObjectMode,
 					transform: function(chunk, encoding, done) {
 						this.push(chunk);