@camstack/system 1.2.416 → 1.2.418

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
-import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Et as enumerateInferenceDevices, Mr as emitReadiness, Nn as scoreRuntimes, _n as platformProbeCapability, ai as EventCategory, fr as errMsg, pr as BaseAddon } from "../../dist-DwE9yHdk.mjs";
+import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
+import { Ct as enumerateInferenceDevices, On as scoreRuntimes, Or as emitReadiness, cr as BaseAddon, ei as EventCategory, fn as platformProbeCapability, sr as errMsg } from "../../dist-DlmdESNT.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
@@ -53,7 +53,257 @@ function classifyCoralAccelerator(fsx) {
 	return null;
 }
 //#endregion
+//#region src/builtins/platform-probe/amd-npu.ts
+var amd_npu_exports = /* @__PURE__ */ __exportAll({
+	classifyAmdNpu: () => classifyAmdNpu,
+	xdnaInfoForDevice: () => xdnaInfoForDevice
+});
+var ACCEL_CLASS = "/sys/class/accel";
+var ACCEL_DEV = "/dev/accel";
+var AMD_PCI_VENDOR = "0x1022";
+/** Phoenix / Hawk Point XDNA1. */
+var XDNA1_DEVICES = new Set(["0x1502"]);
+/** Strix / Krackan XDNA2. */
+var XDNA2_DEVICES = new Set(["0x17f0"]);
+function normalizePciId(raw) {
+	const t = raw.trim().toLowerCase();
+	if (t.startsWith("0x")) return t;
+	if (t.length > 0 && [...t].every((c) => "0123456789abcdef".includes(c))) return "0x" + t;
+	return t;
+}
+function hasAccelCharDevice(fsx) {
+	if (fsx.listDir(ACCEL_DEV).some((n) => n.startsWith("accel"))) return true;
+	return fsx.exists("/dev/accel/accel0");
+}
+/**
+* Detect an AMD XDNA NPU and report it as **present only**.
+*
+* Inference is NOT offered until P2 (Ryzen AI on Linux is Strix-first;
+* Phoenix is not a production path today). The probe still names the
+* generation so the UI and fleet census can show the hardware.
+*/
+function classifyAmdNpu(ctx, fsx) {
+	if (ctx.platform !== "linux" || ctx.arch !== "x64" || !ctx.amdPresent) return null;
+	if (!hasAccelCharDevice(fsx)) return null;
+	for (const name of fsx.listDir(ACCEL_CLASS)) {
+		if (!name.startsWith("accel")) continue;
+		const vendor = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/vendor"));
+		const device = normalizePciId(fsx.readFile("/sys/class/accel/" + name + "/device/device"));
+		if (vendor !== AMD_PCI_VENDOR) continue;
+		return xdnaInfoForDevice(device);
+	}
+	return null;
+}
+/**
+* The NPU descriptor for an AMD PCI device id (`0x1502` or `1502`). Shared by
+* the Linux sysfs probe and the Windows PnP probe so both name the same
+* silicon the same way.
+*/
+function xdnaInfoForDevice(rawDeviceId) {
+	const device = normalizePciId(rawDeviceId);
+	if (XDNA1_DEVICES.has(device)) return {
+		type: "amd-xdna",
+		name: "AMD XDNA1 NPU",
+		generation: "xdna1"
+	};
+	if (XDNA2_DEVICES.has(device)) return {
+		type: "amd-xdna",
+		name: "AMD XDNA2 NPU",
+		generation: "xdna2"
+	};
+	return {
+		type: "amd-xdna",
+		name: "AMD XDNA NPU"
+	};
+}
+//#endregion
+//#region src/builtins/platform-probe/windows-hardware.ts
+var PCI_VENDOR_NVIDIA = "10DE";
+var PCI_VENDOR_INTEL = "8086";
+/** Radeon graphics are 1002; the XDNA NPU is a 1022 device. */
+var PCI_VENDORS_AMD = new Set(["1002", "1022"]);
+/** Adapters that are not hardware: RDP, hypervisor, capture and spoofing drivers. */
+var VIRTUAL_ADAPTER = /basic display|basic render|remote display|hyper-v|vmware|virtualbox|parallels|citrix|parsec|indirect display|displaylink|mirror driver|virtual/i;
+/** One PowerShell process answers both: video controllers and AMD PCI devices. */
+var POWERSHELL_SCRIPT = [
+	"$ErrorActionPreference = 'SilentlyContinue'",
+	"$gpu = @(Get-CimInstance Win32_VideoController | Select-Object Name, PNPDeviceID)",
+	"$npu = @(Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPDeviceID -match 'VEN_1022&DEV_(1502|17F0)' } | Select-Object Name, PNPDeviceID)",
+	"@{ gpu = $gpu; npu = $npu } | ConvertTo-Json -Compress -Depth 3"
+].join("; ");
+function powershellInvocation(systemRoot) {
+	return [`${systemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
+		"-NoProfile",
+		"-NonInteractive",
+		"-ExecutionPolicy",
+		"Bypass",
+		"-Command",
+		POWERSHELL_SCRIPT
+	]];
+}
+var WMIC_VIDEO_ARGS = [
+	"path",
+	"Win32_VideoController",
+	"get",
+	"Name,PNPDeviceID",
+	"/format:csv"
+];
+var WMIC_AMD_PNP_ARGS = [
+	"path",
+	"Win32_PnPEntity",
+	"where",
+	"PNPDeviceID like 'PCI\\\\VEN_1022&DEV_%'",
+	"get",
+	"Name,PNPDeviceID",
+	"/format:csv"
+];
+function asRecordList(value) {
+	if (Array.isArray(value)) return value.filter((v) => v !== null && typeof v === "object" && !Array.isArray(v));
+	return value !== null && typeof value === "object" ? [Object.fromEntries(Object.entries(value))] : [];
+}
+function str(value) {
+	return typeof value === "string" ? value : "";
+}
+/** PowerShell prepends a BOM on some hosts, which `JSON.parse` rejects. */
+function parseJson(text) {
+	return JSON.parse(text.replace(/^\uFEFF/, "").trim());
+}
+/**
+* `{"gpu":[...],"npu":[...]}` as the script emits it. A single result comes
+* back as an object rather than a one-element array, and an empty one as
+* `null` — all three are handled.
+*/
+function parsePowershellOutput(text) {
+	const root = parseJson(text);
+	const gpu = root !== null && typeof root === "object" ? Reflect.get(root, "gpu") : void 0;
+	const npu = root !== null && typeof root === "object" ? Reflect.get(root, "npu") : void 0;
+	const toDevice = (r) => ({
+		name: str(r["Name"]),
+		pnpDeviceId: str(r["PNPDeviceID"])
+	});
+	return {
+		controllers: asRecordList(gpu).map(toDevice),
+		pnp: asRecordList(npu).map(toDevice)
+	};
+}
+/**
+* `wmic ... /format:csv` — a blank line, then `Node,<cols alphabetical>`, then
+* one row per object. The device name can contain commas, so only the FIRST
+* column boundaries are trusted: columns after `Node` are `Name,PNPDeviceID`
+* and the PNP id (no commas) is taken from the END of the row.
+*/
+function parseWmicCsv(text) {
+	const lines = text.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
+	const headerIndex = lines.findIndex((l) => /^node,/i.test(l));
+	if (headerIndex < 0) return [];
+	const out = [];
+	for (const line of lines.slice(headerIndex + 1)) {
+		const parts = line.split(",");
+		if (parts.length < 3) continue;
+		const pnpDeviceId = (parts[parts.length - 1] ?? "").trim();
+		const name = parts.slice(1, -1).join(",").trim();
+		if (pnpDeviceId.length > 0) out.push({
+			name,
+			pnpDeviceId
+		});
+	}
+	return out;
+}
+/** The PCI vendor id (`10DE`) out of a PnP id like `PCI\VEN_10DE&DEV_2504&...`. */
+function pciVendorOf(pnpDeviceId) {
+	const m = /VEN_([0-9A-F]{4})/i.exec(pnpDeviceId);
+	return m?.[1] ? m[1].toUpperCase() : null;
+}
+function pciDeviceOf(pnpDeviceId) {
+	const m = /DEV_([0-9A-F]{4})/i.exec(pnpDeviceId);
+	return m?.[1] ? m[1].toLowerCase() : null;
+}
+function gpuVendor(c) {
+	const vendor = pciVendorOf(c.pnpDeviceId);
+	if (vendor === PCI_VENDOR_NVIDIA) return "nvidia";
+	if (vendor === PCI_VENDOR_INTEL) return "intel";
+	if (vendor !== null && PCI_VENDORS_AMD.has(vendor)) return "amd";
+	if (/nvidia|geforce|quadro|rtx/i.test(c.name)) return "nvidia";
+	if (/intel/i.test(c.name)) return "intel";
+	if (/amd|radeon/i.test(c.name)) return "amd";
+	return null;
+}
+/**
+* The accelerator the node should treat as its GPU. Same preference as the
+* Linux probe — NVIDIA, then Intel, then AMD — so a laptop with an Intel iGPU
+* and a discrete card is described the way the rest of the system already
+* expects. Virtual adapters never count.
+*/
+function classifyWindowsGpu(controllers) {
+	const real = controllers.filter((c) => c.name.length > 0 && !VIRTUAL_ADAPTER.test(c.name));
+	for (const wanted of [
+		"nvidia",
+		"intel",
+		"amd"
+	]) {
+		const hit = real.find((c) => gpuVendor(c) === wanted);
+		if (hit) return {
+			type: wanted,
+			name: hit.name
+		};
+	}
+	return null;
+}
+/**
+* An AMD XDNA NPU from PnP ids: `PCI\VEN_1022&DEV_1502` (Phoenix / Hawk Point)
+* or `DEV_17F0` (Strix / Krackan). Present-only, exactly like the Linux probe.
+*/
+function classifyWindowsAmdNpu(devices) {
+	for (const d of devices) {
+		if (pciVendorOf(d.pnpDeviceId) !== "1022") continue;
+		const device = pciDeviceOf(d.pnpDeviceId);
+		if (device === "1502" || device === "17f0") return xdnaInfoForDevice(device);
+	}
+	return null;
+}
+async function viaPowershell(run, systemRoot) {
+	const [file, args] = powershellInvocation(systemRoot);
+	const parsed = parsePowershellOutput(await run(file, args));
+	return {
+		gpu: classifyWindowsGpu(parsed.controllers),
+		npu: classifyWindowsAmdNpu(parsed.pnp),
+		source: "powershell"
+	};
+}
+async function viaWmic(run) {
+	const [video, amd] = await Promise.all([run("wmic", WMIC_VIDEO_ARGS), run("wmic", WMIC_AMD_PNP_ARGS).catch(() => "")]);
+	return {
+		gpu: classifyWindowsGpu(parseWmicCsv(video)),
+		npu: classifyWindowsAmdNpu(parseWmicCsv(amd)),
+		source: "wmic"
+	};
+}
+/**
+* GPU + AMD NPU on a Windows host. NEVER throws: a probe that cannot run is
+* `{ gpu: null, npu: null, source: 'none' }` and boot goes on — the node then
+* scores as a CPU node, which is correct for hardware we could not see.
+*/
+async function probeWindowsHardware(run, options = {}) {
+	try {
+		return await viaPowershell(run, options.systemRoot);
+	} catch (powershellError) {
+		options.onFallback?.(`PowerShell probe failed (${powershellError instanceof Error ? powershellError.message : String(powershellError)}); trying wmic`);
+	}
+	try {
+		return await viaWmic(run);
+	} catch (wmicError) {
+		options.onFallback?.(`wmic probe failed (${wmicError instanceof Error ? wmicError.message : String(wmicError)}); hardware unknown`);
+		return {
+			gpu: null,
+			npu: null,
+			source: "none"
+		};
+	}
+}
+//#endregion
 //#region src/builtins/platform-probe/platform-scorer.ts
+/** WMI can be slow on a cold machine, but never worth stalling boot for. */
+var WINDOWS_PROBE_TIMEOUT_MS = 15e3;
 /**
 * Promisified `execFile`. Used across the scorer so every subprocess
 * spawn yields the event loop — critical at boot because a single sync
@@ -231,24 +481,25 @@ var PlatformScorer = class {
 			};
 			npu = { type: "apple-ane" };
 		}
+		if (platform === "win32") {
+			const nvidia = await this.probeNvidiaSmi();
+			const win = await this.probeWindowsHardwareSafely();
+			gpu = nvidia ?? win.gpu;
+			npu = win.npu;
+			if (gpu) this.logger.info("Windows GPU detected", { meta: {
+				type: gpu.type,
+				name: gpu.name
+			} });
+			if (npu && win.source !== "none") this.logger.info("AMD XDNA NPU detected (present only)", { meta: {
+				type: npu.type,
+				name: npu.name,
+				generation: npu.generation,
+				source: win.source
+			} });
+		}
 		if (platform === "linux") {
-			try {
-				const { stdout } = await execFileAsync("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
-					encoding: "utf8",
-					timeout: 5e3
-				});
-				const output = stdout.trim();
-				if (output) {
-					const [name, mem] = output.split(",").map((s) => s.trim());
-					gpu = {
-						type: "nvidia",
-						name: name ?? "NVIDIA GPU",
-						memoryMB: parseInt(mem ?? "0")
-					};
-				}
-			} catch (err) {
-				this.logger.debug("NVIDIA GPU detection failed", { meta: { error: errMsg(err) } });
-			}
+			const nvidia = await this.probeNvidiaSmi();
+			if (nvidia) gpu = nvidia;
 			const listRenderNodes = () => {
 				try {
 					return fs.readdirSync("/dev/dri").filter((n) => n.startsWith("renderD")).map((n) => `/dev/dri/${n}`);
@@ -307,7 +558,7 @@ var PlatformScorer = class {
 				} });
 			}
 			if (!npu) {
-				const { classifyAmdNpu } = await import("../../amd-npu-Db_SoSuL.mjs");
+				const { classifyAmdNpu } = await Promise.resolve().then(() => amd_npu_exports);
 				npu = classifyAmdNpu({
 					platform,
 					arch,
@@ -342,6 +593,53 @@ var PlatformScorer = class {
 			coral
 		};
 	}
+	/** NVIDIA's own tool: exact model and VRAM. Null when absent or failing. */
+	async probeNvidiaSmi() {
+		try {
+			const { stdout } = await execFileAsync("nvidia-smi", ["--query-gpu=name,memory.total", "--format=csv,noheader"], {
+				encoding: "utf8",
+				timeout: 5e3,
+				windowsHide: true
+			});
+			const output = stdout.trim();
+			if (!output) return null;
+			const [name, mem] = output.split(",").map((s) => s.trim());
+			return {
+				type: "nvidia",
+				name: name ?? "NVIDIA GPU",
+				memoryMB: parseInt(mem ?? "0")
+			};
+		} catch (err) {
+			this.logger.debug("NVIDIA GPU detection failed", { meta: { error: errMsg(err) } });
+			return null;
+		}
+	}
+	/** Windows WMI probe; bounded, and a failure is a log line, never a boot failure. */
+	async probeWindowsHardwareSafely() {
+		const run = async (file, args) => {
+			const { stdout } = await execFileAsync(file, [...args], {
+				encoding: "utf8",
+				timeout: WINDOWS_PROBE_TIMEOUT_MS,
+				windowsHide: true,
+				maxBuffer: 4 * 1024 * 1024
+			});
+			return stdout;
+		};
+		const systemRoot = process.env["SystemRoot"];
+		try {
+			return await probeWindowsHardware(run, {
+				...systemRoot === void 0 ? {} : { systemRoot },
+				onFallback: (reason) => this.logger.warn("Windows hardware probe degraded", { meta: { reason } })
+			});
+		} catch (err) {
+			this.logger.warn("Windows hardware probe failed — scoring as a CPU node", { meta: { error: errMsg(err) } });
+			return {
+				gpu: null,
+				npu: null,
+				source: "none"
+			};
+		}
+	}
 	/**
 	* Locates a Python interpreter without importing any module.
 	*

package/dist/builtins/platform-probe/platform-scorer.d.ts

@@ -26,6 +26,10 @@ export declare class PlatformScorer {
 	*/
 	probe(onPhase?: (phase: string, payload?: Record<string, unknown>) => void): Promise<PlatformCapabilities>;
 	probeHardware(): Promise<HardwareInfo>;
+	/** NVIDIA's own tool: exact model and VRAM. Null when absent or failing. */
+	private probeNvidiaSmi;
+	/** Windows WMI probe; bounded, and a failure is a log line, never a boot failure. */
+	private probeWindowsHardwareSafely;
 	/**
 	* Locates a Python interpreter without importing any module.
 	*

package/dist/builtins/platform-probe/windows-hardware.d.ts

@@ -0,0 +1,77 @@
+import type { GpuInfo, NpuInfo } from "@camstack/types";
+/**
+* Windows hardware probe — the same `hw.gpu` / `hw.npu` model the Linux probe
+* fills from `/sys` and `/dev`, read from WMI instead.
+*
+* Two sources, tried in order, neither able to block boot:
+*   1. PowerShell + `Get-CimInstance` (every supported Windows ships it; one
+*      process answers both questions).
+*   2. `wmic` — deprecated and absent from newer images, but present on the
+*      Windows 10/11 releases that lack nothing else, and the only thing left
+*      when PowerShell is locked down by policy.
+*
+* Everything here is PURE over the text a runner returns, so the parsing and
+* the classification are tested on any OS. What this cannot prove — and a
+* Mac cannot — is the shape of the real WMI output on a real Windows host; the
+* parsers are written to accept both the object and the array form PowerShell
+* produces, and the wmic CSV header order wmic actually uses.
+*/
+/** Runs a program and resolves with its stdout; rejects on failure or timeout. */
+export type WindowsProbeRunner = (file: string, args: readonly string[]) => Promise<string>;
+export interface WindowsVideoController {
+	readonly name: string;
+	readonly pnpDeviceId: string;
+}
+export interface WindowsPnpDevice {
+	readonly name: string;
+	readonly pnpDeviceId: string;
+}
+export interface WindowsHardware {
+	readonly gpu: GpuInfo | null;
+	readonly npu: NpuInfo | null;
+	/** Which source answered — for the boot log; `none` when neither could. */
+	readonly source: "powershell" | "wmic" | "none";
+}
+export declare function powershellInvocation(systemRoot: string | undefined): readonly [string, readonly string[]];
+export declare const WMIC_VIDEO_ARGS: readonly string[];
+export declare const WMIC_AMD_PNP_ARGS: readonly string[];
+export interface ParsedPowershell {
+	readonly controllers: readonly WindowsVideoController[];
+	readonly pnp: readonly WindowsPnpDevice[];
+}
+/**
+* `{"gpu":[...],"npu":[...]}` as the script emits it. A single result comes
+* back as an object rather than a one-element array, and an empty one as
+* `null` — all three are handled.
+*/
+export declare function parsePowershellOutput(text: string): ParsedPowershell;
+/**
+* `wmic ... /format:csv` — a blank line, then `Node,<cols alphabetical>`, then
+* one row per object. The device name can contain commas, so only the FIRST
+* column boundaries are trusted: columns after `Node` are `Name,PNPDeviceID`
+* and the PNP id (no commas) is taken from the END of the row.
+*/
+export declare function parseWmicCsv(text: string): readonly WindowsPnpDevice[];
+/** The PCI vendor id (`10DE`) out of a PnP id like `PCI\VEN_10DE&DEV_2504&...`. */
+export declare function pciVendorOf(pnpDeviceId: string): string | null;
+/**
+* The accelerator the node should treat as its GPU. Same preference as the
+* Linux probe — NVIDIA, then Intel, then AMD — so a laptop with an Intel iGPU
+* and a discrete card is described the way the rest of the system already
+* expects. Virtual adapters never count.
+*/
+export declare function classifyWindowsGpu(controllers: readonly WindowsVideoController[]): GpuInfo | null;
+/**
+* An AMD XDNA NPU from PnP ids: `PCI\VEN_1022&DEV_1502` (Phoenix / Hawk Point)
+* or `DEV_17F0` (Strix / Krackan). Present-only, exactly like the Linux probe.
+*/
+export declare function classifyWindowsAmdNpu(devices: readonly WindowsPnpDevice[]): NpuInfo | null;
+/**
+* GPU + AMD NPU on a Windows host. NEVER throws: a probe that cannot run is
+* `{ gpu: null, npu: null, source: 'none' }` and boot goes on — the node then
+* scores as a CPU node, which is correct for hardware we could not see.
+*/
+export declare function probeWindowsHardware(run: WindowsProbeRunner, options?: {
+	readonly systemRoot?: string;
+	readonly onFallback?: (reason: string) => void;
+}): Promise<WindowsHardware>;

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DxiDI8hZ.js");
+const require_dist = require("../../dist-DVUg8e1T.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { ai as EventCategory, pr as BaseAddon } from "../../dist-DwE9yHdk.mjs";
+import { cr as BaseAddon, ei as EventCategory } from "../../dist-DlmdESNT.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DxiDI8hZ.js");
+const require_dist = require("../../dist-DVUg8e1T.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { $ as bareAddonId, Hn as streamQualityLabel, In as snapshotCapability, Ur as nodePin, a as BatteryStatusSchema, ai as EventCategory, bt as deriveBatteryPresence, dr as DeviceType, et as batteryCapability, fr as errMsg, lr as DeviceFeature, on as memoizePinnedFfmpeg, pr as BaseAddon } from "../../dist-DwE9yHdk.mjs";
+import { Ln as streamQualityLabel, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, cr as BaseAddon, ei as EventCategory, ir as DeviceFeature, jn as snapshotCapability, or as DeviceType, sr as errMsg, tn as memoizePinnedFfmpeg, zr as nodePin } from "../../dist-DlmdESNT.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DxiDI8hZ.js");
+const require_dist = require("../../dist-DVUg8e1T.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Bn as storageProviderCapability, Pt as filesystemBrowseCapability, pr as BaseAddon } from "../../dist-DwE9yHdk.mjs";
+import { Fn as storageProviderCapability, cr as BaseAddon, jt as filesystemBrowseCapability } from "../../dist-DlmdESNT.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/index.mjs

@@ -1,2 +1,2 @@
-import { StorageOrchestratorAddon, i as SqliteLocationStore, r as StorageMigrationCoordinator, t as StorageOrchestratorService } from "./storage-orchestrator.addon.mjs";
+import { StorageOrchestratorAddon, c as SqliteLocationStore, s as StorageMigrationCoordinator, t as StorageOrchestratorService } from "./storage-orchestrator.addon.mjs";
 export { SqliteLocationStore, StorageMigrationCoordinator, StorageOrchestratorAddon, StorageOrchestratorAddon as default, StorageOrchestratorService };

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,8 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DxiDI8hZ.js");
-const require_hub_cap_forward = require("../../hub-cap-forward-W8oEm4ME.js");
+const require_dist = require("../../dist-DVUg8e1T.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -1380,6 +1379,83 @@ var SqliteDrainStateStore = class {
 	}
 };
 //#endregion
+//#region src/kernel/transport/hub-cap-forward.ts
+/** The Moleculer service name the hub registers for agent→hub cap forwarding. */
+var HUB_CAP_FWD_SERVICE = "$hub-cap-fwd";
+/** The Moleculer action (service.action) for hub cap forwarding. */
+var HUB_CAP_FWD_ACTION = `${HUB_CAP_FWD_SERVICE}.forward`;
+/**
+* Drop a `caller` the forwarded args carry. `caller` is the USER identity the
+* hub's tRPC router injects for `caller: 'required'` methods
+* (`cap-router-builder.ts`), and providers trust it — `keychainAdmin.reveal`
+* reads `input.caller.userId`. A call that arrives over the mesh has no user
+* session behind it, so whatever `caller` it carries is forged (D802). The
+* args' `callerAddonId` is overwritten or stripped further down by
+* `stampCallerAddonId`; `caller` had no such guard.
+*/
+function stripForwardedCaller(args) {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+	if (!Object.prototype.hasOwnProperty.call(args, "caller")) return args;
+	const rest = {};
+	for (const [key, value] of Object.entries(args)) if (key !== "caller") rest[key] = value;
+	return rest;
+}
+/**
+* Narrow Moleculer's loosely-typed `ctx.params` to {@link HubCapForwardParams}
+* without unsafe casts — mirrors `agent-cap-dispatch-service.ts:narrowParams`.
+*/
+function narrowParams(raw) {
+	if (raw === null || typeof raw !== "object") throw new Error("$hub-cap-fwd.forward: invalid params — capName and method are required strings");
+	const capName = Reflect.get(raw, "capName");
+	const method = Reflect.get(raw, "method");
+	if (typeof capName !== "string" || typeof method !== "string") throw new Error("$hub-cap-fwd.forward: invalid params — capName and method are required strings");
+	const deviceId = Reflect.get(raw, "deviceId");
+	const nodeId = Reflect.get(raw, "nodeId");
+	const native = Reflect.get(raw, "native");
+	const callerAddonId = Reflect.get(raw, "callerAddonId");
+	return {
+		capName,
+		method,
+		args: stripForwardedCaller(Reflect.get(raw, "args")),
+		deviceId: typeof deviceId === "number" ? deviceId : void 0,
+		nodeId: typeof nodeId === "string" && nodeId.length > 0 ? nodeId : void 0,
+		native: native === true ? true : void 0,
+		callerAddonId: typeof callerAddonId === "string" && callerAddonId.length > 0 ? callerAddonId : void 0
+	};
+}
+/**
+* Build the `$hub-cap-fwd` Moleculer `ServiceSchema`. The hub registers this on
+* its broker (only the hub registers it → an agent's `broker.call` for
+* `$hub-cap-fwd.forward` discovers it on the hub with no explicit nodeID pin).
+*
+* @param onUnownedCall  The hub's cap routing handler (from
+*                       `createParentUnownedCallHandler`). Reused verbatim so
+*                       forwarded calls route exactly like a hub-local child's.
+*/
+function createHubCapForwardService(onUnownedCall, options = {}) {
+	return {
+		name: HUB_CAP_FWD_SERVICE,
+		actions: { forward: { handler: async (ctx) => {
+			const { capName, method, args, deviceId, nodeId, native, callerAddonId } = narrowParams(ctx.params);
+			const sender = typeof ctx.nodeID === "string" ? ctx.nodeID : null;
+			let caller = callerAddonId;
+			if (caller !== void 0 && options.isCallerOnNode !== void 0 && (sender === null || !options.isCallerOnNode(sender, caller))) {
+				options.onRejectedCaller?.(sender ?? "(unknown node)", caller);
+				caller = void 0;
+			}
+			return onUnownedCall({
+				capName,
+				method,
+				args,
+				...deviceId !== void 0 ? { deviceId } : {},
+				...nodeId !== void 0 ? { nodeId } : {},
+				...native === true ? { native: true } : {},
+				...caller !== void 0 ? { callerAddonId: caller } : {}
+			});
+		} } }
+	};
+}
+//#endregion
 //#region src/builtins/storage-orchestrator/hub-settings-forward.ts
 /**
 * The data door with the HUB behind it — an agent's `settings-store` provider.
@@ -1513,7 +1589,7 @@ function resolveHubSettingsForward(options) {
 	const broker = options.broker;
 	if (!broker) return null;
 	options.logger.info("storage-orchestrator: no local data-store engine on this node — the data door forwards to the hub");
-	return createHubSettingsForward((envelope) => broker.call(require_hub_cap_forward.HUB_CAP_FWD_ACTION, {
+	return createHubSettingsForward((envelope) => broker.call(HUB_CAP_FWD_ACTION, {
 		capName: envelope.capName,
 		method: envelope.method,
 		args: envelope.args
@@ -4513,9 +4589,13 @@ function parseOrphanStatus(raw) {
 	};
 }
 //#endregion
+exports.HUB_CAP_FWD_ACTION = HUB_CAP_FWD_ACTION;
+exports.HUB_CAP_FWD_SERVICE = HUB_CAP_FWD_SERVICE;
 exports.SqliteLocationStore = SqliteLocationStore;
 exports.StorageMigrationCoordinator = StorageMigrationCoordinator;
 exports.StorageOrchestratorAddon = StorageOrchestratorAddon;
 exports.default = StorageOrchestratorAddon;
 exports.StorageOrchestratorService = StorageOrchestratorService;
 exports.buildStorageLocationRegistry = buildStorageLocationRegistry;
+exports.createHubCapForwardService = createHubCapForwardService;
+exports.stripForwardedCaller = stripForwardedCaller;