@camstack/system 1.2.458 → 1.2.460

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { An as isVoidInput, Bn as logLevelAtMost, Ci as ReadinessTimeoutError, Da as withoutCallerStamp, Ea as userError, Fi as asString$1, Hi as createEvent$1, In as lifecycleJobSchema, J as METHOD_ACCESS_MAP, K as LOG_LEVEL_RANK, Ki as defineRecordKinds, Mr as supportedRuntimes, Ni as asJsonObject$1, Oa as EventCategory$1, Pi as asNumber, Si as ReadinessRegistry, Tn as isCollectionArrayMethod, Vn as looseSchema, Xn as objectInputDeclaresAddonId, Yi as expandCapMethods, Zn as objectInputDeclaresRequiredDeviceId, _a as resolveCapMount, _r as scopesAllowAddon, ai as DATAPLANE_SECRET_HEADER$1, bn as interpolate, bt as addonSettingsCapability, d as CATALOG_LANGS, da as parseJsonUnknown, ha as readinessKey, ii as CALLER_STAMPED_CAPABILITIES$1, jn as kebabToCamel$1, kn as isObjectInput, mn as extractNestedAddonId, mr as resolveMethodAuth, n as AGENT_MDNS_TXT_KEYS, nr as procedureAuthKey, oi as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qi as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, si as DEVICE_STATUS_METHOD, t as AGENT_MDNS_SERVICE_TYPE, ti as errMsg$1, ua as parseJsonObject, v as CatalogFileSchema, vr as scopesAllowDeviceCap, wn as isArrayOutputSchema, wr as splitTranslationRef, xi as RUNTIME_DEFAULTS, ya as scopeKey } from "./dist-B_GRPhnY.mjs";
+import { An as isVoidInput, Bn as logLevelAtMost, Ca as userError, Ci as ReadinessTimeoutError, Fi as asString$1, Gi as defineRecordKinds, Hi as createEvent$1, In as lifecycleJobSchema, J as METHOD_ACCESS_MAP, Ji as expandCapMethods, K as LOG_LEVEL_RANK, Ki as emitDownForOwnedCaps, Mr as supportedRuntimes, Ni as asJsonObject$1, Pi as asNumber, Si as ReadinessRegistry, Ta as EventCategory$1, Tn as isCollectionArrayMethod, Vn as looseSchema, Xn as objectInputDeclaresAddonId, Zn as objectInputDeclaresRequiredDeviceId, _r as scopesAllowAddon, ai as DATAPLANE_SECRET_HEADER$1, bn as interpolate, bt as addonSettingsCapability, d as CATALOG_LANGS, fa as readinessKey, ga as scopeKey, ii as CALLER_STAMPED_CAPABILITIES$1, jn as kebabToCamel$1, kn as isObjectInput, la as parseJsonObject, ma as resolveCapMount, mn as extractNestedAddonId, mr as resolveMethodAuth, n as AGENT_MDNS_TXT_KEYS, nr as procedureAuthKey, oi as DEVICE_SETTINGS_CONTRIBUTION_METHODS, r as ALL_CAPABILITY_DEFINITIONS, si as DEVICE_STATUS_METHOD, t as AGENT_MDNS_SERVICE_TYPE, ti as errMsg$1, ua as parseJsonUnknown, v as CatalogFileSchema, vr as scopesAllowDeviceCap, wa as withoutCallerStamp, wn as isArrayOutputSchema, wr as splitTranslationRef, xi as RUNTIME_DEFAULTS } from "./dist-Wy8cTxg6.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-lEaAQ9Xi.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-Bnkw8GyU.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -27,26 +27,26 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { l as SqliteSettingsBackend } from "./wal-maintenance-Duejh7Lx.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-Bj_MmDkr.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-FGjnsE2x.mjs";
-import { $ as generateMeshCa, A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, U as MESH_NODE_CERTIFICATES_COLUMNS, W as MeshCertificateRegistry, X as caFingerprintCompact, Y as caFingerprint, Z as createMeshCsrPem, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, et as generateMeshKeyPair, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, it as loadMeshCa, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafForNode, o as createAgentHttpsRequest, p as pemDigest, q as getProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as issueMeshLeafFromCsr, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as isValidAgentNodeId, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-CQA3W-3e.mjs";
-import { $ as parseCidrList, A as setProcessMeshPeerTransportLookup, B as requireProcessMeshCa, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as AGENT_UI_UNLOCK_VERSION, H as AGENT_UI_UNLOCK_TTL_MS, I as MeshCrl, J as mintAgentUiUnlockTicket, K as UnlockTicketJtiStore, L as processMeshCrl, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as normalizeIp, R as MeshCaKeeper, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as AGENT_UI_UNLOCK_TYP, V as AGENT_DASHBOARD_ORIGINS_FIELD, W as AGENT_UI_UNLOCK_USE, X as verifyAgentUiUnlockTicket, Y as parseAgentDashboardOrigins, Z as createCidrMatcher, _ as signPairingProof, a as hubHostFromMeshAddress, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, d as PAIRING_PROTOCOL, et as readCidrSetting, f as PAIRING_TTL_MS, g as keyFingerprintShort, h as describeCsr, i as AgentPairing, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, m as computePairingSas, n as HubPairing, o as PAIRING_CODE_DIGITS, p as computePairingCommitment, q as isAllowedAgentDashboardReturnTo, r as PairingHttpError, s as PAIRING_MAX_CODE_ATTEMPTS, u as PAIRING_PIN_DIGITS, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as getProcessMeshCaState } from "./builtins/system-config/system-config.addon.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-Iw3RSQup.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-BnkOdj9Q.mjs";
+import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-stpC3Zy-.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-Bg2HfTwP.mjs";
+import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DStvrQKI.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-CJu0nhla.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-C7kLDI_0.mjs";
-import { n as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-DcnZvctM.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CM23Pq9B.mjs";
+import { n as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-Qhn5TOYZ.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureBinary as ensureBinary$1, ensureFfmpeg, ensureFfmpeg as ensureFfmpeg$1, ensurePython, ensurePython as ensurePython$1, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonPackages as installPythonPackages$1, installPythonRequirements, installPythonRequirements as installPythonRequirements$1 } from "@camstack/types/node";
+import { PYTHON_VERSION, buildBinaryPath, declaresEdgetpuDelegate, downloadBinary, ensureBinary, ensureBinary as ensureBinary$1, ensureEdgetpuDelegate, ensureFfmpeg, ensureFfmpeg as ensureFfmpeg$1, ensurePython, ensurePython as ensurePython$1, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonPackages as installPythonPackages$1, installPythonRequirements, installPythonRequirements as installPythonRequirements$1 } from "@camstack/types/node";
 import { connect, createConnection, createServer } from "node:net";
 import { mkdir, rm, stat, unlink } from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -57,7 +57,7 @@ import * as os$1 from "node:os";
 import { tmpdir } from "node:os";
 import { pathToFileURL } from "node:url";
 import { BOOT_RECOVERY_BACKOFF_MS, CALLER_STAMPED_CAPABILITIES, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, ErrorI18nPayloadSchema, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, addonSliceHandleApi, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createRecordsAccess, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readErrorI18n, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 import { accessSync, constants, createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
 import { once } from "node:events";
@@ -5031,7 +5031,7 @@ var PythonEnvManager = class {
 	async ensure(options) {
 		const probe = await this.probe();
 		if (!probe.available || !probe.path) throw userError("system.python-required", void 0, "Python 3.10+ is required but not found on this system");
-		if (!fs.existsSync(path$1.join(this.venvPath, "bin", "python"))) await execFileAsync$7(probe.path, [
+		if (!fs$1.existsSync(path$1.join(this.venvPath, "bin", "python"))) await execFileAsync$7(probe.path, [
 			"-m",
 			"venv",
 			this.venvPath
@@ -5054,7 +5054,7 @@ var PythonEnvManager = class {
 	}
 	spawn(script, args) {
 		const venvPython = path$1.join(this.venvPath, "bin", "python");
-		if (!fs.existsSync(venvPython)) throw new Error("Python venv not initialized. Call ensure() first.");
+		if (!fs$1.existsSync(venvPython)) throw new Error("Python venv not initialized. Call ensure() first.");
 		return spawn(venvPython, [script, ...args]);
 	}
 };
@@ -5406,20 +5406,20 @@ var StorageManager = class {
 				const basePath = this.locationManager.getBackend(mappedName).basePath;
 				location.files = {
 					async readFile(p) {
-						return fs.promises.readFile(path$1.join(basePath, p));
+						return fs$1.promises.readFile(path$1.join(basePath, p));
 					},
 					async writeFile(p, data) {
 						const full = path$1.join(basePath, p);
-						await fs.promises.mkdir(path$1.dirname(full), { recursive: true });
-						await fs.promises.writeFile(full, data);
+						await fs$1.promises.mkdir(path$1.dirname(full), { recursive: true });
+						await fs$1.promises.writeFile(full, data);
 					},
 					async deleteFile(p) {
-						await fs.promises.rm(path$1.join(basePath, p), { force: true });
+						await fs$1.promises.rm(path$1.join(basePath, p), { force: true });
 					},
 					async listFiles(prefix) {
 						const dir = prefix ? path$1.join(basePath, prefix) : basePath;
 						try {
-							return (await fs.promises.readdir(dir)).map((f) => prefix ? `${prefix}/${f}` : f);
+							return (await fs$1.promises.readdir(dir)).map((f) => prefix ? `${prefix}/${f}` : f);
 						} catch {
 							return [];
 						}
@@ -5429,7 +5429,7 @@ var StorageManager = class {
 					},
 					async exists(p) {
 						try {
-							await fs.promises.access(path$1.join(basePath, p));
+							await fs$1.promises.access(path$1.join(basePath, p));
 							return true;
 						} catch {
 							return false;
@@ -5616,8 +5616,7 @@ var _integrationRegistryRecordKinds = defineRecordKinds({
 			name: "addon_id",
 			fields: ["addonId"]
 		}],
-		retention: { none: "deleteIntegration only" },
-		adoptsFrom: INTEGRATIONS_LEGACY
+		retention: { none: "deleteIntegration only" }
 	},
 	"integration-settings": {
 		schema: IntegrationSettingBodySchema,
@@ -5629,8 +5628,7 @@ var _integrationRegistryRecordKinds = defineRecordKinds({
 			name: "integration_id",
 			fields: ["integrationId"]
 		}],
-		retention: { none: "cascade on deleteIntegration" },
-		adoptsFrom: INTEGRATION_SETTINGS_LEGACY
+		retention: { none: "cascade on deleteIntegration" }
 	}
 });
 var integrationRegistryRecordKinds = _integrationRegistryRecordKinds;
@@ -6118,8 +6116,7 @@ var _clusterAgentRecordKinds = defineRecordKinds({ "node-history": {
 		name: "last_active",
 		fields: ["at"]
 	}],
-	retention: { none: "rows removed only by operator forget(nodeId)" },
-	adoptsFrom: CLUSTER_NODE_HISTORY_COLLECTION
+	retention: { none: "rows removed only by operator forget(nodeId)" }
 } });
 var clusterAgentRecordKinds = _clusterAgentRecordKinds;
 /** Narrow kind for `records.kind()` — `IsolatedRecordKinds` string index is `| undefined`. */
@@ -6175,7 +6172,7 @@ var TRADITIONAL_NATIVE_PACKAGES = ["better-sqlite3"];
 function hasDotNode(dir, maxDepth) {
 	let entries;
 	try {
-		entries = fs.readdirSync(dir, { withFileTypes: true });
+		entries = fs$1.readdirSync(dir, { withFileTypes: true });
 	} catch {
 		return false;
 	}
@@ -6186,7 +6183,7 @@ function hasDotNode(dir, maxDepth) {
 }
 /** Locate the bundled `prebuild-install` bin.js inside the staged closure. */
 function resolvePrebuildInstallBin(closureDir, moduleDir) {
-	return [path$1.join(moduleDir, "node_modules", "prebuild-install", "bin.js"), path$1.join(closureDir, "node_modules", "prebuild-install", "bin.js")].find((c) => fs.existsSync(c)) ?? null;
+	return [path$1.join(moduleDir, "node_modules", "prebuild-install", "bin.js"), path$1.join(closureDir, "node_modules", "prebuild-install", "bin.js")].find((c) => fs$1.existsSync(c)) ?? null;
 }
 /**
 * Default fetcher: run the closure's own `prebuild-install` under the CURRENT
@@ -6239,7 +6236,7 @@ async function ensureNativePrebuilds(closureDir, options) {
 	const fetched = [];
 	for (const pkg of packages) {
 		const moduleDir = path$1.join(nm, pkg);
-		if (!fs.existsSync(moduleDir)) continue;
+		if (!fs$1.existsSync(moduleDir)) continue;
 		if (hasDotNode(moduleDir, 4)) continue;
 		options.logger.warn("staged closure native prebuild missing — fetching for running ABI", { meta: {
 			pkg,
@@ -6302,12 +6299,12 @@ async function ensureNativePrebuilds(closureDir, options) {
 function replantFromBundled(srcModuleDir, dstModuleDir, hasNative) {
 	if (!hasNative(srcModuleDir)) return false;
 	try {
-		fs.rmSync(dstModuleDir, {
+		fs$1.rmSync(dstModuleDir, {
 			recursive: true,
 			force: true
 		});
-		fs.mkdirSync(path$1.dirname(dstModuleDir), { recursive: true });
-		fs.cpSync(srcModuleDir, dstModuleDir, {
+		fs$1.mkdirSync(path$1.dirname(dstModuleDir), { recursive: true });
+		fs$1.cpSync(srcModuleDir, dstModuleDir, {
 			recursive: true,
 			dereference: true
 		});
@@ -6336,7 +6333,7 @@ async function ensureAddonNativePrebuilds(addonDir, options) {
 	const missing = [];
 	for (const pkg of packages) {
 		const moduleDir = path$1.join(nm, pkg);
-		if (!fs.existsSync(moduleDir)) continue;
+		if (!fs$1.existsSync(moduleDir)) continue;
 		if (hasNative(moduleDir)) {
 			results.push({
 				pkg,
@@ -6435,7 +6432,7 @@ async function defaultDownloadTarball(url, destTgz) {
 	const res = await fetch(url);
 	if (!res.ok || !res.body) throw new Error(`HTTP ${res.status} downloading ${url}`);
 	const bytes = Buffer.from(await res.arrayBuffer());
-	await fs.promises.writeFile(destTgz, bytes);
+	await fs$1.promises.writeFile(destTgz, bytes);
 }
 async function defaultExtractTarball(tgzPath, destDir) {
 	await execFileAsync$5("tar", [
@@ -6521,7 +6518,7 @@ async function resolveUncached(options) {
 		argsPrefix: []
 	};
 	const cliPath = bootstrappedCliPath(options.cacheDir);
-	if (fs.existsSync(cliPath)) {
+	if (fs$1.existsSync(cliPath)) {
 		options.logger.info("system npm unavailable — using bootstrapped npm", { meta: { cliPath } });
 		return {
 			command: process.execPath,
@@ -6533,12 +6530,12 @@ async function resolveUncached(options) {
 		const registry = (options.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, "");
 		const tarballUrl = tarballUrlOf(await (options.fetchJson ?? defaultFetchJson)(`${registry}/npm/latest`));
 		if (!tarballUrl) throw new Error(`registry metadata for 'npm' carries no dist.tarball (${registry})`);
-		await fs.promises.mkdir(options.cacheDir, { recursive: true });
+		await fs$1.promises.mkdir(options.cacheDir, { recursive: true });
 		const tgzPath = path$1.join(options.cacheDir, "npm-bootstrap.tgz");
 		await (options.downloadTarball ?? defaultDownloadTarball)(tarballUrl, tgzPath);
 		await (options.extractTarball ?? defaultExtractTarball)(tgzPath, options.cacheDir);
-		await fs.promises.rm(tgzPath, { force: true });
-		if (!fs.existsSync(cliPath)) throw new Error(`extracted npm tarball is missing ${cliPath}`);
+		await fs$1.promises.rm(tgzPath, { force: true });
+		if (!fs$1.existsSync(cliPath)) throw new Error(`extracted npm tarball is missing ${cliPath}`);
 		options.logger.info("npm bootstrapped", { meta: { cliPath } });
 		return {
 			command: process.execPath,
@@ -6604,7 +6601,7 @@ function readOwningPackageVersion(entryPath) {
 	let dir = path$1.dirname(entryPath);
 	for (let hop = 0; hop < PACKAGE_JSON_LOOKUP_DEPTH; hop++) {
 		try {
-			const version = asJsonObject$1(parseJsonUnknown(fs.readFileSync(path$1.join(dir, "package.json"), "utf-8")))?.["version"];
+			const version = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(path$1.join(dir, "package.json"), "utf-8")))?.["version"];
 			if (typeof version === "string" && version.length > 0) return version;
 		} catch {}
 		const parent = path$1.dirname(dir);
@@ -6648,14 +6645,14 @@ function readOwningPackageVersion(entryPath) {
 function addonModuleCacheKey(entryPath) {
 	let stat;
 	try {
-		stat = fs.statSync(entryPath);
+		stat = fs$1.statSync(entryPath);
 	} catch {
 		return null;
 	}
 	const version = readOwningPackageVersion(entryPath) ?? `m${stat.mtimeMs}`;
 	let content;
 	try {
-		content = createHash("sha1").update(fs.readFileSync(entryPath)).digest("hex").slice(0, 16);
+		content = createHash("sha1").update(fs$1.readFileSync(entryPath)).digest("hex").slice(0, 16);
 	} catch {
 		content = `m${stat.mtimeMs}s${stat.size}`;
 	}
@@ -6759,14 +6756,14 @@ var AddonLoader = class {
 	*  BUILTINS from the active closure, not the (now-inert) addons-dir copy, so
 	*  the addons-dir `@camstack/system` must NOT be double-loaded here. */
 	async loadFromDirectory(addonsDir, skipPackages = []) {
-		if (!fs.existsSync(addonsDir)) return;
+		if (!fs$1.existsSync(addonsDir)) return;
 		const skip = new Set(skipPackages);
-		const entries = fs.readdirSync(addonsDir, { withFileTypes: true });
+		const entries = fs$1.readdirSync(addonsDir, { withFileTypes: true });
 		for (const entry of entries) {
 			if (!isDirectoryEntry(entry, addonsDir)) continue;
 			if (entry.name.startsWith("@")) {
 				const scopeDir = path$1.join(addonsDir, entry.name);
-				const scopeEntries = fs.readdirSync(scopeDir, { withFileTypes: true });
+				const scopeEntries = fs$1.readdirSync(scopeDir, { withFileTypes: true });
 				for (const scopeEntry of scopeEntries) {
 					if (!isDirectoryEntry(scopeEntry, scopeDir)) continue;
 					if (skip.has(`${entry.name}/${scopeEntry.name}`)) continue;
@@ -6780,7 +6777,7 @@ var AddonLoader = class {
 	}
 	async tryLoadAddon(addonDir) {
 		const pkgJsonPath = path$1.join(addonDir, "package.json");
-		if (!fs.existsSync(pkgJsonPath)) return;
+		if (!fs$1.existsSync(pkgJsonPath)) return;
 		try {
 			await this.loadFromAddonDir(addonDir);
 		} catch (err) {
@@ -6798,7 +6795,7 @@ var AddonLoader = class {
 	/** Load addon from a specific directory (package.json + dist/) */
 	async loadFromAddonDir(addonDir) {
 		const pkgJsonPath = path$1.join(addonDir, "package.json");
-		const pkgJson = asJsonObject$1(parseJsonUnknown(fs.readFileSync(pkgJsonPath, "utf-8"))) ?? {};
+		const pkgJson = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(pkgJsonPath, "utf-8"))) ?? {};
 		const packageNameRaw = pkgJson["name"];
 		const packageName = typeof packageNameRaw === "string" ? packageNameRaw : "";
 		const packageVersionRaw = pkgJson["version"];
@@ -6829,9 +6826,23 @@ var AddonLoader = class {
 	}
 	async loadDeclaration(addonDir, declaration, packageName, packageVersion, packageDisplayName, bundle) {
 		if (!declaration.entry) throw new Error(`Addon "${declaration.id}" has no entry point in package.json`);
+		const owner = this.addons.get(declaration.id);
+		if (owner !== void 0 && owner.packageName !== packageName) {
+			this.logger.warn(`Skipped addon "${declaration.id}" from ${packageName}: already provided by ${owner.packageName}`, {
+				tags: { addonId: declaration.id },
+				meta: {
+					skippedPackage: packageName,
+					skippedVersion: packageVersion,
+					skippedDir: addonDir,
+					ownerPackage: owner.packageName,
+					ownerVersion: owner.packageVersion
+				}
+			});
+			return;
+		}
 		const entryFile = declaration.entry.replace(/^\.\//, "").replace(/^src\//, "dist/").replace(/\.ts$/, ".js");
 		let entryPath = path$1.resolve(addonDir, entryFile);
-		if (!fs.existsSync(entryPath)) {
+		if (!fs$1.existsSync(entryPath)) {
 			const base = entryPath.replace(/\.(js|cjs|mjs)$/, "");
 			entryPath = [
 				`${base}.cjs`,
@@ -6840,9 +6851,9 @@ var AddonLoader = class {
 				path$1.resolve(addonDir, "dist", "index.cjs"),
 				path$1.resolve(addonDir, "dist", "index.mjs"),
 				path$1.resolve(addonDir, declaration.entry)
-			].find((p) => fs.existsSync(p)) ?? entryPath;
+			].find((p) => fs$1.existsSync(p)) ?? entryPath;
 		}
-		if (!fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
+		if (!fs$1.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
 		const mod = isRecord$5(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
@@ -6927,7 +6938,7 @@ function isDirectoryEntry(entry, parentDir) {
 	if (entry.name.startsWith(".")) return false;
 	if (entry.isDirectory()) return true;
 	if (entry.isSymbolicLink()) try {
-		return fs.statSync(path$1.join(parentDir, entry.name)).isDirectory();
+		return fs$1.statSync(path$1.join(parentDir, entry.name)).isDirectory();
 	} catch {
 		return false;
 	}
@@ -7021,7 +7032,7 @@ var execFileAsync$4 = promisify(execFile);
 * Single source of truth — replaces scattered mkdirSync calls.
 */
 function ensureDir(dirPath) {
-	fs.mkdirSync(dirPath, { recursive: true });
+	fs$1.mkdirSync(dirPath, { recursive: true });
 }
 /**
 * Copy a directory recursively — ASYNC so it never blocks the event loop.
@@ -7034,7 +7045,7 @@ function ensureDir(dirPath) {
 * `fs.promises.cp` keeps the I/O off the event loop. (Node ≥18 stable.)
 */
 async function copyDirRecursive(src, dest) {
-	await fs.promises.cp(src, dest, {
+	await fs$1.promises.cp(src, dest, {
 		recursive: true,
 		force: true
 	});
@@ -7139,13 +7150,13 @@ async function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 		if (typeof fileEntry !== "string") continue;
 		if (fileEntry === "dist" || fileEntry.includes("*")) continue;
 		const srcPath = path$1.join(sourceDir, fileEntry);
-		if (!fs.existsSync(srcPath)) continue;
+		if (!fs$1.existsSync(srcPath)) continue;
 		const destPath = path$1.join(destDir, fileEntry);
-		const stat = await fs.promises.stat(srcPath);
+		const stat = await fs$1.promises.stat(srcPath);
 		if (stat.isDirectory()) await copyDirRecursive(srcPath, destPath);
 		else if (stat.isFile()) {
 			ensureDir(path$1.dirname(destPath));
-			await fs.promises.copyFile(srcPath, destPath);
+			await fs$1.promises.copyFile(srcPath, destPath);
 		}
 	}
 }
@@ -7156,10 +7167,10 @@ async function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 function isSourceNewer(packageDir) {
 	const srcDir = path$1.join(packageDir, "src");
 	const distDir = path$1.join(packageDir, "dist");
-	if (!fs.existsSync(srcDir) || !fs.existsSync(distDir)) return true;
+	if (!fs$1.existsSync(srcDir) || !fs$1.existsSync(distDir)) return true;
 	try {
-		const distMtime = fs.statSync(distDir).mtimeMs;
-		const entries = fs.readdirSync(srcDir, {
+		const distMtime = fs$1.statSync(distDir).mtimeMs;
+		const entries = fs$1.readdirSync(srcDir, {
 			withFileTypes: true,
 			recursive: true
 		});
@@ -7167,7 +7178,7 @@ function isSourceNewer(packageDir) {
 			if (!entry.isFile()) continue;
 			const parentDir = entry.parentPath ?? String(Reflect.get(entry, "path") ?? "");
 			const filePath = path$1.join(parentDir, entry.name);
-			if (fs.statSync(filePath).mtimeMs > distMtime) return true;
+			if (fs$1.statSync(filePath).mtimeMs > distMtime) return true;
 		}
 		return false;
 	} catch {
@@ -7182,9 +7193,9 @@ function isSourceNewer(packageDir) {
 function ensureLibraryBuilt(packageName, packagesDir) {
 	const dirName = packageName.replace("@camstack/", "");
 	const sourceDir = path$1.join(packagesDir, dirName);
-	if (!fs.existsSync(sourceDir)) return;
+	if (!fs$1.existsSync(sourceDir)) return;
 	const distDir = path$1.join(sourceDir, "dist");
-	if (fs.existsSync(path$1.join(distDir, "index.js")) || fs.existsSync(path$1.join(distDir, "index.mjs"))) return;
+	if (fs$1.existsSync(path$1.join(distDir, "index.js")) || fs$1.existsSync(path$1.join(distDir, "index.mjs"))) return;
 	console.warn(`[ensureLibraryBuilt] ${packageName} has no dist/ — run 'npm run build' first`);
 }
 /**
@@ -7197,7 +7208,7 @@ function ensureLibraryBuilt(packageName, packagesDir) {
 * `copyDirRecursive` for the wedge this prevents.
 */
 async function installPackageFromNpm(packageName, targetDir) {
-	const tmpDir = await fs.promises.mkdtemp(path$1.join(os$1.tmpdir(), "camstack-install-"));
+	const tmpDir = await fs$1.promises.mkdtemp(path$1.join(os$1.tmpdir(), "camstack-install-"));
 	try {
 		const { stdout } = await execFileAsync$4("npm", [
 			"pack",
@@ -7220,21 +7231,21 @@ async function installPackageFromNpm(packageName, targetDir) {
 			extractDir
 		], { timeout: 3e4 });
 		const packageSubDir = path$1.join(extractDir, "package");
-		const srcPkgJsonDir = fs.existsSync(path$1.join(packageSubDir, "package.json")) ? packageSubDir : extractDir;
-		await fs.promises.rm(targetDir, {
+		const srcPkgJsonDir = fs$1.existsSync(path$1.join(packageSubDir, "package.json")) ? packageSubDir : extractDir;
+		await fs$1.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		await fs.promises.copyFile(path$1.join(srcPkgJsonDir, "package.json"), path$1.join(targetDir, "package.json"));
+		await fs$1.promises.copyFile(path$1.join(srcPkgJsonDir, "package.json"), path$1.join(targetDir, "package.json"));
 		const distSrc = path$1.join(srcPkgJsonDir, "dist");
-		if (fs.existsSync(distSrc)) await copyDirRecursive(distSrc, path$1.join(targetDir, "dist"));
+		if (fs$1.existsSync(distSrc)) await copyDirRecursive(distSrc, path$1.join(targetDir, "dist"));
 		try {
-			const npmPkg = asJsonObject$1(parseJsonUnknown(await fs.promises.readFile(path$1.join(srcPkgJsonDir, "package.json"), "utf-8")));
+			const npmPkg = asJsonObject$1(parseJsonUnknown(await fs$1.promises.readFile(path$1.join(srcPkgJsonDir, "package.json"), "utf-8")));
 			if (npmPkg) await copyExtraFileDirs(npmPkg, srcPkgJsonDir, targetDir);
 		} catch {}
 	} finally {
-		await fs.promises.rm(tmpDir, {
+		await fs$1.promises.rm(tmpDir, {
 			recursive: true,
 			force: true
 		});
@@ -7259,7 +7270,7 @@ function packageDirName$1(declaredName) {
 }
 function isDirLike$1(p) {
 	try {
-		return fs.statSync(p).isDirectory();
+		return fs$1.statSync(p).isDirectory();
 	} catch {
 		return false;
 	}
@@ -7277,12 +7288,12 @@ var AddonManifest = class {
 	*/
 	read() {
 		if (this.cache != null) return this.cache;
-		if (!fs.existsSync(this.manifestPath)) {
+		if (!fs$1.existsSync(this.manifestPath)) {
 			this.cache = this.empty();
 			return this.cache;
 		}
 		try {
-			const raw = fs.readFileSync(this.manifestPath, "utf-8");
+			const raw = fs$1.readFileSync(this.manifestPath, "utf-8");
 			const parsed = JSON.parse(raw);
 			if (parsed.version !== MANIFEST_VERSION) {
 				process.stderr.write(`[AddonManifest] schema mismatch (file=${parsed.version} vs runtime=${MANIFEST_VERSION}); starting empty\n`);
@@ -7303,13 +7314,13 @@ var AddonManifest = class {
 	* a half-written file.
 	*/
 	write(manifest) {
-		fs.mkdirSync(path$1.dirname(this.manifestPath), { recursive: true });
+		fs$1.mkdirSync(path$1.dirname(this.manifestPath), { recursive: true });
 		const tmp = `${this.manifestPath}.tmp.${process.pid}.${Date.now()}`;
-		fs.writeFileSync(tmp, JSON.stringify(manifest, null, 2), {
+		fs$1.writeFileSync(tmp, JSON.stringify(manifest, null, 2), {
 			encoding: "utf-8",
 			mode: 384
 		});
-		fs.renameSync(tmp, this.manifestPath);
+		fs$1.renameSync(tmp, this.manifestPath);
 		this.cache = manifest;
 	}
 	/** Lookup a single addon's manifest entry, or `null` if not tracked. */
@@ -7384,22 +7395,22 @@ var AddonManifest = class {
 	* exactly what moved. Returns the total number of changes.
 	*/
 	reconcileFromDisk(addonsDir, onChange) {
-		if (!fs.existsSync(addonsDir)) return 0;
+		if (!fs$1.existsSync(addonsDir)) return 0;
 		const m = this.read();
 		let changes = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		/** Package name → version, for every ADDON package actually installed. */
 		const onDisk = /* @__PURE__ */ new Map();
-		for (const scope of fs.readdirSync(addonsDir, { withFileTypes: true })) {
+		for (const scope of fs$1.readdirSync(addonsDir, { withFileTypes: true })) {
 			if (!scope.name.startsWith("@") || !isDirLike$1(path$1.join(addonsDir, scope.name))) continue;
 			const scopeDir = path$1.join(addonsDir, scope.name);
-			for (const pkg of fs.readdirSync(scopeDir, { withFileTypes: true })) {
+			for (const pkg of fs$1.readdirSync(scopeDir, { withFileTypes: true })) {
 				if (!isDirLike$1(path$1.join(scopeDir, pkg.name))) continue;
 				const pkgJsonPath = path$1.join(scopeDir, pkg.name, "package.json");
-				if (!fs.existsSync(pkgJsonPath)) continue;
+				if (!fs$1.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
 				try {
-					const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+					const parsed = JSON.parse(fs$1.readFileSync(pkgJsonPath, "utf-8"));
 					if (typeof parsed !== "object" || parsed == null) continue;
 					pkgJson = parsed;
 				} catch {
@@ -7470,28 +7481,28 @@ var AddonManifest = class {
 	migrateFromInstallSourceMarkers(addonsDir) {
 		const m = this.read();
 		if (Object.keys(m.addons).length > 0) return 0;
-		if (!fs.existsSync(addonsDir)) return 0;
+		if (!fs$1.existsSync(addonsDir)) return 0;
 		let migrated = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		for (const scope of fs.readdirSync(addonsDir, { withFileTypes: true })) {
+		for (const scope of fs$1.readdirSync(addonsDir, { withFileTypes: true })) {
 			if (!scope.isDirectory() || !scope.name.startsWith("@")) continue;
 			const scopeDir = path$1.join(addonsDir, scope.name);
-			for (const pkg of fs.readdirSync(scopeDir, { withFileTypes: true })) {
+			for (const pkg of fs$1.readdirSync(scopeDir, { withFileTypes: true })) {
 				if (!pkg.isDirectory()) continue;
 				const pkgDir = path$1.join(scopeDir, pkg.name);
 				const markerPath = path$1.join(pkgDir, ".install-source");
 				const pkgJsonPath = path$1.join(pkgDir, "package.json");
-				if (!fs.existsSync(pkgJsonPath)) continue;
+				if (!fs$1.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
 				try {
-					const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+					const parsed = JSON.parse(fs$1.readFileSync(pkgJsonPath, "utf-8"));
 					if (typeof parsed !== "object" || parsed == null) continue;
 					pkgJson = parsed;
 				} catch {
 					continue;
 				}
 				if (!pkgJson.name || !pkgJson.version) continue;
-				const source = fs.existsSync(markerPath) ? fs.readFileSync(markerPath, "utf-8").trim() : "bundled";
+				const source = fs$1.existsSync(markerPath) ? fs$1.readFileSync(markerPath, "utf-8").trim() : "bundled";
 				m.addons[pkgJson.name] = {
 					name: pkgJson.name,
 					version: pkgJson.version,
@@ -7668,7 +7679,7 @@ function planClosureDedupe(input) {
 function readTreeManifest(pkgJsonPath) {
 	let raw;
 	try {
-		raw = asJsonObject$1(parseJsonUnknown(fs.readFileSync(pkgJsonPath, "utf-8")));
+		raw = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(pkgJsonPath, "utf-8")));
 	} catch {
 		return null;
 	}
@@ -7693,7 +7704,7 @@ function readTreeManifest(pkgJsonPath) {
 function listTopLevelEntries(nodeModulesDir) {
 	let entries;
 	try {
-		entries = fs.readdirSync(nodeModulesDir, { withFileTypes: true });
+		entries = fs$1.readdirSync(nodeModulesDir, { withFileTypes: true });
 	} catch {
 		return [];
 	}
@@ -7703,7 +7714,7 @@ function listTopLevelEntries(nodeModulesDir) {
 		if (entry.name.startsWith("@")) {
 			let inner;
 			try {
-				inner = fs.readdirSync(path$1.join(nodeModulesDir, entry.name), { withFileTypes: true });
+				inner = fs$1.readdirSync(path$1.join(nodeModulesDir, entry.name), { withFileTypes: true });
 			} catch {
 				continue;
 			}
@@ -7736,14 +7747,14 @@ function collectAddonTreeState(addonDir) {
 		const entryDir = path$1.join(nodeModulesDir, name);
 		let isLink = false;
 		try {
-			isLink = fs.lstatSync(entryDir).isSymbolicLink();
+			isLink = fs$1.lstatSync(entryDir).isSymbolicLink();
 		} catch {
 			continue;
 		}
 		if (isLink) {
 			let target = "";
 			try {
-				target = fs.readlinkSync(entryDir);
+				target = fs$1.readlinkSync(entryDir);
 			} catch {}
 			existingLinks.push({
 				name,
@@ -7757,7 +7768,7 @@ function collectAddonTreeState(addonDir) {
 			version: manifest.version
 		});
 		for (const [depName, range] of manifest.ranges) {
-			if (fs.existsSync(path$1.join(entryDir, "node_modules", depName))) continue;
+			if (fs$1.existsSync(path$1.join(entryDir, "node_modules", depName))) continue;
 			addRange(depName, range);
 		}
 	}
@@ -7787,7 +7798,7 @@ function resolveClosureNodeModulesDir(explicitDir) {
 	const frameworkDir = explicitDir ?? process.env["CAMSTACK_FRAMEWORK_DIR"];
 	if (frameworkDir === void 0 || frameworkDir.length === 0) return null;
 	const nodeModulesDir = explicitDir ?? path$1.join(frameworkDir, "node_modules");
-	return fs.existsSync(nodeModulesDir) ? nodeModulesDir : null;
+	return fs$1.existsSync(nodeModulesDir) ? nodeModulesDir : null;
 }
 function symlinkType() {
 	return process.platform === "win32" ? "junction" : "dir";
@@ -7806,10 +7817,10 @@ function executeClosureDedupe(addonDir, closureNodeModulesDir, plan, logger) {
 	const nodeModulesDir = path$1.join(addonDir, "node_modules");
 	const probePath = path$1.join(nodeModulesDir, ".closure-link-probe");
 	try {
-		fs.mkdirSync(nodeModulesDir, { recursive: true });
-		fs.rmSync(probePath, { force: true });
-		fs.symlinkSync(closureNodeModulesDir, probePath, symlinkType());
-		fs.rmSync(probePath, { force: true });
+		fs$1.mkdirSync(nodeModulesDir, { recursive: true });
+		fs$1.rmSync(probePath, { force: true });
+		fs$1.symlinkSync(closureNodeModulesDir, probePath, symlinkType());
+		fs$1.rmSync(probePath, { force: true });
 	} catch (err) {
 		logger.warn("closure dedupe skipped — symlinks unavailable on this volume", { meta: {
 			addonDir,
@@ -7831,12 +7842,12 @@ function executeClosureDedupe(addonDir, closureNodeModulesDir, plan, logger) {
 		}
 		const entryDir = path$1.join(nodeModulesDir, link.name);
 		try {
-			fs.rmSync(entryDir, {
+			fs$1.rmSync(entryDir, {
 				recursive: true,
 				force: true
 			});
-			fs.mkdirSync(path$1.dirname(entryDir), { recursive: true });
-			fs.symlinkSync(target, entryDir, symlinkType());
+			fs$1.mkdirSync(path$1.dirname(entryDir), { recursive: true });
+			fs$1.symlinkSync(target, entryDir, symlinkType());
 			linked.push(link.name);
 		} catch (err) {
 			logger.warn("closure dedupe — link failed; entry removed copy may need reinstall", { meta: {
@@ -7912,7 +7923,7 @@ async function installManifestNativeDeps(addonDir, pkgRaw, logger, registry, npm
 			count: Object.keys(native).length
 		} });
 		try {
-			fs.writeFileSync(markerFile, markerHash);
+			fs$1.writeFileSync(markerFile, markerHash);
 		} catch (err) {
 			logger.warn("Failed to write native deps marker", { meta: {
 				markerFile,
@@ -7950,7 +7961,7 @@ async function installManifestNativeDeps(addonDir, pkgRaw, logger, registry, npm
 	}
 	await rebuildNativeDeps(addonDir, pending.map(([name]) => name), logger, npmCacheDir ?? defaultNpmCacheDir(), registry);
 	try {
-		fs.writeFileSync(markerFile, markerHash);
+		fs$1.writeFileSync(markerFile, markerHash);
 	} catch (err) {
 		logger.warn("Failed to write native deps marker", { meta: {
 			markerFile,
@@ -7972,12 +7983,12 @@ function copyPrebuiltNativeDep(name, addonDir, logger) {
 		if (source === target) continue;
 		if (!hasBuiltBinary(source)) continue;
 		try {
-			fs.rmSync(target, {
+			fs$1.rmSync(target, {
 				recursive: true,
 				force: true
 			});
-			fs.mkdirSync(path$1.dirname(target), { recursive: true });
-			fs.cpSync(source, target, {
+			fs$1.mkdirSync(path$1.dirname(target), { recursive: true });
+			fs$1.cpSync(source, target, {
 				recursive: true,
 				dereference: true
 			});
@@ -8013,7 +8024,7 @@ var BUNDLED_NATIVE_SIBLING_SCOPES = {
 function hasAnyDotNode(dir, maxDepth) {
 	let entries;
 	try {
-		entries = fs.readdirSync(dir, { withFileTypes: true });
+		entries = fs$1.readdirSync(dir, { withFileTypes: true });
 	} catch {
 		return false;
 	}
@@ -8027,12 +8038,12 @@ function copyPrebuiltModuleDir(src, dst, label, logger) {
 	if (!hasAnyDotNode(src, 5)) return;
 	if (hasAnyDotNode(dst, 5)) return;
 	try {
-		fs.rmSync(dst, {
+		fs$1.rmSync(dst, {
 			recursive: true,
 			force: true
 		});
-		fs.mkdirSync(path$1.dirname(dst), { recursive: true });
-		fs.cpSync(src, dst, {
+		fs$1.mkdirSync(path$1.dirname(dst), { recursive: true });
+		fs$1.cpSync(src, dst, {
 			recursive: true,
 			dereference: true
 		});
@@ -8067,7 +8078,7 @@ function copyPrebuiltModuleDir(src, dst, label, logger) {
 */
 function copyBundledNativeModules(sourceDir, targetDir, logger) {
 	const srcNm = path$1.join(sourceDir, "node_modules");
-	if (!fs.existsSync(srcNm)) return;
+	if (!fs$1.existsSync(srcNm)) return;
 	const dstNm = path$1.join(targetDir, "node_modules");
 	for (const [name, scopes] of Object.entries(BUNDLED_NATIVE_SIBLING_SCOPES)) {
 		copyPrebuiltModuleDir(path$1.join(srcNm, name), path$1.join(dstNm, name), name, logger);
@@ -8075,7 +8086,7 @@ function copyBundledNativeModules(sourceDir, targetDir, logger) {
 			const scopeSrc = path$1.join(srcNm, scope);
 			let siblings;
 			try {
-				siblings = fs.readdirSync(scopeSrc);
+				siblings = fs$1.readdirSync(scopeSrc);
 			} catch {
 				continue;
 			}
@@ -8085,12 +8096,12 @@ function copyBundledNativeModules(sourceDir, targetDir, logger) {
 }
 /** A package dir is "built" when it carries a compiled `.node` or a prebuilds tree. */
 function hasBuiltBinary(pkgDir) {
-	if (!fs.existsSync(path$1.join(pkgDir, "package.json"))) return false;
+	if (!fs$1.existsSync(path$1.join(pkgDir, "package.json"))) return false;
 	const releaseDir = path$1.join(pkgDir, "build", "Release");
 	try {
-		if (fs.existsSync(releaseDir) && fs.readdirSync(releaseDir).some((f) => f.endsWith(".node"))) return true;
+		if (fs$1.existsSync(releaseDir) && fs$1.readdirSync(releaseDir).some((f) => f.endsWith(".node"))) return true;
 	} catch {}
-	return fs.existsSync(path$1.join(pkgDir, "prebuilds"));
+	return fs$1.existsSync(path$1.join(pkgDir, "prebuilds"));
 }
 /** Candidate hoisted locations for `<name>`: NODE_PATH entries + ancestors of `addonDir`. */
 function candidateHoistedDirs(name, addonDir) {
@@ -8128,7 +8139,7 @@ function hashDeclaration(deps) {
 }
 function markerMatches(markerFile, expected) {
 	try {
-		return fs.readFileSync(markerFile, "utf-8").trim() === expected;
+		return fs$1.readFileSync(markerFile, "utf-8").trim() === expected;
 	} catch {
 		return false;
 	}
@@ -8235,7 +8246,7 @@ function parseInstallSource(value) {
 function readPackageJson(pkgJsonPath) {
 	let raw;
 	try {
-		raw = asJsonObject$1(parseJsonUnknown(fs.readFileSync(pkgJsonPath, "utf-8")));
+		raw = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(pkgJsonPath, "utf-8")));
 	} catch {
 		return null;
 	}
@@ -8398,7 +8409,7 @@ var AddonInstaller = class AddonInstaller {
 		} catch {
 			return Object.freeze([]);
 		}
-		const raw = fs.readFileSync(pkgPath, "utf-8");
+		const raw = fs$1.readFileSync(pkgPath, "utf-8");
 		const parsed = JSON.parse(raw);
 		const deps = Object.keys(parsed.dependencies ?? {});
 		const agentOnly = new Set(parsed.camstack?.agentOnlyBootstrapAddons ?? []);
@@ -8443,7 +8454,7 @@ var AddonInstaller = class AddonInstaller {
 		} catch {
 			return Object.freeze([]);
 		}
-		const raw = fs.readFileSync(pkgPath, "utf-8");
+		const raw = fs$1.readFileSync(pkgPath, "utf-8");
 		const addons = JSON.parse(raw).camstack?.agentBootstrapAddons ?? [];
 		return Object.freeze(["@camstack/system", ...addons]);
 	}
@@ -8474,7 +8485,7 @@ var AddonInstaller = class AddonInstaller {
 		}
 		for (const packageName of pkgList) {
 			const addonDir = path$1.join(this.addonsDir, packageName);
-			if (fs.existsSync(path$1.join(addonDir, "package.json"))) {
+			if (fs$1.existsSync(path$1.join(addonDir, "package.json"))) {
 				this.logger.debug(`${packageName} — already installed, skipping`);
 				continue;
 			}
@@ -8559,7 +8570,7 @@ var AddonInstaller = class AddonInstaller {
 		const installedPackages = this.listInstalled();
 		for (const pkg of installedPackages) {
 			try {
-				if (fs.lstatSync(pkg.dir).isSymbolicLink()) continue;
+				if (fs$1.lstatSync(pkg.dir).isSymbolicLink()) continue;
 			} catch {
 				continue;
 			}
@@ -8599,7 +8610,7 @@ var AddonInstaller = class AddonInstaller {
 		if (closureNodeModules !== null) for (const link of state.existingLinks) {
 			if (!isClosureLinkTarget(link.target, closureNodeModules)) continue;
 			const linkDir = path$1.join(nodeModulesDir, link.name);
-			const targetManifest = fs.existsSync(path$1.join(linkDir, "package.json"));
+			const targetManifest = fs$1.existsSync(path$1.join(linkDir, "package.json"));
 			const ranges = state.requirements.get(link.name) ?? [];
 			let holds = targetManifest;
 			if (holds && ranges.length > 0) {
@@ -8608,14 +8619,14 @@ var AddonInstaller = class AddonInstaller {
 			}
 			if (!holds) {
 				this.logger.warn(`${packageName} — closure link for ${link.name} no longer holds; reinstalling this addon's deps`, { meta: { target: link.target } });
-				fs.rmSync(linkDir, { force: true });
+				fs$1.rmSync(linkDir, { force: true });
 				needsInstall = true;
 			}
 		}
 		const linked = [];
 		for (const [depName, range] of declaredEntries) {
 			if (typeof range !== "string") continue;
-			if (fs.existsSync(path$1.join(nodeModulesDir, depName, "package.json"))) continue;
+			if (fs$1.existsSync(path$1.join(nodeModulesDir, depName, "package.json"))) continue;
 			const closureVersion = closureNodeModules === null ? void 0 : readClosureVersions(closureNodeModules, [depName]).get(depName);
 			if (closureNodeModules !== null && closureVersion !== void 0 && closureSatisfiesRange(range, closureVersion)) {
 				if (executeClosureDedupe(addonDir, closureNodeModules, {
@@ -8648,7 +8659,7 @@ var AddonInstaller = class AddonInstaller {
 		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
 		if (closureNodeModules !== null) {
 			const state = collectAddonTreeState(addonDir);
-			for (const link of state.existingLinks) if (isClosureLinkTarget(link.target, closureNodeModules)) fs.rmSync(path$1.join(addonDir, "node_modules", link.name), { force: true });
+			for (const link of state.existingLinks) if (isClosureLinkTarget(link.target, closureNodeModules)) fs$1.rmSync(path$1.join(addonDir, "node_modules", link.name), { force: true });
 		}
 		this.logger.info(`${packageName} — reinstalling runtime dependencies`, { meta: { addonDir } });
 		await runNpm([
@@ -8707,7 +8718,7 @@ var AddonInstaller = class AddonInstaller {
 	async realignFromClosure(packageName, closureDir) {
 		const targetDir = path$1.join(this.addonsDir, packageName);
 		const result = await this.installLocal(packageName, closureDir);
-		await fs.promises.writeFile(path$1.join(targetDir, ".install-source"), "closure");
+		await fs$1.promises.writeFile(path$1.join(targetDir, ".install-source"), "closure");
 		this.manifest.upsert(result.name, {
 			version: result.version,
 			source: "closure"
@@ -8742,12 +8753,12 @@ var AddonInstaller = class AddonInstaller {
 	*/
 	async installSymlink(packageName, sourceDir, pkgData, targetDir) {
 		await this.ensureBuilt(packageName, sourceDir, pkgData);
-		fs.rmSync(targetDir, {
+		fs$1.rmSync(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(path$1.dirname(targetDir));
-		fs.symlinkSync(sourceDir, targetDir, "dir");
+		fs$1.symlinkSync(sourceDir, targetDir, "dir");
 		this.manifest.upsert(packageName, {
 			version: asString$1(pkgData.version, "0.0.0"),
 			source: "local"
@@ -8761,17 +8772,17 @@ var AddonInstaller = class AddonInstaller {
 	async installCopy(packageName, sourceDir, pkgData, targetDir) {
 		await this.ensureBuilt(packageName, sourceDir, pkgData);
 		const distDir = path$1.join(sourceDir, "dist");
-		if (!fs.existsSync(distDir)) throw new Error(`${packageName} has no dist/ after build`);
-		await fs.promises.rm(targetDir, {
+		if (!fs$1.existsSync(distDir)) throw new Error(`${packageName} has no dist/ after build`);
+		await fs$1.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		await fs.promises.writeFile(path$1.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
+		await fs$1.promises.writeFile(path$1.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
 		await copyDirRecursive(distDir, path$1.join(targetDir, "dist"));
 		await copyExtraFileDirs(pkgData, sourceDir, targetDir);
 		copyBundledNativeModules(sourceDir, targetDir, this.logger);
-		await fs.promises.writeFile(path$1.join(targetDir, ".install-source"), "local");
+		await fs$1.promises.writeFile(path$1.join(targetDir, ".install-source"), "local");
 		const localPkgVersion = asString$1(pkgData.version, "0.0.0");
 		this.manifest.upsert(packageName, {
 			version: localPkgVersion,
@@ -8812,7 +8823,7 @@ var AddonInstaller = class AddonInstaller {
 	* unusual auth, offline mode, etc).
 	*/
 	async installFromNpm(packageName, version) {
-		const tmpDir = fs.mkdtempSync(path$1.join(os$1.tmpdir(), "camstack-addon-npm-"));
+		const tmpDir = fs$1.mkdtempSync(path$1.join(os$1.tmpdir(), "camstack-addon-npm-"));
 		const packageSpec = version ? `${packageName}@${version}` : packageName;
 		this.logger.info(`${packageName} — installing from npm`);
 		try {
@@ -8826,19 +8837,19 @@ var AddonInstaller = class AddonInstaller {
 				];
 				if (this.registry) args.push("--registry", this.registry);
 				const { stdout } = await runNpm(args, this.npmRunOptions(tmpDir, 12e4));
-				const tgzFiles = fs.readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
+				const tgzFiles = fs$1.readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
 				if (tgzFiles.length === 0) throw new Error(`npm pack produced no tgz. stdout: ${stdout.trim()}`);
 				return path$1.join(tmpDir, tgzFiles[0]);
 			});
 			const result = await this.installFromTgz(tgzPath);
-			fs.writeFileSync(path$1.join(this.addonsDir, result.name, ".install-source"), "npm");
+			fs$1.writeFileSync(path$1.join(this.addonsDir, result.name, ".install-source"), "npm");
 			this.manifest.upsert(result.name, {
 				version: result.version,
 				source: "npm"
 			});
 			return result;
 		} finally {
-			fs.rmSync(tmpDir, {
+			fs$1.rmSync(tmpDir, {
 				recursive: true,
 				force: true
 			});
@@ -8876,7 +8887,7 @@ var AddonInstaller = class AddonInstaller {
 		if (!tarRes.ok) throw new Error(`tarball GET ${tarballUrl} → ${tarRes.status}`);
 		const tgzPath = path$1.join(tmpDir, `${packageName.replace(/[/@]/g, "-").replace(/^-+/, "")}-${resolvedVersion}.tgz`);
 		const buf = Buffer.from(await tarRes.arrayBuffer());
-		fs.writeFileSync(tgzPath, buf);
+		fs$1.writeFileSync(tgzPath, buf);
 		return tgzPath;
 	}
 	/**
@@ -8897,7 +8908,7 @@ var AddonInstaller = class AddonInstaller {
 	* on the next deploy.
 	*/
 	async evictInstallDir(targetDir) {
-		if (!fs.existsSync(targetDir)) return;
+		if (!fs$1.existsSync(targetDir)) return;
 		const graveyard = path$1.join(this.addonsDir, ".evicting");
 		ensureDir(graveyard);
 		await this.sweepGraveyard(graveyard);
@@ -8905,10 +8916,10 @@ var AddonInstaller = class AddonInstaller {
 		const flatName = path$1.relative(this.addonsDir, targetDir).replace(/[/\\]/g, "-");
 		const asideDir = path$1.join(graveyard, `${flatName}-${ts}`);
 		try {
-			fs.renameSync(targetDir, asideDir);
+			fs$1.renameSync(targetDir, asideDir);
 		} catch (renameErr) {
 			if (renameErr.code === "EXDEV") {
-				await fs.promises.rm(targetDir, {
+				await fs$1.promises.rm(targetDir, {
 					recursive: true,
 					force: true
 				});
@@ -8916,7 +8927,7 @@ var AddonInstaller = class AddonInstaller {
 			}
 			throw renameErr;
 		}
-		await fs.promises.rm(asideDir, {
+		await fs$1.promises.rm(asideDir, {
 			recursive: true,
 			force: true
 		}).catch((cleanupErr) => {
@@ -8937,14 +8948,14 @@ var AddonInstaller = class AddonInstaller {
 	async sweepStagingResidue(stagingRoot) {
 		let names;
 		try {
-			names = fs.readdirSync(stagingRoot);
+			names = fs$1.readdirSync(stagingRoot);
 		} catch {
 			return;
 		}
 		const now = Date.now();
 		const ages = [];
 		for (const name of names) try {
-			const stat = fs.statSync(path$1.join(stagingRoot, name));
+			const stat = fs$1.statSync(path$1.join(stagingRoot, name));
 			ages.push({
 				name,
 				ageMs: now - stat.mtimeMs
@@ -8955,7 +8966,7 @@ var AddonInstaller = class AddonInstaller {
 			stagingRoot,
 			entries: sweepable
 		} });
-		await Promise.all(sweepable.map((name) => fs.promises.rm(path$1.join(stagingRoot, name), {
+		await Promise.all(sweepable.map((name) => fs$1.promises.rm(path$1.join(stagingRoot, name), {
 			recursive: true,
 			force: true
 		}).catch(() => void 0)));
@@ -8964,11 +8975,11 @@ var AddonInstaller = class AddonInstaller {
 	async sweepGraveyard(graveyard) {
 		let entries;
 		try {
-			entries = fs.readdirSync(graveyard);
+			entries = fs$1.readdirSync(graveyard);
 		} catch {
 			return;
 		}
-		await Promise.all(entries.map((name) => fs.promises.rm(path$1.join(graveyard, name), {
+		await Promise.all(entries.map((name) => fs$1.promises.rm(path$1.join(graveyard, name), {
 			recursive: true,
 			force: true
 		}).catch(() => void 0)));
@@ -9019,7 +9030,7 @@ var AddonInstaller = class AddonInstaller {
 			return;
 		}
 		const strippedManifest = stripBundledDeps(pkgView.raw);
-		await fs.promises.writeFile(pkgJsonPath, JSON.stringify(strippedManifest, null, 2));
+		await fs$1.promises.writeFile(pkgJsonPath, JSON.stringify(strippedManifest, null, 2));
 		const deps = asJsonObject$1(strippedManifest["dependencies"]);
 		const depNames = deps ? Object.keys(deps) : [];
 		if (depNames.length === 0) return;
@@ -9151,9 +9162,9 @@ var AddonInstaller = class AddonInstaller {
 				"-C",
 				stagingDir
 			], { timeout: 12e4 });
-			const pkgDir = fs.existsSync(path$1.join(stagingDir, "package", "package.json")) ? path$1.join(stagingDir, "package") : stagingDir;
+			const pkgDir = fs$1.existsSync(path$1.join(stagingDir, "package", "package.json")) ? path$1.join(stagingDir, "package") : stagingDir;
 			const pkgJsonPath = path$1.join(pkgDir, "package.json");
-			if (!fs.existsSync(pkgJsonPath)) throw new Error("No package.json found in tgz archive");
+			if (!fs$1.existsSync(pkgJsonPath)) throw new Error("No package.json found in tgz archive");
 			const pkgView = readPackageJson(pkgJsonPath);
 			if (!pkgView) throw new Error(`Invalid package.json at ${pkgJsonPath}`);
 			if (!pkgView.camstackAddons) throw new Error(`Package ${pkgView.name} has no camstack.addons manifest`);
@@ -9163,7 +9174,7 @@ var AddonInstaller = class AddonInstaller {
 			this.dedupeTreeAgainstClosure(pkgDir, pkgView.name);
 			await this.evictInstallDir(targetDir);
 			ensureDir(path$1.dirname(targetDir));
-			await fs.promises.rename(pkgDir, targetDir);
+			await fs$1.promises.rename(pkgDir, targetDir);
 			this.manifest.upsert(pkgView.name, {
 				version: pkgView.version,
 				source: "bundled"
@@ -9174,7 +9185,7 @@ var AddonInstaller = class AddonInstaller {
 			};
 		} finally {
 			this.inFlightStaging.delete(stagingName);
-			await fs.promises.rm(stagingDir, {
+			await fs$1.promises.rm(stagingDir, {
 				recursive: true,
 				force: true
 			}).catch(() => void 0);
@@ -9204,13 +9215,13 @@ var AddonInstaller = class AddonInstaller {
 		const current = this.manifest.get(packageName);
 		if (current == null) throw new Error(`Cannot update ${packageName}: not currently tracked in manifest`);
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (!fs.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
+		if (!fs$1.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
 		const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 		const backupRoot = path$1.join(this.addonsDir, ".backups", packageName);
 		ensureDir(backupRoot);
 		const backupDir = path$1.join(backupRoot, ts);
 		this.logger.info(`${packageName} — backing up v${current.version} → ${backupDir}`);
-		fs.renameSync(addonDir, backupDir);
+		fs$1.renameSync(addonDir, backupDir);
 		let result;
 		try {
 			if (this.installSource === "local" || this.installSource === "symlink") {
@@ -9225,11 +9236,11 @@ var AddonInstaller = class AddonInstaller {
 		} catch (installErr) {
 			this.logger.error(`${packageName} — install failed, restoring backup`, { meta: { error: errMsg$1(installErr) } });
 			try {
-				if (fs.existsSync(addonDir)) fs.rmSync(addonDir, {
+				if (fs$1.existsSync(addonDir)) fs$1.rmSync(addonDir, {
 					recursive: true,
 					force: true
 				});
-				fs.renameSync(backupDir, addonDir);
+				fs$1.renameSync(backupDir, addonDir);
 				this.manifest.upsert(packageName, {
 					version: current.version,
 					source: current.source,
@@ -9290,7 +9301,7 @@ var AddonInstaller = class AddonInstaller {
 		const current = this.manifest.get(packageName);
 		if (current == null) throw new Error(`Cannot update ${packageName}: not currently tracked in manifest`);
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (!fs.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
+		if (!fs$1.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
 		await this.installRuntimeDependencies(stagedPath, packageName);
 		await this.installNativeDependencies(stagedPath, packageName);
 		this.dedupeTreeAgainstClosure(stagedPath, packageName);
@@ -9299,14 +9310,14 @@ var AddonInstaller = class AddonInstaller {
 		ensureDir(backupRoot);
 		const backupDir = path$1.join(backupRoot, ts);
 		this.logger.info(`${packageName} — backing up v${current.version} → ${backupDir}`);
-		fs.renameSync(addonDir, backupDir);
+		fs$1.renameSync(addonDir, backupDir);
 		try {
 			try {
-				fs.renameSync(stagedPath, addonDir);
+				fs$1.renameSync(stagedPath, addonDir);
 			} catch (renameErr) {
 				if (renameErr.code === "EXDEV") {
-					fs.cpSync(stagedPath, addonDir, { recursive: true });
-					fs.rmSync(stagedPath, {
+					fs$1.cpSync(stagedPath, addonDir, { recursive: true });
+					fs$1.rmSync(stagedPath, {
 						recursive: true,
 						force: true
 					});
@@ -9315,11 +9326,11 @@ var AddonInstaller = class AddonInstaller {
 		} catch (swapErr) {
 			this.logger.error(`${packageName} — staged swap failed, restoring backup`, { meta: { error: errMsg$1(swapErr) } });
 			try {
-				if (fs.existsSync(addonDir)) fs.rmSync(addonDir, {
+				if (fs$1.existsSync(addonDir)) fs$1.rmSync(addonDir, {
 					recursive: true,
 					force: true
 				});
-				fs.renameSync(backupDir, addonDir);
+				fs$1.renameSync(backupDir, addonDir);
 				this.manifest.upsert(packageName, {
 					version: current.version,
 					source: current.source,
@@ -9358,20 +9369,20 @@ var AddonInstaller = class AddonInstaller {
 			this.logger.warn(`${packageName} — no backup to rollback to`);
 			return null;
 		}
-		if (!fs.existsSync(entry.lastBackupDir)) {
+		if (!fs$1.existsSync(entry.lastBackupDir)) {
 			this.logger.warn(`${packageName} — backup dir vanished: ${entry.lastBackupDir}`);
 			return null;
 		}
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (fs.existsSync(addonDir)) fs.rmSync(addonDir, {
+		if (fs$1.existsSync(addonDir)) fs$1.rmSync(addonDir, {
 			recursive: true,
 			force: true
 		});
-		fs.renameSync(entry.lastBackupDir, addonDir);
+		fs$1.renameSync(entry.lastBackupDir, addonDir);
 		const pkgJsonPath = path$1.join(addonDir, "package.json");
 		let restoredVersion = entry.version;
-		if (fs.existsSync(pkgJsonPath)) try {
-			const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+		if (fs$1.existsSync(pkgJsonPath)) try {
+			const parsed = JSON.parse(fs$1.readFileSync(pkgJsonPath, "utf-8"));
 			if (typeof parsed === "object" && parsed != null) {
 				const v = parsed.version;
 				if (typeof v === "string" && v.length > 0) restoredVersion = v;
@@ -9419,7 +9430,7 @@ var AddonInstaller = class AddonInstaller {
 			return false;
 		}
 		try {
-			await fs.promises.rm(target, {
+			await fs$1.promises.rm(target, {
 				recursive: true,
 				force: true
 			});
@@ -9437,7 +9448,7 @@ var AddonInstaller = class AddonInstaller {
 	listBackupsFor(packageName) {
 		const dir = path$1.join(this.backupsRoot, packageName);
 		try {
-			return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path$1.join(dir, e.name)).sort();
+			return fs$1.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path$1.join(dir, e.name)).sort();
 		} catch {
 			return [];
 		}
@@ -9469,7 +9480,7 @@ var AddonInstaller = class AddonInstaller {
 		for (const dir of [pkgDir, path$1.dirname(pkgDir)]) {
 			if (!this.isInsideBackups(dir)) continue;
 			try {
-				await fs.promises.rmdir(dir);
+				await fs$1.promises.rmdir(dir);
 			} catch {
 				return;
 			}
@@ -9551,7 +9562,7 @@ var AddonInstaller = class AddonInstaller {
 	*/
 	resolveBackupToKeep(packageName, backups) {
 		const liveDir = path$1.join(this.addonsDir, packageName);
-		if (!fs.existsSync(liveDir)) {
+		if (!fs$1.existsSync(liveDir)) {
 			const newest = backups[backups.length - 1] ?? null;
 			if (newest != null) this.logger.warn(`${packageName} — live install dir missing; retaining its newest backup as the only surviving copy`, { meta: {
 				liveDir,
@@ -9568,7 +9579,7 @@ var AddonInstaller = class AddonInstaller {
 	listBackedUpPackages() {
 		let entries;
 		try {
-			entries = fs.readdirSync(this.backupsRoot, { withFileTypes: true });
+			entries = fs$1.readdirSync(this.backupsRoot, { withFileTypes: true });
 		} catch {
 			return [];
 		}
@@ -9580,14 +9591,14 @@ var AddonInstaller = class AddonInstaller {
 				continue;
 			}
 			const scopeDir = path$1.join(this.backupsRoot, entry.name);
-			for (const inner of fs.readdirSync(scopeDir, { withFileTypes: true })) if (inner.isDirectory()) names.push(`${entry.name}/${inner.name}`);
+			for (const inner of fs$1.readdirSync(scopeDir, { withFileTypes: true })) if (inner.isDirectory()) names.push(`${entry.name}/${inner.name}`);
 		}
 		return names;
 	}
 	async uninstall(packageName) {
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (fs.existsSync(addonDir)) {
-			fs.rmSync(addonDir, {
+		if (fs$1.existsSync(addonDir)) {
+			fs$1.rmSync(addonDir, {
 				recursive: true,
 				force: true
 			});
@@ -9595,8 +9606,8 @@ var AddonInstaller = class AddonInstaller {
 			return;
 		}
 		const legacyDir = path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""));
-		if (fs.existsSync(legacyDir)) {
-			fs.rmSync(legacyDir, {
+		if (fs$1.existsSync(legacyDir)) {
+			fs$1.rmSync(legacyDir, {
 				recursive: true,
 				force: true
 			});
@@ -9604,22 +9615,22 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	listInstalled() {
-		if (!fs.existsSync(this.addonsDir)) return [];
+		if (!fs$1.existsSync(this.addonsDir)) return [];
 		const packageDirs = [];
-		for (const entry of fs.readdirSync(this.addonsDir, { withFileTypes: true })) {
+		for (const entry of fs$1.readdirSync(this.addonsDir, { withFileTypes: true })) {
 			if (!isDirEntry(entry, this.addonsDir)) continue;
 			if (entry.name.startsWith("@")) {
 				const scopeDir = path$1.join(this.addonsDir, entry.name);
-				for (const inner of fs.readdirSync(scopeDir, { withFileTypes: true })) if (isDirEntry(inner, scopeDir)) packageDirs.push(path$1.join(scopeDir, inner.name));
+				for (const inner of fs$1.readdirSync(scopeDir, { withFileTypes: true })) if (isDirEntry(inner, scopeDir)) packageDirs.push(path$1.join(scopeDir, inner.name));
 			} else packageDirs.push(path$1.join(this.addonsDir, entry.name));
 		}
 		return packageDirs.map((dir) => {
 			const pkgPath = path$1.join(dir, "package.json");
-			if (!fs.existsSync(pkgPath)) return null;
+			if (!fs$1.existsSync(pkgPath)) return null;
 			const pkg = readPackageJson(pkgPath);
 			if (!pkg || !pkg.camstackAddons) return null;
 			const sourceFile = path$1.join(dir, ".install-source");
-			const installSource = fs.existsSync(sourceFile) ? parseInstallSource(fs.readFileSync(sourceFile, "utf-8").trim()) : void 0;
+			const installSource = fs$1.existsSync(sourceFile) ? parseInstallSource(fs$1.readFileSync(sourceFile, "utf-8").trim()) : void 0;
 			return {
 				name: pkg.name,
 				version: pkg.version,
@@ -9629,13 +9640,13 @@ var AddonInstaller = class AddonInstaller {
 		}).filter((item) => item !== null);
 	}
 	isInstalled(packageName) {
-		if (fs.existsSync(path$1.join(this.addonsDir, packageName, "package.json"))) return true;
-		return fs.existsSync(path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json"));
+		if (fs$1.existsSync(path$1.join(this.addonsDir, packageName, "package.json"))) return true;
+		return fs$1.existsSync(path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json"));
 	}
 	getInstalledPackage(packageName) {
 		let pkgPath = path$1.join(this.addonsDir, packageName, "package.json");
-		if (!fs.existsSync(pkgPath)) pkgPath = path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json");
-		if (!fs.existsSync(pkgPath)) return null;
+		if (!fs$1.existsSync(pkgPath)) pkgPath = path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json");
+		if (!fs$1.existsSync(pkgPath)) return null;
 		const pkg = readPackageJson(pkgPath);
 		if (!pkg) return null;
 		return {
@@ -9654,7 +9665,7 @@ var AddonInstaller = class AddonInstaller {
 		]) {
 			const candidate = path$1.join(this.workspaceDir, dirName);
 			try {
-				const pkg = asJsonObject$1(parseJsonUnknown(fs.readFileSync(path$1.join(candidate, "package.json"), "utf-8")));
+				const pkg = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(path$1.join(candidate, "package.json"), "utf-8")));
 				if (pkg && asString$1(pkg["name"]) === packageName) return candidate;
 			} catch {}
 		}
@@ -9663,7 +9674,7 @@ var AddonInstaller = class AddonInstaller {
 	/** Ensure a package is built (dist/ exists and page bundles present) */
 	async ensureBuilt(packageName, sourceDir, pkgData) {
 		const distDir = path$1.join(sourceDir, "dist");
-		if (!(!fs.existsSync(distDir) || this.isDistIncomplete(pkgData, sourceDir))) return;
+		if (!(!fs$1.existsSync(distDir) || this.isDistIncomplete(pkgData, sourceDir))) return;
 		this.logger.info(`${packageName} — building (dist/ missing or incomplete)`);
 		try {
 			await runNpm(["run", "build"], this.npmRunOptions(sourceDir, 18e4));
@@ -9678,7 +9689,7 @@ var AddonInstaller = class AddonInstaller {
 		if (!camstack?.addons) return false;
 		for (const addon of camstack.addons) {
 			if (!addon.pages) continue;
-			for (const page of addon.pages) if (page.bundle && !fs.existsSync(path$1.join(sourceDir, "dist", page.bundle))) return true;
+			for (const page of addon.pages) if (page.bundle && !fs$1.existsSync(path$1.join(sourceDir, "dist", page.bundle))) return true;
 		}
 		return false;
 	}
@@ -9687,7 +9698,7 @@ var AddonInstaller = class AddonInstaller {
 function isDirEntry(entry, parentDir) {
 	if (entry.isDirectory()) return true;
 	if (entry.isSymbolicLink()) try {
-		return fs.statSync(path$1.join(parentDir, entry.name)).isDirectory();
+		return fs$1.statSync(path$1.join(parentDir, entry.name)).isDirectory();
 	} catch {
 		return false;
 	}
@@ -9786,7 +9797,7 @@ function selectAddonResidue(candidates) {
 }
 function readDeclaredName(dir) {
 	try {
-		const parsed = JSON.parse(fs.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
+		const parsed = JSON.parse(fs$1.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
 		if (typeof parsed !== "object" || parsed === null) return null;
 		const name = parsed.name;
 		return typeof name === "string" ? name : null;
@@ -9796,7 +9807,7 @@ function readDeclaredName(dir) {
 }
 function readDeclaredVersion(dir) {
 	try {
-		const parsed = JSON.parse(fs.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
+		const parsed = JSON.parse(fs$1.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
 		if (typeof parsed !== "object" || parsed === null) return null;
 		const version = parsed.version;
 		return typeof version === "string" ? version : null;
@@ -9806,7 +9817,7 @@ function readDeclaredVersion(dir) {
 }
 function isDirLike(p) {
 	try {
-		return fs.statSync(p).isDirectory();
+		return fs$1.statSync(p).isDirectory();
 	} catch {
 		return false;
 	}
@@ -9816,7 +9827,7 @@ function freeQuarantineTarget(store, scope, dirName) {
 	const base = scope === null ? dirName : `${scope.replace("@", "")}__${dirName}`;
 	let candidate = path$1.join(store, base);
 	let n = 1;
-	while (fs.existsSync(candidate)) {
+	while (fs$1.existsSync(candidate)) {
 		candidate = path$1.join(store, `${base}-${n}`);
 		n += 1;
 	}
@@ -9833,7 +9844,7 @@ function freeQuarantineTarget(store, scope, dirName) {
 function quarantineAddonResidue(addonsDir, log) {
 	const quarantined = [];
 	const failed = [];
-	if (!fs.existsSync(addonsDir)) return {
+	if (!fs$1.existsSync(addonsDir)) return {
 		quarantined,
 		failed
 	};
@@ -9841,7 +9852,7 @@ function quarantineAddonResidue(addonsDir, log) {
 	const scan = (parent, scope) => {
 		let names;
 		try {
-			names = fs.readdirSync(parent);
+			names = fs$1.readdirSync(parent);
 		} catch {
 			return;
 		}
@@ -9860,8 +9871,8 @@ function quarantineAddonResidue(addonsDir, log) {
 			const version = readDeclaredVersion(full);
 			const to = freeQuarantineTarget(store, scope, dirName);
 			try {
-				fs.mkdirSync(store, { recursive: true });
-				fs.renameSync(full, to);
+				fs$1.mkdirSync(store, { recursive: true });
+				fs$1.renameSync(full, to);
 			} catch (err) {
 				const error = err instanceof Error ? err.message : String(err);
 				failed.push({
@@ -9902,8 +9913,8 @@ function detectWorkspacePackagesDir(startDir) {
 		current = path$1.dirname(current);
 		const packagesDir = path$1.join(current, "packages");
 		const rootPkgJson = path$1.join(current, "package.json");
-		if (fs.existsSync(packagesDir) && fs.existsSync(rootPkgJson)) try {
-			const rootPkg = JSON.parse(fs.readFileSync(rootPkgJson, "utf-8"));
+		if (fs$1.existsSync(packagesDir) && fs$1.existsSync(rootPkgJson)) try {
+			const rootPkg = JSON.parse(fs$1.readFileSync(rootPkgJson, "utf-8"));
 			if (rootPkg.workspaces || rootPkg.name === "camstack-server" || rootPkg.name === "camstack") return packagesDir;
 		} catch {}
 	}
@@ -9942,11 +9953,11 @@ function getRestartMarkerPath(dataDir) {
 * intact or no marker at all (never a half-written file).
 */
 function writePendingRestart(dataDir, marker) {
-	fs.mkdirSync(dataDir, { recursive: true });
+	fs$1.mkdirSync(dataDir, { recursive: true });
 	const markerPath = getRestartMarkerPath(dataDir);
 	const tmpPath = `${markerPath}.tmp`;
-	fs.writeFileSync(tmpPath, JSON.stringify(marker, null, 2), "utf-8");
-	fs.renameSync(tmpPath, markerPath);
+	fs$1.writeFileSync(tmpPath, JSON.stringify(marker, null, 2), "utf-8");
+	fs$1.renameSync(tmpPath, markerPath);
 }
 /**
 * Read + consume the marker. Returns the parsed payload on success and
@@ -9971,10 +9982,10 @@ function writePendingRestart(dataDir, marker) {
 */
 function readPendingRestart(dataDir) {
 	const markerPath = getRestartMarkerPath(dataDir);
-	if (!fs.existsSync(markerPath)) return null;
+	if (!fs$1.existsSync(markerPath)) return null;
 	let raw;
 	try {
-		raw = fs.readFileSync(markerPath, "utf-8");
+		raw = fs$1.readFileSync(markerPath, "utf-8");
 	} catch (err) {
 		console.error("[restart-coordinator] Marker unreadable — leaving in place:", err);
 		return null;
@@ -10013,7 +10024,7 @@ function readPendingRestart(dataDir) {
 /** Remove the marker if present. No-op if missing. */
 function clearPendingRestart(dataDir) {
 	const markerPath = getRestartMarkerPath(dataDir);
-	fs.rmSync(markerPath, { force: true });
+	fs$1.rmSync(markerPath, { force: true });
 }
 function isRestartKind(value) {
 	return value === "framework-update" || value === "manual" || value === "system";
@@ -10025,7 +10036,7 @@ function scheduleSelfRestart(options = {}) {
 		const touchTarget = process.env["CAMSTACK_RESTART_TOUCH_FILE"];
 		if (touchTarget !== void 0 && touchTarget.length > 0) try {
 			const now = /* @__PURE__ */ new Date();
-			fs.utimesSync(touchTarget, now, now);
+			fs$1.utimesSync(touchTarget, now, now);
 			return;
 		} catch (err) {
 			console.error("[restart-coordinator] dev touch-reload failed; falling through to process exit:", err);
@@ -14392,7 +14403,7 @@ function loadBootstrapConfig(configPath) {
 function writeBootstrapSection(configPath, section, data) {
 	if (!BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
 	let raw = {};
-	if (fs.existsSync(configPath)) raw = asJsonObject(load(fs.readFileSync(configPath, "utf-8"))) ?? {};
+	if (fs$1.existsSync(configPath)) raw = asJsonObject(load(fs$1.readFileSync(configPath, "utf-8"))) ?? {};
 	const existing = asJsonObject(raw[section]) ?? {};
 	raw[section] = {
 		...existing,
@@ -14401,12 +14412,12 @@ function writeBootstrapSection(configPath, section, data) {
 	const validation = bootstrapSchema.safeParse(raw);
 	if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
 	const tmpPath = `${configPath}.tmp`;
-	fs.writeFileSync(tmpPath, dump(raw, {
+	fs$1.writeFileSync(tmpPath, dump(raw, {
 		lineWidth: 120,
 		indent: 2,
 		quotingType: "\""
 	}), "utf-8");
-	fs.renameSync(tmpPath, configPath);
+	fs$1.renameSync(tmpPath, configPath);
 	return validation.data;
 }
 /**
@@ -14477,11 +14488,11 @@ function applyEnvOverrides(raw) {
 	return result;
 }
 function loadYaml(configPath) {
-	if (!fs.existsSync(configPath)) {
+	if (!fs$1.existsSync(configPath)) {
 		console.warn(`[ConfigManager] Config file not found at: ${configPath}\n  → Using built-in defaults. Set CONFIG_PATH env var or create the file.\n  → Example path from project root: ./server/backend/data/config.yaml`);
 		return {};
 	}
-	const parsed = load(fs.readFileSync(configPath, "utf-8")) ?? {};
+	const parsed = load(fs$1.readFileSync(configPath, "utf-8")) ?? {};
 	console.log(`[ConfigManager] Loaded config from: ${configPath}`);
 	return parsed;
 }
@@ -22306,7 +22317,7 @@ function buildLinkChain(target, localResolver, hookup) {
 */
 function safeExistsSync(path) {
 	try {
-		return fs.existsSync(path);
+		return fs$1.existsSync(path);
 	} catch {
 		return false;
 	}
@@ -22325,11 +22336,11 @@ function probeLinuxGpus() {
 	if (safeExistsSync("/dev/nvidia0") || safeExistsSync("/proc/driver/nvidia/version")) signals.hasNvidiaGpu = true;
 	try {
 		const drmDir = "/sys/class/drm";
-		if (fs.existsSync(drmDir)) for (const entry of fs.readdirSync(drmDir)) {
+		if (fs$1.existsSync(drmDir)) for (const entry of fs$1.readdirSync(drmDir)) {
 			if (!entry.startsWith("card")) continue;
 			const vendorPath = `${drmDir}/${entry}/device/vendor`;
 			if (!safeExistsSync(vendorPath)) continue;
-			const vendor = fs.readFileSync(vendorPath, "utf8").trim().toLowerCase();
+			const vendor = fs$1.readFileSync(vendorPath, "utf8").trim().toLowerCase();
 			if (vendor === "0x10de") signals.hasNvidiaGpu = true;
 			else if (vendor === "0x1002") signals.hasAmdGpu = true;
 			else if (vendor === "0x8086") signals.hasIntelGpu = true;
@@ -22495,21 +22506,21 @@ function sleep$1(ms) {
 * crashed holder) is stolen.
 */
 async function withFileLock(lockPath, fn) {
-	fs.mkdirSync(join(lockPath, ".."), { recursive: true });
+	fs$1.mkdirSync(join(lockPath, ".."), { recursive: true });
 	for (;;) try {
-		const fd = fs.openSync(lockPath, "wx");
-		fs.closeSync(fd);
+		const fd = fs$1.openSync(lockPath, "wx");
+		fs$1.closeSync(fd);
 		break;
 	} catch {
 		try {
-			if (Date.now() - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs.rmSync(lockPath, { force: true });
+			if (Date.now() - fs$1.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs$1.rmSync(lockPath, { force: true });
 			else await sleep$1(LOCK_POLL_MS);
 		} catch {}
 	}
 	try {
 		return await fn();
 	} finally {
-		fs.rmSync(lockPath, { force: true });
+		fs$1.rmSync(lockPath, { force: true });
 	}
 }
 /** Coalesce in-process + serialize cross-process for one binary id. */
@@ -22556,6 +22567,19 @@ var AddonDepsManager = class {
 		const pythonPath = await this.ensurePython();
 		if (!pythonPath) throw new Error("Cannot install Python requirements: Python is not available");
 		await singleFlight(this.depsDir, "python-pip", () => installPythonRequirements$1(pythonPath, requirementsFile, this.logger));
+		await this.stageNativeDepsDeclaredBy(requirementsFile);
+	}
+	/**
+	* The native library a requirements file says its packages need
+	* (`# camstack-native-dep: edgetpu-delegate`), staged under this node's
+	* deps dir. Runs on every call — not only the first pip install — so a
+	* node whose pip marker predates the line still gets the library. A
+	* platform without a build answers `unavailable` (logged, not thrown); a
+	* failed or tampered download throws, and provisioning reports it.
+	*/
+	async stageNativeDepsDeclaredBy(requirementsFile) {
+		if (!declaresEdgetpuDelegate(fs$1.readFileSync(requirementsFile, "utf8"))) return;
+		await singleFlight(this.depsDir, "edgetpu-delegate", () => ensureEdgetpuDelegate(this.nodeRoot, this.logger));
 	}
 	getDepsDir() {
 		return this.depsDir;
@@ -23738,7 +23762,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 	const addonId = declaration.id;
 	const nodeDataDir = process.env["CAMSTACK_DATA"] ?? dataDir;
 	const addonDataDir = path$1.resolve(nodeDataDir, "addons-data", addonId);
-	fs.mkdirSync(addonDataDir, { recursive: true });
+	fs$1.mkdirSync(addonDataDir, { recursive: true });
 	if (runtime.mode === "broker") ensureBindingSubscription(runtime.broker);
 	const regs = getRegistries(nodeId);
 	const workerResolver = {
@@ -25545,7 +25569,7 @@ function readAddonHeapDeclaration(spec) {
 	if (cached !== void 0) return cached;
 	let declaration = EMPTY_HEAP_DECLARATION;
 	for (const manifestPath of [path$1.join(spec.addonDir, "package.json"), path$1.join(path$1.dirname(spec.addonDir), "package.json")]) try {
-		const raw = fs.readFileSync(manifestPath, "utf8");
+		const raw = fs$1.readFileSync(manifestPath, "utf8");
 		const parsed = JSON.parse(raw);
 		const profile = extractHeapProfile(parsed, spec.addonId);
 		const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
@@ -26679,17 +26703,17 @@ var JobJournal = class {
 		return path$1.join(this.jobsDir, `${id}.json`);
 	}
 	writeAtomic(filePath, data) {
-		fs.mkdirSync(path$1.dirname(filePath), { recursive: true });
+		fs$1.mkdirSync(path$1.dirname(filePath), { recursive: true });
 		const tmp = `${filePath}.tmp.${process.pid}.${Date.now()}`;
-		fs.writeFileSync(tmp, JSON.stringify(data, null, 2), {
+		fs$1.writeFileSync(tmp, JSON.stringify(data, null, 2), {
 			encoding: "utf-8",
 			mode: 384
 		});
-		fs.renameSync(tmp, filePath);
+		fs$1.renameSync(tmp, filePath);
 	}
 	readIndex() {
 		try {
-			const raw = JSON.parse(fs.readFileSync(this.indexPath, "utf-8"));
+			const raw = JSON.parse(fs$1.readFileSync(this.indexPath, "utf-8"));
 			if (raw && Array.isArray(raw.jobIds)) return {
 				version: 1,
 				jobIds: raw.jobIds
@@ -26714,7 +26738,7 @@ var JobJournal = class {
 	}
 	getJob(id) {
 		try {
-			const parsed = lifecycleJobSchema.safeParse(JSON.parse(fs.readFileSync(this.jobPath(id), "utf-8")));
+			const parsed = lifecycleJobSchema.safeParse(JSON.parse(fs$1.readFileSync(this.jobPath(id), "utf-8")));
 			return parsed.success ? parsed.data : null;
 		} catch {
 			return null;
@@ -26779,14 +26803,14 @@ var StagingArea = class {
 	}
 	async fetchAndStage(input) {
 		const destDir = path$1.join(this.stagingDir, input.jobId, safeSegment(input.name));
-		fs.rmSync(destDir, {
+		fs$1.rmSync(destDir, {
 			recursive: true,
 			force: true
 		});
 		const tgz = await this.deps.fetchTarball(input.name, input.version, input.signal);
 		if (input.signal.aborted) throw new Error("staging aborted after fetch");
 		await this.deps.extract(tgz, destDir);
-		const raw = JSON.parse(fs.readFileSync(path$1.join(destDir, "package.json"), "utf-8"));
+		const raw = JSON.parse(fs$1.readFileSync(path$1.join(destDir, "package.json"), "utf-8"));
 		if (typeof raw.version !== "string" || raw.version.length === 0) throw new Error(`staging validation failed: ${input.name} staged a package.json with no version`);
 		if (EXACT_SEMVER.test(input.version) && raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${raw.version}`);
 		return {
@@ -26795,7 +26819,7 @@ var StagingArea = class {
 		};
 	}
 	cleanup(jobId) {
-		fs.rmSync(path$1.join(this.stagingDir, jobId), {
+		fs$1.rmSync(path$1.join(this.stagingDir, jobId), {
 			recursive: true,
 			force: true
 		});
@@ -26810,13 +26834,13 @@ var StagingArea = class {
 	sweepOrphans() {
 		let entries;
 		try {
-			entries = fs.readdirSync(this.stagingDir);
+			entries = fs$1.readdirSync(this.stagingDir);
 		} catch {
 			return 0;
 		}
 		let removed = 0;
 		for (const name of entries) try {
-			fs.rmSync(path$1.join(this.stagingDir, name), {
+			fs$1.rmSync(path$1.join(this.stagingDir, name), {
 				recursive: true,
 				force: true
 			});
@@ -26994,7 +27018,7 @@ var LifecycleJobEngine = class {
 	*   on failure → `failed`.
 	*/
 	async reconcileJob(job) {
-		const exists = this.deps.stagedPathExists ?? ((p) => fs.existsSync(p));
+		const exists = this.deps.stagedPathExists ?? ((p) => fs$1.existsSync(p));
 		for (const task of job.tasks) {
 			if (task.target === "framework") {
 				if (!this.isTerminal(task.phase)) this.skipFrameworkTask(job, task);
@@ -27607,7 +27631,7 @@ var CatalogRegistry = class {
 			const file = path$1.join(packageDir, "i18n", `${lang}.json`);
 			let text;
 			try {
-				text = fs.readFileSync(file, "utf8");
+				text = fs$1.readFileSync(file, "utf8");
 			} catch {
 				continue;
 			}
@@ -27663,4 +27687,4 @@ function resetCatalogRegistryForTests() {
 }
 //#endregion
 var readAllRows = import_read_all_rows.readAllRows;
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_NODE_HISTORY_COLLECTION, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_NODE_HISTORY_COLLECTION, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, RecordsEngine, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };