@camstack/system 1.2.471 → 1.2.473

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $r as errMsg$1, Ar as supportedRuntimes, Cn as isCollectionArrayMethod, Da as EventCategory$1, Dn as isObjectInput, Ea as withoutCallerStamp, Fi as asString$1, J as METHOD_ACCESS_MAP, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Ki as defineRecordKinds, Ni as asJsonObject$1, On as isVoidInput, Pi as asNumber, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Sn as isArrayOutputSchema, Sr as splitTranslationRef, Ta as userError, Ui as createEvent$1, Yi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, ai as DEVICE_STATUS_METHOD, bi as ReadinessRegistry, da as parseJsonObject, er as procedureAuthKey, fa as parseJsonUnknown, fn as extractNestedAddonId, fr as resolveMethodAuth, ga as resolveCapMount, gr as scopesAllowDeviceCap, hr as scopesAllowAddon, ii as DEVICE_SETTINGS_CONTRIBUTION_METHODS, kn as kebabToCamel$1, ma as readinessKey, n as AGENT_MDNS_TXT_KEYS, ni as CALLER_STAMPED_CAPABILITIES$1, qi as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, ri as DATAPLANE_SECRET_HEADER$1, t as AGENT_MDNS_SERVICE_TYPE, u as CATALOG_LANGS, va as scopeKey, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessTimeoutError, yi as RUNTIME_DEFAULTS, zn as looseSchema } from "./dist-5XUG7iYJ.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-URrs1lxK.mjs";
+import { Cn as isCollectionArrayMethod, Cr as splitTranslationRef, Da as withoutCallerStamp, Dn as isObjectInput, Ea as userError, Fi as asNumber, Ii as asString$1, J as METHOD_ACCESS_MAP, Ji as emitDownForOwnedCaps, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Oa as EventCategory$1, On as isVoidInput, Pi as asJsonObject$1, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessTimeoutError, Sn as isArrayOutputSchema, Wi as createEvent$1, Xi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, _a as resolveCapMount, _r as scopesAllowDeviceCap, ai as DEVICE_SETTINGS_CONTRIBUTION_METHODS, bi as RUNTIME_DEFAULTS, ei as errMsg$1, fa as parseJsonObject, fn as extractNestedAddonId, gr as scopesAllowAddon, ha as readinessKey, ii as DATAPLANE_SECRET_HEADER$1, jr as supportedRuntimes, kn as kebabToCamel$1, n as AGENT_MDNS_TXT_KEYS, oi as DEVICE_STATUS_METHOD, pa as parseJsonUnknown, pr as resolveMethodAuth, qi as defineRecordKinds, r as ALL_CAPABILITY_DEFINITIONS, ri as CALLER_STAMPED_CAPABILITIES$1, t as AGENT_MDNS_SERVICE_TYPE, tr as procedureAuthKey, u as CATALOG_LANGS, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessRegistry, ya as scopeKey, zn as looseSchema } from "./dist-C9lbdBL5.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DyUtcpf4.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
@@ -25,22 +25,22 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-Bl2I-ZcR.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-BuB731DK.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-DHBvFZJS.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-5lA8Z9d8.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-DOwn4pqL.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-p5mPM1iL.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BGYDjTqY.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-zD3JojB_.mjs";
+import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-BemeCNGe.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CN1pJTRn.mjs";
-import { r as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-BW3OcrLD.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-C0aohmAK.mjs";
+import { r as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-DBlgWB8k.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -48,14 +48,14 @@ import { PYTHON_VERSION, buildBinaryPath, declaresEdgetpuDelegate, downloadBinar
 import { connect, createConnection, createServer } from "node:net";
 import { mkdir, rm, stat, unlink } from "node:fs/promises";
 import * as path$1 from "node:path";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import * as util from "node:util";
 import { promisify } from "node:util";
 import * as os$1 from "node:os";
 import { tmpdir } from "node:os";
 import { pathToFileURL } from "node:url";
 import { BOOT_RECOVERY_BACKOFF_MS, CALLER_STAMPED_CAPABILITIES, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, ErrorI18nPayloadSchema, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, addonSliceHandleApi, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createRecordsAccess, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readErrorI18n, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
-import * as fs from "node:fs";
+import * as fs$1 from "node:fs";
 import { accessSync, constants, createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
 import { once } from "node:events";
@@ -5029,7 +5029,7 @@ var PythonEnvManager = class {
 	async ensure(options) {
 		const probe = await this.probe();
 		if (!probe.available || !probe.path) throw userError("system.python-required", void 0, "Python 3.10+ is required but not found on this system");
-		if (!fs.existsSync(path$1.join(this.venvPath, "bin", "python"))) await execFileAsync$7(probe.path, [
+		if (!fs$1.existsSync(path$1.join(this.venvPath, "bin", "python"))) await execFileAsync$7(probe.path, [
 			"-m",
 			"venv",
 			this.venvPath
@@ -5052,7 +5052,7 @@ var PythonEnvManager = class {
 	}
 	spawn(script, args) {
 		const venvPython = path$1.join(this.venvPath, "bin", "python");
-		if (!fs.existsSync(venvPython)) throw new Error("Python venv not initialized. Call ensure() first.");
+		if (!fs$1.existsSync(venvPython)) throw new Error("Python venv not initialized. Call ensure() first.");
 		return spawn(venvPython, [script, ...args]);
 	}
 };
@@ -5404,20 +5404,20 @@ var StorageManager = class {
 				const basePath = this.locationManager.getBackend(mappedName).basePath;
 				location.files = {
 					async readFile(p) {
-						return fs.promises.readFile(path$1.join(basePath, p));
+						return fs$1.promises.readFile(path$1.join(basePath, p));
 					},
 					async writeFile(p, data) {
 						const full = path$1.join(basePath, p);
-						await fs.promises.mkdir(path$1.dirname(full), { recursive: true });
-						await fs.promises.writeFile(full, data);
+						await fs$1.promises.mkdir(path$1.dirname(full), { recursive: true });
+						await fs$1.promises.writeFile(full, data);
 					},
 					async deleteFile(p) {
-						await fs.promises.rm(path$1.join(basePath, p), { force: true });
+						await fs$1.promises.rm(path$1.join(basePath, p), { force: true });
 					},
 					async listFiles(prefix) {
 						const dir = prefix ? path$1.join(basePath, prefix) : basePath;
 						try {
-							return (await fs.promises.readdir(dir)).map((f) => prefix ? `${prefix}/${f}` : f);
+							return (await fs$1.promises.readdir(dir)).map((f) => prefix ? `${prefix}/${f}` : f);
 						} catch {
 							return [];
 						}
@@ -5427,7 +5427,7 @@ var StorageManager = class {
 					},
 					async exists(p) {
 						try {
-							await fs.promises.access(path$1.join(basePath, p));
+							await fs$1.promises.access(path$1.join(basePath, p));
 							return true;
 						} catch {
 							return false;
@@ -6169,7 +6169,7 @@ var TRADITIONAL_NATIVE_PACKAGES = ["better-sqlite3"];
 function hasDotNode(dir, maxDepth) {
 	let entries;
 	try {
-		entries = fs.readdirSync(dir, { withFileTypes: true });
+		entries = fs$1.readdirSync(dir, { withFileTypes: true });
 	} catch {
 		return false;
 	}
@@ -6180,7 +6180,7 @@ function hasDotNode(dir, maxDepth) {
 }
 /** Locate the bundled `prebuild-install` bin.js inside the staged closure. */
 function resolvePrebuildInstallBin(closureDir, moduleDir) {
-	return [path$1.join(moduleDir, "node_modules", "prebuild-install", "bin.js"), path$1.join(closureDir, "node_modules", "prebuild-install", "bin.js")].find((c) => fs.existsSync(c)) ?? null;
+	return [path$1.join(moduleDir, "node_modules", "prebuild-install", "bin.js"), path$1.join(closureDir, "node_modules", "prebuild-install", "bin.js")].find((c) => fs$1.existsSync(c)) ?? null;
 }
 /**
 * Default fetcher: run the closure's own `prebuild-install` under the CURRENT
@@ -6233,7 +6233,7 @@ async function ensureNativePrebuilds(closureDir, options) {
 	const fetched = [];
 	for (const pkg of packages) {
 		const moduleDir = path$1.join(nm, pkg);
-		if (!fs.existsSync(moduleDir)) continue;
+		if (!fs$1.existsSync(moduleDir)) continue;
 		if (hasDotNode(moduleDir, 4)) continue;
 		options.logger.warn("staged closure native prebuild missing — fetching for running ABI", { meta: {
 			pkg,
@@ -6296,12 +6296,12 @@ async function ensureNativePrebuilds(closureDir, options) {
 function replantFromBundled(srcModuleDir, dstModuleDir, hasNative) {
 	if (!hasNative(srcModuleDir)) return false;
 	try {
-		fs.rmSync(dstModuleDir, {
+		fs$1.rmSync(dstModuleDir, {
 			recursive: true,
 			force: true
 		});
-		fs.mkdirSync(path$1.dirname(dstModuleDir), { recursive: true });
-		fs.cpSync(srcModuleDir, dstModuleDir, {
+		fs$1.mkdirSync(path$1.dirname(dstModuleDir), { recursive: true });
+		fs$1.cpSync(srcModuleDir, dstModuleDir, {
 			recursive: true,
 			dereference: true
 		});
@@ -6330,7 +6330,7 @@ async function ensureAddonNativePrebuilds(addonDir, options) {
 	const missing = [];
 	for (const pkg of packages) {
 		const moduleDir = path$1.join(nm, pkg);
-		if (!fs.existsSync(moduleDir)) continue;
+		if (!fs$1.existsSync(moduleDir)) continue;
 		if (hasNative(moduleDir)) {
 			results.push({
 				pkg,
@@ -6429,7 +6429,7 @@ async function defaultDownloadTarball(url, destTgz) {
 	const res = await fetch(url);
 	if (!res.ok || !res.body) throw new Error(`HTTP ${res.status} downloading ${url}`);
 	const bytes = Buffer.from(await res.arrayBuffer());
-	await fs.promises.writeFile(destTgz, bytes);
+	await fs$1.promises.writeFile(destTgz, bytes);
 }
 async function defaultExtractTarball(tgzPath, destDir) {
 	await execFileAsync$5("tar", [
@@ -6515,7 +6515,7 @@ async function resolveUncached(options) {
 		argsPrefix: []
 	};
 	const cliPath = bootstrappedCliPath(options.cacheDir);
-	if (fs.existsSync(cliPath)) {
+	if (fs$1.existsSync(cliPath)) {
 		options.logger.info("system npm unavailable — using bootstrapped npm", { meta: { cliPath } });
 		return {
 			command: process.execPath,
@@ -6527,12 +6527,12 @@ async function resolveUncached(options) {
 		const registry = (options.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, "");
 		const tarballUrl = tarballUrlOf(await (options.fetchJson ?? defaultFetchJson)(`${registry}/npm/latest`));
 		if (!tarballUrl) throw new Error(`registry metadata for 'npm' carries no dist.tarball (${registry})`);
-		await fs.promises.mkdir(options.cacheDir, { recursive: true });
+		await fs$1.promises.mkdir(options.cacheDir, { recursive: true });
 		const tgzPath = path$1.join(options.cacheDir, "npm-bootstrap.tgz");
 		await (options.downloadTarball ?? defaultDownloadTarball)(tarballUrl, tgzPath);
 		await (options.extractTarball ?? defaultExtractTarball)(tgzPath, options.cacheDir);
-		await fs.promises.rm(tgzPath, { force: true });
-		if (!fs.existsSync(cliPath)) throw new Error(`extracted npm tarball is missing ${cliPath}`);
+		await fs$1.promises.rm(tgzPath, { force: true });
+		if (!fs$1.existsSync(cliPath)) throw new Error(`extracted npm tarball is missing ${cliPath}`);
 		options.logger.info("npm bootstrapped", { meta: { cliPath } });
 		return {
 			command: process.execPath,
@@ -6598,7 +6598,7 @@ function readOwningPackageVersion(entryPath) {
 	let dir = path$1.dirname(entryPath);
 	for (let hop = 0; hop < PACKAGE_JSON_LOOKUP_DEPTH; hop++) {
 		try {
-			const version = asJsonObject$1(parseJsonUnknown(fs.readFileSync(path$1.join(dir, "package.json"), "utf-8")))?.["version"];
+			const version = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(path$1.join(dir, "package.json"), "utf-8")))?.["version"];
 			if (typeof version === "string" && version.length > 0) return version;
 		} catch {}
 		const parent = path$1.dirname(dir);
@@ -6642,14 +6642,14 @@ function readOwningPackageVersion(entryPath) {
 function addonModuleCacheKey(entryPath) {
 	let stat;
 	try {
-		stat = fs.statSync(entryPath);
+		stat = fs$1.statSync(entryPath);
 	} catch {
 		return null;
 	}
 	const version = readOwningPackageVersion(entryPath) ?? `m${stat.mtimeMs}`;
 	let content;
 	try {
-		content = createHash("sha1").update(fs.readFileSync(entryPath)).digest("hex").slice(0, 16);
+		content = createHash("sha1").update(fs$1.readFileSync(entryPath)).digest("hex").slice(0, 16);
 	} catch {
 		content = `m${stat.mtimeMs}s${stat.size}`;
 	}
@@ -6753,14 +6753,14 @@ var AddonLoader = class {
 	*  BUILTINS from the active closure, not the (now-inert) addons-dir copy, so
 	*  the addons-dir `@camstack/system` must NOT be double-loaded here. */
 	async loadFromDirectory(addonsDir, skipPackages = []) {
-		if (!fs.existsSync(addonsDir)) return;
+		if (!fs$1.existsSync(addonsDir)) return;
 		const skip = new Set(skipPackages);
-		const entries = fs.readdirSync(addonsDir, { withFileTypes: true });
+		const entries = fs$1.readdirSync(addonsDir, { withFileTypes: true });
 		for (const entry of entries) {
 			if (!isDirectoryEntry(entry, addonsDir)) continue;
 			if (entry.name.startsWith("@")) {
 				const scopeDir = path$1.join(addonsDir, entry.name);
-				const scopeEntries = fs.readdirSync(scopeDir, { withFileTypes: true });
+				const scopeEntries = fs$1.readdirSync(scopeDir, { withFileTypes: true });
 				for (const scopeEntry of scopeEntries) {
 					if (!isDirectoryEntry(scopeEntry, scopeDir)) continue;
 					if (skip.has(`${entry.name}/${scopeEntry.name}`)) continue;
@@ -6774,7 +6774,7 @@ var AddonLoader = class {
 	}
 	async tryLoadAddon(addonDir) {
 		const pkgJsonPath = path$1.join(addonDir, "package.json");
-		if (!fs.existsSync(pkgJsonPath)) return;
+		if (!fs$1.existsSync(pkgJsonPath)) return;
 		try {
 			await this.loadFromAddonDir(addonDir);
 		} catch (err) {
@@ -6792,7 +6792,7 @@ var AddonLoader = class {
 	/** Load addon from a specific directory (package.json + dist/) */
 	async loadFromAddonDir(addonDir) {
 		const pkgJsonPath = path$1.join(addonDir, "package.json");
-		const pkgJson = asJsonObject$1(parseJsonUnknown(fs.readFileSync(pkgJsonPath, "utf-8"))) ?? {};
+		const pkgJson = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(pkgJsonPath, "utf-8"))) ?? {};
 		const packageNameRaw = pkgJson["name"];
 		const packageName = typeof packageNameRaw === "string" ? packageNameRaw : "";
 		const packageVersionRaw = pkgJson["version"];
@@ -6839,7 +6839,7 @@ var AddonLoader = class {
 		}
 		const entryFile = declaration.entry.replace(/^\.\//, "").replace(/^src\//, "dist/").replace(/\.ts$/, ".js");
 		let entryPath = path$1.resolve(addonDir, entryFile);
-		if (!fs.existsSync(entryPath)) {
+		if (!fs$1.existsSync(entryPath)) {
 			const base = entryPath.replace(/\.(js|cjs|mjs)$/, "");
 			entryPath = [
 				`${base}.cjs`,
@@ -6848,9 +6848,9 @@ var AddonLoader = class {
 				path$1.resolve(addonDir, "dist", "index.cjs"),
 				path$1.resolve(addonDir, "dist", "index.mjs"),
 				path$1.resolve(addonDir, declaration.entry)
-			].find((p) => fs.existsSync(p)) ?? entryPath;
+			].find((p) => fs$1.existsSync(p)) ?? entryPath;
 		}
-		if (!fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
+		if (!fs$1.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
 		const mod = isRecord$4(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
@@ -6935,7 +6935,7 @@ function isDirectoryEntry(entry, parentDir) {
 	if (entry.name.startsWith(".")) return false;
 	if (entry.isDirectory()) return true;
 	if (entry.isSymbolicLink()) try {
-		return fs.statSync(path$1.join(parentDir, entry.name)).isDirectory();
+		return fs$1.statSync(path$1.join(parentDir, entry.name)).isDirectory();
 	} catch {
 		return false;
 	}
@@ -7029,7 +7029,7 @@ var execFileAsync$4 = promisify(execFile);
 * Single source of truth — replaces scattered mkdirSync calls.
 */
 function ensureDir(dirPath) {
-	fs.mkdirSync(dirPath, { recursive: true });
+	fs$1.mkdirSync(dirPath, { recursive: true });
 }
 /**
 * Copy a directory recursively — ASYNC so it never blocks the event loop.
@@ -7042,7 +7042,7 @@ function ensureDir(dirPath) {
 * `fs.promises.cp` keeps the I/O off the event loop. (Node ≥18 stable.)
 */
 async function copyDirRecursive(src, dest) {
-	await fs.promises.cp(src, dest, {
+	await fs$1.promises.cp(src, dest, {
 		recursive: true,
 		force: true
 	});
@@ -7147,13 +7147,13 @@ async function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 		if (typeof fileEntry !== "string") continue;
 		if (fileEntry === "dist" || fileEntry.includes("*")) continue;
 		const srcPath = path$1.join(sourceDir, fileEntry);
-		if (!fs.existsSync(srcPath)) continue;
+		if (!fs$1.existsSync(srcPath)) continue;
 		const destPath = path$1.join(destDir, fileEntry);
-		const stat = await fs.promises.stat(srcPath);
+		const stat = await fs$1.promises.stat(srcPath);
 		if (stat.isDirectory()) await copyDirRecursive(srcPath, destPath);
 		else if (stat.isFile()) {
 			ensureDir(path$1.dirname(destPath));
-			await fs.promises.copyFile(srcPath, destPath);
+			await fs$1.promises.copyFile(srcPath, destPath);
 		}
 	}
 }
@@ -7164,10 +7164,10 @@ async function copyExtraFileDirs(pkgJson, sourceDir, destDir) {
 function isSourceNewer(packageDir) {
 	const srcDir = path$1.join(packageDir, "src");
 	const distDir = path$1.join(packageDir, "dist");
-	if (!fs.existsSync(srcDir) || !fs.existsSync(distDir)) return true;
+	if (!fs$1.existsSync(srcDir) || !fs$1.existsSync(distDir)) return true;
 	try {
-		const distMtime = fs.statSync(distDir).mtimeMs;
-		const entries = fs.readdirSync(srcDir, {
+		const distMtime = fs$1.statSync(distDir).mtimeMs;
+		const entries = fs$1.readdirSync(srcDir, {
 			withFileTypes: true,
 			recursive: true
 		});
@@ -7175,7 +7175,7 @@ function isSourceNewer(packageDir) {
 			if (!entry.isFile()) continue;
 			const parentDir = entry.parentPath ?? String(Reflect.get(entry, "path") ?? "");
 			const filePath = path$1.join(parentDir, entry.name);
-			if (fs.statSync(filePath).mtimeMs > distMtime) return true;
+			if (fs$1.statSync(filePath).mtimeMs > distMtime) return true;
 		}
 		return false;
 	} catch {
@@ -7190,9 +7190,9 @@ function isSourceNewer(packageDir) {
 function ensureLibraryBuilt(packageName, packagesDir) {
 	const dirName = packageName.replace("@camstack/", "");
 	const sourceDir = path$1.join(packagesDir, dirName);
-	if (!fs.existsSync(sourceDir)) return;
+	if (!fs$1.existsSync(sourceDir)) return;
 	const distDir = path$1.join(sourceDir, "dist");
-	if (fs.existsSync(path$1.join(distDir, "index.js")) || fs.existsSync(path$1.join(distDir, "index.mjs"))) return;
+	if (fs$1.existsSync(path$1.join(distDir, "index.js")) || fs$1.existsSync(path$1.join(distDir, "index.mjs"))) return;
 	console.warn(`[ensureLibraryBuilt] ${packageName} has no dist/ — run 'npm run build' first`);
 }
 /**
@@ -7205,7 +7205,7 @@ function ensureLibraryBuilt(packageName, packagesDir) {
 * `copyDirRecursive` for the wedge this prevents.
 */
 async function installPackageFromNpm(packageName, targetDir) {
-	const tmpDir = await fs.promises.mkdtemp(path$1.join(os$1.tmpdir(), "camstack-install-"));
+	const tmpDir = await fs$1.promises.mkdtemp(path$1.join(os$1.tmpdir(), "camstack-install-"));
 	try {
 		const { stdout } = await execFileAsync$4("npm", [
 			"pack",
@@ -7228,21 +7228,21 @@ async function installPackageFromNpm(packageName, targetDir) {
 			extractDir
 		], { timeout: 3e4 });
 		const packageSubDir = path$1.join(extractDir, "package");
-		const srcPkgJsonDir = fs.existsSync(path$1.join(packageSubDir, "package.json")) ? packageSubDir : extractDir;
-		await fs.promises.rm(targetDir, {
+		const srcPkgJsonDir = fs$1.existsSync(path$1.join(packageSubDir, "package.json")) ? packageSubDir : extractDir;
+		await fs$1.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		await fs.promises.copyFile(path$1.join(srcPkgJsonDir, "package.json"), path$1.join(targetDir, "package.json"));
+		await fs$1.promises.copyFile(path$1.join(srcPkgJsonDir, "package.json"), path$1.join(targetDir, "package.json"));
 		const distSrc = path$1.join(srcPkgJsonDir, "dist");
-		if (fs.existsSync(distSrc)) await copyDirRecursive(distSrc, path$1.join(targetDir, "dist"));
+		if (fs$1.existsSync(distSrc)) await copyDirRecursive(distSrc, path$1.join(targetDir, "dist"));
 		try {
-			const npmPkg = asJsonObject$1(parseJsonUnknown(await fs.promises.readFile(path$1.join(srcPkgJsonDir, "package.json"), "utf-8")));
+			const npmPkg = asJsonObject$1(parseJsonUnknown(await fs$1.promises.readFile(path$1.join(srcPkgJsonDir, "package.json"), "utf-8")));
 			if (npmPkg) await copyExtraFileDirs(npmPkg, srcPkgJsonDir, targetDir);
 		} catch {}
 	} finally {
-		await fs.promises.rm(tmpDir, {
+		await fs$1.promises.rm(tmpDir, {
 			recursive: true,
 			force: true
 		});
@@ -7267,7 +7267,7 @@ function packageDirName$1(declaredName) {
 }
 function isDirLike$1(p) {
 	try {
-		return fs.statSync(p).isDirectory();
+		return fs$1.statSync(p).isDirectory();
 	} catch {
 		return false;
 	}
@@ -7285,12 +7285,12 @@ var AddonManifest = class {
 	*/
 	read() {
 		if (this.cache != null) return this.cache;
-		if (!fs.existsSync(this.manifestPath)) {
+		if (!fs$1.existsSync(this.manifestPath)) {
 			this.cache = this.empty();
 			return this.cache;
 		}
 		try {
-			const raw = fs.readFileSync(this.manifestPath, "utf-8");
+			const raw = fs$1.readFileSync(this.manifestPath, "utf-8");
 			const parsed = JSON.parse(raw);
 			if (parsed.version !== MANIFEST_VERSION) {
 				process.stderr.write(`[AddonManifest] schema mismatch (file=${parsed.version} vs runtime=${MANIFEST_VERSION}); starting empty\n`);
@@ -7311,13 +7311,13 @@ var AddonManifest = class {
 	* a half-written file.
 	*/
 	write(manifest) {
-		fs.mkdirSync(path$1.dirname(this.manifestPath), { recursive: true });
+		fs$1.mkdirSync(path$1.dirname(this.manifestPath), { recursive: true });
 		const tmp = `${this.manifestPath}.tmp.${process.pid}.${Date.now()}`;
-		fs.writeFileSync(tmp, JSON.stringify(manifest, null, 2), {
+		fs$1.writeFileSync(tmp, JSON.stringify(manifest, null, 2), {
 			encoding: "utf-8",
 			mode: 384
 		});
-		fs.renameSync(tmp, this.manifestPath);
+		fs$1.renameSync(tmp, this.manifestPath);
 		this.cache = manifest;
 	}
 	/** Lookup a single addon's manifest entry, or `null` if not tracked. */
@@ -7392,22 +7392,22 @@ var AddonManifest = class {
 	* exactly what moved. Returns the total number of changes.
 	*/
 	reconcileFromDisk(addonsDir, onChange) {
-		if (!fs.existsSync(addonsDir)) return 0;
+		if (!fs$1.existsSync(addonsDir)) return 0;
 		const m = this.read();
 		let changes = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		/** Package name → version, for every ADDON package actually installed. */
 		const onDisk = /* @__PURE__ */ new Map();
-		for (const scope of fs.readdirSync(addonsDir, { withFileTypes: true })) {
+		for (const scope of fs$1.readdirSync(addonsDir, { withFileTypes: true })) {
 			if (!scope.name.startsWith("@") || !isDirLike$1(path$1.join(addonsDir, scope.name))) continue;
 			const scopeDir = path$1.join(addonsDir, scope.name);
-			for (const pkg of fs.readdirSync(scopeDir, { withFileTypes: true })) {
+			for (const pkg of fs$1.readdirSync(scopeDir, { withFileTypes: true })) {
 				if (!isDirLike$1(path$1.join(scopeDir, pkg.name))) continue;
 				const pkgJsonPath = path$1.join(scopeDir, pkg.name, "package.json");
-				if (!fs.existsSync(pkgJsonPath)) continue;
+				if (!fs$1.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
 				try {
-					const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+					const parsed = JSON.parse(fs$1.readFileSync(pkgJsonPath, "utf-8"));
 					if (typeof parsed !== "object" || parsed == null) continue;
 					pkgJson = parsed;
 				} catch {
@@ -7478,28 +7478,28 @@ var AddonManifest = class {
 	migrateFromInstallSourceMarkers(addonsDir) {
 		const m = this.read();
 		if (Object.keys(m.addons).length > 0) return 0;
-		if (!fs.existsSync(addonsDir)) return 0;
+		if (!fs$1.existsSync(addonsDir)) return 0;
 		let migrated = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		for (const scope of fs.readdirSync(addonsDir, { withFileTypes: true })) {
+		for (const scope of fs$1.readdirSync(addonsDir, { withFileTypes: true })) {
 			if (!scope.isDirectory() || !scope.name.startsWith("@")) continue;
 			const scopeDir = path$1.join(addonsDir, scope.name);
-			for (const pkg of fs.readdirSync(scopeDir, { withFileTypes: true })) {
+			for (const pkg of fs$1.readdirSync(scopeDir, { withFileTypes: true })) {
 				if (!pkg.isDirectory()) continue;
 				const pkgDir = path$1.join(scopeDir, pkg.name);
 				const markerPath = path$1.join(pkgDir, ".install-source");
 				const pkgJsonPath = path$1.join(pkgDir, "package.json");
-				if (!fs.existsSync(pkgJsonPath)) continue;
+				if (!fs$1.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
 				try {
-					const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+					const parsed = JSON.parse(fs$1.readFileSync(pkgJsonPath, "utf-8"));
 					if (typeof parsed !== "object" || parsed == null) continue;
 					pkgJson = parsed;
 				} catch {
 					continue;
 				}
 				if (!pkgJson.name || !pkgJson.version) continue;
-				const source = fs.existsSync(markerPath) ? fs.readFileSync(markerPath, "utf-8").trim() : "bundled";
+				const source = fs$1.existsSync(markerPath) ? fs$1.readFileSync(markerPath, "utf-8").trim() : "bundled";
 				m.addons[pkgJson.name] = {
 					name: pkgJson.name,
 					version: pkgJson.version,
@@ -7676,7 +7676,7 @@ function planClosureDedupe(input) {
 function readTreeManifest(pkgJsonPath) {
 	let raw;
 	try {
-		raw = asJsonObject$1(parseJsonUnknown(fs.readFileSync(pkgJsonPath, "utf-8")));
+		raw = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(pkgJsonPath, "utf-8")));
 	} catch {
 		return null;
 	}
@@ -7701,7 +7701,7 @@ function readTreeManifest(pkgJsonPath) {
 function listTopLevelEntries(nodeModulesDir) {
 	let entries;
 	try {
-		entries = fs.readdirSync(nodeModulesDir, { withFileTypes: true });
+		entries = fs$1.readdirSync(nodeModulesDir, { withFileTypes: true });
 	} catch {
 		return [];
 	}
@@ -7711,7 +7711,7 @@ function listTopLevelEntries(nodeModulesDir) {
 		if (entry.name.startsWith("@")) {
 			let inner;
 			try {
-				inner = fs.readdirSync(path$1.join(nodeModulesDir, entry.name), { withFileTypes: true });
+				inner = fs$1.readdirSync(path$1.join(nodeModulesDir, entry.name), { withFileTypes: true });
 			} catch {
 				continue;
 			}
@@ -7744,14 +7744,14 @@ function collectAddonTreeState(addonDir) {
 		const entryDir = path$1.join(nodeModulesDir, name);
 		let isLink = false;
 		try {
-			isLink = fs.lstatSync(entryDir).isSymbolicLink();
+			isLink = fs$1.lstatSync(entryDir).isSymbolicLink();
 		} catch {
 			continue;
 		}
 		if (isLink) {
 			let target = "";
 			try {
-				target = fs.readlinkSync(entryDir);
+				target = fs$1.readlinkSync(entryDir);
 			} catch {}
 			existingLinks.push({
 				name,
@@ -7765,7 +7765,7 @@ function collectAddonTreeState(addonDir) {
 			version: manifest.version
 		});
 		for (const [depName, range] of manifest.ranges) {
-			if (fs.existsSync(path$1.join(entryDir, "node_modules", depName))) continue;
+			if (fs$1.existsSync(path$1.join(entryDir, "node_modules", depName))) continue;
 			addRange(depName, range);
 		}
 	}
@@ -7795,7 +7795,7 @@ function resolveClosureNodeModulesDir(explicitDir) {
 	const frameworkDir = explicitDir ?? process.env["CAMSTACK_FRAMEWORK_DIR"];
 	if (frameworkDir === void 0 || frameworkDir.length === 0) return null;
 	const nodeModulesDir = explicitDir ?? path$1.join(frameworkDir, "node_modules");
-	return fs.existsSync(nodeModulesDir) ? nodeModulesDir : null;
+	return fs$1.existsSync(nodeModulesDir) ? nodeModulesDir : null;
 }
 function symlinkType() {
 	return process.platform === "win32" ? "junction" : "dir";
@@ -7814,10 +7814,10 @@ function executeClosureDedupe(addonDir, closureNodeModulesDir, plan, logger) {
 	const nodeModulesDir = path$1.join(addonDir, "node_modules");
 	const probePath = path$1.join(nodeModulesDir, ".closure-link-probe");
 	try {
-		fs.mkdirSync(nodeModulesDir, { recursive: true });
-		fs.rmSync(probePath, { force: true });
-		fs.symlinkSync(closureNodeModulesDir, probePath, symlinkType());
-		fs.rmSync(probePath, { force: true });
+		fs$1.mkdirSync(nodeModulesDir, { recursive: true });
+		fs$1.rmSync(probePath, { force: true });
+		fs$1.symlinkSync(closureNodeModulesDir, probePath, symlinkType());
+		fs$1.rmSync(probePath, { force: true });
 	} catch (err) {
 		logger.warn("closure dedupe skipped — symlinks unavailable on this volume", { meta: {
 			addonDir,
@@ -7839,12 +7839,12 @@ function executeClosureDedupe(addonDir, closureNodeModulesDir, plan, logger) {
 		}
 		const entryDir = path$1.join(nodeModulesDir, link.name);
 		try {
-			fs.rmSync(entryDir, {
+			fs$1.rmSync(entryDir, {
 				recursive: true,
 				force: true
 			});
-			fs.mkdirSync(path$1.dirname(entryDir), { recursive: true });
-			fs.symlinkSync(target, entryDir, symlinkType());
+			fs$1.mkdirSync(path$1.dirname(entryDir), { recursive: true });
+			fs$1.symlinkSync(target, entryDir, symlinkType());
 			linked.push(link.name);
 		} catch (err) {
 			logger.warn("closure dedupe — link failed; entry removed copy may need reinstall", { meta: {
@@ -7920,7 +7920,7 @@ async function installManifestNativeDeps(addonDir, pkgRaw, logger, registry, npm
 			count: Object.keys(native).length
 		} });
 		try {
-			fs.writeFileSync(markerFile, markerHash);
+			fs$1.writeFileSync(markerFile, markerHash);
 		} catch (err) {
 			logger.warn("Failed to write native deps marker", { meta: {
 				markerFile,
@@ -7958,7 +7958,7 @@ async function installManifestNativeDeps(addonDir, pkgRaw, logger, registry, npm
 	}
 	await rebuildNativeDeps(addonDir, pending.map(([name]) => name), logger, npmCacheDir ?? defaultNpmCacheDir(), registry);
 	try {
-		fs.writeFileSync(markerFile, markerHash);
+		fs$1.writeFileSync(markerFile, markerHash);
 	} catch (err) {
 		logger.warn("Failed to write native deps marker", { meta: {
 			markerFile,
@@ -7980,12 +7980,12 @@ function copyPrebuiltNativeDep(name, addonDir, logger) {
 		if (source === target) continue;
 		if (!hasBuiltBinary(source)) continue;
 		try {
-			fs.rmSync(target, {
+			fs$1.rmSync(target, {
 				recursive: true,
 				force: true
 			});
-			fs.mkdirSync(path$1.dirname(target), { recursive: true });
-			fs.cpSync(source, target, {
+			fs$1.mkdirSync(path$1.dirname(target), { recursive: true });
+			fs$1.cpSync(source, target, {
 				recursive: true,
 				dereference: true
 			});
@@ -8021,7 +8021,7 @@ var BUNDLED_NATIVE_SIBLING_SCOPES = {
 function hasAnyDotNode(dir, maxDepth) {
 	let entries;
 	try {
-		entries = fs.readdirSync(dir, { withFileTypes: true });
+		entries = fs$1.readdirSync(dir, { withFileTypes: true });
 	} catch {
 		return false;
 	}
@@ -8035,12 +8035,12 @@ function copyPrebuiltModuleDir(src, dst, label, logger) {
 	if (!hasAnyDotNode(src, 5)) return;
 	if (hasAnyDotNode(dst, 5)) return;
 	try {
-		fs.rmSync(dst, {
+		fs$1.rmSync(dst, {
 			recursive: true,
 			force: true
 		});
-		fs.mkdirSync(path$1.dirname(dst), { recursive: true });
-		fs.cpSync(src, dst, {
+		fs$1.mkdirSync(path$1.dirname(dst), { recursive: true });
+		fs$1.cpSync(src, dst, {
 			recursive: true,
 			dereference: true
 		});
@@ -8075,7 +8075,7 @@ function copyPrebuiltModuleDir(src, dst, label, logger) {
 */
 function copyBundledNativeModules(sourceDir, targetDir, logger) {
 	const srcNm = path$1.join(sourceDir, "node_modules");
-	if (!fs.existsSync(srcNm)) return;
+	if (!fs$1.existsSync(srcNm)) return;
 	const dstNm = path$1.join(targetDir, "node_modules");
 	for (const [name, scopes] of Object.entries(BUNDLED_NATIVE_SIBLING_SCOPES)) {
 		copyPrebuiltModuleDir(path$1.join(srcNm, name), path$1.join(dstNm, name), name, logger);
@@ -8083,7 +8083,7 @@ function copyBundledNativeModules(sourceDir, targetDir, logger) {
 			const scopeSrc = path$1.join(srcNm, scope);
 			let siblings;
 			try {
-				siblings = fs.readdirSync(scopeSrc);
+				siblings = fs$1.readdirSync(scopeSrc);
 			} catch {
 				continue;
 			}
@@ -8093,12 +8093,12 @@ function copyBundledNativeModules(sourceDir, targetDir, logger) {
 }
 /** A package dir is "built" when it carries a compiled `.node` or a prebuilds tree. */
 function hasBuiltBinary(pkgDir) {
-	if (!fs.existsSync(path$1.join(pkgDir, "package.json"))) return false;
+	if (!fs$1.existsSync(path$1.join(pkgDir, "package.json"))) return false;
 	const releaseDir = path$1.join(pkgDir, "build", "Release");
 	try {
-		if (fs.existsSync(releaseDir) && fs.readdirSync(releaseDir).some((f) => f.endsWith(".node"))) return true;
+		if (fs$1.existsSync(releaseDir) && fs$1.readdirSync(releaseDir).some((f) => f.endsWith(".node"))) return true;
 	} catch {}
-	return fs.existsSync(path$1.join(pkgDir, "prebuilds"));
+	return fs$1.existsSync(path$1.join(pkgDir, "prebuilds"));
 }
 /** Candidate hoisted locations for `<name>`: NODE_PATH entries + ancestors of `addonDir`. */
 function candidateHoistedDirs(name, addonDir) {
@@ -8136,7 +8136,7 @@ function hashDeclaration(deps) {
 }
 function markerMatches(markerFile, expected) {
 	try {
-		return fs.readFileSync(markerFile, "utf-8").trim() === expected;
+		return fs$1.readFileSync(markerFile, "utf-8").trim() === expected;
 	} catch {
 		return false;
 	}
@@ -8243,7 +8243,7 @@ function parseInstallSource(value) {
 function readPackageJson(pkgJsonPath) {
 	let raw;
 	try {
-		raw = asJsonObject$1(parseJsonUnknown(fs.readFileSync(pkgJsonPath, "utf-8")));
+		raw = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(pkgJsonPath, "utf-8")));
 	} catch {
 		return null;
 	}
@@ -8406,7 +8406,7 @@ var AddonInstaller = class AddonInstaller {
 		} catch {
 			return Object.freeze([]);
 		}
-		const raw = fs.readFileSync(pkgPath, "utf-8");
+		const raw = fs$1.readFileSync(pkgPath, "utf-8");
 		const parsed = JSON.parse(raw);
 		const deps = Object.keys(parsed.dependencies ?? {});
 		const agentOnly = new Set(parsed.camstack?.agentOnlyBootstrapAddons ?? []);
@@ -8451,7 +8451,7 @@ var AddonInstaller = class AddonInstaller {
 		} catch {
 			return Object.freeze([]);
 		}
-		const raw = fs.readFileSync(pkgPath, "utf-8");
+		const raw = fs$1.readFileSync(pkgPath, "utf-8");
 		const addons = JSON.parse(raw).camstack?.agentBootstrapAddons ?? [];
 		return Object.freeze(["@camstack/system", ...addons]);
 	}
@@ -8482,7 +8482,7 @@ var AddonInstaller = class AddonInstaller {
 		}
 		for (const packageName of pkgList) {
 			const addonDir = path$1.join(this.addonsDir, packageName);
-			if (fs.existsSync(path$1.join(addonDir, "package.json"))) {
+			if (fs$1.existsSync(path$1.join(addonDir, "package.json"))) {
 				this.logger.debug(`${packageName} — already installed, skipping`);
 				continue;
 			}
@@ -8567,7 +8567,7 @@ var AddonInstaller = class AddonInstaller {
 		const installedPackages = this.listInstalled();
 		for (const pkg of installedPackages) {
 			try {
-				if (fs.lstatSync(pkg.dir).isSymbolicLink()) continue;
+				if (fs$1.lstatSync(pkg.dir).isSymbolicLink()) continue;
 			} catch {
 				continue;
 			}
@@ -8607,7 +8607,7 @@ var AddonInstaller = class AddonInstaller {
 		if (closureNodeModules !== null) for (const link of state.existingLinks) {
 			if (!isClosureLinkTarget(link.target, closureNodeModules)) continue;
 			const linkDir = path$1.join(nodeModulesDir, link.name);
-			const targetManifest = fs.existsSync(path$1.join(linkDir, "package.json"));
+			const targetManifest = fs$1.existsSync(path$1.join(linkDir, "package.json"));
 			const ranges = state.requirements.get(link.name) ?? [];
 			let holds = targetManifest;
 			if (holds && ranges.length > 0) {
@@ -8616,14 +8616,14 @@ var AddonInstaller = class AddonInstaller {
 			}
 			if (!holds) {
 				this.logger.warn(`${packageName} — closure link for ${link.name} no longer holds; reinstalling this addon's deps`, { meta: { target: link.target } });
-				fs.rmSync(linkDir, { force: true });
+				fs$1.rmSync(linkDir, { force: true });
 				needsInstall = true;
 			}
 		}
 		const linked = [];
 		for (const [depName, range] of declaredEntries) {
 			if (typeof range !== "string") continue;
-			if (fs.existsSync(path$1.join(nodeModulesDir, depName, "package.json"))) continue;
+			if (fs$1.existsSync(path$1.join(nodeModulesDir, depName, "package.json"))) continue;
 			const closureVersion = closureNodeModules === null ? void 0 : readClosureVersions(closureNodeModules, [depName]).get(depName);
 			if (closureNodeModules !== null && closureVersion !== void 0 && closureSatisfiesRange(range, closureVersion)) {
 				if (executeClosureDedupe(addonDir, closureNodeModules, {
@@ -8656,7 +8656,7 @@ var AddonInstaller = class AddonInstaller {
 		const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
 		if (closureNodeModules !== null) {
 			const state = collectAddonTreeState(addonDir);
-			for (const link of state.existingLinks) if (isClosureLinkTarget(link.target, closureNodeModules)) fs.rmSync(path$1.join(addonDir, "node_modules", link.name), { force: true });
+			for (const link of state.existingLinks) if (isClosureLinkTarget(link.target, closureNodeModules)) fs$1.rmSync(path$1.join(addonDir, "node_modules", link.name), { force: true });
 		}
 		this.logger.info(`${packageName} — reinstalling runtime dependencies`, { meta: { addonDir } });
 		await runNpm([
@@ -8715,7 +8715,7 @@ var AddonInstaller = class AddonInstaller {
 	async realignFromClosure(packageName, closureDir) {
 		const targetDir = path$1.join(this.addonsDir, packageName);
 		const result = await this.installLocal(packageName, closureDir);
-		await fs.promises.writeFile(path$1.join(targetDir, ".install-source"), "closure");
+		await fs$1.promises.writeFile(path$1.join(targetDir, ".install-source"), "closure");
 		this.manifest.upsert(result.name, {
 			version: result.version,
 			source: "closure"
@@ -8750,12 +8750,12 @@ var AddonInstaller = class AddonInstaller {
 	*/
 	async installSymlink(packageName, sourceDir, pkgData, targetDir) {
 		await this.ensureBuilt(packageName, sourceDir, pkgData);
-		fs.rmSync(targetDir, {
+		fs$1.rmSync(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(path$1.dirname(targetDir));
-		fs.symlinkSync(sourceDir, targetDir, "dir");
+		fs$1.symlinkSync(sourceDir, targetDir, "dir");
 		this.manifest.upsert(packageName, {
 			version: asString$1(pkgData.version, "0.0.0"),
 			source: "local"
@@ -8769,17 +8769,17 @@ var AddonInstaller = class AddonInstaller {
 	async installCopy(packageName, sourceDir, pkgData, targetDir) {
 		await this.ensureBuilt(packageName, sourceDir, pkgData);
 		const distDir = path$1.join(sourceDir, "dist");
-		if (!fs.existsSync(distDir)) throw new Error(`${packageName} has no dist/ after build`);
-		await fs.promises.rm(targetDir, {
+		if (!fs$1.existsSync(distDir)) throw new Error(`${packageName} has no dist/ after build`);
+		await fs$1.promises.rm(targetDir, {
 			recursive: true,
 			force: true
 		});
 		ensureDir(targetDir);
-		await fs.promises.writeFile(path$1.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
+		await fs$1.promises.writeFile(path$1.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
 		await copyDirRecursive(distDir, path$1.join(targetDir, "dist"));
 		await copyExtraFileDirs(pkgData, sourceDir, targetDir);
 		copyBundledNativeModules(sourceDir, targetDir, this.logger);
-		await fs.promises.writeFile(path$1.join(targetDir, ".install-source"), "local");
+		await fs$1.promises.writeFile(path$1.join(targetDir, ".install-source"), "local");
 		const localPkgVersion = asString$1(pkgData.version, "0.0.0");
 		this.manifest.upsert(packageName, {
 			version: localPkgVersion,
@@ -8820,7 +8820,7 @@ var AddonInstaller = class AddonInstaller {
 	* unusual auth, offline mode, etc).
 	*/
 	async installFromNpm(packageName, version) {
-		const tmpDir = fs.mkdtempSync(path$1.join(os$1.tmpdir(), "camstack-addon-npm-"));
+		const tmpDir = fs$1.mkdtempSync(path$1.join(os$1.tmpdir(), "camstack-addon-npm-"));
 		const packageSpec = version ? `${packageName}@${version}` : packageName;
 		this.logger.info(`${packageName} — installing from npm`);
 		try {
@@ -8834,19 +8834,19 @@ var AddonInstaller = class AddonInstaller {
 				];
 				if (this.registry) args.push("--registry", this.registry);
 				const { stdout } = await runNpm(args, this.npmRunOptions(tmpDir, 12e4));
-				const tgzFiles = fs.readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
+				const tgzFiles = fs$1.readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
 				if (tgzFiles.length === 0) throw new Error(`npm pack produced no tgz. stdout: ${stdout.trim()}`);
 				return path$1.join(tmpDir, tgzFiles[0]);
 			});
 			const result = await this.installFromTgz(tgzPath);
-			fs.writeFileSync(path$1.join(this.addonsDir, result.name, ".install-source"), "npm");
+			fs$1.writeFileSync(path$1.join(this.addonsDir, result.name, ".install-source"), "npm");
 			this.manifest.upsert(result.name, {
 				version: result.version,
 				source: "npm"
 			});
 			return result;
 		} finally {
-			fs.rmSync(tmpDir, {
+			fs$1.rmSync(tmpDir, {
 				recursive: true,
 				force: true
 			});
@@ -8884,7 +8884,7 @@ var AddonInstaller = class AddonInstaller {
 		if (!tarRes.ok) throw new Error(`tarball GET ${tarballUrl} → ${tarRes.status}`);
 		const tgzPath = path$1.join(tmpDir, `${packageName.replace(/[/@]/g, "-").replace(/^-+/, "")}-${resolvedVersion}.tgz`);
 		const buf = Buffer.from(await tarRes.arrayBuffer());
-		fs.writeFileSync(tgzPath, buf);
+		fs$1.writeFileSync(tgzPath, buf);
 		return tgzPath;
 	}
 	/**
@@ -8905,7 +8905,7 @@ var AddonInstaller = class AddonInstaller {
 	* on the next deploy.
 	*/
 	async evictInstallDir(targetDir) {
-		if (!fs.existsSync(targetDir)) return;
+		if (!fs$1.existsSync(targetDir)) return;
 		const graveyard = path$1.join(this.addonsDir, ".evicting");
 		ensureDir(graveyard);
 		await this.sweepGraveyard(graveyard);
@@ -8913,10 +8913,10 @@ var AddonInstaller = class AddonInstaller {
 		const flatName = path$1.relative(this.addonsDir, targetDir).replace(/[/\\]/g, "-");
 		const asideDir = path$1.join(graveyard, `${flatName}-${ts}`);
 		try {
-			fs.renameSync(targetDir, asideDir);
+			fs$1.renameSync(targetDir, asideDir);
 		} catch (renameErr) {
 			if (renameErr.code === "EXDEV") {
-				await fs.promises.rm(targetDir, {
+				await fs$1.promises.rm(targetDir, {
 					recursive: true,
 					force: true
 				});
@@ -8924,7 +8924,7 @@ var AddonInstaller = class AddonInstaller {
 			}
 			throw renameErr;
 		}
-		await fs.promises.rm(asideDir, {
+		await fs$1.promises.rm(asideDir, {
 			recursive: true,
 			force: true
 		}).catch((cleanupErr) => {
@@ -8945,14 +8945,14 @@ var AddonInstaller = class AddonInstaller {
 	async sweepStagingResidue(stagingRoot) {
 		let names;
 		try {
-			names = fs.readdirSync(stagingRoot);
+			names = fs$1.readdirSync(stagingRoot);
 		} catch {
 			return;
 		}
 		const now = Date.now();
 		const ages = [];
 		for (const name of names) try {
-			const stat = fs.statSync(path$1.join(stagingRoot, name));
+			const stat = fs$1.statSync(path$1.join(stagingRoot, name));
 			ages.push({
 				name,
 				ageMs: now - stat.mtimeMs
@@ -8963,7 +8963,7 @@ var AddonInstaller = class AddonInstaller {
 			stagingRoot,
 			entries: sweepable
 		} });
-		await Promise.all(sweepable.map((name) => fs.promises.rm(path$1.join(stagingRoot, name), {
+		await Promise.all(sweepable.map((name) => fs$1.promises.rm(path$1.join(stagingRoot, name), {
 			recursive: true,
 			force: true
 		}).catch(() => void 0)));
@@ -8972,11 +8972,11 @@ var AddonInstaller = class AddonInstaller {
 	async sweepGraveyard(graveyard) {
 		let entries;
 		try {
-			entries = fs.readdirSync(graveyard);
+			entries = fs$1.readdirSync(graveyard);
 		} catch {
 			return;
 		}
-		await Promise.all(entries.map((name) => fs.promises.rm(path$1.join(graveyard, name), {
+		await Promise.all(entries.map((name) => fs$1.promises.rm(path$1.join(graveyard, name), {
 			recursive: true,
 			force: true
 		}).catch(() => void 0)));
@@ -9027,7 +9027,7 @@ var AddonInstaller = class AddonInstaller {
 			return;
 		}
 		const strippedManifest = stripBundledDeps(pkgView.raw);
-		await fs.promises.writeFile(pkgJsonPath, JSON.stringify(strippedManifest, null, 2));
+		await fs$1.promises.writeFile(pkgJsonPath, JSON.stringify(strippedManifest, null, 2));
 		const deps = asJsonObject$1(strippedManifest["dependencies"]);
 		const depNames = deps ? Object.keys(deps) : [];
 		if (depNames.length === 0) return;
@@ -9159,9 +9159,9 @@ var AddonInstaller = class AddonInstaller {
 				"-C",
 				stagingDir
 			], { timeout: 12e4 });
-			const pkgDir = fs.existsSync(path$1.join(stagingDir, "package", "package.json")) ? path$1.join(stagingDir, "package") : stagingDir;
+			const pkgDir = fs$1.existsSync(path$1.join(stagingDir, "package", "package.json")) ? path$1.join(stagingDir, "package") : stagingDir;
 			const pkgJsonPath = path$1.join(pkgDir, "package.json");
-			if (!fs.existsSync(pkgJsonPath)) throw new Error("No package.json found in tgz archive");
+			if (!fs$1.existsSync(pkgJsonPath)) throw new Error("No package.json found in tgz archive");
 			const pkgView = readPackageJson(pkgJsonPath);
 			if (!pkgView) throw new Error(`Invalid package.json at ${pkgJsonPath}`);
 			if (!pkgView.camstackAddons) throw new Error(`Package ${pkgView.name} has no camstack.addons manifest`);
@@ -9171,7 +9171,7 @@ var AddonInstaller = class AddonInstaller {
 			this.dedupeTreeAgainstClosure(pkgDir, pkgView.name);
 			await this.evictInstallDir(targetDir);
 			ensureDir(path$1.dirname(targetDir));
-			await fs.promises.rename(pkgDir, targetDir);
+			await fs$1.promises.rename(pkgDir, targetDir);
 			this.manifest.upsert(pkgView.name, {
 				version: pkgView.version,
 				source: "bundled"
@@ -9182,7 +9182,7 @@ var AddonInstaller = class AddonInstaller {
 			};
 		} finally {
 			this.inFlightStaging.delete(stagingName);
-			await fs.promises.rm(stagingDir, {
+			await fs$1.promises.rm(stagingDir, {
 				recursive: true,
 				force: true
 			}).catch(() => void 0);
@@ -9212,13 +9212,13 @@ var AddonInstaller = class AddonInstaller {
 		const current = this.manifest.get(packageName);
 		if (current == null) throw new Error(`Cannot update ${packageName}: not currently tracked in manifest`);
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (!fs.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
+		if (!fs$1.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
 		const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 		const backupRoot = path$1.join(this.addonsDir, ".backups", packageName);
 		ensureDir(backupRoot);
 		const backupDir = path$1.join(backupRoot, ts);
 		this.logger.info(`${packageName} — backing up v${current.version} → ${backupDir}`);
-		fs.renameSync(addonDir, backupDir);
+		fs$1.renameSync(addonDir, backupDir);
 		let result;
 		try {
 			if (this.installSource === "local" || this.installSource === "symlink") {
@@ -9233,11 +9233,11 @@ var AddonInstaller = class AddonInstaller {
 		} catch (installErr) {
 			this.logger.error(`${packageName} — install failed, restoring backup`, { meta: { error: errMsg$1(installErr) } });
 			try {
-				if (fs.existsSync(addonDir)) fs.rmSync(addonDir, {
+				if (fs$1.existsSync(addonDir)) fs$1.rmSync(addonDir, {
 					recursive: true,
 					force: true
 				});
-				fs.renameSync(backupDir, addonDir);
+				fs$1.renameSync(backupDir, addonDir);
 				this.manifest.upsert(packageName, {
 					version: current.version,
 					source: current.source,
@@ -9298,7 +9298,7 @@ var AddonInstaller = class AddonInstaller {
 		const current = this.manifest.get(packageName);
 		if (current == null) throw new Error(`Cannot update ${packageName}: not currently tracked in manifest`);
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (!fs.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
+		if (!fs$1.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
 		await this.installRuntimeDependencies(stagedPath, packageName);
 		await this.installNativeDependencies(stagedPath, packageName);
 		this.dedupeTreeAgainstClosure(stagedPath, packageName);
@@ -9307,14 +9307,14 @@ var AddonInstaller = class AddonInstaller {
 		ensureDir(backupRoot);
 		const backupDir = path$1.join(backupRoot, ts);
 		this.logger.info(`${packageName} — backing up v${current.version} → ${backupDir}`);
-		fs.renameSync(addonDir, backupDir);
+		fs$1.renameSync(addonDir, backupDir);
 		try {
 			try {
-				fs.renameSync(stagedPath, addonDir);
+				fs$1.renameSync(stagedPath, addonDir);
 			} catch (renameErr) {
 				if (renameErr.code === "EXDEV") {
-					fs.cpSync(stagedPath, addonDir, { recursive: true });
-					fs.rmSync(stagedPath, {
+					fs$1.cpSync(stagedPath, addonDir, { recursive: true });
+					fs$1.rmSync(stagedPath, {
 						recursive: true,
 						force: true
 					});
@@ -9323,11 +9323,11 @@ var AddonInstaller = class AddonInstaller {
 		} catch (swapErr) {
 			this.logger.error(`${packageName} — staged swap failed, restoring backup`, { meta: { error: errMsg$1(swapErr) } });
 			try {
-				if (fs.existsSync(addonDir)) fs.rmSync(addonDir, {
+				if (fs$1.existsSync(addonDir)) fs$1.rmSync(addonDir, {
 					recursive: true,
 					force: true
 				});
-				fs.renameSync(backupDir, addonDir);
+				fs$1.renameSync(backupDir, addonDir);
 				this.manifest.upsert(packageName, {
 					version: current.version,
 					source: current.source,
@@ -9366,20 +9366,20 @@ var AddonInstaller = class AddonInstaller {
 			this.logger.warn(`${packageName} — no backup to rollback to`);
 			return null;
 		}
-		if (!fs.existsSync(entry.lastBackupDir)) {
+		if (!fs$1.existsSync(entry.lastBackupDir)) {
 			this.logger.warn(`${packageName} — backup dir vanished: ${entry.lastBackupDir}`);
 			return null;
 		}
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (fs.existsSync(addonDir)) fs.rmSync(addonDir, {
+		if (fs$1.existsSync(addonDir)) fs$1.rmSync(addonDir, {
 			recursive: true,
 			force: true
 		});
-		fs.renameSync(entry.lastBackupDir, addonDir);
+		fs$1.renameSync(entry.lastBackupDir, addonDir);
 		const pkgJsonPath = path$1.join(addonDir, "package.json");
 		let restoredVersion = entry.version;
-		if (fs.existsSync(pkgJsonPath)) try {
-			const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+		if (fs$1.existsSync(pkgJsonPath)) try {
+			const parsed = JSON.parse(fs$1.readFileSync(pkgJsonPath, "utf-8"));
 			if (typeof parsed === "object" && parsed != null) {
 				const v = parsed.version;
 				if (typeof v === "string" && v.length > 0) restoredVersion = v;
@@ -9427,7 +9427,7 @@ var AddonInstaller = class AddonInstaller {
 			return false;
 		}
 		try {
-			await fs.promises.rm(target, {
+			await fs$1.promises.rm(target, {
 				recursive: true,
 				force: true
 			});
@@ -9445,7 +9445,7 @@ var AddonInstaller = class AddonInstaller {
 	listBackupsFor(packageName) {
 		const dir = path$1.join(this.backupsRoot, packageName);
 		try {
-			return fs.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path$1.join(dir, e.name)).sort();
+			return fs$1.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => path$1.join(dir, e.name)).sort();
 		} catch {
 			return [];
 		}
@@ -9477,7 +9477,7 @@ var AddonInstaller = class AddonInstaller {
 		for (const dir of [pkgDir, path$1.dirname(pkgDir)]) {
 			if (!this.isInsideBackups(dir)) continue;
 			try {
-				await fs.promises.rmdir(dir);
+				await fs$1.promises.rmdir(dir);
 			} catch {
 				return;
 			}
@@ -9559,7 +9559,7 @@ var AddonInstaller = class AddonInstaller {
 	*/
 	resolveBackupToKeep(packageName, backups) {
 		const liveDir = path$1.join(this.addonsDir, packageName);
-		if (!fs.existsSync(liveDir)) {
+		if (!fs$1.existsSync(liveDir)) {
 			const newest = backups[backups.length - 1] ?? null;
 			if (newest != null) this.logger.warn(`${packageName} — live install dir missing; retaining its newest backup as the only surviving copy`, { meta: {
 				liveDir,
@@ -9576,7 +9576,7 @@ var AddonInstaller = class AddonInstaller {
 	listBackedUpPackages() {
 		let entries;
 		try {
-			entries = fs.readdirSync(this.backupsRoot, { withFileTypes: true });
+			entries = fs$1.readdirSync(this.backupsRoot, { withFileTypes: true });
 		} catch {
 			return [];
 		}
@@ -9588,14 +9588,14 @@ var AddonInstaller = class AddonInstaller {
 				continue;
 			}
 			const scopeDir = path$1.join(this.backupsRoot, entry.name);
-			for (const inner of fs.readdirSync(scopeDir, { withFileTypes: true })) if (inner.isDirectory()) names.push(`${entry.name}/${inner.name}`);
+			for (const inner of fs$1.readdirSync(scopeDir, { withFileTypes: true })) if (inner.isDirectory()) names.push(`${entry.name}/${inner.name}`);
 		}
 		return names;
 	}
 	async uninstall(packageName) {
 		const addonDir = path$1.join(this.addonsDir, packageName);
-		if (fs.existsSync(addonDir)) {
-			fs.rmSync(addonDir, {
+		if (fs$1.existsSync(addonDir)) {
+			fs$1.rmSync(addonDir, {
 				recursive: true,
 				force: true
 			});
@@ -9603,8 +9603,8 @@ var AddonInstaller = class AddonInstaller {
 			return;
 		}
 		const legacyDir = path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""));
-		if (fs.existsSync(legacyDir)) {
-			fs.rmSync(legacyDir, {
+		if (fs$1.existsSync(legacyDir)) {
+			fs$1.rmSync(legacyDir, {
 				recursive: true,
 				force: true
 			});
@@ -9612,22 +9612,22 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	listInstalled() {
-		if (!fs.existsSync(this.addonsDir)) return [];
+		if (!fs$1.existsSync(this.addonsDir)) return [];
 		const packageDirs = [];
-		for (const entry of fs.readdirSync(this.addonsDir, { withFileTypes: true })) {
+		for (const entry of fs$1.readdirSync(this.addonsDir, { withFileTypes: true })) {
 			if (!isDirEntry(entry, this.addonsDir)) continue;
 			if (entry.name.startsWith("@")) {
 				const scopeDir = path$1.join(this.addonsDir, entry.name);
-				for (const inner of fs.readdirSync(scopeDir, { withFileTypes: true })) if (isDirEntry(inner, scopeDir)) packageDirs.push(path$1.join(scopeDir, inner.name));
+				for (const inner of fs$1.readdirSync(scopeDir, { withFileTypes: true })) if (isDirEntry(inner, scopeDir)) packageDirs.push(path$1.join(scopeDir, inner.name));
 			} else packageDirs.push(path$1.join(this.addonsDir, entry.name));
 		}
 		return packageDirs.map((dir) => {
 			const pkgPath = path$1.join(dir, "package.json");
-			if (!fs.existsSync(pkgPath)) return null;
+			if (!fs$1.existsSync(pkgPath)) return null;
 			const pkg = readPackageJson(pkgPath);
 			if (!pkg || !pkg.camstackAddons) return null;
 			const sourceFile = path$1.join(dir, ".install-source");
-			const installSource = fs.existsSync(sourceFile) ? parseInstallSource(fs.readFileSync(sourceFile, "utf-8").trim()) : void 0;
+			const installSource = fs$1.existsSync(sourceFile) ? parseInstallSource(fs$1.readFileSync(sourceFile, "utf-8").trim()) : void 0;
 			return {
 				name: pkg.name,
 				version: pkg.version,
@@ -9637,13 +9637,13 @@ var AddonInstaller = class AddonInstaller {
 		}).filter((item) => item !== null);
 	}
 	isInstalled(packageName) {
-		if (fs.existsSync(path$1.join(this.addonsDir, packageName, "package.json"))) return true;
-		return fs.existsSync(path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json"));
+		if (fs$1.existsSync(path$1.join(this.addonsDir, packageName, "package.json"))) return true;
+		return fs$1.existsSync(path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json"));
 	}
 	getInstalledPackage(packageName) {
 		let pkgPath = path$1.join(this.addonsDir, packageName, "package.json");
-		if (!fs.existsSync(pkgPath)) pkgPath = path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json");
-		if (!fs.existsSync(pkgPath)) return null;
+		if (!fs$1.existsSync(pkgPath)) pkgPath = path$1.join(this.addonsDir, packageName.replace(/^@[^/]+\//, ""), "package.json");
+		if (!fs$1.existsSync(pkgPath)) return null;
 		const pkg = readPackageJson(pkgPath);
 		if (!pkg) return null;
 		return {
@@ -9662,7 +9662,7 @@ var AddonInstaller = class AddonInstaller {
 		]) {
 			const candidate = path$1.join(this.workspaceDir, dirName);
 			try {
-				const pkg = asJsonObject$1(parseJsonUnknown(fs.readFileSync(path$1.join(candidate, "package.json"), "utf-8")));
+				const pkg = asJsonObject$1(parseJsonUnknown(fs$1.readFileSync(path$1.join(candidate, "package.json"), "utf-8")));
 				if (pkg && asString$1(pkg["name"]) === packageName) return candidate;
 			} catch {}
 		}
@@ -9671,7 +9671,7 @@ var AddonInstaller = class AddonInstaller {
 	/** Ensure a package is built (dist/ exists and page bundles present) */
 	async ensureBuilt(packageName, sourceDir, pkgData) {
 		const distDir = path$1.join(sourceDir, "dist");
-		if (!(!fs.existsSync(distDir) || this.isDistIncomplete(pkgData, sourceDir))) return;
+		if (!(!fs$1.existsSync(distDir) || this.isDistIncomplete(pkgData, sourceDir))) return;
 		this.logger.info(`${packageName} — building (dist/ missing or incomplete)`);
 		try {
 			await runNpm(["run", "build"], this.npmRunOptions(sourceDir, 18e4));
@@ -9686,7 +9686,7 @@ var AddonInstaller = class AddonInstaller {
 		if (!camstack?.addons) return false;
 		for (const addon of camstack.addons) {
 			if (!addon.pages) continue;
-			for (const page of addon.pages) if (page.bundle && !fs.existsSync(path$1.join(sourceDir, "dist", page.bundle))) return true;
+			for (const page of addon.pages) if (page.bundle && !fs$1.existsSync(path$1.join(sourceDir, "dist", page.bundle))) return true;
 		}
 		return false;
 	}
@@ -9695,7 +9695,7 @@ var AddonInstaller = class AddonInstaller {
 function isDirEntry(entry, parentDir) {
 	if (entry.isDirectory()) return true;
 	if (entry.isSymbolicLink()) try {
-		return fs.statSync(path$1.join(parentDir, entry.name)).isDirectory();
+		return fs$1.statSync(path$1.join(parentDir, entry.name)).isDirectory();
 	} catch {
 		return false;
 	}
@@ -9794,7 +9794,7 @@ function selectAddonResidue(candidates) {
 }
 function readDeclaredName(dir) {
 	try {
-		const parsed = JSON.parse(fs.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
+		const parsed = JSON.parse(fs$1.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
 		if (typeof parsed !== "object" || parsed === null) return null;
 		const name = parsed.name;
 		return typeof name === "string" ? name : null;
@@ -9804,7 +9804,7 @@ function readDeclaredName(dir) {
 }
 function readDeclaredVersion(dir) {
 	try {
-		const parsed = JSON.parse(fs.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
+		const parsed = JSON.parse(fs$1.readFileSync(path$1.join(dir, "package.json"), "utf-8"));
 		if (typeof parsed !== "object" || parsed === null) return null;
 		const version = parsed.version;
 		return typeof version === "string" ? version : null;
@@ -9814,7 +9814,7 @@ function readDeclaredVersion(dir) {
 }
 function isDirLike(p) {
 	try {
-		return fs.statSync(p).isDirectory();
+		return fs$1.statSync(p).isDirectory();
 	} catch {
 		return false;
 	}
@@ -9824,7 +9824,7 @@ function freeQuarantineTarget(store, scope, dirName) {
 	const base = scope === null ? dirName : `${scope.replace("@", "")}__${dirName}`;
 	let candidate = path$1.join(store, base);
 	let n = 1;
-	while (fs.existsSync(candidate)) {
+	while (fs$1.existsSync(candidate)) {
 		candidate = path$1.join(store, `${base}-${n}`);
 		n += 1;
 	}
@@ -9841,7 +9841,7 @@ function freeQuarantineTarget(store, scope, dirName) {
 function quarantineAddonResidue(addonsDir, log) {
 	const quarantined = [];
 	const failed = [];
-	if (!fs.existsSync(addonsDir)) return {
+	if (!fs$1.existsSync(addonsDir)) return {
 		quarantined,
 		failed
 	};
@@ -9849,7 +9849,7 @@ function quarantineAddonResidue(addonsDir, log) {
 	const scan = (parent, scope) => {
 		let names;
 		try {
-			names = fs.readdirSync(parent);
+			names = fs$1.readdirSync(parent);
 		} catch {
 			return;
 		}
@@ -9868,8 +9868,8 @@ function quarantineAddonResidue(addonsDir, log) {
 			const version = readDeclaredVersion(full);
 			const to = freeQuarantineTarget(store, scope, dirName);
 			try {
-				fs.mkdirSync(store, { recursive: true });
-				fs.renameSync(full, to);
+				fs$1.mkdirSync(store, { recursive: true });
+				fs$1.renameSync(full, to);
 			} catch (err) {
 				const error = err instanceof Error ? err.message : String(err);
 				failed.push({
@@ -9910,8 +9910,8 @@ function detectWorkspacePackagesDir(startDir) {
 		current = path$1.dirname(current);
 		const packagesDir = path$1.join(current, "packages");
 		const rootPkgJson = path$1.join(current, "package.json");
-		if (fs.existsSync(packagesDir) && fs.existsSync(rootPkgJson)) try {
-			const rootPkg = JSON.parse(fs.readFileSync(rootPkgJson, "utf-8"));
+		if (fs$1.existsSync(packagesDir) && fs$1.existsSync(rootPkgJson)) try {
+			const rootPkg = JSON.parse(fs$1.readFileSync(rootPkgJson, "utf-8"));
 			if (rootPkg.workspaces || rootPkg.name === "camstack-server" || rootPkg.name === "camstack") return packagesDir;
 		} catch {}
 	}
@@ -9950,11 +9950,11 @@ function getRestartMarkerPath(dataDir) {
 * intact or no marker at all (never a half-written file).
 */
 function writePendingRestart(dataDir, marker) {
-	fs.mkdirSync(dataDir, { recursive: true });
+	fs$1.mkdirSync(dataDir, { recursive: true });
 	const markerPath = getRestartMarkerPath(dataDir);
 	const tmpPath = `${markerPath}.tmp`;
-	fs.writeFileSync(tmpPath, JSON.stringify(marker, null, 2), "utf-8");
-	fs.renameSync(tmpPath, markerPath);
+	fs$1.writeFileSync(tmpPath, JSON.stringify(marker, null, 2), "utf-8");
+	fs$1.renameSync(tmpPath, markerPath);
 }
 /**
 * Read + consume the marker. Returns the parsed payload on success and
@@ -9979,10 +9979,10 @@ function writePendingRestart(dataDir, marker) {
 */
 function readPendingRestart(dataDir) {
 	const markerPath = getRestartMarkerPath(dataDir);
-	if (!fs.existsSync(markerPath)) return null;
+	if (!fs$1.existsSync(markerPath)) return null;
 	let raw;
 	try {
-		raw = fs.readFileSync(markerPath, "utf-8");
+		raw = fs$1.readFileSync(markerPath, "utf-8");
 	} catch (err) {
 		console.error("[restart-coordinator] Marker unreadable — leaving in place:", err);
 		return null;
@@ -10021,7 +10021,7 @@ function readPendingRestart(dataDir) {
 /** Remove the marker if present. No-op if missing. */
 function clearPendingRestart(dataDir) {
 	const markerPath = getRestartMarkerPath(dataDir);
-	fs.rmSync(markerPath, { force: true });
+	fs$1.rmSync(markerPath, { force: true });
 }
 function isRestartKind(value) {
 	return value === "framework-update" || value === "manual" || value === "system";
@@ -10033,7 +10033,7 @@ function scheduleSelfRestart(options = {}) {
 		const touchTarget = process.env["CAMSTACK_RESTART_TOUCH_FILE"];
 		if (touchTarget !== void 0 && touchTarget.length > 0) try {
 			const now = /* @__PURE__ */ new Date();
-			fs.utimesSync(touchTarget, now, now);
+			fs$1.utimesSync(touchTarget, now, now);
 			return;
 		} catch (err) {
 			console.error("[restart-coordinator] dev touch-reload failed; falling through to process exit:", err);
@@ -14400,7 +14400,7 @@ function loadBootstrapConfig(configPath) {
 function writeBootstrapSection(configPath, section, data) {
 	if (!BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
 	let raw = {};
-	if (fs.existsSync(configPath)) raw = asJsonObject(load(fs.readFileSync(configPath, "utf-8"))) ?? {};
+	if (fs$1.existsSync(configPath)) raw = asJsonObject(load(fs$1.readFileSync(configPath, "utf-8"))) ?? {};
 	const existing = asJsonObject(raw[section]) ?? {};
 	raw[section] = {
 		...existing,
@@ -14409,12 +14409,12 @@ function writeBootstrapSection(configPath, section, data) {
 	const validation = bootstrapSchema.safeParse(raw);
 	if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
 	const tmpPath = `${configPath}.tmp`;
-	fs.writeFileSync(tmpPath, dump(raw, {
+	fs$1.writeFileSync(tmpPath, dump(raw, {
 		lineWidth: 120,
 		indent: 2,
 		quotingType: "\""
 	}), "utf-8");
-	fs.renameSync(tmpPath, configPath);
+	fs$1.renameSync(tmpPath, configPath);
 	return validation.data;
 }
 /**
@@ -14485,11 +14485,11 @@ function applyEnvOverrides(raw) {
 	return result;
 }
 function loadYaml(configPath) {
-	if (!fs.existsSync(configPath)) {
+	if (!fs$1.existsSync(configPath)) {
 		console.warn(`[ConfigManager] Config file not found at: ${configPath}\n  → Using built-in defaults. Set CONFIG_PATH env var or create the file.\n  → Example path from project root: ./server/backend/data/config.yaml`);
 		return {};
 	}
-	const parsed = load(fs.readFileSync(configPath, "utf-8")) ?? {};
+	const parsed = load(fs$1.readFileSync(configPath, "utf-8")) ?? {};
 	console.log(`[ConfigManager] Loaded config from: ${configPath}`);
 	return parsed;
 }
@@ -21786,7 +21786,7 @@ function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
 }
 /**
-* Parse an `op.path` (e.g. `"pipelineExecutor.getDefaultSteps"`) into
+* Parse an `op.path` (e.g. `"pipelineExecutor.getAvailableEngines"`) into
 * the capability name (kebab-case) and the method name.
 */
 function parsePath(path) {
@@ -22296,6 +22296,148 @@ function buildLinkChain(target, localResolver, hookup) {
 	return links;
 }
 //#endregion
+//#region src/kernel/hwaccel/vaapi-init-probe.ts
+/**
+* Can libva initialise the VA driver on this node's render node? (D926)
+*
+* Measured 2026-10-23 (intel-1.2.509, hub + little-unraid): Intel's iHD 25.2.4
+* exports only `__vaDriverInit_1_22`, the container's Ubuntu libva 2.20 looks
+* for `_1_20`, and `vaInitialize` failed — while the resolver kept offering
+* `qsv, vaapi`. Every session tried, failed and fell back to software: 722
+* `hwaccel 'vaapi' failed` lines a day and nothing that named the cause.
+*
+* One `vainfo --display drm --device <node>` per process answers it. A failure
+* reads the driver's exported `__vaDriverInit_1_N` so the verdict names the gap
+* (`driver iHD needs VA-API >= 1.22, libva has 1.20`). No `vainfo` on the host
+* (a bare install) is `unknown` — the resolver then behaves as it always did.
+*/
+var VAINFO_TIMEOUT_MS = 1e4;
+var INIT_SYMBOL = /__vaDriverInit_(\d+)_(\d+)/g;
+var VA_API_VERSION = /VA-API version:? (\d+)\.(\d+)/;
+var DRIVER_OPEN = /Trying to open (\S+_drv_video\.so)/g;
+function newestInitVersion(symbols) {
+	let best = null;
+	for (const symbol of symbols) for (const m of symbol.matchAll(INIT_SYMBOL)) {
+		const v = {
+			major: Number(m[1]),
+			minor: Number(m[2])
+		};
+		if (!best || v.major > best.major || v.major === best.major && v.minor > best.minor) best = v;
+	}
+	return best;
+}
+function lastMatch(text, re) {
+	let last = null;
+	for (const m of text.matchAll(re)) last = m[1] ?? null;
+	return last;
+}
+function lastLine(text) {
+	const lines = text.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+	return lines[lines.length - 1] ?? "no output";
+}
+function driverName(driverPath) {
+	if (!driverPath) return "unknown";
+	return basename(driverPath).replace(/_drv_video\.so$/, "");
+}
+/** Classify one vainfo run plus the driver's exported init symbols. Pure. */
+function classifyVainfo(run, driverSymbols) {
+	const va = VA_API_VERSION.exec(run.output);
+	const vaApiVersion = va ? `${va[1]}.${va[2]}` : null;
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	const needs = newestInitVersion(driverSymbols);
+	const driverNeedsVaApi = needs ? `${needs.major}.${needs.minor}` : null;
+	const base = {
+		vaApiVersion,
+		driverPath,
+		driverNeedsVaApi
+	};
+	if (run.spawnError !== null) return {
+		...base,
+		state: "unknown",
+		summary: `vaapi: unknown (vainfo not run: ${run.spawnError})`
+	};
+	if (run.exitCode === 0) return {
+		...base,
+		state: "ok",
+		summary: `vaapi: ok (VA-API ${vaApiVersion ?? "?"}, driver ${driverName(driverPath)})`
+	};
+	const reason = needs !== null && va !== null && (needs.major > Number(va[1]) || needs.major === Number(va[1]) && needs.minor > Number(va[2])) ? `driver ${driverName(driverPath)} needs VA-API >= ${driverNeedsVaApi}, libva has ${vaApiVersion}` : lastLine(run.output);
+	return {
+		...base,
+		state: "init-failed",
+		summary: `vaapi: init-failed (${reason})`
+	};
+}
+/** Run `vainfo` against one render node; never throws. */
+function runVainfo(renderNode) {
+	return new Promise((resolve) => {
+		execFile("vainfo", [
+			"--display",
+			"drm",
+			"--device",
+			renderNode
+		], {
+			timeout: VAINFO_TIMEOUT_MS,
+			encoding: "utf8"
+		}, (err, stdout, stderr) => {
+			const output = `${stdout}\n${stderr}`;
+			if (err === null) {
+				resolve({
+					exitCode: 0,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			const code = err.code;
+			if (typeof code === "number") {
+				resolve({
+					exitCode: code,
+					output,
+					spawnError: null
+				});
+				return;
+			}
+			resolve({
+				exitCode: null,
+				output,
+				spawnError: code ?? (err.killed ? "timeout" : err.message)
+			});
+		});
+	});
+}
+/**
+* The `__vaDriverInit_N_M` names in a driver file, streamed (iHD is ~43 MB),
+* with an overlap so a name split across two chunks is still found.
+*/
+function readDriverInitSymbols(driverPath) {
+	return new Promise((resolve) => {
+		const found = /* @__PURE__ */ new Set();
+		let carry = "";
+		const stream = createReadStream(driverPath, {
+			encoding: "latin1",
+			highWaterMark: 64 * 1024
+		});
+		stream.on("data", (chunk) => {
+			const text = carry + String(chunk);
+			for (const m of text.matchAll(INIT_SYMBOL)) if (m.index + m[0].length < text.length) found.add(m[0]);
+			carry = text.slice(-32);
+		});
+		stream.on("error", () => resolve([]));
+		stream.on("end", () => {
+			for (const m of carry.matchAll(INIT_SYMBOL)) found.add(m[0]);
+			resolve([...found].sort());
+		});
+	});
+}
+/** Probe one render node: vainfo, and on failure the driver's init symbols. */
+async function probeVaapiInit(renderNode) {
+	const run = await runVainfo(renderNode);
+	if (run.spawnError !== null || run.exitCode === 0) return classifyVainfo(run, []);
+	const driverPath = lastMatch(run.output, DRIVER_OPEN);
+	return classifyVainfo(run, driverPath ? await readDriverInitSymbols(driverPath) : []);
+}
+//#endregion
 //#region src/kernel/hwaccel/hwaccel-resolver.ts
 /**
 * Platform-probe for hardware video decode acceleration.
@@ -22315,7 +22457,7 @@ function buildLinkChain(target, localResolver, hookup) {
 */
 function safeExistsSync(path) {
 	try {
-		return fs.existsSync(path);
+		return fs$1.existsSync(path);
 	} catch {
 		return false;
 	}
@@ -22334,11 +22476,11 @@ function probeLinuxGpus() {
 	if (safeExistsSync("/dev/nvidia0") || safeExistsSync("/proc/driver/nvidia/version")) signals.hasNvidiaGpu = true;
 	try {
 		const drmDir = "/sys/class/drm";
-		if (fs.existsSync(drmDir)) for (const entry of fs.readdirSync(drmDir)) {
+		if (fs$1.existsSync(drmDir)) for (const entry of fs$1.readdirSync(drmDir)) {
 			if (!entry.startsWith("card")) continue;
 			const vendorPath = `${drmDir}/${entry}/device/vendor`;
 			if (!safeExistsSync(vendorPath)) continue;
-			const vendor = fs.readFileSync(vendorPath, "utf8").trim().toLowerCase();
+			const vendor = fs$1.readFileSync(vendorPath, "utf8").trim().toLowerCase();
 			if (vendor === "0x10de") signals.hasNvidiaGpu = true;
 			else if (vendor === "0x1002") signals.hasAmdGpu = true;
 			else if (vendor === "0x8086") signals.hasIntelGpu = true;
@@ -22365,7 +22507,23 @@ function probePlatform() {
 		coral: classifyCoralAccelerator(nodeCoralFs)
 	};
 }
-function pickBackendsForPlatform(signals) {
+/** The backends that open their device through libva on Linux. */
+var LIBVA_BACKENDS = ["vaapi", "qsv"];
+/**
+* The preference list for these signals. A `vaapi` verdict of `init-failed`
+* (libva cannot initialise the driver — D926) removes every libva-backed
+* backend and names the cause in the rationale; `ok`, `unknown` or `null`
+* change nothing.
+*/
+function pickBackendsForPlatform(signals, vaapi = null) {
+	const res = pickBackendsFromSignals(signals);
+	if (signals.platform !== "linux" || vaapi?.state !== "init-failed") return res;
+	return {
+		preferred: res.preferred.filter((b) => !LIBVA_BACKENDS.includes(b)),
+		rationale: `${res.rationale} ${vaapi.summary} — vaapi/qsv withheld, decode runs in software.`
+	};
+}
+function pickBackendsFromSignals(signals) {
 	switch (signals.platform) {
 		case "darwin": return {
 			preferred: ["videotoolbox"],
@@ -22426,13 +22584,49 @@ function resolveHwAccel(prefer) {
 	};
 	return pickBackendsForPlatform(probePlatform());
 }
+var RENDER_NODE = "/dev/dri/renderD128";
+/** Process-wide: the VA init failure is logged once per process, not per resolver. */
+var PROCESS_VAAPI_REPORT = { reported: false };
+/** Process-wide: hub-main builds one resolver per in-process addon; vainfo runs once. */
+var PROCESS_VAAPI_PROBES = /* @__PURE__ */ new Map();
+function probeVaapiOncePerProcess(renderNode) {
+	const known = PROCESS_VAAPI_PROBES.get(renderNode);
+	if (known) return known;
+	const probe = probeVaapiInit(renderNode);
+	PROCESS_VAAPI_PROBES.set(renderNode, probe);
+	return probe;
+}
 /**
 * Build the `IKernelHwAccel` provider used to populate `ctx.kernel.hwaccel`.
-* Thin async wrapper around the sync `resolveHwAccel` function so the
-* contract matches the per-node `$hwaccel.resolve` Moleculer action.
-*/
-function createKernelHwAccel() {
-	return { resolve: async (prefer) => resolveHwAccel(prefer) };
+* An auto resolve on a Linux host with a render node asks libva ONCE per
+* provider whether it can initialise the driver (D926); an explicit override
+* is never second-guessed.
+*/
+function createKernelHwAccel(options = {}) {
+	const probeSignals = options.probeSignals ?? probePlatform;
+	const probeVaapi = options.probeVaapi ?? probeVaapiOncePerProcess;
+	const reportOnce = options.reportOnce ?? PROCESS_VAAPI_REPORT;
+	let vaapi = null;
+	const vaapiVerdict = async () => {
+		if (vaapi === null) vaapi = probeVaapi(RENDER_NODE);
+		const status = await vaapi;
+		if (status.state === "init-failed" && !reportOnce.reported) {
+			reportOnce.reported = true;
+			options.logger?.error(`hwaccel: ${status.summary} — vaapi/qsv withheld, decode runs in software`, { meta: {
+				renderNode: RENDER_NODE,
+				vaApiVersion: status.vaApiVersion,
+				driverPath: status.driverPath,
+				driverNeedsVaApi: status.driverNeedsVaApi
+			} });
+		}
+		return status;
+	};
+	return { resolve: async (prefer) => {
+		if (prefer === "none" || prefer !== null && prefer !== void 0 && prefer.length > 0) return resolveHwAccel(prefer);
+		const signals = probeSignals();
+		if (signals.platform !== "linux" || !signals.hasRenderNode) return pickBackendsForPlatform(signals);
+		return pickBackendsForPlatform(signals, await vaapiVerdict());
+	} };
 }
 //#endregion
 //#region src/kernel/inference/inference-resolver.ts
@@ -22504,21 +22698,21 @@ function sleep$1(ms) {
 * crashed holder) is stolen.
 */
 async function withFileLock(lockPath, fn) {
-	fs.mkdirSync(join(lockPath, ".."), { recursive: true });
+	fs$1.mkdirSync(join(lockPath, ".."), { recursive: true });
 	for (;;) try {
-		const fd = fs.openSync(lockPath, "wx");
-		fs.closeSync(fd);
+		const fd = fs$1.openSync(lockPath, "wx");
+		fs$1.closeSync(fd);
 		break;
 	} catch {
 		try {
-			if (Date.now() - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs.rmSync(lockPath, { force: true });
+			if (Date.now() - fs$1.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs$1.rmSync(lockPath, { force: true });
 			else await sleep$1(LOCK_POLL_MS);
 		} catch {}
 	}
 	try {
 		return await fn();
 	} finally {
-		fs.rmSync(lockPath, { force: true });
+		fs$1.rmSync(lockPath, { force: true });
 	}
 }
 /** Coalesce in-process + serialize cross-process for one binary id. */
@@ -22576,7 +22770,7 @@ var AddonDepsManager = class {
 	* failed or tampered download throws, and provisioning reports it.
 	*/
 	async stageNativeDepsDeclaredBy(requirementsFile) {
-		if (!declaresEdgetpuDelegate(fs.readFileSync(requirementsFile, "utf8"))) return;
+		if (!declaresEdgetpuDelegate(fs$1.readFileSync(requirementsFile, "utf8"))) return;
 		await singleFlight(this.depsDir, "edgetpu-delegate", () => ensureEdgetpuDelegate(this.nodeRoot, this.logger));
 	}
 	getDepsDir() {
@@ -23586,7 +23780,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 	const addonId = declaration.id;
 	const nodeDataDir = process.env["CAMSTACK_DATA"] ?? dataDir;
 	const addonDataDir = path$1.resolve(nodeDataDir, "addons-data", addonId);
-	fs.mkdirSync(addonDataDir, { recursive: true });
+	fs$1.mkdirSync(addonDataDir, { recursive: true });
 	if (runtime.mode === "broker") ensureBindingSubscription(runtime.broker);
 	const regs = getRegistries(nodeId);
 	const workerResolver = {
@@ -23825,7 +24019,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 					value
 				})
 			};
-			const hwaccel = createKernelHwAccel();
+			const hwaccel = createKernelHwAccel({ logger: scopedLogger });
 			const inferenceEngine = createKernelInferenceEngine();
 			return {
 				localNodeId: nodeId,
@@ -25379,7 +25573,7 @@ function readAddonHeapDeclaration(spec) {
 	if (cached !== void 0) return cached;
 	let declaration = EMPTY_HEAP_DECLARATION;
 	for (const manifestPath of [path$1.join(spec.addonDir, "package.json"), path$1.join(path$1.dirname(spec.addonDir), "package.json")]) try {
-		const raw = fs.readFileSync(manifestPath, "utf8");
+		const raw = fs$1.readFileSync(manifestPath, "utf8");
 		const parsed = JSON.parse(raw);
 		const profile = extractHeapProfile(parsed, spec.addonId);
 		const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
@@ -25871,6 +26065,7 @@ function releaseRunnerGroup(pgid) {
 * Returns how many groups were signalled.
 */
 function signalAllRunnerGroups(signal) {
+	beginRunnerShutdown();
 	let signalled = 0;
 	for (const [pgid, group] of ownedGroups) try {
 		group.kill(-pgid, signal);
@@ -25878,6 +26073,21 @@ function signalAllRunnerGroups(signal) {
 	} catch {}
 	return signalled;
 }
+/**
+* Set once this process has begun an ORDERLY shutdown (hub-main's SIGTERM/SIGINT
+* handler, through {@link signalAllRunnerGroups}, which signals every runner
+* BEFORE the broker stops the process service). A runner that exits after this point is part of the
+* shutdown, not a crash: its exit is INFO and it is never respawned. Without it
+* a clean hub stop logged `ERROR Process exited (code=0)` once per runner and
+* scheduled a respawn into the dying node (CT200, 2026-10-23).
+*/
+var runnerShutdownInProgress = false;
+function beginRunnerShutdown() {
+	runnerShutdownInProgress = true;
+}
+function isRunnerShutdownInProgress() {
+	return runnerShutdownInProgress;
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -26115,6 +26325,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
 			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
+			if (isRunnerShutdownInProgress()) {
+				entry.state = "stopped";
+				emitStateChange(entry);
+				capturedBroker?.logger.info(`[${runnerId}] Process exited during shutdown (code=${code}, signal=${signal})`, { tags: { runnerId } });
+				return;
+			}
 			const announced = entry.announcedRefusal;
 			entry.announcedRefusal = null;
 			if (code === 78) {
@@ -26142,7 +26358,9 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			}
 			entry.state = "crashed";
 			emitStateChange(entry);
-			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
+			const exitLine = `[${runnerId}] Process exited (code=${code}, signal=${signal})`;
+			if (code === 0 && signal === null) capturedBroker?.logger.warn(`${exitLine} — unexpected clean exit, respawning`, { tags: { runnerId } });
+			else capturedBroker?.logger.error(exitLine, { tags: { runnerId } });
 			const decision = crashSupervisor.recordCrash(runnerId);
 			emitRunnerEvent(EventCategory$1.ProcessCrashed, runnerId, {
 				processId: runnerId,
@@ -26557,17 +26775,17 @@ var JobJournal = class {
 		return path$1.join(this.jobsDir, `${id}.json`);
 	}
 	writeAtomic(filePath, data) {
-		fs.mkdirSync(path$1.dirname(filePath), { recursive: true });
+		fs$1.mkdirSync(path$1.dirname(filePath), { recursive: true });
 		const tmp = `${filePath}.tmp.${process.pid}.${Date.now()}`;
-		fs.writeFileSync(tmp, JSON.stringify(data, null, 2), {
+		fs$1.writeFileSync(tmp, JSON.stringify(data, null, 2), {
 			encoding: "utf-8",
 			mode: 384
 		});
-		fs.renameSync(tmp, filePath);
+		fs$1.renameSync(tmp, filePath);
 	}
 	readIndex() {
 		try {
-			const raw = JSON.parse(fs.readFileSync(this.indexPath, "utf-8"));
+			const raw = JSON.parse(fs$1.readFileSync(this.indexPath, "utf-8"));
 			if (raw && Array.isArray(raw.jobIds)) return {
 				version: 1,
 				jobIds: raw.jobIds
@@ -26592,7 +26810,7 @@ var JobJournal = class {
 	}
 	getJob(id) {
 		try {
-			const parsed = lifecycleJobSchema.safeParse(JSON.parse(fs.readFileSync(this.jobPath(id), "utf-8")));
+			const parsed = lifecycleJobSchema.safeParse(JSON.parse(fs$1.readFileSync(this.jobPath(id), "utf-8")));
 			return parsed.success ? parsed.data : null;
 		} catch {
 			return null;
@@ -26657,14 +26875,14 @@ var StagingArea = class {
 	}
 	async fetchAndStage(input) {
 		const destDir = path$1.join(this.stagingDir, input.jobId, safeSegment(input.name));
-		fs.rmSync(destDir, {
+		fs$1.rmSync(destDir, {
 			recursive: true,
 			force: true
 		});
 		const tgz = await this.deps.fetchTarball(input.name, input.version, input.signal);
 		if (input.signal.aborted) throw new Error("staging aborted after fetch");
 		await this.deps.extract(tgz, destDir);
-		const raw = JSON.parse(fs.readFileSync(path$1.join(destDir, "package.json"), "utf-8"));
+		const raw = JSON.parse(fs$1.readFileSync(path$1.join(destDir, "package.json"), "utf-8"));
 		if (typeof raw.version !== "string" || raw.version.length === 0) throw new Error(`staging validation failed: ${input.name} staged a package.json with no version`);
 		if (EXACT_SEMVER.test(input.version) && raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${raw.version}`);
 		return {
@@ -26673,7 +26891,7 @@ var StagingArea = class {
 		};
 	}
 	cleanup(jobId) {
-		fs.rmSync(path$1.join(this.stagingDir, jobId), {
+		fs$1.rmSync(path$1.join(this.stagingDir, jobId), {
 			recursive: true,
 			force: true
 		});
@@ -26688,13 +26906,13 @@ var StagingArea = class {
 	sweepOrphans() {
 		let entries;
 		try {
-			entries = fs.readdirSync(this.stagingDir);
+			entries = fs$1.readdirSync(this.stagingDir);
 		} catch {
 			return 0;
 		}
 		let removed = 0;
 		for (const name of entries) try {
-			fs.rmSync(path$1.join(this.stagingDir, name), {
+			fs$1.rmSync(path$1.join(this.stagingDir, name), {
 				recursive: true,
 				force: true
 			});
@@ -26872,7 +27090,7 @@ var LifecycleJobEngine = class {
 	*   on failure → `failed`.
 	*/
 	async reconcileJob(job) {
-		const exists = this.deps.stagedPathExists ?? ((p) => fs.existsSync(p));
+		const exists = this.deps.stagedPathExists ?? ((p) => fs$1.existsSync(p));
 		for (const task of job.tasks) {
 			if (task.target === "framework") {
 				if (!this.isTerminal(task.phase)) this.skipFrameworkTask(job, task);
@@ -26964,6 +27182,7 @@ var en_default = {
 	"auth.session-ended": "Session ended — sign in again",
 	"auth.access-denied": "Access denied",
 	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
+	"auth.person-scopes-refused": "A person is an admin, with no scope rows, or holds exactly one viewer grant",
 	"device.certificates-unavailable": "Device certificates are not available",
 	"device.not-found": "Device {id} not found",
 	"device.credentials-unavailable": "Device credentials not available",
@@ -27215,6 +27434,7 @@ var it_default = {
 	"auth.session-ended": "Sessione terminata — accedi di nuovo",
 	"auth.access-denied": "Accesso negato",
 	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
+	"auth.person-scopes-refused": "Una persona è amministratore, senza righe di permesso, oppure ha esattamente un permesso visualizzatore",
 	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
 	"device.not-found": "Dispositivo {id} non trovato",
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",
@@ -27485,7 +27705,7 @@ var CatalogRegistry = class {
 			const file = path$1.join(packageDir, "i18n", `${lang}.json`);
 			let text;
 			try {
-				text = fs.readFileSync(file, "utf8");
+				text = fs$1.readFileSync(file, "utf8");
 			} catch {
 				continue;
 			}