@camstack/system 1.2.480 → 1.2.482

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-ByIgd_g9.js");
+const require_wal_maintenance = require("./wal-maintenance-CsGk4kYn.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DkkPbYwt.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DYAJwPWu.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-C49WPQfd.js → hub-mdns-ciao-C3NJsOvK.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DDVtA047.js");
+const require_dist = require("./dist--v3KMKa1.js");
 const require_x509_es = require("./x509.es-WtnRNyYS.js");
-const require_agent_https = require("./agent-https-DDnP9ywM.js");
+const require_agent_https = require("./agent-https-o3X-jkS7.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/{hub-mdns-ciao-KIDDBuDn.mjs → hub-mdns-ciao-DMFXIlMY.mjs}

@@ -1,7 +1,7 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { Ea as userError } from "./dist-DfZKKnMP.mjs";
+import { Da as userError } from "./dist-BIJXQo_j.mjs";
 import { f as X509Certificate$1 } from "./x509.es-BRiJgOvu.mjs";
-import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-6j9JDvjh.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-doVPSeiy.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DDVtA047.js");
-const require_device_ca = require("./device-ca-CVO0N_Oz.js");
+const require_dist = require("./dist--v3KMKa1.js");
+const require_device_ca = require("./device-ca-DgLZPn5R.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
@@ -26,21 +26,21 @@ const require_builtins_loki_logging_index = require("./builtins/loki-logging/ind
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_device_history_device_history_addon = require("./builtins/device-history/device-history.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-ByIgd_g9.js");
+const require_wal_maintenance = require("./wal-maintenance-CsGk4kYn.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-DDnP9ywM.js");
-const require_constants = require("./constants-Bc-5tr1I.js");
+const require_agent_https = require("./agent-https-o3X-jkS7.js");
+const require_constants = require("./constants-BVJrLycr.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-MRyes5j0.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-C49WPQfd.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-C3NJsOvK.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-BXORpvel.js");
+const require_restore_archive = require("./restore-archive-DpkdAuFf.js");
 const require_coral_accelerators = require("./coral-accelerators-BSVsBVzt.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -7528,6 +7528,34 @@ var AddonManifest = class {
 	}
 };
 //#endregion
+//#region src/kernel/addon-version-policy.ts
+/**
+* Which version an installed addon should be running (D942).
+*
+* The hub's target is the registry dist-tag `latest`. An agent's target is
+* the hub's installed version — never the registry, and never "strictly
+* newer". A missing target is an unreadable authority: a failed read changes
+* nothing (D49), including never a move downward because the registry or the
+* hub could not be asked.
+*/
+var ADDON_VERSION_REASON_REGISTRY_LATEST = "installed version differs from registry latest";
+var ADDON_VERSION_REASON_HUB = "agent follows the hub installed version";
+/**
+* Move when `installed` is not `target`. `target === null` (or empty) means
+* the authority could not be read — keep whatever is installed.
+* `installed === null` with a known target is a first install of that target.
+*/
+function decideAddonVersionMove(installed, target, reason) {
+	if (target === null || target.length === 0) return { move: false };
+	if (installed !== null && installed === target) return { move: false };
+	return {
+		move: true,
+		from: installed ?? "absent",
+		to: target,
+		reason
+	};
+}
+//#endregion
 //#region src/kernel/deps/closure-dedupe.ts
 /**
 * Closure dedupe — stop copying into every addon the libraries the server
@@ -8282,6 +8310,25 @@ function readPackageJson(pkgJsonPath) {
 function shouldSkipClosureProvidedSeed(packageName, isResolvable) {
 	return packageName === "@camstack/system" && isResolvable;
 }
+/** How long a boot-time `dist-tags.latest` read may take before it is "unreadable". */
+var REGISTRY_LATEST_TIMEOUT_MS = 15e3;
+function readInstalledPackageVersion(addonDir) {
+	try {
+		const raw = JSON.parse(node_fs.readFileSync(node_path.join(addonDir, "package.json"), "utf-8"));
+		if (raw === null || typeof raw !== "object") return null;
+		const version = Reflect.get(raw, "version");
+		return typeof version === "string" && version.length > 0 ? version : null;
+	} catch {
+		return null;
+	}
+}
+function distTagLatest(body) {
+	if (body === null || typeof body !== "object") return null;
+	const tags = Reflect.get(body, "dist-tags");
+	if (tags === null || typeof tags !== "object") return null;
+	const latest = Reflect.get(tags, "latest");
+	return typeof latest === "string" && latest.length > 0 ? latest : null;
+}
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -8332,6 +8379,7 @@ var AddonInstaller = class AddonInstaller {
 	isPackageResolvable;
 	/** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
 	closureNodeModulesDir;
+	resolveLatestVersionOverride;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -8354,6 +8402,7 @@ var AddonInstaller = class AddonInstaller {
 		this.manifest = new AddonManifest(config.addonsDir);
 		this.isPackageResolvable = config.isPackageResolvable;
 		this.closureNodeModulesDir = config.closureNodeModulesDir;
+		this.resolveLatestVersionOverride = config.resolveLatestVersion;
 		if (config.installSource) this.installSource = config.installSource;
 		else this.installSource = "npm";
 	}
@@ -8467,10 +8516,13 @@ var AddonInstaller = class AddonInstaller {
 	* defaults to npm in production.
 	*
 	* There is no version argument and there is deliberately no pin: the system is
-	* addons-agnostic and `latest` is the whole contract at first boot (operator,
-	* 2026-08-13). A copy already under the addon root is never replaced either —
-	* bootstrap is seed-only, and overwriting a deployed bundle would be an
-	* un-deploy ([D90](../../../../docs/decisions/adr-0090.md)).
+	* addons-agnostic and `latest` is the whole contract (operator, 2026-08-13,
+	* restated 2026-10-25 — D942). A copy already under the addon root is left
+	* alone when this installer is not on the npm source (a workspace or a
+	* bundled desktop seed) and when the package is the closure-provided
+	* `@camstack/system` (a copy there would shadow the closure). Every other
+	* required addon already on disk is moved to registry `latest` when that
+	* tag differs, higher or lower. An unreadable registry changes nothing.
 	*
 	* @param packages — optional custom package list (default: REQUIRED_PACKAGES)
 	*/
@@ -8486,7 +8538,16 @@ var AddonInstaller = class AddonInstaller {
 		for (const packageName of pkgList) {
 			const addonDir = node_path.join(this.addonsDir, packageName);
 			if (node_fs.existsSync(node_path.join(addonDir, "package.json"))) {
-				this.logger.debug(`${packageName} — already installed, skipping`);
+				if (this.installSource !== "npm" || shouldSkipClosureProvidedSeed(packageName, this.isResolvableFromClosure(packageName))) {
+					this.logger.debug(`${packageName} — already installed, skipping`);
+					continue;
+				}
+				try {
+					await this.followInstalledAddonToLatest(packageName, addonDir);
+				} catch (err) {
+					const msg = require_dist.errMsg(err);
+					this.logger.error(`Failed to move ${packageName} to registry latest`, { meta: { error: msg } });
+				}
 				continue;
 			}
 			if (shouldSkipClosureProvidedSeed(packageName, this.isResolvableFromClosure(packageName))) {
@@ -8511,6 +8572,56 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	/**
+	* Move an already-installed required addon to registry `latest` when the
+	* installed version differs. `applyUpdate` keeps the previous tree as a
+	* backup and restores it if the install throws. A null latest (registry
+	* down, or no tag) leaves the copy where it is.
+	*/
+	async followInstalledAddonToLatest(packageName, addonDir) {
+		const installedVersion = readInstalledPackageVersion(addonDir);
+		const decision = decideAddonVersionMove(installedVersion, await this.readRegistryLatest(packageName), ADDON_VERSION_REASON_REGISTRY_LATEST);
+		if (!decision.move) {
+			this.logger.debug(`${packageName} — installed copy matches registry latest, or the registry could not be read`);
+			return;
+		}
+		this.logger.info(`${packageName} — moving ${decision.from} → ${decision.to}: ${decision.reason}`, { meta: {
+			from: decision.from,
+			to: decision.to,
+			reason: decision.reason
+		} });
+		if (this.manifest.get(packageName) == null) this.manifest.upsert(packageName, {
+			version: installedVersion ?? "0.0.0",
+			source: "npm"
+		});
+		await this.applyUpdate(packageName, decision.to);
+	}
+	/** `dist-tags.latest`, or `null` when the registry cannot be read. */
+	async readRegistryLatest(packageName) {
+		if (this.resolveLatestVersionOverride) try {
+			return await this.resolveLatestVersionOverride(packageName);
+		} catch (err) {
+			this.logger.warn(`${packageName} — registry unreadable, leaving the installed copy`, { meta: { error: require_dist.errMsg(err) } });
+			return null;
+		}
+		return this.fetchRegistryLatest(packageName);
+	}
+	async fetchRegistryLatest(packageName) {
+		const metadataUrl = `${(this.registry ?? "https://registry.npmjs.org").replace(/\/+$/, "")}/${encodeURIComponent(packageName).replace(/^%40/, "@")}`;
+		try {
+			const metadataRes = await fetch(metadataUrl, { signal: AbortSignal.timeout(REGISTRY_LATEST_TIMEOUT_MS) });
+			if (!metadataRes.ok) {
+				this.logger.warn(`${packageName} — registry answered ${metadataRes.status}, leaving the installed copy`);
+				return null;
+			}
+			const latest = distTagLatest(await metadataRes.json());
+			if (latest === null) this.logger.warn(`${packageName} — registry returned no dist-tags.latest, leaving the installed copy`);
+			return latest;
+		} catch (err) {
+			this.logger.warn(`${packageName} — registry unreadable, leaving the installed copy`, { meta: { error: require_dist.errMsg(err) } });
+			return null;
+		}
+	}
+	/**
 	* Reconcile the install manifest against the addons actually present on
 	* disk: register seeded addons, correct a version that disagrees with the
 	* installed `package.json`, and drop entries naming a directory that does
@@ -27769,6 +27880,8 @@ function resetCatalogRegistryForTests() {
 	shared = null;
 }
 //#endregion
+exports.ADDON_VERSION_REASON_HUB = ADDON_VERSION_REASON_HUB;
+exports.ADDON_VERSION_REASON_REGISTRY_LATEST = ADDON_VERSION_REASON_REGISTRY_LATEST;
 exports.AGENT_CAP_FWD_ACTION = AGENT_CAP_FWD_ACTION;
 exports.AGENT_CAP_FWD_SERVICE = AGENT_CAP_FWD_SERVICE;
 exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_config_addon.AGENT_DASHBOARD_ORIGINS_FIELD;
@@ -28115,6 +28228,7 @@ exports.createUdsLogger = createUdsLogger;
 exports.createUdsLoggerWithControl = createUdsLoggerWithControl;
 exports.createV8Reclaimer = createV8Reclaimer;
 exports.currentBrokerTransporter = currentBrokerTransporter;
+exports.decideAddonVersionMove = decideAddonVersionMove;
 exports.deleteModelFromDisk = require_custom_action_registry.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeCsr = require_builtins_system_config_system_config_addon.describeCsr;

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Cn as isCollectionArrayMethod, Cr as splitTranslationRef, Da as withoutCallerStamp, Dn as isObjectInput, Ea as userError, Fi as asNumber, Ii as asString$1, J as METHOD_ACCESS_MAP, Ji as emitDownForOwnedCaps, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Oa as EventCategory$1, On as isVoidInput, Pi as asJsonObject$1, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessTimeoutError, Sn as isArrayOutputSchema, Wi as createEvent$1, Xi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, _a as resolveCapMount, _r as scopesAllowDeviceCap, ai as DEVICE_SETTINGS_CONTRIBUTION_METHODS, bi as RUNTIME_DEFAULTS, ei as errMsg$1, fa as parseJsonObject, fn as extractNestedAddonId, gr as scopesAllowAddon, ha as readinessKey, ii as DATAPLANE_SECRET_HEADER$1, jr as supportedRuntimes, kn as kebabToCamel$1, n as AGENT_MDNS_TXT_KEYS, oi as DEVICE_STATUS_METHOD, pa as parseJsonUnknown, pr as resolveMethodAuth, qi as defineRecordKinds, r as ALL_CAPABILITY_DEFINITIONS, ri as CALLER_STAMPED_CAPABILITIES$1, t as AGENT_MDNS_SERVICE_TYPE, tr as procedureAuthKey, u as CATALOG_LANGS, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessRegistry, ya as scopeKey, zn as looseSchema } from "./dist-DfZKKnMP.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-Bxjub9X-.mjs";
+import { Ci as ReadinessTimeoutError, Cn as isCollectionArrayMethod, Da as userError, Dn as isObjectInput, Fi as asJsonObject$1, Gi as createEvent$1, Ii as asNumber, J as METHOD_ACCESS_MAP, Ji as defineRecordKinds, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Li as asString$1, Mr as supportedRuntimes, Oa as withoutCallerStamp, On as isVoidInput, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessRegistry, Sn as isArrayOutputSchema, Yi as emitDownForOwnedCaps, Yn as objectInputDeclaresRequiredDeviceId, Zi as expandCapMethods, _ as CatalogFileSchema, _r as scopesAllowAddon, ai as DATAPLANE_SECRET_HEADER$1, ba as scopeKey, fn as extractNestedAddonId, ga as readinessKey, ii as CALLER_STAMPED_CAPABILITIES$1, ka as EventCategory$1, kn as kebabToCamel$1, ma as parseJsonUnknown, mr as resolveMethodAuth, n as AGENT_MDNS_TXT_KEYS, nr as procedureAuthKey, oi as DEVICE_SETTINGS_CONTRIBUTION_METHODS, pa as parseJsonObject, r as ALL_CAPABILITY_DEFINITIONS, si as DEVICE_STATUS_METHOD, t as AGENT_MDNS_SERVICE_TYPE, ti as errMsg$1, u as CATALOG_LANGS, va as resolveCapMount, vn as interpolate, vr as scopesAllowDeviceCap, vt as addonSettingsCapability, wr as splitTranslationRef, xi as RUNTIME_DEFAULTS, zn as looseSchema } from "./dist-BIJXQo_j.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DKOZSFED.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
@@ -25,21 +25,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-DkkPbYwt.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-DYAJwPWu.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-6j9JDvjh.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-BUf0tYhG.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-doVPSeiy.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-xuLNi4a2.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-KIDDBuDn.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-DMFXIlMY.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-NvTeD4tg.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DAEsvFY6.mjs";
 import { r as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-DBlgWB8k.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
@@ -7525,6 +7525,34 @@ var AddonManifest = class {
 	}
 };
 //#endregion
+//#region src/kernel/addon-version-policy.ts
+/**
+* Which version an installed addon should be running (D942).
+*
+* The hub's target is the registry dist-tag `latest`. An agent's target is
+* the hub's installed version — never the registry, and never "strictly
+* newer". A missing target is an unreadable authority: a failed read changes
+* nothing (D49), including never a move downward because the registry or the
+* hub could not be asked.
+*/
+var ADDON_VERSION_REASON_REGISTRY_LATEST = "installed version differs from registry latest";
+var ADDON_VERSION_REASON_HUB = "agent follows the hub installed version";
+/**
+* Move when `installed` is not `target`. `target === null` (or empty) means
+* the authority could not be read — keep whatever is installed.
+* `installed === null` with a known target is a first install of that target.
+*/
+function decideAddonVersionMove(installed, target, reason) {
+	if (target === null || target.length === 0) return { move: false };
+	if (installed !== null && installed === target) return { move: false };
+	return {
+		move: true,
+		from: installed ?? "absent",
+		to: target,
+		reason
+	};
+}
+//#endregion
 //#region src/kernel/deps/closure-dedupe.ts
 /**
 * Closure dedupe — stop copying into every addon the libraries the server
@@ -8279,6 +8307,25 @@ function readPackageJson(pkgJsonPath) {
 function shouldSkipClosureProvidedSeed(packageName, isResolvable) {
 	return packageName === "@camstack/system" && isResolvable;
 }
+/** How long a boot-time `dist-tags.latest` read may take before it is "unreadable". */
+var REGISTRY_LATEST_TIMEOUT_MS = 15e3;
+function readInstalledPackageVersion(addonDir) {
+	try {
+		const raw = JSON.parse(fs$1.readFileSync(path$1.join(addonDir, "package.json"), "utf-8"));
+		if (raw === null || typeof raw !== "object") return null;
+		const version = Reflect.get(raw, "version");
+		return typeof version === "string" && version.length > 0 ? version : null;
+	} catch {
+		return null;
+	}
+}
+function distTagLatest(body) {
+	if (body === null || typeof body !== "object") return null;
+	const tags = Reflect.get(body, "dist-tags");
+	if (tags === null || typeof tags !== "object") return null;
+	const latest = Reflect.get(tags, "latest");
+	return typeof latest === "string" && latest.length > 0 ? latest : null;
+}
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -8329,6 +8376,7 @@ var AddonInstaller = class AddonInstaller {
 	isPackageResolvable;
 	/** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
 	closureNodeModulesDir;
+	resolveLatestVersionOverride;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -8351,6 +8399,7 @@ var AddonInstaller = class AddonInstaller {
 		this.manifest = new AddonManifest(config.addonsDir);
 		this.isPackageResolvable = config.isPackageResolvable;
 		this.closureNodeModulesDir = config.closureNodeModulesDir;
+		this.resolveLatestVersionOverride = config.resolveLatestVersion;
 		if (config.installSource) this.installSource = config.installSource;
 		else this.installSource = "npm";
 	}
@@ -8464,10 +8513,13 @@ var AddonInstaller = class AddonInstaller {
 	* defaults to npm in production.
 	*
 	* There is no version argument and there is deliberately no pin: the system is
-	* addons-agnostic and `latest` is the whole contract at first boot (operator,
-	* 2026-08-13). A copy already under the addon root is never replaced either —
-	* bootstrap is seed-only, and overwriting a deployed bundle would be an
-	* un-deploy ([D90](../../../../docs/decisions/adr-0090.md)).
+	* addons-agnostic and `latest` is the whole contract (operator, 2026-08-13,
+	* restated 2026-10-25 — D942). A copy already under the addon root is left
+	* alone when this installer is not on the npm source (a workspace or a
+	* bundled desktop seed) and when the package is the closure-provided
+	* `@camstack/system` (a copy there would shadow the closure). Every other
+	* required addon already on disk is moved to registry `latest` when that
+	* tag differs, higher or lower. An unreadable registry changes nothing.
 	*
 	* @param packages — optional custom package list (default: REQUIRED_PACKAGES)
 	*/
@@ -8483,7 +8535,16 @@ var AddonInstaller = class AddonInstaller {
 		for (const packageName of pkgList) {
 			const addonDir = path$1.join(this.addonsDir, packageName);
 			if (fs$1.existsSync(path$1.join(addonDir, "package.json"))) {
-				this.logger.debug(`${packageName} — already installed, skipping`);
+				if (this.installSource !== "npm" || shouldSkipClosureProvidedSeed(packageName, this.isResolvableFromClosure(packageName))) {
+					this.logger.debug(`${packageName} — already installed, skipping`);
+					continue;
+				}
+				try {
+					await this.followInstalledAddonToLatest(packageName, addonDir);
+				} catch (err) {
+					const msg = errMsg$1(err);
+					this.logger.error(`Failed to move ${packageName} to registry latest`, { meta: { error: msg } });
+				}
 				continue;
 			}
 			if (shouldSkipClosureProvidedSeed(packageName, this.isResolvableFromClosure(packageName))) {
@@ -8508,6 +8569,56 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	/**
+	* Move an already-installed required addon to registry `latest` when the
+	* installed version differs. `applyUpdate` keeps the previous tree as a
+	* backup and restores it if the install throws. A null latest (registry
+	* down, or no tag) leaves the copy where it is.
+	*/
+	async followInstalledAddonToLatest(packageName, addonDir) {
+		const installedVersion = readInstalledPackageVersion(addonDir);
+		const decision = decideAddonVersionMove(installedVersion, await this.readRegistryLatest(packageName), ADDON_VERSION_REASON_REGISTRY_LATEST);
+		if (!decision.move) {
+			this.logger.debug(`${packageName} — installed copy matches registry latest, or the registry could not be read`);
+			return;
+		}
+		this.logger.info(`${packageName} — moving ${decision.from} → ${decision.to}: ${decision.reason}`, { meta: {
+			from: decision.from,
+			to: decision.to,
+			reason: decision.reason
+		} });
+		if (this.manifest.get(packageName) == null) this.manifest.upsert(packageName, {
+			version: installedVersion ?? "0.0.0",
+			source: "npm"
+		});
+		await this.applyUpdate(packageName, decision.to);
+	}
+	/** `dist-tags.latest`, or `null` when the registry cannot be read. */
+	async readRegistryLatest(packageName) {
+		if (this.resolveLatestVersionOverride) try {
+			return await this.resolveLatestVersionOverride(packageName);
+		} catch (err) {
+			this.logger.warn(`${packageName} — registry unreadable, leaving the installed copy`, { meta: { error: errMsg$1(err) } });
+			return null;
+		}
+		return this.fetchRegistryLatest(packageName);
+	}
+	async fetchRegistryLatest(packageName) {
+		const metadataUrl = `${(this.registry ?? "https://registry.npmjs.org").replace(/\/+$/, "")}/${encodeURIComponent(packageName).replace(/^%40/, "@")}`;
+		try {
+			const metadataRes = await fetch(metadataUrl, { signal: AbortSignal.timeout(REGISTRY_LATEST_TIMEOUT_MS) });
+			if (!metadataRes.ok) {
+				this.logger.warn(`${packageName} — registry answered ${metadataRes.status}, leaving the installed copy`);
+				return null;
+			}
+			const latest = distTagLatest(await metadataRes.json());
+			if (latest === null) this.logger.warn(`${packageName} — registry returned no dist-tags.latest, leaving the installed copy`);
+			return latest;
+		} catch (err) {
+			this.logger.warn(`${packageName} — registry unreadable, leaving the installed copy`, { meta: { error: errMsg$1(err) } });
+			return null;
+		}
+	}
+	/**
 	* Reconcile the install manifest against the addons actually present on
 	* disk: register seeded addons, correct a version that disagrees with the
 	* installed `package.json`, and drop entries naming a directory that does
@@ -27767,4 +27878,4 @@ function resetCatalogRegistryForTests() {
 }
 //#endregion
 var readAllRows = import_read_all_rows.readAllRows;
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, RecordsEngine, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADDON_VERSION_REASON_HUB, ADDON_VERSION_REASON_REGISTRY_LATEST, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, RecordsEngine, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, decideAddonVersionMove, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/addon-installer.d.ts

@@ -61,6 +61,12 @@ export interface AddonInstallerConfig {
 	* specs point it at a fabricated closure dir.
 	*/
 	readonly closureNodeModulesDir?: string;
+	/**
+	* Resolve dist-tag `latest` for a package. `null` means the registry could
+	* not be read — the caller leaves the installed copy alone (D942, D49).
+	* Production leaves it unset and asks the registry; specs inject it.
+	*/
+	readonly resolveLatestVersion?: (packageName: string) => Promise<string | null>;
 }
 import type { InstalledPackage, IScopedLogger } from "@camstack/types";
 import { AddonManifest } from "./addon-manifest.js";
@@ -123,6 +129,7 @@ export declare class AddonInstaller {
 	private readonly isPackageResolvable?;
 	/** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
 	private readonly closureNodeModulesDir;
+	private readonly resolveLatestVersionOverride;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -206,15 +213,28 @@ export declare class AddonInstaller {
 	* defaults to npm in production.
 	*
 	* There is no version argument and there is deliberately no pin: the system is
-	* addons-agnostic and `latest` is the whole contract at first boot (operator,
-	* 2026-08-13). A copy already under the addon root is never replaced either —
-	* bootstrap is seed-only, and overwriting a deployed bundle would be an
-	* un-deploy ([D90](../../../../docs/decisions/adr-0090.md)).
+	* addons-agnostic and `latest` is the whole contract (operator, 2026-08-13,
+	* restated 2026-10-25 — D942). A copy already under the addon root is left
+	* alone when this installer is not on the npm source (a workspace or a
+	* bundled desktop seed) and when the package is the closure-provided
+	* `@camstack/system` (a copy there would shadow the closure). Every other
+	* required addon already on disk is moved to registry `latest` when that
+	* tag differs, higher or lower. An unreadable registry changes nothing.
 	*
 	* @param packages — optional custom package list (default: REQUIRED_PACKAGES)
 	*/
 	ensureRequiredPackages(packages?: readonly string[]): Promise<void>;
 	/**
+	* Move an already-installed required addon to registry `latest` when the
+	* installed version differs. `applyUpdate` keeps the previous tree as a
+	* backup and restores it if the install throws. A null latest (registry
+	* down, or no tag) leaves the copy where it is.
+	*/
+	private followInstalledAddonToLatest;
+	/** `dist-tags.latest`, or `null` when the registry cannot be read. */
+	private readRegistryLatest;
+	private fetchRegistryLatest;
+	/**
 	* Reconcile the install manifest against the addons actually present on
 	* disk: register seeded addons, correct a version that disagrees with the
 	* installed `package.json`, and drop entries naming a directory that does

package/dist/kernel/addon-version-policy.d.ts

@@ -0,0 +1,26 @@
+/**
+* Which version an installed addon should be running (D942).
+*
+* The hub's target is the registry dist-tag `latest`. An agent's target is
+* the hub's installed version — never the registry, and never "strictly
+* newer". A missing target is an unreadable authority: a failed read changes
+* nothing (D49), including never a move downward because the registry or the
+* hub could not be asked.
+*/
+export declare const ADDON_VERSION_REASON_REGISTRY_LATEST: "installed version differs from registry latest";
+export declare const ADDON_VERSION_REASON_HUB: "agent follows the hub installed version";
+export type AddonVersionReason = typeof ADDON_VERSION_REASON_REGISTRY_LATEST | typeof ADDON_VERSION_REASON_HUB;
+export type AddonVersionMove = {
+	readonly move: false;
+} | {
+	readonly move: true;
+	readonly from: string;
+	readonly to: string;
+	readonly reason: AddonVersionReason;
+};
+/**
+* Move when `installed` is not `target`. `target === null` (or empty) means
+* the authority could not be read — keep whatever is installed.
+* `installed === null` with a known target is a first install of that target.
+*/
+export declare function decideAddonVersionMove(installed: string | null, target: string | null, reason: AddonVersionReason): AddonVersionMove;

package/dist/kernel/index.d.ts

@@ -3,6 +3,8 @@ export { AddonLoader } from "./addon-loader.js";
 export { AddonEngineManager } from "./addon-engine-manager.js";
 export type { AddonInstallerConfig, InstallSource, InstalledPackage } from "./addon-installer.js";
 export { AddonInstaller } from "./addon-installer.js";
+export type { AddonVersionMove, AddonVersionReason } from "./addon-version-policy.js";
+export { ADDON_VERSION_REASON_HUB, ADDON_VERSION_REASON_REGISTRY_LATEST, decideAddonVersionMove } from "./addon-version-policy.js";
 export type { AddonInstallSource, AddonManifestEntry, AddonManifestFile } from "./addon-manifest.js";
 export { AddonManifest } from "./addon-manifest.js";
 export type { AddonDirCandidate, QuarantinedEntry, ResidueQuarantineResult, ResidueReason, ResidueVerdict } from "./addon-residue.js";