@camstack/system 1.2.69 → 1.2.71

package/dist/{model-download-service-Caj1kaSi.js → file-data-plane-DUHPHa-Y.js}

@@ -1,943 +1,943 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
 let node_crypto = require("node:crypto");
-let node_http = require("node:http");
-let node_fs = require("node:fs");
-node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_util = require("node:util");
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
+let node_http = require("node:http");
 let node_zlib = require("node:zlib");
-//#region src/http/authenticated-file-server.ts
+//#region src/download/model-downloader.ts
+function isNonEmptyFile(filePath) {
+	return node_fs.existsSync(filePath) && node_fs.statSync(filePath).size > 0;
+}
 /**
-* Authenticated data-plane file-server — a shared host primitive for addons that
-* must serve files (media segments, scrub-frame stores, exported clips) directly
-* to browsers/players, node-direct (NOT through the hub tRPC, per the recording
-* design's "no media bytes traverse the hub").
-*
-* It bundles the three things every such server needs so addons don't re-roll
-* them: CORS (the data plane is cross-origin from the admin-ui — a native
-* `<video src>` is exempt but hls.js / WebCodecs fetch via XHR and are blocked
-* without it), HTTP `Range` (seeking / partial fetch), and a SCOPED TOKEN check.
-*
-* The token rides as the FIRST path segment (`<urlPrefix><token>/<relPath>`) so
-* a player resolving a manifest's RELATIVE child URIs carries it on every
-* sub-request automatically — no per-URI rewriting, no cookies/headers a dumb
-* player can't set. The caller supplies `verifyToken(token, relPath)`; the
-* primitive stays auth-scheme-agnostic.
+* Sibling files of a single-file (non-directory) format — extra files the
+* format needs, fetched from the same remote directory as `url` and stored
+* flat alongside the main file in `modelsDir`. Catalog-declared via
+* `formatEntry.files`, e.g. OpenVINO IR lists its `.bin` weights next to the
+* `.xml`. The downloader stays format-agnostic; the convention lives in the
+* catalog data (like `MLPACKAGE_FILES` for the directory case).
+*/
+function siblingFilesFor(formatEntry) {
+	return formatEntry.isDirectory ? [] : formatEntry.files ?? [];
+}
+/** Resolve a sibling's remote URL relative to the main file's directory. */
+function siblingUrl(mainUrl, sibling) {
+	return mainUrl.replace(/[^/]+$/, sibling);
+}
+/**
+* The relative filenames a model format occupies under `modelsDir` — the main
+* file (URL basename, or `${id}.${format}` fallback), its declared siblings
+* (e.g. the OpenVINO `.bin` next to the `.xml`), and any `extraFiles`. For a
+* directory bundle the single entry is the bundle dir itself (tar/extract
+* recurse into it).
 *
-* Pure helpers (`parseTokenizedUrl`, `resolveFilePath`, `contentTypeFor`,
-* `parseRangeHeader`) are exported for unit testing; `createAuthenticatedFileServer`
-* is the thin `node:http` glue.
+* Used by model distribution (P2): the hub tars exactly these names from its
+* `modelsDir` and the agent untars them into its own `modelsDir`, so both ends
+* agree on the on-disk layout without re-deriving it.
 */
-function corsHeaders(origin) {
-	return {
-		"access-control-allow-origin": origin,
-		"access-control-allow-methods": "GET, HEAD, OPTIONS",
-		"access-control-allow-headers": "range",
-		"access-control-expose-headers": "content-length, content-range, accept-ranges",
-		"access-control-max-age": "86400"
-	};
+function collectModelFiles(entry, format) {
+	const formatEntry = entry.formats[format];
+	if (!formatEntry) return [];
+	const names = [formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`, ...siblingFilesFor(formatEntry)];
+	for (const extra of entry.extraFiles ?? []) names.push(extra.filename);
+	return names;
+}
+/** Build fetch headers, including HF auth token for huggingface.co URLs */
+function buildHeaders(url) {
+	const headers = { "User-Agent": "CamStack/1.0" };
+	const hfToken = process.env["HF_TOKEN"] ?? process.env["HUGGING_FACE_HUB_TOKEN"];
+	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
+	return headers;
 }
 /**
-* Split a request URL (`<urlPrefix><token>/<relPath>`) into its token + rel
-* path. Returns null for anything outside the prefix or missing either part.
-* `relPath` is URL-decoded; a decode failure → null.
+* Download a single file from a URL to a destination path.
+* Uses native fetch() (Node 22+) which handles redirects natively.
+* Streams to disk with optional progress callback.
+* Returns the destination path. Skips download if file already exists.
 */
-function parseTokenizedUrl(urlPrefix, urlPath) {
-	if (!urlPath.startsWith(urlPrefix)) return null;
-	const after = urlPath.slice(urlPrefix.length);
-	const slash = after.indexOf("/");
-	if (slash <= 0) return null;
-	const token = after.slice(0, slash);
-	let rel;
+async function downloadFile(url, destPath, onProgress) {
+	if (node_fs.existsSync(destPath)) return destPath;
+	node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
+	const tmpPath = destPath + ".downloading";
 	try {
-		rel = decodeURIComponent(after.slice(slash + 1));
-	} catch {
-		return null;
+		const response = await fetch(url, {
+			redirect: "follow",
+			headers: buildHeaders(url)
+		});
+		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
+		if (!response.body) throw new Error(`No response body from ${url}`);
+		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
+		let downloaded = 0;
+		const fileStream = node_fs.createWriteStream(tmpPath);
+		const reader = response.body.getReader();
+		try {
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done || !value) break;
+				fileStream.write(value);
+				downloaded += value.length;
+				onProgress?.(downloaded, total);
+			}
+		} finally {
+			fileStream.end();
+			await new Promise((resolve, reject) => {
+				fileStream.on("finish", resolve);
+				fileStream.on("error", reject);
+			});
+		}
+		node_fs.renameSync(tmpPath, destPath);
+		return destPath;
+	} catch (err) {
+		try {
+			node_fs.unlinkSync(tmpPath);
+		} catch {}
+		throw err;
 	}
-	if (rel.length === 0) return null;
-	return {
-		token,
-		rel
-	};
 }
 /**
-* Map a rel path to one candidate absolute path PER root, keeping only roots the
-* path stays within (traversal guard). The handler serves the first candidate
-* that exists. Rejects a path that escapes every root.
+* Fetch JSON from a URL using native fetch().
 */
-function resolveFilePath(roots, rel) {
-	if (rel.length === 0) return { error: "forbidden" };
-	const candidates = [];
-	for (const rootDir of roots) {
-		const root = node_path.default.resolve(rootDir);
-		const abs = node_path.default.resolve(root, rel);
-		if (abs === root || abs.startsWith(root + node_path.default.sep)) candidates.push(abs);
-	}
-	if (candidates.length === 0) return { error: "forbidden" };
-	return { candidates };
-}
-var DEFAULT_CONTENT_TYPES = {
-	".m3u8": "application/vnd.apple.mpegurl",
-	".m4s": "video/mp4",
-	".mp4": "video/mp4",
-	".idx": "application/octet-stream",
-	".html": "text/html; charset=utf-8",
-	".js": "application/javascript; charset=utf-8",
-	".mjs": "application/javascript; charset=utf-8",
-	".css": "text/css; charset=utf-8",
-	".json": "application/json; charset=utf-8",
-	".map": "application/json; charset=utf-8",
-	".svg": "image/svg+xml",
-	".png": "image/png",
-	".jpg": "image/jpeg",
-	".jpeg": "image/jpeg",
-	".ico": "image/x-icon",
-	".woff2": "font/woff2",
-	".woff": "font/woff",
-	".ttf": "font/ttf"
-};
-function contentTypeFor(filePath, overrides) {
-	const ext = node_path.default.extname(filePath).toLowerCase();
-	return overrides?.[ext] ?? DEFAULT_CONTENT_TYPES[ext] ?? "application/octet-stream";
-}
-/** Parse an HTTP `Range` header against a known size. Null = serve whole file. */
-function parseRangeHeader(header, size) {
-	if (!header) return null;
-	const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
-	if (!m) return null;
-	const [, rawStart, rawEnd] = m;
-	if (rawStart === "" && rawEnd === "") return null;
-	let start;
-	let end;
-	if (rawStart === "") {
-		const n = Number(rawEnd);
-		if (n <= 0) return null;
-		start = Math.max(0, size - n);
-		end = size - 1;
-	} else {
-		start = Number(rawStart);
-		end = rawEnd === "" ? size - 1 : Number(rawEnd);
-	}
-	if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || start >= size) return null;
-	return {
-		start,
-		end: Math.min(end, size - 1)
-	};
+async function fetchJson(url) {
+	const response = await fetch(url, {
+		redirect: "follow",
+		headers: buildHeaders(url)
+	});
+	if (!response.ok) throw new Error(`HTTP ${response.status} fetching ${url}`);
+	return response.json();
 }
 /**
-* Start an authenticated file-server. Returns the bound port so the caller can
-* build URLs. `getRoots`/`verifyToken` are invoked per request, so they always
-* reflect the live config.
+* Download a model with fallback URLs and optional SHA256 verification.
+* Legacy API preserved for backward compatibility -- delegates to downloadFile().
 */
-async function createAuthenticatedFileServer(opts) {
-	const cors = corsHeaders(opts.corsOrigin ?? "*");
-	const server = (0, node_http.createServer)((req, res) => {
-		handle(opts, cors, req, res);
-	});
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(opts.port, () => resolve());
-	});
-	const addr = server.address();
-	return {
-		port: typeof addr === "object" && addr ? addr.port : opts.port,
-		close: () => new Promise((resolve) => server.close(() => resolve()))
+async function downloadModel(options) {
+	const { url, fallbackUrls = [], destDir, filename, expectedSha256, onProgress } = options;
+	const fname = filename ?? url.split("/").pop() ?? "model.bin";
+	const destPath = node_path.join(destDir, fname);
+	if (node_fs.existsSync(destPath)) return {
+		filePath: destPath,
+		downloadedBytes: 0,
+		fromCache: true
 	};
-}
-async function handle(opts, cors, req, res) {
-	if (req.method === "OPTIONS") {
-		res.writeHead(204, cors).end();
-		return;
-	}
-	if (req.method !== "GET" && req.method !== "HEAD") {
-		res.writeHead(405, cors).end();
-		return;
+	node_fs.mkdirSync(destDir, { recursive: true });
+	const urls = [url, ...fallbackUrls];
+	let lastError = null;
+	for (const tryUrl of urls) try {
+		await downloadFile(tryUrl, destPath, onProgress);
+		if (expectedSha256) {
+			const hash = await computeSha256(destPath);
+			if (hash !== expectedSha256) {
+				node_fs.unlinkSync(destPath);
+				throw new Error(`SHA256 mismatch: expected ${expectedSha256}, got ${hash}`);
+			}
+		}
+		return {
+			filePath: destPath,
+			downloadedBytes: node_fs.statSync(destPath).size,
+			fromCache: false
+		};
+	} catch (e) {
+		lastError = e;
+		if (node_fs.existsSync(destPath)) node_fs.unlinkSync(destPath);
 	}
-	const urlPath = (req.url ?? "").split("?")[0] ?? "";
-	const parsed = parseTokenizedUrl(opts.urlPrefix, urlPath);
-	if (!parsed) {
-		res.writeHead(403, cors).end();
-		return;
-	}
-	if (!opts.verifyToken(parsed.token, parsed.rel)) {
-		res.writeHead(401, cors).end();
-		return;
-	}
-	const resolved = resolveFilePath(opts.getRoots(), parsed.rel);
-	if ("error" in resolved) {
-		res.writeHead(403, cors).end();
-		return;
-	}
-	let absPath = null;
-	let size = 0;
-	for (const candidate of resolved.candidates) try {
-		const st = await node_fs.promises.stat(candidate);
-		if (st.isFile()) {
-			absPath = candidate;
-			size = st.size;
-			break;
+	throw lastError ?? /* @__PURE__ */ new Error(`Failed to download model from ${url}`);
+}
+async function computeSha256(filePath) {
+	return new Promise((resolve, reject) => {
+		const hash = (0, node_crypto.createHash)("sha256");
+		const stream = node_fs.createReadStream(filePath);
+		stream.on("data", (chunk) => hash.update(chunk));
+		stream.on("end", () => resolve(hash.digest("hex")));
+		stream.on("error", reject);
+	});
+}
+/**
+* Download every file in a HuggingFace directory bundle (e.g.,
+* `.mlpackage` / OpenVINO IR pair) atomically. `knownFiles` lists the
+* relative paths inside the directory; the function fetches each from
+* `${url}/${file}` and renames the staging directory only on full
+* success. Mirrors `ModelDownloadService.downloadDirectory` but
+* exposed as a standalone for catalog-less callers.
+*/
+async function downloadDirectory(url, destDir, knownFiles, onProgress) {
+	const match = url.match(/huggingface\.co\/([^/]+\/[^/]+)\/resolve\/main\/(.+)/);
+	if (!match) throw new Error(`Cannot parse HuggingFace URL: ${url}`);
+	const [, repo, dirPath] = match;
+	const files = (knownFiles ?? []).map((f) => ({
+		relativePath: f,
+		fileUrl: `https://huggingface.co/${repo}/resolve/main/${dirPath}/${f}`
+	}));
+	if (files.length === 0) throw new Error(`Directory bundle requires explicit \`files\` list (got none for ${url})`);
+	const tmpDir = destDir + ".downloading";
+	node_fs.rmSync(tmpDir, {
+		recursive: true,
+		force: true
+	});
+	node_fs.mkdirSync(tmpDir, { recursive: true });
+	let totalDownloaded = 0;
+	try {
+		for (const file of files) {
+			const destPath = node_path.join(tmpDir, file.relativePath);
+			node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
+			await downloadFile(file.fileUrl, destPath, (downloaded, _total) => {
+				onProgress?.(totalDownloaded + downloaded, void 0);
+			});
+			totalDownloaded += node_fs.statSync(destPath).size;
 		}
-	} catch {}
-	if (absPath === null) {
-		res.writeHead(404, cors).end();
-		return;
-	}
-	const baseHeaders = {
-		...cors,
-		"content-type": contentTypeFor(absPath, opts.contentTypes),
-		"accept-ranges": "bytes",
-		"cache-control": "no-cache"
-	};
-	const range = parseRangeHeader(req.headers.range, size);
-	if (range) {
-		res.writeHead(206, {
-			...baseHeaders,
-			"content-range": `bytes ${range.start}-${range.end}/${size}`,
-			"content-length": String(range.end - range.start + 1)
+		node_fs.rmSync(destDir, {
+			recursive: true,
+			force: true
 		});
-		if (req.method === "HEAD") {
-			res.end();
-			return;
-		}
-		(0, node_fs.createReadStream)(absPath, {
-			start: range.start,
-			end: range.end
-		}).pipe(res);
-		return;
+		node_fs.renameSync(tmpDir, destDir);
+	} catch (err) {
+		node_fs.rmSync(tmpDir, {
+			recursive: true,
+			force: true
+		});
+		throw err;
 	}
-	res.writeHead(200, {
-		...baseHeaders,
-		"content-length": String(size)
+}
+/**
+* Resolve a `ModelCatalogEntry` against `modelsDir`: download model file
+* (or directory bundle) + extra files (labels JSON, charset dict, …),
+* skip if already on disk. Returns the local model path.
+*/
+async function ensureModel(modelsDir, entry, format, onProgress) {
+	const formatEntry = entry.formats[format];
+	if (!formatEntry) throw new Error(`Model "${entry.id}" has no ${format} format. Available: ${Object.keys(entry.formats).join(", ")}`);
+	if (entry.extraFiles) for (const extra of entry.extraFiles) await downloadFile(extra.url, node_path.join(modelsDir, extra.filename));
+	const filename = formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`;
+	const modelPath = node_path.join(modelsDir, filename);
+	const siblings = siblingFilesFor(formatEntry);
+	if (node_fs.existsSync(modelPath)) if (formatEntry.isDirectory && !node_fs.existsSync(node_path.join(modelPath, "Manifest.json"))) node_fs.rmSync(modelPath, {
+		recursive: true,
+		force: true
 	});
-	if (req.method === "HEAD") {
-		res.end();
-		return;
+	else if (siblings.some((f) => !isNonEmptyFile(node_path.join(modelsDir, f)))) {} else return modelPath;
+	node_fs.mkdirSync(modelsDir, { recursive: true });
+	if (formatEntry.isDirectory) await downloadDirectory(formatEntry.url, modelPath, formatEntry.files, onProgress);
+	else {
+		await downloadFile(formatEntry.url, modelPath, (downloaded, total) => onProgress?.(downloaded, total === 0 ? void 0 : total));
+		for (const sibling of siblings) await downloadFile(siblingUrl(formatEntry.url, sibling), node_path.join(modelsDir, sibling));
 	}
-	(0, node_fs.createReadStream)(absPath).pipe(res);
+	return modelPath;
+}
+/** Compute the on-disk path for a given model + format, even when not yet downloaded. */
+function getModelFilePath(modelsDir, entry, format) {
+	const formatEntry = entry.formats[format];
+	if (!formatEntry) return null;
+	const filename = formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`;
+	return node_path.join(modelsDir, filename);
+}
+/** True iff the model file (or `Manifest.json` for directory bundles) exists and is non-empty. */
+function isModelDownloaded(modelsDir, entry, format) {
+	const formatEntry = entry.formats[format];
+	if (!formatEntry) return false;
+	const modelPath = getModelFilePath(modelsDir, entry, format);
+	if (!modelPath || !node_fs.existsSync(modelPath)) return false;
+	if (formatEntry.isDirectory) return node_fs.existsSync(node_path.join(modelPath, "Manifest.json"));
+	if (node_fs.statSync(modelPath).size <= 0) return false;
+	return siblingFilesFor(formatEntry).every((f) => isNonEmptyFile(node_path.join(modelsDir, f)));
+}
+/** Remove the on-disk model file/directory. Returns true if something was deleted. */
+function deleteModelFromDisk(modelsDir, entry, format) {
+	const modelPath = getModelFilePath(modelsDir, entry, format);
+	if (!modelPath || !node_fs.existsSync(modelPath)) return false;
+	const formatEntry = entry.formats[format];
+	if (formatEntry?.isDirectory) node_fs.rmSync(modelPath, {
+		recursive: true,
+		force: true
+	});
+	else {
+		node_fs.unlinkSync(modelPath);
+		if (formatEntry) for (const sibling of siblingFilesFor(formatEntry)) {
+			const sibPath = node_path.join(modelsDir, sibling);
+			if (node_fs.existsSync(sibPath)) node_fs.unlinkSync(sibPath);
+		}
+	}
+	return true;
 }
 //#endregion
-//#region src/http/asset-compression.ts
+//#region src/download/model-download-service.ts
 /**
-* Content-coding for addon-served static assets: `Accept-Encoding` negotiation,
-* an eligibility rule, and a BOUNDED cache of the compressed bytes.
-*
-* ## Why the ADDON owns the encoding
-*
-* The hub's `/addon/:addonId/*` bridge is registered `{ compress: false }`. That
-* is not an oversight — on 2026-07-16 the global `@fastify/compress` was found
-* emitting an EMPTY brotli stream (`content-encoding: br`, `content-length: 0`)
-* for any compressible body over its 1 KiB threshold once the body had crossed
-* the UDS route bridge of a FORKED addon. It silently broke the notifier SVG
-* icons; the deploy-bundle pull route had already dodged the same class with
-* `compress: false`. The resolution then, and the contract now, is that an addon
-* route owns its content-coding END TO END: it negotiates, it compresses, it
-* stamps `content-encoding` + `Vary`, and the hub pipes those bytes through
-* untouched (`proxyToUpstream` replays the upstream headers verbatim).
-*
-* So compression belongs HERE, in the shared file data-plane, and nowhere above
-* it. Anything that re-compresses on top of this reintroduces the empty-brotli
-* bug rather than doubling the ratio.
-*
-* ## Why the bytes are cached, and why the cache is bounded
-*
-* Measured on the stream-broker embed bundle (`index-<hash>.js`, 1,443,142 B):
-* gzip-6 → 360,868 B, brotli-5 → 327,419 B in 27 ms, brotli-11 → 293,677 B in
-* 2,233 ms. Quality 5 is the request-path choice: 77% off the wire for 27 ms
-* paid ONCE. Quality 11 buys another 2.3% for eighty times the CPU, on a path
-* where a real client is waiting.
+* Unified model download service.
 *
-* The cache is an LRU bounded by BOTH entry count and total bytes, and it
-* refuses assets over {@link COMPRESSION_MAX_ASSET_BYTES} outright. An unbounded
-* `Map` keyed by URL is how a long-lived process walks into an OOM, and this
-* repo has already spent a session on one.
+* Handles downloading model files and extra files (labels, dicts) from a
+* catalog of ModelCatalogEntry items. Supports single-file models and
+* directory bundles (e.g., .mlpackage for CoreML).
 *
-* The key carries `mtimeMs` and `size`, so a rebuild that rewrites an asset in
-* place under an UNCHANGED name (an SPA shell, a service worker) can never be
-* served from the previous build's bytes.
-*/
-var brotliAsync = (0, node_util.promisify)(node_zlib.brotliCompress);
-var gzipAsync = (0, node_util.promisify)(node_zlib.gzip);
-/** LRU bounds. Both are enforced; whichever binds first evicts. */
-var MAX_CACHE_ENTRIES = 64;
-var MAX_CACHE_BYTES = 32 * 1024 * 1024;
-/** Brotli quality — see the file header for the measured trade. */
-var BROTLI_QUALITY = 5;
-/**
-* Content types worth compressing. An ALLOW-list, not a deny-list: an unknown
-* type (`application/octet-stream`) is assumed to be opaque binary. This is what
-* keeps jpeg/png/webp/mp4/m4s/woff2 out — running brotli over them burns CPU to
-* make the body marginally BIGGER.
+* Addons use this via `context.models.ensure(modelId, format)`.
 */
-var COMPRESSIBLE_EXACT = new Set([
-	"application/javascript",
-	"application/ecmascript",
-	"application/json",
-	"application/manifest+json",
-	"application/wasm",
-	"application/xml",
-	"application/xhtml+xml",
-	"application/vnd.apple.mpegurl",
-	"image/svg+xml"
-]);
-/** Is a body of this content type worth compressing at all? */
-function isCompressibleContentType(contentType) {
-	const base = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
-	if (base.length === 0) return false;
-	if (base.startsWith("text/")) return true;
-	if (base.endsWith("+json") || base.endsWith("+xml")) return true;
-	return COMPRESSIBLE_EXACT.has(base);
-}
-/** Parse `Accept-Encoding` into tokens with their q-values (default 1). */
-function parseAcceptEncoding(header) {
-	if (header === void 0 || header.trim().length === 0) return [];
-	const out = [];
-	for (const part of header.split(",")) {
-		const [rawToken, ...params] = part.split(";");
-		const token = rawToken?.trim().toLowerCase() ?? "";
-		if (token.length === 0) continue;
-		let q = 1;
-		for (const param of params) {
-			const [name, value] = param.split("=");
-			if (name?.trim().toLowerCase() !== "q") continue;
-			const parsed = Number(value?.trim());
-			q = Number.isFinite(parsed) ? parsed : 1;
+var ModelDownloadService = class {
+	modelsDir;
+	onProgress;
+	catalog;
+	constructor(modelsDir, catalog, onProgress) {
+		this.modelsDir = modelsDir;
+		this.onProgress = onProgress;
+		const map = /* @__PURE__ */ new Map();
+		for (const entry of catalog) map.set(entry.id, entry);
+		this.catalog = map;
+	}
+	/**
+	* Ensure a model (and its extra files) is downloaded.
+	* Returns the local filesystem path to the model file/directory.
+	*/
+	async ensure(modelId, format) {
+		const entry = this.catalog.get(modelId);
+		if (!entry) throw new Error(`ModelDownloadService: unknown model "${modelId}"`);
+		const selectedFormat = format ?? this.pickDefaultFormat(entry);
+		const formatEntry = entry.formats[selectedFormat];
+		if (!formatEntry) throw new Error(`ModelDownloadService: model "${modelId}" has no ${selectedFormat} format`);
+		await this.ensureExtraFiles(modelId);
+		const modelPath = this.modelFilePath(entry, selectedFormat);
+		const siblings = siblingFilesFor(formatEntry);
+		if (node_fs.existsSync(modelPath)) {
+			if (formatEntry.isDirectory) if (!node_fs.existsSync(node_path.join(modelPath, "Manifest.json"))) node_fs.rmSync(modelPath, {
+				recursive: true,
+				force: true
+			});
+			else return modelPath;
+			else if (siblings.every((f) => isNonEmptyFile(node_path.join(this.modelsDir, f)))) return modelPath;
 		}
-		out.push({
-			token,
-			q
+		node_fs.mkdirSync(this.modelsDir, { recursive: true });
+		if (formatEntry.isDirectory) await this.downloadDirectory(formatEntry.url, modelPath, formatEntry.files, modelId);
+		else {
+			await downloadFile(formatEntry.url, modelPath, this.onProgress ? (downloaded, total) => this.onProgress(modelId, downloaded, total) : void 0);
+			for (const sibling of siblings) await downloadFile(siblingUrl(formatEntry.url, sibling), node_path.join(this.modelsDir, sibling));
+		}
+		return modelPath;
+	}
+	/**
+	* Ensure extra files for a model are downloaded.
+	* Returns the local paths of all extra files.
+	*/
+	async ensureExtraFiles(modelId) {
+		const entry = this.catalog.get(modelId);
+		if (!entry) throw new Error(`ModelDownloadService: unknown model "${modelId}"`);
+		const extras = entry.extraFiles;
+		if (!extras || extras.length === 0) return [];
+		const paths = [];
+		for (const extra of extras) {
+			const destPath = node_path.join(this.modelsDir, extra.filename);
+			await downloadFile(extra.url, destPath);
+			paths.push(destPath);
+		}
+		return paths;
+	}
+	/** Absolute path to the shared models directory. */
+	getModelsDir() {
+		return this.modelsDir;
+	}
+	/** Check if a model file is already present on disk. */
+	isDownloaded(modelId, format) {
+		const entry = this.catalog.get(modelId);
+		if (!entry) return false;
+		const selectedFormat = format ?? this.pickDefaultFormat(entry);
+		const formatEntry = entry.formats[selectedFormat];
+		if (!formatEntry) return false;
+		const modelPath = this.modelFilePath(entry, selectedFormat);
+		if (!node_fs.existsSync(modelPath)) return false;
+		if (formatEntry.isDirectory) return node_fs.existsSync(node_path.join(modelPath, "Manifest.json"));
+		if (node_fs.statSync(modelPath).size <= 0) return false;
+		return siblingFilesFor(formatEntry).every((f) => isNonEmptyFile(node_path.join(this.modelsDir, f)));
+	}
+	/** Get the catalog entry for a model by ID. */
+	getEntry(modelId) {
+		return this.catalog.get(modelId);
+	}
+	pickDefaultFormat(entry) {
+		for (const fmt of [
+			"onnx",
+			"coreml",
+			"openvino",
+			"tflite",
+			"pt"
+		]) if (entry.formats[fmt]) return fmt;
+		const first = Object.keys(entry.formats)[0];
+		if (first) return first;
+		throw new Error(`ModelDownloadService: model "${entry.id}" has no formats`);
+	}
+	modelFilePath(entry, format) {
+		const formatEntry = entry.formats[format];
+		if (!formatEntry) throw new Error(`Model ${entry.id} has no ${format} format`);
+		const urlParts = formatEntry.url.split("/");
+		const filename = urlParts[urlParts.length - 1] ?? `${entry.id}.${format}`;
+		return node_path.join(this.modelsDir, filename);
+	}
+	/**
+	* Download a directory bundle (e.g., .mlpackage) from HuggingFace.
+	* ATOMIC: downloads to temp dir, renames only on complete success.
+	*/
+	async downloadDirectory(url, destDir, knownFiles, _modelId) {
+		const match = url.match(/huggingface\.co\/([^/]+\/[^/]+)\/resolve\/main\/(.+)/);
+		if (!match) throw new Error(`Cannot parse HuggingFace URL: ${url}`);
+		const [, repo, dirPath] = match;
+		let filesToDownload;
+		if (knownFiles && knownFiles.length > 0) filesToDownload = knownFiles.map((f) => ({
+			relativePath: f,
+			fileUrl: `https://huggingface.co/${repo}/resolve/main/${dirPath}/${f}`
+		}));
+		else {
+			const hfFiles = await this.listHfFiles(repo, dirPath);
+			if (hfFiles.length === 0) throw new Error(`No files found in HuggingFace directory: ${dirPath}`);
+			filesToDownload = hfFiles.map((f) => ({
+				relativePath: f.path.substring(dirPath.length + 1),
+				fileUrl: `https://huggingface.co/${repo}/resolve/main/${f.path}`
+			}));
+		}
+		const tmpDir = destDir + ".downloading";
+		node_fs.rmSync(tmpDir, {
+			recursive: true,
+			force: true
 		});
+		node_fs.mkdirSync(tmpDir, { recursive: true });
+		try {
+			for (const file of filesToDownload) {
+				const destPath = node_path.join(tmpDir, file.relativePath);
+				node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
+				await downloadFile(file.fileUrl, destPath);
+			}
+			node_fs.rmSync(destDir, {
+				recursive: true,
+				force: true
+			});
+			node_fs.renameSync(tmpDir, destDir);
+		} catch (err) {
+			node_fs.rmSync(tmpDir, {
+				recursive: true,
+				force: true
+			});
+			throw err;
+		}
 	}
-	return out;
-}
-function accepts(prefs, token) {
-	const exact = prefs.find((p) => p.token === token);
-	if (exact) return exact.q > 0;
-	const wildcard = prefs.find((p) => p.token === "*");
-	return wildcard !== void 0 && wildcard.q > 0;
-}
+	/** Recursively list all files in a HuggingFace directory via API. */
+	async listHfFiles(repo, dirPath) {
+		const entries = await fetchJson(`https://huggingface.co/api/models/${repo}/tree/main/${dirPath}`);
+		const files = [];
+		for (const entry of entries) if (entry.type === "file") files.push({
+			path: entry.path,
+			size: entry.size ?? entry.lfs?.size ?? 0
+		});
+		else if (entry.type === "directory") {
+			const subFiles = await this.listHfFiles(repo, entry.path);
+			files.push(...subFiles);
+		}
+		return files;
+	}
+};
+//#endregion
+//#region src/http/authenticated-file-server.ts
 /**
-* Pick a coding for this request: brotli when offered, else gzip, else identity.
+* Authenticated data-plane file-server — a shared host primitive for addons that
+* must serve files (media segments, scrub-frame stores, exported clips) directly
+* to browsers/players, node-direct (NOT through the hub tRPC, per the recording
+* design's "no media bytes traverse the hub").
 *
-* Returns `null` for identity — including when the header is ABSENT. A client
-* that offers nothing gets the raw bytes; guessing on its behalf is how a
-* non-negotiating consumer (a native fetch, a probe, an OTA puller) ends up with
-* a body it cannot read.
+* It bundles the three things every such server needs so addons don't re-roll
+* them: CORS (the data plane is cross-origin from the admin-ui — a native
+* `<video src>` is exempt but hls.js / WebCodecs fetch via XHR and are blocked
+* without it), HTTP `Range` (seeking / partial fetch), and a SCOPED TOKEN check.
+*
+* The token rides as the FIRST path segment (`<urlPrefix><token>/<relPath>`) so
+* a player resolving a manifest's RELATIVE child URIs carries it on every
+* sub-request automatically — no per-URI rewriting, no cookies/headers a dumb
+* player can't set. The caller supplies `verifyToken(token, relPath)`; the
+* primitive stays auth-scheme-agnostic.
+*
+* Pure helpers (`parseTokenizedUrl`, `resolveFilePath`, `contentTypeFor`,
+* `parseRangeHeader`) are exported for unit testing; `createAuthenticatedFileServer`
+* is the thin `node:http` glue.
 */
-function negotiateContentEncoding(acceptEncoding) {
-	const prefs = parseAcceptEncoding(acceptEncoding);
-	if (prefs.length === 0) return null;
-	if (accepts(prefs, "br")) return "br";
-	if (accepts(prefs, "gzip")) return "gzip";
-	return null;
-}
-var cache = /* @__PURE__ */ new Map();
-var inFlight = /* @__PURE__ */ new Map();
-var compressions = 0;
-var hits = 0;
-var cachedBytes = 0;
-function cacheKey(key) {
-	return `${key.encoding}|${String(key.mtimeMs)}|${String(key.size)}|${key.path}`;
-}
-/** Evict least-recently-used entries until both bounds hold. */
-function evictToBounds() {
-	for (const [k, buf] of cache) {
-		if (cache.size <= MAX_CACHE_ENTRIES && cachedBytes <= MAX_CACHE_BYTES) return;
-		cache.delete(k);
-		cachedBytes -= buf.byteLength;
-	}
-}
-async function compressBody(raw, encoding) {
-	if (encoding === "gzip") return await gzipAsync(raw);
-	return await brotliAsync(raw, { params: {
-		[node_zlib.constants.BROTLI_PARAM_QUALITY]: BROTLI_QUALITY,
-		[node_zlib.constants.BROTLI_PARAM_SIZE_HINT]: raw.byteLength
-	} });
+function corsHeaders(origin) {
+	return {
+		"access-control-allow-origin": origin,
+		"access-control-allow-methods": "GET, HEAD, OPTIONS",
+		"access-control-allow-headers": "range",
+		"access-control-expose-headers": "content-length, content-range, accept-ranges",
+		"access-control-max-age": "86400"
+	};
 }
 /**
-* Compressed bytes for one asset, compressing at most once per key.
-*
-* `null` means "send the original" — the asset is too large to buffer, the
-* source could not be read, or compression did not actually shrink it. Every
-* failure degrades to identity, so this can only ever be an optimisation.
-*
-* Concurrent callers for the same key share ONE compression: a cold cache hit by
-* a dozen parallel asset requests must not run zlib a dozen times.
+* Split a request URL (`<urlPrefix><token>/<relPath>`) into its token + rel
+* path. Returns null for anything outside the prefix or missing either part.
+* `relPath` is URL-decoded; a decode failure → null.
 */
-async function getCompressedAsset(key, readSource) {
-	if (key.size > 8388608) return null;
-	const id = cacheKey(key);
-	const cached = cache.get(id);
-	if (cached) {
-		cache.delete(id);
-		cache.set(id, cached);
-		hits += 1;
-		return cached;
-	}
-	const pending = inFlight.get(id) ?? (async () => {
-		let raw;
-		try {
-			raw = await readSource();
-		} catch {
-			return null;
-		}
-		const out = await compressBody(raw, key.encoding);
-		compressions += 1;
-		if (out.byteLength >= raw.byteLength) return null;
-		cache.set(id, out);
-		cachedBytes += out.byteLength;
-		evictToBounds();
-		return out;
-	})();
-	inFlight.set(id, pending);
+function parseTokenizedUrl(urlPrefix, urlPath) {
+	if (!urlPath.startsWith(urlPrefix)) return null;
+	const after = urlPath.slice(urlPrefix.length);
+	const slash = after.indexOf("/");
+	if (slash <= 0) return null;
+	const token = after.slice(0, slash);
+	let rel;
 	try {
-		return await pending;
+		rel = decodeURIComponent(after.slice(slash + 1));
 	} catch {
 		return null;
-	} finally {
-		inFlight.delete(id);
 	}
+	if (rel.length === 0) return null;
+	return {
+		token,
+		rel
+	};
 }
-//#endregion
-//#region src/http/file-data-plane.ts
 /**
-* A ready-made data-plane request handler that serves files from a set of roots
-* with HTTP `Range`, for addons whose data-plane is "stream files off disk"
-* (recording playback, scrub-frame stores, exported clips).
-*
-* This is the addon-side handler the addon hands to `ctx.dataPlane.serve({ handler })`.
-* It receives the REAL Node `req`/`res`, resolves the request path against the
-* addon's roots (traversal-guarded), and streams the file. NO token and NO CORS:
-* the hub already authenticated the caller and the data plane is same-origin
-* through the hub's port. Reuses the shared Range/content-type/traversal helpers
-* so there is one implementation across the standalone file-server and this.
-*
-* It also owns its own CONTENT-CODING. The hub bridge is `{ compress: false }`
-* because the global compressor emits an empty brotli stream over the forked-
-* addon route bridge, so nothing above this layer will ever compress an addon
-* body — see `asset-compression.ts` for the incident and the contract.
+* Map a rel path to one candidate absolute path PER root, keeping only roots the
+* path stays within (traversal guard). The handler serves the first candidate
+* that exists. Rejects a path that escapes every root.
 */
-/** Build a `(req, res)` handler that serves `getRoots()` files with Range. */
-function createFileDataPlaneHandler(opts) {
-	return async (req, res) => {
-		if (req.method !== "GET" && req.method !== "HEAD") {
-			res.writeHead(405).end();
-			return;
-		}
-		const urlPath = (req.url ?? "/").split("?")[0] ?? "/";
-		let rel;
-		try {
-			rel = decodeURIComponent(urlPath.replace(/^\/+/, ""));
-		} catch {
-			res.writeHead(400).end();
-			return;
-		}
-		if (rel.length === 0) {
-			res.writeHead(404).end();
-			return;
-		}
-		const resolved = resolveFilePath(opts.getRoots(), rel);
-		if ("error" in resolved) {
-			res.writeHead(403).end();
-			return;
-		}
-		let absPath = null;
-		let size = 0;
-		let mtimeMs = 0;
-		for (const candidate of resolved.candidates) try {
-			const st = await node_fs.promises.stat(candidate);
-			if (st.isFile()) {
-				absPath = candidate;
-				size = st.size;
-				mtimeMs = st.mtimeMs;
-				break;
-			}
-		} catch {}
-		if (absPath === null) {
-			res.writeHead(404).end();
-			return;
-		}
-		const contentType = contentTypeFor(absPath, opts.contentTypes);
-		const compressible = isCompressibleContentType(contentType);
-		const baseHeaders = {
-			"content-type": contentType,
-			"accept-ranges": "bytes",
-			"cache-control": opts.cacheControl?.(rel) ?? "no-cache",
-			...compressible ? { vary: "accept-encoding" } : {}
-		};
-		const range = parseRangeHeader(req.headers.range, size);
-		if (range) {
-			res.writeHead(206, {
-				...baseHeaders,
-				"content-range": `bytes ${range.start}-${range.end}/${size}`,
-				"content-length": String(range.end - range.start + 1)
-			});
-			if (req.method === "HEAD") {
-				res.end();
-				return;
-			}
-			(0, node_fs.createReadStream)(absPath, {
-				start: range.start,
-				end: range.end
-			}).pipe(res);
-			return;
-		}
-		const encoding = compressible ? negotiateContentEncoding(req.headers["accept-encoding"]) : null;
-		if (encoding !== null && size >= 1024) {
-			const filePath = absPath;
-			const body = await getCompressedAsset({
-				path: filePath,
-				mtimeMs,
-				size,
-				encoding
-			}, () => node_fs.promises.readFile(filePath));
-			if (body !== null) {
-				res.writeHead(200, {
-					...baseHeaders,
-					"content-encoding": encoding,
-					"accept-ranges": "none",
-					"content-length": String(body.byteLength)
-				});
-				if (req.method === "HEAD") {
-					res.end();
-					return;
-				}
-				res.end(body);
-				return;
-			}
+function resolveFilePath(roots, rel) {
+	if (rel.length === 0) return { error: "forbidden" };
+	const candidates = [];
+	for (const rootDir of roots) {
+		const root = node_path.default.resolve(rootDir);
+		const abs = node_path.default.resolve(root, rel);
+		if (abs === root || abs.startsWith(root + node_path.default.sep)) candidates.push(abs);
+	}
+	if (candidates.length === 0) return { error: "forbidden" };
+	return { candidates };
+}
+var DEFAULT_CONTENT_TYPES = {
+	".m3u8": "application/vnd.apple.mpegurl",
+	".m4s": "video/mp4",
+	".mp4": "video/mp4",
+	".idx": "application/octet-stream",
+	".html": "text/html; charset=utf-8",
+	".js": "application/javascript; charset=utf-8",
+	".mjs": "application/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".map": "application/json; charset=utf-8",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".ico": "image/x-icon",
+	".woff2": "font/woff2",
+	".woff": "font/woff",
+	".ttf": "font/ttf"
+};
+function contentTypeFor(filePath, overrides) {
+	const ext = node_path.default.extname(filePath).toLowerCase();
+	return overrides?.[ext] ?? DEFAULT_CONTENT_TYPES[ext] ?? "application/octet-stream";
+}
+/** Parse an HTTP `Range` header against a known size. Null = serve whole file. */
+function parseRangeHeader(header, size) {
+	if (!header) return null;
+	const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+	if (!m) return null;
+	const [, rawStart, rawEnd] = m;
+	if (rawStart === "" && rawEnd === "") return null;
+	let start;
+	let end;
+	if (rawStart === "") {
+		const n = Number(rawEnd);
+		if (n <= 0) return null;
+		start = Math.max(0, size - n);
+		end = size - 1;
+	} else {
+		start = Number(rawStart);
+		end = rawEnd === "" ? size - 1 : Number(rawEnd);
+	}
+	if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || start >= size) return null;
+	return {
+		start,
+		end: Math.min(end, size - 1)
+	};
+}
+/**
+* Start an authenticated file-server. Returns the bound port so the caller can
+* build URLs. `getRoots`/`verifyToken` are invoked per request, so they always
+* reflect the live config.
+*/
+async function createAuthenticatedFileServer(opts) {
+	const cors = corsHeaders(opts.corsOrigin ?? "*");
+	const server = (0, node_http.createServer)((req, res) => {
+		handle(opts, cors, req, res);
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(opts.port, () => resolve());
+	});
+	const addr = server.address();
+	return {
+		port: typeof addr === "object" && addr ? addr.port : opts.port,
+		close: () => new Promise((resolve) => server.close(() => resolve()))
+	};
+}
+async function handle(opts, cors, req, res) {
+	if (req.method === "OPTIONS") {
+		res.writeHead(204, cors).end();
+		return;
+	}
+	if (req.method !== "GET" && req.method !== "HEAD") {
+		res.writeHead(405, cors).end();
+		return;
+	}
+	const urlPath = (req.url ?? "").split("?")[0] ?? "";
+	const parsed = parseTokenizedUrl(opts.urlPrefix, urlPath);
+	if (!parsed) {
+		res.writeHead(403, cors).end();
+		return;
+	}
+	if (!opts.verifyToken(parsed.token, parsed.rel)) {
+		res.writeHead(401, cors).end();
+		return;
+	}
+	const resolved = resolveFilePath(opts.getRoots(), parsed.rel);
+	if ("error" in resolved) {
+		res.writeHead(403, cors).end();
+		return;
+	}
+	let absPath = null;
+	let size = 0;
+	for (const candidate of resolved.candidates) try {
+		const st = await node_fs.promises.stat(candidate);
+		if (st.isFile()) {
+			absPath = candidate;
+			size = st.size;
+			break;
 		}
-		res.writeHead(200, {
+	} catch {}
+	if (absPath === null) {
+		res.writeHead(404, cors).end();
+		return;
+	}
+	const baseHeaders = {
+		...cors,
+		"content-type": contentTypeFor(absPath, opts.contentTypes),
+		"accept-ranges": "bytes",
+		"cache-control": "no-cache"
+	};
+	const range = parseRangeHeader(req.headers.range, size);
+	if (range) {
+		res.writeHead(206, {
 			...baseHeaders,
-			"content-length": String(size)
+			"content-range": `bytes ${range.start}-${range.end}/${size}`,
+			"content-length": String(range.end - range.start + 1)
 		});
 		if (req.method === "HEAD") {
 			res.end();
 			return;
 		}
-		(0, node_fs.createReadStream)(absPath).pipe(res);
-	};
+		(0, node_fs.createReadStream)(absPath, {
+			start: range.start,
+			end: range.end
+		}).pipe(res);
+		return;
+	}
+	res.writeHead(200, {
+		...baseHeaders,
+		"content-length": String(size)
+	});
+	if (req.method === "HEAD") {
+		res.end();
+		return;
+	}
+	(0, node_fs.createReadStream)(absPath).pipe(res);
 }
 //#endregion
-//#region src/download/model-downloader.ts
-function isNonEmptyFile(filePath) {
-	return node_fs.existsSync(filePath) && node_fs.statSync(filePath).size > 0;
-}
-/**
-* Sibling files of a single-file (non-directory) format — extra files the
-* format needs, fetched from the same remote directory as `url` and stored
-* flat alongside the main file in `modelsDir`. Catalog-declared via
-* `formatEntry.files`, e.g. OpenVINO IR lists its `.bin` weights next to the
-* `.xml`. The downloader stays format-agnostic; the convention lives in the
-* catalog data (like `MLPACKAGE_FILES` for the directory case).
-*/
-function siblingFilesFor(formatEntry) {
-	return formatEntry.isDirectory ? [] : formatEntry.files ?? [];
-}
-/** Resolve a sibling's remote URL relative to the main file's directory. */
-function siblingUrl(mainUrl, sibling) {
-	return mainUrl.replace(/[^/]+$/, sibling);
-}
+//#region src/http/asset-compression.ts
 /**
-* The relative filenames a model format occupies under `modelsDir` — the main
-* file (URL basename, or `${id}.${format}` fallback), its declared siblings
-* (e.g. the OpenVINO `.bin` next to the `.xml`), and any `extraFiles`. For a
-* directory bundle the single entry is the bundle dir itself (tar/extract
-* recurse into it).
+* Content-coding for addon-served static assets: `Accept-Encoding` negotiation,
+* an eligibility rule, and a BOUNDED cache of the compressed bytes.
 *
-* Used by model distribution (P2): the hub tars exactly these names from its
-* `modelsDir` and the agent untars them into its own `modelsDir`, so both ends
-* agree on the on-disk layout without re-deriving it.
+* ## Why the ADDON owns the encoding
+*
+* The hub's `/addon/:addonId/*` bridge is registered `{ compress: false }`. That
+* is not an oversight — on 2026-07-16 the global `@fastify/compress` was found
+* emitting an EMPTY brotli stream (`content-encoding: br`, `content-length: 0`)
+* for any compressible body over its 1 KiB threshold once the body had crossed
+* the UDS route bridge of a FORKED addon. It silently broke the notifier SVG
+* icons; the deploy-bundle pull route had already dodged the same class with
+* `compress: false`. The resolution then, and the contract now, is that an addon
+* route owns its content-coding END TO END: it negotiates, it compresses, it
+* stamps `content-encoding` + `Vary`, and the hub pipes those bytes through
+* untouched (`proxyToUpstream` replays the upstream headers verbatim).
+*
+* So compression belongs HERE, in the shared file data-plane, and nowhere above
+* it. Anything that re-compresses on top of this reintroduces the empty-brotli
+* bug rather than doubling the ratio.
+*
+* ## Why the bytes are cached, and why the cache is bounded
+*
+* Measured on the stream-broker embed bundle (`index-<hash>.js`, 1,443,142 B):
+* gzip-6 → 360,868 B, brotli-5 → 327,419 B in 27 ms, brotli-11 → 293,677 B in
+* 2,233 ms. Quality 5 is the request-path choice: 77% off the wire for 27 ms
+* paid ONCE. Quality 11 buys another 2.3% for eighty times the CPU, on a path
+* where a real client is waiting.
+*
+* The cache is an LRU bounded by BOTH entry count and total bytes, and it
+* refuses assets over {@link COMPRESSION_MAX_ASSET_BYTES} outright. An unbounded
+* `Map` keyed by URL is how a long-lived process walks into an OOM, and this
+* repo has already spent a session on one.
+*
+* The key carries `mtimeMs` and `size`, so a rebuild that rewrites an asset in
+* place under an UNCHANGED name (an SPA shell, a service worker) can never be
+* served from the previous build's bytes.
 */
-function collectModelFiles(entry, format) {
-	const formatEntry = entry.formats[format];
-	if (!formatEntry) return [];
-	const names = [formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`, ...siblingFilesFor(formatEntry)];
-	for (const extra of entry.extraFiles ?? []) names.push(extra.filename);
-	return names;
-}
-/** Build fetch headers, including HF auth token for huggingface.co URLs */
-function buildHeaders(url) {
-	const headers = { "User-Agent": "CamStack/1.0" };
-	const hfToken = process.env["HF_TOKEN"] ?? process.env["HUGGING_FACE_HUB_TOKEN"];
-	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
-	return headers;
-}
+var brotliAsync = (0, node_util.promisify)(node_zlib.brotliCompress);
+var gzipAsync = (0, node_util.promisify)(node_zlib.gzip);
+/** LRU bounds. Both are enforced; whichever binds first evicts. */
+var MAX_CACHE_ENTRIES = 64;
+var MAX_CACHE_BYTES = 32 * 1024 * 1024;
+/** Brotli quality — see the file header for the measured trade. */
+var BROTLI_QUALITY = 5;
 /**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
+* Content types worth compressing. An ALLOW-list, not a deny-list: an unknown
+* type (`application/octet-stream`) is assumed to be opaque binary. This is what
+* keeps jpeg/png/webp/mp4/m4s/woff2 out — running brotli over them burns CPU to
+* make the body marginally BIGGER.
 */
-async function downloadFile(url, destPath, onProgress) {
-	if (node_fs.existsSync(destPath)) return destPath;
-	node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
-	const tmpPath = destPath + ".downloading";
-	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
-		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
-		if (!response.body) throw new Error(`No response body from ${url}`);
-		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
-		let downloaded = 0;
-		const fileStream = node_fs.createWriteStream(tmpPath);
-		const reader = response.body.getReader();
-		try {
-			for (;;) {
-				const { done, value } = await reader.read();
-				if (done || !value) break;
-				fileStream.write(value);
-				downloaded += value.length;
-				onProgress?.(downloaded, total);
-			}
-		} finally {
-			fileStream.end();
-			await new Promise((resolve, reject) => {
-				fileStream.on("finish", resolve);
-				fileStream.on("error", reject);
-			});
+var COMPRESSIBLE_EXACT = new Set([
+	"application/javascript",
+	"application/ecmascript",
+	"application/json",
+	"application/manifest+json",
+	"application/wasm",
+	"application/xml",
+	"application/xhtml+xml",
+	"application/vnd.apple.mpegurl",
+	"image/svg+xml"
+]);
+/** Is a body of this content type worth compressing at all? */
+function isCompressibleContentType(contentType) {
+	const base = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+	if (base.length === 0) return false;
+	if (base.startsWith("text/")) return true;
+	if (base.endsWith("+json") || base.endsWith("+xml")) return true;
+	return COMPRESSIBLE_EXACT.has(base);
+}
+/** Parse `Accept-Encoding` into tokens with their q-values (default 1). */
+function parseAcceptEncoding(header) {
+	if (header === void 0 || header.trim().length === 0) return [];
+	const out = [];
+	for (const part of header.split(",")) {
+		const [rawToken, ...params] = part.split(";");
+		const token = rawToken?.trim().toLowerCase() ?? "";
+		if (token.length === 0) continue;
+		let q = 1;
+		for (const param of params) {
+			const [name, value] = param.split("=");
+			if (name?.trim().toLowerCase() !== "q") continue;
+			const parsed = Number(value?.trim());
+			q = Number.isFinite(parsed) ? parsed : 1;
 		}
-		node_fs.renameSync(tmpPath, destPath);
-		return destPath;
-	} catch (err) {
-		try {
-			node_fs.unlinkSync(tmpPath);
-		} catch {}
-		throw err;
+		out.push({
+			token,
+			q
+		});
 	}
+	return out;
 }
-/**
-* Fetch JSON from a URL using native fetch().
-*/
-async function fetchJson(url) {
-	const response = await fetch(url, {
-		redirect: "follow",
-		headers: buildHeaders(url)
-	});
-	if (!response.ok) throw new Error(`HTTP ${response.status} fetching ${url}`);
-	return response.json();
+function accepts(prefs, token) {
+	const exact = prefs.find((p) => p.token === token);
+	if (exact) return exact.q > 0;
+	const wildcard = prefs.find((p) => p.token === "*");
+	return wildcard !== void 0 && wildcard.q > 0;
 }
 /**
-* Download a model with fallback URLs and optional SHA256 verification.
-* Legacy API preserved for backward compatibility -- delegates to downloadFile().
+* Pick a coding for this request: brotli when offered, else gzip, else identity.
+*
+* Returns `null` for identity — including when the header is ABSENT. A client
+* that offers nothing gets the raw bytes; guessing on its behalf is how a
+* non-negotiating consumer (a native fetch, a probe, an OTA puller) ends up with
+* a body it cannot read.
 */
-async function downloadModel(options) {
-	const { url, fallbackUrls = [], destDir, filename, expectedSha256, onProgress } = options;
-	const fname = filename ?? url.split("/").pop() ?? "model.bin";
-	const destPath = node_path.join(destDir, fname);
-	if (node_fs.existsSync(destPath)) return {
-		filePath: destPath,
-		downloadedBytes: 0,
-		fromCache: true
-	};
-	node_fs.mkdirSync(destDir, { recursive: true });
-	const urls = [url, ...fallbackUrls];
-	let lastError = null;
-	for (const tryUrl of urls) try {
-		await downloadFile(tryUrl, destPath, onProgress);
-		if (expectedSha256) {
-			const hash = await computeSha256(destPath);
-			if (hash !== expectedSha256) {
-				node_fs.unlinkSync(destPath);
-				throw new Error(`SHA256 mismatch: expected ${expectedSha256}, got ${hash}`);
-			}
-		}
-		return {
-			filePath: destPath,
-			downloadedBytes: node_fs.statSync(destPath).size,
-			fromCache: false
-		};
-	} catch (e) {
-		lastError = e;
-		if (node_fs.existsSync(destPath)) node_fs.unlinkSync(destPath);
-	}
-	throw lastError ?? /* @__PURE__ */ new Error(`Failed to download model from ${url}`);
+function negotiateContentEncoding(acceptEncoding) {
+	const prefs = parseAcceptEncoding(acceptEncoding);
+	if (prefs.length === 0) return null;
+	if (accepts(prefs, "br")) return "br";
+	if (accepts(prefs, "gzip")) return "gzip";
+	return null;
 }
-async function computeSha256(filePath) {
-	return new Promise((resolve, reject) => {
-		const hash = (0, node_crypto.createHash)("sha256");
-		const stream = node_fs.createReadStream(filePath);
-		stream.on("data", (chunk) => hash.update(chunk));
-		stream.on("end", () => resolve(hash.digest("hex")));
-		stream.on("error", reject);
-	});
+var cache = /* @__PURE__ */ new Map();
+var inFlight = /* @__PURE__ */ new Map();
+var compressions = 0;
+var hits = 0;
+var cachedBytes = 0;
+function cacheKey(key) {
+	return `${key.encoding}|${String(key.mtimeMs)}|${String(key.size)}|${key.path}`;
 }
-/**
-* Download every file in a HuggingFace directory bundle (e.g.,
-* `.mlpackage` / OpenVINO IR pair) atomically. `knownFiles` lists the
-* relative paths inside the directory; the function fetches each from
-* `${url}/${file}` and renames the staging directory only on full
-* success. Mirrors `ModelDownloadService.downloadDirectory` but
-* exposed as a standalone for catalog-less callers.
-*/
-async function downloadDirectory(url, destDir, knownFiles, onProgress) {
-	const match = url.match(/huggingface\.co\/([^/]+\/[^/]+)\/resolve\/main\/(.+)/);
-	if (!match) throw new Error(`Cannot parse HuggingFace URL: ${url}`);
-	const [, repo, dirPath] = match;
-	const files = (knownFiles ?? []).map((f) => ({
-		relativePath: f,
-		fileUrl: `https://huggingface.co/${repo}/resolve/main/${dirPath}/${f}`
-	}));
-	if (files.length === 0) throw new Error(`Directory bundle requires explicit \`files\` list (got none for ${url})`);
-	const tmpDir = destDir + ".downloading";
-	node_fs.rmSync(tmpDir, {
-		recursive: true,
-		force: true
-	});
-	node_fs.mkdirSync(tmpDir, { recursive: true });
-	let totalDownloaded = 0;
-	try {
-		for (const file of files) {
-			const destPath = node_path.join(tmpDir, file.relativePath);
-			node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
-			await downloadFile(file.fileUrl, destPath, (downloaded, _total) => {
-				onProgress?.(totalDownloaded + downloaded, void 0);
-			});
-			totalDownloaded += node_fs.statSync(destPath).size;
-		}
-		node_fs.rmSync(destDir, {
-			recursive: true,
-			force: true
-		});
-		node_fs.renameSync(tmpDir, destDir);
-	} catch (err) {
-		node_fs.rmSync(tmpDir, {
-			recursive: true,
-			force: true
-		});
-		throw err;
+/** Evict least-recently-used entries until both bounds hold. */
+function evictToBounds() {
+	for (const [k, buf] of cache) {
+		if (cache.size <= MAX_CACHE_ENTRIES && cachedBytes <= MAX_CACHE_BYTES) return;
+		cache.delete(k);
+		cachedBytes -= buf.byteLength;
 	}
 }
+async function compressBody(raw, encoding) {
+	if (encoding === "gzip") return await gzipAsync(raw);
+	return await brotliAsync(raw, { params: {
+		[node_zlib.constants.BROTLI_PARAM_QUALITY]: BROTLI_QUALITY,
+		[node_zlib.constants.BROTLI_PARAM_SIZE_HINT]: raw.byteLength
+	} });
+}
 /**
-* Resolve a `ModelCatalogEntry` against `modelsDir`: download model file
-* (or directory bundle) + extra files (labels JSON, charset dict, …),
-* skip if already on disk. Returns the local model path.
+* Compressed bytes for one asset, compressing at most once per key.
+*
+* `null` means "send the original" — the asset is too large to buffer, the
+* source could not be read, or compression did not actually shrink it. Every
+* failure degrades to identity, so this can only ever be an optimisation.
+*
+* Concurrent callers for the same key share ONE compression: a cold cache hit by
+* a dozen parallel asset requests must not run zlib a dozen times.
 */
-async function ensureModel(modelsDir, entry, format, onProgress) {
-	const formatEntry = entry.formats[format];
-	if (!formatEntry) throw new Error(`Model "${entry.id}" has no ${format} format. Available: ${Object.keys(entry.formats).join(", ")}`);
-	if (entry.extraFiles) for (const extra of entry.extraFiles) await downloadFile(extra.url, node_path.join(modelsDir, extra.filename));
-	const filename = formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`;
-	const modelPath = node_path.join(modelsDir, filename);
-	const siblings = siblingFilesFor(formatEntry);
-	if (node_fs.existsSync(modelPath)) if (formatEntry.isDirectory && !node_fs.existsSync(node_path.join(modelPath, "Manifest.json"))) node_fs.rmSync(modelPath, {
-		recursive: true,
-		force: true
-	});
-	else if (siblings.some((f) => !isNonEmptyFile(node_path.join(modelsDir, f)))) {} else return modelPath;
-	node_fs.mkdirSync(modelsDir, { recursive: true });
-	if (formatEntry.isDirectory) await downloadDirectory(formatEntry.url, modelPath, formatEntry.files, onProgress);
-	else {
-		await downloadFile(formatEntry.url, modelPath, (downloaded, total) => onProgress?.(downloaded, total === 0 ? void 0 : total));
-		for (const sibling of siblings) await downloadFile(siblingUrl(formatEntry.url, sibling), node_path.join(modelsDir, sibling));
+async function getCompressedAsset(key, readSource) {
+	if (key.size > 8388608) return null;
+	const id = cacheKey(key);
+	const cached = cache.get(id);
+	if (cached) {
+		cache.delete(id);
+		cache.set(id, cached);
+		hits += 1;
+		return cached;
 	}
-	return modelPath;
-}
-/** Compute the on-disk path for a given model + format, even when not yet downloaded. */
-function getModelFilePath(modelsDir, entry, format) {
-	const formatEntry = entry.formats[format];
-	if (!formatEntry) return null;
-	const filename = formatEntry.url.split("/").pop() ?? `${entry.id}.${format}`;
-	return node_path.join(modelsDir, filename);
-}
-/** True iff the model file (or `Manifest.json` for directory bundles) exists and is non-empty. */
-function isModelDownloaded(modelsDir, entry, format) {
-	const formatEntry = entry.formats[format];
-	if (!formatEntry) return false;
-	const modelPath = getModelFilePath(modelsDir, entry, format);
-	if (!modelPath || !node_fs.existsSync(modelPath)) return false;
-	if (formatEntry.isDirectory) return node_fs.existsSync(node_path.join(modelPath, "Manifest.json"));
-	if (node_fs.statSync(modelPath).size <= 0) return false;
-	return siblingFilesFor(formatEntry).every((f) => isNonEmptyFile(node_path.join(modelsDir, f)));
-}
-/** Remove the on-disk model file/directory. Returns true if something was deleted. */
-function deleteModelFromDisk(modelsDir, entry, format) {
-	const modelPath = getModelFilePath(modelsDir, entry, format);
-	if (!modelPath || !node_fs.existsSync(modelPath)) return false;
-	const formatEntry = entry.formats[format];
-	if (formatEntry?.isDirectory) node_fs.rmSync(modelPath, {
-		recursive: true,
-		force: true
-	});
-	else {
-		node_fs.unlinkSync(modelPath);
-		if (formatEntry) for (const sibling of siblingFilesFor(formatEntry)) {
-			const sibPath = node_path.join(modelsDir, sibling);
-			if (node_fs.existsSync(sibPath)) node_fs.unlinkSync(sibPath);
+	const pending = inFlight.get(id) ?? (async () => {
+		let raw;
+		try {
+			raw = await readSource();
+		} catch {
+			return null;
 		}
+		const out = await compressBody(raw, key.encoding);
+		compressions += 1;
+		if (out.byteLength >= raw.byteLength) return null;
+		cache.set(id, out);
+		cachedBytes += out.byteLength;
+		evictToBounds();
+		return out;
+	})();
+	inFlight.set(id, pending);
+	try {
+		return await pending;
+	} catch {
+		return null;
+	} finally {
+		inFlight.delete(id);
 	}
-	return true;
 }
 //#endregion
-//#region src/download/model-download-service.ts
+//#region src/http/file-data-plane.ts
 /**
-* Unified model download service.
+* A ready-made data-plane request handler that serves files from a set of roots
+* with HTTP `Range`, for addons whose data-plane is "stream files off disk"
+* (recording playback, scrub-frame stores, exported clips).
 *
-* Handles downloading model files and extra files (labels, dicts) from a
-* catalog of ModelCatalogEntry items. Supports single-file models and
-* directory bundles (e.g., .mlpackage for CoreML).
+* This is the addon-side handler the addon hands to `ctx.dataPlane.serve({ handler })`.
+* It receives the REAL Node `req`/`res`, resolves the request path against the
+* addon's roots (traversal-guarded), and streams the file. NO token and NO CORS:
+* the hub already authenticated the caller and the data plane is same-origin
+* through the hub's port. Reuses the shared Range/content-type/traversal helpers
+* so there is one implementation across the standalone file-server and this.
 *
-* Addons use this via `context.models.ensure(modelId, format)`.
+* It also owns its own CONTENT-CODING. The hub bridge is `{ compress: false }`
+* because the global compressor emits an empty brotli stream over the forked-
+* addon route bridge, so nothing above this layer will ever compress an addon
+* body — see `asset-compression.ts` for the incident and the contract.
 */
-var ModelDownloadService = class {
-	modelsDir;
-	onProgress;
-	catalog;
-	constructor(modelsDir, catalog, onProgress) {
-		this.modelsDir = modelsDir;
-		this.onProgress = onProgress;
-		const map = /* @__PURE__ */ new Map();
-		for (const entry of catalog) map.set(entry.id, entry);
-		this.catalog = map;
-	}
-	/**
-	* Ensure a model (and its extra files) is downloaded.
-	* Returns the local filesystem path to the model file/directory.
-	*/
-	async ensure(modelId, format) {
-		const entry = this.catalog.get(modelId);
-		if (!entry) throw new Error(`ModelDownloadService: unknown model "${modelId}"`);
-		const selectedFormat = format ?? this.pickDefaultFormat(entry);
-		const formatEntry = entry.formats[selectedFormat];
-		if (!formatEntry) throw new Error(`ModelDownloadService: model "${modelId}" has no ${selectedFormat} format`);
-		await this.ensureExtraFiles(modelId);
-		const modelPath = this.modelFilePath(entry, selectedFormat);
-		const siblings = siblingFilesFor(formatEntry);
-		if (node_fs.existsSync(modelPath)) {
-			if (formatEntry.isDirectory) if (!node_fs.existsSync(node_path.join(modelPath, "Manifest.json"))) node_fs.rmSync(modelPath, {
-				recursive: true,
-				force: true
-			});
-			else return modelPath;
-			else if (siblings.every((f) => isNonEmptyFile(node_path.join(this.modelsDir, f)))) return modelPath;
+/** Build a `(req, res)` handler that serves `getRoots()` files with Range. */
+function createFileDataPlaneHandler(opts) {
+	return async (req, res) => {
+		if (req.method !== "GET" && req.method !== "HEAD") {
+			res.writeHead(405).end();
+			return;
 		}
-		node_fs.mkdirSync(this.modelsDir, { recursive: true });
-		if (formatEntry.isDirectory) await this.downloadDirectory(formatEntry.url, modelPath, formatEntry.files, modelId);
-		else {
-			await downloadFile(formatEntry.url, modelPath, this.onProgress ? (downloaded, total) => this.onProgress(modelId, downloaded, total) : void 0);
-			for (const sibling of siblings) await downloadFile(siblingUrl(formatEntry.url, sibling), node_path.join(this.modelsDir, sibling));
+		const urlPath = (req.url ?? "/").split("?")[0] ?? "/";
+		let rel;
+		try {
+			rel = decodeURIComponent(urlPath.replace(/^\/+/, ""));
+		} catch {
+			res.writeHead(400).end();
+			return;
 		}
-		return modelPath;
-	}
-	/**
-	* Ensure extra files for a model are downloaded.
-	* Returns the local paths of all extra files.
-	*/
-	async ensureExtraFiles(modelId) {
-		const entry = this.catalog.get(modelId);
-		if (!entry) throw new Error(`ModelDownloadService: unknown model "${modelId}"`);
-		const extras = entry.extraFiles;
-		if (!extras || extras.length === 0) return [];
-		const paths = [];
-		for (const extra of extras) {
-			const destPath = node_path.join(this.modelsDir, extra.filename);
-			await downloadFile(extra.url, destPath);
-			paths.push(destPath);
+		if (rel.length === 0) {
+			res.writeHead(404).end();
+			return;
 		}
-		return paths;
-	}
-	/** Absolute path to the shared models directory. */
-	getModelsDir() {
-		return this.modelsDir;
-	}
-	/** Check if a model file is already present on disk. */
-	isDownloaded(modelId, format) {
-		const entry = this.catalog.get(modelId);
-		if (!entry) return false;
-		const selectedFormat = format ?? this.pickDefaultFormat(entry);
-		const formatEntry = entry.formats[selectedFormat];
-		if (!formatEntry) return false;
-		const modelPath = this.modelFilePath(entry, selectedFormat);
-		if (!node_fs.existsSync(modelPath)) return false;
-		if (formatEntry.isDirectory) return node_fs.existsSync(node_path.join(modelPath, "Manifest.json"));
-		if (node_fs.statSync(modelPath).size <= 0) return false;
-		return siblingFilesFor(formatEntry).every((f) => isNonEmptyFile(node_path.join(this.modelsDir, f)));
-	}
-	/** Get the catalog entry for a model by ID. */
-	getEntry(modelId) {
-		return this.catalog.get(modelId);
-	}
-	pickDefaultFormat(entry) {
-		for (const fmt of [
-			"onnx",
-			"coreml",
-			"openvino",
-			"tflite",
-			"pt"
-		]) if (entry.formats[fmt]) return fmt;
-		const first = Object.keys(entry.formats)[0];
-		if (first) return first;
-		throw new Error(`ModelDownloadService: model "${entry.id}" has no formats`);
-	}
-	modelFilePath(entry, format) {
-		const formatEntry = entry.formats[format];
-		if (!formatEntry) throw new Error(`Model ${entry.id} has no ${format} format`);
-		const urlParts = formatEntry.url.split("/");
-		const filename = urlParts[urlParts.length - 1] ?? `${entry.id}.${format}`;
-		return node_path.join(this.modelsDir, filename);
-	}
-	/**
-	* Download a directory bundle (e.g., .mlpackage) from HuggingFace.
-	* ATOMIC: downloads to temp dir, renames only on complete success.
-	*/
-	async downloadDirectory(url, destDir, knownFiles, _modelId) {
-		const match = url.match(/huggingface\.co\/([^/]+\/[^/]+)\/resolve\/main\/(.+)/);
-		if (!match) throw new Error(`Cannot parse HuggingFace URL: ${url}`);
-		const [, repo, dirPath] = match;
-		let filesToDownload;
-		if (knownFiles && knownFiles.length > 0) filesToDownload = knownFiles.map((f) => ({
-			relativePath: f,
-			fileUrl: `https://huggingface.co/${repo}/resolve/main/${dirPath}/${f}`
-		}));
-		else {
-			const hfFiles = await this.listHfFiles(repo, dirPath);
-			if (hfFiles.length === 0) throw new Error(`No files found in HuggingFace directory: ${dirPath}`);
-			filesToDownload = hfFiles.map((f) => ({
-				relativePath: f.path.substring(dirPath.length + 1),
-				fileUrl: `https://huggingface.co/${repo}/resolve/main/${f.path}`
-			}));
+		const resolved = resolveFilePath(opts.getRoots(), rel);
+		if ("error" in resolved) {
+			res.writeHead(403).end();
+			return;
 		}
-		const tmpDir = destDir + ".downloading";
-		node_fs.rmSync(tmpDir, {
-			recursive: true,
-			force: true
-		});
-		node_fs.mkdirSync(tmpDir, { recursive: true });
-		try {
-			for (const file of filesToDownload) {
-				const destPath = node_path.join(tmpDir, file.relativePath);
-				node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
-				await downloadFile(file.fileUrl, destPath);
+		let absPath = null;
+		let size = 0;
+		let mtimeMs = 0;
+		for (const candidate of resolved.candidates) try {
+			const st = await node_fs.promises.stat(candidate);
+			if (st.isFile()) {
+				absPath = candidate;
+				size = st.size;
+				mtimeMs = st.mtimeMs;
+				break;
 			}
-			node_fs.rmSync(destDir, {
-				recursive: true,
-				force: true
-			});
-			node_fs.renameSync(tmpDir, destDir);
-		} catch (err) {
-			node_fs.rmSync(tmpDir, {
-				recursive: true,
-				force: true
+		} catch {}
+		if (absPath === null) {
+			res.writeHead(404).end();
+			return;
+		}
+		const contentType = contentTypeFor(absPath, opts.contentTypes);
+		const compressible = isCompressibleContentType(contentType);
+		const baseHeaders = {
+			"content-type": contentType,
+			"accept-ranges": "bytes",
+			"cache-control": opts.cacheControl?.(rel) ?? "no-cache",
+			...compressible ? { vary: "accept-encoding" } : {}
+		};
+		const range = parseRangeHeader(req.headers.range, size);
+		if (range) {
+			res.writeHead(206, {
+				...baseHeaders,
+				"content-range": `bytes ${range.start}-${range.end}/${size}`,
+				"content-length": String(range.end - range.start + 1)
 			});
-			throw err;
+			if (req.method === "HEAD") {
+				res.end();
+				return;
+			}
+			(0, node_fs.createReadStream)(absPath, {
+				start: range.start,
+				end: range.end
+			}).pipe(res);
+			return;
 		}
-	}
-	/** Recursively list all files in a HuggingFace directory via API. */
-	async listHfFiles(repo, dirPath) {
-		const entries = await fetchJson(`https://huggingface.co/api/models/${repo}/tree/main/${dirPath}`);
-		const files = [];
-		for (const entry of entries) if (entry.type === "file") files.push({
-			path: entry.path,
-			size: entry.size ?? entry.lfs?.size ?? 0
+		const encoding = compressible ? negotiateContentEncoding(req.headers["accept-encoding"]) : null;
+		if (encoding !== null && size >= 1024) {
+			const filePath = absPath;
+			const body = await getCompressedAsset({
+				path: filePath,
+				mtimeMs,
+				size,
+				encoding
+			}, () => node_fs.promises.readFile(filePath));
+			if (body !== null) {
+				res.writeHead(200, {
+					...baseHeaders,
+					"content-encoding": encoding,
+					"accept-ranges": "none",
+					"content-length": String(body.byteLength)
+				});
+				if (req.method === "HEAD") {
+					res.end();
+					return;
+				}
+				res.end(body);
+				return;
+			}
+		}
+		res.writeHead(200, {
+			...baseHeaders,
+			"content-length": String(size)
 		});
-		else if (entry.type === "directory") {
-			const subFiles = await this.listHfFiles(repo, entry.path);
-			files.push(...subFiles);
+		if (req.method === "HEAD") {
+			res.end();
+			return;
 		}
-		return files;
-	}
-};
+		(0, node_fs.createReadStream)(absPath).pipe(res);
+	};
+}
 //#endregion
 Object.defineProperty(exports, "ModelDownloadService", {
 	enumerable: true,