@camstack/server 1.2.113 → 1.2.115

package/dist/api/trpc/generated-cap-routers.js

@@ -4171,6 +4171,14 @@ function createCapRouter_llm(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listNodeModels(input);
         }),
+        resolveModelRef: trpc_middleware_js_1.adminProcedure
+            .input(types_55.llmCapability.methods.resolveModelRef.input.loose())
+            .output(types_55.llmCapability.methods.resolveModelRef.output)
+            .mutation(async ({ input, ctx }) => {
+            const p = requireCapProvider('llm', () => getProvider(ctx));
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.resolveModelRef(input);
+        }),
         installModel: trpc_middleware_js_1.adminProcedure
             .input(types_55.llmCapability.methods.installModel.input.loose())
             .output(types_55.llmCapability.methods.installModel.output)

package/dist/boot/init-sequence.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * The hub's `onModuleInit` order, as one named, testable sequence.
+ *
+ * It was inline in `bootManual`. It is here because one seam in it is now
+ * load-bearing rather than incidental — {@link BootInitSequence.beforeAddonBoot}
+ * — and a seam nothing pins is a seam that moves.
+ *
+ * The order is derived from the dependency graph:
+ *
+ *   1. Moleculer — starts the broker and calls `EventBus.attachBroker()`.
+ *   2. AddonBridge — no cross-service deps.
+ *   3. AgentRegistry — subscribes to `broker.localBus.on('$node.connected')`.
+ *   ── beforeAddonBoot ── the broker is live and NOTHING has booted yet.
+ *   4. AddonRegistry — boots EVERY addon. Minutes of work on a real hub.
+ *   5. …post-boot reconciles.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBootInitSequence = runBootInitSequence;
+/** Run the boot init steps in dependency order. */
+async function runBootInitSequence(sequence) {
+    await sequence.moleculer();
+    await sequence.addonBridge();
+    await sequence.agentRegistry();
+    if (sequence.beforeAddonBoot !== undefined)
+        await sequence.beforeAddonBoot();
+    await sequence.addonBoot();
+    if (sequence.afterAddonBoot !== undefined)
+        await sequence.afterAddonBoot();
+}

package/dist/core/addon/addon-registry.service.js

@@ -1,4 +1,5 @@
 "use strict";
+/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-member-access -- pre-existing lint debt across this 2200-line orchestration class. The flagged sites (StorageService.setLocationManager / setSettingsBackend, LoggingService.addDestination, RouteRegistry, etc.) are typed as `unknown` by their owning services to break circular construction-order dependencies; runtime contracts are validated structurally. Tracked separately; do not amend in unrelated edits. */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -36,29 +37,23 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AddonRegistryService = void 0;
 exports.shouldEvictMissingOnDisk = shouldEvictMissingOnDisk;
 exports.shouldEmitProviderRegisteredReady = shouldEmitProviderRegisteredReady;
-/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-member-access -- pre-existing lint debt across this 2200-line orchestration class. The flagged sites (StorageService.setLocationManager / setSettingsBackend, LoggingService.addDestination, RouteRegistry, etc.) are typed as `unknown` by their owning services to break circular construction-order dependencies; runtime contracts are validated structurally. Tracked separately; do not amend in unrelated edits. */
-const os = __importStar(require("node:os"));
-const addon_row_manifest_1 = require("./addon-row-manifest");
-const runner_convergence_1 = require("./runner-convergence");
-const package_dir_utils_1 = require("./package-dir-utils");
-const types_1 = require("@camstack/types");
-const prune_misplaced_addons_js_1 = require("./prune-misplaced-addons.js");
-const system_1 = require("@camstack/system");
-const system_2 = require("@camstack/system");
-const client_1 = require("@trpc/client");
-const system_3 = require("@camstack/system");
-const system_4 = require("@camstack/system");
-const system_5 = require("@camstack/system");
 const node_crypto_1 = require("node:crypto");
-const path = __importStar(require("node:path"));
 const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const node_url_1 = require("node:url");
-const require_cache_js_1 = require("./require-cache.js");
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const client_1 = require("@trpc/client");
+const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
+const addon_row_manifest_1 = require("./addon-row-manifest");
 const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
 const integration_visibility_js_1 = require("./integration-visibility.js");
-const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
-const system_6 = require("@camstack/system");
-const types_2 = require("@camstack/types");
+const package_dir_utils_1 = require("./package-dir-utils");
+const prune_misplaced_addons_js_1 = require("./prune-misplaced-addons.js");
+const require_cache_js_1 = require("./require-cache.js");
+const runner_convergence_1 = require("./runner-convergence");
+const runner_spawn_fanout_js_1 = require("./runner-spawn-fanout.js");
 /**
  * Decide whether an in-memory addon entry should be evicted because it is no
  * longer on disk (the uninstall path in `loadNewAddons`).
@@ -222,6 +217,11 @@ class AddonRegistryService {
     // each addon's initialize() (in-process path); Task 7.2 will dispatch
     // through this from the `api.addons.custom` tRPC procedure.
     customActionRegistry = new system_1.CustomActionRegistry();
+    /**
+     * Keeps `purgeRequireCacheUnder` + `import()` atomic per addon directory now
+     * that the boot runner plan overlaps (D171). See `runner-spawn-fanout.ts`.
+     */
+    moduleLoadSerializer = (0, runner_spawn_fanout_js_1.createKeyedSerializer)();
     /**
      * AddonIds whose group-runner disconnect is operator-initiated (update /
      * restart / uninstall). The Moleculer `$node.disconnected` handler skips
@@ -267,7 +267,7 @@ class AddonRegistryService {
                 getByName: (capName) => reg.getSingleton(capName) ?? reg.getAllProviders(capName)[0] ?? null,
             };
             const client = (0, client_1.createTRPCClient)({
-                links: [(0, system_2.localProviderLink)(resolver), (0, system_2.brokerTransportLink)(this.moleculer.broker)],
+                links: [(0, system_1.localProviderLink)(resolver), (0, system_1.brokerTransportLink)(this.moleculer.broker)],
             });
             this.brokerApi = client;
         }
@@ -399,7 +399,7 @@ class AddonRegistryService {
         // Register the addon-settings singleton provider — replaces the
         // former `$addonHost` Moleculer service. The provider resolves
         // addonId → local addon instance (hub) or remote Moleculer call.
-        this.capabilityRegistry.declareCapability(system_6.addonSettingsCapability);
+        this.capabilityRegistry.declareCapability(system_1.addonSettingsCapability);
         // The SINGLE router for addon-level calls (routes / custom / settings).
         // It classifies in-process | hub-local-child (UDS) | remote-agent
         // (Moleculer) in ONE place — `resolveNode` reports only the BASE node
@@ -681,8 +681,16 @@ class AddonRegistryService {
         // `addon.error` — there is NO in-process-on-the-hub fallback (it
         // would violate one-addon-one-process). Retry policy for a failed
         // spawn is governed by the kernel circuit-breaker.
+        //
+        // BOUNDED-PARALLEL (D171). Entries within a plan are independent by
+        // construction — `buildAddonGroupPlan` keys by runner id and nothing reads
+        // the iteration order — while each one costs a fork plus a full addon
+        // bundle evaluated on the hub's event loop. Serially that was ~4 s of the
+        // measured 10 s kernel boot and grew with every addon shipped. The ordering
+        // that IS load-bearing is BETWEEN the plans (see the two call sites), not
+        // inside one.
         const spawnRunnerPlan = async (plan) => {
-            for (const [runnerId, runnerAddons] of plan) {
+            await (0, runner_spawn_fanout_js_1.spawnPlanConcurrently)(plan, async (runnerId, runnerAddons) => {
                 try {
                     await this.initializeAddonGroup(runnerId, runnerAddons);
                     for (const { addonId } of runnerAddons) {
@@ -701,7 +709,7 @@ class AddonRegistryService {
                         meta: { runnerId, addonIds: runnerAddons.map((a) => a.addonId), error: msg },
                     });
                 }
-            }
+            });
         };
         // An ISOLATED builtin is a builtin: everything it stores lives behind
         // `settings-store`, which is one of the in-process builtins booted below.
@@ -2420,7 +2428,7 @@ class AddonRegistryService {
                     const store = this.capabilityRegistry.getProviderByAddon('settings-store', addonId);
                     if (!store)
                         return;
-                    this.integrationRegistry = new system_4.IntegrationRegistry(store);
+                    this.integrationRegistry = new system_1.IntegrationRegistry(store);
                     void this.integrationRegistry.initialize().then(() => {
                         this.logger.info('IntegrationRegistry initialized', { meta: { phase: 'v2' } });
                     });
@@ -2822,7 +2830,7 @@ class AddonRegistryService {
                 registry.dataPlaneRegistry?.registerAddon(id, endpoints);
             },
         };
-        const dataPlaneFacility = (0, system_5.createAddonDataPlaneFacility)({
+        const dataPlaneFacility = (0, system_1.createAddonDataPlaneFacility)({
             addonId,
             logger,
             sink: dataPlaneSink,
@@ -2859,7 +2867,7 @@ class AddonRegistryService {
                     return registry.capabilityRegistry.getSingleton(capName) ?? undefined;
                 },
             },
-            deps: new system_3.AddonDepsManager(dataDir, logger),
+            deps: new system_1.AddonDepsManager(dataDir, logger),
             kernel: {
                 localNodeId: this.broker.nodeID,
                 storage: storageProvider ?? undefined,
@@ -2936,7 +2944,7 @@ class AddonRegistryService {
         let chain = this.disposerChains.get(addonId);
         if (chain == null) {
             const log = this.loggingService.createLogger().withTags({ addonId });
-            chain = new types_2.DisposerChain({
+            chain = new types_1.DisposerChain({
                 onError: (err, index) => {
                     log.error(`Disposer #${index} threw during teardown`, {
                         meta: { error: (0, types_1.errMsg)(err) },
@@ -3248,17 +3256,26 @@ class AddonRegistryService {
             // Dropping the addon's own modules from the require cache is what
             // actually re-reads the bundle — see `require-cache.ts` for the scoping
             // and the real-path match Node's cache keys demand.
-            (0, require_cache_js_1.purgeRequireCacheUnder)(path.dirname(entryPath));
-            // Kept for a genuinely ESM addon entry, where it IS the mechanism.
-            const cacheBustedUrl = `${(0, node_url_1.pathToFileURL)(entryPath).href}?t=${Date.now()}`;
-            // A plain `await import()` here is downleveled by tsc (the backend builds
-            // with `module: CommonJS`) into a `require()`-based shim. `require()` then
-            // treats the `?t=…` cache-bust query as part of the literal filename and
-            // throws MODULE_NOT_FOUND for EVERY forked addon — so no forked addon's
-            // custom-action catalog ever loaded. Use a native dynamic import the
-            // compiler won't rewrite, so Node's ESM loader handles the query string.
-            const nativeImport = new Function('specifier', 'return import(specifier)');
-            const modUnknown = await nativeImport(cacheBustedUrl);
+            //
+            // The purge mutates the PROCESS-GLOBAL require cache, so purge-then-import
+            // must stay atomic per directory now that the boot plan overlaps (D171):
+            // `@camstack/addon-remote-storage` ships three addon ids whose entries all
+            // resolve into one `dist/`, and a sibling's purge landing mid-import would
+            // evict a module graph while it is being evaluated. Different directories
+            // still load concurrently.
+            const modUnknown = await this.moduleLoadSerializer.run(path.dirname(entryPath), async () => {
+                (0, require_cache_js_1.purgeRequireCacheUnder)(path.dirname(entryPath));
+                // Kept for a genuinely ESM addon entry, where it IS the mechanism.
+                const cacheBustedUrl = `${(0, node_url_1.pathToFileURL)(entryPath).href}?t=${Date.now()}`;
+                // A plain `await import()` here is downleveled by tsc (the backend builds
+                // with `module: CommonJS`) into a `require()`-based shim. `require()` then
+                // treats the `?t=…` cache-bust query as part of the literal filename and
+                // throws MODULE_NOT_FOUND for EVERY forked addon — so no forked addon's
+                // custom-action catalog ever loaded. Use a native dynamic import the
+                // compiler won't rewrite, so Node's ESM loader handles the query string.
+                const nativeImport = new Function('specifier', 'return import(specifier)');
+                return nativeImport(cacheBustedUrl);
+            });
             catalog =
                 modUnknown && typeof modUnknown === 'object'
                     ? modUnknown['customActions']

package/dist/core/addon/runner-spawn-fanout.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * What makes the boot runner plan safe to OVERLAP.
+ *
+ * `spawnRunnerPlan` used to be `for (…of plan) await initializeAddonGroup(…)`.
+ * The fork itself is cheap — `$process.spawnRunner` returns as soon as
+ * `child_process.spawn` hands back a pid, and the child's capabilities land
+ * later on its INFO heartbeat — but every iteration ALSO does a dynamic
+ * `import()` of the addon's built bundle inside the hub process, purely to read
+ * its `customActions` export. Forty runners' module graphs, evaluated one after
+ * another, were ~4 s of the measured 10 s kernel boot, and it grows linearly
+ * with the addon count (docs/design/boot-to-usable-camera.md, item B).
+ *
+ * Nothing in a plan is ordered: `buildAddonGroupPlan` keys by runner id and
+ * `resolveRunnerId` is `execution.group ?? addonId`, so entries are independent
+ * by construction. The ordering that IS load-bearing lives BETWEEN the plans
+ * (forked addons → in-process builtins → isolated builtins) and is untouched.
+ *
+ * Two primitives, because overlapping the loop exposes exactly one shared
+ * resource: Node's `require.cache`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNNER_SPAWN_CONCURRENCY = void 0;
+exports.spawnPlanConcurrently = spawnPlanConcurrently;
+exports.createKeyedSerializer = createKeyedSerializer;
+/**
+ * Concurrent runner spawns during boot.
+ *
+ * Each unit is a `child_process.spawn` (kernel work) plus a full CJS module
+ * graph evaluated ON the hub's event loop. The bound protects the hub, not the
+ * code: unbounded, forty simultaneous module evaluations would starve the very
+ * event loop that has to answer the children's UDS handshakes. Eight keeps the
+ * fork syscalls overlapped while never leaving more than eight bundles being
+ * parsed at once.
+ */
+exports.RUNNER_SPAWN_CONCURRENCY = 8;
+/**
+ * Run `spawnOne` over every plan entry with at most `concurrency` in flight.
+ *
+ * Same lane-pool shape as `BaseDeviceProvider.onRestoreDevices` and
+ * `hydrateDevicesFromStorage` (D167) — one queue, N lanes, each lane pulling
+ * the next index until the queue is drained. `spawnOne` owns its own failure
+ * handling; a unit that settles (however it settles) frees its lane.
+ */
+async function spawnPlanConcurrently(plan, spawnOne, concurrency = exports.RUNNER_SPAWN_CONCURRENCY) {
+    const queue = [...plan.entries()];
+    if (queue.length === 0)
+        return;
+    let next = 0;
+    const lane = async () => {
+        for (;;) {
+            const unit = queue[next++];
+            if (unit === undefined)
+                return;
+            await spawnOne(unit[0], unit[1]);
+        }
+    };
+    const lanes = Math.min(Math.max(1, concurrency), queue.length);
+    await Promise.all(Array.from({ length: lanes }, lane));
+}
+/**
+ * Serialise work that shares a key, while different keys run freely.
+ *
+ * THE reason this exists: loading a forked addon's custom-action catalog first
+ * calls `purgeRequireCacheUnder(dirname(entryPath))`, which mutates the
+ * PROCESS-GLOBAL `require.cache`. Serially that is always purge-then-import.
+ * Overlapped, one addon's purge can fire while a sibling's `import()` of the
+ * same directory is still resolving, evicting half of a module graph that is
+ * being evaluated — duplicate module instances, or a partially-purged one.
+ *
+ * It is not hypothetical: `@camstack/addon-remote-storage` ships three addon
+ * ids (`sftp-storage`, `s3-storage`, `webdav-storage`) whose entries all
+ * resolve into the same `dist/` directory, each on its own runner, all in the
+ * same plan.
+ *
+ * Keyed by the purge scope, so the bound above still applies across packages
+ * and only true siblings queue behind each other.
+ */
+function createKeyedSerializer() {
+    const chains = new Map();
+    return {
+        run(key, work) {
+            const previous = chains.get(key) ?? Promise.resolve();
+            // `.then(work, work)` — a predecessor that REJECTED must not cancel its
+            // successors, and must not leave the chain permanently rejected.
+            const result = previous.then(work, work);
+            // The chain link swallows the outcome; only the caller sees it.
+            const link = result.then(() => undefined, () => undefined);
+            chains.set(key, link);
+            void link.then(() => {
+                // Drop the key once this link is the tail — keeps the map from growing
+                // one entry per addon directory for the life of the process.
+                if (chains.get(key) === link)
+                    chains.delete(key);
+            });
+            return result;
+        },
+    };
+}

package/dist/main.js

@@ -1,4 +1,5 @@
 "use strict";
+/* eslint-disable @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument -- pre-existing lint debt across this 800+ line bootstrap module. The flagged sites cross typed boundaries (Fastify request typing, AddonRouteRegistry, AuthService inherited methods) where the projectService context can't trace inheritance chains. Tracked separately; do not amend in unrelated edits. */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -36,23 +37,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-/* eslint-disable @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument -- pre-existing lint debt across this 800+ line bootstrap module. The flagged sites cross typed boundaries (Fastify request typing, AddonRouteRegistry, AuthService inherited methods) where the projectService context can't trace inheritance chains. Tracked separately; do not amend in unrelated edits. */
-const fastify_1 = require("@trpc/server/adapters/fastify");
-const ws_1 = require("@trpc/server/adapters/ws");
-const compress_1 = __importDefault(require("@fastify/compress"));
-const cookie_1 = __importDefault(require("@fastify/cookie"));
-const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
-const ws_2 = require("ws");
+const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
-const node_child_process_1 = require("node:child_process");
-const single_copy_cleanup_runner_js_1 = require("./single-copy-cleanup-runner.js");
-const logging_service_1 = require("./core/logging/logging.service");
-const event_bus_service_1 = require("./core/events/event-bus.service");
-const config_service_1 = require("./core/config/config.service");
-const auth_service_1 = require("./core/auth/auth.service");
-const share_token_service_1 = require("./core/auth/share-token.service");
-const handoff_code_service_1 = require("./core/auth/handoff-code.service");
 // Boot-time capability declaration runs over the auto-generated
 // `ALL_CAPABILITY_DEFINITIONS` array — every `*.cap.ts` file that ships
 // with `@camstack/types` is included automatically. Adding a new cap
@@ -64,39 +51,50 @@ const handoff_code_service_1 = require("./core/auth/handoff-code.service");
 // capability surface refreshes on `camstack deploy packages/system` with no new
 // server image. `@camstack/types` is never deployed to the hub.
 const system_1 = require("@camstack/system");
-const stream_probe_service_1 = require("./core/streaming/stream-probe.service");
-const feature_service_1 = require("./core/feature/feature.service");
-const agent_registry_service_1 = require("./core/agent/agent-registry.service");
-const moleculer_service_1 = require("./core/moleculer/moleculer.service");
+const compress_1 = __importDefault(require("@fastify/compress"));
+const cookie_1 = __importDefault(require("@fastify/cookie"));
+const fastify_1 = require("@trpc/server/adapters/fastify");
+const ws_1 = require("@trpc/server/adapters/ws");
+const ws_2 = require("ws");
+const addon_upload_1 = require("./api/addon-upload");
+const auth_whoami_1 = require("./api/auth-whoami");
+const health_routes_1 = require("./api/health/health.routes");
 const model_distributor_js_1 = require("./api/model-distributor.js");
-const addon_registry_service_1 = require("./core/addon/addon-registry.service");
-const addon_package_service_1 = require("./core/addon/addon-package.service");
-const repl_engine_service_1 = require("./core/repl/repl-engine.service");
-const network_quality_service_1 = require("./core/network/network-quality.service");
-const storage_service_1 = require("./core/storage/storage.service");
-const addon_bridge_service_1 = require("./core/addon-bridge/addon-bridge.service");
-const addon_pages_service_1 = require("./core/addon-pages/addon-pages.service");
-const addon_widgets_service_1 = require("./core/addon-widgets/addon-widgets.service");
-const trpc_router_1 = require("./api/trpc/trpc.router");
+const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
+const server_upload_1 = require("./api/server-upload");
+const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
+const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
+const spa_static_1 = require("./api/static/spa-static");
 const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
 const trpc_context_1 = require("./api/trpc/trpc.context");
+const trpc_router_1 = require("./api/trpc/trpc.router");
 const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
-const addon_upload_1 = require("./api/addon-upload");
-const server_upload_1 = require("./api/server-upload");
-const auth_whoami_1 = require("./api/auth-whoami");
-const system_2 = require("@camstack/system");
-const session_cookie_js_1 = require("./auth/session-cookie.js");
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
-const health_routes_1 = require("./api/health/health.routes");
-const spa_static_1 = require("./api/static/spa-static");
-const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
-const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
-const system_3 = require("@camstack/system");
+const session_cookie_js_1 = require("./auth/session-cookie.js");
 const boot_config_1 = require("./boot/boot-config");
-const manual_boot_1 = require("./manual-boot");
+const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
+const addon_package_service_1 = require("./core/addon/addon-package.service");
+const addon_registry_service_1 = require("./core/addon/addon-registry.service");
+const addon_bridge_service_1 = require("./core/addon-bridge/addon-bridge.service");
+const addon_pages_service_1 = require("./core/addon-pages/addon-pages.service");
+const addon_widgets_service_1 = require("./core/addon-widgets/addon-widgets.service");
+const agent_registry_service_1 = require("./core/agent/agent-registry.service");
+const auth_service_1 = require("./core/auth/auth.service");
+const handoff_code_service_1 = require("./core/auth/handoff-code.service");
+const share_token_service_1 = require("./core/auth/share-token.service");
+const config_service_1 = require("./core/config/config.service");
+const event_bus_service_1 = require("./core/events/event-bus.service");
+const feature_service_1 = require("./core/feature/feature.service");
+const logging_service_1 = require("./core/logging/logging.service");
+const moleculer_service_1 = require("./core/moleculer/moleculer.service");
+const network_quality_service_1 = require("./core/network/network-quality.service");
+const repl_engine_service_1 = require("./core/repl/repl-engine.service");
 const server_update_service_1 = require("./core/server-update/server-update.service");
-const integration_id_backfill_1 = require("./boot/integration-id-backfill");
+const storage_service_1 = require("./core/storage/storage.service");
+const stream_probe_service_1 = require("./core/streaming/stream-probe.service");
+const manual_boot_1 = require("./manual-boot");
+const single_copy_cleanup_runner_js_1 = require("./single-copy-cleanup-runner.js");
 // ---- Process-level error handlers ----
 process.on('uncaughtException', (err) => {
     console.error('[uncaughtException] Unhandled exception — server will continue:', err);
@@ -233,9 +231,9 @@ async function bootstrap() {
     // 256KB pages it committed at a sawtooth peak, and an ordinary major GC does not
     // return them. `createV8Reclaimer()` returns undefined if V8 declines, and the
     // heartbeat then behaves exactly as it did before.
-    const heapReclaimer = (0, system_2.createV8Reclaimer)();
+    const heapReclaimer = (0, system_1.createV8Reclaimer)();
     const heapReclaim = heapReclaimer === undefined ? undefined : { reclaim: heapReclaimer };
-    (0, system_2.startHeapWatch)('hub-main', undefined, undefined, heapReclaim);
+    (0, system_1.startHeapWatch)('hub-main', undefined, undefined, heapReclaim);
     // Clean up orphaned processes from previous crashes before starting
     cleanupOrphanProcesses();
     // SPA fallback — set later when admin UI is resolved, used by addon route catch-all
@@ -323,8 +321,8 @@ async function bootstrap() {
     // If registration fails, start in degraded mode: serve a health warning endpoint.
     // Instantiate new core services
     const loggingService = app.get(logging_service_1.LoggingService);
-    const addonRouteRegistry = new system_3.AddonRouteRegistry();
-    const dataPlaneRegistry = new system_3.DataPlaneRegistry();
+    const addonRouteRegistry = new system_1.AddonRouteRegistry();
+    const dataPlaneRegistry = new system_1.DataPlaneRegistry();
     // Use Fastify-managed notification/toast wrappers (globally provided by NotificationModule)
     const { NotificationServiceWrapper } = await Promise.resolve().then(() => __importStar(require('./core/notification/notification-wrapper.service')));
     const { ToastServiceWrapper } = await Promise.resolve().then(() => __importStar(require('./core/notification/toast-wrapper.service')));
@@ -369,9 +367,68 @@ async function bootstrap() {
     // and the distributed metrics-provider capability — no manual wiring needed.
     let trpcRegistered = false;
     let appRouter = null;
-    // Run app.init() FIRST so onModuleInit hooks complete (PipelineWiring, AddonBridge, etc.)
-    // before we build the tRPC router which depends on their results.
-    await app.init();
+    // Share-view (`csv_*`) tokens — hub-resident mint/verify/revoke over the
+    // settings backend (lazy getter: the backend lands after the sqlite-storage
+    // builtin registers; the service resolves it per call).
+    const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
+    // One-time native-app login handoff codes (in-memory, 60s TTL, single-use) —
+    // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
+    // public `auth.redeemHandoffCode`.
+    const handoffCodeService = new handoff_code_service_1.HandoffCodeService();
+    const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
+        authService: app.get(auth_service_1.AuthService),
+        shareTokenService,
+        handoffCodeService,
+        configService: config,
+        featureService: app.get(feature_service_1.FeatureService),
+        loggingService,
+        eventBus: app.get(event_bus_service_1.EventBusService),
+        agentRegistry: app.get(agent_registry_service_1.AgentRegistryService),
+        moleculer: app.get(moleculer_service_1.MoleculerService),
+        addonRegistry,
+        replEngine: app.get(repl_engine_service_1.ReplEngineService),
+        networkQualityService: app.get(network_quality_service_1.NetworkQualityService),
+        addonBridge: app.get(addon_bridge_service_1.AddonBridgeService),
+        addonPackageService: app.get(addon_package_service_1.AddonPackageService),
+        notificationService,
+        toastService,
+        capabilityRegistry,
+        streamProbe: app.get(stream_probe_service_1.StreamProbeService),
+        serverUpdateService: app.get(server_update_service_1.ServerUpdateService),
+    });
+    // ── The core-cap mesh bridge, mounted BEFORE a single addon boots (D171) ──
+    //
+    // `$core-caps` exposes the hub's core (non-addon) tRPC routers on the mesh so
+    // a forked addon's `ctx.api.<coreCap>` resolves. It used to be registered
+    // after `app.init()` returned — and `app.init()` IS the addon boot, so for
+    // the whole of it every core-cap call was structurally unanswerable:
+    // `brokerTransportLink` polled the full 30 s discovery deadline and
+    // fast-failed, with no boot-window retry (core caps are excluded from it).
+    // One such await held `device-manager`, and with it every camera (D167).
+    //
+    // The router is safe to build here: `buildCapabilityRouters` is driven by
+    // `ALL_CAPABILITY_DEFINITIONS` (declared above, before init) and every
+    // provider — registry singleton or `server-provided` factory — is resolved
+    // PER REQUEST, not at build time. That is the two-phase shape: the route is
+    // on the mesh immediately, each provider completes on its own schedule, and
+    // a caller that is early gets an immediate, typed answer instead of 30 s of
+    // silence. The same router instance is handed to Fastify after init, so
+    // there is exactly one.
+    await app.init({
+        beforeAddonBoot: () => {
+            try {
+                appRouter = buildRouter();
+                app.get(moleculer_service_1.MoleculerService).registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter));
+                console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — before addon boot');
+            }
+            catch (err) {
+                // Never abort boot for this: a hub without the bridge is degraded
+                // (core-cap calls fast-fail), a hub that refuses to start is down.
+                appRouter = null;
+                console.warn('[bootstrap] Failed to register core-cap mesh bridge early:', err);
+            }
+        },
+    });
     console.log('[bootstrap] app.init() complete — all onModuleInit hooks have run');
     // Mark registry as ready — providers from app.init() are now registered
     capabilityRegistry.ready();
@@ -429,35 +486,19 @@ async function bootstrap() {
     }
     try {
         const authService = app.get(auth_service_1.AuthService);
-        // Share-view (`csv_*`) tokens — hub-resident mint/verify/revoke over
-        // the settings backend (lazy getter: the backend lands after the
-        // sqlite-storage builtin registers; the service resolves it per call).
-        const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
-        // One-time native-app login handoff codes (in-memory, 60s TTL,
-        // single-use) — minted by `auth.createHandoffCode`, redeemed by the
-        // viewer app via the public `auth.redeemHandoffCode`.
-        const handoffCodeService = new handoff_code_service_1.HandoffCodeService();
-        appRouter = (0, trpc_router_1.buildAppRouter)({
-            authService,
-            shareTokenService,
-            handoffCodeService,
-            configService: config,
-            featureService: app.get(feature_service_1.FeatureService),
-            loggingService,
-            eventBus: app.get(event_bus_service_1.EventBusService),
-            agentRegistry: app.get(agent_registry_service_1.AgentRegistryService),
-            moleculer: app.get(moleculer_service_1.MoleculerService),
-            addonRegistry,
-            replEngine: app.get(repl_engine_service_1.ReplEngineService),
-            networkQualityService: app.get(network_quality_service_1.NetworkQualityService),
-            addonBridge: app.get(addon_bridge_service_1.AddonBridgeService),
-            addonPackageService: app.get(addon_package_service_1.AddonPackageService),
-            notificationService,
-            toastService,
-            capabilityRegistry,
-            streamProbe: app.get(stream_probe_service_1.StreamProbeService),
-            serverUpdateService: app.get(server_update_service_1.ServerUpdateService),
-        });
+        // Normally already built and bridged onto the mesh in `beforeAddonBoot`
+        // above — this is the fallback for the case where that failed, so a hub
+        // whose mesh bridge could not be mounted still serves HTTP.
+        if (appRouter === null) {
+            appRouter = buildRouter();
+            try {
+                app.get(moleculer_service_1.MoleculerService).registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter));
+                console.log('[bootstrap] core-cap mesh bridge registered ($core-caps) — late fallback');
+            }
+            catch (err) {
+                console.warn('[bootstrap] Failed to register core-cap mesh bridge:', err);
+            }
+        }
         await fastify.register(fastify_1.fastifyTRPCPlugin, {
             prefix: '/trpc',
             trpcOptions: {
@@ -487,17 +528,6 @@ async function bootstrap() {
             },
         });
         trpcRegistered = true;
-        // Mount the `$core-caps` Moleculer service so forked addons /
-        // remote agents can reach the hub's core (non-addon) tRPC routers
-        // through `ctx.api.<coreCap>`. Without it those calls hang in
-        // `brokerTransportLink`'s unbounded discovery wait.
-        try {
-            moleculer.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter));
-            console.log('[bootstrap] core-cap mesh bridge registered ($core-caps)');
-        }
-        catch (err) {
-            console.warn('[bootstrap] Failed to register core-cap mesh bridge:', err);
-        }
         // Register addon-pages static file endpoint
         const addonPagesService = app.get(addon_pages_service_1.AddonPagesService);
         fastify.get('/api/addon-pages/:addonId/*', async (request, reply) => {
@@ -873,7 +903,7 @@ async function bootstrap() {
                     : Buffer.isBuffer(request.body)
                         ? request.body
                         : Buffer.from(typeof request.body === 'string' ? request.body : JSON.stringify(request.body));
-                (0, system_3.proxyToUpstream)({
+                (0, system_1.proxyToUpstream)({
                     baseUrl: dpMatch.endpoint.baseUrl,
                     secret: dpMatch.endpoint.secret,
                     upstreamPath,

package/dist/manual-boot.js

@@ -46,10 +46,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.bootManual = bootManual;
 const node_crypto_1 = require("node:crypto");
 const path = __importStar(require("node:path"));
+const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 const fastify_1 = __importDefault(require("fastify"));
 const addon_upload_1 = require("./api/addon-upload");
 const cap_providers_1 = require("./api/core/cap-providers");
+const init_sequence_1 = require("./boot/init-sequence");
 const post_boot_service_1 = require("./boot/post-boot.service");
 const addon_package_service_1 = require("./core/addon/addon-package.service");
 const addon_registry_service_1 = require("./core/addon/addon-registry.service");
@@ -109,6 +111,17 @@ async function bootManual(opts) {
     const toastWrapper = new toast_wrapper_service_1.ToastServiceWrapper();
     // ---- Layer 1: need ConfigService / LoggingService -----------------------
     const loggingService = new logging_service_1.LoggingService(configService);
+    // Bootstrap stdout, attached at the FIRST moment a LogManager exists.
+    //
+    // The real console destination is a core builtin that boots in pass 3, after
+    // the entire runner plan: a measured boot produced no stdout at all for ~40 s
+    // and then flushed the whole backlog newest-first, so every boot
+    // investigation needed a parser (docs/design/boot-to-usable-camera.md, F).
+    // This sink carries the window and is detached — without a second flush —
+    // the moment `console-logging` registers.
+    const bootstrapConsole = new system_1.ConsoleDestination();
+    void bootstrapConsole.initialize();
+    loggingService.attachBootstrapConsole(bootstrapConsole);
     const eventBusService = new event_bus_service_1.EventBusService(configService);
     // Wire device-name cache for log formatter — subscribes here so the
     // very first DeviceRegistered event populates the cache before any
@@ -325,27 +338,31 @@ async function bootManual(opts) {
             process.once('SIGTERM', handler);
             process.once('SIGINT', handler);
         },
-        async init() {
-            // Init order (dependency-graph-derived):
-            //   1. MoleculerService — starts broker and calls EventBus.attachBroker()
-            //   2. AddonBridgeService — no cross-service deps
-            //   3. AgentRegistryService — subscribes to broker.localBus.on('$node.connected')
-            //   4. AddonRegistryService — boots every addon (needs broker live + config)
-            await moleculerService.onModuleInit();
-            await addonBridgeService.onModuleInit();
-            agentRegistryService.onModuleInit();
-            await addonRegistryService.onModuleInit();
-            // Reconcile already-connected agents now that the hub's installed
-            // addon set is populated. Agents online before the hub started never
-            // fire a fresh `$node.connected` event, so the per-connect trigger
-            // alone would miss them — this catches the boot-time case (e.g. a
-            // long-running dev-agent with a now-stale addon). Fire-and-forget so
-            // an unreachable agent never delays boot.
-            void agentRegistryService.reconcileConnectedAgents();
-            // Topology emitter must boot AFTER AgentRegistry + AddonRegistry —
-            // its initial snapshot reads both. Subscribes to lifecycle events
-            // for incremental snapshots and emits a periodic safety net.
-            topologyEmitterService.onModuleInit();
+        async init(hooks = {}) {
+            // The order and the `beforeAddonBoot` seam live in `runBootInitSequence`
+            // — see `boot/init-sequence.ts` for why that seam is load-bearing.
+            await (0, init_sequence_1.runBootInitSequence)({
+                moleculer: () => moleculerService.onModuleInit(),
+                addonBridge: () => addonBridgeService.onModuleInit(),
+                agentRegistry: () => {
+                    agentRegistryService.onModuleInit();
+                },
+                ...(hooks.beforeAddonBoot !== undefined ? { beforeAddonBoot: hooks.beforeAddonBoot } : {}),
+                addonBoot: () => addonRegistryService.onModuleInit(),
+                afterAddonBoot: () => {
+                    // Reconcile already-connected agents now that the hub's installed
+                    // addon set is populated. Agents online before the hub started never
+                    // fire a fresh `$node.connected` event, so the per-connect trigger
+                    // alone would miss them — this catches the boot-time case (e.g. a
+                    // long-running dev-agent with a now-stale addon). Fire-and-forget so
+                    // an unreachable agent never delays boot.
+                    void agentRegistryService.reconcileConnectedAgents();
+                    // Topology emitter must boot AFTER AgentRegistry + AddonRegistry —
+                    // its initial snapshot reads both. Subscribes to lifecycle events
+                    // for incremental snapshots and emits a periodic safety net.
+                    topologyEmitterService.onModuleInit();
+                },
+            });
         },
         async listen(port, host) {
             await fastify.listen({ port, host });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.113",
+  "version": "1.2.115",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.62",
+    "@camstack/addon-admin-ui": "1.2.64",
     "@camstack/addon-agent-ui": "1.2.17",
     "@camstack/addon-auth": "1.2.19",
     "@camstack/addon-decoder-nodeav": "1.2.16",
     "@camstack/addon-notifiers": "1.2.21",
-    "@camstack/addon-pipeline": "1.2.79",
-    "@camstack/addon-pipeline-orchestrator": "1.2.59",
-    "@camstack/addon-post-analysis": "1.2.78",
+    "@camstack/addon-pipeline": "1.2.81",
+    "@camstack/addon-pipeline-orchestrator": "1.2.60",
+    "@camstack/addon-post-analysis": "1.2.79",
     "@camstack/sdk": "1.2.19",
     "@camstack/shm-ring": "1.1.16",
-    "@camstack/system": "1.2.91",
-    "@camstack/types": "1.2.75",
-    "@camstack/ui-library": "1.2.52",
+    "@camstack/system": "1.2.93",
+    "@camstack/types": "1.2.77",
+    "@camstack/ui-library": "1.2.54",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",