@camstack/server 1.2.592 → 1.2.594

package/dist/core/moleculer/moleculer.service.js

@@ -1,29 +1,20 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ChildManifestGate = exports.CHILD_MANIFEST_SKIP_SAMPLE = exports.MoleculerService = void 0;
-exports.childOwnerToken = childOwnerToken;
-exports.buildChildUdsManifest = buildChildUdsManifest;
-const node_crypto_1 = require("node:crypto");
-const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
-const cap_router_runtime_js_1 = require("../../api/trpc/cap-router-runtime.js");
-const core_cap_bridge_js_1 = require("../../api/trpc/core-cap-bridge.js");
-const agent_readiness_pull_js_1 = require("./agent-readiness-pull.js");
-const agent_registration_request_js_1 = require("./agent-registration-request.js");
-const hub_mesh_guard_js_1 = require("./hub-mesh-guard.js");
-const cap_call_fn_js_1 = require("./cap-call-fn.js");
-const cap_route_authority_js_1 = require("./cap-route-authority.js");
-class MoleculerService {
+import { randomUUID } from 'node:crypto';
+import { AGENT_READINESS_SERVICE_NAME, CapRouteError, CapRouteResolver, callWithServiceDiscovery, capActionName, createBroker, createHubCapForwardService, createHubService, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessServiceForRegistry, createStreamProbeBrokerService, createUdsEventBridge, expandCapMethods, getBrokerTlsTransporter, getCapUsageRegistry, HubNodeRegistry, getProcessMeshCertificateRegistry, getProcessPeerLeaf, isInfraCapability, LocalChildRegistry, localEndpointPath, registerEventBusService, serializeTypedArrays, setNodeEventInterest, emitProcessNodeRegistered, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, subscribePassthrough, udsChildLogToWorkerEntry, UNCLAIMED, answerClaimedGetStatus, } from '@camstack/system';
+import { EventCategory, emitReadiness, errMsg, ReadinessRegistry } from '@camstack/types';
+import { addonPinOf, aggregateCollectionCall, COLLECTION_ARRAY_METHODS, devicePinOf, pinnedCollectionCall, pinnedDeviceCollectionCall, } from '../../api/trpc/cap-router-runtime.js';
+import { isCoreServiceCapName } from '../../api/trpc/core-cap-bridge.js';
+import { filterAgentAuthoritativeRecords } from './agent-readiness-pull.js';
+import { requestAgentRegistration } from './agent-registration-request.js';
+import { HubMeshGuard } from './hub-mesh-guard.js';
+import { buildCapCallFn } from './cap-call-fn.js';
+import { createHubResidentProviderLookup, createInProcessProviderLookup, createNodeCapAuthority, } from './cap-route-authority.js';
+export class MoleculerService {
     eventBus;
     config;
     logging;
     capabilityService;
     streamProbe;
     broker;
-    /** Narrow-typed view of `this.broker` — see `BrokerLike` doc above. */
-    get brokerSafe() {
-        return this.broker;
-    }
     logger;
     /**
      * D802, D857 — who may talk to the hub over the mesh: the broker middleware
@@ -35,7 +26,7 @@ class MoleculerService {
      * D3 authority: union of every node's manifest delivered via
      * `$hub.registerNode`. Populated by `onRegisterNode` in `hubDeps`.
      */
-    nodeRegistry = new system_1.HubNodeRegistry();
+    nodeRegistry = new HubNodeRegistry();
     /**
      * nodeId → the owner token of the INCARNATION whose manifest currently backs
      * that node's capability registrations.
@@ -172,7 +163,7 @@ class MoleculerService {
     /** This hub's Moleculer node id (e.g. `hub`). Hub-local forked children
      *  register under `${nodeId}/${runnerId}`. */
     get nodeId() {
-        return this.brokerSafe.nodeID;
+        return this.broker.nodeID;
     }
     constructor(eventBus, config, logging, capabilityService, streamProbe) {
         this.eventBus = eventBus;
@@ -193,8 +184,8 @@ class MoleculerService {
         // `no-unsafe-assignment`. Going via `unknown` documents the boundary.
         // No shared secret (D857): the Moleculer namespace was never authentication (TCP
         // ignores it); a node is admitted by the certificate it presented at the TLS handshake.
-        this.meshGuard = new hub_mesh_guard_js_1.HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
-        const broker = (0, system_1.createBroker)({
+        this.meshGuard = new HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
+        const broker = createBroker({
             nodeID: 'hub',
             mode: 'hub',
             // D802, D857: every action and event another node sends passes the certificate gate.
@@ -206,9 +197,9 @@ class MoleculerService {
         // (eventemitter2 chain unresolvable). Documented + single-site cast.
         // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
         this.broker = broker;
-        this.readinessRegistry = new types_1.ReadinessRegistry({
+        this.readinessRegistry = new ReadinessRegistry({
             eventBus: this.eventBus,
-            sourceNodeId: this.brokerSafe.nodeID,
+            sourceNodeId: this.broker.nodeID,
             logger: this.logging.createLogger('readiness'),
         });
     }
@@ -251,19 +242,20 @@ class MoleculerService {
                 });
             },
             onSetLogLevel: (level) => {
-                const factory = this.brokerSafe.logger;
-                const appenders = factory['appenders'];
+                const factory = this.broker.logger;
+                const moleculerLogFactory = factory;
+                const appenders = moleculerLogFactory.appenders;
                 if (appenders) {
                     for (const appender of appenders) {
                         appender.opts.level = level;
                     }
                 }
-                const cache = factory['cache'];
+                const cache = moleculerLogFactory.cache;
                 if (cache) {
                     cache.clear();
                 }
                 logger.info('Moleculer log level changed', { meta: { level } });
-                this.brokerSafe.call('$process.setLogLevel', { level }).catch(() => { });
+                this.broker.call('$process.setLogLevel', { level }).catch(() => { });
             },
             // D3: registration-handshake path. Nodes send $hub.registerNode with
             // their complete capability manifest; the hub applies it immediately.
@@ -276,8 +268,8 @@ class MoleculerService {
             // D857: a node registers only itself, and only with a certificate identity.
             meshIdentity: this.meshGuard.gate,
         };
-        const hubService = (0, system_1.createHubService)(hubDeps);
-        this.brokerSafe.createService(hubService);
+        const hubService = createHubService(hubDeps);
+        this.broker.createService(hubService);
         // Forked addon-runner children must root their storage (addons-data,
         // the sqlite settings DB) under the SAME data path as the hub's main
         // process. The configured key is `server.dataPath` (populated from the
@@ -293,7 +285,7 @@ class MoleculerService {
         // broker-only — no parentUdsPath is propagated.
         let parentUdsPath;
         try {
-            const nodeId = this.brokerSafe.nodeID;
+            const nodeId = this.broker.nodeID;
             // F0 (slice-5 outbound): when a forked child issues `ctx.api.<cap>` for a
             // cap NO local sibling owns, route it from the PARENT and return the
             // result over UDS — resolver-first, broker-fallback. Closes over `this`
@@ -304,7 +296,7 @@ class MoleculerService {
             // capabilities the resolver can see. Before F0 this fell through
             // UDS_NO_ROUTE → the child's own brokerTransportLink; F1+F2 removes that
             // child broker, so the parent must own this path.
-            const onUnownedCall = (0, system_1.createParentUnownedCallHandler)({
+            const onUnownedCall = createParentUnownedCallHandler({
                 getResolver: () => this.resolver,
                 // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- moleculer types unresolvable; see `broker` getter docstring
                 broker: this.broker,
@@ -362,7 +354,7 @@ class MoleculerService {
                         return null;
                     if (reg.getDefinition(capName)?.mode !== 'collection')
                         return null;
-                    if (!cap_router_runtime_js_1.COLLECTION_ARRAY_METHODS.get(capName)?.includes(method))
+                    if (!COLLECTION_ARRAY_METHODS.get(capName)?.includes(method))
                         return null;
                     if (reg.getCollectionEntries(capName).length > 0)
                         return null;
@@ -376,7 +368,7 @@ class MoleculerService {
                 // never disagree again). Routing alone picks ONE provider, which is
                 // how the Notification Center saw an empty `notification-output`
                 // catalog and dead-lettered every notification (2026-07-30).
-                callCollectionAggregate: (capName, method, args) => (0, cap_router_runtime_js_1.aggregateCollectionCall)(this.capabilityService.getRegistry(), capName, method, args),
+                callCollectionAggregate: (capName, method, args) => aggregateCollectionCall(this.capabilityService.getRegistry(), capName, method, args),
                 // `{ addonId }` PIN for the same child→parent path — the scalar twin of
                 // the fan-out above, sharing this server's provider resolution so the
                 // two paths cannot disagree. Routing takes only `nodeId`/`deviceId`, so
@@ -391,7 +383,7 @@ class MoleculerService {
                 // addon's clip byte read named `provider-reolink` and was answered by
                 // whichever child registered first — the recorder, then export-hap
                 // after a redeploy in a different order (2026-09-22, D594).
-                callPinnedCollection: async (capName, method, args) => (await (0, cap_router_runtime_js_1.pinnedDeviceCollectionCall)(this.capabilityService.getRegistry(), capName, method, args)) ?? (0, cap_router_runtime_js_1.pinnedCollectionCall)(this.capabilityService.getRegistry(), capName, method, args),
+                callPinnedCollection: async (capName, method, args) => (await pinnedDeviceCollectionCall(this.capabilityService.getRegistry(), capName, method, args)) ?? pinnedCollectionCall(this.capabilityService.getRegistry(), capName, method, args),
                 // Hub-core `$`-service discriminant for the general
                 // provider-not-yet-registered recovery. A resolver miss on a NON-core
                 // cap (any addon-provided system/singleton cap, e.g.
@@ -401,7 +393,7 @@ class MoleculerService {
                 // predicate lets it retry the resolver + throw a precise error instead.
                 // Derived from the already-maintained core-router list, so a new
                 // multi-node addon cap is covered with no change here.
-                isCoreServiceCap: (capName) => (0, core_cap_bridge_js_1.isCoreServiceCapName)(capName),
+                isCoreServiceCap: (capName) => isCoreServiceCapName(capName),
                 logger: {
                     debug: (msg, meta) => logger.debug(msg, meta !== null && meta !== undefined
                         ? { meta: meta }
@@ -419,7 +411,7 @@ class MoleculerService {
             // `broker.call('$hub-cap-fwd.forward', …)` discovers it here. Without it a
             // remote agent's raw `${cap}.*` discovery 30s-deadlines (hub-local addon
             // runners expose no Moleculer service). See hub-cap-forward.ts.
-            this.brokerSafe.createService((0, system_1.createHubCapForwardService)(onUnownedCall, {
+            this.broker.createService(createHubCapForwardService(onUnownedCall, {
                 // The agent stamps WHO is calling (its child's runner id) into the
                 // envelope (D787). Believe it only when that runner is on the agent
                 // the request came from — a node's registered manifest lists the
@@ -429,8 +421,8 @@ class MoleculerService {
                     meta: { senderNodeId, callerRunnerId },
                 }),
             }));
-            const registry = new system_1.LocalChildRegistry({
-                server: (0, system_1.createLocalTransport)().createServer(nodeId),
+            const registry = new LocalChildRegistry({
+                server: createLocalTransport().createServer(nodeId),
                 // This node's own id — lets the cap-call-out router serve a pin-to-self
                 // from the co-resident sibling instead of bouncing it through
                 // onUnownedCall (a pin to ANOTHER node still bypasses the sibling).
@@ -456,7 +448,7 @@ class MoleculerService {
                         return false;
                     if (reg.getDefinition(capName)?.mode !== 'collection')
                         return false;
-                    return cap_router_runtime_js_1.COLLECTION_ARRAY_METHODS.get(capName)?.includes(method) === true;
+                    return COLLECTION_ARRAY_METHODS.get(capName)?.includes(method) === true;
                 },
                 // Same story for an explicit `{ addonId }` selector: the sibling
                 // short-circuit picks the FIRST-registered child, which is precisely
@@ -472,8 +464,8 @@ class MoleculerService {
                 // routing that would honour it — "honoured only there is honoured
                 // never", which is how the first attempt at the `addonId` fix failed
                 // live, and how the `provider` pin failed twice more (D592, D593).
-                isAddonPinnedCall: (capName, method, args) => (0, cap_router_runtime_js_1.addonPinOf)(this.capabilityService.getRegistry(), capName, method, args) !== null ||
-                    (0, cap_router_runtime_js_1.devicePinOf)(this.capabilityService.getRegistry(), capName, args) !== null,
+                isAddonPinnedCall: (capName, method, args) => addonPinOf(this.capabilityService.getRegistry(), capName, method, args) !== null ||
+                    devicePinOf(this.capabilityService.getRegistry(), capName, args) !== null,
                 // Bound every UDS cap call by the cap's own declared timeout, falling
                 // back to the channel default. Same resolver the REMOTE plane uses
                 // below, so a method that survives 16 minutes across nodes survives it
@@ -487,7 +479,7 @@ class MoleculerService {
                 // RUNNER's own module singleton, which hub-main never sees — which is
                 // why the graph answered `[]` on a hub running 64 addons. Blind spots
                 // that remain are listed on `LocalChildRegistryOptions.capUsageObserver`.
-                capUsageObserver: (obs) => (0, system_1.getCapUsageRegistry)().recordCall(obs),
+                capUsageObserver: (obs) => getCapUsageRegistry().recordCall(obs),
                 logger: {
                     info: (msg, meta) => logger.info(msg, meta !== null && meta !== undefined
                         ? { meta: meta }
@@ -516,7 +508,7 @@ class MoleculerService {
             // Phase F removes the child broker; `onRegisterNode`'s diff logic ensures
             // double-apply is idempotent (same nodeId + same caps → no-op on the second call).
             registry.onChildRegistered((child) => {
-                const hubNodeId = this.brokerSafe.nodeID;
+                const hubNodeId = this.broker.nodeID;
                 const childNodeId = `${hubNodeId}/${child.childId}`;
                 // The catalogs first, and unconditionally: the manifest gate below
                 // judges CAPS, and a frame whose caps are unchanged may still be the
@@ -528,7 +520,7 @@ class MoleculerService {
                     }
                     catch (err) {
                         logger.warn('UDS child custom-action catalogs could not be applied', {
-                            meta: { nodeId: childNodeId, incarnation: child.incarnation, error: (0, types_1.errMsg)(err) },
+                            meta: { nodeId: childNodeId, incarnation: child.incarnation, error: errMsg(err) },
                         });
                     }
                 }
@@ -551,7 +543,7 @@ class MoleculerService {
                                 nodeId: childNodeId,
                                 incarnation: child.incarnation,
                                 skipped: this.childManifestGate.skippedSince(),
-                                sampleEvery: exports.CHILD_MANIFEST_SKIP_SAMPLE,
+                                sampleEvery: CHILD_MANIFEST_SKIP_SAMPLE,
                             },
                         });
                     }
@@ -568,7 +560,7 @@ class MoleculerService {
             // E1: cleanup on child disconnect — same effect as `$node.disconnected`
             // for hub-local children. The Moleculer path stays for AGENT nodes.
             registry.onChildGone((childId, incarnation) => {
-                const hubNodeId = this.brokerSafe.nodeID;
+                const hubNodeId = this.broker.nodeID;
                 const childNodeId = `${hubNodeId}/${childId}`;
                 // The successor's first register must be a FIRST register: leaving the
                 // record behind would let a same-incarnation reconnect (mixed-version
@@ -585,7 +577,7 @@ class MoleculerService {
             // This runs in PARALLEL with the existing $hub.log / onLog broker path —
             // both stay active until Phase F removes the broker path.
             registry.onChildLog((childId, entry) => {
-                this.logging.writeFromWorker((0, system_1.udsChildLogToWorkerEntry)(childId, entry));
+                this.logging.writeFromWorker(udsChildLogToWorkerEntry(childId, entry));
             });
             // D1: answer readiness-snapshot requests from UDS children so they can
             // hydrate without a `$readiness.getSnapshot` Moleculer call.
@@ -596,7 +588,7 @@ class MoleculerService {
             // Keep `$readiness.getSnapshot` intact — Phase F removes it.
             registry.onReadinessSnapshotRequest(() => this.readinessRegistry.getSnapshotForTransport());
             this.localChildRegistry = registry;
-            parentUdsPath = (0, system_1.localEndpointPath)(nodeId);
+            parentUdsPath = localEndpointPath(nodeId);
             logger.info('UDS child registry listening', { meta: { path: parentUdsPath } });
         }
         catch (err) {
@@ -604,15 +596,14 @@ class MoleculerService {
                 meta: { err: err instanceof Error ? err.message : String(err) },
             });
         }
-        const processService = (0, system_1.createProcessService)(this.brokerSafe.nodeID, dataDir, undefined, undefined, parentUdsPath);
-        this.brokerSafe.createService(processService);
+        const processService = createProcessService(this.broker.nodeID, dataDir, undefined, undefined, parentUdsPath);
+        this.broker.createService(processService);
         // $addonHost — REMOVED (Sprint 6). Three-level settings are now
         // served by the `addon-settings` singleton capability. Per-addon
         // Moleculer services expose `settings.*` actions for remote agents.
         // D3: mirror $node.disconnected onto the registry path so nodes that
         // sent a $hub.registerNode manifest get cleaned up on disconnect.
-        const bridgeBus = this.broker;
-        bridgeBus.localBus.on('$node.disconnected', ({ node }) => {
+        this.broker.localBus.on('$node.disconnected', ({ node }) => {
             // No owner token: this listener cannot observe WHICH incarnation died.
             // For a hub-local child the UDS `onChildGone` is the authority (it holds
             // the incarnation) and this call is refused if the id has been reclaimed;
@@ -620,7 +611,7 @@ class MoleculerService {
             this.removeNodeFromRegistry(node.id);
             this.meshGuard.forget(node.id);
             // Release A: its next connection decides again whether it is `tls` or `clear`.
-            (0, system_1.getBrokerTlsTransporter)(this.broker)?.forgetPeer(node.id);
+            getBrokerTlsTransporter(this.broker)?.forgetPeer(node.id);
         });
         // D8 reverse-leg snapshot-reconcile: on every agent (re)connect, pull
         // the agent's own readiness snapshot (`$agent-readiness.getSnapshot`)
@@ -630,16 +621,16 @@ class MoleculerService {
         // this registry stuck on the synthesized `down` forever (2026-07-17:
         // pipeline-executor@little-unraid, 3.5h dispatch outage). The
         // periodic sweep below repairs deltas lost while CONNECTED.
-        bridgeBus.localBus.on('$node.connected', ({ node }) => {
+        this.broker.localBus.on('$node.connected', ({ node }) => {
             const nodeId = node.id;
-            if (nodeId === this.brokerSafe.nodeID || nodeId.includes('/'))
+            if (nodeId === this.broker.nodeID || nodeId.includes('/'))
                 return;
             void this.pullAgentReadinessSnapshot(nodeId);
             // The hub may have dropped this agent's registration on a disconnect
             // only the hub saw (gossip, a failed write): ask it for its full set
             // (`agent-registration-request.ts`, 2026-10-14).
-            void (0, agent_registration_request_js_1.requestAgentRegistration)({
-                call: (action, params, opts) => this.brokerSafe.call(action, params, opts),
+            void requestAgentRegistration({
+                call: (action, params, opts) => this.broker.call(action, params, opts),
                 isRegistered: (id) => this.isNodeRegistered(id),
                 warn: (message, id, meta) => this.logger.warn(message, { tags: { nodeId: id }, meta }),
                 info: (message, id, meta) => this.logger.info(message, { tags: { nodeId: id }, meta }),
@@ -647,7 +638,7 @@ class MoleculerService {
         });
         this.agentReadinessPullTimer = setInterval(() => {
             for (const nodeId of this.nodeRegistry.listNodeIds()) {
-                if (nodeId === this.brokerSafe.nodeID || nodeId.includes('/'))
+                if (nodeId === this.broker.nodeID || nodeId.includes('/'))
                     continue;
                 void this.pullAgentReadinessSnapshot(nodeId);
             }
@@ -660,26 +651,26 @@ class MoleculerService {
         // handshake, not dynamically after post-start `createService()`.
         // Without this, cross-node broadcasts (camstack.evt.<category>) would
         // arrive unreliably for the first ~10s after each node joins.
-        (0, system_1.registerEventBusService)(this.broker);
+        registerEventBusService(this.broker);
         // Register the hub-authoritative `$readiness.getSnapshot` service
         // BEFORE broker.start() so workers / agents see it in their initial
         // INFO packet — post-start `createService` calls propagate via
         // heartbeat (several seconds) and would force workers to poll.
-        this.brokerSafe.createService((0, system_1.createReadinessServiceForRegistry)(this.readinessRegistry));
+        this.broker.createService(createReadinessServiceForRegistry(this.readinessRegistry));
         // Register the hub-authoritative `$stream-probe` service —
         // workers route RTSP probe + field-probe through this action when
         // the tRPC WSS link isn't available (default path for forked
         // workers). Keeps ffprobe + HTTP-reachability as a single
         // hub-side implementation; see `createStreamProbeBrokerService`
         // for the shape.
-        this.brokerSafe.createService((0, system_1.createStreamProbeBrokerService)({
+        this.broker.createService(createStreamProbeBrokerService({
             probe: (url, options) => this.streamProbe.probe(url, options),
             probeField: (key, value) => this.streamProbe.probeField(key, value),
         }));
         // D826: when system-config's MeshCaKeeper becomes ready it offers hub leaf
         // material here; the transporter listens on mutual TLS only (:6443).
-        (0, system_1.setProcessMeshTlsEnabler)(async (material) => {
-            const tx = (0, system_1.getBrokerTlsTransporter)(this.broker);
+        setProcessMeshTlsEnabler(async (material) => {
+            const tx = getBrokerTlsTransporter(this.broker);
             if (tx === null) {
                 logger.warn('Mesh TLS material ready but broker transporter is not TlsTcpTransporter');
                 return;
@@ -687,13 +678,13 @@ class MoleculerService {
             await tx.enableMeshTls(material);
             logger.info('Mesh mTLS listener enabled (TLS-only hub mesh)');
         });
-        (0, system_1.setProcessMeshPeerTransportLookup)({
-            transportOf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerTransport(nodeId),
-            isVerifiedPeer: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.verifiedPeer(nodeId) !== undefined,
-            peerLeaf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerLeaf(nodeId),
-            dropPeer: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.dropPeer(nodeId) ?? 0,
+        setProcessMeshPeerTransportLookup({
+            transportOf: (nodeId) => getBrokerTlsTransporter(this.broker)?.peerTransport(nodeId),
+            isVerifiedPeer: (nodeId) => getBrokerTlsTransporter(this.broker)?.verifiedPeer(nodeId) !== undefined,
+            peerLeaf: (nodeId) => getBrokerTlsTransporter(this.broker)?.peerLeaf(nodeId),
+            dropPeer: (nodeId) => getBrokerTlsTransporter(this.broker)?.dropPeer(nodeId) ?? 0,
         });
-        await this.brokerSafe.start();
+        await this.broker.start();
         logger.info('Moleculer broker started (TCP transport)');
         // Construct the CapRouteResolver now that both the broker and
         // localChildRegistry are ready. The resolver reads live registry state
@@ -701,21 +692,21 @@ class MoleculerService {
         // children connecting/disconnecting after this point are picked up
         // correctly. The localChildRegistry reference is captured and may be
         // null if UDS failed to start.
-        this.resolver = new system_1.CapRouteResolver({
-            hubNodeId: this.brokerSafe.nodeID,
-            broker: this.brokerSafe,
+        this.resolver = new CapRouteResolver({
+            hubNodeId: this.broker.nodeID,
+            broker: this.broker,
             hubLocalRegistry: this.localChildRegistry,
-            nodeAuthority: (0, cap_route_authority_js_1.createNodeCapAuthority)(this.nodeRegistry, {
+            nodeAuthority: createNodeCapAuthority(this.nodeRegistry, {
                 resolveSingleton: (capName, nodeId) => this.capabilityService.getRegistry()?.resolveSingletonAddonIdForNode(capName, nodeId) ??
                     null,
             }),
-            inProcessProviders: (0, cap_route_authority_js_1.createInProcessProviderLookup)(this.capabilityService),
+            inProcessProviders: createInProcessProviderLookup(this.capabilityService),
             // Node-accurate lookup for EXPLICITLY hub-pinned calls: unlike the
             // lookup above (which falls back to the cluster-elected ACTIVE
             // singleton — possibly a remote proxy), this resolves only providers
             // physically resident on the hub, so a `nodePin('hub')` fails precisely
             // instead of silently executing on another node.
-            hubResidentProviders: (0, cap_route_authority_js_1.createHubResidentProviderLookup)(this.capabilityService),
+            hubResidentProviders: createHubResidentProviderLookup(this.capabilityService),
             // Per-cap-method RPC timeout override (e.g. model-convert.convert, which
             // runs for minutes) — read from the cap definition's declared timeoutMs.
             capTimeoutMs: (capName, method) => this.capabilityService.getRegistry()?.getDefinition(capName)?.methods?.[method]?.timeoutMs,
@@ -736,15 +727,15 @@ class MoleculerService {
         // is wired after attachBroker so the parentBus is backed by the real
         // shared broker bus and broker.broadcast is live.
         if (this.localChildRegistry !== null) {
-            const hubNodeId = this.brokerSafe.nodeID;
-            this.udsEventBridgeDispose = (0, system_1.createUdsEventBridge)({
+            const hubNodeId = this.broker.nodeID;
+            this.udsEventBridgeDispose = createUdsEventBridge({
                 registry: this.localChildRegistry,
                 parentBus: this.eventBus,
                 parentNodeId: hubNodeId,
                 // D2: relay via pass-through so the bridge's wildcard is not counted as
                 // local interest (uniform with the agent; harmless here since the hub
                 // retains and always accepts inbound cross-node events anyway).
-                subscribePassthrough: (handler) => (0, system_1.subscribePassthrough)(this.broker, handler),
+                subscribePassthrough: (handler) => subscribePassthrough(this.broker, handler),
             });
             // D2: expose the hub's aggregate child interest to its `$event-bus`
             // inbound gate for uniformity with the agent. NOTE: the hub main process
@@ -754,7 +745,7 @@ class MoleculerService {
             // wiring is therefore harmless-but-uniform; the real efficiency win is on
             // agents (non-retaining nodes).
             const hubChildRegistry = this.localChildRegistry;
-            (0, system_1.setNodeEventInterest)(this.broker, () => hubChildRegistry.aggregateEventInterest());
+            setNodeEventInterest(this.broker, () => hubChildRegistry.aggregateEventInterest());
         }
     }
     /**
@@ -763,7 +754,7 @@ class MoleculerService {
      * the updated service list to the network.
      */
     registerLogReceiver() {
-        this.brokerSafe.createService({
+        this.broker.createService({
             name: 'log-receiver',
             actions: {
                 ingest: {
@@ -795,7 +786,7 @@ class MoleculerService {
      * `registerLogReceiver` relies on the same post-init registration.
      */
     registerCoreCapService(service) {
-        this.brokerSafe.createService(service);
+        this.broker.createService(service);
     }
     /**
      * The hub's claim authority (D663, S3): `CapabilityRegistry.resolveClaimedStatus`,
@@ -806,7 +797,7 @@ class MoleculerService {
         const registry = this.capabilityService.getRegistry();
         return registry !== null
             ? registry.resolveClaimedStatus(capName, deviceId)
-            : Promise.resolve(system_1.UNCLAIMED);
+            : Promise.resolve(UNCLAIMED);
     }
     /**
      * Call a capability method on a specific node.
@@ -831,7 +822,7 @@ class MoleculerService {
         // a `nodeId` pin — the generated DeviceProxy always sends one — and every
         // hub in-process addon's `ctx.api` through `deviceCapResolverLink`); a pin
         // does not bypass the claim authority. Same shared function as the other two.
-        const claimed = await (0, system_1.answerClaimedGetStatus)((capName, deviceId) => this.resolveClaimedStatus(capName, deviceId), { capName: capabilityName, method: methodName, args: params });
+        const claimed = await answerClaimedGetStatus((capName, deviceId) => this.resolveClaimedStatus(capName, deviceId), { capName: capabilityName, method: methodName, args: params });
         if (claimed !== null)
             return claimed.slice;
         const resolver = this.resolver;
@@ -846,7 +837,7 @@ class MoleculerService {
                 return await resolver.dispatch(route, methodName, params);
             }
             catch (err) {
-                if (err instanceof system_1.CapRouteError &&
+                if (err instanceof CapRouteError &&
                     (err.reason === 'no-provider' || err.reason === 'node-offline')) {
                     // Resolver couldn't find the cap — try the legacy callFn store as a
                     // fallback. This covers caps registered in nodeCallFns (e.g. agent
@@ -867,7 +858,7 @@ class MoleculerService {
         // Pre-init fallback (resolver not yet constructed — before onModuleInit).
         // This path is only reachable in tests that drive onRegisterNode without
         // calling onModuleInit first.
-        if (nodeId === 'hub' || nodeId === this.brokerSafe.nodeID) {
+        if (nodeId === 'hub' || nodeId === this.broker.nodeID) {
             const registry = this.capabilityService.getRegistry();
             const provider = registry?.getSingleton(capabilityName) ?? null;
             if (provider !== null) {
@@ -881,7 +872,7 @@ class MoleculerService {
         if (callFn) {
             return callFn(methodName, params);
         }
-        throw new system_1.CapRouteError(capabilityName, methodName, {
+        throw new CapRouteError(capabilityName, methodName, {
             reason: 'no-provider',
             nodeId,
             rejected: [
@@ -912,7 +903,7 @@ class MoleculerService {
         this.observePresentedMeshLeaf(params.nodeId);
         // The node's capabilities are routable now: whoever waits for this registration (a mesh
         // leaf renewal confirming the node came back WITH the new leaf) is told, with no polling.
-        (0, system_1.emitProcessNodeRegistered)(params.nodeId, params.addons.map((addon) => addon.addonId));
+        emitProcessNodeRegistered(params.nodeId, params.addons.map((addon) => addon.addonId));
         // Notify AgentRegistryService to reconcile placement for bare-ID
         // agent nodes (no '/' = not a hub child worker, not the hub itself).
         // The handshake is the authoritative completeness signal — the full
@@ -946,7 +937,7 @@ class MoleculerService {
      */
     applyNodeManifest(params, previousManifest, owner, previousOwner) {
         const { nodeId, addons } = params;
-        const hubNodeId = this.brokerSafe.nodeID;
+        const hubNodeId = this.broker.nodeID;
         const isLocalChild = nodeId.startsWith(hubNodeId + '/');
         const isHubInProcess = nodeId === hubNodeId;
         // Hub in-process addons register themselves during initialize() — skip.
@@ -975,7 +966,7 @@ class MoleculerService {
         // isolate (D231) IS this node's engine, and skipping it leaves
         // `getCollection` empty. Hub-local children are proxied; remote nodes
         // are not (D233).
-        const skipInfraFromRemote = (capName) => (0, system_1.isInfraCapability)(capName) && !isLocalChild;
+        const skipInfraFromRemote = (capName) => isInfraCapability(capName) && !isLocalChild;
         const appliedKeys = (manifest) => {
             const keys = new Map();
             for (const addon of manifest) {
@@ -1041,14 +1032,14 @@ class MoleculerService {
             //     UDS-migration gap where this dispatcher hand-rolled a `broker.call`
             //     to an agent that exposes no Moleculer service for the cap.
             //   - resolver not yet built (pre-init) → legacy Moleculer call.
-            const callFn = (0, cap_call_fn_js_1.buildCapCallFn)({
+            const callFn = buildCapCallFn({
                 capName,
                 addonId,
                 nodeId,
                 udsChildId,
                 getLocalChildRegistry: () => this.localChildRegistry,
                 getResolver: () => this.resolver,
-                legacyBrokerCall: (method, methodParams, targetNode) => (0, system_1.callWithServiceDiscovery)(this.brokerSafe, addonId, (0, system_1.capActionName)(addonId, capName, method, false), (0, system_1.serializeTypedArrays)(methodParams), { nodeID: targetNode, timeout: 60_000 }),
+                legacyBrokerCall: (method, methodParams, targetNode) => callWithServiceDiscovery(this.broker, addonId, capActionName(addonId, capName, method, false), serializeTypedArrays(methodParams), { nodeID: targetNode, timeout: 60_000 }),
                 onUdsRoute: (cap) => {
                     if (!this.udsRoutedCaps.has(cap)) {
                         this.udsRoutedCaps.add(cap);
@@ -1057,7 +1048,7 @@ class MoleculerService {
                 },
             });
             const proxy = { id: addonId, nodeId };
-            for (const methodName of Object.keys((0, system_1.expandCapMethods)(capDef))) {
+            for (const methodName of Object.keys(expandCapMethods(capDef))) {
                 proxy[methodName] = (methodParams) => callFn(methodName, methodParams);
             }
             registry.registerProvider(capName, registryKey, proxy, owner);
@@ -1081,19 +1072,19 @@ class MoleculerService {
             // refreshes its page/widget registry for cross-process addons.
             if (capName === 'addon-pages-source') {
                 this.eventBus.emit({
-                    id: (0, node_crypto_1.randomUUID)(),
+                    id: randomUUID(),
                     timestamp: new Date(),
                     source: { type: 'addon', id: addonId },
-                    category: types_1.EventCategory.AddonPageReady,
+                    category: EventCategory.AddonPageReady,
                     data: { addonId, nodeId },
                 });
             }
             if (capName === 'addon-widgets-source') {
                 this.eventBus.emit({
-                    id: (0, node_crypto_1.randomUUID)(),
+                    id: randomUUID(),
                     timestamp: new Date(),
                     source: { type: 'addon', id: addonId },
-                    category: types_1.EventCategory.AddonWidgetReady,
+                    category: EventCategory.AddonWidgetReady,
                     data: { addonId, nodeId },
                 });
             }
@@ -1121,9 +1112,9 @@ class MoleculerService {
         const manifest = this.nodeRegistry.getNodeManifest(nodeId);
         if (!manifest)
             return; // node never sent a handshake — nothing to do
-        const hubNodeId = this.brokerSafe.nodeID;
+        const hubNodeId = this.broker.nodeID;
         const isLocalChild = nodeId.startsWith(hubNodeId + '/');
-        const disconnectGen = `disconnect-${nodeId}-${(0, node_crypto_1.randomUUID)()}`;
+        const disconnectGen = `disconnect-${nodeId}-${randomUUID()}`;
         const agentNodeId = nodeId.includes('/') ? nodeId.split('/')[0] : nodeId;
         const registry = this.capabilityService.getRegistry();
         for (const addon of manifest) {
@@ -1137,7 +1128,7 @@ class MoleculerService {
             for (const capName of capabilities) {
                 this.nodeCallFns.delete(`${nodeId}::${capName}`);
                 try {
-                    (0, types_1.emitReadiness)(this.eventBus, {
+                    emitReadiness(this.eventBus, {
                         capName,
                         scope: { type: 'node', nodeId: agentNodeId },
                         state: 'down',
@@ -1194,7 +1185,7 @@ class MoleculerService {
     isReachableViaLegacy(nodeId, capabilityName) {
         if (this.findCallFn(nodeId, capabilityName) !== undefined)
             return true;
-        return this.localChildRegistry !== null && nodeId.startsWith(`${this.brokerSafe.nodeID}/`);
+        return this.localChildRegistry !== null && nodeId.startsWith(`${this.broker.nodeID}/`);
     }
     /**
      * Build a proxy object that forwards every method call on a capability
@@ -1223,7 +1214,7 @@ class MoleculerService {
                 // Resolver found a route — proxy is reachable.
             }
             catch (err) {
-                if (err instanceof system_1.CapRouteError &&
+                if (err instanceof CapRouteError &&
                     (err.reason === 'no-provider' || err.reason === 'node-offline')) {
                     // Check legacy callFn store and hub-local child fallbacks.
                     if (!this.isReachableViaLegacy(nodeId, capabilityName))
@@ -1285,8 +1276,8 @@ class MoleculerService {
      * registry that is not up, or a write that fails, must not fail the node's registration.
      */
     observePresentedMeshLeaf(nodeId) {
-        const registry = (0, system_1.getProcessMeshCertificateRegistry)();
-        const leaf = (0, system_1.getProcessPeerLeaf)(nodeId);
+        const registry = getProcessMeshCertificateRegistry();
+        const leaf = getProcessPeerLeaf(nodeId);
         if (registry === null || leaf === undefined)
             return;
         registry
@@ -1329,7 +1320,7 @@ class MoleculerService {
      * to the Moleculer `$node-mgmt.setLogLevel` action.
      */
     setChildLogLevelByNodeId(nodeId, level) {
-        const hubNodeId = this.brokerSafe.nodeID;
+        const hubNodeId = this.broker.nodeID;
         if (!nodeId.startsWith(`${hubNodeId}/`))
             return false;
         const childId = nodeId.slice(hubNodeId.length + 1);
@@ -1348,10 +1339,10 @@ class MoleculerService {
      */
     async pullAgentReadinessSnapshot(nodeId) {
         try {
-            const snapshot = await this.brokerSafe.call(`${system_1.AGENT_READINESS_SERVICE_NAME}.getSnapshot`, {}, { nodeID: nodeId });
+            const snapshot = await this.broker.call(`${AGENT_READINESS_SERVICE_NAME}.getSnapshot`, {}, { nodeID: nodeId });
             if (!Array.isArray(snapshot) || snapshot.length === 0)
                 return;
-            const records = (0, agent_readiness_pull_js_1.filterAgentAuthoritativeRecords)(snapshot, nodeId);
+            const records = filterAgentAuthoritativeRecords(snapshot, nodeId);
             if (records.length === 0)
                 return;
             this.readinessRegistry.hydrate(records);
@@ -1367,19 +1358,18 @@ class MoleculerService {
         }
     }
     async onModuleDestroy() {
-        (0, system_1.setProcessMeshTlsEnabler)(null);
-        (0, system_1.setProcessMeshPeerTransportLookup)(null);
+        setProcessMeshTlsEnabler(null);
+        setProcessMeshPeerTransportLookup(null);
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);
             this.agentReadinessPullTimer = null;
         }
         this.udsEventBridgeDispose?.();
         this.udsEventBridgeDispose = null;
-        await this.brokerSafe.stop();
+        await this.broker.stop();
         await this.localChildRegistry?.close();
     }
 }
-exports.MoleculerService = MoleculerService;
 // ---------------------------------------------------------------------------
 // Module-level helpers
 // ---------------------------------------------------------------------------
@@ -1392,7 +1382,7 @@ exports.MoleculerService = MoleculerService;
  * regression suite: the rule is only worth anything if register and unregister
  * derive the token the SAME way.
  */
-function childOwnerToken(childNodeId, incarnation) {
+export function childOwnerToken(childNodeId, incarnation) {
     return `${childNodeId}#${incarnation}`;
 }
 /**
@@ -1402,7 +1392,7 @@ function childOwnerToken(childNodeId, incarnation) {
  * re-registering, and those two want opposite investigations. A line per skip
  * would reproduce exactly the volume the gate exists to remove.
  */
-exports.CHILD_MANIFEST_SKIP_SAMPLE = 25;
+export const CHILD_MANIFEST_SKIP_SAMPLE = 25;
 /** Canonical, order-insensitive text for a child manifest. */
 function childManifestFingerprint(params) {
     const addons = params.addons
@@ -1436,7 +1426,7 @@ function childManifestFingerprint(params) {
  * every provider owned by the dead generation and the successor's disconnect
  * would unregister nothing.
  */
-class ChildManifestGate {
+export class ChildManifestGate {
     applied = new Map();
     skipped = 0;
     sinceSample = 0;
@@ -1466,13 +1456,12 @@ class ChildManifestGate {
     }
     /** True once every {@link CHILD_MANIFEST_SKIP_SAMPLE} skips. */
     sampleDue() {
-        if (this.sinceSample < exports.CHILD_MANIFEST_SKIP_SAMPLE)
+        if (this.sinceSample < CHILD_MANIFEST_SKIP_SAMPLE)
             return false;
         this.sinceSample = 0;
         return true;
     }
 }
-exports.ChildManifestGate = ChildManifestGate;
 /**
  * E1: Adapt a child's UDS `ChildCapDescriptor[]` into a `RegisterNodeParams`
  * that `onRegisterNode` / `applyNodeManifest` can consume.
@@ -1494,7 +1483,7 @@ exports.ChildManifestGate = ChildManifestGate;
  * cap names; device-scoped native caps are handled separately via `nativeCaps` in the
  * full `RegisterNodeParams`.
  */
-function buildChildUdsManifest(nodeId, childId, caps) {
+export function buildChildUdsManifest(nodeId, childId, caps) {
     // Group unique system (non-device-scoped) cap names per hosted addon.
     // Insertion order preserves the child's registration order.
     const capsByAddon = new Map();