@camstack/server 1.2.593 → 1.2.595

package/dist/agent/agent-http.js

@@ -184,8 +184,11 @@ function writeConfigFile(configPath, data) {
 /** Live Moleculer registry snapshot — reused by agent-bootstrap's Option A. */
 function getRegistryNodes(broker) {
     try {
-        const registry = broker.registry;
-        return registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
+        return broker.registry.getNodeList({ onlyAvailable: true }).map((node) => ({
+            id: node.id,
+            ...(node.hostname != null ? { hostname: node.hostname } : {}),
+            ...(node.ipList != null ? { ipList: node.ipList } : {}),
+        }));
     }
     catch {
         return [];

package/dist/agent/agent-service.js

@@ -202,8 +202,7 @@ function readDeployedAddonIds(addonDir) {
 }
 function isHubConnected(broker) {
     try {
-        const registry = broker.registry;
-        const nodes = registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
+        const nodes = broker.registry.getNodeList({ onlyAvailable: true });
         return nodes.some((n) => n.id === 'hub');
     }
     catch {
@@ -367,8 +366,7 @@ function createAgentService(deps) {
             },
             deploy: {
                 handler: async (ctx) => {
-                    const { params } = ctx;
-                    const { addonId, source, bundle } = params;
+                    const { addonId, source, bundle } = ctx.params;
                     // execFile (no shell) instead of execSync — addonId comes from RPC
                     // params and was previously interpolated into a shell command, which
                     // is a command-injection vector. argv form doesn't go through a shell
@@ -469,7 +467,7 @@ function createAgentService(deps) {
              */
             stageDevUploads: {
                 handler: async (ctx) => {
-                    const { params } = ctx;
+                    const params = ctx.params;
                     const seam = {
                         dataDir: deps.dataDir,
                         fetchBundle: (s) => (0, fetch_bundle_from_hub_js_1.fetchBundleFromHub)(s),
@@ -487,7 +485,7 @@ function createAgentService(deps) {
              */
             distributeModel: {
                 handler: async (ctx) => {
-                    const { params } = ctx;
+                    const params = ctx.params;
                     const { execFile } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
                     const { promisify } = await Promise.resolve().then(() => __importStar(require('node:util')));
                     const execFileAsync = promisify(execFile);
@@ -526,12 +524,13 @@ function createAgentService(deps) {
             undeploy: {
                 handler: async (ctx) => {
                     const { params, broker } = ctx;
+                    const bkr = (0, system_1.asBrokerLike)(broker);
                     return (0, agent_undeploy_js_1.undeployFromAgent)({
                         addonsDir: deps.addonsDir,
                         loadedAddons: deps.loadedAddons,
                         bootstrapPackages: deps.bootstrapPackages ?? DEFAULT_AGENT_BOOTSTRAP_PACKAGES,
-                        listRunnersByAddon: (addonId) => broker.call('$process.listByAddon', { addonId }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
-                        stopRunner: (name) => broker.call('$process.stop', { name }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
+                        listRunnersByAddon: (addonId) => bkr.call('$process.listByAddon', { addonId }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
+                        stopRunner: (name) => bkr.call('$process.stop', { name }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
                         destroyService: (addonId) => broker.destroyService(addonId),
                         unregisterProvider: (capName, addonId) => deps.unregisterProvider?.(capName, addonId),
                         respawnSurvivors: deps.reloadDeployedAddons,
@@ -566,6 +565,7 @@ function createAgentService(deps) {
             restart: {
                 handler: async (ctx) => {
                     const { params, broker } = ctx;
+                    const bkr = (0, system_1.asBrokerLike)(broker);
                     const { addonId } = params;
                     // Delegate to THIS agent's own `$process` service — the SAME primitive
                     // the hub uses for a local forked addon (AddonRegistryService.restartAddon
@@ -575,7 +575,7 @@ function createAgentService(deps) {
                     // Moleculer node evicted, and the addon's caps re-registered — identical
                     // semantics to a hub-local restart. Pin to the agent's own node so the
                     // call always hits THIS agent's `$process`, never the hub's.
-                    const result = await broker.call('$process.restart', { name: addonId }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS });
+                    const result = await bkr.call('$process.restart', { name: addonId }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS });
                     if (!result.success) {
                         // Fail loudly so the hub's `nodes.restartAddon` surfaces the real
                         // error instead of the old fire-and-forget phantom success.

package/dist/agent/main.js

@@ -279,8 +279,7 @@ async function startAgent(configPath) {
         // Fall through to live registry-derived state (connected/unconfigured/disconnected).
         // getRegistryNodes-equivalent inline: broker.registry.getNodeList
         try {
-            const registry = broker.registry;
-            const nodes = registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
+            const nodes = broker.registry.getNodeList({ onlyAvailable: true });
             if (nodes.some((n) => n.id === 'hub'))
                 return 'connected';
         }
@@ -840,12 +839,20 @@ async function startAgent(configPath) {
         // Wired after broker.start() so the broker event bus is operational.
         const agentReadinessRegistry = (0, system_1.getOrInitReadinessRegistry)(broker, agentBrokerEventBus, consoleLogger);
         agentUdsRegistry.onReadinessSnapshotRequest(() => agentReadinessRegistry.getSnapshotForTransport());
+        // D8 reverse leg: expose THIS agent's readiness snapshot so the hub can
+        // snapshot-reconcile agent-origin records on every (re)connect and
+        // periodically. Without this, the hub learns agent readiness ONLY from
+        // lossy cross-node `system.ready-state` broadcasts — a lost `ready`
+        // (2026-07-17 incident) left the hub's authoritative registry stuck on
+        // the synthesized `down` forever. Registered under
+        // `$agent-readiness` (NOT `$readiness`) so the agent's own unqualified
+        // `$readiness.getSnapshot` hub-hydrate call is never shadowed locally.
         broker.createService((0, system_1.createReadinessServiceForRegistry)(agentReadinessRegistry, system_1.AGENT_READINESS_SERVICE_NAME));
     }
     // ── HTTP server (Fastify) — status API + process management + UI ──
     // Started early (before addon boot) so the status page is reachable
     // even while addons are still loading.
-    const getBrokerFn = (() => broker);
+    const getBrokerFn = () => broker;
     // ── Update controls for the agent UI ──────────────────────────────
     // Framework: the LOCAL `AgentUpdateService` — `npm view` + `npm install`
     // straight from the registry, no hub in the path, so an isolated node can

package/dist/api/core/cap-providers.js

@@ -488,7 +488,7 @@ function createNodeRootPackageLookup(moleculer, serverUpdate) {
     };
 }
 function buildNodesProvider(agentRegistry, moleculer, addonRegistry, getNodeRootPackage, logger) {
-    const broker = moleculer.broker;
+    const broker = (0, system_1.asBrokerLike)(moleculer.broker);
     return {
         topology: async () => computeTopology(agentRegistry, addonRegistry, getNodeRootPackage, (nodeId) => moleculer.isNodeRegistered(nodeId)),
         directory: async () => agentRegistry.listNodeDirectory(),
@@ -1462,7 +1462,7 @@ function buildUninstallSeam(ar, ps, broker, agentRegistry) {
     };
 }
 function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx, agentRegistry) {
-    const broker = moleculer.broker;
+    const broker = (0, system_1.asBrokerLike)(moleculer.broker);
     const uninstallSeam = buildUninstallSeam(ar, ps, broker, agentRegistry);
     const frameworkAllowSet = new Set([addon_package_service_js_1.SYSTEM_PACKAGE]);
     // Process-wide runner built once at boot (manual-boot wires its deps from the

package/dist/api/trpc/generated-cap-routers.js

@@ -10868,6 +10868,24 @@ function createCapRouter_storageAdmin(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.adoptRecords(methodInput);
         }),
+        readLegacyCollection: trpc_middleware_js_1.adminProcedure
+            .input(types_124.storageAdminCapability.methods.readLegacyCollection.input.loose())
+            .output(types_124.storageAdminCapability.methods.readLegacyCollection.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('storage-admin', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.readLegacyCollection(methodInput);
+        }),
+        isAdoptedLegacyTable: trpc_middleware_js_1.adminProcedure
+            .input(types_124.storageAdminCapability.methods.isAdoptedLegacyTable.input.loose())
+            .output(types_124.storageAdminCapability.methods.isAdoptedLegacyTable.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('storage-admin', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.isAdoptedLegacyTable(methodInput);
+        }),
     });
 }
 function createCapRouter_storageEvictable(getProvider, createRemoteProxy) {

package/dist/closure-patches/patch-reach.json

@@ -61,8 +61,12 @@
         ],
         "lib/webrtc/src/media/rtpSender.js": ["RTP_HISTORY_SIZE = 4096"],
         "lib/rtp/src/rtp/rtp.js": ["camstack: D868 — SRTP output arena"],
-        "lib/rtp/src/srtp/cipher/ctr.js": ["camstack: D868 — header, ciphertext and tag in ONE arena slice"],
-        "lib/rtp/src/srtp/cipher/gcm.js": ["camstack: D868 — header, ciphertext and tag in ONE arena slice"]
+        "lib/rtp/src/srtp/cipher/ctr.js": [
+          "camstack: D868 — header, ciphertext and tag in ONE arena slice"
+        ],
+        "lib/rtp/src/srtp/cipher/gcm.js": [
+          "camstack: D868 — header, ciphertext and tag in ONE arena slice"
+        ]
       },
       "declaredBy": [
         "packages/addon-pipeline",

package/dist/core/addon/addon-registry.service.js

@@ -53,6 +53,7 @@ const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
 const device_meta_mirror_js_1 = require("./device-meta-mirror.js");
 const forked_custom_actions_js_1 = require("./forked-custom-actions.js");
 const integration_visibility_js_1 = require("./integration-visibility.js");
+const record_kinds_js_1 = require("../auth/record-kinds.js");
 const materialize_route_path_js_1 = require("./materialize-route-path.js");
 const package_dir_utils_1 = require("./package-dir-utils");
 const prune_misplaced_addons_js_1 = require("./prune-misplaced-addons.js");
@@ -96,6 +97,12 @@ function addonUpdatePayload(fromVersion, toVersion) {
         toVersion,
     };
 }
+function isAddonDeclaration(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const id = Reflect.get(value, 'id');
+    return typeof id === 'string' && id.length > 0;
+}
 /**
  * Type predicate: true when an `ISettingsBackend` also satisfies the
  * sync `ISettingsStore` contract (system/addon/device key-value ops)
@@ -360,6 +367,9 @@ class AddonRegistryService {
     activeStorageProvider = null;
     activeSettingsBackend = null;
     integrationRegistry = null;
+    clusterNodeHistoryStore = null;
+    clusterAgentRecords = null;
+    shareTokenService = null;
     // Device architecture — in-memory registry of live IDevice instances.
     // Persistence is owned by the `device-manager` capability addon.
     deviceRegistry = new system_1.DeviceRegistry();
@@ -375,7 +385,7 @@ class AddonRegistryService {
      * `this.broker.call(...)` / `this.broker.nodeID` lint clean.
      */
     get broker() {
-        return this.moleculer.broker;
+        return (0, system_1.asBrokerLike)(this.moleculer.broker);
     }
     constructor(loggingService, eventBusService, configService, storageService, capabilityService, moleculer, streamProbe) {
         this.loggingService = loggingService;
@@ -1334,6 +1344,43 @@ class AddonRegistryService {
     loadCollectionPreferences() {
         // TODO: implement CapabilityRegistry.loadDisabledProviders() to restore persisted preferences
     }
+    /** Durable cluster-node history (A1) — bind records kind after orphan declare. */
+    setClusterNodeHistoryStore(store) {
+        this.clusterNodeHistoryStore = store;
+        this.bindClusterNodeHistoryRecordsKind();
+    }
+    bindClusterNodeHistoryRecordsKind() {
+        const clusterStore = this.clusterNodeHistoryStore;
+        const records = this.clusterAgentRecords;
+        if (clusterStore === null || records === null)
+            return;
+        const kind = records.kind(system_1.clusterNodeHistoryRecordKind);
+        clusterStore.bindRecordsKind(() => kind);
+    }
+    setShareTokenService(service) {
+        this.shareTokenService = service;
+    }
+    async wireHubMainOrphanRecords(store) {
+        const recordsCap = this.capabilityRegistry.getSingleton('records');
+        if (recordsCap === null || recordsCap === undefined)
+            return;
+        const integrationRecords = this.recordsForOwner('integration-registry', this.secretsForOwner('integration-registry'));
+        await integrationRecords.declare(system_1.integrationRegistryRecordKinds);
+        this.integrationRegistry = new system_1.IntegrationRegistry(store, system_1.IntegrationRegistry.recordStoresOf(integrationRecords));
+        await this.integrationRegistry.initialize();
+        this.logger.info('IntegrationRegistry initialized (records)', { meta: { phase: 'v2' } });
+        const clusterRecords = this.recordsForOwner('cluster-agent', this.secretsForOwner('cluster-agent'));
+        await clusterRecords.declare(system_1.clusterAgentRecordKinds);
+        this.clusterAgentRecords = clusterRecords;
+        this.bindClusterNodeHistoryRecordsKind();
+        const shareTokens = this.shareTokenService;
+        if (shareTokens !== null) {
+            const coreRecords = this.recordsForOwner('core-auth', this.secretsForOwner('core-auth'));
+            await coreRecords.declare(record_kinds_js_1.coreAuthRecordKinds);
+            const shareKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['share-view-tokens']);
+            shareTokens.bindShareTokensKind(() => shareKind);
+        }
+    }
     /**
      * Returns the IntegrationRegistry filtered to exclude orphaned integrations
      * (where the addon is not currently installed). Orphaned data stays in DB
@@ -2210,11 +2257,12 @@ class AddonRegistryService {
                     ...(bundleRaw.icon !== undefined ? { icon: bundleRaw.icon } : {}),
                 }
                 : undefined;
-            for (const decl of addons) {
-                const id = typeof decl['id'] === 'string' ? decl['id'] : '';
-                const name = typeof decl['name'] === 'string' ? decl['name'] : id;
-                if (!id)
+            for (const rawDecl of addons) {
+                if (!isAddonDeclaration(rawDecl))
                     continue;
+                const decl = rawDecl;
+                const id = decl.id;
+                const name = typeof decl.name === 'string' ? decl.name : id;
                 const manifest = {
                     ...decl,
                     id,
@@ -2550,9 +2598,16 @@ class AddonRegistryService {
                         registry: this.capabilityRegistry,
                         logger: this.logger,
                     }, store);
-                    this.integrationRegistry = new system_1.IntegrationRegistry(store);
-                    void this.integrationRegistry.initialize().then(() => {
-                        this.logger.info('IntegrationRegistry initialized', { meta: { phase: 'v2' } });
+                    void this.wireHubMainOrphanRecords(store).catch((err) => {
+                        this.logger.warn('hub-main records wiring failed (best-effort)', {
+                            meta: { error: (0, types_1.errMsg)(err) },
+                        });
+                        this.integrationRegistry = new system_1.IntegrationRegistry(store);
+                        void this.integrationRegistry.initialize().then(() => {
+                            this.logger.info('IntegrationRegistry initialized (legacy)', {
+                                meta: { phase: 'v2' },
+                            });
+                        });
                     });
                     this.loadCollectionPreferences();
                     // DeviceStore/ConfigStore are owned by the `device-persistence`

package/dist/core/agent/agent-registry.service.js

@@ -526,7 +526,7 @@ class AgentRegistryService {
         // connected when the listener registers. Classifies each as
         // agent or worker — same logic as the live handlers above.
         try {
-            const registry = this.moleculer.broker.registry;
+            const registry = this.nodeCatalogRegistry();
             const existing = registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
             for (const { id } of existing) {
                 const kind = classifyNode(id);
@@ -571,7 +571,7 @@ class AgentRegistryService {
      * must not abort the pass or hub boot.
      */
     async reconcileConnectedAgents() {
-        const registry = this.moleculer.broker.registry;
+        const registry = this.nodeCatalogRegistry();
         const nodes = registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
         const agentIds = nodes
             .map((n) => n.id)
@@ -968,7 +968,7 @@ class AgentRegistryService {
         return (0, node_directory_1.toNodeDirectory)(this.listNodeLiveness(), history);
     }
     async listNodes() {
-        const registry = this.moleculer.broker.registry;
+        const registry = this.nodeCatalogRegistry();
         // `onlyAvailable: false` intentionally includes nodes Moleculer still
         // remembers as disconnected (`available: false`) — the same registry
         // read `listNodeLiveness()` uses for `/health`. This surfaces recently

package/dist/core/agent/cluster-node-history-store.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClusterNodeHistoryStore = void 0;
+const system_1 = require("@camstack/system");
 const zod_1 = require("zod");
 const types_1 = require("@camstack/types");
 const DescriptorSchema = zod_1.z.object({
@@ -83,9 +84,15 @@ class ClusterNodeHistoryStore {
     resolveSettingsStore;
     logger;
     declared = false;
-    constructor(resolveSettingsStore, logger) {
+    resolveKind;
+    constructor(resolveSettingsStore, logger, resolveKind = () => null) {
         this.resolveSettingsStore = resolveSettingsStore;
         this.logger = logger;
+        this.resolveKind = resolveKind;
+    }
+    /** Hub wiring after `records.forOwner('cluster-agent').declare(...)`. */
+    bindRecordsKind(resolver) {
+        this.resolveKind = resolver;
     }
     /**
      * Idempotently declare the typed collection. Returns the resolved provider
@@ -93,6 +100,8 @@ class ClusterNodeHistoryStore {
      * unreachable) — callers treat null as "skip, best-effort".
      */
     async ensureDeclared() {
+        if (this.resolveKind() !== null)
+            return this.resolveSettingsStore();
         const store = this.resolveSettingsStore();
         if (!store)
             return null;
@@ -143,16 +152,12 @@ class ClusterNodeHistoryStore {
             // Carry the package roster forward. `listNodes()` does not resolve it
             // (only the reconcile does), so writing this descriptor blind would erase
             // the back-fill's intended set on the very next topology poll.
-            const existing = await this.readRow(store, descriptor.id);
+            const existing = await this.readStored(descriptor.id);
             const packages = descriptor.packages ?? existing?.descriptor.packages;
             const next = packages === undefined ? descriptor : { ...descriptor, packages };
             if (existing !== null && !this.worthWriting(existing, next))
                 return;
-            await store.set({
-                collection: COLLECTION,
-                key: descriptor.id,
-                value: { lastActive: Date.now(), descriptor: next },
-            });
+            await this.writeStored(descriptor.id, Date.now(), next);
         }
         catch (err) {
             this.logger.warn('snapshot upsert failed (best-effort)', {
@@ -172,13 +177,48 @@ class ClusterNodeHistoryStore {
         return !descriptorsEqual(existing.descriptor, next);
     }
     /** Read one node's row, validated. `null` when absent or malformed. */
-    async readRow(store, nodeId) {
+    async readStored(nodeId) {
+        const kind = this.resolveKind();
+        if (kind !== null) {
+            const row = await kind.get(nodeId);
+            if (row === null)
+                return null;
+            const parsed = RowDataSchema.safeParse({
+                lastActive: row.at ?? 0,
+                descriptor: row.data.descriptor,
+            });
+            return parsed.success ? parsed.data : null;
+        }
+        const store = this.resolveSettingsStore();
+        if (!store)
+            return null;
+        return this.readRowLegacy(store, nodeId);
+    }
+    async readRowLegacy(store, nodeId) {
         const raw = await store.get({ collection: COLLECTION, key: nodeId });
         if (raw === null || raw === undefined)
             return null;
         const parsed = RowDataSchema.safeParse(raw);
         return parsed.success ? parsed.data : null;
     }
+    async writeStored(nodeId, lastActive, descriptor) {
+        const kind = this.resolveKind();
+        if (kind !== null) {
+            const body = system_1.ClusterNodeHistoryBodySchema.safeParse({ descriptor });
+            if (!body.success)
+                return;
+            await kind.put({ id: nodeId, at: lastActive, data: body.data });
+            return;
+        }
+        const store = this.resolveSettingsStore();
+        if (!store)
+            return;
+        await store.set({
+            collection: COLLECTION,
+            key: nodeId,
+            value: { lastActive, descriptor },
+        });
+    }
     /** A placeholder descriptor for a node the topology pass has not seen yet. */
     static placeholderDescriptor(nodeId) {
         return {
@@ -206,7 +246,7 @@ class ClusterNodeHistoryStore {
         if (!store)
             return [];
         try {
-            return (await this.readRow(store, nodeId))?.descriptor.packages ?? [];
+            return (await this.readStored(nodeId))?.descriptor.packages ?? [];
         }
         catch (err) {
             this.logger.warn('getPackages failed (best-effort)', {
@@ -231,7 +271,7 @@ class ClusterNodeHistoryStore {
         if (!store)
             return;
         try {
-            const existing = await this.readRow(store, nodeId);
+            const existing = await this.readStored(nodeId);
             const merged = new Map((existing?.descriptor.packages ?? []).map((p) => [p.name, p]));
             // The node's current declaration wins on version — it is the authority on
             // what it is actually running.
@@ -241,11 +281,7 @@ class ClusterNodeHistoryStore {
                 ...(existing?.descriptor ?? ClusterNodeHistoryStore.placeholderDescriptor(nodeId)),
                 packages: [...merged.values()],
             };
-            await store.set({
-                collection: COLLECTION,
-                key: nodeId,
-                value: { lastActive: existing?.lastActive ?? Date.now(), descriptor },
-            });
+            await this.writeStored(nodeId, existing?.lastActive ?? Date.now(), descriptor);
         }
         catch (err) {
             this.logger.warn('recordPackages failed (best-effort)', {
@@ -266,7 +302,7 @@ class ClusterNodeHistoryStore {
         if (!store)
             return;
         try {
-            const existing = await this.readRow(store, nodeId);
+            const existing = await this.readStored(nodeId);
             if (existing === null)
                 return;
             const current = existing.descriptor.packages;
@@ -276,13 +312,9 @@ class ClusterNodeHistoryStore {
             const remaining = current.filter((p) => !drop.has(p.name));
             if (remaining.length === current.length)
                 return;
-            await store.set({
-                collection: COLLECTION,
-                key: nodeId,
-                value: {
-                    lastActive: existing.lastActive,
-                    descriptor: { ...existing.descriptor, packages: remaining },
-                },
+            await this.writeStored(nodeId, existing.lastActive, {
+                ...existing.descriptor,
+                packages: remaining,
             });
             this.logger.info('pruned node package record', {
                 tags: { nodeId },
@@ -306,6 +338,18 @@ class ClusterNodeHistoryStore {
         if (!store)
             return;
         try {
+            const existing = await this.readStored(nodeId);
+            if (existing === null)
+                return;
+            const kind = this.resolveKind();
+            if (kind !== null) {
+                await kind.put({
+                    id: nodeId,
+                    at: Date.now(),
+                    data: { descriptor: existing.descriptor },
+                });
+                return;
+            }
             await store.update({
                 collection: COLLECTION,
                 id: nodeId,
@@ -335,8 +379,17 @@ class ClusterNodeHistoryStore {
         if (!store)
             return null;
         try {
-            const rows = await store.query({ collection: COLLECTION });
+            const kind = this.resolveKind();
             const result = [];
+            const rows = kind !== null
+                ? (await (0, system_1.readAllRows)(kind)).map((row) => ({
+                    id: row.id,
+                    data: { lastActive: row.at ?? 0, descriptor: row.data.descriptor },
+                }))
+                : (await store.query({ collection: COLLECTION })).map((row) => ({
+                    id: row.id,
+                    data: row.data,
+                }));
             for (const row of rows) {
                 const parsed = RowDataSchema.safeParse(row.data);
                 if (!parsed.success) {
@@ -370,8 +423,14 @@ class ClusterNodeHistoryStore {
             // Read first: `delete` on this provider is idempotent and cannot tell a
             // removal from a no-op, and "there was nothing to remove" is the answer
             // that stops an operator repeating a working action forever.
-            const existed = (await this.readRow(store, nodeId)) !== null;
-            await store.delete({ collection: COLLECTION, key: nodeId });
+            const existed = (await this.readStored(nodeId)) !== null;
+            const kind = this.resolveKind();
+            if (kind !== null) {
+                await kind.delete(nodeId);
+            }
+            else {
+                await store.delete({ collection: COLLECTION, key: nodeId });
+            }
             if (!existed) {
                 this.logger.info('cluster node had no history row to forget', { tags: { nodeId } });
                 return 'not-found';

package/dist/core/auth/record-kinds.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreAuthRecordKinds = exports.SHARE_VIEW_TOKENS_LEGACY = void 0;
+/**
+ * Record kinds owned by `core-auth` (hub-resident, phase 6 / §2.8).
+ */
+const types_1 = require("@camstack/types");
+const zod_1 = require("zod");
+const ShareTokenScopeSchema = zod_1.z.object({
+    kind: zod_1.z.enum(types_1.SHARE_VIEW_KINDS),
+    deviceIds: zod_1.z.array(zod_1.z.number().int().nonnegative()).min(1).max(64),
+    talk: zod_1.z.boolean().optional(),
+});
+exports.SHARE_VIEW_TOKENS_LEGACY = 'share_view_tokens';
+const ShareViewTokenBodySchema = zod_1.z.object({
+    userId: zod_1.z.string(),
+    tokenHash: zod_1.z.string(),
+    tokenPrefix: zod_1.z.string(),
+    scope: ShareTokenScopeSchema,
+    createdAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number().nullable(),
+    lastUsedAt: zod_1.z.number().nullish(),
+});
+exports.coreAuthRecordKinds = (0, types_1.defineRecordKinds)({
+    'share-view-tokens': {
+        schema: ShareViewTokenBodySchema,
+        class: 'config',
+        writeTrigger: 'operator mints a share link; validate touches lastUsedAt',
+        device: 'none',
+        at: 'none',
+        indexes: [
+            { name: 'hash', fields: ['tokenHash'], unique: true },
+            { name: 'user', fields: ['userId'] },
+        ],
+        retention: { none: 'revoke only; expiry enforced at validate' },
+        adoptsFrom: exports.SHARE_VIEW_TOKENS_LEGACY,
+    },
+});

package/dist/core/auth/share-token.service.js

@@ -61,6 +61,7 @@ exports.ShareTokenService = exports.ShareTokenRecordSchema = exports.ShareTokenS
 const crypto = __importStar(require("node:crypto"));
 const zod_1 = require("zod");
 const types_1 = require("@camstack/types");
+const record_kinds_js_1 = require("./record-kinds.js");
 /**
  * @durable class=config owner=core-auth
  *   write="a user mints a share link; and a best-effort lastUsedAt touch on every successful validation"
@@ -153,6 +154,29 @@ function parseShareToken(data) {
     const parsed = exports.ShareTokenRecordSchema.safeParse(data);
     return parsed.success ? parsed.data : null;
 }
+function recordToBody(record) {
+    const { id: _id, ...body } = record;
+    return body;
+}
+function rowToRecord(id, body) {
+    return exports.ShareTokenRecordSchema.safeParse({ id, ...body }).data ?? null;
+}
+async function readAllShareTokenRows(kind, where) {
+    const out = [];
+    let cursor;
+    for (let page = 0; page < 100; page += 1) {
+        const answer = await kind.query({
+            ...(where === undefined ? {} : { where }),
+            limit: 1000,
+            ...(cursor === undefined ? {} : { cursor }),
+        });
+        out.push(...answer.records);
+        if (answer.nextCursor === null)
+            return out;
+        cursor = answer.nextCursor;
+    }
+    throw new Error('share-view-tokens: row count exceeds pagination bound');
+}
 class ShareTokenService {
     getStore;
     logger;
@@ -162,9 +186,59 @@ class ShareTokenService {
      * the sqlite builtin registers after this service is constructed).
      */
     collectionDeclared = false;
-    constructor(getStore, logger = null) {
+    resolveKind;
+    constructor(getStore, logger = null, resolveKind = () => null) {
         this.getStore = getStore;
         this.logger = logger;
+        this.resolveKind = resolveKind;
+    }
+    /** Hub wiring after `records.forOwner('core-auth').declare(...)`. */
+    bindShareTokensKind(resolver) {
+        this.resolveKind = resolver;
+        this.collectionDeclared = true;
+    }
+    kind() {
+        return this.resolveKind();
+    }
+    async findById(id) {
+        const kind = this.kind();
+        if (kind !== null) {
+            const row = await kind.get(id);
+            return row === null ? null : rowToRecord(row.id, row.data);
+        }
+        const results = await (await this.store()).query({
+            collection: SHARE_TOKENS_COLLECTION,
+            filter: { where: { id } },
+        });
+        const first = results[0];
+        return first === undefined ? null : parseShareToken(first.data);
+    }
+    async persistRecord(record) {
+        const kind = this.kind();
+        if (kind !== null) {
+            const parsed = record_kinds_js_1.coreAuthRecordKinds['share-view-tokens'].schema.safeParse(recordToBody(record));
+            if (!parsed.success)
+                throw new Error(parsed.error.message);
+            await kind.put({
+                id: record.id,
+                expiresAt: record.expiresAt ?? undefined,
+                data: parsed.data,
+            });
+            return;
+        }
+        await (await this.store()).update({
+            collection: SHARE_TOKENS_COLLECTION,
+            id: record.id,
+            data: { ...record },
+        });
+    }
+    async deleteById(id) {
+        const kind = this.kind();
+        if (kind !== null) {
+            await kind.delete(id);
+            return;
+        }
+        await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: id });
     }
     /**
      * Resolve the backend AND ensure `share_view_tokens` is declared before
@@ -174,6 +248,13 @@ class ShareTokenService {
      * rows keep working with no migration.
      */
     async store() {
+        if (this.kind() !== null) {
+            const store = this.getStore();
+            if (!store) {
+                throw new Error('Share tokens unavailable — settings backend not ready');
+            }
+            return store;
+        }
         const store = this.getStore();
         if (!store) {
             throw new Error('Share tokens unavailable — settings backend not ready');
@@ -219,10 +300,23 @@ class ShareTokenService {
             createdAt: now,
             expiresAt: ttlSec === 'never' ? null : now + ttlSec * 1000,
         };
-        await (await this.store()).insert({
-            collection: SHARE_TOKENS_COLLECTION,
-            record: { id: record.id, data: { ...record } },
-        });
+        const kind = this.kind();
+        if (kind !== null) {
+            const parsed = record_kinds_js_1.coreAuthRecordKinds['share-view-tokens'].schema.safeParse(recordToBody(record));
+            if (!parsed.success)
+                throw new Error(parsed.error.message);
+            await kind.put({
+                id: record.id,
+                expiresAt: record.expiresAt ?? undefined,
+                data: parsed.data,
+            });
+        }
+        else {
+            await (await this.store()).insert({
+                collection: SHARE_TOKENS_COLLECTION,
+                record: { id: record.id, data: { ...record } },
+            });
+        }
         this.logger?.info('Share token minted', {
             meta: {
                 id: record.id,
@@ -243,15 +337,22 @@ class ShareTokenService {
         if (!rawToken.startsWith(exports.SHARE_TOKEN_PREFIX))
             return null;
         const tokenHash = crypto.createHash('sha256').update(rawToken).digest('hex');
-        const results = await (await this.store()).query({
-            collection: SHARE_TOKENS_COLLECTION,
-            filter: { where: { tokenHash } },
-        });
-        const first = results[0];
-        if (!first)
-            return null;
-        const record = parseShareToken(first.data);
-        if (!record)
+        const kind = this.kind();
+        let record = null;
+        if (kind !== null) {
+            const page = await kind.query({ where: { tokenHash }, limit: 1 });
+            const row = page.records[0];
+            record = row === undefined ? null : rowToRecord(row.id, row.data);
+        }
+        else {
+            const results = await (await this.store()).query({
+                collection: SHARE_TOKENS_COLLECTION,
+                filter: { where: { tokenHash } },
+            });
+            const first = results[0];
+            record = first === undefined ? null : parseShareToken(first.data);
+        }
+        if (record === null)
             return null;
         // `expiresAt: null` = never expires (explicit mint-time choice);
         // revocation remains the kill switch for those.
@@ -275,16 +376,8 @@ class ShareTokenService {
             throw new Error(`Share token TTL out of bounds — got ${input.ttlSec}s, allowed ` +
                 `[${exports.SHARE_TOKEN_TTL_MIN_SEC}s, ${exports.SHARE_TOKEN_TTL_MAX_SEC}s]`);
         }
-        const results = await (await this.store()).query({
-            collection: SHARE_TOKENS_COLLECTION,
-            filter: { where: { id: input.id } },
-        });
-        const first = results[0];
-        if (!first) {
-            throw (0, types_1.userError)('auth.share-token-not-found', { id: input.id }, `Share token not found: ${input.id}`);
-        }
-        const record = parseShareToken(first.data);
-        if (!record) {
+        const record = await this.findById(input.id);
+        if (record === null) {
             throw (0, types_1.userError)('auth.share-token-not-found', { id: input.id }, `Share token not found: ${input.id}`);
         }
         if (!input.callerIsAdmin && record.userId !== input.callerUserId) {
@@ -301,11 +394,7 @@ class ShareTokenService {
             ...record,
             expiresAt: now + input.ttlSec * 1000,
         };
-        await (await this.store()).update({
-            collection: SHARE_TOKENS_COLLECTION,
-            id: record.id,
-            data: { ...updated },
-        });
+        await this.persistRecord(updated);
         this.logger?.info('Share token extended', {
             meta: {
                 id: updated.id,
@@ -321,23 +410,13 @@ class ShareTokenService {
      * permission mismatch so the router surfaces a FORBIDDEN.
      */
     async revoke(input) {
-        const results = await (await this.store()).query({
-            collection: SHARE_TOKENS_COLLECTION,
-            filter: { where: { id: input.id } },
-        });
-        const first = results[0];
-        if (!first)
+        const record = await this.findById(input.id);
+        if (record === null)
             return false;
-        const record = parseShareToken(first.data);
-        if (!record) {
-            // Corrupt record — delete it regardless (it can never validate).
-            await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
-            return true;
-        }
         if (!input.callerIsAdmin && record.userId !== input.callerUserId) {
             throw (0, types_1.userError)('auth.share-owner-only-revoke', undefined, 'Only the token owner or an admin can revoke a share token');
         }
-        await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
+        await this.deleteById(input.id);
         this.logger?.info('Share token revoked', {
             meta: { id: record.id, byUserId: input.callerUserId },
         });
@@ -345,6 +424,13 @@ class ShareTokenService {
     }
     /** Every share token minted by `userId`, expired ones included. */
     async listForUser(userId) {
+        const kind = this.kind();
+        if (kind !== null) {
+            const rows = await readAllShareTokenRows(kind, { userId });
+            return rows
+                .map((row) => rowToRecord(row.id, row.data))
+                .filter((r) => r !== null);
+        }
         const results = await (await this.store()).query({
             collection: SHARE_TOKENS_COLLECTION,
             filter: { where: { userId } },
@@ -353,6 +439,13 @@ class ShareTokenService {
     }
     /** All share tokens (admin listing). */
     async listAll() {
+        const kind = this.kind();
+        if (kind !== null) {
+            const rows = await readAllShareTokenRows(kind);
+            return rows
+                .map((row) => rowToRecord(row.id, row.data))
+                .filter((r) => r !== null);
+        }
         const results = await (await this.store()).query({
             collection: SHARE_TOKENS_COLLECTION,
             filter: {},
@@ -360,11 +453,7 @@ class ShareTokenService {
         return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
     }
     async touchLastUsed(record) {
-        await (await this.store()).update({
-            collection: SHARE_TOKENS_COLLECTION,
-            id: record.id,
-            data: { ...record, lastUsedAt: Date.now() },
-        });
+        await this.persistRecord({ ...record, lastUsedAt: Date.now() });
     }
 }
 exports.ShareTokenService = ShareTokenService;

package/dist/core/moleculer/cap-call-fn.js

@@ -1,6 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildCapCallFn = buildCapCallFn;
+/**
+ * cap-call-fn — the per-(cap, node) dispatcher behind every CapabilityRegistry
+ * provider proxy the hub builds in `applyNodeManifest`.
+ *
+ * Extracted from `MoleculerService` so its routing branches are unit-testable
+ * in isolation (the closure that lived inline could only be exercised by
+ * standing up a full broker). It closes a UDS-migration gap: the inline
+ * version hand-rolled a `broker.call` for any non-hub-local provider, so an
+ * AGENT-hosted addon cap (a UDS child of the agent, NOT a Moleculer service)
+ * resolved to a Moleculer node that does not exist → `waitForServices` waited
+ * its full 30s discovery timeout → "Services waiting is timed out". The fix
+ * routes everything that isn't a hub-local child through the unified
+ * `CapRouteResolver`, which classifies an agent node as `agent-child-forward`
+ * (hub → agent over Moleculer → agent's UDS child) and a direct remote as
+ * `remote-moleculer`.
+ */
+const types_1 = require("@camstack/types");
 /** Extract a numeric `deviceId` routing hint out of arbitrary method args. */
 function extractDeviceId(params) {
     if (params === null || typeof params !== 'object')
@@ -8,6 +25,19 @@ function extractDeviceId(params) {
     const raw = Reflect.get(params, 'deviceId');
     return typeof raw === 'number' ? raw : undefined;
 }
+/**
+ * Hub in-process builtins state `callerAddonId` in args (see
+ * `AddonRegistryService.inProcessRecordsTransport`). A registry proxy routes
+ * over UDS; without lifting this to {@link CapCallInput.callerAddonId} the
+ * child strips the claim (`stampCallerAddonId` with no wire stamp) and records
+ * refuses `no-caller`.
+ */
+function extractStatedCallerAddonId(params) {
+    if (params === null || typeof params !== 'object' || Array.isArray(params))
+        return undefined;
+    const raw = Reflect.get(params, 'callerAddonId');
+    return typeof raw === 'string' && raw.length > 0 ? raw : undefined;
+}
 /**
  * Build the `CallFn` (`(method, params, targetNodeId?) => Promise`) for one
  * registered provider. See module docs for the routing rationale.
@@ -25,12 +55,16 @@ function buildCapCallFn(deps) {
             const registry = deps.getLocalChildRegistry();
             if (registry !== null && registry.childProvides(deps.udsChildId, deps.capName, deviceId)) {
                 deps.onUdsRoute?.(deps.capName);
+                const statedCaller = types_1.CALLER_STAMPED_CAPABILITIES.includes(deps.capName)
+                    ? extractStatedCallerAddonId(params)
+                    : undefined;
                 const input = {
                     capName: deps.capName,
                     method,
                     args: params,
                     ...(deviceId !== undefined ? { deviceId } : {}),
                     ...(deps.addonId !== undefined ? { addonId: deps.addonId } : {}),
+                    ...(statedCaller !== undefined ? { callerAddonId: statedCaller } : {}),
                 };
                 return registry.callCapOnChild(deps.udsChildId, input);
             }
@@ -45,11 +79,14 @@ function buildCapCallFn(deps) {
         // there is a harmless no-op.
         const resolver = deps.getResolver();
         if (resolver !== null) {
+            const statedCaller = types_1.CALLER_STAMPED_CAPABILITIES.includes(deps.capName)
+                ? extractStatedCallerAddonId(params)
+                : undefined;
             const route = resolver.resolveCapRoute(deps.capName, {
                 nodeId: targetNodeId ?? deps.nodeId,
                 ...(deviceId !== undefined ? { deviceId } : {}),
             });
-            return resolver.dispatch(route, method, params, deps.addonId);
+            return resolver.dispatch(route, method, params, deps.addonId, statedCaller);
         }
         // ── Pre-init window (resolver not yet constructed): legacy Moleculer call.
         return deps.legacyBrokerCall(method, params, targetNodeId ?? deps.nodeId);

package/dist/core/moleculer/moleculer.service.js

@@ -20,10 +20,6 @@ class MoleculerService {
     capabilityService;
     streamProbe;
     broker;
-    /** Narrow-typed view of `this.broker` — see `BrokerLike` doc above. */
-    get brokerSafe() {
-        return this.broker;
-    }
     logger;
     /**
      * D802, D857 — who may talk to the hub over the mesh: the broker middleware
@@ -172,7 +168,7 @@ class MoleculerService {
     /** This hub's Moleculer node id (e.g. `hub`). Hub-local forked children
      *  register under `${nodeId}/${runnerId}`. */
     get nodeId() {
-        return this.brokerSafe.nodeID;
+        return this.broker.nodeID;
     }
     constructor(eventBus, config, logging, capabilityService, streamProbe) {
         this.eventBus = eventBus;
@@ -208,7 +204,7 @@ class MoleculerService {
         this.broker = broker;
         this.readinessRegistry = new types_1.ReadinessRegistry({
             eventBus: this.eventBus,
-            sourceNodeId: this.brokerSafe.nodeID,
+            sourceNodeId: this.broker.nodeID,
             logger: this.logging.createLogger('readiness'),
         });
     }
@@ -251,19 +247,20 @@ class MoleculerService {
                 });
             },
             onSetLogLevel: (level) => {
-                const factory = this.brokerSafe.logger;
-                const appenders = factory['appenders'];
+                const factory = this.broker.logger;
+                const moleculerLogFactory = factory;
+                const appenders = moleculerLogFactory.appenders;
                 if (appenders) {
                     for (const appender of appenders) {
                         appender.opts.level = level;
                     }
                 }
-                const cache = factory['cache'];
+                const cache = moleculerLogFactory.cache;
                 if (cache) {
                     cache.clear();
                 }
                 logger.info('Moleculer log level changed', { meta: { level } });
-                this.brokerSafe.call('$process.setLogLevel', { level }).catch(() => { });
+                this.broker.call('$process.setLogLevel', { level }).catch(() => { });
             },
             // D3: registration-handshake path. Nodes send $hub.registerNode with
             // their complete capability manifest; the hub applies it immediately.
@@ -277,7 +274,7 @@ class MoleculerService {
             meshIdentity: this.meshGuard.gate,
         };
         const hubService = (0, system_1.createHubService)(hubDeps);
-        this.brokerSafe.createService(hubService);
+        this.broker.createService(hubService);
         // Forked addon-runner children must root their storage (addons-data,
         // the sqlite settings DB) under the SAME data path as the hub's main
         // process. The configured key is `server.dataPath` (populated from the
@@ -293,7 +290,7 @@ class MoleculerService {
         // broker-only — no parentUdsPath is propagated.
         let parentUdsPath;
         try {
-            const nodeId = this.brokerSafe.nodeID;
+            const nodeId = this.broker.nodeID;
             // F0 (slice-5 outbound): when a forked child issues `ctx.api.<cap>` for a
             // cap NO local sibling owns, route it from the PARENT and return the
             // result over UDS — resolver-first, broker-fallback. Closes over `this`
@@ -419,7 +416,7 @@ class MoleculerService {
             // `broker.call('$hub-cap-fwd.forward', …)` discovers it here. Without it a
             // remote agent's raw `${cap}.*` discovery 30s-deadlines (hub-local addon
             // runners expose no Moleculer service). See hub-cap-forward.ts.
-            this.brokerSafe.createService((0, system_1.createHubCapForwardService)(onUnownedCall, {
+            this.broker.createService((0, system_1.createHubCapForwardService)(onUnownedCall, {
                 // The agent stamps WHO is calling (its child's runner id) into the
                 // envelope (D787). Believe it only when that runner is on the agent
                 // the request came from — a node's registered manifest lists the
@@ -516,7 +513,7 @@ class MoleculerService {
             // Phase F removes the child broker; `onRegisterNode`'s diff logic ensures
             // double-apply is idempotent (same nodeId + same caps → no-op on the second call).
             registry.onChildRegistered((child) => {
-                const hubNodeId = this.brokerSafe.nodeID;
+                const hubNodeId = this.broker.nodeID;
                 const childNodeId = `${hubNodeId}/${child.childId}`;
                 // The catalogs first, and unconditionally: the manifest gate below
                 // judges CAPS, and a frame whose caps are unchanged may still be the
@@ -568,7 +565,7 @@ class MoleculerService {
             // E1: cleanup on child disconnect — same effect as `$node.disconnected`
             // for hub-local children. The Moleculer path stays for AGENT nodes.
             registry.onChildGone((childId, incarnation) => {
-                const hubNodeId = this.brokerSafe.nodeID;
+                const hubNodeId = this.broker.nodeID;
                 const childNodeId = `${hubNodeId}/${childId}`;
                 // The successor's first register must be a FIRST register: leaving the
                 // record behind would let a same-incarnation reconnect (mixed-version
@@ -604,15 +601,14 @@ class MoleculerService {
                 meta: { err: err instanceof Error ? err.message : String(err) },
             });
         }
-        const processService = (0, system_1.createProcessService)(this.brokerSafe.nodeID, dataDir, undefined, undefined, parentUdsPath);
-        this.brokerSafe.createService(processService);
+        const processService = (0, system_1.createProcessService)(this.broker.nodeID, dataDir, undefined, undefined, parentUdsPath);
+        this.broker.createService(processService);
         // $addonHost — REMOVED (Sprint 6). Three-level settings are now
         // served by the `addon-settings` singleton capability. Per-addon
         // Moleculer services expose `settings.*` actions for remote agents.
         // D3: mirror $node.disconnected onto the registry path so nodes that
         // sent a $hub.registerNode manifest get cleaned up on disconnect.
-        const bridgeBus = this.broker;
-        bridgeBus.localBus.on('$node.disconnected', ({ node }) => {
+        this.broker.localBus.on('$node.disconnected', ({ node }) => {
             // No owner token: this listener cannot observe WHICH incarnation died.
             // For a hub-local child the UDS `onChildGone` is the authority (it holds
             // the incarnation) and this call is refused if the id has been reclaimed;
@@ -630,16 +626,16 @@ class MoleculerService {
         // this registry stuck on the synthesized `down` forever (2026-07-17:
         // pipeline-executor@little-unraid, 3.5h dispatch outage). The
         // periodic sweep below repairs deltas lost while CONNECTED.
-        bridgeBus.localBus.on('$node.connected', ({ node }) => {
+        this.broker.localBus.on('$node.connected', ({ node }) => {
             const nodeId = node.id;
-            if (nodeId === this.brokerSafe.nodeID || nodeId.includes('/'))
+            if (nodeId === this.broker.nodeID || nodeId.includes('/'))
                 return;
             void this.pullAgentReadinessSnapshot(nodeId);
             // The hub may have dropped this agent's registration on a disconnect
             // only the hub saw (gossip, a failed write): ask it for its full set
             // (`agent-registration-request.ts`, 2026-10-14).
             void (0, agent_registration_request_js_1.requestAgentRegistration)({
-                call: (action, params, opts) => this.brokerSafe.call(action, params, opts),
+                call: (action, params, opts) => this.broker.call(action, params, opts),
                 isRegistered: (id) => this.isNodeRegistered(id),
                 warn: (message, id, meta) => this.logger.warn(message, { tags: { nodeId: id }, meta }),
                 info: (message, id, meta) => this.logger.info(message, { tags: { nodeId: id }, meta }),
@@ -647,7 +643,7 @@ class MoleculerService {
         });
         this.agentReadinessPullTimer = setInterval(() => {
             for (const nodeId of this.nodeRegistry.listNodeIds()) {
-                if (nodeId === this.brokerSafe.nodeID || nodeId.includes('/'))
+                if (nodeId === this.broker.nodeID || nodeId.includes('/'))
                     continue;
                 void this.pullAgentReadinessSnapshot(nodeId);
             }
@@ -665,14 +661,14 @@ class MoleculerService {
         // BEFORE broker.start() so workers / agents see it in their initial
         // INFO packet — post-start `createService` calls propagate via
         // heartbeat (several seconds) and would force workers to poll.
-        this.brokerSafe.createService((0, system_1.createReadinessServiceForRegistry)(this.readinessRegistry));
+        this.broker.createService((0, system_1.createReadinessServiceForRegistry)(this.readinessRegistry));
         // Register the hub-authoritative `$stream-probe` service —
         // workers route RTSP probe + field-probe through this action when
         // the tRPC WSS link isn't available (default path for forked
         // workers). Keeps ffprobe + HTTP-reachability as a single
         // hub-side implementation; see `createStreamProbeBrokerService`
         // for the shape.
-        this.brokerSafe.createService((0, system_1.createStreamProbeBrokerService)({
+        this.broker.createService((0, system_1.createStreamProbeBrokerService)({
             probe: (url, options) => this.streamProbe.probe(url, options),
             probeField: (key, value) => this.streamProbe.probeField(key, value),
         }));
@@ -693,7 +689,7 @@ class MoleculerService {
             peerLeaf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerLeaf(nodeId),
             dropPeer: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.dropPeer(nodeId) ?? 0,
         });
-        await this.brokerSafe.start();
+        await this.broker.start();
         logger.info('Moleculer broker started (TCP transport)');
         // Construct the CapRouteResolver now that both the broker and
         // localChildRegistry are ready. The resolver reads live registry state
@@ -702,8 +698,8 @@ class MoleculerService {
         // correctly. The localChildRegistry reference is captured and may be
         // null if UDS failed to start.
         this.resolver = new system_1.CapRouteResolver({
-            hubNodeId: this.brokerSafe.nodeID,
-            broker: this.brokerSafe,
+            hubNodeId: this.broker.nodeID,
+            broker: this.broker,
             hubLocalRegistry: this.localChildRegistry,
             nodeAuthority: (0, cap_route_authority_js_1.createNodeCapAuthority)(this.nodeRegistry, {
                 resolveSingleton: (capName, nodeId) => this.capabilityService.getRegistry()?.resolveSingletonAddonIdForNode(capName, nodeId) ??
@@ -736,7 +732,7 @@ class MoleculerService {
         // is wired after attachBroker so the parentBus is backed by the real
         // shared broker bus and broker.broadcast is live.
         if (this.localChildRegistry !== null) {
-            const hubNodeId = this.brokerSafe.nodeID;
+            const hubNodeId = this.broker.nodeID;
             this.udsEventBridgeDispose = (0, system_1.createUdsEventBridge)({
                 registry: this.localChildRegistry,
                 parentBus: this.eventBus,
@@ -763,7 +759,7 @@ class MoleculerService {
      * the updated service list to the network.
      */
     registerLogReceiver() {
-        this.brokerSafe.createService({
+        this.broker.createService({
             name: 'log-receiver',
             actions: {
                 ingest: {
@@ -795,7 +791,7 @@ class MoleculerService {
      * `registerLogReceiver` relies on the same post-init registration.
      */
     registerCoreCapService(service) {
-        this.brokerSafe.createService(service);
+        this.broker.createService(service);
     }
     /**
      * The hub's claim authority (D663, S3): `CapabilityRegistry.resolveClaimedStatus`,
@@ -867,7 +863,7 @@ class MoleculerService {
         // Pre-init fallback (resolver not yet constructed — before onModuleInit).
         // This path is only reachable in tests that drive onRegisterNode without
         // calling onModuleInit first.
-        if (nodeId === 'hub' || nodeId === this.brokerSafe.nodeID) {
+        if (nodeId === 'hub' || nodeId === this.broker.nodeID) {
             const registry = this.capabilityService.getRegistry();
             const provider = registry?.getSingleton(capabilityName) ?? null;
             if (provider !== null) {
@@ -946,7 +942,7 @@ class MoleculerService {
      */
     applyNodeManifest(params, previousManifest, owner, previousOwner) {
         const { nodeId, addons } = params;
-        const hubNodeId = this.brokerSafe.nodeID;
+        const hubNodeId = this.broker.nodeID;
         const isLocalChild = nodeId.startsWith(hubNodeId + '/');
         const isHubInProcess = nodeId === hubNodeId;
         // Hub in-process addons register themselves during initialize() — skip.
@@ -1048,7 +1044,7 @@ class MoleculerService {
                 udsChildId,
                 getLocalChildRegistry: () => this.localChildRegistry,
                 getResolver: () => this.resolver,
-                legacyBrokerCall: (method, methodParams, targetNode) => (0, system_1.callWithServiceDiscovery)(this.brokerSafe, addonId, (0, system_1.capActionName)(addonId, capName, method, false), (0, system_1.serializeTypedArrays)(methodParams), { nodeID: targetNode, timeout: 60_000 }),
+                legacyBrokerCall: (method, methodParams, targetNode) => (0, system_1.callWithServiceDiscovery)(this.broker, addonId, (0, system_1.capActionName)(addonId, capName, method, false), (0, system_1.serializeTypedArrays)(methodParams), { nodeID: targetNode, timeout: 60_000 }),
                 onUdsRoute: (cap) => {
                     if (!this.udsRoutedCaps.has(cap)) {
                         this.udsRoutedCaps.add(cap);
@@ -1121,7 +1117,7 @@ class MoleculerService {
         const manifest = this.nodeRegistry.getNodeManifest(nodeId);
         if (!manifest)
             return; // node never sent a handshake — nothing to do
-        const hubNodeId = this.brokerSafe.nodeID;
+        const hubNodeId = this.broker.nodeID;
         const isLocalChild = nodeId.startsWith(hubNodeId + '/');
         const disconnectGen = `disconnect-${nodeId}-${(0, node_crypto_1.randomUUID)()}`;
         const agentNodeId = nodeId.includes('/') ? nodeId.split('/')[0] : nodeId;
@@ -1194,7 +1190,7 @@ class MoleculerService {
     isReachableViaLegacy(nodeId, capabilityName) {
         if (this.findCallFn(nodeId, capabilityName) !== undefined)
             return true;
-        return this.localChildRegistry !== null && nodeId.startsWith(`${this.brokerSafe.nodeID}/`);
+        return this.localChildRegistry !== null && nodeId.startsWith(`${this.broker.nodeID}/`);
     }
     /**
      * Build a proxy object that forwards every method call on a capability
@@ -1329,7 +1325,7 @@ class MoleculerService {
      * to the Moleculer `$node-mgmt.setLogLevel` action.
      */
     setChildLogLevelByNodeId(nodeId, level) {
-        const hubNodeId = this.brokerSafe.nodeID;
+        const hubNodeId = this.broker.nodeID;
         if (!nodeId.startsWith(`${hubNodeId}/`))
             return false;
         const childId = nodeId.slice(hubNodeId.length + 1);
@@ -1348,7 +1344,7 @@ class MoleculerService {
      */
     async pullAgentReadinessSnapshot(nodeId) {
         try {
-            const snapshot = await this.brokerSafe.call(`${system_1.AGENT_READINESS_SERVICE_NAME}.getSnapshot`, {}, { nodeID: nodeId });
+            const snapshot = await this.broker.call(`${system_1.AGENT_READINESS_SERVICE_NAME}.getSnapshot`, {}, { nodeID: nodeId });
             if (!Array.isArray(snapshot) || snapshot.length === 0)
                 return;
             const records = (0, agent_readiness_pull_js_1.filterAgentAuthoritativeRecords)(snapshot, nodeId);
@@ -1375,7 +1371,7 @@ class MoleculerService {
         }
         this.udsEventBridgeDispose?.();
         this.udsEventBridgeDispose = null;
-        await this.brokerSafe.stop();
+        await this.broker.stop();
         await this.localChildRegistry?.close();
     }
 }

package/dist/main.js

@@ -599,6 +599,7 @@ async function bootstrap() {
     // settings backend (lazy getter: the backend lands after the sqlite-storage
     // builtin registers; the service resolves it per call).
     const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
+    addonRegistry.setShareTokenService(shareTokenService);
     // One-time native-app login handoff codes (in-memory, 60s TTL, single-use) —
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.

package/dist/manual-boot.js

@@ -166,8 +166,10 @@ async function bootManual(opts) {
     // A1: durable, routing-blind offline-node history — persisted through the
     // hub-resident `settings-store` cap (resolved lazily; null until it boots).
     // Wired post-construction so the service's 3-arg constructor stays intact.
-    agentRegistryService.setClusterNodeHistoryStore(new cluster_node_history_store_1.ClusterNodeHistoryStore(() => capabilityService.getRegistry()?.getSingleton('settings-store') ??
-        null, loggingService.createLogger('cluster-node-history')));
+    const clusterNodeHistoryStore = new cluster_node_history_store_1.ClusterNodeHistoryStore(() => capabilityService.getRegistry()?.getSingleton('settings-store') ??
+        null, loggingService.createLogger('cluster-node-history'));
+    agentRegistryService.setClusterNodeHistoryStore(clusterNodeHistoryStore);
+    addonRegistryService.setClusterNodeHistoryStore(clusterNodeHistoryStore);
     // ---- Layer 4: need AddonRegistry ---------------------------------------
     // AddonWidgetsService — needs AddonRegistryService for the bundled-addon
     // dist sub-folder lookup (see service docstring).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.593",
+  "version": "1.2.595",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.435",
-    "@camstack/addon-agent-ui": "1.2.242",
-    "@camstack/addon-auth": "1.2.148",
+    "@camstack/addon-admin-ui": "1.2.436",
+    "@camstack/addon-agent-ui": "1.2.243",
+    "@camstack/addon-auth": "1.2.149",
     "@camstack/addon-decoder-nodeav": "1.2.123",
-    "@camstack/addon-notifiers": "1.2.135",
-    "@camstack/addon-pipeline": "1.2.375",
-    "@camstack/addon-pipeline-orchestrator": "1.2.332",
-    "@camstack/addon-post-analysis": "1.2.374",
-    "@camstack/develop": "0.1.11",
-    "@camstack/sdk": "1.2.132",
-    "@camstack/system": "1.2.444",
-    "@camstack/types": "1.2.380",
-    "@camstack/ui-library": "1.2.298",
+    "@camstack/addon-notifiers": "1.2.601",
+    "@camstack/addon-pipeline": "1.2.601",
+    "@camstack/addon-pipeline-orchestrator": "1.2.601",
+    "@camstack/addon-post-analysis": "1.2.601",
+    "@camstack/develop": "0.1.12",
+    "@camstack/sdk": "1.2.133",
+    "@camstack/system": "1.2.445",
+    "@camstack/types": "1.2.381",
+    "@camstack/ui-library": "1.2.299",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",