@camstack/server 1.2.594 → 1.2.596

package/dist/core/moleculer/moleculer.service.js

@@ -1,14 +1,19 @@
-import { randomUUID } from 'node:crypto';
-import { AGENT_READINESS_SERVICE_NAME, CapRouteError, CapRouteResolver, callWithServiceDiscovery, capActionName, createBroker, createHubCapForwardService, createHubService, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessServiceForRegistry, createStreamProbeBrokerService, createUdsEventBridge, expandCapMethods, getBrokerTlsTransporter, getCapUsageRegistry, HubNodeRegistry, getProcessMeshCertificateRegistry, getProcessPeerLeaf, isInfraCapability, LocalChildRegistry, localEndpointPath, registerEventBusService, serializeTypedArrays, setNodeEventInterest, emitProcessNodeRegistered, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, subscribePassthrough, udsChildLogToWorkerEntry, UNCLAIMED, answerClaimedGetStatus, } from '@camstack/system';
-import { EventCategory, emitReadiness, errMsg, ReadinessRegistry } from '@camstack/types';
-import { addonPinOf, aggregateCollectionCall, COLLECTION_ARRAY_METHODS, devicePinOf, pinnedCollectionCall, pinnedDeviceCollectionCall, } from '../../api/trpc/cap-router-runtime.js';
-import { isCoreServiceCapName } from '../../api/trpc/core-cap-bridge.js';
-import { filterAgentAuthoritativeRecords } from './agent-readiness-pull.js';
-import { requestAgentRegistration } from './agent-registration-request.js';
-import { HubMeshGuard } from './hub-mesh-guard.js';
-import { buildCapCallFn } from './cap-call-fn.js';
-import { createHubResidentProviderLookup, createInProcessProviderLookup, createNodeCapAuthority, } from './cap-route-authority.js';
-export class MoleculerService {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChildManifestGate = exports.CHILD_MANIFEST_SKIP_SAMPLE = exports.MoleculerService = void 0;
+exports.childOwnerToken = childOwnerToken;
+exports.buildChildUdsManifest = buildChildUdsManifest;
+const node_crypto_1 = require("node:crypto");
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const cap_router_runtime_js_1 = require("../../api/trpc/cap-router-runtime.js");
+const core_cap_bridge_js_1 = require("../../api/trpc/core-cap-bridge.js");
+const agent_readiness_pull_js_1 = require("./agent-readiness-pull.js");
+const agent_registration_request_js_1 = require("./agent-registration-request.js");
+const hub_mesh_guard_js_1 = require("./hub-mesh-guard.js");
+const cap_call_fn_js_1 = require("./cap-call-fn.js");
+const cap_route_authority_js_1 = require("./cap-route-authority.js");
+class MoleculerService {
     eventBus;
     config;
     logging;
@@ -26,7 +31,7 @@ export class MoleculerService {
      * D3 authority: union of every node's manifest delivered via
      * `$hub.registerNode`. Populated by `onRegisterNode` in `hubDeps`.
      */
-    nodeRegistry = new HubNodeRegistry();
+    nodeRegistry = new system_1.HubNodeRegistry();
     /**
      * nodeId → the owner token of the INCARNATION whose manifest currently backs
      * that node's capability registrations.
@@ -184,8 +189,8 @@ export class MoleculerService {
         // `no-unsafe-assignment`. Going via `unknown` documents the boundary.
         // No shared secret (D857): the Moleculer namespace was never authentication (TCP
         // ignores it); a node is admitted by the certificate it presented at the TLS handshake.
-        this.meshGuard = new HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
-        const broker = createBroker({
+        this.meshGuard = new hub_mesh_guard_js_1.HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
+        const broker = (0, system_1.createBroker)({
             nodeID: 'hub',
             mode: 'hub',
             // D802, D857: every action and event another node sends passes the certificate gate.
@@ -197,7 +202,7 @@ export class MoleculerService {
         // (eventemitter2 chain unresolvable). Documented + single-site cast.
         // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
         this.broker = broker;
-        this.readinessRegistry = new ReadinessRegistry({
+        this.readinessRegistry = new types_1.ReadinessRegistry({
             eventBus: this.eventBus,
             sourceNodeId: this.broker.nodeID,
             logger: this.logging.createLogger('readiness'),
@@ -268,7 +273,7 @@ export class MoleculerService {
             // D857: a node registers only itself, and only with a certificate identity.
             meshIdentity: this.meshGuard.gate,
         };
-        const hubService = createHubService(hubDeps);
+        const hubService = (0, system_1.createHubService)(hubDeps);
         this.broker.createService(hubService);
         // Forked addon-runner children must root their storage (addons-data,
         // the sqlite settings DB) under the SAME data path as the hub's main
@@ -296,7 +301,7 @@ export class MoleculerService {
             // capabilities the resolver can see. Before F0 this fell through
             // UDS_NO_ROUTE → the child's own brokerTransportLink; F1+F2 removes that
             // child broker, so the parent must own this path.
-            const onUnownedCall = createParentUnownedCallHandler({
+            const onUnownedCall = (0, system_1.createParentUnownedCallHandler)({
                 getResolver: () => this.resolver,
                 // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- moleculer types unresolvable; see `broker` getter docstring
                 broker: this.broker,
@@ -354,7 +359,7 @@ export class MoleculerService {
                         return null;
                     if (reg.getDefinition(capName)?.mode !== 'collection')
                         return null;
-                    if (!COLLECTION_ARRAY_METHODS.get(capName)?.includes(method))
+                    if (!cap_router_runtime_js_1.COLLECTION_ARRAY_METHODS.get(capName)?.includes(method))
                         return null;
                     if (reg.getCollectionEntries(capName).length > 0)
                         return null;
@@ -368,7 +373,7 @@ export class MoleculerService {
                 // never disagree again). Routing alone picks ONE provider, which is
                 // how the Notification Center saw an empty `notification-output`
                 // catalog and dead-lettered every notification (2026-07-30).
-                callCollectionAggregate: (capName, method, args) => aggregateCollectionCall(this.capabilityService.getRegistry(), capName, method, args),
+                callCollectionAggregate: (capName, method, args) => (0, cap_router_runtime_js_1.aggregateCollectionCall)(this.capabilityService.getRegistry(), capName, method, args),
                 // `{ addonId }` PIN for the same child→parent path — the scalar twin of
                 // the fan-out above, sharing this server's provider resolution so the
                 // two paths cannot disagree. Routing takes only `nodeId`/`deviceId`, so
@@ -383,7 +388,7 @@ export class MoleculerService {
                 // addon's clip byte read named `provider-reolink` and was answered by
                 // whichever child registered first — the recorder, then export-hap
                 // after a redeploy in a different order (2026-09-22, D594).
-                callPinnedCollection: async (capName, method, args) => (await pinnedDeviceCollectionCall(this.capabilityService.getRegistry(), capName, method, args)) ?? pinnedCollectionCall(this.capabilityService.getRegistry(), capName, method, args),
+                callPinnedCollection: async (capName, method, args) => (await (0, cap_router_runtime_js_1.pinnedDeviceCollectionCall)(this.capabilityService.getRegistry(), capName, method, args)) ?? (0, cap_router_runtime_js_1.pinnedCollectionCall)(this.capabilityService.getRegistry(), capName, method, args),
                 // Hub-core `$`-service discriminant for the general
                 // provider-not-yet-registered recovery. A resolver miss on a NON-core
                 // cap (any addon-provided system/singleton cap, e.g.
@@ -393,7 +398,7 @@ export class MoleculerService {
                 // predicate lets it retry the resolver + throw a precise error instead.
                 // Derived from the already-maintained core-router list, so a new
                 // multi-node addon cap is covered with no change here.
-                isCoreServiceCap: (capName) => isCoreServiceCapName(capName),
+                isCoreServiceCap: (capName) => (0, core_cap_bridge_js_1.isCoreServiceCapName)(capName),
                 logger: {
                     debug: (msg, meta) => logger.debug(msg, meta !== null && meta !== undefined
                         ? { meta: meta }
@@ -411,7 +416,7 @@ export class MoleculerService {
             // `broker.call('$hub-cap-fwd.forward', …)` discovers it here. Without it a
             // remote agent's raw `${cap}.*` discovery 30s-deadlines (hub-local addon
             // runners expose no Moleculer service). See hub-cap-forward.ts.
-            this.broker.createService(createHubCapForwardService(onUnownedCall, {
+            this.broker.createService((0, system_1.createHubCapForwardService)(onUnownedCall, {
                 // The agent stamps WHO is calling (its child's runner id) into the
                 // envelope (D787). Believe it only when that runner is on the agent
                 // the request came from — a node's registered manifest lists the
@@ -421,8 +426,8 @@ export class MoleculerService {
                     meta: { senderNodeId, callerRunnerId },
                 }),
             }));
-            const registry = new LocalChildRegistry({
-                server: createLocalTransport().createServer(nodeId),
+            const registry = new system_1.LocalChildRegistry({
+                server: (0, system_1.createLocalTransport)().createServer(nodeId),
                 // This node's own id — lets the cap-call-out router serve a pin-to-self
                 // from the co-resident sibling instead of bouncing it through
                 // onUnownedCall (a pin to ANOTHER node still bypasses the sibling).
@@ -448,7 +453,7 @@ export class MoleculerService {
                         return false;
                     if (reg.getDefinition(capName)?.mode !== 'collection')
                         return false;
-                    return COLLECTION_ARRAY_METHODS.get(capName)?.includes(method) === true;
+                    return cap_router_runtime_js_1.COLLECTION_ARRAY_METHODS.get(capName)?.includes(method) === true;
                 },
                 // Same story for an explicit `{ addonId }` selector: the sibling
                 // short-circuit picks the FIRST-registered child, which is precisely
@@ -464,8 +469,8 @@ export class MoleculerService {
                 // routing that would honour it — "honoured only there is honoured
                 // never", which is how the first attempt at the `addonId` fix failed
                 // live, and how the `provider` pin failed twice more (D592, D593).
-                isAddonPinnedCall: (capName, method, args) => addonPinOf(this.capabilityService.getRegistry(), capName, method, args) !== null ||
-                    devicePinOf(this.capabilityService.getRegistry(), capName, args) !== null,
+                isAddonPinnedCall: (capName, method, args) => (0, cap_router_runtime_js_1.addonPinOf)(this.capabilityService.getRegistry(), capName, method, args) !== null ||
+                    (0, cap_router_runtime_js_1.devicePinOf)(this.capabilityService.getRegistry(), capName, args) !== null,
                 // Bound every UDS cap call by the cap's own declared timeout, falling
                 // back to the channel default. Same resolver the REMOTE plane uses
                 // below, so a method that survives 16 minutes across nodes survives it
@@ -479,7 +484,7 @@ export class MoleculerService {
                 // RUNNER's own module singleton, which hub-main never sees — which is
                 // why the graph answered `[]` on a hub running 64 addons. Blind spots
                 // that remain are listed on `LocalChildRegistryOptions.capUsageObserver`.
-                capUsageObserver: (obs) => getCapUsageRegistry().recordCall(obs),
+                capUsageObserver: (obs) => (0, system_1.getCapUsageRegistry)().recordCall(obs),
                 logger: {
                     info: (msg, meta) => logger.info(msg, meta !== null && meta !== undefined
                         ? { meta: meta }
@@ -520,7 +525,7 @@ export class MoleculerService {
                     }
                     catch (err) {
                         logger.warn('UDS child custom-action catalogs could not be applied', {
-                            meta: { nodeId: childNodeId, incarnation: child.incarnation, error: errMsg(err) },
+                            meta: { nodeId: childNodeId, incarnation: child.incarnation, error: (0, types_1.errMsg)(err) },
                         });
                     }
                 }
@@ -543,7 +548,7 @@ export class MoleculerService {
                                 nodeId: childNodeId,
                                 incarnation: child.incarnation,
                                 skipped: this.childManifestGate.skippedSince(),
-                                sampleEvery: CHILD_MANIFEST_SKIP_SAMPLE,
+                                sampleEvery: exports.CHILD_MANIFEST_SKIP_SAMPLE,
                             },
                         });
                     }
@@ -577,7 +582,7 @@ export class MoleculerService {
             // This runs in PARALLEL with the existing $hub.log / onLog broker path —
             // both stay active until Phase F removes the broker path.
             registry.onChildLog((childId, entry) => {
-                this.logging.writeFromWorker(udsChildLogToWorkerEntry(childId, entry));
+                this.logging.writeFromWorker((0, system_1.udsChildLogToWorkerEntry)(childId, entry));
             });
             // D1: answer readiness-snapshot requests from UDS children so they can
             // hydrate without a `$readiness.getSnapshot` Moleculer call.
@@ -588,7 +593,7 @@ export class MoleculerService {
             // Keep `$readiness.getSnapshot` intact — Phase F removes it.
             registry.onReadinessSnapshotRequest(() => this.readinessRegistry.getSnapshotForTransport());
             this.localChildRegistry = registry;
-            parentUdsPath = localEndpointPath(nodeId);
+            parentUdsPath = (0, system_1.localEndpointPath)(nodeId);
             logger.info('UDS child registry listening', { meta: { path: parentUdsPath } });
         }
         catch (err) {
@@ -596,7 +601,7 @@ export class MoleculerService {
                 meta: { err: err instanceof Error ? err.message : String(err) },
             });
         }
-        const processService = createProcessService(this.broker.nodeID, dataDir, undefined, undefined, parentUdsPath);
+        const processService = (0, system_1.createProcessService)(this.broker.nodeID, dataDir, undefined, undefined, parentUdsPath);
         this.broker.createService(processService);
         // $addonHost — REMOVED (Sprint 6). Three-level settings are now
         // served by the `addon-settings` singleton capability. Per-addon
@@ -611,7 +616,7 @@ export class MoleculerService {
             this.removeNodeFromRegistry(node.id);
             this.meshGuard.forget(node.id);
             // Release A: its next connection decides again whether it is `tls` or `clear`.
-            getBrokerTlsTransporter(this.broker)?.forgetPeer(node.id);
+            (0, system_1.getBrokerTlsTransporter)(this.broker)?.forgetPeer(node.id);
         });
         // D8 reverse-leg snapshot-reconcile: on every agent (re)connect, pull
         // the agent's own readiness snapshot (`$agent-readiness.getSnapshot`)
@@ -629,7 +634,7 @@ export class MoleculerService {
             // The hub may have dropped this agent's registration on a disconnect
             // only the hub saw (gossip, a failed write): ask it for its full set
             // (`agent-registration-request.ts`, 2026-10-14).
-            void requestAgentRegistration({
+            void (0, agent_registration_request_js_1.requestAgentRegistration)({
                 call: (action, params, opts) => this.broker.call(action, params, opts),
                 isRegistered: (id) => this.isNodeRegistered(id),
                 warn: (message, id, meta) => this.logger.warn(message, { tags: { nodeId: id }, meta }),
@@ -651,26 +656,26 @@ export class MoleculerService {
         // handshake, not dynamically after post-start `createService()`.
         // Without this, cross-node broadcasts (camstack.evt.<category>) would
         // arrive unreliably for the first ~10s after each node joins.
-        registerEventBusService(this.broker);
+        (0, system_1.registerEventBusService)(this.broker);
         // Register the hub-authoritative `$readiness.getSnapshot` service
         // BEFORE broker.start() so workers / agents see it in their initial
         // INFO packet — post-start `createService` calls propagate via
         // heartbeat (several seconds) and would force workers to poll.
-        this.broker.createService(createReadinessServiceForRegistry(this.readinessRegistry));
+        this.broker.createService((0, system_1.createReadinessServiceForRegistry)(this.readinessRegistry));
         // Register the hub-authoritative `$stream-probe` service —
         // workers route RTSP probe + field-probe through this action when
         // the tRPC WSS link isn't available (default path for forked
         // workers). Keeps ffprobe + HTTP-reachability as a single
         // hub-side implementation; see `createStreamProbeBrokerService`
         // for the shape.
-        this.broker.createService(createStreamProbeBrokerService({
+        this.broker.createService((0, system_1.createStreamProbeBrokerService)({
             probe: (url, options) => this.streamProbe.probe(url, options),
             probeField: (key, value) => this.streamProbe.probeField(key, value),
         }));
         // D826: when system-config's MeshCaKeeper becomes ready it offers hub leaf
         // material here; the transporter listens on mutual TLS only (:6443).
-        setProcessMeshTlsEnabler(async (material) => {
-            const tx = getBrokerTlsTransporter(this.broker);
+        (0, system_1.setProcessMeshTlsEnabler)(async (material) => {
+            const tx = (0, system_1.getBrokerTlsTransporter)(this.broker);
             if (tx === null) {
                 logger.warn('Mesh TLS material ready but broker transporter is not TlsTcpTransporter');
                 return;
@@ -678,11 +683,11 @@ export class MoleculerService {
             await tx.enableMeshTls(material);
             logger.info('Mesh mTLS listener enabled (TLS-only hub mesh)');
         });
-        setProcessMeshPeerTransportLookup({
-            transportOf: (nodeId) => getBrokerTlsTransporter(this.broker)?.peerTransport(nodeId),
-            isVerifiedPeer: (nodeId) => getBrokerTlsTransporter(this.broker)?.verifiedPeer(nodeId) !== undefined,
-            peerLeaf: (nodeId) => getBrokerTlsTransporter(this.broker)?.peerLeaf(nodeId),
-            dropPeer: (nodeId) => getBrokerTlsTransporter(this.broker)?.dropPeer(nodeId) ?? 0,
+        (0, system_1.setProcessMeshPeerTransportLookup)({
+            transportOf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerTransport(nodeId),
+            isVerifiedPeer: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.verifiedPeer(nodeId) !== undefined,
+            peerLeaf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerLeaf(nodeId),
+            dropPeer: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.dropPeer(nodeId) ?? 0,
         });
         await this.broker.start();
         logger.info('Moleculer broker started (TCP transport)');
@@ -692,21 +697,21 @@ export class MoleculerService {
         // children connecting/disconnecting after this point are picked up
         // correctly. The localChildRegistry reference is captured and may be
         // null if UDS failed to start.
-        this.resolver = new CapRouteResolver({
+        this.resolver = new system_1.CapRouteResolver({
             hubNodeId: this.broker.nodeID,
             broker: this.broker,
             hubLocalRegistry: this.localChildRegistry,
-            nodeAuthority: createNodeCapAuthority(this.nodeRegistry, {
+            nodeAuthority: (0, cap_route_authority_js_1.createNodeCapAuthority)(this.nodeRegistry, {
                 resolveSingleton: (capName, nodeId) => this.capabilityService.getRegistry()?.resolveSingletonAddonIdForNode(capName, nodeId) ??
                     null,
             }),
-            inProcessProviders: createInProcessProviderLookup(this.capabilityService),
+            inProcessProviders: (0, cap_route_authority_js_1.createInProcessProviderLookup)(this.capabilityService),
             // Node-accurate lookup for EXPLICITLY hub-pinned calls: unlike the
             // lookup above (which falls back to the cluster-elected ACTIVE
             // singleton — possibly a remote proxy), this resolves only providers
             // physically resident on the hub, so a `nodePin('hub')` fails precisely
             // instead of silently executing on another node.
-            hubResidentProviders: createHubResidentProviderLookup(this.capabilityService),
+            hubResidentProviders: (0, cap_route_authority_js_1.createHubResidentProviderLookup)(this.capabilityService),
             // Per-cap-method RPC timeout override (e.g. model-convert.convert, which
             // runs for minutes) — read from the cap definition's declared timeoutMs.
             capTimeoutMs: (capName, method) => this.capabilityService.getRegistry()?.getDefinition(capName)?.methods?.[method]?.timeoutMs,
@@ -728,14 +733,14 @@ export class MoleculerService {
         // shared broker bus and broker.broadcast is live.
         if (this.localChildRegistry !== null) {
             const hubNodeId = this.broker.nodeID;
-            this.udsEventBridgeDispose = createUdsEventBridge({
+            this.udsEventBridgeDispose = (0, system_1.createUdsEventBridge)({
                 registry: this.localChildRegistry,
                 parentBus: this.eventBus,
                 parentNodeId: hubNodeId,
                 // D2: relay via pass-through so the bridge's wildcard is not counted as
                 // local interest (uniform with the agent; harmless here since the hub
                 // retains and always accepts inbound cross-node events anyway).
-                subscribePassthrough: (handler) => subscribePassthrough(this.broker, handler),
+                subscribePassthrough: (handler) => (0, system_1.subscribePassthrough)(this.broker, handler),
             });
             // D2: expose the hub's aggregate child interest to its `$event-bus`
             // inbound gate for uniformity with the agent. NOTE: the hub main process
@@ -745,7 +750,7 @@ export class MoleculerService {
             // wiring is therefore harmless-but-uniform; the real efficiency win is on
             // agents (non-retaining nodes).
             const hubChildRegistry = this.localChildRegistry;
-            setNodeEventInterest(this.broker, () => hubChildRegistry.aggregateEventInterest());
+            (0, system_1.setNodeEventInterest)(this.broker, () => hubChildRegistry.aggregateEventInterest());
         }
     }
     /**
@@ -797,7 +802,7 @@ export class MoleculerService {
         const registry = this.capabilityService.getRegistry();
         return registry !== null
             ? registry.resolveClaimedStatus(capName, deviceId)
-            : Promise.resolve(UNCLAIMED);
+            : Promise.resolve(system_1.UNCLAIMED);
     }
     /**
      * Call a capability method on a specific node.
@@ -822,7 +827,7 @@ export class MoleculerService {
         // a `nodeId` pin — the generated DeviceProxy always sends one — and every
         // hub in-process addon's `ctx.api` through `deviceCapResolverLink`); a pin
         // does not bypass the claim authority. Same shared function as the other two.
-        const claimed = await answerClaimedGetStatus((capName, deviceId) => this.resolveClaimedStatus(capName, deviceId), { capName: capabilityName, method: methodName, args: params });
+        const claimed = await (0, system_1.answerClaimedGetStatus)((capName, deviceId) => this.resolveClaimedStatus(capName, deviceId), { capName: capabilityName, method: methodName, args: params });
         if (claimed !== null)
             return claimed.slice;
         const resolver = this.resolver;
@@ -837,7 +842,7 @@ export class MoleculerService {
                 return await resolver.dispatch(route, methodName, params);
             }
             catch (err) {
-                if (err instanceof CapRouteError &&
+                if (err instanceof system_1.CapRouteError &&
                     (err.reason === 'no-provider' || err.reason === 'node-offline')) {
                     // Resolver couldn't find the cap — try the legacy callFn store as a
                     // fallback. This covers caps registered in nodeCallFns (e.g. agent
@@ -872,7 +877,7 @@ export class MoleculerService {
         if (callFn) {
             return callFn(methodName, params);
         }
-        throw new CapRouteError(capabilityName, methodName, {
+        throw new system_1.CapRouteError(capabilityName, methodName, {
             reason: 'no-provider',
             nodeId,
             rejected: [
@@ -903,7 +908,7 @@ export class MoleculerService {
         this.observePresentedMeshLeaf(params.nodeId);
         // The node's capabilities are routable now: whoever waits for this registration (a mesh
         // leaf renewal confirming the node came back WITH the new leaf) is told, with no polling.
-        emitProcessNodeRegistered(params.nodeId, params.addons.map((addon) => addon.addonId));
+        (0, system_1.emitProcessNodeRegistered)(params.nodeId, params.addons.map((addon) => addon.addonId));
         // Notify AgentRegistryService to reconcile placement for bare-ID
         // agent nodes (no '/' = not a hub child worker, not the hub itself).
         // The handshake is the authoritative completeness signal — the full
@@ -966,7 +971,7 @@ export class MoleculerService {
         // isolate (D231) IS this node's engine, and skipping it leaves
         // `getCollection` empty. Hub-local children are proxied; remote nodes
         // are not (D233).
-        const skipInfraFromRemote = (capName) => isInfraCapability(capName) && !isLocalChild;
+        const skipInfraFromRemote = (capName) => (0, system_1.isInfraCapability)(capName) && !isLocalChild;
         const appliedKeys = (manifest) => {
             const keys = new Map();
             for (const addon of manifest) {
@@ -1032,14 +1037,14 @@ export class MoleculerService {
             //     UDS-migration gap where this dispatcher hand-rolled a `broker.call`
             //     to an agent that exposes no Moleculer service for the cap.
             //   - resolver not yet built (pre-init) → legacy Moleculer call.
-            const callFn = buildCapCallFn({
+            const callFn = (0, cap_call_fn_js_1.buildCapCallFn)({
                 capName,
                 addonId,
                 nodeId,
                 udsChildId,
                 getLocalChildRegistry: () => this.localChildRegistry,
                 getResolver: () => this.resolver,
-                legacyBrokerCall: (method, methodParams, targetNode) => callWithServiceDiscovery(this.broker, addonId, capActionName(addonId, capName, method, false), serializeTypedArrays(methodParams), { nodeID: targetNode, timeout: 60_000 }),
+                legacyBrokerCall: (method, methodParams, targetNode) => (0, system_1.callWithServiceDiscovery)(this.broker, addonId, (0, system_1.capActionName)(addonId, capName, method, false), (0, system_1.serializeTypedArrays)(methodParams), { nodeID: targetNode, timeout: 60_000 }),
                 onUdsRoute: (cap) => {
                     if (!this.udsRoutedCaps.has(cap)) {
                         this.udsRoutedCaps.add(cap);
@@ -1048,7 +1053,7 @@ export class MoleculerService {
                 },
             });
             const proxy = { id: addonId, nodeId };
-            for (const methodName of Object.keys(expandCapMethods(capDef))) {
+            for (const methodName of Object.keys((0, system_1.expandCapMethods)(capDef))) {
                 proxy[methodName] = (methodParams) => callFn(methodName, methodParams);
             }
             registry.registerProvider(capName, registryKey, proxy, owner);
@@ -1072,19 +1077,19 @@ export class MoleculerService {
             // refreshes its page/widget registry for cross-process addons.
             if (capName === 'addon-pages-source') {
                 this.eventBus.emit({
-                    id: randomUUID(),
+                    id: (0, node_crypto_1.randomUUID)(),
                     timestamp: new Date(),
                     source: { type: 'addon', id: addonId },
-                    category: EventCategory.AddonPageReady,
+                    category: types_1.EventCategory.AddonPageReady,
                     data: { addonId, nodeId },
                 });
             }
             if (capName === 'addon-widgets-source') {
                 this.eventBus.emit({
-                    id: randomUUID(),
+                    id: (0, node_crypto_1.randomUUID)(),
                     timestamp: new Date(),
                     source: { type: 'addon', id: addonId },
-                    category: EventCategory.AddonWidgetReady,
+                    category: types_1.EventCategory.AddonWidgetReady,
                     data: { addonId, nodeId },
                 });
             }
@@ -1114,7 +1119,7 @@ export class MoleculerService {
             return; // node never sent a handshake — nothing to do
         const hubNodeId = this.broker.nodeID;
         const isLocalChild = nodeId.startsWith(hubNodeId + '/');
-        const disconnectGen = `disconnect-${nodeId}-${randomUUID()}`;
+        const disconnectGen = `disconnect-${nodeId}-${(0, node_crypto_1.randomUUID)()}`;
         const agentNodeId = nodeId.includes('/') ? nodeId.split('/')[0] : nodeId;
         const registry = this.capabilityService.getRegistry();
         for (const addon of manifest) {
@@ -1128,7 +1133,7 @@ export class MoleculerService {
             for (const capName of capabilities) {
                 this.nodeCallFns.delete(`${nodeId}::${capName}`);
                 try {
-                    emitReadiness(this.eventBus, {
+                    (0, types_1.emitReadiness)(this.eventBus, {
                         capName,
                         scope: { type: 'node', nodeId: agentNodeId },
                         state: 'down',
@@ -1214,7 +1219,7 @@ export class MoleculerService {
                 // Resolver found a route — proxy is reachable.
             }
             catch (err) {
-                if (err instanceof CapRouteError &&
+                if (err instanceof system_1.CapRouteError &&
                     (err.reason === 'no-provider' || err.reason === 'node-offline')) {
                     // Check legacy callFn store and hub-local child fallbacks.
                     if (!this.isReachableViaLegacy(nodeId, capabilityName))
@@ -1276,8 +1281,8 @@ export class MoleculerService {
      * registry that is not up, or a write that fails, must not fail the node's registration.
      */
     observePresentedMeshLeaf(nodeId) {
-        const registry = getProcessMeshCertificateRegistry();
-        const leaf = getProcessPeerLeaf(nodeId);
+        const registry = (0, system_1.getProcessMeshCertificateRegistry)();
+        const leaf = (0, system_1.getProcessPeerLeaf)(nodeId);
         if (registry === null || leaf === undefined)
             return;
         registry
@@ -1339,10 +1344,10 @@ export class MoleculerService {
      */
     async pullAgentReadinessSnapshot(nodeId) {
         try {
-            const snapshot = await this.broker.call(`${AGENT_READINESS_SERVICE_NAME}.getSnapshot`, {}, { nodeID: nodeId });
+            const snapshot = await this.broker.call(`${system_1.AGENT_READINESS_SERVICE_NAME}.getSnapshot`, {}, { nodeID: nodeId });
             if (!Array.isArray(snapshot) || snapshot.length === 0)
                 return;
-            const records = filterAgentAuthoritativeRecords(snapshot, nodeId);
+            const records = (0, agent_readiness_pull_js_1.filterAgentAuthoritativeRecords)(snapshot, nodeId);
             if (records.length === 0)
                 return;
             this.readinessRegistry.hydrate(records);
@@ -1358,8 +1363,8 @@ export class MoleculerService {
         }
     }
     async onModuleDestroy() {
-        setProcessMeshTlsEnabler(null);
-        setProcessMeshPeerTransportLookup(null);
+        (0, system_1.setProcessMeshTlsEnabler)(null);
+        (0, system_1.setProcessMeshPeerTransportLookup)(null);
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);
             this.agentReadinessPullTimer = null;
@@ -1370,6 +1375,7 @@ export class MoleculerService {
         await this.localChildRegistry?.close();
     }
 }
+exports.MoleculerService = MoleculerService;
 // ---------------------------------------------------------------------------
 // Module-level helpers
 // ---------------------------------------------------------------------------
@@ -1382,7 +1388,7 @@ export class MoleculerService {
  * regression suite: the rule is only worth anything if register and unregister
  * derive the token the SAME way.
  */
-export function childOwnerToken(childNodeId, incarnation) {
+function childOwnerToken(childNodeId, incarnation) {
     return `${childNodeId}#${incarnation}`;
 }
 /**
@@ -1392,7 +1398,7 @@ export function childOwnerToken(childNodeId, incarnation) {
  * re-registering, and those two want opposite investigations. A line per skip
  * would reproduce exactly the volume the gate exists to remove.
  */
-export const CHILD_MANIFEST_SKIP_SAMPLE = 25;
+exports.CHILD_MANIFEST_SKIP_SAMPLE = 25;
 /** Canonical, order-insensitive text for a child manifest. */
 function childManifestFingerprint(params) {
     const addons = params.addons
@@ -1426,7 +1432,7 @@ function childManifestFingerprint(params) {
  * every provider owned by the dead generation and the successor's disconnect
  * would unregister nothing.
  */
-export class ChildManifestGate {
+class ChildManifestGate {
     applied = new Map();
     skipped = 0;
     sinceSample = 0;
@@ -1456,12 +1462,13 @@ export class ChildManifestGate {
     }
     /** True once every {@link CHILD_MANIFEST_SKIP_SAMPLE} skips. */
     sampleDue() {
-        if (this.sinceSample < CHILD_MANIFEST_SKIP_SAMPLE)
+        if (this.sinceSample < exports.CHILD_MANIFEST_SKIP_SAMPLE)
             return false;
         this.sinceSample = 0;
         return true;
     }
 }
+exports.ChildManifestGate = ChildManifestGate;
 /**
  * E1: Adapt a child's UDS `ChildCapDescriptor[]` into a `RegisterNodeParams`
  * that `onRegisterNode` / `applyNodeManifest` can consume.
@@ -1483,7 +1490,7 @@ export class ChildManifestGate {
  * cap names; device-scoped native caps are handled separately via `nativeCaps` in the
  * full `RegisterNodeParams`.
  */
-export function buildChildUdsManifest(nodeId, childId, caps) {
+function buildChildUdsManifest(nodeId, childId, caps) {
     // Group unique system (non-device-scoped) cap names per hosted addon.
     // Insertion order preserves the child's registration order.
     const capsByAddon = new Map();

package/dist/core/network/network-quality.service.js

@@ -1,3 +1,7 @@
-import { NetworkQualityTracker } from '@camstack/system';
-export class NetworkQualityService extends NetworkQualityTracker {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetworkQualityService = void 0;
+const system_1 = require("@camstack/system");
+class NetworkQualityService extends system_1.NetworkQualityTracker {
 }
+exports.NetworkQualityService = NetworkQualityService;

package/dist/core/notification/notification-wrapper.service.js

@@ -1,11 +1,14 @@
-import { NotificationService } from '@camstack/system';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotificationServiceWrapper = void 0;
+const system_1 = require("@camstack/system");
 /**
  * NestJS-injectable wrapper around the core NotificationService.
  *
  * Lazily creates the NotificationService on first use, wiring in the
  * CapabilityRegistry for proxy-based output resolution.
  */
-export class NotificationServiceWrapper {
+class NotificationServiceWrapper {
     caps;
     logging;
     _service = null;
@@ -15,7 +18,7 @@ export class NotificationServiceWrapper {
     }
     get service() {
         if (!this._service) {
-            this._service = new NotificationService(this.logging.createLogger('notifications'));
+            this._service = new system_1.NotificationService(this.logging.createLogger('notifications'));
             const registry = this.caps.getRegistry();
             if (registry) {
                 this._service.setRegistry(registry);
@@ -27,3 +30,4 @@ export class NotificationServiceWrapper {
         return this.service.notify(notification);
     }
 }
+exports.NotificationServiceWrapper = NotificationServiceWrapper;

package/dist/core/notification/toast-wrapper.service.js

@@ -1,11 +1,14 @@
-import { ToastService } from '@camstack/system';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToastServiceWrapper = void 0;
+const system_1 = require("@camstack/system");
 /**
  * NestJS-injectable wrapper around the core ToastService.
  *
  * Provides toast broadcasting to connected UI clients.
  */
-export class ToastServiceWrapper {
-    _service = new ToastService();
+class ToastServiceWrapper {
+    _service = new system_1.ToastService();
     get service() {
         return this._service;
     }
@@ -19,3 +22,4 @@ export class ToastServiceWrapper {
         return this._service.subscribe(connectionId, userId, callback);
     }
 }
+exports.ToastServiceWrapper = ToastServiceWrapper;

package/dist/core/provider/provider.tokens.js

@@ -1 +1,4 @@
-export const PROVIDER_MANAGER = Symbol('PROVIDER_MANAGER');
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_MANAGER = void 0;
+exports.PROVIDER_MANAGER = Symbol('PROVIDER_MANAGER');

package/dist/core/repl/repl-engine.service.js

@@ -1,6 +1,9 @@
-import { ReplEngine } from '@camstack/system';
-import { SystemMirror } from '@camstack/types';
-export class ReplEngineService extends ReplEngine {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReplEngineService = void 0;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+class ReplEngineService extends system_1.ReplEngine {
     /**
      * Lazily-instantiated `SystemMirror` shared across REPL sessions.
      * Holds a single warm-boot mirror that every `sm.getDeviceById(id)`
@@ -45,7 +48,7 @@ export class ReplEngineService extends ReplEngine {
             return Promise.resolve(this.systemMirror);
         if (!this.systemMirrorInit) {
             const api = this.buildInProcessApi(addonRegistry, eventBus);
-            const sm = new SystemMirror(api);
+            const sm = new types_1.SystemMirror(api);
             this.systemMirrorInit = sm.init().then(() => {
                 this.systemMirror = sm;
                 return sm;
@@ -134,3 +137,4 @@ export class ReplEngineService extends ReplEngine {
         super(contextProvider);
     }
 }
+exports.ReplEngineService = ReplEngineService;