@camstack/server 1.2.594 → 1.2.596

package/dist/main.js

@@ -1,9 +1,47 @@
+"use strict";
 /* eslint-disable @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument -- pre-existing lint debt across this 800+ line bootstrap module. The flagged sites cross typed boundaries (Fastify request typing, AddonRouteRegistry, AuthService inherited methods) where the projectService context can't trace inheritance chains. Tracked separately; do not amend in unrelated edits. */
-import { createLazyUiServing } from './ui-serving/lazy-ui-serving.js';
-import { execSync } from 'node:child_process';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { Server as TlsServer } from 'node:tls';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const lazy_ui_serving_js_1 = require("./ui-serving/lazy-ui-serving.js");
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_tls_1 = require("node:tls");
 // Boot-time capability declaration runs over the auto-generated
 // `ALL_CAPABILITY_DEFINITIONS` array — every `*.cap.ts` file that ships
 // with `@camstack/types` is included automatically. Adding a new cap
@@ -14,88 +52,88 @@ import { Server as TlsServer } from 'node:tls';
 // Sourced from `@camstack/system` (not `@camstack/types`) so the hub's
 // capability surface refreshes on `camstack deploy packages/system` with no new
 // server image. `@camstack/types` is never deployed to the hub.
-import { AddonRouteRegistry, ALL_CAPABILITY_DEFINITIONS, allFamiliesListenHost, bindPendingLanHttp, createDeferredHeapWatchSink, createEventPlaneReader, createInspectorArrayBufferCensus, createMeshQueueReader, createSocketPlaneReader, createV8Reclaimer, DataPlaneRegistry, getLoggingGate, getMoleculerEventStats, getUserManagementInternal, HUB_MAIN_HEAP_WATCH_LABEL, hubMainRssBudget, onSessionsRevoked, proxyToUpstream, registerHttpsListener, registerLanHttpHandler, signalAllRunnerGroups, startEventLoopStallMonitor, startHeapWatch, } from '@camstack/system';
-import fastifyCompress from '@fastify/compress';
-import fastifyCookie from '@fastify/cookie';
-import { fastifyTRPCPlugin } from '@trpc/server/adapters/fastify';
-import { applyWSSHandler } from '@trpc/server/adapters/ws';
-import { WebSocketServer } from 'ws';
-import { registerAddonUploadRoute } from './api/addon-upload';
-import { registerAuthWhoamiRoute } from './api/auth-whoami';
-import { registerBackupDownloadRoute } from './api/backup-download.js';
-import { buildSettingsStoreGateway } from './api/core/cap-providers';
-import { LoggingSettingsService } from './api/core/logging-settings';
-import { RequestCensusService } from './api/core/request-census-settings';
-import { createCorsPolicy, refuseForeignWsUpgrade, registerCorsPolicy, } from './api/cors/register-cors-policy';
-import { ADAPTIVE_PROBE_PER_IP_PER_MINUTE, registerAdaptiveProbeRoute, } from './api/health/adaptive-probe.routes';
-import { registerHealthRoutes } from './api/health/health.routes';
-import { RunnerBootCheckService } from './core/runner-health/runner-boot-check';
-import { clusterBaseUrlResolver, resolveHubBaseUrl } from './api/hub-cluster-url';
-import { buildModelDistributorProvider } from './api/model-distributor.js';
-import { registerOauth2Routes } from './api/oauth2/oauth2-routes.js';
-import { registerServerUploadRoute } from './api/server-upload';
-import { registerServerUploadPropagateRoute } from './api/server-upload-propagate';
-import { markSseRequestNoCompression } from './api/sse-no-compression.js';
-import { registerFramePolicy } from './api/static/frame-policy';
-import { resolvePrecompressedAsset, warmPrecompressedAssets, } from './api/static/precompressed-asset.js';
-import { FORWARDED_PREFIX_HEADER, parseForwardedPrefix, sendSpaShell } from './api/static/spa-mount';
-import { addonBundleCacheControl, contentTypeForPath, isRetiredPublicPath, spaAssetCacheControl, spaShellCacheControl, } from './api/static/spa-static';
-import { buildCoreCapService, setRemotePrivilegeLogSink } from './api/trpc/core-cap-bridge';
-import { getHttpRequestCensus } from './api/trpc/http-request-census.singleton';
-import { recordTrpcHttpRequest } from './api/trpc/http-request-census-hook';
-import { createTrpcContext, createWsTrpcContext } from './api/trpc/trpc.context';
-import { getSessionConnections, SESSION_ENDED_CLOSE_CODE, SESSION_ENDED_CLOSE_REASON, } from './auth/session-connections.js';
-import { buildAppRouter } from './api/trpc/trpc.router';
-import { trpcErrorDeviceTags } from './api/trpc/trpc-error-device-tags';
-import { describeTrpcPrincipal } from './api/trpc/trpc-error-principal';
-import { attachWsCensusSession, identifyWsCensusSession } from './api/trpc/ws-request-census';
-import { WsSlowConsumerGuard, wsConnectionFacts } from './api/trpc/ws-slow-consumer-guard.js';
-import { gateAddonJwt } from './auth/addon-route-jwt-gate.js';
-import { gateAddonShareToken, SHARE_DEVICES_HEADER, SHARE_KIND_HEADER, } from './auth/addon-route-share-gate.js';
-import { createAuthNetworkPolicy } from './auth/auth-network-policy.js';
-import { createSessionTokenCheck, sessionBackingFrom } from './auth/hub-sessions.js';
-import { readSessionLifetimes } from './auth/session-lifetimes.js';
-import { clientKeyFromRequest, createRateLimiter } from './auth/auth-rate-limit';
-import { ExternalLinkIntents } from './auth/external-link-intents.js';
-import { buildSessionCookie, clearSessionCookie, isEmbedRedirectTarget, isSessionGradeJwtPayload, loginRedirectUrl, SESSION_COOKIE, sessionCookieIsSecure, shouldRedirectToLogin, } from './auth/session-cookie.js';
-import { createSessionMinter } from './auth/session-mint.js';
-import { createSsoFinishDeps } from './auth/sso-finish-deps.js';
-import { AppConfirmations } from './auth/app-confirmations.js';
-import { registerAppConfirmRoutes } from './auth/app-confirm-routes.js';
-import { registerAppPasskeyRoutes } from './auth/app-passkey-routes.js';
-import { registerAppRefusedRoute } from './auth/app-refused-route.js';
-import { resolvePasskeyProvider } from './auth/passkey-provider.js';
-import { collectSecondFactors } from './auth/second-factors.js';
-import { registerSsoRoutes } from './auth/sso-routes.js';
-import { UsedBridgeIds } from './auth/used-bridge-ids.js';
-import { NativeLinkCompletions } from './auth/native-link-completions.js';
-import { loadBootstrapConfig, setupInfra } from './boot/boot-config';
-import { loadPlatformKeychainKey } from './boot/platform-keychain-key';
-import { runIntegrationIdBackfill } from './boot/integration-id-backfill';
-import { PostBootService } from './boot/post-boot.service';
-import { dropRetiredHubAddressEnv } from './boot/retired-public-url-env';
-import { AddonPackageService } from './core/addon/addon-package.service';
-import { AddonRegistryService } from './core/addon/addon-registry.service';
-import { AddonBridgeService } from './core/addon-bridge/addon-bridge.service';
-import { AddonPagesService } from './core/addon-pages/addon-pages.service';
-import { AddonWidgetsService, stripBundleVersionSegment, } from './core/addon-widgets/addon-widgets.service';
-import { AgentRegistryService } from './core/agent/agent-registry.service';
-import { buildAppLinkFiles, parseCertFingerprints } from './core/app-links/well-known-app-links';
-import { AuthService } from './core/auth/auth.service';
-import { HandoffCodeService } from './core/auth/handoff-code.service';
-import { ShareTokenService } from './core/auth/share-token.service';
-import { ConfigService } from './core/config/config.service';
-import { EventBusService } from './core/events/event-bus.service';
-import { FeatureService } from './core/feature/feature.service';
-import { LoggingService } from './core/logging/logging.service';
-import { MoleculerService } from './core/moleculer/moleculer.service';
-import { NetworkQualityService } from './core/network/network-quality.service';
-import { ReplEngineService } from './core/repl/repl-engine.service';
-import { ServerUpdateService } from './core/server-update/server-update.service';
-import { StorageService } from './core/storage/storage.service';
-import { StreamProbeService } from './core/streaming/stream-probe.service';
-import { bootManual } from './manual-boot';
-import { runSingleCopyCleanup } from './single-copy-cleanup-runner.js';
+const system_1 = require("@camstack/system");
+const compress_1 = __importDefault(require("@fastify/compress"));
+const cookie_1 = __importDefault(require("@fastify/cookie"));
+const fastify_1 = require("@trpc/server/adapters/fastify");
+const ws_1 = require("@trpc/server/adapters/ws");
+const ws_2 = require("ws");
+const addon_upload_1 = require("./api/addon-upload");
+const auth_whoami_1 = require("./api/auth-whoami");
+const backup_download_js_1 = require("./api/backup-download.js");
+const cap_providers_1 = require("./api/core/cap-providers");
+const logging_settings_1 = require("./api/core/logging-settings");
+const request_census_settings_1 = require("./api/core/request-census-settings");
+const register_cors_policy_1 = require("./api/cors/register-cors-policy");
+const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
+const health_routes_1 = require("./api/health/health.routes");
+const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
+const hub_cluster_url_1 = require("./api/hub-cluster-url");
+const model_distributor_js_1 = require("./api/model-distributor.js");
+const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
+const server_upload_1 = require("./api/server-upload");
+const server_upload_propagate_1 = require("./api/server-upload-propagate");
+const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
+const frame_policy_1 = require("./api/static/frame-policy");
+const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
+const spa_mount_1 = require("./api/static/spa-mount");
+const spa_static_1 = require("./api/static/spa-static");
+const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
+const http_request_census_singleton_1 = require("./api/trpc/http-request-census.singleton");
+const http_request_census_hook_1 = require("./api/trpc/http-request-census-hook");
+const trpc_context_1 = require("./api/trpc/trpc.context");
+const session_connections_js_1 = require("./auth/session-connections.js");
+const trpc_router_1 = require("./api/trpc/trpc.router");
+const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
+const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
+const ws_request_census_1 = require("./api/trpc/ws-request-census");
+const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
+const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
+const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
+const auth_network_policy_js_1 = require("./auth/auth-network-policy.js");
+const hub_sessions_js_1 = require("./auth/hub-sessions.js");
+const session_lifetimes_js_1 = require("./auth/session-lifetimes.js");
+const auth_rate_limit_1 = require("./auth/auth-rate-limit");
+const external_link_intents_js_1 = require("./auth/external-link-intents.js");
+const session_cookie_js_1 = require("./auth/session-cookie.js");
+const session_mint_js_1 = require("./auth/session-mint.js");
+const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
+const app_confirmations_js_1 = require("./auth/app-confirmations.js");
+const app_confirm_routes_js_1 = require("./auth/app-confirm-routes.js");
+const app_passkey_routes_js_1 = require("./auth/app-passkey-routes.js");
+const app_refused_route_js_1 = require("./auth/app-refused-route.js");
+const passkey_provider_js_1 = require("./auth/passkey-provider.js");
+const second_factors_js_1 = require("./auth/second-factors.js");
+const sso_routes_js_1 = require("./auth/sso-routes.js");
+const used_bridge_ids_js_1 = require("./auth/used-bridge-ids.js");
+const native_link_completions_js_1 = require("./auth/native-link-completions.js");
+const boot_config_1 = require("./boot/boot-config");
+const platform_keychain_key_1 = require("./boot/platform-keychain-key");
+const integration_id_backfill_1 = require("./boot/integration-id-backfill");
+const post_boot_service_1 = require("./boot/post-boot.service");
+const retired_public_url_env_1 = require("./boot/retired-public-url-env");
+const addon_package_service_1 = require("./core/addon/addon-package.service");
+const addon_registry_service_1 = require("./core/addon/addon-registry.service");
+const addon_bridge_service_1 = require("./core/addon-bridge/addon-bridge.service");
+const addon_pages_service_1 = require("./core/addon-pages/addon-pages.service");
+const addon_widgets_service_1 = require("./core/addon-widgets/addon-widgets.service");
+const agent_registry_service_1 = require("./core/agent/agent-registry.service");
+const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
+const auth_service_1 = require("./core/auth/auth.service");
+const handoff_code_service_1 = require("./core/auth/handoff-code.service");
+const share_token_service_1 = require("./core/auth/share-token.service");
+const config_service_1 = require("./core/config/config.service");
+const event_bus_service_1 = require("./core/events/event-bus.service");
+const feature_service_1 = require("./core/feature/feature.service");
+const logging_service_1 = require("./core/logging/logging.service");
+const moleculer_service_1 = require("./core/moleculer/moleculer.service");
+const network_quality_service_1 = require("./core/network/network-quality.service");
+const repl_engine_service_1 = require("./core/repl/repl-engine.service");
+const server_update_service_1 = require("./core/server-update/server-update.service");
+const storage_service_1 = require("./core/storage/storage.service");
+const stream_probe_service_1 = require("./core/streaming/stream-probe.service");
+const manual_boot_1 = require("./manual-boot");
+const single_copy_cleanup_runner_js_1 = require("./single-copy-cleanup-runner.js");
 // ---- Process-level error handlers ----
 process.on('uncaughtException', (err) => {
     console.error('[uncaughtException] Unhandled exception — server will continue:', err);
@@ -116,7 +154,7 @@ function immediateChildCleanup(signal) {
     // Every addon-runner leads its OWN process group (D668), so the hub-group kill
     // below no longer reaches runners or their ffmpeg/llama-server children.
     // Signal each runner group first.
-    const runnerGroups = signalAllRunnerGroups('SIGTERM');
+    const runnerGroups = (0, system_1.signalAllRunnerGroups)('SIGTERM');
     // Synchronously kill all children of this process via the OS.
     // This is fast and ensures no orphans even if Fastify shutdown is slow.
     try {
@@ -126,7 +164,7 @@ function immediateChildCleanup(signal) {
         const cmd = isMac
             ? `pkill -TERM -P ${myPid} 2>/dev/null; true`
             : `kill -- -${myPid} 2>/dev/null; true`;
-        execSync(cmd, { timeout: 3000 });
+        (0, node_child_process_1.execSync)(cmd, { timeout: 3000 });
         console.log(`[shutdown] Child processes signalled (runner groups: ${runnerGroups})`);
     }
     catch {
@@ -158,7 +196,7 @@ function cleanupOrphanProcesses() {
         const cmd = isMac
             ? "ps -eo pid,ppid,command | grep -E 'coreml_inference\\.py' | grep -v grep"
             : "ps -eo pid,ppid,cmd | grep -E 'coreml_inference\\.py' | grep -v grep";
-        const output = execSync(cmd, { encoding: 'utf8', timeout: 5000 }).trim();
+        const output = (0, node_child_process_1.execSync)(cmd, { encoding: 'utf8', timeout: 5000 }).trim();
         if (!output)
             return;
         for (const line of output.split('\n')) {
@@ -204,9 +242,9 @@ function cleanupOrphanProcesses() {
  */
 async function sendMaybePrecompressed(reply, absolutePath, acceptEncoding) {
     if (reply.getHeader('content-type') === undefined) {
-        reply.type(contentTypeForPath(absolutePath));
+        reply.type((0, spa_static_1.contentTypeForPath)(absolutePath));
     }
-    const resolved = await resolvePrecompressedAsset(absolutePath, acceptEncoding, (msg, meta) => console.log(`[static] ${msg} ${JSON.stringify(meta)}`));
+    const resolved = await (0, precompressed_asset_js_1.resolvePrecompressedAsset)(absolutePath, acceptEncoding, (msg, meta) => console.log(`[static] ${msg} ${JSON.stringify(meta)}`));
     if (resolved.encoding === 'br') {
         reply.header('content-encoding', 'br');
         reply.header('vary', 'accept-encoding');
@@ -227,10 +265,10 @@ async function bootstrap() {
     // retired address variable is dropped here — before any addon runner is
     // forked, so no child can read it — and warned about once a logger exists
     // (below). See `boot/retired-public-url-env.ts`.
-    const publicUrlWarning = dropRetiredHubAddressEnv(process.env);
+    const publicUrlWarning = (0, retired_public_url_env_1.dropRetiredHubAddressEnv)(process.env);
     // A desktop hub's keychain master key arrives on an inherited pipe (D788).
     // Read and closed before anything is forked, so no runner inherits it.
-    const platformKey = loadPlatformKeychainKey();
+    const platformKey = (0, platform_keychain_key_1.loadPlatformKeychainKey)();
     if (platformKey.kind === 'loaded') {
         console.log(`[keychain] master key provided by the ${platformKey.label}`);
     }
@@ -259,7 +297,7 @@ async function bootstrap() {
     // calls `malloc_trim`, and no V8 flavor reaches it. So the pass is a real bound on the V8
     // share and touches none of the share that grew. It is telemetry plus a partial bound, not a
     // fix — do not read a reclaim line as "the leak was handled".
-    const heapReclaimer = createV8Reclaimer();
+    const heapReclaimer = (0, system_1.createV8Reclaimer)();
     const heapReclaim = heapReclaimer === undefined ? undefined : { reclaim: heapReclaimer };
     // ...and the budget the heartbeat alarms on. hub-main has no manifest to declare one in, and
     // the entrypoint that would be the obvious alternative is the least deployable surface here —
@@ -272,7 +310,7 @@ async function bootstrap() {
     // line for every runner in the cluster and none for the largest process in it. The sink is
     // repointed at `LoggingService` the moment it exists (below), and boot lines keep going to
     // stdout exactly as before. See `createDeferredHeapWatchSink`.
-    const heapWatchSink = createDeferredHeapWatchSink(HUB_MAIN_HEAP_WATCH_LABEL);
+    const heapWatchSink = (0, system_1.createDeferredHeapWatchSink)(system_1.HUB_MAIN_HEAP_WATCH_LABEL);
     // ...and the event planes, which is the OTHER half of what this process is.
     // hub-main's `arrayBuffers` is a rate, not a set: every forced compaction
     // drops it to 12-29MB (ten passes out of ten, 2026-08-29), so the number to
@@ -287,12 +325,12 @@ async function bootstrap() {
     // the reader reports `undefined` and the line carries no fan-out fields at all
     // — a plane that does not exist yet must not be reported as a silent one.
     let moleculerForEventPlane = null;
-    startHeapWatch(HUB_MAIN_HEAP_WATCH_LABEL, heapWatchSink.sink, undefined, heapReclaim, undefined, undefined, true, hubMainRssBudget(), {
-        eventPlane: createEventPlaneReader({
+    (0, system_1.startHeapWatch)(system_1.HUB_MAIN_HEAP_WATCH_LABEL, heapWatchSink.sink, undefined, heapReclaim, undefined, undefined, true, (0, system_1.hubMainRssBudget)(), {
+        eventPlane: (0, system_1.createEventPlaneReader)({
             registry: () => moleculerForEventPlane?.childRegistry ?? null,
             crossNodeStats: () => {
                 const broker = moleculerForEventPlane?.broker;
-                return broker === undefined ? null : getMoleculerEventStats(broker);
+                return broker === undefined ? null : (0, system_1.getMoleculerEventStats)(broker);
             },
         }),
         // The fan-out counters above answered their own question and sharpened
@@ -303,7 +341,7 @@ async function bootstrap() {
         // analytics` computed from a runner whose rchar also counts page-cache
         // reads. These counters live on the channel itself, so the attribution is
         // per peer and per frame kind. Same lazy registry, same reason.
-        socketPlane: createSocketPlaneReader({
+        socketPlane: (0, system_1.createSocketPlaneReader)({
             registry: () => moleculerForEventPlane?.childRegistry ?? null,
         }),
         // The write queue to every peer NODE, from Moleculer's own writer
@@ -311,7 +349,7 @@ async function bootstrap() {
         // exclusion of "every socket queue" — a sum over `_getActiveHandles()` —
         // never saw them. With the UDS queues above, every outbound plane this
         // process writes to is now on the line and judged on every probe (D446).
-        meshQueue: createMeshQueueReader(() => moleculerForEventPlane?.broker ?? null),
+        meshQueue: (0, system_1.createMeshQueueReader)(() => moleculerForEventPlane?.broker ?? null),
         // The ArrayBuffer census, armed by the probe itself. Twice on 2026-09-10
         // this process's `arrayBuffers` climbed linearly for an hour (to 1.3 GB
         // and to 5 GB, both LIVE across a forced compaction) and released in one
@@ -321,7 +359,7 @@ async function bootstrap() {
         // the pause a reclaim pass already costs — walked in memory, nothing
         // written, on a threshold held for a minute, at most twice an hour.
         // It is NOT a heap snapshot; see `array-buffer-census.ts`.
-        arrayBufferCensus: { census: createInspectorArrayBufferCensus() },
+        arrayBufferCensus: { census: (0, system_1.createInspectorArrayBufferCensus)() },
     });
     // Clean up orphaned processes from previous crashes before starting
     cleanupOrphanProcesses();
@@ -335,14 +373,14 @@ async function bootstrap() {
     // path for local/dev runs where neither env var is set.
     const configPath = process.env.CONFIG_PATH ??
         path.join(process.env.CAMSTACK_DATA ?? path.join(process.cwd(), 'camstack-data'), 'config.yaml');
-    const bootstrapConfig = loadBootstrapConfig(configPath);
-    const infra = await setupInfra(configPath, bootstrapConfig);
+    const bootstrapConfig = (0, boot_config_1.loadBootstrapConfig)(configPath);
+    const infra = await (0, boot_config_1.setupInfra)(configPath, bootstrapConfig);
     const { dataPath, tlsOptions, tlsCert } = infra;
     const port = infra.bootstrapConfig.server.port;
     const host = infra.bootstrapConfig.server.host;
     // --- Phase 3: Create app + tRPC register + listen ---
     const fastifyOpts = tlsOptions ? { https: tlsOptions } : {};
-    const app = await bootManual({ infra, fastifyOpts });
+    const app = await (0, manual_boot_1.bootManual)({ infra, fastifyOpts });
     app.enableShutdownHooks();
     const fastify = app.getHttpAdapter().getInstance();
     // Which browser origins may read hub responses, and open the /trpc socket
@@ -350,19 +388,19 @@ async function bootstrap() {
     // `null`, and the operator's `server.corsOrigins`. First hook on the
     // instance so every route — and every OPTIONS — is judged.
     if (publicUrlWarning !== undefined) {
-        app.get(LoggingService).createLogger('public-url').warn(publicUrlWarning);
+        app.get(logging_service_1.LoggingService).createLogger('public-url').warn(publicUrlWarning);
     }
-    const corsConfig = app.get(ConfigService);
-    const corsPolicy = createCorsPolicy({
+    const corsConfig = app.get(config_service_1.ConfigService);
+    const corsPolicy = (0, register_cors_policy_1.createCorsPolicy)({
         configuredOrigins: () => corsConfig.get('server.corsOrigins'),
-        logger: app.get(LoggingService).createLogger('cors'),
+        logger: app.get(logging_service_1.LoggingService).createLogger('cors'),
     });
-    registerCorsPolicy(fastify, corsPolicy);
-    await fastify.register(fastifyCookie);
+    (0, register_cors_policy_1.registerCorsPolicy)(fastify, corsPolicy);
+    await fastify.register(cookie_1.default);
     // Every HTML document the hub serves may be framed by its own origin only
     // (D425). Stamped here, on the one instance, so no shell-send site added
     // later can ship without it.
-    registerFramePolicy(fastify);
+    (0, frame_policy_1.registerFramePolicy)(fastify);
     // Gzip/Brotli compression for all responses (including static JS/CSS).
     // Registered before @fastify/static so the compress plugin wraps the
     // static send path — hashed admin-ui chunks go from ~2MB to ~600KB on
@@ -372,9 +410,9 @@ async function bootstrap() {
     // silently in the compressor buffer — see `api/sse-no-compression.ts` for
     // the mechanism and the live measurement.
     fastify.addHook('onRequest', async (request) => {
-        markSseRequestNoCompression(request);
+        (0, sse_no_compression_js_1.markSseRequestNoCompression)(request);
     });
-    await fastify.register(fastifyCompress, { global: true, threshold: 1024 });
+    await fastify.register(compress_1.default, { global: true, threshold: 1024 });
     // Data-plane POST bodies: the addon reverse-proxy (`proxyToUpstream`) pipes
     // `request.raw` upstream, but Fastify's default application/json parser would
     // drain it first, so a POST body would reach the addon empty. Register a
@@ -383,53 +421,53 @@ async function bootstrap() {
     // the raw stream intact for piping. No effect on JSON API routes.
     fastify.addContentTypeParser('application/octet-stream', (_req, _payload, done) => done(null, undefined));
     // Make LocationManager available to StorageService before lifecycle hooks run
-    const storageService = app.get(StorageService);
+    const storageService = app.get(storage_service_1.StorageService);
     storageService.setLocationManager(infra.locationManager);
     // ConfigService — SettingsStore is wired later by the settings-store capability consumer
-    const config = app.get(ConfigService);
+    const config = app.get(config_service_1.ConfigService);
     // The real client address behind a trusted proxy, and the opt-in trusted
     // networks — read from settings per request (auth-network-policy.ts).
-    const authNetwork = createAuthNetworkPolicy((key) => config.get(key));
+    const authNetwork = (0, auth_network_policy_js_1.createAuthNetworkPolicy)((key) => config.get(key));
     // Public addon routes that declare `rateLimit: 'auth'` (an IdP start /
     // callback) and the SSO finish: 30 per minute per real client address.
-    const authRouteLimiter = createRateLimiter({ windowMs: 60_000, max: 30 });
+    const authRouteLimiter = (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: 30 });
     // Login sessions (local-auth's table, reached through its hub-internal
     // surface): every session token minted from here on carries a `sid`, and
     // every verify of one asks whether that session is still live.
-    const sessionLifetimes = () => readSessionLifetimes((key) => config.get(key));
+    const sessionLifetimes = () => (0, session_lifetimes_js_1.readSessionLifetimes)((key) => config.get(key));
     // Register addon upload route (multipart — must be registered before tRPC).
     // We pass AddonRegistryService so the handler can resolve the
     // `user-management` cap singleton at request time (the only working
     // path to validate `cst_*` scoped tokens — see addon-upload.ts).
     try {
-        const uploadAuthService = app.get(AuthService);
-        const uploadAddonBridge = app.get(AddonBridgeService);
-        const uploadMoleculer = app.get(MoleculerService);
-        const uploadAddonRegistry = app.get(AddonRegistryService);
-        const uploadAddonPackage = app.get(AddonPackageService);
-        const uploadLogger = app.get(LoggingService).createLogger('addon-upload');
+        const uploadAuthService = app.get(auth_service_1.AuthService);
+        const uploadAddonBridge = app.get(addon_bridge_service_1.AddonBridgeService);
+        const uploadMoleculer = app.get(moleculer_service_1.MoleculerService);
+        const uploadAddonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
+        const uploadAddonPackage = app.get(addon_package_service_1.AddonPackageService);
+        const uploadLogger = app.get(logging_service_1.LoggingService).createLogger('addon-upload');
         // The delivery ledger marks "the hub is writing addons to this node" for
         // the whole deploy+reload, so the addon back-fill cannot read the roster
         // gap a deploy opens and repair the node over the bytes just shipped.
-        await registerAddonUploadRoute(fastify, uploadAddonBridge, uploadAuthService, uploadMoleculer, uploadAddonRegistry, uploadAddonPackage, uploadLogger, clusterBaseUrlResolver(() => uploadAddonRegistry
+        await (0, addon_upload_1.registerAddonUploadRoute)(fastify, uploadAddonBridge, uploadAuthService, uploadMoleculer, uploadAddonRegistry, uploadAddonPackage, uploadLogger, (0, hub_cluster_url_1.clusterBaseUrlResolver)(() => uploadAddonRegistry
             .getCapabilityRegistry()
-            .getSingleton('local-network')), app.get(AgentRegistryService).deliveryLedger);
+            .getSingleton('local-network')), app.get(agent_registry_service_1.AgentRegistryService).deliveryLedger);
         console.log('[bootstrap] Addon upload route registered at POST /api/addons/upload');
         // Dev server-deploy channel gateway (`camstack deploy-server`). MUST be
         // registered AFTER registerAddonUploadRoute — it reuses the multipart
         // plugin that route installs on this instance.
-        registerServerUploadRoute(fastify, {
+        (0, server_upload_1.registerServerUploadRoute)(fastify, {
             authService: uploadAuthService,
             addonRegistry: uploadAddonRegistry,
-            logger: app.get(LoggingService).createLogger('server-upload'),
+            logger: app.get(logging_service_1.LoggingService).createLogger('server-upload'),
         });
         console.log('[bootstrap] Server upload route registered at POST /api/server-upload');
-        registerServerUploadPropagateRoute(fastify, {
+        (0, server_upload_propagate_1.registerServerUploadPropagateRoute)(fastify, {
             authService: uploadAuthService,
             addonRegistry: uploadAddonRegistry,
-            logger: app.get(LoggingService).createLogger('server-upload-propagate'),
+            logger: app.get(logging_service_1.LoggingService).createLogger('server-upload-propagate'),
             broker: uploadMoleculer.broker,
-            resolveClusterBaseUrl: clusterBaseUrlResolver(() => uploadAddonRegistry
+            resolveClusterBaseUrl: (0, hub_cluster_url_1.clusterBaseUrlResolver)(() => uploadAddonRegistry
                 .getCapabilityRegistry()
                 .getSingleton('local-network')),
         });
@@ -438,7 +476,7 @@ async function bootstrap() {
         // scoped tokens, returns the resolved identity + scope summary.
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
-        await registerAuthWhoamiRoute(fastify, uploadAuthService, uploadAddonRegistry);
+        await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
         console.log('[bootstrap] Auth whoami route registered at GET /api/auth/whoami');
     }
     catch (err) {
@@ -447,7 +485,7 @@ async function bootstrap() {
     // Register tRPC plugin on Fastify BEFORE listen.
     // If registration fails, start in degraded mode: serve a health warning endpoint.
     // Instantiate new core services
-    const loggingService = app.get(LoggingService);
+    const loggingService = app.get(logging_service_1.LoggingService);
     // The heap heartbeat's handover: from here on hub-main's `[mem]` lines go through the log
     // manager like every runner's do — buffer, console destination, rotated file and Loki — so
     // the one process that mediates every cross-runner call is finally trendable next to the
@@ -478,19 +516,19 @@ async function bootstrap() {
     // interval is `unref`ed, so it cannot hold the process open, and hub-main's
     // shutdown is process exit.
     const stallLogger = loggingService.createLogger('event-loop');
-    startEventLoopStallMonitor(stallLogger);
-    const addonRouteRegistry = new AddonRouteRegistry();
-    const dataPlaneRegistry = new DataPlaneRegistry();
+    (0, system_1.startEventLoopStallMonitor)(stallLogger);
+    const addonRouteRegistry = new system_1.AddonRouteRegistry();
+    const dataPlaneRegistry = new system_1.DataPlaneRegistry();
     // Use Fastify-managed notification/toast wrappers (globally provided by NotificationModule)
-    const { NotificationServiceWrapper } = await import('./core/notification/notification-wrapper.service');
-    const { ToastServiceWrapper } = await import('./core/notification/toast-wrapper.service');
+    const { NotificationServiceWrapper } = await Promise.resolve().then(() => __importStar(require('./core/notification/notification-wrapper.service')));
+    const { ToastServiceWrapper } = await Promise.resolve().then(() => __importStar(require('./core/notification/toast-wrapper.service')));
     const notificationWrapper = app.get(NotificationServiceWrapper);
     const toastWrapper = app.get(ToastServiceWrapper);
     // Expose the underlying core services for the tRPC router
     const notificationService = notificationWrapper.service;
     const toastService = toastWrapper.service;
     // Wire AddonRouteRegistry and NotificationService
-    const addonRegistry = app.get(AddonRegistryService);
+    const addonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
     addonRegistry.setAddonRouteRegistry(addonRouteRegistry);
     addonRegistry.setDataPlaneRegistry(dataPlaneRegistry);
     // ── Configure the CapabilityRegistry (created in AddonRegistryService constructor) ──
@@ -501,7 +539,7 @@ async function bootstrap() {
         hubInstalledVersion: (name) => {
             try {
                 return (app
-                    .get(AddonPackageService)
+                    .get(addon_package_service_1.AddonPackageService)
                     .listInstalled()
                     .find((p) => p.name === name)?.version ?? null);
             }
@@ -511,7 +549,7 @@ async function bootstrap() {
         },
         audit: async (event) => {
             try {
-                const internal = getUserManagementInternal(capabilityRegistry.getSingleton('user-management'));
+                const internal = (0, system_1.getUserManagementInternal)(capabilityRegistry.getSingleton('user-management'));
                 if (internal === null) {
                     console.warn('[bootstrap] agent addon update not audited: no user-management internal');
                     return;
@@ -523,17 +561,17 @@ async function bootstrap() {
             }
         },
     });
-    const sessionBacking = sessionBackingFrom(capabilityRegistry, sessionLifetimes);
+    const sessionBacking = (0, hub_sessions_js_1.sessionBackingFrom)(capabilityRegistry, sessionLifetimes);
     // From here on every verify of a session-grade token — tRPC, addon routes,
     // the session cookie, OAuth authorize, uploads, health — requires its
     // session to be live (`hub-sessions.ts`).
-    app.get(AuthService).setSessionCheck(createSessionTokenCheck(capabilityRegistry));
+    app.get(auth_service_1.AuthService).setSessionCheck((0, hub_sessions_js_1.createSessionTokenCheck)(capabilityRegistry));
     // Declare every shipped capability BEFORE app.init() so addon
     // registerProvider() calls (in-process or via the Moleculer bridge
     // from forked workers / agents) find their definition during
     // onModuleInit. The list comes from the codegen — see the import
     // comment above for the rationale.
-    for (const capDef of ALL_CAPABILITY_DEFINITIONS) {
+    for (const capDef of system_1.ALL_CAPABILITY_DEFINITIONS) {
         capabilityRegistry.declareCapability(capDef);
     }
     // Hub-internal `sso-bridge` provider — gives auth-provider addons
@@ -541,7 +579,7 @@ async function bootstrap() {
     // bridge token before redirecting to `/api/auth/sso/finish`. Without
     // this, the finish endpoint would have to trust unsigned query params
     // (anyone could craft `?isAdmin=1`). Backed by AuthService.
-    const authServiceForBridge = app.get(AuthService);
+    const authServiceForBridge = app.get(auth_service_1.AuthService);
     capabilityRegistry.registerProvider('sso-bridge', '$hub', {
         signBridgeToken: async ({ claims, ttlSec, }) => {
             const token = authServiceForBridge.signSsoBridgeToken(claims, ttlSec ?? 300);
@@ -560,39 +598,39 @@ async function bootstrap() {
     // Share-view (`csv_*`) tokens — hub-resident mint/verify/revoke over the
     // settings backend (lazy getter: the backend lands after the sqlite-storage
     // builtin registers; the service resolves it per call).
-    const shareTokenService = new ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
+    const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
     addonRegistry.setShareTokenService(shareTokenService);
     // One-time native-app login handoff codes (in-memory, 60s TTL, single-use) —
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.
-    const handoffCodeService = new HandoffCodeService();
+    const handoffCodeService = new handoff_code_service_1.HandoffCodeService();
     // Pending "link this sign-in account" intents (D782) — minted by
     // `auth.beginExternalLink`, consumed once by `/api/auth/sso/finish`.
-    const externalLinkIntents = new ExternalLinkIntents();
+    const externalLinkIntents = new external_link_intents_js_1.ExternalLinkIntents();
     // Native-app links parked for the app to claim, and one-time codes that
     // open the account page signed in, in a browser (D801).
-    const nativeLinkCompletions = new NativeLinkCompletions();
+    const nativeLinkCompletions = new native_link_completions_js_1.NativeLinkCompletions();
     // `jti`s of login bridges already finished — a bridge is single-use.
-    const usedBridgeIds = new UsedBridgeIds();
-    const browserHandoffCodes = new HandoffCodeService();
+    const usedBridgeIds = new used_bridge_ids_js_1.UsedBridgeIds();
+    const browserHandoffCodes = new handoff_code_service_1.HandoffCodeService();
     // Parked "sign the app in?" confirmations of the two native app flows (D858).
-    const appConfirmations = new AppConfirmations();
-    const nativeLinkMinter = createSessionMinter({
-        signer: app.get(AuthService),
+    const appConfirmations = new app_confirmations_js_1.AppConfirmations();
+    const nativeLinkMinter = (0, session_mint_js_1.createSessionMinter)({
+        signer: app.get(auth_service_1.AuthService),
         directory: () => capabilityRegistry.getSingleton('user-management'),
         sessions: sessionBacking,
     });
     const nativeLinkWiring = () => ({
-        auth: app.get(AuthService),
+        auth: app.get(auth_service_1.AuthService),
         registry: capabilityRegistry,
-        moleculer: app.get(MoleculerService),
+        moleculer: app.get(moleculer_service_1.MoleculerService),
         minter: nativeLinkMinter,
         linkIntents: externalLinkIntents,
         nativeLinks: nativeLinkCompletions,
         usedBridgeIds,
     });
-    const buildRouter = () => buildAppRouter({
-        authService: app.get(AuthService),
+    const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
+        authService: app.get(auth_service_1.AuthService),
         shareTokenService,
         handoffCodeService,
         externalLinkIntents,
@@ -601,26 +639,26 @@ async function bootstrap() {
             browserHandoffs: browserHandoffCodes,
             // The SSO finish's own link step — the same conflict rule, the same
             // store — run for the app's claim instead of the browser's return.
-            link: (input) => createSsoFinishDeps(nativeLinkWiring(), undefined).identities.link(input),
+            link: (input) => (0, sso_finish_deps_js_1.createSsoFinishDeps)(nativeLinkWiring(), undefined).identities.link(input),
         },
         configService: config,
         authNetworkPolicy: authNetwork,
         sessionBacking,
-        featureService: app.get(FeatureService),
+        featureService: app.get(feature_service_1.FeatureService),
         loggingService,
-        eventBus: app.get(EventBusService),
-        agentRegistry: app.get(AgentRegistryService),
-        moleculer: app.get(MoleculerService),
+        eventBus: app.get(event_bus_service_1.EventBusService),
+        agentRegistry: app.get(agent_registry_service_1.AgentRegistryService),
+        moleculer: app.get(moleculer_service_1.MoleculerService),
         addonRegistry,
-        replEngine: app.get(ReplEngineService),
-        networkQualityService: app.get(NetworkQualityService),
-        addonBridge: app.get(AddonBridgeService),
-        addonPackageService: app.get(AddonPackageService),
+        replEngine: app.get(repl_engine_service_1.ReplEngineService),
+        networkQualityService: app.get(network_quality_service_1.NetworkQualityService),
+        addonBridge: app.get(addon_bridge_service_1.AddonBridgeService),
+        addonPackageService: app.get(addon_package_service_1.AddonPackageService),
         notificationService,
         toastService,
         capabilityRegistry,
-        streamProbe: app.get(StreamProbeService),
-        serverUpdateService: app.get(ServerUpdateService),
+        streamProbe: app.get(stream_probe_service_1.StreamProbeService),
+        serverUpdateService: app.get(server_update_service_1.ServerUpdateService),
     });
     // ── The core-cap mesh bridge, mounted BEFORE a single addon boots (D171) ──
     //
@@ -645,9 +683,9 @@ async function bootstrap() {
             try {
                 appRouter = buildRouter();
                 {
-                    const meshBroker = app.get(MoleculerService);
+                    const meshBroker = app.get(moleculer_service_1.MoleculerService);
                     // D802: another node's call runs as `node:<id>`, never the hub's own principal.
-                    meshBroker.registerCoreCapService(buildCoreCapService(appRouter, undefined, {
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, {
                         ownNodeId: meshBroker.nodeId,
                         remoteUpdateGrant: remoteUpdateGrantDeps(),
                     }));
@@ -667,7 +705,7 @@ async function bootstrap() {
     capabilityRegistry.ready();
     // Register log-receiver service for agent log forwarding (after app.init
     // so Moleculer re-advertises the service list to the network)
-    const moleculer = app.get(MoleculerService);
+    const moleculer = app.get(moleculer_service_1.MoleculerService);
     // Hand the heartbeat its event-plane sources. The reader holds this by
     // closure and re-reads `childRegistry` / `broker` on every line, so a registry
     // that is rebuilt later is picked up without re-wiring anything.
@@ -679,26 +717,26 @@ async function bootstrap() {
     // router) so forked addons (addon-model-studio) can reach it via `ctx.api`,
     // not only external HTTP clients. Needs the broker + the deploy-stage
     // registry, which an addon can't access.
-    capabilityRegistry.registerProvider('model-distributor', '$hub', buildModelDistributorProvider(moleculer, loggingService, clusterBaseUrlResolver(() => capabilityRegistry.getSingleton('local-network'))));
+    capabilityRegistry.registerProvider('model-distributor', '$hub', (0, model_distributor_js_1.buildModelDistributorProvider)(moleculer, loggingService, (0, hub_cluster_url_1.clusterBaseUrlResolver)(() => capabilityRegistry.getSingleton('local-network'))));
     // ── Health routes (hub self + agent forwarding) ──────────────────
     // Registered after app.init() so the AgentRegistryService is wired and
     // the Moleculer broker is ready to forward `$agent.health` calls.
     try {
         const hubVersion = readHubVersion();
-        registerHealthRoutes(fastify, {
+        (0, health_routes_1.registerHealthRoutes)(fastify, {
             moleculer,
-            agentRegistry: app.get(AgentRegistryService),
+            agentRegistry: app.get(agent_registry_service_1.AgentRegistryService),
             hubVersion,
             // Read the live flag at request time — flips to true once the tRPC
             // router finishes registering (see `trpcRegistered = true` below).
             isReady: () => trpcRegistered,
-            verifyToken: (token) => app.get(AuthService).verifyToken(token),
-            runnerBootCheck: () => app.get(RunnerBootCheckService).current(),
+            verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
+            runnerBootCheck: () => app.get(runner_boot_check_1.RunnerBootCheckService).current(),
         });
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
-        registerAdaptiveProbeRoute(fastify, {
-            verifyToken: (token) => app.get(AuthService).verifyToken(token),
-            limiter: createRateLimiter({ windowMs: 60_000, max: ADAPTIVE_PROBE_PER_IP_PER_MINUTE }),
+        (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify, {
+            verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
+            limiter: (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE }),
             network: authNetwork,
         });
     }
@@ -731,12 +769,12 @@ async function bootstrap() {
     // this boot unless `restore()` (below, just before `listen`) finds a window
     // an operator armed earlier. The logger is attached now so a restored census
     // has somewhere to report before the first request arrives.
-    const httpRequestCensus = getHttpRequestCensus();
+    const httpRequestCensus = (0, http_request_census_singleton_1.getHttpRequestCensus)();
     const trpcLogger = loggingService.createLogger('tRPC');
     httpRequestCensus.setLogger(trpcLogger);
-    setRemotePrivilegeLogSink(trpcLogger);
+    (0, core_cap_bridge_1.setRemotePrivilegeLogSink)(trpcLogger);
     try {
-        const authService = app.get(AuthService);
+        const authService = app.get(auth_service_1.AuthService);
         // Normally already built and bridged onto the mesh in `beforeAddonBoot`
         // above — this is the fallback for the case where that failed, so a hub
         // whose mesh bridge could not be mounted still serves HTTP.
@@ -744,9 +782,9 @@ async function bootstrap() {
             appRouter = buildRouter();
             try {
                 {
-                    const meshBroker = app.get(MoleculerService);
+                    const meshBroker = app.get(moleculer_service_1.MoleculerService);
                     // D802: another node's call runs as `node:<id>`, never the hub's own principal.
-                    meshBroker.registerCoreCapService(buildCoreCapService(appRouter, undefined, {
+                    meshBroker.registerCoreCapService((0, core_cap_bridge_1.buildCoreCapService)(appRouter, undefined, {
                         ownNodeId: meshBroker.nodeId,
                         remoteUpdateGrant: remoteUpdateGrantDeps(),
                     }));
@@ -757,30 +795,30 @@ async function bootstrap() {
                 console.warn('[bootstrap] Failed to register core-cap mesh bridge:', err);
             }
         }
-        await fastify.register(fastifyTRPCPlugin, {
+        await fastify.register(fastify_1.fastifyTRPCPlugin, {
             prefix: '/trpc',
             trpcOptions: {
                 router: appRouter,
                 createContext: async ({ req }) => {
-                    const trpcCtx = await createTrpcContext(req, authService, addonRegistry, shareTokenService, 
+                    const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
                     // A bearer refused for NOT being an API credential never reaches a
                     // procedure, so `onError` below never sees it — the refusal would
                     // be silent without this. Same reason `gateAddonJwt` logs (D103).
-                    app.get(LoggingService).createLogger('tRPC'));
+                    app.get(logging_service_1.LoggingService).createLogger('tRPC'));
                     // WHO called, counted here because this is the first point at which
                     // a principal exists AND the only one tRPC runs exactly once per
                     // HTTP request (batched or not). Disarmed this is a boolean read and
                     // a return — see `http-request-census-hook.ts`.
-                    recordTrpcHttpRequest(httpRequestCensus, req, trpcCtx.user);
+                    (0, http_request_census_hook_1.recordTrpcHttpRequest)(httpRequestCensus, req, trpcCtx.user);
                     return trpcCtx;
                 },
                 onError: ({ path: trpcPath, error, ctx, input, }) => {
-                    const trpcLogger = app.get(LoggingService).createLogger('tRPC');
+                    const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC');
                     trpcLogger.warn('tRPC error', {
                         // WHICH camera. A refusal on a device-scoped path that names no
                         // deviceId cannot answer "one camera or all of them?" — the
                         // question always asked first (2026-08-29, `intercom.startSession`).
-                        tags: trpcErrorDeviceTags(trpcPath, input),
+                        tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
                         meta: {
                             code: error.code,
                             path: trpcPath ?? '?',
@@ -788,7 +826,7 @@ async function bootstrap() {
                             // to the integration that hit it, and an operator grepping for
                             // the integration finds nothing — which reads as "the hub logged
                             // nothing" (2026-08-09).
-                            principal: describeTrpcPrincipal(ctx?.user),
+                            principal: (0, trpc_error_principal_1.describeTrpcPrincipal)(ctx?.user),
                             message: error.message,
                         },
                     });
@@ -803,7 +841,7 @@ async function bootstrap() {
         });
         trpcRegistered = true;
         // Register addon-pages static file endpoint
-        const addonPagesService = app.get(AddonPagesService);
+        const addonPagesService = app.get(addon_pages_service_1.AddonPagesService);
         fastify.get('/api/addon-pages/:addonId/*', async (request, reply) => {
             const { addonId } = request.params;
             const filePath = request.params['*'];
@@ -826,7 +864,7 @@ async function bootstrap() {
                             : 'application/octet-stream';
             const stream = fs.createReadStream(resolved);
             return reply
-                .header('cache-control', addonBundleCacheControl(resolved))
+                .header('cache-control', (0, spa_static_1.addonBundleCacheControl)(resolved))
                 .type(contentType)
                 .send(stream);
         });
@@ -835,7 +873,7 @@ async function bootstrap() {
         // `dist/widgets.mjs` (declared per-widget in `addon-widgets-source`
         // metadata). Path-traversal protection + cap-registration check
         // both live in `AddonWidgetsService.resolveBundle`.
-        const addonWidgetsService = app.get(AddonWidgetsService);
+        const addonWidgetsService = app.get(addon_widgets_service_1.AddonWidgetsService);
         fastify.get('/api/addon-widgets/:addonId/*', async (request, reply) => {
             const { addonId } = request.params;
             const filePath = request.params['*'];
@@ -861,10 +899,10 @@ async function bootstrap() {
             // fixed-name `_stub.js`/`remoteEntry.js` — is safely immutable (this
             // defeats a CDN edge serving a stale stub). Legacy unversioned requests
             // keep the per-file revalidation policy.
-            const { versioned } = stripBundleVersionSegment(filePath);
+            const { versioned } = (0, addon_widgets_service_1.stripBundleVersionSegment)(filePath);
             const cacheControl = versioned
                 ? 'public, max-age=31536000, immutable'
-                : addonBundleCacheControl(resolved);
+                : (0, spa_static_1.addonBundleCacheControl)(resolved);
             const stream = fs.createReadStream(resolved);
             return reply.header('cache-control', cacheControl).type(contentType).send(stream);
         });
@@ -905,16 +943,16 @@ async function bootstrap() {
         // bridge bound to the browser that started it; the session is minted by
         // THE session mint from the user record as it is now (D712). Rules in
         // `auth/sso-finish.ts`, routes in `auth/sso-routes.ts`.
-        const ssoMinter = createSessionMinter({
-            signer: app.get(AuthService),
+        const ssoMinter = (0, session_mint_js_1.createSessionMinter)({
+            signer: app.get(auth_service_1.AuthService),
             directory: () => capabilityRegistry.getSingleton('user-management'),
             sessions: sessionBacking,
         });
-        registerSsoRoutes(fastify, {
+        (0, sso_routes_js_1.registerSsoRoutes)(fastify, {
             wiring: {
-                auth: app.get(AuthService),
+                auth: app.get(auth_service_1.AuthService),
                 registry: capabilityRegistry,
-                moleculer: app.get(MoleculerService),
+                moleculer: app.get(moleculer_service_1.MoleculerService),
                 minter: ssoMinter,
                 linkIntents: externalLinkIntents,
                 nativeLinks: nativeLinkCompletions,
@@ -925,46 +963,46 @@ async function bootstrap() {
             browserHandoffCodes,
             confirmations: appConfirmations,
             minter: ssoMinter,
-            logger: app.get(LoggingService).createLogger('sso-finish'),
+            logger: app.get(logging_service_1.LoggingService).createLogger('sso-finish'),
         });
         // ── Passkey sign-in for the native app (D858) ───────────────────
         // A standalone page + two same-origin legs; the assertion ends in a handoff
         // code at the app's custom scheme, never in a web session.
-        registerAppPasskeyRoutes(fastify, {
-            passkeys: () => resolvePasskeyProvider(capabilityRegistry, app.get(MoleculerService)),
+        (0, app_passkey_routes_js_1.registerAppPasskeyRoutes)(fastify, {
+            passkeys: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(capabilityRegistry, app.get(moleculer_service_1.MoleculerService)),
             secondFactors: (userId) => {
                 const um = capabilityRegistry.getSingleton('user-management');
-                return collectSecondFactors({
+                return (0, second_factors_js_1.collectSecondFactors)({
                     ...(um && typeof um.getTotpStatus === 'function'
                         ? { getTotpStatus: (input) => um.getTotpStatus(input) }
                         : {}),
-                    passkeyProvider: () => resolvePasskeyProvider(capabilityRegistry, app.get(MoleculerService)),
+                    passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(capabilityRegistry, app.get(moleculer_service_1.MoleculerService)),
                 }, userId, 'passkey');
             },
             minter: ssoMinter,
             confirmations: appConfirmations,
             network: authNetwork,
             limiter: authRouteLimiter,
-            logger: app.get(LoggingService).createLogger('app-passkey'),
+            logger: app.get(logging_service_1.LoggingService).createLogger('app-passkey'),
         });
-        registerAppRefusedRoute(fastify);
+        (0, app_refused_route_js_1.registerAppRefusedRoute)(fastify);
         // The last step of both app flows: "Sign in the app as <user>?" - the
         // handoff code is minted only when the person presses Continue (D858).
-        registerAppConfirmRoutes(fastify, {
+        (0, app_confirm_routes_js_1.registerAppConfirmRoutes)(fastify, {
             confirmations: appConfirmations,
             handoffCodes: handoffCodeService,
             network: authNetwork,
             limiter: authRouteLimiter,
-            logger: app.get(LoggingService).createLogger('app-confirm'),
+            logger: app.get(logging_service_1.LoggingService).createLogger('app-confirm'),
         });
         // ── Backup archive download ─────────────────────────────────────
         // Streams an archive through the storage cap's chunked-download
         // protocol at the pace the client reads it (D447). The route, its
         // auth chain and the drain-respecting pump live in `api/backup-download*`.
-        registerBackupDownloadRoute(fastify, {
-            verifier: app.get(AuthService),
+        (0, backup_download_js_1.registerBackupDownloadRoute)(fastify, {
+            verifier: app.get(auth_service_1.AuthService),
             capabilities: capabilityRegistry,
-            logger: app.get(LoggingService).createLogger('backup-download'),
+            logger: app.get(logging_service_1.LoggingService).createLogger('backup-download'),
         });
         // POST /api/auth/session — upgrade a tRPC-issued JWT to a browser cookie.
         fastify.post('/api/auth/session', async (request, reply) => {
@@ -978,7 +1016,7 @@ async function bootstrap() {
                 // e.g. the totp-challenge from login leg 1) verify under the same
                 // secret — accepting one here handed out a cookie that bypassed
                 // the second factor on every cookie-gated surface.
-                if (!isSessionGradeJwtPayload(payload)) {
+                if (!(0, session_cookie_js_1.isSessionGradeJwtPayload)(payload)) {
                     return reply.status(401).send({ error: 'invalid token' });
                 }
                 const expSec = typeof payload.exp === 'number' ? payload.exp : 0;
@@ -987,16 +1025,16 @@ async function bootstrap() {
             catch {
                 return reply.status(401).send({ error: 'invalid token' });
             }
-            const c = buildSessionCookie(token, ttlSec, {
-                secure: sessionCookieIsSecure(request.protocol, request.headers, FORWARDED_PREFIX_HEADER),
+            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
+                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
             });
             reply.setCookie(c.name, c.value, c.options);
             return reply.send({ ok: true });
         });
         // DELETE /api/auth/session — clear the cookie on logout.
         fastify.delete('/api/auth/session', async (request, reply) => {
-            const c = clearSessionCookie({
-                secure: sessionCookieIsSecure(request.protocol, request.headers, FORWARDED_PREFIX_HEADER),
+            const c = (0, session_cookie_js_1.clearSessionCookie)({
+                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
             });
             reply.setCookie(c.name, c.value, c.options);
             return reply.send({ ok: true });
@@ -1016,7 +1054,7 @@ async function bootstrap() {
             if (!token)
                 return reply.status(401).send({ error: 'Bearer token required' });
             const next = request.query?.next ?? '';
-            if (!isEmbedRedirectTarget(next))
+            if (!(0, session_cookie_js_1.isEmbedRedirectTarget)(next))
                 return reply.status(400).send({ error: 'invalid next' });
             let ttlSec;
             try {
@@ -1027,8 +1065,8 @@ async function bootstrap() {
             catch {
                 return reply.status(401).send({ error: 'invalid token' });
             }
-            const c = buildSessionCookie(token, ttlSec, {
-                secure: sessionCookieIsSecure(request.protocol, request.headers, FORWARDED_PREFIX_HEADER),
+            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
+                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
             });
             reply.setCookie(c.name, c.value, c.options);
             return reply.redirect(next);
@@ -1036,7 +1074,7 @@ async function bootstrap() {
         // Every refusal on the addon gate is a request an operator will be asking
         // about ("why did Home Assistant stop actuating?"). Its own scope so the
         // reason is greppable rather than buried in the bootstrap logger.
-        const addonGateLogger = app.get(LoggingService).createLogger('addon-route-auth');
+        const addonGateLogger = app.get(logging_service_1.LoggingService).createLogger('addon-route-auth');
         // Addon HTTP API route catch-all: /addon/:addonId/*
         // Only handles non-GET or routes that actually exist in the addon route registry.
         // GET requests that don't match an addon route are SPA pages — handled by the /* fallback.
@@ -1070,7 +1108,7 @@ async function bootstrap() {
                 let shareHeaders = null;
                 if (access !== 'public') {
                     const authHeader = request.headers.authorization;
-                    const cookieToken = request.cookies?.[SESSION_COOKIE];
+                    const cookieToken = request.cookies?.[session_cookie_js_1.SESSION_COOKIE];
                     if (!authHeader && !cookieToken) {
                         return reply.status(401).send({ error: 'Unauthorized' });
                     }
@@ -1081,7 +1119,7 @@ async function bootstrap() {
                         // HUB sets — whatever the client sent under those names is dropped
                         // (see `addon-route-share-gate.ts`).
                         const record = await shareTokenService.validate(token);
-                        const gate = gateAddonShareToken({ record, endpoint: dpMatch.endpoint });
+                        const gate = (0, addon_route_share_gate_js_1.gateAddonShareToken)({ record, endpoint: dpMatch.endpoint });
                         if (!gate.ok)
                             return reply.status(gate.status).send({ error: gate.error });
                         shareHeaders = gate.headers;
@@ -1104,7 +1142,7 @@ async function bootstrap() {
                         catch {
                             return reply.status(401).send({ error: 'Invalid token' });
                         }
-                        const gate = gateAddonJwt({ payload, addonId, method, access }, addonGateLogger);
+                        const gate = (0, addon_route_jwt_gate_js_1.gateAddonJwt)({ payload, addonId, method, access }, addonGateLogger);
                         if (!gate.ok) {
                             return reply.status(gate.status).send({ error: gate.error });
                         }
@@ -1119,8 +1157,8 @@ async function bootstrap() {
                 // The share headers are the HUB's to write: drop whatever the client
                 // sent under those names, then set the validated scope, if any.
                 for (const name of Object.keys(request.raw.headers)) {
-                    if (name.toLowerCase() === SHARE_KIND_HEADER ||
-                        name.toLowerCase() === SHARE_DEVICES_HEADER)
+                    if (name.toLowerCase() === addon_route_share_gate_js_1.SHARE_KIND_HEADER ||
+                        name.toLowerCase() === addon_route_share_gate_js_1.SHARE_DEVICES_HEADER)
                         delete request.raw.headers[name];
                 }
                 if (shareHeaders !== null)
@@ -1132,7 +1170,7 @@ async function bootstrap() {
                     : Buffer.isBuffer(request.body)
                         ? request.body
                         : Buffer.from(typeof request.body === 'string' ? request.body : JSON.stringify(request.body));
-                proxyToUpstream({
+                (0, system_1.proxyToUpstream)({
                     baseUrl: dpMatch.endpoint.baseUrl,
                     secret: dpMatch.endpoint.secret,
                     upstreamPath,
@@ -1144,7 +1182,7 @@ async function bootstrap() {
             }
             const match = addonRouteRegistry.matchRoute(method, fullPath);
             if (!match) {
-                if (isRetiredPublicPath(fullPath)) {
+                if ((0, spa_static_1.isRetiredPublicPath)(fullPath)) {
                     return reply.status(404).send({ error: 'Not found' });
                 }
                 if (method === 'GET' && spaIndexHtml) {
@@ -1153,14 +1191,14 @@ async function bootstrap() {
                     // send used to carry no cache header at all, so browsers kept the
                     // index.html of a previous build (and its dead hashed asset names)
                     // across deploys until a force refresh.
-                    return sendSpaShell(reply, spaIndexHtml, request.headers);
+                    return (0, spa_mount_1.sendSpaShell)(reply, spaIndexHtml, request.headers);
                 }
                 return reply.status(404).send({ error: 'Not found' });
             }
             // A route that asked for it (an IdP start / callback) is limited per
             // REAL client address before its handler runs.
             if (match.route.rateLimit === 'auth') {
-                const routeClient = clientKeyFromRequest(request, authNetwork);
+                const routeClient = (0, auth_rate_limit_1.clientKeyFromRequest)(request, authNetwork);
                 if (routeClient !== null) {
                     const verdict = authRouteLimiter.check(`route:${addonId}:${routeClient}`);
                     if (!verdict.allowed) {
@@ -1174,11 +1212,11 @@ async function bootstrap() {
                 const authHeader = request.headers.authorization;
                 // Browser navigation has no Authorization header — fall back to the
                 // session cookie, and if that is missing bounce to the login page.
-                const cookieToken = request.cookies?.[SESSION_COOKIE];
+                const cookieToken = request.cookies?.[session_cookie_js_1.SESSION_COOKIE];
                 if (!authHeader && !cookieToken) {
-                    if (shouldRedirectToLogin(request.method, request.headers.accept)) {
+                    if ((0, session_cookie_js_1.shouldRedirectToLogin)(request.method, request.headers.accept)) {
                         const qs = request.url.includes('?') ? request.url.slice(request.url.indexOf('?')) : '';
-                        return reply.redirect(loginRedirectUrl(fullPath + qs, parseForwardedPrefix(request.headers['x-forwarded-prefix'])));
+                        return reply.redirect((0, session_cookie_js_1.loginRedirectUrl)(fullPath + qs, (0, spa_mount_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix'])));
                     }
                     return reply.status(401).send({ error: 'Unauthorized' });
                 }
@@ -1226,7 +1264,7 @@ async function bootstrap() {
                     }
                     // NOTE: the handler call used to sit INSIDE this try, so a throw from
                     // an addon's own route handler was reported as `401 Invalid token`.
-                    const gate = gateAddonJwt({ payload, addonId, method, access: match.route.access }, addonGateLogger);
+                    const gate = (0, addon_route_jwt_gate_js_1.gateAddonJwt)({ payload, addonId, method, access: match.route.access }, addonGateLogger);
                     if (!gate.ok) {
                         return reply.status(gate.status).send({ error: gate.error });
                     }
@@ -1260,17 +1298,17 @@ async function bootstrap() {
         // namespace already excluded from the SPA catch-all everywhere.
         // getRegistry is a closure so it always resolves the live registry at
         // request time (safe even if called before ready()).
-        registerOauth2Routes(fastify, {
+        (0, oauth2_routes_js_1.registerOauth2Routes)(fastify, {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
             // The hub's public endpoint from the `local-network` cap (the flagged
             // address, else tunnel, then mesh, then LAN). `localhost` only when the
             // palette names nothing — the dev case, where it is the truth.
-            publicHubUrl: () => resolveHubBaseUrl(() => capabilityRegistry.getSingleton('local-network'), 'publicEndpoint').catch(() => `https://localhost:${port}`),
+            publicHubUrl: () => (0, hub_cluster_url_1.resolveHubBaseUrl)(() => capabilityRegistry.getSingleton('local-network'), 'publicEndpoint').catch(() => `https://localhost:${port}`),
             // Every /authorize refusal is a dropped account-linking attempt. Without
             // this scope the drop is invisible in Loki and the only signal left is an
             // operator noticing that linking stopped working.
-            logger: app.get(LoggingService).createLogger('oauth2'),
+            logger: app.get(logging_service_1.LoggingService).createLogger('oauth2'),
         });
         console.log('[bootstrap] OAuth2 routes registered at /api/oauth2/*');
         // Attach tRPC WebSocket handler using noServer mode to avoid
@@ -1290,7 +1328,7 @@ async function bootstrap() {
         // per viewer is exactly the kind of growth that is invisible until it is
         // not. `threshold` leaves small frames (subscription ticks) alone, where
         // framing overhead would exceed the saving.
-        const wss = new WebSocketServer({
+        const wss = new ws_2.WebSocketServer({
             noServer: true,
             perMessageDeflate: {
                 threshold: 1024,
@@ -1315,19 +1353,19 @@ async function bootstrap() {
         // in the background, JS suspended, TCP open) queued 88 MB of JSON strings
         // in hub-main's old_space with no bound and no line. See
         // `ws-slow-consumer-guard.ts` for the policy and the alternatives it beat.
-        const wsSlowConsumerGuard = new WsSlowConsumerGuard({
-            logger: app.get(LoggingService).createLogger('tRPC:ws'),
+        const wsSlowConsumerGuard = new ws_slow_consumer_guard_js_1.WsSlowConsumerGuard({
+            logger: app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'),
         });
         wsSlowConsumerGuard.start();
         wss.on('connection', (client, req) => {
-            attachWsCensusSession(httpRequestCensus, client, req, app.get(LoggingService).createLogger('tRPC:ws'));
-            wsSlowConsumerGuard.attach(client, wsConnectionFacts(req));
+            (0, ws_request_census_1.attachWsCensusSession)(httpRequestCensus, client, req, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
+            wsSlowConsumerGuard.attach(client, (0, ws_slow_consumer_guard_js_1.wsConnectionFacts)(req));
         });
         // Revoking a login session ends what it holds: its sockets (close 4401
         // `session-ended`) and its live media. See `auth/session-connections.ts`.
-        const sessionConnections = getSessionConnections();
-        sessionConnections.setLogger(app.get(LoggingService).createLogger('session-revocation'));
-        onSessionsRevoked((event) => {
+        const sessionConnections = (0, session_connections_js_1.getSessionConnections)();
+        sessionConnections.setLogger(app.get(logging_service_1.LoggingService).createLogger('session-revocation'));
+        (0, system_1.onSessionsRevoked)((event) => {
             sessionConnections.endSessions({
                 sessionIds: event.sessionIds,
                 userId: event.userId,
@@ -1336,7 +1374,7 @@ async function bootstrap() {
                 reason: event.reason,
             });
         });
-        applyWSSHandler({
+        (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
             // The complement of the bound above, for the SUSPENDED client: a PING is
@@ -1349,22 +1387,22 @@ async function bootstrap() {
             // A termination here closes with 1006; the guard's close line names it.
             keepAlive: { enabled: true, pingMs: 30_000, pongWaitMs: 10_000 },
             createContext: async (opts) => {
-                const wsCtx = await createWsTrpcContext(opts, authService, addonRegistry, shareTokenService, app.get(LoggingService).createLogger('tRPC:ws'));
+                const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
                 // The connection's identity, derived ONCE and reused for every
                 // operation on this socket. Frames that arrived while the bearer was
                 // still resolving are held by the session and released here.
-                const principal = describeTrpcPrincipal(wsCtx.user);
-                identifyWsCensusSession(opts.res, principal);
+                const principal = (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user);
+                (0, ws_request_census_1.identifyWsCensusSession)(opts.res, principal);
                 wsSlowConsumerGuard.identify(opts.res, principal);
-                const connectionLogger = app.get(LoggingService).createLogger('tRPC:ws');
+                const connectionLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
                 if (wsCtx.credentialRejected === true) {
                     // A bearer that resolves to nobody (revoked, expired): say so with
                     // the close code the client recognises, instead of leaving an
                     // anonymous socket open for the client to poll.
                     connectionLogger.info('Closing a socket whose credential was refused', {
-                        meta: { principal, code: SESSION_ENDED_CLOSE_CODE },
+                        meta: { principal, code: session_connections_js_1.SESSION_ENDED_CLOSE_CODE },
                     });
-                    opts.res.close(SESSION_ENDED_CLOSE_CODE, SESSION_ENDED_CLOSE_REASON);
+                    opts.res.close(session_connections_js_1.SESSION_ENDED_CLOSE_CODE, session_connections_js_1.SESSION_ENDED_CLOSE_REASON);
                 }
                 else if (wsCtx.user !== null) {
                     const untrack = sessionConnections.trackSocket(opts.res, {
@@ -1376,15 +1414,15 @@ async function bootstrap() {
                 return wsCtx;
             },
             onError: ({ path: trpcPath, error, ctx, input, }) => {
-                const trpcLogger = app.get(LoggingService).createLogger('tRPC:ws');
+                const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
                 trpcLogger.warn('tRPC error', {
                     // The socket the viewer uses — this is the transport that logged the
                     // four `intercom.startSession` refusals with no camera on them.
-                    tags: trpcErrorDeviceTags(trpcPath, input),
+                    tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
                     meta: {
                         code: error.code,
                         path: trpcPath ?? '?',
-                        principal: describeTrpcPrincipal(ctx?.user),
+                        principal: (0, trpc_error_principal_1.describeTrpcPrincipal)(ctx?.user),
                         message: error.message,
                     },
                 });
@@ -1406,7 +1444,7 @@ async function bootstrap() {
             const pathname = (request.url ?? '').split('?')[0];
             if (pathname === '/trpc') {
                 // CORS does not cover a WebSocket: refuse a foreign page here (D707).
-                if (refuseForeignWsUpgrade(corsPolicy, request.headers, socket))
+                if ((0, register_cors_policy_1.refuseForeignWsUpgrade)(corsPolicy, request.headers, socket))
                     return;
                 wss.handleUpgrade(request, socket, head, (ws) => {
                     wss.emit('connection', ws, request);
@@ -1453,25 +1491,25 @@ async function bootstrap() {
         // HUB-NODE-SCOPED resolution — never the cluster-global singleton. An agent
         // node registers the same cap (agent-only placement) and its `getStaticDir()`
         // answers with a path on the agent's filesystem.
-        const capRegistry = app.get(AddonRegistryService).getCapabilityRegistry();
+        const capRegistry = app.get(addon_registry_service_1.AddonRegistryService).getCapabilityRegistry();
         return capRegistry?.getSingletonForNode(capName, 'hub') ?? null;
     };
-    const adminUi = createLazyUiServing({
+    const adminUi = (0, lazy_ui_serving_js_1.createLazyUiServing)({
         label: 'Admin UI',
         // CAMSTACK_SKIP_ADMIN_UI_WAIT: e2e runs that do not need the SPA.
         lookup: () => process.env['CAMSTACK_SKIP_ADMIN_UI_WAIT'] === '1' ? null : hubUiProvider('admin-ui'),
         log: uiLogger,
         onServed: ({ staticDir, indexPath }) => {
             spaIndexHtml = indexPath;
-            warmPrecompressedAssets(staticDir, (msg, meta) => console.log(`[static] ${msg} ${JSON.stringify(meta)}`));
+            (0, precompressed_asset_js_1.warmPrecompressedAssets)(staticDir, (msg, meta) => console.log(`[static] ${msg} ${JSON.stringify(meta)}`));
         },
     });
-    const viewerUi = createLazyUiServing({
+    const viewerUi = (0, lazy_ui_serving_js_1.createLazyUiServing)({
         label: 'Viewer UI',
         lookup: () => hubUiProvider('viewer-ui'),
         log: uiLogger,
         onServed: ({ staticDir }) => {
-            warmPrecompressedAssets(staticDir, (msg, meta) => console.log(`[static] ${msg} ${JSON.stringify(meta)}`));
+            (0, precompressed_asset_js_1.warmPrecompressedAssets)(staticDir, (msg, meta) => console.log(`[static] ${msg} ${JSON.stringify(meta)}`));
         },
     });
     const VIEWER_MOUNT = '/viewer/camstack';
@@ -1483,7 +1521,7 @@ async function bootstrap() {
     // Unauthenticated by design — Apple's CDN and Android's verifier fetch these
     // with no cookies; content-type must be application/json and no redirect.
     {
-        const { appleAppSiteAssociation, assetLinks } = buildAppLinkFiles(parseCertFingerprints(process.env['CAMSTACK_ANDROID_CERT_SHA256']));
+        const { appleAppSiteAssociation, assetLinks } = (0, well_known_app_links_1.buildAppLinkFiles)((0, well_known_app_links_1.parseCertFingerprints)(process.env['CAMSTACK_ANDROID_CERT_SHA256']));
         const aasa = JSON.stringify(appleAppSiteAssociation);
         const assetlinks = JSON.stringify(assetLinks);
         fastify.get('/.well-known/apple-app-site-association', async (_request, reply) => reply.type('application/json').send(aasa));
@@ -1512,18 +1550,18 @@ async function bootstrap() {
         if (rel && /\.[a-zA-Z0-9]+$/.test(pathOnly)) {
             const abs = path.join(staticDir, rel);
             if ((abs === staticDir || abs.startsWith(staticDir + path.sep)) && fs.existsSync(abs)) {
-                reply.header('cache-control', spaAssetCacheControl(rel));
-                reply.type(contentTypeForPath(rel));
+                reply.header('cache-control', (0, spa_static_1.spaAssetCacheControl)(rel));
+                reply.type((0, spa_static_1.contentTypeForPath)(rel));
                 return sendMaybePrecompressed(reply, abs, request.headers['accept-encoding']);
             }
             return reply.callNotFound();
         }
-        reply.header('cache-control', spaShellCacheControl());
+        reply.header('cache-control', (0, spa_static_1.spaShellCacheControl)());
         return reply.type('text/html').send(fs.createReadStream(indexPath));
     });
     fastify.get('/*', async (request, reply) => {
         const url = request.url;
-        if (isRetiredPublicPath(url))
+        if ((0, spa_static_1.isRetiredPublicPath)(url))
             return reply.callNotFound();
         if (url.startsWith('/trpc') ||
             url.startsWith('/api/') ||
@@ -1545,14 +1583,14 @@ async function bootstrap() {
             const rel = pathOnly.replace(/^\/+/, '');
             const abs = path.join(staticDir, rel);
             if ((abs === staticDir || abs.startsWith(staticDir + path.sep)) && fs.existsSync(abs)) {
-                reply.header('cache-control', spaAssetCacheControl(rel));
+                reply.header('cache-control', (0, spa_static_1.spaAssetCacheControl)(rel));
                 return sendMaybePrecompressed(reply, abs, request.headers['accept-encoding']);
             }
             return reply.callNotFound();
         }
         // A relayed navigation (`X-Forwarded-Prefix`) gets a shell that says where
         // it is mounted; without the header the shell is served as before.
-        return sendSpaShell(reply, indexPath, request.headers);
+        return (0, spa_mount_1.sendSpaShell)(reply, indexPath, request.headers);
     });
     // Boot-time attempt, after listen. Later attempts are driven by requests.
     const resolveAdminUi = async () => {
@@ -1573,12 +1611,12 @@ async function bootstrap() {
     // fails to boot, hence the catch — and a restore that fails leaves the
     // mirror at its default rather than inventing a level (D49).
     try {
-        const settingsStore = buildSettingsStoreGateway(capabilityRegistry);
+        const settingsStore = (0, cap_providers_1.buildSettingsStoreGateway)(capabilityRegistry);
         const loggingLogger = loggingService.createLogger('logging-settings');
-        await new LoggingSettingsService({
+        await new logging_settings_1.LoggingSettingsService({
             store: settingsStore,
-            gate: getLoggingGate(),
-            requestCensus: new RequestCensusService({
+            gate: (0, system_1.getLoggingGate)(),
+            requestCensus: new request_census_settings_1.RequestCensusService({
                 census: httpRequestCensus,
                 store: settingsStore,
                 logger: loggingLogger,
@@ -1590,7 +1628,7 @@ async function bootstrap() {
         console.warn('[bootstrap] logging settings restore skipped:', censusErr instanceof Error ? censusErr.message : censusErr);
     }
     try {
-        const listenHost = allFamiliesListenHost(host).host;
+        const listenHost = (0, system_1.allFamiliesListenHost)(host).host;
         try {
             await app.listen(port, listenHost);
         }
@@ -1613,15 +1651,15 @@ async function bootstrap() {
         }
         throw listenErr;
     }
-    const logger = app.get(LoggingService).createLogger('System');
+    const logger = app.get(logging_service_1.LoggingService).createLogger('System');
     const protocol = tlsOptions ? 'https' : 'http';
     logger.info('CamStack server listening', { meta: { protocol, host, port, trpcRegistered } });
     // Certificate actions (Network → Local access) swap the served certificate
     // in place through this registration — without it an upload sat on disk
     // while the listener kept serving the boot-time leaf (D726).
     if (tlsOptions) {
-        if (fastify.server instanceof TlsServer) {
-            registerHttpsListener(fastify.server, tlsOptions);
+        if (fastify.server instanceof node_tls_1.Server) {
+            (0, system_1.registerHttpsListener)(fastify.server, tlsOptions);
         }
         else {
             logger.warn('HTTPS listener is not a TLS server — certificate changes need a restart');
@@ -1630,7 +1668,7 @@ async function bootstrap() {
     // LAN HTTP sibling — same Fastify request graph, dedicated port. Handler
     // is registered as soon as we have the instance; bind happens after HTTPS
     // is up so a failed HTTPS listen does not leave HTTP serving alone.
-    registerLanHttpHandler({
+    (0, system_1.registerLanHttpHandler)({
         onRequest: (req, res) => {
             fastify.server.emit('request', req, res);
         },
@@ -1639,7 +1677,7 @@ async function bootstrap() {
         },
     });
     try {
-        const lanHttp = await bindPendingLanHttp();
+        const lanHttp = await (0, system_1.bindPendingLanHttp)();
         if (lanHttp.listening) {
             logger.info('LAN HTTP listening', { meta: { port: lanHttp.port } });
         }
@@ -1656,17 +1694,17 @@ async function bootstrap() {
     // state switches from 503 to static serving as soon as each capability is up.
     void Promise.all([resolveAdminUi(), resolveViewerUi()]);
     // Post-boot: fork workers, register device streams, emit system.boot
-    const postBoot = app.get(PostBootService);
+    const postBoot = app.get(post_boot_service_1.PostBootService);
     await postBoot.run({ port, host, dataPath, trpcRegistered, tlsCert });
     // D877: ONE check, ~60 s after the boot sequence, of the runners this node
     // planned against what its process service holds. Stored in memory and served
     // on `getServerPackageStatus` / `/health`; not a timer loop.
-    app.get(RunnerBootCheckService).scheduleAfterBoot();
+    app.get(runner_boot_check_1.RunnerBootCheckService).scheduleAfterBoot();
     // The hub reached ready — when this boot is the PROBATION boot of a freshly
     // staged @camstack/server root, promote it (currentVersion ← pending, N-1
     // retained for rollback) and disarm the starter's crash-loop auto-rollback.
     try {
-        const confirm = app.get(ServerUpdateService).confirmBootHealthy();
+        const confirm = app.get(server_update_service_1.ServerUpdateService).confirmBootHealthy();
         if (confirm.promoted !== null) {
             logger.info('Server root package update confirmed healthy', {
                 meta: { version: confirm.promoted },
@@ -1690,7 +1728,7 @@ async function bootstrap() {
     // seeds them for exactly the boot that would otherwise fail. The agent runs
     // the SAME function at its own confirmation point; neither role owns a
     // private idea of what may be deleted.
-    void runSingleCopyCleanup({
+    void (0, single_copy_cleanup_runner_js_1.runSingleCopyCleanup)({
         dataDir: dataPath,
         addonRoot: process.env['CAMSTACK_ADDONS_DIR'] ?? path.join(dataPath, 'addons'),
         log: (line) => logger.info(line),
@@ -1706,7 +1744,7 @@ async function bootstrap() {
             const listAll = dmForBackfill.listAll;
             const setIntegrationId = dmForBackfill.setIntegrationId;
             const backfillLogger = loggingService.createLogger('integration-backfill');
-            await runIntegrationIdBackfill({
+            await (0, integration_id_backfill_1.runIntegrationIdBackfill)({
                 listIntegrations: async () => (await integrationRegistry.listIntegrations()).map((i) => ({
                     id: i.id,
                     addonId: i.addonId,