@camstack/server 1.2.687 → 1.2.689

package/dist/core/addon/addon-registry.service.js

@@ -402,6 +402,7 @@ class AddonRegistryService {
     activeSettingsBackend = null;
     integrationRegistry = null;
     clusterNodeHistoryStore = null;
+    nodeTombstoneStore = null;
     clusterAgentRecords = null;
     credentialTokenService = null;
     // Device architecture — in-memory registry of live IDevice instances.
@@ -1392,6 +1393,19 @@ class AddonRegistryService {
         const kind = records.kind(system_1.clusterNodeHistoryRecordKind);
         clusterStore.bindRecordsKind(() => kind);
     }
+    /** Durable node tombstones (#265) — bound to the `cluster-agent` records like the history. */
+    setNodeTombstoneStore(store) {
+        this.nodeTombstoneStore = store;
+        this.bindNodeTombstoneRecordsKind();
+    }
+    bindNodeTombstoneRecordsKind() {
+        const store = this.nodeTombstoneStore;
+        const records = this.clusterAgentRecords;
+        if (store === null || records === null)
+            return;
+        const kind = records.kind(system_1.clusterNodeTombstoneRecordKind);
+        store.bindRecordsKind(() => kind);
+    }
     /** The unified token store (D892), bound to its `core-auth` records. */
     setCredentialTokenService(service) {
         this.credentialTokenService = service;
@@ -1409,6 +1423,7 @@ class AddonRegistryService {
         await clusterRecords.declare(system_1.clusterAgentRecordKinds);
         this.clusterAgentRecords = clusterRecords;
         this.bindClusterNodeHistoryRecordsKind();
+        this.bindNodeTombstoneRecordsKind();
         const credentialTokens = this.credentialTokenService;
         if (credentialTokens !== null) {
             const coreRecords = this.recordsForOwner('core-auth', this.secretsForOwner('core-auth'));

package/dist/core/agent/agent-registry.service.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentRegistryService = exports.AGENT_BACKFILL_RPC_TIMEOUT_MS = void 0;
+exports.AgentRegistryService = exports.AGENT_BACKFILL_RPC_TIMEOUT_MS = exports.FORGOTTEN_NODE_REVOCATION_REASON = void 0;
 exports.toNodeLiveness = toNodeLiveness;
 exports.toDescriptor = toDescriptor;
 const node_crypto_1 = require("node:crypto");
@@ -45,6 +45,20 @@ const agent_delivery_ledger_1 = require("./agent-delivery-ledger");
 const agent_liveness_event_1 = require("./agent-liveness-event");
 const cluster_node_history_mirror_1 = require("./cluster-node-history-mirror");
 const node_directory_1 = require("./node-directory");
+/** The reason recorded on a certificate revoked because its node was forgotten. */
+exports.FORGOTTEN_NODE_REVOCATION_REASON = 'forgotten';
+function describeRevocation(revocation) {
+    switch (revocation.outcome) {
+        case 'not-attempted':
+            return '';
+        case 'revoked':
+            return ` ${revocation.serials.length} certificate(s) revoked - the node must be paired again.`;
+        case 'registry-unavailable':
+            return ' Its certificates were NOT revoked (the certificate registry is not loaded) - it can still reconnect.';
+        case 'failed':
+            return ` Its certificates were NOT revoked (${revocation.error}) - it can still reconnect.`;
+    }
+}
 /** Turn a forget outcome into the sentence the operator reads. */
 function describeForgetOutcome(nodeId, history, registryRemoved, stillListed) {
     const parts = [];
@@ -133,7 +147,11 @@ function toNodeLiveness(nodes) {
         // (seen live 2026-07-16 after agent churn): guard it or every consumer of
         // this projection 500s on `undefined.includes`.
         .filter((node) => typeof node.id === 'string' && !node.id.includes('/'))
-        .map((node) => ({ id: node.id, isHub: node.id === 'hub', isOnline: node.available })));
+        .map((node) => ({
+        id: node.id,
+        isHub: node.id === 'hub',
+        isOnline: node.available,
+    })));
 }
 /**
  * Project a live `AgentListItem` into the durable history descriptor. Field
@@ -245,6 +263,52 @@ class AgentRegistryService {
     setAddonRegistry(addonRegistry) {
         this.addonRegistry = addonRegistry;
     }
+    /**
+     * Wire what runs AFTER a node is really forgotten: the `node-removal-hook`
+     * dispatch and the hub-owned node-scoped data (#265). It never runs for a
+     * refused or a no-op forget.
+     */
+    setNodeRemovalCleanup(cleanup) {
+        this.nodeRemovalCleanup = cleanup;
+    }
+    nodeRemovalCleanup = null;
+    /**
+     * Wire the revocation of a forgotten node's mesh certificates (D857). Injected so this service
+     * never imports the pairing router; unwired reads as `registry-unavailable`.
+     */
+    setNodeCertificateRevoker(revoker) {
+        this.nodeCertificateRevoker = revoker;
+    }
+    nodeCertificateRevoker = null;
+    async revokeForgottenNodeCertificates(nodeId) {
+        let revocation;
+        try {
+            const serials = (await this.nodeCertificateRevoker?.(nodeId, exports.FORGOTTEN_NODE_REVOCATION_REASON)) ?? null;
+            revocation =
+                serials === null
+                    ? { outcome: 'registry-unavailable' }
+                    : { outcome: 'revoked', serials: [...serials] };
+        }
+        catch (err) {
+            revocation = {
+                outcome: 'failed',
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (revocation.outcome === 'revoked') {
+            this.logger?.info('node forgotten: certificates revoked', {
+                tags: { nodeId },
+                meta: { serials: revocation.serials },
+            });
+        }
+        else {
+            this.logger?.warn('node forgotten: certificates were NOT revoked', {
+                tags: { nodeId },
+                meta: { outcome: revocation.outcome },
+            });
+        }
+        return revocation;
+    }
     /** Wire the durable offline-node history store (A1). */
     setClusterNodeHistoryStore(store) {
         this.historyStore = store;
@@ -300,7 +364,12 @@ class AgentRegistryService {
                 timestamp: new Date(),
                 source: { type: 'core', id: 'agent-registry' },
                 category: types_1.EventCategory.AddonUninstalled,
-                data: { addonId, agentId: nodeId, packageName, reason: 'operator uninstall' },
+                data: {
+                    addonId,
+                    agentId: nodeId,
+                    packageName,
+                    reason: 'operator uninstall',
+                },
             });
         }
     }
@@ -349,31 +418,26 @@ class AgentRegistryService {
      * nothing re-announces it, and the operator has no reason to wait for a
      * timer they cannot see.
      *
-     * An ONLINE node is REFUSED: dropping a live node from the routing catalog
-     * would break every cap call pinned to it, and it re-registers on the next
-     * heartbeat anyway — "forget" of a live node is not a slow success, it is
-     * not a thing.
+     * An ONLINE node is forgotten too (operator ruling 2026-10-29, D966). The old refusal said a
+     * live node re-registers at once; since D857 its leaf is on the CRL, so it cannot. The order
+     * matters: (1) revoke (the revoker also closes the node's mutual-TLS sockets, because the CRL is
+     * only read at a handshake), (2) `disconnected` in the catalog, which unregisters its services and
+     * rejects the cap calls still waiting on it with `RequestRejectedError` - a bare `nodes.delete`
+     * would leave both behind, (3) the delete and the rest of the cleanup. The agent finds out on
+     * its own: refused at the next handshake, it asks the hub (`agent-membership-watch`) and resets
+     * to unpaired after two CA-signed `revoked` answers. `stillListed` is read back at the end, so a
+     * node that came straight back (revocation failed) is reported as listed, never as forgotten.
      */
     async forgetClusterNode(nodeId) {
-        if (this.isNodeOnline(nodeId)) {
-            const message = `Refused: ${nodeId} is ONLINE. Take the node down first — a live node re-registers immediately.`;
-            this.logger?.warn('forget cluster node refused', {
-                tags: { nodeId },
-                meta: { reason: 'node-online' },
-            });
-            return {
-                forgotten: false,
-                historyRemoved: false,
-                registryRemoved: false,
-                stillListed: true,
-                message,
-            };
-        }
+        // First: a forgotten node whose leaf stays valid walks back in on its next boot (D857).
+        const certificates = await this.revokeForgottenNodeCertificates(nodeId);
         const historyOutcome = this.historyStore
             ? await this.historyStore.forget(nodeId)
             : 'store-unavailable';
         // The mirror still lists the forgotten node: the next directory re-reads.
         this.historyMirror?.invalidate();
+        if (this.isNodeOnline(nodeId))
+            this.disconnectFromNodeCatalog(nodeId);
         const registryRemoved = this.removeFromNodeCatalog(nodeId);
         // Its intended set is gone with the row, so the back-fill breaker's memory
         // of failed deliveries to it is meaningless — drop it too.
@@ -388,7 +452,8 @@ class AgentRegistryService {
         }));
         const historyRemoved = historyOutcome === 'removed';
         const stillListed = this.isNodeKnown(nodeId);
-        const message = describeForgetOutcome(nodeId, historyOutcome, registryRemoved, stillListed);
+        const message = describeForgetOutcome(nodeId, historyOutcome, registryRemoved, stillListed) +
+            describeRevocation(certificates);
         this.logger?.info('forget cluster node', {
             tags: { nodeId },
             meta: { historyOutcome, historyRemoved, registryRemoved, stillListed },
@@ -398,6 +463,17 @@ class AgentRegistryService {
         // operator had to refresh by hand. `TopologyEmitterService` listens for
         // `AgentUnregistered` and re-emits immediately.
         if (historyRemoved || registryRemoved) {
+            // The recorded fact the owners of node-scoped data are driven from. A
+            // failure here must not turn a forget that happened into an error.
+            try {
+                await this.nodeRemovalCleanup?.(nodeId, Date.now());
+            }
+            catch (err) {
+                this.logger?.warn('node removal cleanup failed', {
+                    tags: { nodeId },
+                    meta: { error: err instanceof Error ? err.message : String(err) },
+                });
+            }
             this.eventBus.emit({
                 id: (0, node_crypto_1.randomUUID)(),
                 timestamp: new Date(),
@@ -411,9 +487,24 @@ class AgentRegistryService {
             historyRemoved,
             registryRemoved,
             stillListed,
+            certificates,
             message,
         };
     }
+    /**
+     * Take a LIVE node out of routing the way Moleculer does when its transport drops: services
+     * unregistered, pending requests rejected (typed, not left to time out). Idempotent.
+     */
+    disconnectFromNodeCatalog(nodeId) {
+        const nodes = this.nodeCatalogRegistry()?.nodes;
+        if (nodes?.disconnected === undefined) {
+            this.logger?.warn('cluster node catalog does not expose disconnected - calls may hang', {
+                tags: { nodeId },
+            });
+            return;
+        }
+        nodes.disconnected(nodeId, false);
+    }
     /** Is the node currently AVAILABLE in Moleculer's catalog? */
     isNodeOnline(nodeId) {
         return this.catalogNodeIds({ onlyAvailable: true }).includes(nodeId);
@@ -481,7 +572,10 @@ class AgentRegistryService {
                     timestamp: new Date(),
                     source: { type: 'core', id: 'agent-registry' },
                     category: types_1.EventCategory.AgentOnline,
-                    data: { agentId: node.id, ...(nodeName !== undefined ? { nodeName } : {}) },
+                    data: {
+                        agentId: node.id,
+                        ...(nodeName !== undefined ? { nodeName } : {}),
+                    },
                 });
             }
             else {
@@ -807,7 +901,9 @@ class AgentRegistryService {
         if (priorRoster.length === 0) {
             this.logger?.info('back-fill: fresh node (no prior declared roster), plan from the hub any-node set', {
                 tags: { nodeId: agentId },
-                meta: { planned: planned.targets.map((t) => `${t.name}@${t.version}`) },
+                meta: {
+                    planned: planned.targets.map((t) => `${t.name}@${t.version}`),
+                },
             });
             for (const skip of planned.skipped) {
                 this.logger?.info('back-fill: fresh node not given a hub package', {
@@ -1083,7 +1179,8 @@ class AgentRegistryService {
             status: {
                 activeCameras: 0,
                 cpuPercent: status.cpuPercent ?? 0,
-                memoryPercent: status.memoryPercent ?? 0,
+                memoryPercent: typeof status.memoryPercent === 'number' ? status.memoryPercent : null,
+                processRssBytes: typeof status.processRssBytes === 'number' ? status.processRssBytes : null,
                 fps: {},
                 errors: [],
             },
@@ -1147,7 +1244,7 @@ class AgentRegistryService {
             status: {
                 activeCameras: 0,
                 cpuPercent: 0,
-                memoryPercent: 0,
+                memoryPercent: null,
                 fps: {},
                 errors: [],
             },
@@ -1164,7 +1261,7 @@ class AgentRegistryService {
         // The cap contract only exposes async snapshots; the cached read is cheap
         // because the addon's background sampler keeps the snapshot warm.
         let cpuPercent = 0;
-        let memoryPercent = 0;
+        let memoryPercent = null;
         const registry = this.capabilityService.getRegistry();
         if (registry) {
             const metricsProvider = registry.getSingleton('metrics-provider');
@@ -1193,6 +1290,7 @@ class AgentRegistryService {
                 activeCameras: 0,
                 cpuPercent,
                 memoryPercent,
+                processRssBytes: process.memoryUsage().rss,
                 fps: {},
                 errors: [],
             },

package/dist/core/agent/forgotten-node-revoker.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createForgottenNodeRevoker = createForgottenNodeRevoker;
+/**
+ * The hub's revocation of a FORGOTTEN node's mesh certificates (D857, #265).
+ *
+ * `AgentRegistryService.forgetClusterNode` is handed this as a seam so it never imports the
+ * pairing router; the revocation is the same one the operator's "unpair" performs
+ * (`revokeMeshCertificate`: every leaf of the node onto the CRL, its sockets cut) with the
+ * reason `forgotten`, which is what the node is told when it asks why it is refused.
+ */
+const system_1 = require("@camstack/system");
+function createForgottenNodeRevoker(deps) {
+    const registry = deps.registry ?? system_1.getProcessMeshCertificateRegistry;
+    const crl = deps.crl ?? system_1.processMeshCrl;
+    const peers = deps.peers ?? {
+        peerLeaf: (nodeId) => (0, system_1.getProcessPeerLeaf)(nodeId),
+        dropPeer: (nodeId) => (0, system_1.dropProcessPeer)(nodeId),
+    };
+    return async (nodeId, reason) => {
+        const loaded = registry();
+        if (loaded === null)
+            return null;
+        const result = await (0, system_1.revokeMeshCertificate)({
+            nodeId,
+            registry: loaded,
+            crl: crl(),
+            peers,
+            reason,
+            log: deps.logger,
+        });
+        return result.revokedSerials;
+    };
+}

package/dist/core/agent/node-removal-hooks.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeRemovalDispatcher = exports.NodeTombstoneStore = void 0;
+exports.registryNodeRemovalHooks = registryNodeRemovalHooks;
+exports.clearSingletonNodeOverrides = clearSingletonNodeOverrides;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const capability_preference_writes_1 = require("../../api/core/capability-preference-writes");
+/** Durable tombstones over the `cluster-agent` `node-tombstones` records kind. */
+class NodeTombstoneStore {
+    logger;
+    resolveKind;
+    constructor(logger, resolveKind = () => null) {
+        this.logger = logger;
+        this.resolveKind = resolveKind;
+    }
+    /** Hub wiring once the records provider is up. */
+    bindRecordsKind(resolver) {
+        this.resolveKind = resolver;
+    }
+    /** Record the forget. `false` = not persisted (kind unbound, or the write failed). */
+    async record(nodeId, removedAt, pending) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return false;
+        try {
+            await kind.put({ id: nodeId, at: removedAt, data: { removedAt, pending } });
+            return true;
+        }
+        catch (err) {
+            this.logger.warn('could not record node tombstone', {
+                tags: { nodeId },
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+            return false;
+        }
+    }
+    /** One implementer acknowledged: drop it from `pending`; delete the row when none is left. */
+    async acknowledge(nodeId, addonId) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return;
+        try {
+            const row = await kind.get(nodeId);
+            if (row === null)
+                return;
+            const pending = row.data.pending.filter((id) => id !== addonId);
+            if (pending.length === 0)
+                await kind.delete(nodeId);
+            else
+                await kind.put({ id: nodeId, at: row.data.removedAt, data: { ...row.data, pending } });
+        }
+        catch (err) {
+            this.logger.warn('could not acknowledge node tombstone', {
+                tags: { nodeId },
+                meta: { addonId, error: (0, types_1.errMsg)(err) },
+            });
+        }
+    }
+    /** Tombstones with an unacknowledged implementer. Unanswered read = none (a retry, never a delete). */
+    async listPending() {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return [];
+        try {
+            const out = [];
+            for (const row of await (0, system_1.readAllRows)(kind)) {
+                const parsed = system_1.ClusterNodeTombstoneBodySchema.safeParse(row.data);
+                if (parsed.success && parsed.data.pending.length > 0) {
+                    out.push({ nodeId: row.id, removedAt: parsed.data.removedAt, pending: parsed.data.pending });
+                }
+            }
+            return out;
+        }
+        catch (err) {
+            this.logger.warn('could not list node tombstones', { meta: { error: (0, types_1.errMsg)(err) } });
+            return [];
+        }
+    }
+}
+exports.NodeTombstoneStore = NodeTombstoneStore;
+const DEFAULT_ATTEMPTS = 3;
+class NodeRemovalDispatcher {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** A node was forgotten: record the tombstone, then tell every implementer. */
+    async nodeForgotten(nodeId, removedAt) {
+        const implementers = this.deps.hooks.implementers();
+        if (implementers.length === 0)
+            return { acknowledged: [], pending: [] };
+        const persisted = await this.deps.store.record(nodeId, removedAt, implementers);
+        if (!persisted) {
+            this.deps.logger.warn('node tombstone not persisted — implementers are told now but cannot be re-driven', { tags: { nodeId } });
+        }
+        return this.drive({ nodeId, removedAt, pending: implementers });
+    }
+    /** Re-drive every tombstone that still has a registered, unacknowledged implementer. */
+    async redrive() {
+        for (const tombstone of await this.deps.store.listPending()) {
+            await this.drive(tombstone);
+        }
+    }
+    async drive(tombstone) {
+        const { nodeId, removedAt } = tombstone;
+        const registered = new Set(this.deps.hooks.implementers());
+        const attempts = this.deps.maxAttempts ?? DEFAULT_ATTEMPTS;
+        const acknowledged = [];
+        const pending = [];
+        for (const addonId of tombstone.pending) {
+            if (!registered.has(addonId)) {
+                pending.push(addonId);
+                continue;
+            }
+            const done = await this.callWithRetries(addonId, { nodeId, removedAt }, attempts);
+            if (done) {
+                acknowledged.push(addonId);
+                await this.deps.store.acknowledge(nodeId, addonId);
+            }
+            else {
+                pending.push(addonId);
+            }
+        }
+        return { acknowledged, pending };
+    }
+    async callWithRetries(addonId, input, attempts) {
+        for (let attempt = 1; attempt <= attempts; attempt++) {
+            try {
+                const result = await this.deps.hooks.call(addonId, input);
+                this.deps.logger.info('node removal hook done', {
+                    tags: { nodeId: input.nodeId },
+                    meta: { addonId, counts: result.counts },
+                });
+                return true;
+            }
+            catch (err) {
+                this.deps.logger.warn('node removal hook failed', {
+                    tags: { nodeId: input.nodeId },
+                    meta: { addonId, attempt, attempts, error: (0, types_1.errMsg)(err) },
+                });
+            }
+        }
+        return false;
+    }
+}
+exports.NodeRemovalDispatcher = NodeRemovalDispatcher;
+const NODE_REMOVAL_HOOK_CAP = 'node-removal-hook';
+function isNodeRemovalHook(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof Reflect.get(value, 'onNodeRemoved') === 'function');
+}
+/** {@link NodeRemovalHooks} over the capability registry (keys include `addon@node`). */
+function registryNodeRemovalHooks(registry) {
+    return {
+        implementers: () => registry.getProviderAddonIds(NODE_REMOVAL_HOOK_CAP),
+        call: async (addonId, input) => {
+            const provider = registry.getProviderByAddonId(NODE_REMOVAL_HOOK_CAP, addonId);
+            if (!isNodeRemovalHook(provider)) {
+                throw new Error(`"${addonId}" no longer provides ${NODE_REMOVAL_HOOK_CAP}`);
+            }
+            return provider.onNodeRemoved(input);
+        },
+    };
+}
+/**
+ * A forgotten node leaves no per-node singleton override behind: for every
+ * singleton capability, the persisted preference is cleared FIRST, then the
+ * live override (the order `capabilities.clearSingletonNodeOverride` uses).
+ * Returns how many overrides were cleared. A failed write leaves that override
+ * in place and the error propagates — the caller reports it, nothing is hidden.
+ */
+async function clearSingletonNodeOverrides(nodeId, registry, config) {
+    let cleared = 0;
+    for (const cap of registry.listCapabilities()) {
+        if (cap.mode !== 'singleton')
+            continue;
+        if (!registry.getSingletonNodeOverrides(cap.name).has(nodeId))
+            continue;
+        await config.set((0, capability_preference_writes_1.singletonPreferenceKey)(cap.name, nodeId), null);
+        registry.clearSingletonNodeOverride(cap.name, nodeId);
+        cleared += 1;
+    }
+    return cleared;
+}

package/dist/main.js

@@ -59,6 +59,7 @@ const fastify_1 = require("@trpc/server/adapters/fastify");
 const ws_1 = require("@trpc/server/adapters/ws");
 const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
+const mesh_membership_routes_1 = require("./api/mesh-membership-routes");
 const auth_whoami_1 = require("./api/auth-whoami");
 const backup_download_js_1 = require("./api/backup-download.js");
 const cap_providers_1 = require("./api/core/cap-providers");
@@ -482,6 +483,10 @@ async function bootstrap() {
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
         console.log('[bootstrap] Auth whoami route registered at GET /api/auth/whoami');
+        // A refused (forgotten / unpaired) agent asks here whether it is still a member (D857).
+        (0, mesh_membership_routes_1.registerMeshMembershipRoutes)(fastify, {
+            logger: app.get(logging_service_1.LoggingService).createLogger('mesh-membership'),
+        });
     }
     catch (err) {
         console.warn('[bootstrap] Failed to register addon upload route:', err);
@@ -743,7 +748,10 @@ async function bootstrap() {
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
         (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify, {
             verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
-            limiter: (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE }),
+            limiter: (0, auth_rate_limit_1.createRateLimiter)({
+                windowMs: 60_000,
+                max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE,
+            }),
             network: authNetwork,
         });
     }
@@ -981,7 +989,9 @@ async function bootstrap() {
                 const um = capabilityRegistry.getSingleton('user-management');
                 return (0, second_factors_js_1.collectSecondFactors)({
                     ...(um && typeof um.getTotpStatus === 'function'
-                        ? { getTotpStatus: (input) => um.getTotpStatus(input) }
+                        ? {
+                            getTotpStatus: (input) => um.getTotpStatus(input),
+                        }
                         : {}),
                     passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(capabilityRegistry, app.get(moleculer_service_1.MoleculerService)),
                 }, userId, 'passkey');
@@ -1106,7 +1116,12 @@ async function bootstrap() {
                     const auth = await (0, addon_route_auth_js_1.authorizeAddonBearer)({
                         bearer: token,
                         verifier: addonVerifier,
-                        target: { addonId, method, access, share: dpMatch.endpoint.share ?? [] },
+                        target: {
+                            addonId,
+                            method,
+                            access,
+                            share: dpMatch.endpoint.share ?? [],
+                        },
                         facts: (0, trpc_context_1.requestFacts)(request),
                         logger: addonGateLogger,
                     });
@@ -1579,7 +1594,9 @@ async function bootstrap() {
     }
     const logger = app.get(logging_service_1.LoggingService).createLogger('System');
     const protocol = tlsOptions ? 'https' : 'http';
-    logger.info('CamStack server listening', { meta: { protocol, host, port, trpcRegistered } });
+    logger.info('CamStack server listening', {
+        meta: { protocol, host, port, trpcRegistered },
+    });
     // Certificate actions (Network → Local access) swap the served certificate
     // in place through this registration — without it an upload sat on disk
     // while the listener kept serving the boot-time leaf (D726).
@@ -1608,7 +1625,9 @@ async function bootstrap() {
             logger.info('LAN HTTP listening', { meta: { port: lanHttp.port } });
         }
         else if (lanHttp.error) {
-            logger.warn('LAN HTTP not bound', { meta: { error: lanHttp.error, port: lanHttp.port } });
+            logger.warn('LAN HTTP not bound', {
+                meta: { error: lanHttp.error, port: lanHttp.port },
+            });
         }
     }
     catch (err) {