@camstack/system 1.1.20 → 1.1.22

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-PbdHKDpj.js");
+const require_manifest_python_deps = require("./manifest-python-deps-D7iR07uA.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { $ as getWorkerNativeCapProvider, N as createUdsLoggerWithControl, P as LocalChildClient, _t as resolveAddonClass, et as getWorkerNativeCapSnapshot, gt as installManifestNativeDeps, i as createUdsAddonContext, it as validateProviderRegistrations, nt as setWorkerNativeCapsChangeListener, t as installManifestPythonDeps } from "./manifest-python-deps-X00KVYHa.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as resolveAddonClass, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, yt as installManifestNativeDeps } from "./manifest-python-deps-hDWMDe_b.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { register } from "node:module";
 import * as fs from "node:fs";

package/dist/index.js

@@ -20,7 +20,7 @@ const require_builtins_local_auth_local_auth_addon = require("./builtins/local-a
 require("./builtins/local-auth/index.js");
 const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
 require("./builtins/device-manager/index.js");
-const require_manifest_python_deps = require("./manifest-python-deps-PbdHKDpj.js");
+const require_manifest_python_deps = require("./manifest-python-deps-D7iR07uA.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
@@ -93487,6 +93487,7 @@ Object.defineProperty(exports, "getFfmpegDownloadUrl", {
 	}
 });
 exports.getModelFilePath = require_model_download_service.getModelFilePath;
+exports.getMoleculerEventStats = require_manifest_python_deps.getMoleculerEventStats;
 exports.getOrInitReadinessRegistry = require_manifest_python_deps.getOrInitReadinessRegistry;
 exports.getOrInitReadinessRegistryForClient = require_manifest_python_deps.getOrInitReadinessRegistryForClient;
 exports.getPidStats = require_resource_monitor.getPidStats;
@@ -93556,8 +93557,10 @@ Object.defineProperty(exports, "scopeKey", {
 exports.scopesAllowDeviceCap = scopesAllowDeviceCap;
 exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays;
 exports.setHubConnected = require_manifest_python_deps.setHubConnected;
+exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
 exports.stageFrameworkLockstep = stageFrameworkLockstep;
 exports.stripCamstackDeps = stripCamstackDeps;
+exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
 exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
 exports.writePendingRestart = writePendingRestart;

package/dist/index.mjs

@@ -18,7 +18,7 @@ import { LocalAuthAddon, a as require_ms, c as __esmMin, d as __toCommonJS, f as
 import "./builtins/local-auth/index.mjs";
 import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
-import { A as createUdsEventBus, B as CapRouteError, C as ipcParentLink, D as createHubCapForwardService, E as HUB_CAP_FWD_SERVICE, F as LocalChildRegistry, G as UdsLocalTransportServer, H as callWithServiceDiscovery, I as UDS_NO_ROUTE_PREFIX, J as FrameDecoder, K as SocketChannel, L as AGENT_CAP_FWD_ACTION, M as createUdsLogger, N as createUdsLoggerWithControl, O as createParentUnownedCallHandler, P as LocalChildClient, Q as createBrokerDeviceManagerApi, R as AGENT_CAP_FWD_SERVICE, S as ipcChildLink, T as HUB_CAP_FWD_ACTION, U as createLocalTransport, V as classifyCapRoute, W as UdsLocalTransportClient, X as buildNativeCapProxy, Y as encodeFrame, Z as buildUdsNativeCapProxy, _ as __resetCapUsageRegistryForTests, _t as resolveAddonClass, a as getWorkerDeviceRegistry, at as NATIVE_PROVIDER_SERVICE_INFIX, b as brokerTransportLink, c as setHubConnected, ct as capBareAction, d as registerEventBusService, dt as deserializeTypedArrays, f as AddonDepsManager, ft as serializeTypedArrays, g as CapUsageRegistry, gt as installManifestNativeDeps, h as createHwAccelService, ht as CapabilityUnavailableError, i as createUdsAddonContext, it as validateProviderRegistrations, j as udsChildLogToWorkerEntry, k as createUdsEventBridge, l as EVENT_TOPIC_PREFIX, lt as capServiceName, m as resolveHwAccel, mt as CapabilityHandle, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as capActionName, p as createKernelHwAccel, pt as DeviceRegistry, q as localEndpointPath, r as createAddonContext, rt as createAddonService, s as getOrInitReadinessRegistryForClient, st as capActionSuffix, t as installManifestPythonDeps, tt as mountNativeCapService, u as getBrokerEventBus, ut as parseCapAction, v as getCapUsageRegistry, w as localProviderLink, x as buildLinkChain, y as brokerCallForCap, z as CapRouteResolver } from "./manifest-python-deps-X00KVYHa.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as resolveHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getMoleculerEventStats, dt as capBareAction, et as buildUdsNativeCapProxy, f as registerEventBusService, ft as capServiceName, g as createKernelHwAccel, gt as DeviceRegistry, h as AddonDepsManager, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as subscribePassthrough, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as setNodeEventInterest, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as getBrokerEventBus, ut as capActionSuffix, v as createHwAccelService, vt as CapabilityUnavailableError, w as buildLinkChain, x as getCapUsageRegistry, y as CapUsageRegistry, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-hDWMDe_b.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { request } from "node:http";
@@ -93252,4 +93252,4 @@ async function stageFrameworkLockstep(input) {
 	return results;
 }
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FRAMEWORK_LOCKSTEP, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyCapRoute, clearPendingRestart, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createHwAccelService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensurePython, ensureTlsCert, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isClusterSecretMismatchError, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, scheduleSelfRestart, scopeKey, scopesAllowDeviceCap, serializeTypedArrays, setHubConnected, stageFrameworkLockstep, stripCamstackDeps, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FRAMEWORK_LOCKSTEP, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyCapRoute, clearPendingRestart, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createHwAccelService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensurePython, ensureTlsCert, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isClusterSecretMismatchError, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, scheduleSelfRestart, scopeKey, scopesAllowDeviceCap, serializeTypedArrays, setHubConnected, setNodeEventInterest, stageFrameworkLockstep, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };

package/dist/kernel/index.d.ts

@@ -33,7 +33,8 @@ export { type AddonDeploySource, isAddonDeploySource } from './moleculer/addon-d
 export { createAddonService, validateProviderRegistrations, } from './moleculer/addon-service-factory.js';
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-cap-service.js';
 export type { CoreCapAction, CoreCapServiceOptions } from './moleculer/core-cap-service.js';
-export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, getBrokerEventBus, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
+export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, getBrokerEventBus, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
+export type { MoleculerEventStats } from './moleculer/addon-context-factory.js';
 export { HubLogForwarder } from './moleculer/hub-log-forwarder.js';
 export type { AddonContextOptions } from './moleculer/addon-context-factory.js';
 export { createHubService } from './moleculer/hub-service.js';

package/dist/kernel/moleculer/addon-context-factory.d.ts

@@ -5,7 +5,7 @@ import { CapabilityRegistry } from '../capability-registry.js';
 import { CapCallInput } from '../transport/index.js';
 import { LocalChildClient } from '../transport/local-child-client.js';
 import { DataPlaneSink } from './addon-data-plane-facility.js';
-import { getBrokerEventBus, registerEventBusService, clusterEventTopic, EVENT_TOPIC_PREFIX } from './event-bus.js';
+import { getBrokerEventBus, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, clusterEventTopic, EVENT_TOPIC_PREFIX, MoleculerEventStats } from './event-bus.js';
 import { createRunnerLogger, setHubConnected, ___resetHubConnectedForTests, ___createRemoteLoggerForTests } from './remote-logger.js';
 import { withAddonScope, setPreferredProvider, ___resetBindingSubscriptionForTests } from './provider-registry.js';
 /**
@@ -99,5 +99,5 @@ declare function createUdsAddonContext(client: LocalChildClient, nodeId: string,
  * next addon instance loads.
  */
 declare function drainWorkerDisposerChain(nodeId: string, addonId: string): Promise<void>;
-export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, drainWorkerDisposerChain, registerEventBusService, clusterEventTopic, EVENT_TOPIC_PREFIX, getBrokerEventBus, withAddonScope, setPreferredProvider, createRunnerLogger, __resetHubConnectedForTests, __resetBindingSubscriptionForTests, __createRemoteLoggerForTests, };
-export type { AddonContextOptions };
+export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, drainWorkerDisposerChain, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, clusterEventTopic, EVENT_TOPIC_PREFIX, getBrokerEventBus, withAddonScope, setPreferredProvider, createRunnerLogger, __resetHubConnectedForTests, __resetBindingSubscriptionForTests, __createRemoteLoggerForTests, };
+export type { AddonContextOptions, MoleculerEventStats };

package/dist/kernel/moleculer/event-bus-core.d.ts

@@ -77,6 +77,60 @@ export declare const RING_BUFFER_DENY_PATTERNS: readonly string[];
  */
 export declare const MAX_RECENT_EVENTS = 1000;
 export declare function isHighFrequencyCategory(category: string): boolean;
+/**
+ * Fan-out mode for cross-node (Moleculer) event delivery, read from the
+ * `CAMSTACK_MOLECULER_EVENT_FANOUT` env. The inter-node analogue of the
+ * intra-host `CAMSTACK_UDS_EVENT_FANOUT` gate (`local-child-registry.ts`):
+ *   - `filter`    (default) — drop an inbound cross-node event whose category
+ *     no local subscriber on THIS node wants (the union of its children's
+ *     declared patterns).
+ *   - `shadow`    — compute the drop decision + count would-suppresses, but
+ *     STILL deliver every event (burn-in: prove zero would-be-starved deliveries
+ *     before flipping to `filter`).
+ *   - `broadcast` — ignore the gate entirely (pre-D2 behaviour).
+ *
+ * ROLLBACK CONTRACT (operators, read this): this env governs ONLY the inter-node
+ * (Moleculer) gate. The intra-host UDS fan-out has a SEPARATE, independent
+ * kill-switch, `CAMSTACK_UDS_EVENT_FANOUT` (see `local-child-registry.ts`). A
+ * FULL rollback to pre-D2 / pre-#44 delivery therefore requires BOTH env vars
+ * set to `broadcast` AND a process restart on EVERY node (hub + all agents) —
+ * each is read ONCE at registration/construction, so a running process will not
+ * pick up a change. Flipping only one leg leaves the other filtering and yields
+ * inconsistent behaviour. Recommended first fleet-wide enable: `shadow` on both,
+ * watch the suppressed counters (`getMoleculerEventStats` /
+ * `getChildEventStats`), then flip to `filter` once burn-in shows zero
+ * would-be-starved deliveries.
+ */
+export type MoleculerEventFanoutMode = 'filter' | 'shadow' | 'broadcast';
+export declare function readMoleculerFanoutMode(): MoleculerEventFanoutMode;
+/**
+ * A node's inbound-interest snapshot used by {@link crossNodeAcceptsCategory}.
+ *  - `retainRecent` — the receiving bus retains events for `getRecent`/audit
+ *    (the hub main process). Such a bus genuinely wants EVERY category (its
+ *    interest set is the admin-ui live stream + recent[] ring), so it always
+ *    fails OPEN — it never filters inbound cross-node events.
+ *  - `interest` — the union of this node's local subscribers' declared category
+ *    patterns (aggregated from its UDS children). `null` = undeclared / unknown
+ *    (a legacy child, or no oracle installed) → fail OPEN (accept everything).
+ *    An EMPTY array is a *declared* "wants nothing" and drops every category.
+ */
+export interface CrossNodeInterestSnapshot {
+    readonly retainRecent: boolean;
+    readonly interest: readonly string[] | null;
+}
+/**
+ * Does this node want to accept an inbound cross-node event in `category`?
+ * The receiving-side mirror of `LocalChildRegistry.childWantsEvent`:
+ *   - `broadcast` mode → always (gate disabled).
+ *   - a retaining bus (hub main) → always (it serves `getRecent` + admin-ui;
+ *     its interest is genuinely everything).
+ *   - undeclared interest (`null`) → always (fail-open).
+ *   - else the declared union must match via `matchesPattern` — the SAME
+ *     function the local subscriber map-key gate uses, giving delivery parity.
+ * `shadow` is handled by the caller (it counts the would-suppress but still
+ * delivers), exactly like the UDS fan-out.
+ */
+export declare function crossNodeAcceptsCategory(mode: MoleculerEventFanoutMode, snapshot: CrossNodeInterestSnapshot, category: string): boolean;
 /**
  * Deliver `event` to all matching local subscribers and — ONLY on a bus that
  * opted into retention (`state.retainRecent`, i.e. the hub main process) and

package/dist/kernel/moleculer/event-bus.d.ts

@@ -1,4 +1,4 @@
-import { IEventBus } from '@camstack/types';
+import { IEventBus, SystemEvent } from '@camstack/types';
 import { ServiceBroker } from 'moleculer';
 /**
  * Narrow interface for the Moleculer ServiceBroker surface used in this file.
@@ -28,6 +28,39 @@ export interface BrokerLike {
 export declare const EVENT_TOPIC_PREFIX = "camstack.evt.";
 /** Build the Moleculer broadcast topic for an event category. */
 export declare function clusterEventTopic(category: string): string;
+/**
+ * Subscribe a PASS-THROUGH relay handler to the broker's shared bus WITHOUT
+ * registering it in the local-interest surface. Used exclusively by the UDS
+ * event bridge for its cluster/parent-local → children fan-out subscription:
+ * the bridge must receive every event the gate lets through so it can relay to
+ * forked children, but it is not itself a terminal consumer, so it must not
+ * count toward this node's interest (a counted `*` would defeat the filter).
+ * Returns an unsubscribe function.
+ */
+export declare function subscribePassthrough(broker: ServiceBroker, handler: (event: SystemEvent) => void): () => void;
+/** Cross-node inbound fan-out counters for a broker, `{ delivered, suppressed }`. */
+export interface MoleculerEventStats {
+    readonly delivered: number;
+    readonly suppressed: number;
+}
+/**
+ * Install (or clear, with `null`) the per-node interest oracle consulted by the
+ * `$event-bus` inbound handler to decide whether an inbound cross-node event is
+ * wanted by any local subscriber on this node. The oracle is read PER-EVENT so a
+ * child (un)subscribing takes effect immediately with no re-registration.
+ *
+ * Only non-retaining nodes (agents) meaningfully filter — a retaining bus (hub
+ * main) always accepts every category (it serves `getRecent` + the admin-ui live
+ * stream). Installing the oracle on the hub too is therefore harmless and keeps
+ * the wiring uniform.
+ */
+export declare function setNodeEventInterest(broker: ServiceBroker, oracle: (() => readonly string[] | null) | null): void;
+/**
+ * Cross-node inbound counters for `broker`, or `null` if no cross-node event has
+ * been processed yet. Exposed for the D2 shadow burn-in + operator debug —
+ * mirror of `LocalChildRegistry.getChildEventStats`.
+ */
+export declare function getMoleculerEventStats(broker: ServiceBroker): MoleculerEventStats | null;
 /**
  * Register the `$event-bus` service on a broker. MUST be called BEFORE
  * `broker.start()` — Moleculer announces a service's event

package/dist/kernel/transport/cap-route-resolver.d.ts

@@ -1,6 +1,6 @@
-import { CapCallInput } from './child-cap-protocol.js';
 import { ServiceDiscoveryBroker } from '../moleculer/resilient-cap-call.js';
 import { CapRoute, CapRouteOpts, HubLocalUdsRoute, InProcessProviderRef } from './cap-route.js';
+import { CapCallInput } from './child-cap-protocol.js';
 /**
  * Minimal surface of LocalChildRegistry that the resolver needs.
  * Keeping a narrow interface here prevents the resolver from depending on the
@@ -80,6 +80,14 @@ export interface CapRouteResolverDeps {
      * Decouples the resolver from CapabilityRegistry.
      */
     readonly inProcessProviders: InProcessProviderLookup;
+    /**
+     * Optional NODE-ACCURATE lookup for providers physically resident on the
+     * hub node — consulted ONLY when a call is EXPLICITLY pinned to the hub.
+     * `inProcessProviders` may resolve the cluster-elected ACTIVE singleton
+     * (a remote-proxy provider registered in the hub registry), which must not
+     * satisfy a `nodePin('hub')`. See `CapRouteSnapshot.hubResidentProvides`.
+     */
+    readonly hubResidentProviders?: InProcessProviderLookup;
     /**
      * Per-cap-method RPC timeout (ms). Lets a long-running cap method (e.g.
      * `model-convert.convert`, minutes) override the default 60s remote/forward
@@ -133,6 +141,7 @@ export declare class CapRouteResolver {
     private readonly hubLocalRegistry;
     private readonly nodeAuthority;
     private readonly inProcessProviders;
+    private readonly hubResidentProviders?;
     private readonly capTimeoutMs?;
     private readonly snapshot;
     constructor(deps: CapRouteResolverDeps);

package/dist/kernel/transport/cap-route.d.ts

@@ -108,6 +108,26 @@ export interface CapRouteSnapshot {
      * null, classifyCapRoute throws no-provider rather than casting.
      */
     readonly getInProcessProviderRef?: (cap: string) => InProcessProviderRef | null;
+    /**
+     * Optional NODE-ACCURATE variant of `hubInProcessProvides`, consulted ONLY
+     * for an EXPLICIT hub pin (`opts.nodeId === hubNodeId`). Returns true only
+     * when a provider physically resident on the hub node exists.
+     *
+     * Rationale: `hubInProcessProvides` may be backed by the cluster-elected
+     * ACTIVE singleton — which can be a REMOTE-proxy provider registered in the
+     * hub registry. That is correct for UNPINNED dispatch (election adherence)
+     * but must NOT satisfy an explicit `nodePin('hub')`: dispatching the remote
+     * proxy as "hub-in-process" silently executes the call on another node
+     * (the shm frame-plane cross-node decoder-session storm). When absent,
+     * classifyExplicitNode falls back to `hubInProcessProvides` (legacy).
+     */
+    readonly hubResidentProvides?: (cap: string) => boolean;
+    /**
+     * Optional: resolves the InProcessProviderRef of a HUB-RESIDENT provider
+     * (paired with `hubResidentProvides` — same node-accuracy contract). Used
+     * instead of `getInProcessProviderRef` when `hubResidentProvides` is set.
+     */
+    readonly getHubResidentProviderRef?: (cap: string) => InProcessProviderRef | null;
     /**
      * Optional: enumerates all known remote nodeIds for singleton cap resolution
      * (the case where no explicit nodeId is given by the caller).

package/dist/kernel/transport/local-child-registry.d.ts

@@ -123,6 +123,29 @@ export declare class LocalChildRegistry {
      * that explicitly subscribes to a ring-denied category must still RECEIVE it.
      */
     private childWantsEvent;
+    /**
+     * D2: this node's aggregate cross-node event interest — the UNION of every
+     * connected child's declared category patterns. Consumed by the parent's
+     * `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
+     * accepts cross-node (Moleculer) categories at least one local child wants.
+     *
+     * Returns `null` (fail-open — accept everything) when:
+     *   - NO child is currently connected (boot window before the first forked
+     *     child completes its UDS handshake, or every child has disconnected): a
+     *     node MUST NOT drop 100% of inbound cross-node events during that window,
+     *     and a child may connect imminently. This is distinct from the
+     *     declared-empty case below.
+     *   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
+     *     runner): a node cannot safely narrow its inbound set while a child's
+     *     real interest is unknown. Mirrors the per-child fail-open in
+     *     {@link childWantsEvent}, aggregated conservatively.
+     *
+     * Returns an EMPTY array only when ≥1 child is connected and EVERY connected
+     * child declared an explicit empty set — a genuine "wants nothing". Reads the
+     * live `children` map, so a child registering / disconnecting / sending
+     * `event-sub` is reflected on the next call with no extra bookkeeping.
+     */
+    aggregateEventInterest(): readonly string[] | null;
     private statsFor;
     /** Deduped INFO line whenever a child's declared pattern set changes. */
     private logPatternSet;

package/dist/kernel/transport/uds-event-bridge.d.ts

@@ -32,6 +32,18 @@ export interface UdsEventBridgeDeps {
     readonly parentBus: IEventBus;
     /** This process's Moleculer node ID (e.g. `'hub'` or `'agent-a1b2c3'`). */
     readonly parentNodeId: string;
+    /**
+     * D2: subscribe the bridge's cluster/parent-local → children RELAY handler to
+     * the parent bus WITHOUT registering it in the node's local-interest surface
+     * (`subscribePassthrough` from `@camstack/system`). The bridge is a conduit to
+     * forked children, not a terminal local consumer — counting its wildcard `*`
+     * subscription would make every cross-node category appear "wanted" and defeat
+     * the inbound gate. When omitted (tests / legacy callers) the bridge falls
+     * back to `parentBus.subscribe({}, …)`, which is functionally correct but
+     * counts toward local interest — acceptable only where the D2 gate is not
+     * under test.
+     */
+    readonly subscribePassthrough?: (handler: (event: SystemEvent) => void) => () => void;
 }
 /**
  * Create the parent-side UDS ↔ Moleculer event bridge.

package/dist/{manifest-python-deps-PbdHKDpj.js → manifest-python-deps-D7iR07uA.js}

@@ -3461,6 +3461,29 @@ function isHighFrequencyCategory(category) {
 	for (const pattern of RING_BUFFER_DENY_PATTERNS) if (matchesPattern(pattern, category)) return true;
 	return false;
 }
+function readMoleculerFanoutMode() {
+	const raw = process.env.CAMSTACK_MOLECULER_EVENT_FANOUT;
+	if (raw === "shadow" || raw === "broadcast") return raw;
+	return "filter";
+}
+/**
+* Does this node want to accept an inbound cross-node event in `category`?
+* The receiving-side mirror of `LocalChildRegistry.childWantsEvent`:
+*   - `broadcast` mode → always (gate disabled).
+*   - a retaining bus (hub main) → always (it serves `getRecent` + admin-ui;
+*     its interest is genuinely everything).
+*   - undeclared interest (`null`) → always (fail-open).
+*   - else the declared union must match via `matchesPattern` — the SAME
+*     function the local subscriber map-key gate uses, giving delivery parity.
+* `shadow` is handled by the caller (it counts the would-suppress but still
+* delivers), exactly like the UDS fan-out.
+*/
+function crossNodeAcceptsCategory(mode, snapshot, category) {
+	if (mode === "broadcast") return true;
+	if (snapshot.retainRecent) return true;
+	if (snapshot.interest === null) return true;
+	return snapshot.interest.some((p) => matchesPattern(p, category));
+}
 /**
 * Deliver `event` to all matching local subscribers and — ONLY on a bus that
 * opted into retention (`state.retainRecent`, i.e. the hub main process) and
@@ -3561,8 +3584,11 @@ function classifyCapRoute(capName, opts, snapshot) {
 }
 function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
 	if (nodeId === snap.hubNodeId) {
-		if (snap.hubInProcessProvides(capName)) {
-			const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		const residentProvides = snap.hubResidentProvides;
+		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
+		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
+		if (providesOnHub(capName)) {
+			const ref = getRef?.(capName) ?? null;
 			if (ref !== null) return {
 				kind: "hub-in-process",
 				capName,
@@ -3727,6 +3753,7 @@ var CapRouteResolver = class {
 	hubLocalRegistry;
 	nodeAuthority;
 	inProcessProviders;
+	hubResidentProviders;
 	capTimeoutMs;
 	snapshot;
 	constructor(deps) {
@@ -3735,6 +3762,7 @@ var CapRouteResolver = class {
 		this.hubLocalRegistry = deps.hubLocalRegistry;
 		this.nodeAuthority = deps.nodeAuthority;
 		this.inProcessProviders = deps.inProcessProviders;
+		this.hubResidentProviders = deps.hubResidentProviders;
 		this.capTimeoutMs = deps.capTimeoutMs;
 		this.snapshot = this.buildSnapshot();
 	}
@@ -3856,9 +3884,14 @@ var CapRouteResolver = class {
 		const hubLocalRegistry = this.hubLocalRegistry;
 		const nodeAuthority = this.nodeAuthority;
 		const inProcessProviders = this.inProcessProviders;
+		const hubResidentProviders = this.hubResidentProviders;
 		return {
 			hubNodeId: this.hubNodeId,
 			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			...hubResidentProviders !== void 0 ? {
+				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
+				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
+			} : {},
 			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
 			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
 			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
@@ -3977,6 +4010,37 @@ var LocalChildRegistry = class {
 		if (entry.eventPatterns === null) return true;
 		return entry.eventPatterns.some((p) => matchesPattern(p, category));
 	}
+	/**
+	* D2: this node's aggregate cross-node event interest — the UNION of every
+	* connected child's declared category patterns. Consumed by the parent's
+	* `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
+	* accepts cross-node (Moleculer) categories at least one local child wants.
+	*
+	* Returns `null` (fail-open — accept everything) when:
+	*   - NO child is currently connected (boot window before the first forked
+	*     child completes its UDS handshake, or every child has disconnected): a
+	*     node MUST NOT drop 100% of inbound cross-node events during that window,
+	*     and a child may connect imminently. This is distinct from the
+	*     declared-empty case below.
+	*   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
+	*     runner): a node cannot safely narrow its inbound set while a child's
+	*     real interest is unknown. Mirrors the per-child fail-open in
+	*     {@link childWantsEvent}, aggregated conservatively.
+	*
+	* Returns an EMPTY array only when ≥1 child is connected and EVERY connected
+	* child declared an explicit empty set — a genuine "wants nothing". Reads the
+	* live `children` map, so a child registering / disconnecting / sending
+	* `event-sub` is reflected on the next call with no extra bookkeeping.
+	*/
+	aggregateEventInterest() {
+		if (this.children.size === 0) return null;
+		const union = /* @__PURE__ */ new Set();
+		for (const entry of this.children.values()) {
+			if (entry.eventPatterns === null) return null;
+			for (const p of entry.eventPatterns) union.add(p);
+		}
+		return [...union];
+	}
 	statsFor(childId) {
 		let s = this.childEventStats.get(childId);
 		if (s === void 0) {
@@ -4749,7 +4813,7 @@ var MAX_RECENT = 512;
 *          and clears the child-event handler. Call it on process shutdown.
 */
 function createUdsEventBridge(deps) {
-	const { registry, parentBus, parentNodeId } = deps;
+	const { registry, parentBus, parentNodeId, subscribePassthrough } = deps;
 	/**
 	* In-memory set of event ids for events that originated from one of this
 	* bridge's UDS children and have already been fanned to siblings + the
@@ -4768,10 +4832,11 @@ function createUdsEventBridge(deps) {
 		}
 		parentBus.emit(event);
 	});
-	const unsubscribe = parentBus.subscribe({}, (event) => {
+	const relayHandler = (event) => {
 		if (recentlyFannedIds.has(event.id)) return;
 		registry.broadcastEventToChildren(event, parentNodeId, void 0);
-	});
+	};
+	const unsubscribe = subscribePassthrough !== void 0 ? subscribePassthrough(relayHandler) : parentBus.subscribe({}, relayHandler);
 	return () => {
 		unsubscribe();
 		registry.onChildEvent(null);
@@ -5863,6 +5928,163 @@ function getSharedBusState(broker, retainRecent = false) {
 var eventBusServiceInstalled = /* @__PURE__ */ new WeakSet();
 var brokerBusWarnTimestamps = /* @__PURE__ */ new WeakMap();
 /**
+* Per-broker node-interest oracle. Returns the FORKED-CHILD interest (the union
+* of this node's UDS children's declared category patterns), or `null` when it
+* is undeclared/unknown (a legacy child, or no forked child has connected yet)
+* → fail-open. Absent (no entry) is also fail-open: pre-D2 behaviour is
+* preserved until a node wires its interest via {@link setNodeEventInterest}.
+*
+* IMPORTANT: this oracle covers ONLY forked/UDS children. In-process
+* ('broker'-mode) subscribers on this same broker (e.g. each addon context's
+* `device.bindings-changed` cache-invalidation sub) are tracked SEPARATELY in
+* {@link brokerLocalInterest}. The gate unions BOTH so it can never starve a
+* live local subscriber of either kind.
+*/
+var brokerNodeInterest = /* @__PURE__ */ new WeakMap();
+/**
+* Per-broker IN-PROCESS subscriber interest: category pattern → live refcount.
+* Populated by `getBrokerEventBus(...).subscribe` (every in-process /
+* 'broker'-mode subscription) and decremented by its unsubscribe. Does NOT
+* include the UDS event bridge's pass-through relay subscription — that is a
+* conduit to forked children (whose real interest the oracle already reports),
+* not a genuine local consumer, so it registers via {@link subscribePassthrough}
+* which bypasses this surface. Keeping the bridge out is what lets the gate
+* actually filter (otherwise the bridge's `*` would make every category wanted).
+*/
+var brokerLocalInterest = /* @__PURE__ */ new WeakMap();
+function bumpLocalInterest(broker, pattern) {
+	let m = brokerLocalInterest.get(broker);
+	if (m === void 0) {
+		m = /* @__PURE__ */ new Map();
+		brokerLocalInterest.set(broker, m);
+	}
+	m.set(pattern, (m.get(pattern) ?? 0) + 1);
+}
+function dropLocalInterest(broker, pattern) {
+	const m = brokerLocalInterest.get(broker);
+	if (m === void 0) return;
+	const next = (m.get(pattern) ?? 0) - 1;
+	if (next <= 0) m.delete(pattern);
+	else m.set(pattern, next);
+}
+/** Snapshot of the in-process subscriber category patterns for `broker`. */
+function localSubscriberPatterns(broker) {
+	const m = brokerLocalInterest.get(broker);
+	return m === void 0 ? [] : [...m.keys()];
+}
+/**
+* Subscribe a PASS-THROUGH relay handler to the broker's shared bus WITHOUT
+* registering it in the local-interest surface. Used exclusively by the UDS
+* event bridge for its cluster/parent-local → children fan-out subscription:
+* the bridge must receive every event the gate lets through so it can relay to
+* forked children, but it is not itself a terminal consumer, so it must not
+* count toward this node's interest (a counted `*` would defeat the filter).
+* Returns an unsubscribe function.
+*/
+function subscribePassthrough(broker, handler) {
+	const state = getSharedBusState(broker);
+	const entry = {
+		filter: {},
+		categoryPattern: "*",
+		handler
+	};
+	const set = state.handlers.get("*") ?? /* @__PURE__ */ new Set();
+	set.add(entry);
+	state.handlers.set("*", set);
+	return () => {
+		state.handlers.get("*")?.delete(entry);
+	};
+}
+/** Per-broker cross-node inbound counters (delivered / would-suppress). */
+var brokerCrossNodeStats = /* @__PURE__ */ new WeakMap();
+/**
+* Install (or clear, with `null`) the per-node interest oracle consulted by the
+* `$event-bus` inbound handler to decide whether an inbound cross-node event is
+* wanted by any local subscriber on this node. The oracle is read PER-EVENT so a
+* child (un)subscribing takes effect immediately with no re-registration.
+*
+* Only non-retaining nodes (agents) meaningfully filter — a retaining bus (hub
+* main) always accepts every category (it serves `getRecent` + the admin-ui live
+* stream). Installing the oracle on the hub too is therefore harmless and keeps
+* the wiring uniform.
+*/
+function setNodeEventInterest(broker, oracle) {
+	if (oracle === null) brokerNodeInterest.delete(broker);
+	else brokerNodeInterest.set(broker, oracle);
+}
+/**
+* Cross-node inbound counters for `broker`, or `null` if no cross-node event has
+* been processed yet. Exposed for the D2 shadow burn-in + operator debug —
+* mirror of `LocalChildRegistry.getChildEventStats`.
+*/
+function getMoleculerEventStats(broker) {
+	const s = brokerCrossNodeStats.get(broker);
+	return s === void 0 ? null : {
+		delivered: s.delivered,
+		suppressed: s.suppressed
+	};
+}
+function crossNodeStatsFor(broker) {
+	let s = brokerCrossNodeStats.get(broker);
+	if (s === void 0) {
+		s = {
+			delivered: 0,
+			suppressed: 0
+		};
+		brokerCrossNodeStats.set(broker, s);
+	}
+	return s;
+}
+/**
+* Compute this node's COMBINED cross-node interest snapshot for the gate:
+*   - `retainRecent` — from the shared bus (hub main → accept everything).
+*   - `interest` — union of (a) forked-child interest (the oracle) and (b) live
+*     in-process subscriber patterns. `null` (fail-open) when the oracle reports
+*     `null` (undeclared / no forked child yet / oracle threw) — we cannot
+*     safely narrow while a forked child's real interest is unknown, and a boot
+*     window with no children yet must not drop everything.
+*
+* The oracle invocation is wrapped in try/catch and fails OPEN on throw — it
+* sits in front of the per-handler try/catch, in the subsystem that previously
+* caused an OOM, so a throwing oracle must never break inbound delivery.
+*/
+function nodeInterestSnapshot(broker) {
+	const state = getSharedBusState(broker);
+	let childInterest;
+	try {
+		const oracle = brokerNodeInterest.get(broker);
+		childInterest = oracle ? oracle() : null;
+	} catch {
+		childInterest = null;
+	}
+	if (childInterest === null) return {
+		retainRecent: state.retainRecent,
+		interest: null
+	};
+	const local = localSubscriberPatterns(broker);
+	const interest = [...new Set([...local, ...childInterest])];
+	return {
+		retainRecent: state.retainRecent,
+		interest
+	};
+}
+/**
+* Decide + account for an inbound cross-node event on `broker`. Returns whether
+* the event should be delivered to the local bus. Honours the
+* `CAMSTACK_MOLECULER_EVENT_FANOUT` mode (`mode`): in `shadow` it still delivers
+* but records the would-suppress; in `filter` it drops unwanted categories.
+* The interest is the UNION of forked-child AND in-process subscribers — the
+* gate never starves a live local subscriber of either kind.
+*/
+function acceptInboundCrossNode(broker, mode, category) {
+	const wants = crossNodeAcceptsCategory(mode, nodeInterestSnapshot(broker), category);
+	const stats = crossNodeStatsFor(broker);
+	if (!wants) stats.suppressed++;
+	const deliver = wants || mode === "shadow";
+	if (deliver) stats.delivered++;
+	return deliver;
+}
+/**
 * Register the `$event-bus` service on a broker. MUST be called BEFORE
 * `broker.start()` — Moleculer announces a service's event
 * subscriptions to remote nodes only during the discovery handshake;
@@ -5886,6 +6108,7 @@ function registerEventBusService(broker) {
 	if (eventBusServiceInstalled.has(broker)) return;
 	eventBusServiceInstalled.add(broker);
 	const bkr = broker;
+	const fanoutMode = readMoleculerFanoutMode();
 	try {
 		bkr.createService({
 			name: "$event-bus",
@@ -5893,6 +6116,7 @@ function registerEventBusService(broker) {
 				const event = ctx.params;
 				if (!event) return;
 				if (event.sourceNodeId === bkr.nodeID) return;
+				if (!acceptInboundCrossNode(broker, fanoutMode, event.category)) return;
 				deliverShared(getSharedBusState(broker), event);
 			} }
 		});
@@ -5953,8 +6177,9 @@ function getBrokerEventBus(broker, options) {
 			const set = state.handlers.get(pattern) ?? /* @__PURE__ */ new Set();
 			set.add(entry);
 			state.handlers.set(pattern, set);
+			bumpLocalInterest(broker, pattern);
 			return () => {
-				state.handlers.get(pattern)?.delete(entry);
+				if (state.handlers.get(pattern)?.delete(entry) === true) dropLocalInterest(broker, pattern);
 			};
 		},
 		getRecent(filter, limit) {
@@ -7154,6 +7379,12 @@ Object.defineProperty(exports, "getCapUsageRegistry", {
 		return getCapUsageRegistry;
 	}
 });
+Object.defineProperty(exports, "getMoleculerEventStats", {
+	enumerable: true,
+	get: function() {
+		return getMoleculerEventStats;
+	}
+});
 Object.defineProperty(exports, "getOrInitReadinessRegistry", {
 	enumerable: true,
 	get: function() {
@@ -7262,12 +7493,24 @@ Object.defineProperty(exports, "setHubConnected", {
 		return setHubConnected;
 	}
 });
+Object.defineProperty(exports, "setNodeEventInterest", {
+	enumerable: true,
+	get: function() {
+		return setNodeEventInterest;
+	}
+});
 Object.defineProperty(exports, "setWorkerNativeCapsChangeListener", {
 	enumerable: true,
 	get: function() {
 		return setWorkerNativeCapsChangeListener;
 	}
 });
+Object.defineProperty(exports, "subscribePassthrough", {
+	enumerable: true,
+	get: function() {
+		return subscribePassthrough;
+	}
+});
 Object.defineProperty(exports, "udsChildLogToWorkerEntry", {
 	enumerable: true,
 	get: function() {

package/dist/{manifest-python-deps-X00KVYHa.mjs → manifest-python-deps-hDWMDe_b.mjs}

@@ -3459,6 +3459,29 @@ function isHighFrequencyCategory(category) {
 	for (const pattern of RING_BUFFER_DENY_PATTERNS) if (matchesPattern(pattern, category)) return true;
 	return false;
 }
+function readMoleculerFanoutMode() {
+	const raw = process.env.CAMSTACK_MOLECULER_EVENT_FANOUT;
+	if (raw === "shadow" || raw === "broadcast") return raw;
+	return "filter";
+}
+/**
+* Does this node want to accept an inbound cross-node event in `category`?
+* The receiving-side mirror of `LocalChildRegistry.childWantsEvent`:
+*   - `broadcast` mode → always (gate disabled).
+*   - a retaining bus (hub main) → always (it serves `getRecent` + admin-ui;
+*     its interest is genuinely everything).
+*   - undeclared interest (`null`) → always (fail-open).
+*   - else the declared union must match via `matchesPattern` — the SAME
+*     function the local subscriber map-key gate uses, giving delivery parity.
+* `shadow` is handled by the caller (it counts the would-suppress but still
+* delivers), exactly like the UDS fan-out.
+*/
+function crossNodeAcceptsCategory(mode, snapshot, category) {
+	if (mode === "broadcast") return true;
+	if (snapshot.retainRecent) return true;
+	if (snapshot.interest === null) return true;
+	return snapshot.interest.some((p) => matchesPattern(p, category));
+}
 /**
 * Deliver `event` to all matching local subscribers and — ONLY on a bus that
 * opted into retention (`state.retainRecent`, i.e. the hub main process) and
@@ -3559,8 +3582,11 @@ function classifyCapRoute(capName, opts, snapshot) {
 }
 function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
 	if (nodeId === snap.hubNodeId) {
-		if (snap.hubInProcessProvides(capName)) {
-			const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		const residentProvides = snap.hubResidentProvides;
+		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
+		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
+		if (providesOnHub(capName)) {
+			const ref = getRef?.(capName) ?? null;
 			if (ref !== null) return {
 				kind: "hub-in-process",
 				capName,
@@ -3725,6 +3751,7 @@ var CapRouteResolver = class {
 	hubLocalRegistry;
 	nodeAuthority;
 	inProcessProviders;
+	hubResidentProviders;
 	capTimeoutMs;
 	snapshot;
 	constructor(deps) {
@@ -3733,6 +3760,7 @@ var CapRouteResolver = class {
 		this.hubLocalRegistry = deps.hubLocalRegistry;
 		this.nodeAuthority = deps.nodeAuthority;
 		this.inProcessProviders = deps.inProcessProviders;
+		this.hubResidentProviders = deps.hubResidentProviders;
 		this.capTimeoutMs = deps.capTimeoutMs;
 		this.snapshot = this.buildSnapshot();
 	}
@@ -3854,9 +3882,14 @@ var CapRouteResolver = class {
 		const hubLocalRegistry = this.hubLocalRegistry;
 		const nodeAuthority = this.nodeAuthority;
 		const inProcessProviders = this.inProcessProviders;
+		const hubResidentProviders = this.hubResidentProviders;
 		return {
 			hubNodeId: this.hubNodeId,
 			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			...hubResidentProviders !== void 0 ? {
+				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
+				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
+			} : {},
 			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
 			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
 			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
@@ -3975,6 +4008,37 @@ var LocalChildRegistry = class {
 		if (entry.eventPatterns === null) return true;
 		return entry.eventPatterns.some((p) => matchesPattern(p, category));
 	}
+	/**
+	* D2: this node's aggregate cross-node event interest — the UNION of every
+	* connected child's declared category patterns. Consumed by the parent's
+	* `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
+	* accepts cross-node (Moleculer) categories at least one local child wants.
+	*
+	* Returns `null` (fail-open — accept everything) when:
+	*   - NO child is currently connected (boot window before the first forked
+	*     child completes its UDS handshake, or every child has disconnected): a
+	*     node MUST NOT drop 100% of inbound cross-node events during that window,
+	*     and a child may connect imminently. This is distinct from the
+	*     declared-empty case below.
+	*   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
+	*     runner): a node cannot safely narrow its inbound set while a child's
+	*     real interest is unknown. Mirrors the per-child fail-open in
+	*     {@link childWantsEvent}, aggregated conservatively.
+	*
+	* Returns an EMPTY array only when ≥1 child is connected and EVERY connected
+	* child declared an explicit empty set — a genuine "wants nothing". Reads the
+	* live `children` map, so a child registering / disconnecting / sending
+	* `event-sub` is reflected on the next call with no extra bookkeeping.
+	*/
+	aggregateEventInterest() {
+		if (this.children.size === 0) return null;
+		const union = /* @__PURE__ */ new Set();
+		for (const entry of this.children.values()) {
+			if (entry.eventPatterns === null) return null;
+			for (const p of entry.eventPatterns) union.add(p);
+		}
+		return [...union];
+	}
 	statsFor(childId) {
 		let s = this.childEventStats.get(childId);
 		if (s === void 0) {
@@ -4747,7 +4811,7 @@ var MAX_RECENT = 512;
 *          and clears the child-event handler. Call it on process shutdown.
 */
 function createUdsEventBridge(deps) {
-	const { registry, parentBus, parentNodeId } = deps;
+	const { registry, parentBus, parentNodeId, subscribePassthrough } = deps;
 	/**
 	* In-memory set of event ids for events that originated from one of this
 	* bridge's UDS children and have already been fanned to siblings + the
@@ -4766,10 +4830,11 @@ function createUdsEventBridge(deps) {
 		}
 		parentBus.emit(event);
 	});
-	const unsubscribe = parentBus.subscribe({}, (event) => {
+	const relayHandler = (event) => {
 		if (recentlyFannedIds.has(event.id)) return;
 		registry.broadcastEventToChildren(event, parentNodeId, void 0);
-	});
+	};
+	const unsubscribe = subscribePassthrough !== void 0 ? subscribePassthrough(relayHandler) : parentBus.subscribe({}, relayHandler);
 	return () => {
 		unsubscribe();
 		registry.onChildEvent(null);
@@ -5861,6 +5926,163 @@ function getSharedBusState(broker, retainRecent = false) {
 var eventBusServiceInstalled = /* @__PURE__ */ new WeakSet();
 var brokerBusWarnTimestamps = /* @__PURE__ */ new WeakMap();
 /**
+* Per-broker node-interest oracle. Returns the FORKED-CHILD interest (the union
+* of this node's UDS children's declared category patterns), or `null` when it
+* is undeclared/unknown (a legacy child, or no forked child has connected yet)
+* → fail-open. Absent (no entry) is also fail-open: pre-D2 behaviour is
+* preserved until a node wires its interest via {@link setNodeEventInterest}.
+*
+* IMPORTANT: this oracle covers ONLY forked/UDS children. In-process
+* ('broker'-mode) subscribers on this same broker (e.g. each addon context's
+* `device.bindings-changed` cache-invalidation sub) are tracked SEPARATELY in
+* {@link brokerLocalInterest}. The gate unions BOTH so it can never starve a
+* live local subscriber of either kind.
+*/
+var brokerNodeInterest = /* @__PURE__ */ new WeakMap();
+/**
+* Per-broker IN-PROCESS subscriber interest: category pattern → live refcount.
+* Populated by `getBrokerEventBus(...).subscribe` (every in-process /
+* 'broker'-mode subscription) and decremented by its unsubscribe. Does NOT
+* include the UDS event bridge's pass-through relay subscription — that is a
+* conduit to forked children (whose real interest the oracle already reports),
+* not a genuine local consumer, so it registers via {@link subscribePassthrough}
+* which bypasses this surface. Keeping the bridge out is what lets the gate
+* actually filter (otherwise the bridge's `*` would make every category wanted).
+*/
+var brokerLocalInterest = /* @__PURE__ */ new WeakMap();
+function bumpLocalInterest(broker, pattern) {
+	let m = brokerLocalInterest.get(broker);
+	if (m === void 0) {
+		m = /* @__PURE__ */ new Map();
+		brokerLocalInterest.set(broker, m);
+	}
+	m.set(pattern, (m.get(pattern) ?? 0) + 1);
+}
+function dropLocalInterest(broker, pattern) {
+	const m = brokerLocalInterest.get(broker);
+	if (m === void 0) return;
+	const next = (m.get(pattern) ?? 0) - 1;
+	if (next <= 0) m.delete(pattern);
+	else m.set(pattern, next);
+}
+/** Snapshot of the in-process subscriber category patterns for `broker`. */
+function localSubscriberPatterns(broker) {
+	const m = brokerLocalInterest.get(broker);
+	return m === void 0 ? [] : [...m.keys()];
+}
+/**
+* Subscribe a PASS-THROUGH relay handler to the broker's shared bus WITHOUT
+* registering it in the local-interest surface. Used exclusively by the UDS
+* event bridge for its cluster/parent-local → children fan-out subscription:
+* the bridge must receive every event the gate lets through so it can relay to
+* forked children, but it is not itself a terminal consumer, so it must not
+* count toward this node's interest (a counted `*` would defeat the filter).
+* Returns an unsubscribe function.
+*/
+function subscribePassthrough(broker, handler) {
+	const state = getSharedBusState(broker);
+	const entry = {
+		filter: {},
+		categoryPattern: "*",
+		handler
+	};
+	const set = state.handlers.get("*") ?? /* @__PURE__ */ new Set();
+	set.add(entry);
+	state.handlers.set("*", set);
+	return () => {
+		state.handlers.get("*")?.delete(entry);
+	};
+}
+/** Per-broker cross-node inbound counters (delivered / would-suppress). */
+var brokerCrossNodeStats = /* @__PURE__ */ new WeakMap();
+/**
+* Install (or clear, with `null`) the per-node interest oracle consulted by the
+* `$event-bus` inbound handler to decide whether an inbound cross-node event is
+* wanted by any local subscriber on this node. The oracle is read PER-EVENT so a
+* child (un)subscribing takes effect immediately with no re-registration.
+*
+* Only non-retaining nodes (agents) meaningfully filter — a retaining bus (hub
+* main) always accepts every category (it serves `getRecent` + the admin-ui live
+* stream). Installing the oracle on the hub too is therefore harmless and keeps
+* the wiring uniform.
+*/
+function setNodeEventInterest(broker, oracle) {
+	if (oracle === null) brokerNodeInterest.delete(broker);
+	else brokerNodeInterest.set(broker, oracle);
+}
+/**
+* Cross-node inbound counters for `broker`, or `null` if no cross-node event has
+* been processed yet. Exposed for the D2 shadow burn-in + operator debug —
+* mirror of `LocalChildRegistry.getChildEventStats`.
+*/
+function getMoleculerEventStats(broker) {
+	const s = brokerCrossNodeStats.get(broker);
+	return s === void 0 ? null : {
+		delivered: s.delivered,
+		suppressed: s.suppressed
+	};
+}
+function crossNodeStatsFor(broker) {
+	let s = brokerCrossNodeStats.get(broker);
+	if (s === void 0) {
+		s = {
+			delivered: 0,
+			suppressed: 0
+		};
+		brokerCrossNodeStats.set(broker, s);
+	}
+	return s;
+}
+/**
+* Compute this node's COMBINED cross-node interest snapshot for the gate:
+*   - `retainRecent` — from the shared bus (hub main → accept everything).
+*   - `interest` — union of (a) forked-child interest (the oracle) and (b) live
+*     in-process subscriber patterns. `null` (fail-open) when the oracle reports
+*     `null` (undeclared / no forked child yet / oracle threw) — we cannot
+*     safely narrow while a forked child's real interest is unknown, and a boot
+*     window with no children yet must not drop everything.
+*
+* The oracle invocation is wrapped in try/catch and fails OPEN on throw — it
+* sits in front of the per-handler try/catch, in the subsystem that previously
+* caused an OOM, so a throwing oracle must never break inbound delivery.
+*/
+function nodeInterestSnapshot(broker) {
+	const state = getSharedBusState(broker);
+	let childInterest;
+	try {
+		const oracle = brokerNodeInterest.get(broker);
+		childInterest = oracle ? oracle() : null;
+	} catch {
+		childInterest = null;
+	}
+	if (childInterest === null) return {
+		retainRecent: state.retainRecent,
+		interest: null
+	};
+	const local = localSubscriberPatterns(broker);
+	const interest = [...new Set([...local, ...childInterest])];
+	return {
+		retainRecent: state.retainRecent,
+		interest
+	};
+}
+/**
+* Decide + account for an inbound cross-node event on `broker`. Returns whether
+* the event should be delivered to the local bus. Honours the
+* `CAMSTACK_MOLECULER_EVENT_FANOUT` mode (`mode`): in `shadow` it still delivers
+* but records the would-suppress; in `filter` it drops unwanted categories.
+* The interest is the UNION of forked-child AND in-process subscribers — the
+* gate never starves a live local subscriber of either kind.
+*/
+function acceptInboundCrossNode(broker, mode, category) {
+	const wants = crossNodeAcceptsCategory(mode, nodeInterestSnapshot(broker), category);
+	const stats = crossNodeStatsFor(broker);
+	if (!wants) stats.suppressed++;
+	const deliver = wants || mode === "shadow";
+	if (deliver) stats.delivered++;
+	return deliver;
+}
+/**
 * Register the `$event-bus` service on a broker. MUST be called BEFORE
 * `broker.start()` — Moleculer announces a service's event
 * subscriptions to remote nodes only during the discovery handshake;
@@ -5884,6 +6106,7 @@ function registerEventBusService(broker) {
 	if (eventBusServiceInstalled.has(broker)) return;
 	eventBusServiceInstalled.add(broker);
 	const bkr = broker;
+	const fanoutMode = readMoleculerFanoutMode();
 	try {
 		bkr.createService({
 			name: "$event-bus",
@@ -5891,6 +6114,7 @@ function registerEventBusService(broker) {
 				const event = ctx.params;
 				if (!event) return;
 				if (event.sourceNodeId === bkr.nodeID) return;
+				if (!acceptInboundCrossNode(broker, fanoutMode, event.category)) return;
 				deliverShared(getSharedBusState(broker), event);
 			} }
 		});
@@ -5951,8 +6175,9 @@ function getBrokerEventBus(broker, options) {
 			const set = state.handlers.get(pattern) ?? /* @__PURE__ */ new Set();
 			set.add(entry);
 			state.handlers.set(pattern, set);
+			bumpLocalInterest(broker, pattern);
 			return () => {
-				state.handlers.get(pattern)?.delete(entry);
+				if (state.handlers.get(pattern)?.delete(entry) === true) dropLocalInterest(broker, pattern);
 			};
 		},
 		getRecent(filter, limit) {
@@ -6852,4 +7077,4 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
-export { getWorkerNativeCapProvider as $, createUdsEventBus as A, CapRouteError as B, ipcParentLink as C, createHubCapForwardService as D, HUB_CAP_FWD_SERVICE as E, LocalChildRegistry as F, UdsLocalTransportServer as G, callWithServiceDiscovery as H, UDS_NO_ROUTE_PREFIX as I, FrameDecoder as J, SocketChannel as K, AGENT_CAP_FWD_ACTION as L, createUdsLogger as M, createUdsLoggerWithControl as N, createParentUnownedCallHandler as O, LocalChildClient as P, createBrokerDeviceManagerApi as Q, AGENT_CAP_FWD_SERVICE as R, ipcChildLink as S, HUB_CAP_FWD_ACTION as T, createLocalTransport as U, classifyCapRoute as V, UdsLocalTransportClient as W, buildNativeCapProxy as X, encodeFrame as Y, buildUdsNativeCapProxy as Z, __resetCapUsageRegistryForTests as _, resolveAddonClass as _t, getWorkerDeviceRegistry as a, NATIVE_PROVIDER_SERVICE_INFIX as at, brokerTransportLink as b, setHubConnected as c, capBareAction as ct, registerEventBusService as d, deserializeTypedArrays as dt, getWorkerNativeCapSnapshot as et, AddonDepsManager as f, serializeTypedArrays as ft, CapUsageRegistry as g, installManifestNativeDeps as gt, createHwAccelService as h, CapabilityUnavailableError as ht, createUdsAddonContext as i, validateProviderRegistrations as it, udsChildLogToWorkerEntry as j, createUdsEventBridge as k, EVENT_TOPIC_PREFIX as l, capServiceName as lt, resolveHwAccel as m, CapabilityHandle as mt, adaptBrokerToCluster as n, setWorkerNativeCapsChangeListener as nt, getOrInitReadinessRegistry as o, capActionName as ot, createKernelHwAccel as p, DeviceRegistry as pt, localEndpointPath as q, createAddonContext as r, createAddonService as rt, getOrInitReadinessRegistryForClient as s, capActionSuffix as st, installManifestPythonDeps as t, mountNativeCapService as tt, getBrokerEventBus as u, parseCapAction as ut, getCapUsageRegistry as v, localProviderLink as w, buildLinkChain as x, brokerCallForCap as y, CapRouteResolver as z };
+export { buildNativeCapProxy as $, createHubCapForwardService as A, AGENT_CAP_FWD_ACTION as B, brokerTransportLink as C, localProviderLink as D, ipcParentLink as E, createUdsLogger as F, callWithServiceDiscovery as G, CapRouteResolver as H, createUdsLoggerWithControl as I, UdsLocalTransportServer as J, createLocalTransport as K, LocalChildClient as L, createUdsEventBridge as M, createUdsEventBus as N, HUB_CAP_FWD_ACTION as O, udsChildLogToWorkerEntry as P, encodeFrame as Q, LocalChildRegistry as R, brokerCallForCap as S, ipcChildLink as T, CapRouteError as U, AGENT_CAP_FWD_SERVICE as V, classifyCapRoute as W, localEndpointPath as X, SocketChannel as Y, FrameDecoder as Z, resolveHwAccel as _, CapabilityHandle as _t, getWorkerDeviceRegistry as a, setWorkerNativeCapsChangeListener as at, __resetCapUsageRegistryForTests as b, resolveAddonClass as bt, setHubConnected as c, NATIVE_PROVIDER_SERVICE_INFIX as ct, getMoleculerEventStats as d, capBareAction as dt, buildUdsNativeCapProxy as et, registerEventBusService as f, capServiceName as ft, createKernelHwAccel as g, DeviceRegistry as gt, AddonDepsManager as h, serializeTypedArrays as ht, createUdsAddonContext as i, mountNativeCapService as it, createParentUnownedCallHandler as j, HUB_CAP_FWD_SERVICE as k, EVENT_TOPIC_PREFIX as l, capActionName as lt, subscribePassthrough as m, deserializeTypedArrays as mt, adaptBrokerToCluster as n, getWorkerNativeCapProvider as nt, getOrInitReadinessRegistry as o, createAddonService as ot, setNodeEventInterest as p, parseCapAction as pt, UdsLocalTransportClient as q, createAddonContext as r, getWorkerNativeCapSnapshot as rt, getOrInitReadinessRegistryForClient as s, validateProviderRegistrations as st, installManifestPythonDeps as t, createBrokerDeviceManagerApi as tt, getBrokerEventBus as u, capActionSuffix as ut, createHwAccelService as v, CapabilityUnavailableError as vt, buildLinkChain as w, getCapUsageRegistry as x, CapUsageRegistry as y, installManifestNativeDeps as yt, UDS_NO_ROUTE_PREFIX as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.1.20",
+  "version": "1.1.22",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",