@camstack/system 1.2.419 → 1.2.420

package/dist/index.js

@@ -15109,6 +15109,9 @@ function createBroker(config) {
 			serializer: "MsgPack",
 			transporter: new require_builtins_system_config_system_config_addon.TlsTcpTransporter({
 				port: agentListenPort,
+				tlsPort: config.agentTlsListenPort ?? 6443,
+				peerTlsPort: hubDialPort,
+				hubOnlyPeers: true,
 				maxPacketSize: 10 * 1024 * 1024,
 				useHostname,
 				debug: false,
@@ -24111,6 +24114,10 @@ function createMeshAccessMiddleware(options) {
 				const sender = senderOf(ctx);
 				if (sender === null || sender === ownNodeId) return next.call(this, ctx);
 				const verdict = authenticator.admitCall(sender, name);
+				if (verdict.verdict === "hold") return verdict.settled.then((settled) => runAdmitted.call(this, ctx, sender, settled));
+				return runAdmitted.call(this, ctx, sender, verdict);
+			};
+			function runAdmitted(ctx, sender, verdict) {
 				if (verdict.verdict === "deny") {
 					logger?.warn("mesh call refused", {
 						sender,
@@ -24122,23 +24129,119 @@ function createMeshAccessMiddleware(options) {
 				if (name === "$hub.unregisterNode" && paramNodeId(ctx.params) !== sender) return Promise.reject(new require_builtins_system_config_system_config_addon.Errors.MoleculerClientError(`node "${sender}" may unregister only itself`, 403, MESH_ACTION_FORBIDDEN_TYPE));
 				ctx.params = stripForgedIdentity(name, ctx.params);
 				return next.call(this, ctx);
-			};
+			}
 		},
 		localEvent(next, event) {
 			const name = event.name ?? "";
 			return function meshGatedEvent(ctx) {
 				const sender = senderOf(ctx);
 				if (sender === null || sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
-				if (authenticator.admitEvent(sender, name).verdict === "deny") {
-					noteDroppedEvent(sender, name);
-					return Promise.resolve();
-				}
-				return Promise.resolve(next.call(this, ctx));
+				const verdict = authenticator.admitEvent(sender, name);
+				const deliver = (settled) => {
+					if (settled.verdict === "deny") {
+						noteDroppedEvent(sender, name);
+						return Promise.resolve();
+					}
+					return Promise.resolve(next.call(this, ctx));
+				};
+				return verdict.verdict === "hold" ? verdict.settled.then(deliver) : deliver(verdict);
 			};
 		}
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-join-hold.ts
+var DEFAULT_MESH_JOIN_MAX_HELD = 1e3;
+var DEFAULT_MESH_JOIN_MAX_HOLD_MS = 15e3;
+var MeshJoinHold = class {
+	opts;
+	waiters = [];
+	firstHeldAt = null;
+	overflow = 0;
+	timer = null;
+	/** Holding is open while a join is in flight; closed after a decision or the bound. */
+	open = true;
+	now;
+	constructor(opts) {
+		this.opts = opts;
+		this.now = opts.now ?? Date.now;
+	}
+	/** Whether a request arriving now would be held (a join is in flight). */
+	get holding() {
+		return this.open;
+	}
+	/** How many requests wait right now. */
+	get size() {
+		return this.waiters.length;
+	}
+	/** A join started: hold again. */
+	reopen() {
+		this.open = true;
+	}
+	/** Hold one request; `null` when holding is closed (the caller refuses it). */
+	hold(kind) {
+		if (!this.open) return null;
+		if (this.waiters.length >= (this.opts.maxHeld ?? 1e3)) {
+			this.overflow++;
+			return {
+				verdict: "hold",
+				settled: Promise.resolve(this.refusal("the hold before the mesh join is full"))
+			};
+		}
+		if (this.firstHeldAt === null) {
+			this.firstHeldAt = this.now();
+			this.timer = setTimeout(() => this.refuse("bound"), this.opts.maxHoldMs ?? 15e3);
+			this.timer.unref?.();
+		}
+		return {
+			verdict: "hold",
+			settled: new Promise((resolve) => {
+				this.waiters.push({
+					kind,
+					resolve
+				});
+			})
+		};
+	}
+	/** The join proved the hub: deliver everything held, in order. */
+	release() {
+		this.open = false;
+		this.settle({ verdict: "allow" }, "delivered", "authenticated");
+	}
+	/** The join failed, or the bound ran out: refuse everything held. */
+	refuse(reason) {
+		this.open = false;
+		this.settle(this.refusal(`the join ended "${reason}"`), "refused", reason);
+	}
+	refusal(why) {
+		return {
+			verdict: "deny",
+			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+			message: `"${this.opts.hubNodeId}" sent this before the mesh join settled, and ${why}`
+		};
+	}
+	settle(verdict, outcome, reason) {
+		if (this.timer !== null) clearTimeout(this.timer);
+		this.timer = null;
+		const waiters = this.waiters;
+		const overflow = this.overflow;
+		const firstHeldAt = this.firstHeldAt;
+		this.waiters = [];
+		this.overflow = 0;
+		this.firstHeldAt = null;
+		if (waiters.length === 0 && overflow === 0) return;
+		for (const w of waiters) w.resolve(verdict);
+		this.opts.onReport?.({
+			outcome,
+			reason,
+			events: waiters.filter((w) => w.kind === "event").length,
+			calls: waiters.filter((w) => w.kind === "call").length,
+			overflow,
+			heldForMs: firstHeldAt === null ? 0 : this.now() - firstHeldAt
+		});
+	}
+};
+//#endregion
 //#region src/kernel/moleculer/agent-mesh-authenticator.ts
 /** The child's register action on its parent agent. */
 var AGENT_REGISTER_NODE_ACTION = "$agent.registerNode";
@@ -24158,10 +24261,22 @@ var AgentMeshAuthenticator = class {
 	nodes = /* @__PURE__ */ new Map();
 	hubNodeId;
 	now;
+	hold;
 	constructor(deps) {
 		this.deps = deps;
 		this.hubNodeId = deps.hubNodeId ?? DEFAULT_HUB_NODE_ID;
 		this.now = deps.now ?? Date.now;
+		this.hold = new MeshJoinHold({
+			hubNodeId: this.hubNodeId,
+			now: this.now,
+			...deps.maxHeld !== void 0 ? { maxHeld: deps.maxHeld } : {},
+			...deps.maxHoldMs !== void 0 ? { maxHoldMs: deps.maxHoldMs } : {},
+			...deps.onHoldReport !== void 0 ? { onReport: deps.onHoldReport } : {}
+		});
+	}
+	/** How many of the hub's requests wait for the join right now. */
+	heldCount() {
+		return this.hold.size;
 	}
 	/** Current mode: secret configured → enforce; else tolerate (upgrade path). */
 	mode() {
@@ -24175,9 +24290,16 @@ var AgentMeshAuthenticator = class {
 	noteHubJoinState(state) {
 		if (state === "authenticated") {
 			this.record(this.hubNodeId, "authenticated");
+			this.hold.release();
+			return;
+		}
+		if (state === "pending") {
+			this.forget(this.hubNodeId);
+			this.hold.reopen();
 			return;
 		}
-		if (state === "secret-mismatch" || state === "hub-unverified" || state === "pending") this.forget(this.hubNodeId);
+		if (state === "secret-mismatch" || state === "hub-unverified") this.forget(this.hubNodeId);
+		this.hold.refuse(state);
 	}
 	/** A child's `$agent.registerNode` was accepted (secret hash matched or none required). */
 	noteChildRegistered(sender, proof = "authenticated") {
@@ -24196,11 +24318,11 @@ var AgentMeshAuthenticator = class {
 			message: `"${action}" is not callable from another node (caller "${sender}")`
 		};
 		if (action === "$agent.registerNode" && isOwnChildNodeId(this.deps.ownNodeId, sender)) return { verdict: "allow" };
-		return this.admitSender(sender, action);
+		return this.admitSender(sender, action, "call");
 	}
 	admitEvent(sender, eventName) {
 		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
-		return this.admitSender(sender, `event:${eventName}`);
+		return this.admitSender(sender, `event:${eventName}`, "event");
 	}
 	stateOf(nodeId) {
 		return this.nodes.get(nodeId)?.state ?? "unauthenticated";
@@ -24208,14 +24330,20 @@ var AgentMeshAuthenticator = class {
 	authenticatedNodeIds() {
 		return [...this.nodes].filter(([, r]) => r.state === "authenticated").map(([id]) => id);
 	}
-	admitSender(sender, what) {
+	admitSender(sender, what, kind) {
 		const state = this.stateOf(sender);
 		if (state === "authenticated" || state === "legacy") return { verdict: "allow" };
-		if (this.mode() === "enforced") return {
-			verdict: "deny",
-			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-			message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
-		};
+		if (this.mode() === "enforced") {
+			if (sender === this.hubNodeId) {
+				const held = this.hold.hold(kind);
+				if (held !== null) return held;
+			}
+			return {
+				verdict: "deny",
+				errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+				message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
+			};
+		}
 		if (!this.nodes.has(sender)) {
 			this.record(sender, "unauthenticated");
 			this.deps.onTolerated?.(sender, what);
@@ -24235,6 +24363,40 @@ var AgentMeshAuthenticator = class {
 	}
 };
 //#endregion
+//#region src/kernel/moleculer/agent-event-scope.ts
+/** Moleculer's EVENT packet type (`packets.PACKET_EVENT`). */
+var PACKET_EVENT = "EVENT";
+/** Is this an event packet addressed to a node other than the hub? */
+function isPeerEventPacket(packet, hubNodeId) {
+	return packet.type === PACKET_EVENT && packet.target !== null && packet.target !== hubNodeId;
+}
+function createAgentEventScope(opts) {
+	let toHub = 0;
+	const withheld = /* @__PURE__ */ new Map();
+	const gate = (next) => function agentEventScoped(packet) {
+		if (packet.type !== PACKET_EVENT) return next(packet);
+		if (!isPeerEventPacket(packet, opts.hubNodeId)) {
+			if (packet.target === opts.hubNodeId) toHub++;
+			return next(packet);
+		}
+		const peer = packet.target ?? "";
+		const prev = withheld.get(peer) ?? 0;
+		withheld.set(peer, prev + 1);
+		if (prev === 0) opts.log?.(`mesh events: not sending events to node "${peer}" — an agent's events go to the hub only (D848)`);
+		return Promise.resolve();
+	};
+	return {
+		middleware: {
+			name: "CamstackAgentEventScope",
+			transitPublish: gate
+		},
+		stats: () => ({
+			toHub,
+			withheld: Object.fromEntries(withheld)
+		})
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-join-client.ts
 /** States in which a call to the hub is refused locally. */
 var BLOCKING = new Set(["secret-mismatch", "hub-unverified"]);
@@ -26713,6 +26875,8 @@ exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DEFAULT_HUB_TLS_TCP_PORT = require_constants.DEFAULT_HUB_TLS_TCP_PORT;
 exports.DEFAULT_LAN_HTTP_PORT = require_tls.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
+exports.DEFAULT_MESH_JOIN_MAX_HELD = DEFAULT_MESH_JOIN_MAX_HELD;
+exports.DEFAULT_MESH_JOIN_MAX_HOLD_MS = DEFAULT_MESH_JOIN_MAX_HOLD_MS;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
 exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -26786,11 +26950,13 @@ exports.MESH_JOIN_CHALLENGE_TTL_MS = MESH_JOIN_CHALLENGE_TTL_MS;
 exports.MESH_JOIN_PROTOCOL = MESH_JOIN_PROTOCOL;
 exports.MESH_NODE_UNAUTHENTICATED_TYPE = MESH_NODE_UNAUTHENTICATED_TYPE;
 exports.MESH_QUEUE_TOP_N = MESH_QUEUE_TOP_N;
+exports.MESH_TLS_PORT_HELLO_FIELD = require_builtins_system_config_system_config_addon.MESH_TLS_PORT_HELLO_FIELD;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
 exports.MeshAuthenticator = MeshAuthenticator;
 exports.MeshCaKeeper = require_builtins_system_config_system_config_addon.MeshCaKeeper;
 exports.MeshCrl = require_builtins_system_config_system_config_addon.MeshCrl;
 exports.MeshJoinClient = MeshJoinClient;
+exports.MeshJoinHold = MeshJoinHold;
 exports.ModelDownloadService = require_custom_action_registry.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = NATIVE_PROVIDER_SERVICE_INFIX;
 exports.NATIVE_SCAN_DEPTH = NATIVE_SCAN_DEPTH;
@@ -26919,6 +27085,7 @@ exports.createAddonContext = createAddonContext;
 exports.createAddonDataPlaneFacility = createAddonDataPlaneFacility;
 exports.createAddonPeerBytesFacility = createAddonPeerBytesFacility;
 exports.createAddonService = createAddonService;
+exports.createAgentEventScope = createAgentEventScope;
 exports.createArrayBufferCensusGate = createArrayBufferCensusGate;
 exports.createAuthenticatedFileServer = require_custom_action_registry.createAuthenticatedFileServer;
 exports.createBroker = createBroker;
@@ -27095,6 +27262,7 @@ exports.isInfraCapability = isInfraCapability;
 exports.isMeshAuthMode = require_builtins_system_config_system_config_addon.isMeshAuthMode;
 exports.isModelDownloaded = require_custom_action_registry.isModelDownloaded;
 exports.isOwnChildNodeId = isOwnChildNodeId;
+exports.isPeerEventPacket = isPeerEventPacket;
 exports.isRemoteForbiddenAction = isRemoteForbiddenAction;
 exports.isRemoteForbiddenOnAgent = isRemoteForbiddenOnAgent;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;

package/dist/index.mjs

@@ -26,14 +26,14 @@ import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-BeQWXybC.mjs";
-import { A as AGENT_UI_UNLOCK_VERSION, B as parseMeshAuthMode, C as generateMeshKeyPair, D as AGENT_DASHBOARD_ORIGINS_FIELD, E as loadMeshCa, F as verifyAgentUiUnlockTicket, G as createCidrMatcher, H as setProcessMeshAuthMode, I as MESH_AUTH_MODE_FIELD, J as readCidrSetting, K as normalizeIp, L as getProcessMeshAuthMode, M as isAllowedAgentDashboardReturnTo, N as mintAgentUiUnlockTicket, O as AGENT_UI_UNLOCK_DOMAIN, P as parseAgentDashboardOrigins, R as getProcessMeshAuthStatus, S as generateMeshCa, SystemConfigAddon, T as issueMeshLeafFromCsr, U as setProcessMeshAuthStatusSource, V as requestProcessMeshEnforcement, W as setProcessMeshEnforcer, _ as requireProcessMeshCa, a as setProcessMeshTlsEnabler, b as createMeshCsrPem, c as mintMeshJoinToken, d as getProcessNodeMeshTransport, f as setProcessMeshPeerTransportLookup, g as getProcessMeshCaState, h as MeshCaKeeper, i as ServiceBroker, j as UnlockTicketJtiStore, k as AGENT_UI_UNLOCK_TTL_MS, l as processJoinTokenJtiStore, m as processMeshCrl, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCrl, q as parseCidrList, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as caFingerprint, w as issueMeshLeafForNode, x as exportMeshPrivateKeyPem, y as caFingerprintCompact, z as isMeshAuthMode } from "./builtins/system-config/system-config.addon.mjs";
+import { A as AGENT_UI_UNLOCK_TTL_MS, B as isMeshAuthMode, C as generateMeshCa, D as loadMeshCa, E as issueMeshLeafFromCsr, F as parseAgentDashboardOrigins, G as setProcessMeshEnforcer, H as requestProcessMeshEnforcement, I as verifyAgentUiUnlockTicket, J as parseCidrList, K as createCidrMatcher, L as MESH_AUTH_MODE_FIELD, M as UnlockTicketJtiStore, N as isAllowedAgentDashboardReturnTo, O as AGENT_DASHBOARD_ORIGINS_FIELD, P as mintAgentUiUnlockTicket, R as getProcessMeshAuthMode, S as exportMeshPrivateKeyPem, SystemConfigAddon, T as issueMeshLeafForNode, U as setProcessMeshAuthMode, V as parseMeshAuthMode, W as setProcessMeshAuthStatusSource, Y as readCidrSetting, _ as getProcessMeshCaState, a as ServiceBroker, b as caFingerprintCompact, c as JoinTokenJtiStore, d as verifyMeshJoinToken, f as getProcessNodeMeshTransport, g as MeshCaKeeper, h as processMeshCrl, i as Errors, j as AGENT_UI_UNLOCK_VERSION, k as AGENT_UI_UNLOCK_DOMAIN, l as mintMeshJoinToken, m as MeshCrl, n as MESH_TLS_PORT_HELLO_FIELD, o as setProcessMeshTlsEnabler, p as setProcessMeshPeerTransportLookup, q as normalizeIp, r as TlsTcpTransporter, s as enrollMeshNode, u as processJoinTokenJtiStore, v as requireProcessMeshCa, w as generateMeshKeyPair, x as createMeshCsrPem, y as caFingerprint, z as getProcessMeshAuthStatus } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-gGHgAZsz.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-Bt65Em24.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -15106,6 +15106,9 @@ function createBroker(config) {
 			serializer: "MsgPack",
 			transporter: new TlsTcpTransporter({
 				port: agentListenPort,
+				tlsPort: config.agentTlsListenPort ?? 6443,
+				peerTlsPort: hubDialPort,
+				hubOnlyPeers: true,
 				maxPacketSize: 10 * 1024 * 1024,
 				useHostname,
 				debug: false,
@@ -24108,6 +24111,10 @@ function createMeshAccessMiddleware(options) {
 				const sender = senderOf(ctx);
 				if (sender === null || sender === ownNodeId) return next.call(this, ctx);
 				const verdict = authenticator.admitCall(sender, name);
+				if (verdict.verdict === "hold") return verdict.settled.then((settled) => runAdmitted.call(this, ctx, sender, settled));
+				return runAdmitted.call(this, ctx, sender, verdict);
+			};
+			function runAdmitted(ctx, sender, verdict) {
 				if (verdict.verdict === "deny") {
 					logger?.warn("mesh call refused", {
 						sender,
@@ -24119,23 +24126,119 @@ function createMeshAccessMiddleware(options) {
 				if (name === "$hub.unregisterNode" && paramNodeId(ctx.params) !== sender) return Promise.reject(new Errors.MoleculerClientError(`node "${sender}" may unregister only itself`, 403, MESH_ACTION_FORBIDDEN_TYPE));
 				ctx.params = stripForgedIdentity(name, ctx.params);
 				return next.call(this, ctx);
-			};
+			}
 		},
 		localEvent(next, event) {
 			const name = event.name ?? "";
 			return function meshGatedEvent(ctx) {
 				const sender = senderOf(ctx);
 				if (sender === null || sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
-				if (authenticator.admitEvent(sender, name).verdict === "deny") {
-					noteDroppedEvent(sender, name);
-					return Promise.resolve();
-				}
-				return Promise.resolve(next.call(this, ctx));
+				const verdict = authenticator.admitEvent(sender, name);
+				const deliver = (settled) => {
+					if (settled.verdict === "deny") {
+						noteDroppedEvent(sender, name);
+						return Promise.resolve();
+					}
+					return Promise.resolve(next.call(this, ctx));
+				};
+				return verdict.verdict === "hold" ? verdict.settled.then(deliver) : deliver(verdict);
 			};
 		}
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-join-hold.ts
+var DEFAULT_MESH_JOIN_MAX_HELD = 1e3;
+var DEFAULT_MESH_JOIN_MAX_HOLD_MS = 15e3;
+var MeshJoinHold = class {
+	opts;
+	waiters = [];
+	firstHeldAt = null;
+	overflow = 0;
+	timer = null;
+	/** Holding is open while a join is in flight; closed after a decision or the bound. */
+	open = true;
+	now;
+	constructor(opts) {
+		this.opts = opts;
+		this.now = opts.now ?? Date.now;
+	}
+	/** Whether a request arriving now would be held (a join is in flight). */
+	get holding() {
+		return this.open;
+	}
+	/** How many requests wait right now. */
+	get size() {
+		return this.waiters.length;
+	}
+	/** A join started: hold again. */
+	reopen() {
+		this.open = true;
+	}
+	/** Hold one request; `null` when holding is closed (the caller refuses it). */
+	hold(kind) {
+		if (!this.open) return null;
+		if (this.waiters.length >= (this.opts.maxHeld ?? 1e3)) {
+			this.overflow++;
+			return {
+				verdict: "hold",
+				settled: Promise.resolve(this.refusal("the hold before the mesh join is full"))
+			};
+		}
+		if (this.firstHeldAt === null) {
+			this.firstHeldAt = this.now();
+			this.timer = setTimeout(() => this.refuse("bound"), this.opts.maxHoldMs ?? 15e3);
+			this.timer.unref?.();
+		}
+		return {
+			verdict: "hold",
+			settled: new Promise((resolve) => {
+				this.waiters.push({
+					kind,
+					resolve
+				});
+			})
+		};
+	}
+	/** The join proved the hub: deliver everything held, in order. */
+	release() {
+		this.open = false;
+		this.settle({ verdict: "allow" }, "delivered", "authenticated");
+	}
+	/** The join failed, or the bound ran out: refuse everything held. */
+	refuse(reason) {
+		this.open = false;
+		this.settle(this.refusal(`the join ended "${reason}"`), "refused", reason);
+	}
+	refusal(why) {
+		return {
+			verdict: "deny",
+			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+			message: `"${this.opts.hubNodeId}" sent this before the mesh join settled, and ${why}`
+		};
+	}
+	settle(verdict, outcome, reason) {
+		if (this.timer !== null) clearTimeout(this.timer);
+		this.timer = null;
+		const waiters = this.waiters;
+		const overflow = this.overflow;
+		const firstHeldAt = this.firstHeldAt;
+		this.waiters = [];
+		this.overflow = 0;
+		this.firstHeldAt = null;
+		if (waiters.length === 0 && overflow === 0) return;
+		for (const w of waiters) w.resolve(verdict);
+		this.opts.onReport?.({
+			outcome,
+			reason,
+			events: waiters.filter((w) => w.kind === "event").length,
+			calls: waiters.filter((w) => w.kind === "call").length,
+			overflow,
+			heldForMs: firstHeldAt === null ? 0 : this.now() - firstHeldAt
+		});
+	}
+};
+//#endregion
 //#region src/kernel/moleculer/agent-mesh-authenticator.ts
 /** The child's register action on its parent agent. */
 var AGENT_REGISTER_NODE_ACTION = "$agent.registerNode";
@@ -24155,10 +24258,22 @@ var AgentMeshAuthenticator = class {
 	nodes = /* @__PURE__ */ new Map();
 	hubNodeId;
 	now;
+	hold;
 	constructor(deps) {
 		this.deps = deps;
 		this.hubNodeId = deps.hubNodeId ?? DEFAULT_HUB_NODE_ID;
 		this.now = deps.now ?? Date.now;
+		this.hold = new MeshJoinHold({
+			hubNodeId: this.hubNodeId,
+			now: this.now,
+			...deps.maxHeld !== void 0 ? { maxHeld: deps.maxHeld } : {},
+			...deps.maxHoldMs !== void 0 ? { maxHoldMs: deps.maxHoldMs } : {},
+			...deps.onHoldReport !== void 0 ? { onReport: deps.onHoldReport } : {}
+		});
+	}
+	/** How many of the hub's requests wait for the join right now. */
+	heldCount() {
+		return this.hold.size;
 	}
 	/** Current mode: secret configured → enforce; else tolerate (upgrade path). */
 	mode() {
@@ -24172,9 +24287,16 @@ var AgentMeshAuthenticator = class {
 	noteHubJoinState(state) {
 		if (state === "authenticated") {
 			this.record(this.hubNodeId, "authenticated");
+			this.hold.release();
+			return;
+		}
+		if (state === "pending") {
+			this.forget(this.hubNodeId);
+			this.hold.reopen();
 			return;
 		}
-		if (state === "secret-mismatch" || state === "hub-unverified" || state === "pending") this.forget(this.hubNodeId);
+		if (state === "secret-mismatch" || state === "hub-unverified") this.forget(this.hubNodeId);
+		this.hold.refuse(state);
 	}
 	/** A child's `$agent.registerNode` was accepted (secret hash matched or none required). */
 	noteChildRegistered(sender, proof = "authenticated") {
@@ -24193,11 +24315,11 @@ var AgentMeshAuthenticator = class {
 			message: `"${action}" is not callable from another node (caller "${sender}")`
 		};
 		if (action === "$agent.registerNode" && isOwnChildNodeId(this.deps.ownNodeId, sender)) return { verdict: "allow" };
-		return this.admitSender(sender, action);
+		return this.admitSender(sender, action, "call");
 	}
 	admitEvent(sender, eventName) {
 		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
-		return this.admitSender(sender, `event:${eventName}`);
+		return this.admitSender(sender, `event:${eventName}`, "event");
 	}
 	stateOf(nodeId) {
 		return this.nodes.get(nodeId)?.state ?? "unauthenticated";
@@ -24205,14 +24327,20 @@ var AgentMeshAuthenticator = class {
 	authenticatedNodeIds() {
 		return [...this.nodes].filter(([, r]) => r.state === "authenticated").map(([id]) => id);
 	}
-	admitSender(sender, what) {
+	admitSender(sender, what, kind) {
 		const state = this.stateOf(sender);
 		if (state === "authenticated" || state === "legacy") return { verdict: "allow" };
-		if (this.mode() === "enforced") return {
-			verdict: "deny",
-			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-			message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
-		};
+		if (this.mode() === "enforced") {
+			if (sender === this.hubNodeId) {
+				const held = this.hold.hold(kind);
+				if (held !== null) return held;
+			}
+			return {
+				verdict: "deny",
+				errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+				message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
+			};
+		}
 		if (!this.nodes.has(sender)) {
 			this.record(sender, "unauthenticated");
 			this.deps.onTolerated?.(sender, what);
@@ -24232,6 +24360,40 @@ var AgentMeshAuthenticator = class {
 	}
 };
 //#endregion
+//#region src/kernel/moleculer/agent-event-scope.ts
+/** Moleculer's EVENT packet type (`packets.PACKET_EVENT`). */
+var PACKET_EVENT = "EVENT";
+/** Is this an event packet addressed to a node other than the hub? */
+function isPeerEventPacket(packet, hubNodeId) {
+	return packet.type === PACKET_EVENT && packet.target !== null && packet.target !== hubNodeId;
+}
+function createAgentEventScope(opts) {
+	let toHub = 0;
+	const withheld = /* @__PURE__ */ new Map();
+	const gate = (next) => function agentEventScoped(packet) {
+		if (packet.type !== PACKET_EVENT) return next(packet);
+		if (!isPeerEventPacket(packet, opts.hubNodeId)) {
+			if (packet.target === opts.hubNodeId) toHub++;
+			return next(packet);
+		}
+		const peer = packet.target ?? "";
+		const prev = withheld.get(peer) ?? 0;
+		withheld.set(peer, prev + 1);
+		if (prev === 0) opts.log?.(`mesh events: not sending events to node "${peer}" — an agent's events go to the hub only (D848)`);
+		return Promise.resolve();
+	};
+	return {
+		middleware: {
+			name: "CamstackAgentEventScope",
+			transitPublish: gate
+		},
+		stats: () => ({
+			toHub,
+			withheld: Object.fromEntries(withheld)
+		})
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-join-client.ts
 /** States in which a call to the hub is refused locally. */
 var BLOCKING = new Set(["secret-mismatch", "hub-unverified"]);
@@ -26647,4 +26809,4 @@ var LifecycleJobEngine = class {
 */
 var CAP_METHOD_NOT_IMPLEMENTED = "CAP_METHOD_NOT_IMPLEMENTED";
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };