npm - @camstack/server - Versions diffs - 0.2.2 → 1.0.1 - Mend

@camstack/server 0.2.2 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (234) hide show

package/{src/agent-status-page.ts → dist/agent-status-page.js} +30 -45
package/dist/api/addon-upload.js +441 -0
package/dist/api/addons-custom.router.js +91 -0
package/dist/api/auth-whoami.js +55 -0
package/dist/api/bridge-addons.router.js +109 -0
package/dist/api/capabilities.router.js +229 -0
package/dist/api/core/addon-settings.router.js +117 -0
package/dist/api/core/agents.router.js +73 -0
package/dist/api/core/auth.router.js +286 -0
package/dist/api/core/bulk-update-coordinator.js +229 -0
package/dist/api/core/cap-providers.js +1124 -0
package/dist/api/core/capabilities.router.js +138 -0
package/dist/api/core/collection-preference.js +17 -0
package/dist/api/core/event-bus-proxy.router.js +45 -0
package/dist/api/core/hwaccel.router.js +91 -0
package/dist/api/core/live-events.router.js +61 -0
package/dist/api/core/logs.router.js +172 -0
package/dist/api/core/notifications.router.js +67 -0
package/dist/api/core/repl.router.js +35 -0
package/dist/api/core/settings-backend.router.js +121 -0
package/dist/api/core/stream-probe.router.js +58 -0
package/dist/api/core/system-events.router.js +100 -0
package/dist/api/health/health.routes.js +68 -0
package/{src/api/oauth2/consent-page.ts → dist/api/oauth2/consent-page.js} +11 -20
package/dist/api/oauth2/oauth2-routes.js +219 -0
package/dist/api/trpc/cap-mount-helpers.js +194 -0
package/dist/api/trpc/cap-route-error-formatter.js +133 -0
package/dist/api/trpc/client-ip.js +147 -0
package/dist/api/trpc/core-cap-bridge.js +115 -0
package/dist/api/trpc/generated-cap-mounts.js +388 -0
package/dist/api/trpc/generated-cap-routers.js +7635 -0
package/dist/api/trpc/scope-access.js +93 -0
package/dist/api/trpc/trpc.context.js +184 -0
package/dist/api/trpc/trpc.middleware.js +139 -0
package/dist/api/trpc/trpc.router.js +188 -0
package/dist/auth/session-cookie.js +47 -0
package/dist/boot/boot-config.js +241 -0
package/dist/boot/integration-id-backfill.js +76 -0
package/dist/boot/post-boot.service.js +85 -0
package/dist/core/addon/addon-call-gateway.js +99 -0
package/dist/core/addon/addon-package.service.js +1560 -0
package/dist/core/addon/addon-registry.service.js +2739 -0
package/{src/core/addon/addon-row-manifest.ts → dist/core/addon/addon-row-manifest.js} +5 -5
package/dist/core/addon/addon-search.service.js +62 -0
package/dist/core/addon/addon-settings-provider.js +102 -0
package/dist/core/addon/addon.tokens.js +5 -0
package/dist/core/addon-bridge/addon-bridge.service.js +145 -0
package/dist/core/addon-pages/addon-pages.service.js +107 -0
package/dist/core/addon-widgets/addon-widgets.service.js +120 -0
package/dist/core/agent/agent-registry.service.js +477 -0
package/dist/core/auth/auth.service.js +10 -0
package/dist/core/capability/capability.service.js +58 -0
package/dist/core/config/config.schema.js +7 -0
package/dist/core/config/config.service.js +10 -0
package/dist/core/events/event-bus.service.js +83 -0
package/dist/core/feature/feature.service.js +10 -0
package/dist/core/lifecycle/lifecycle-state-machine.js +6 -0
package/dist/core/logging/log-ring-buffer.js +6 -0
package/dist/core/logging/logging.service.js +130 -0
package/dist/core/logging/scoped-logger.js +6 -0
package/dist/core/moleculer/cap-call-fn.js +50 -0
package/dist/core/moleculer/cap-route-authority.js +122 -0
package/dist/core/moleculer/moleculer.service.js +898 -0
package/dist/core/network/network-quality.service.js +7 -0
package/dist/core/notification/notification-wrapper.service.js +33 -0
package/dist/core/notification/toast-wrapper.service.js +25 -0
package/dist/core/provider/provider.tokens.js +4 -0
package/dist/core/repl/repl-engine.service.js +140 -0
package/dist/core/storage/fs-storage-backend.js +6 -0
package/dist/core/storage/storage-location-manager.js +6 -0
package/dist/core/storage/storage.service.js +7 -0
package/dist/core/streaming/stream-probe.service.js +209 -0
package/dist/core/topology/topology-emitter.service.js +106 -0
package/dist/launcher.js +325 -0
package/dist/main.js +1098 -0
package/dist/manual-boot.js +227 -0
package/package.json +5 -1
package/src/__tests__/addon-install-e2e.test.ts +0 -74
package/src/__tests__/addon-pages-e2e.test.ts +0 -200
package/src/__tests__/addon-route-session.test.ts +0 -17
package/src/__tests__/addon-settings-router.spec.ts +0 -67
package/src/__tests__/addon-upload.spec.ts +0 -475
package/src/__tests__/agent-registry.spec.ts +0 -179
package/src/__tests__/agent-status-page.spec.ts +0 -82
package/src/__tests__/auth-session-cookie.test.ts +0 -48
package/src/__tests__/bulk-update-coordinator.spec.ts +0 -303
package/src/__tests__/cap-ownership-authority.spec.ts +0 -431
package/src/__tests__/cap-providers/cap-providers-location-import.spec.ts +0 -206
package/src/__tests__/cap-providers/cap-usage-graph.spec.ts +0 -37
package/src/__tests__/cap-providers/compute-topology-categories.spec.ts +0 -110
package/src/__tests__/cap-providers/integrations-delete-cascade.spec.ts +0 -292
package/src/__tests__/cap-providers-bulk-update.spec.ts +0 -408
package/src/__tests__/cap-route-adapter.spec.ts +0 -302
package/src/__tests__/cap-routers/_meta.spec.ts +0 -199
package/src/__tests__/cap-routers/addon-settings.router.spec.ts +0 -115
package/src/__tests__/cap-routers/broker-routing.router.spec.ts +0 -177
package/src/__tests__/cap-routers/cap-route-error-formatter.spec.ts +0 -125
package/src/__tests__/cap-routers/capabilities-node.spec.ts +0 -68
package/src/__tests__/cap-routers/device-link-overlay.spec.ts +0 -137
package/src/__tests__/cap-routers/device-manager-aggregate.router.spec.ts +0 -194
package/src/__tests__/cap-routers/harness.ts +0 -163
package/src/__tests__/cap-routers/metrics-provider.router.spec.ts +0 -133
package/src/__tests__/cap-routers/null-provider-guard.spec.ts +0 -64
package/src/__tests__/cap-routers/pipeline-executor.router.spec.ts +0 -159
package/src/__tests__/cap-routers/settings-store.router.spec.ts +0 -291
package/src/__tests__/capability-e2e.test.ts +0 -384
package/src/__tests__/cli-e2e.test.ts +0 -150
package/src/__tests__/core-cap-bridge.spec.ts +0 -91
package/src/__tests__/dev-bootstrap-shm-ring.spec.ts +0 -40
package/src/__tests__/device-settings-contribution-dispatch.spec.ts +0 -280
package/src/__tests__/embedded-deps-e2e.test.ts +0 -125
package/src/__tests__/event-bus-proxy-router.spec.ts +0 -75
package/src/__tests__/fixtures/mock-analysis-addon-a.ts +0 -37
package/src/__tests__/fixtures/mock-analysis-addon-b.ts +0 -37
package/src/__tests__/fixtures/mock-log-addon.ts +0 -37
package/src/__tests__/fixtures/mock-storage-addon.ts +0 -40
package/src/__tests__/framework-allowlist.spec.ts +0 -96
package/src/__tests__/framework-installer-defer-restart.spec.ts +0 -165
package/src/__tests__/https-e2e.test.ts +0 -124
package/src/__tests__/lifecycle-e2e.test.ts +0 -189
package/src/__tests__/live-events-subscription.spec.ts +0 -149
package/src/__tests__/moleculer/uds-readiness.spec.ts +0 -150
package/src/__tests__/moleculer/uds-topology.spec.ts +0 -418
package/src/__tests__/moleculer/uds-unowned-call.spec.ts +0 -383
package/src/__tests__/moleculer-register-node-idempotency.spec.ts +0 -273
package/src/__tests__/native-cap-route.spec.ts +0 -427
package/src/__tests__/oauth2-account-linking.spec.ts +0 -867
package/src/__tests__/post-boot-restart.spec.ts +0 -161
package/src/__tests__/singleton-contention.test.ts +0 -499
package/src/__tests__/streaming-diagnostic.test.ts +0 -615
package/src/__tests__/streaming-scale.test.ts +0 -314
package/src/__tests__/uds-addon-call-wiring.spec.ts +0 -242
package/src/__tests__/uds-log-ingest.spec.ts +0 -183
package/src/api/__tests__/addons-custom.spec.ts +0 -148
package/src/api/__tests__/capabilities.router.test.ts +0 -56
package/src/api/addon-upload.ts +0 -529
package/src/api/addons-custom.router.ts +0 -101
package/src/api/auth-whoami.ts +0 -101
package/src/api/bridge-addons.router.ts +0 -122
package/src/api/capabilities.router.ts +0 -265
package/src/api/core/__tests__/auth-router-totp.spec.ts +0 -297
package/src/api/core/__tests__/integration-markers.spec.ts +0 -10
package/src/api/core/addon-settings.router.ts +0 -127
package/src/api/core/agents.router.ts +0 -86
package/src/api/core/auth.router.ts +0 -322
package/src/api/core/bulk-update-coordinator.ts +0 -305
package/src/api/core/cap-providers.ts +0 -1339
package/src/api/core/capabilities.router.ts +0 -149
package/src/api/core/collection-preference.ts +0 -40
package/src/api/core/event-bus-proxy.router.ts +0 -45
package/src/api/core/hwaccel.router.ts +0 -108
package/src/api/core/live-events.router.ts +0 -67
package/src/api/core/logs.router.ts +0 -195
package/src/api/core/notifications.router.ts +0 -66
package/src/api/core/repl.router.ts +0 -39
package/src/api/core/settings-backend.router.ts +0 -140
package/src/api/core/stream-probe.router.ts +0 -57
package/src/api/core/system-events.router.ts +0 -125
package/src/api/health/health.routes.ts +0 -117
package/src/api/oauth2/__tests__/oauth2-routes.spec.ts +0 -62
package/src/api/oauth2/oauth2-routes.ts +0 -281
package/src/api/trpc/__tests__/client-ip.spec.ts +0 -146
package/src/api/trpc/__tests__/scope-access-device.spec.ts +0 -268
package/src/api/trpc/__tests__/scope-access.spec.ts +0 -102
package/src/api/trpc/__tests__/webrtc-session-ua-enrich.spec.ts +0 -136
package/src/api/trpc/cap-mount-helpers.ts +0 -245
package/src/api/trpc/cap-route-error-formatter.ts +0 -171
package/src/api/trpc/client-ip.ts +0 -147
package/src/api/trpc/core-cap-bridge.ts +0 -154
package/src/api/trpc/generated-cap-mounts.ts +0 -1240
package/src/api/trpc/generated-cap-routers.ts +0 -11523
package/src/api/trpc/scope-access.ts +0 -110
package/src/api/trpc/trpc.context.ts +0 -258
package/src/api/trpc/trpc.middleware.ts +0 -146
package/src/api/trpc/trpc.router.ts +0 -389
package/src/auth/session-cookie.ts +0 -54
package/src/boot/__tests__/integration-id-backfill.spec.ts +0 -131
package/src/boot/boot-config.ts +0 -259
package/src/boot/integration-id-backfill.ts +0 -109
package/src/boot/post-boot.service.ts +0 -105
package/src/core/addon/__tests__/addon-registry-capability.test.ts +0 -62
package/src/core/addon/__tests__/addon-row-manifest.spec.ts +0 -62
package/src/core/addon/addon-call-gateway.ts +0 -171
package/src/core/addon/addon-package.service.ts +0 -1787
package/src/core/addon/addon-registry.service.ts +0 -3130
package/src/core/addon/addon-search.service.ts +0 -91
package/src/core/addon/addon-settings-provider.ts +0 -220
package/src/core/addon/addon.tokens.ts +0 -2
package/src/core/addon-bridge/addon-bridge.service.ts +0 -130
package/src/core/addon-pages/addon-pages.service.spec.ts +0 -117
package/src/core/addon-pages/addon-pages.service.ts +0 -82
package/src/core/addon-widgets/addon-widgets.service.ts +0 -95
package/src/core/agent/agent-registry.service.ts +0 -529
package/src/core/auth/auth.service.spec.ts +0 -86
package/src/core/auth/auth.service.ts +0 -8
package/src/core/capability/capability.service.ts +0 -66
package/src/core/config/config.schema.ts +0 -3
package/src/core/config/config.service.spec.ts +0 -175
package/src/core/config/config.service.ts +0 -7
package/src/core/events/event-bus.service.spec.ts +0 -235
package/src/core/events/event-bus.service.ts +0 -89
package/src/core/feature/feature.service.spec.ts +0 -99
package/src/core/feature/feature.service.ts +0 -8
package/src/core/lifecycle/lifecycle-state-machine.spec.ts +0 -166
package/src/core/lifecycle/lifecycle-state-machine.ts +0 -3
package/src/core/logging/log-ring-buffer.ts +0 -3
package/src/core/logging/logging.service.spec.ts +0 -287
package/src/core/logging/logging.service.ts +0 -143
package/src/core/logging/scoped-logger.ts +0 -3
package/src/core/moleculer/cap-call-fn.spec.ts +0 -173
package/src/core/moleculer/cap-call-fn.ts +0 -107
package/src/core/moleculer/cap-route-authority.ts +0 -194
package/src/core/moleculer/moleculer.service.ts +0 -1072
package/src/core/network/network-quality.service.spec.ts +0 -53
package/src/core/network/network-quality.service.ts +0 -5
package/src/core/notification/notification-wrapper.service.ts +0 -34
package/src/core/notification/toast-wrapper.service.ts +0 -27
package/src/core/provider/provider.tokens.ts +0 -1
package/src/core/repl/repl-engine.service.spec.ts +0 -444
package/src/core/repl/repl-engine.service.ts +0 -155
package/src/core/storage/fs-storage-backend.spec.ts +0 -70
package/src/core/storage/fs-storage-backend.ts +0 -3
package/src/core/storage/storage-location-manager.spec.ts +0 -130
package/src/core/storage/storage-location-manager.ts +0 -3
package/src/core/storage/storage.service.spec.ts +0 -73
package/src/core/storage/storage.service.ts +0 -3
package/src/core/streaming/stream-probe.service.ts +0 -221
package/src/core/topology/topology-emitter.service.ts +0 -105
package/src/launcher.ts +0 -314
package/src/main.ts +0 -1245
package/src/manual-boot.ts +0 -301
package/tsconfig.build.json +0 -8
package/tsconfig.json +0 -33
package/vitest.config.ts +0 -26

package/{src/agent-status-page.ts → dist/agent-status-page.js} RENAMED Viewed

@@ -1,54 +1,39 @@
-export interface AgentStatusData {
-  readonly agentId: string
-  readonly agentName: string
-  readonly hubUrl: string
-  readonly connected: boolean
-  readonly activeTaskCount: number
-  readonly taskTypes: readonly string[]
-  readonly platform: string
-  readonly arch: string
-  readonly cpuCores: number
-  readonly memoryTotalMB: number
-  readonly memoryFreeMB: number
-  readonly uptime: number
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderAgentStatusPage = renderAgentStatusPage;
+function formatUptime(seconds) {
+    const days = Math.floor(seconds / 86400);
+    const hours = Math.floor((seconds % 86400) / 3600);
+    const mins = Math.floor((seconds % 3600) / 60);
+    const parts = [];
+    if (days > 0)
+        parts.push(`${days}d`);
+    if (hours > 0)
+        parts.push(`${hours}h`);
+    parts.push(`${mins}m`);
+    return parts.join(' ');
 }
-function formatUptime(seconds: number): string {
-  const days = Math.floor(seconds / 86400)
-  const hours = Math.floor((seconds % 86400) / 3600)
-  const mins = Math.floor((seconds % 3600) / 60)
-  const parts: string[] = []
-  if (days > 0) parts.push(`${days}d`)
-  if (hours > 0) parts.push(`${hours}h`)
-  parts.push(`${mins}m`)
-  return parts.join(' ')
-}
-function escapeHtml(str: string): string {
-  return str
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
+function escapeHtml(str) {
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
 }
 /**
  * Render a minimal server-rendered HTML status page for the agent.
  * No React, no build system. Pure HTML + inline CSS.
  * Designed for local debugging only.
  */
-export function renderAgentStatusPage(data: AgentStatusData): string {
-  const statusColor = data.connected ? '#22c55e' : '#ef4444'
-  const statusText = data.connected ? 'Connected' : 'Disconnected'
-  const memUsedMB = data.memoryTotalMB - data.memoryFreeMB
-  const memPercent = Math.round((memUsedMB / data.memoryTotalMB) * 100)
-  const taskTypesList =
-    data.taskTypes.length > 0
-      ? data.taskTypes.map((t) => `<li>${escapeHtml(t)}</li>`).join('')
-      : '<li class="muted">No task handlers registered</li>'
-  return `<!DOCTYPE html>
+function renderAgentStatusPage(data) {
+    const statusColor = data.connected ? '#22c55e' : '#ef4444';
+    const statusText = data.connected ? 'Connected' : 'Disconnected';
+    const memUsedMB = data.memoryTotalMB - data.memoryFreeMB;
+    const memPercent = Math.round((memUsedMB / data.memoryTotalMB) * 100);
+    const taskTypesList = data.taskTypes.length > 0
+        ? data.taskTypes.map((t) => `<li>${escapeHtml(t)}</li>`).join('')
+        : '<li class="muted">No task handlers registered</li>';
+    return `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="utf-8">
@@ -118,5 +103,5 @@ export function renderAgentStatusPage(data: AgentStatusData): string {
     </div>
   </div>
 </body>
-</html>`
+</html>`;
 }

package/dist/api/addon-upload.js ADDED Viewed

@@ -0,0 +1,441 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAddonUploadRoute = registerAddonUploadRoute;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const node_child_process_1 = require("node:child_process");
+const scope_access_js_1 = require("./trpc/scope-access.js");
+const addon_package_service_js_1 = require("../core/addon/addon-package.service.js");
+/**
+ * Validate a `cst_*` scoped token via the `user-management` cap singleton.
+ *
+ * The local `AuthService.validateScopedToken` indirection is unused (the
+ * `setScopedTokenManager` wire-up was never invoked), so we go straight
+ * to the cap registry — same path the generic addon-route handler in
+ * `main.ts` uses (the one that actually works end-to-end).
+ *
+ * Returns null when the singleton isn't mounted yet (boot race) or the
+ * token doesn't validate. Caller treats both as auth failure.
+ */
+async function validateScopedTokenViaCap(addonRegistry, token) {
+    const capRegistry = addonRegistry.getCapabilityRegistry();
+    const userMgmt = capRegistry.getSingleton('user-management');
+    if (!userMgmt)
+        return null;
+    return userMgmt.validateScopedToken({ token });
+}
+/**
+ * REST endpoint `/api/addons/upload` shares the scope-gate of the
+ * `addons.installPackage` cap method (semantically equivalent — both
+ * install a tarball under the system-scope `addons` cap with `create`
+ * access). Reuse the shared scope matcher so the gate stays in sync
+ * with the tRPC middleware — no parallel REST-only ACL.
+ *
+ * Why not `addons.upload`? There is no `upload` method on the cap
+ * definition (this endpoint is Fastify-only), so `METHOD_ACCESS_MAP`
+ * has no row for it and `checkScopeAccess` falls through to deny.
+ */
+const UPLOAD_TRPC_PATH = 'addons.installPackage';
+function isUploadAllowed(scoped) {
+    return (0, scope_access_js_1.checkScopeAccess)(scoped.scopes, UPLOAD_TRPC_PATH).ok;
+}
+const TARBALL_EXTENSIONS = ['.tgz', '.tar.gz'];
+const MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+const AGENT_DEPLOY_TIMEOUT_MS = 60_000;
+function isTarball(filename) {
+    return TARBALL_EXTENSIONS.some((ext) => filename.endsWith(ext));
+}
+/**
+ * Validate an uploaded tarball by extracting its `package.json` and
+ * checking it declares `name` + `version`. Runs BEFORE the hub/agent
+ * branch so broken archives are rejected at the gateway instead of
+ * failing mid-extraction on the agent (which has no clean rollback).
+ *
+ * The routine writes the buffer to a scratch path and invokes `tar` with
+ * `-xzO` to stream-extract just `package/package.json` to stdout. No full
+ * unpack is needed — npm-pack layout always puts the manifest at that
+ * fixed inner path. Returns null (not throw) on malformed archives so
+ * the caller can surface a precise 400 response.
+ */
+function validateTarball(buffer, filename) {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-tarball-check-'));
+    const tgzPath = path.join(tmpDir, filename);
+    try {
+        fs.writeFileSync(tgzPath, buffer);
+        const output = (0, node_child_process_1.execFileSync)('tar', ['-xzO', '-f', tgzPath, 'package/package.json'], {
+            timeout: 5_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const parsed = JSON.parse(output.toString('utf8'));
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const pkg = parsed;
+        if (typeof pkg['name'] !== 'string' || typeof pkg['version'] !== 'string')
+            return null;
+        return { name: pkg['name'], version: pkg['version'] };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+async function registerAddonUploadRoute(fastify, addonBridge, authService, moleculer, addonRegistry, addonPackageService, logger) {
+    await fastify.register(Promise.resolve().then(() => __importStar(require('@fastify/multipart'))), {
+        limits: { fileSize: MAX_UPLOAD_BYTES },
+    });
+    fastify.post('/api/addons/upload', async (request, reply) => {
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            return reply.status(401).send({ error: 'Unauthorized' });
+        }
+        // Auth chain: JWT (isAdmin) OR scoped token whose scopes grant
+        // `create` access on the `addons` capability. The scoped path is the
+        // CLI's `camstack login` flow — fetches a long-lived upload-scoped
+        // token so headless deploys don't need an admin password on disk.
+        const token = authHeader.replace('Bearer ', '');
+        let authOk = false;
+        let authReason;
+        // Try JWT first — fastest path + carries isAdmin flag directly.
+        try {
+            const payload = authService.verifyToken(token);
+            if (payload.isAdmin) {
+                authOk = true;
+            }
+            else {
+                authReason = 'JWT is not admin';
+            }
+        }
+        catch {
+            // Not a JWT (or invalid signature) — fall through to scoped-token path.
+        }
+        if (!authOk) {
+            // `cst_*` scoped tokens — only the cap-registry singleton actually
+            // validates; the local AuthService bridge was never wired. See main.ts:652.
+            try {
+                const record = await validateScopedTokenViaCap(addonRegistry, token);
+                if (!record) {
+                    authReason = authReason ?? 'token not recognised';
+                }
+                else if (isUploadAllowed(record)) {
+                    authOk = true;
+                }
+                else {
+                    authReason = `scoped token lacks create access on '${UPLOAD_TRPC_PATH}'`;
+                }
+            }
+            catch (err) {
+                authReason = `scoped token validation failed: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        }
+        if (!authOk) {
+            return reply
+                .status(403)
+                .send({ error: `Forbidden: ${authReason ?? 'admin or upload-scoped token required'}` });
+        }
+        const data = await request.file();
+        if (!data) {
+            return reply.status(400).send({ error: 'No file uploaded' });
+        }
+        if (!isTarball(data.filename)) {
+            return reply.status(400).send({ error: 'File must be a .tgz or .tar.gz archive' });
+        }
+        // `nodeId` and `addonId` come through as multipart text fields.
+        // `data.fields[X].value` is the parsed string; we narrow defensively
+        // because the multipart plugin types it as `unknown`.
+        const nodeIdField = data.fields['nodeId'];
+        const addonIdField = data.fields['addonId'];
+        const nodeId = typeof nodeIdField === 'object' &&
+            nodeIdField !== null &&
+            'value' in nodeIdField &&
+            typeof nodeIdField.value === 'string'
+            ? nodeIdField.value
+            : null;
+        const addonIdHint = typeof addonIdField === 'object' &&
+            addonIdField !== null &&
+            'value' in addonIdField &&
+            typeof addonIdField.value === 'string'
+            ? addonIdField.value
+            : null;
+        const buffer = await data.toBuffer();
+        // Gate: reject archives that don't expose a parseable package.json with
+        // name + version. The hub installer did this implicitly via npm; the
+        // agent path would otherwise fail mid-extraction with no clean rollback.
+        const manifest = validateTarball(buffer, data.filename);
+        if (!manifest) {
+            return reply.status(400).send({
+                error: 'Tarball missing or malformed package/package.json (name + version required)',
+            });
+        }
+        // Branch by deployment target. `nodeId === 'hub'` (or absent) installs on
+        // the hub AND broadcasts to every connected agent that can run any of
+        // the package's addons (i.e. anything not marked hub-only). Any other
+        // explicit `nodeId` value routes only to that agent via `$agent.deploy`.
+        if (!nodeId || nodeId === 'hub') {
+            return installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, data.filename, buffer);
+        }
+        const agentAddonId = addonIdHint ?? manifest.name;
+        return deployToAgent(reply, moleculer, nodeId, agentAddonId, buffer);
+    });
+}
+/**
+ * Read the on-disk package.json and decide whether the package contains
+ * anything that needs to land on agents. We deliberately read from disk
+ * (rather than `addonRegistry.listAddons()`) so the function is safe to
+ * call before `loadNewAddons()` and so `agent-only` addons — which the
+ * hub registry intentionally skips — still show up here.
+ *
+ * Returns `true` if at least one addon's `execution.placement` is anything
+ * other than `'hub-only'`. Absence of `execution` defaults to hub-only so
+ * legacy packages don't suddenly broadcast cluster-wide.
+ */
+function packageHasAgentDeployable(addonsDir, packageName) {
+    try {
+        const pkgPath = path.join(addonsDir, packageName, 'package.json');
+        const parsed = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        if (parsed === null || typeof parsed !== 'object')
+            return false;
+        const camstack = parsed
+            .camstack;
+        const addons = camstack?.addons ?? [];
+        return addons.some((a) => {
+            const placement = a.execution?.placement ?? 'hub-only';
+            return placement === 'agent-only' || placement === 'any-node';
+        });
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Push `buffer` (a tarball) to every connected non-hub node and trigger a
+ * `$agent.reload` so the freshly extracted dist is picked up immediately
+ * without an agent restart. Agents that fail are reported per-node — one
+ * unreachable agent must not block the others or the hub install.
+ */
+async function propagateToAgents(moleculer, logger, packageName, buffer) {
+    const broker = moleculer.broker;
+    const nodes = broker.registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
+    // Moleculer reports both top-level nodes (`hub`, `dev-agent-0`, …) AND
+    // their child per-addon runner processes (`hub/detection-pipeline`, `dev-agent-0/foo`).
+    // Only the top-level agent nodes have the `$agent` service — calling
+    // `$agent.deploy` on a child would hang until timeout. The hub itself
+    // is excluded (it was already installed via `installToHub`).
+    const allNodeIds = nodes.map((n) => n.id);
+    const agentNodeIds = allNodeIds.filter((id) => id !== 'hub' && !id.includes('/'));
+    logger.info('propagate: enumerated broker nodes', {
+        meta: {
+            packageName,
+            allNodeIds,
+            targetAgents: agentNodeIds,
+        },
+    });
+    if (agentNodeIds.length === 0)
+        return [];
+    const results = [];
+    for (const nodeId of agentNodeIds) {
+        try {
+            const deployRaw = await broker.call('$agent.deploy', { addonId: packageName, bundle: buffer }, { nodeID: nodeId, timeout: AGENT_DEPLOY_TIMEOUT_MS });
+            if (!isAgentDeployResponse(deployRaw)) {
+                results.push({ nodeId, success: false, error: 'malformed deploy response' });
+                continue;
+            }
+            const reloadRaw = await broker.call('$agent.reload', {}, { nodeID: nodeId, timeout: AGENT_DEPLOY_TIMEOUT_MS });
+            const reloaded = reloadRaw !== null &&
+                typeof reloadRaw === 'object' &&
+                'loaded' in reloadRaw
+                ? reloadRaw.loaded
+                : [];
+            results.push({ nodeId, success: true, loaded: reloaded });
+        }
+        catch (err) {
+            results.push({
+                nodeId,
+                success: false,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return results;
+}
+/**
+ * Hub install path: write the tgz, refresh the manifest list, then drive the
+ * registry through (a) `loadNewAddons` for brand-new addonIds and (b)
+ * `restartAddon` for each addonId already tied to this package. The restart
+ * branch is the hot-update story — group-hosted addons re-fork their child
+ * process (fresh dist code is loaded) and in-process addons re-init in place.
+ * Without this the CLI push was write-to-disk-only and required a server
+ * restart to actually run the new code.
+ */
+async function installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, filename, buffer) {
+    const tmpDir = path.join(os.tmpdir(), `camstack-addon-upload-${Date.now()}`);
+    fs.mkdirSync(tmpDir, { recursive: true });
+    const tgzPath = path.join(tmpDir, filename);
+    fs.writeFileSync(tgzPath, buffer);
+    try {
+        const installer = addonBridge.getInstaller();
+        if (!installer) {
+            return reply.status(500).send({ error: 'Addon installer not available' });
+        }
+        // Snapshot addonIds tied to this package BEFORE installation. Used after
+        // reload to distinguish "new" vs "updated". installFromTgz only writes
+        // to disk; `addonRegistry.listAddons()` reflects in-memory state, so the
+        // order (snapshot first vs install first) doesn't matter here — kept
+        // pre-install for readability.
+        const result = await installer.installFromTgz(tgzPath);
+        const preInstallAddonIds = addonRegistry
+            .listAddons()
+            .filter((row) => row.manifest.packageName === result.name)
+            .map((row) => row.manifest.id);
+        const addonsDir = path.resolve(process.env['CAMSTACK_DATA'] ?? 'camstack-data', 'addons');
+        fs.writeFileSync(path.join(addonsDir, result.name, '.install-source'), 'upload');
+        // Framework / system packages (`camstack.system: true`, e.g. @camstack/core)
+        // ship hub builtins (sqlite-settings, filesystem-storage, …) that CANNOT be
+        // hot-reloaded in place — an in-process `restartAddon` leaves them
+        // uninitialized ("SqliteSettingsBackend not initialized"), breaking auth +
+        // settings. The new code is now on disk; a clean server restart reloads it
+        // and re-runs boot initialization. The 10s restart grace lets this response
+        // flush before the process exits, so the CLI sees a clean confirmation.
+        if ((0, addon_package_service_js_1.isFrameworkPackage)(result.name)) {
+            logger.info('framework package deployed — scheduling server restart', {
+                meta: { packageName: result.name, packageVersion: result.version },
+            });
+            addonPackageService.restartServer(`addon-upload: ${result.name}@${result.version}`);
+            return reply.send({
+                success: true,
+                name: result.name,
+                version: result.version,
+                requiresRestart: true,
+                restarting: true,
+                message: 'Framework package installed — server is restarting to load it',
+            });
+        }
+        // `addonRegistry.loadNewAddons()` already runs its own fresh filesystem
+        // scan, diff'ing against existing `addonEntries` — it updates metadata
+        // for known addons without touching their live instances + initializes
+        // only entries it hasn't seen before. The previous `addonBridge.
+        // reloadPackages()` call here was redundant AND destructive: it built
+        // a brand-new `AddonLoader` and replaced the global, which knocked
+        // every isolated group-runner's IPC channel offline (visible as
+        // `Group-runner hub/<X>-isolated disconnected` for 6+ addons after
+        // a single `camstack deploy`). `loadNewAddons` alone is enough.
+        const loadResult = await addonRegistry.loadNewAddons();
+        // Hot-update + cluster propagation are FIRE-AND-FORGET. The upload
+        // route must respond quickly so the CLI / UI sees confirmation; the
+        // capability re-registration after a forked group-runner respawn can
+        // legitimately take 30s–several minutes (Python pool warmup, native
+        // module init, broken external deps) and we don't want operator
+        // tooling to hang waiting for it. `restartAddon` and
+        // `propagateToAgents` each log their own progress; operators monitor
+        // status through the topology cap or the addons UI.
+        const propagatable = packageHasAgentDeployable(addonsDir, result.name);
+        logger.info('hub install OK', {
+            meta: {
+                packageName: result.name,
+                packageVersion: result.version,
+                loaded: loadResult.loaded,
+                restartTargets: preInstallAddonIds,
+                propagatable,
+            },
+        });
+        for (const id of preInstallAddonIds) {
+            void addonRegistry.restartAddon(id).then((r) => {
+                if (!r.success) {
+                    logger.warn('background restart failed', {
+                        tags: { addonId: id },
+                        meta: { error: r.error ?? 'unknown' },
+                    });
+                }
+                else {
+                    logger.info('background restart OK', { tags: { addonId: id } });
+                }
+            });
+        }
+        if (propagatable) {
+            void propagateToAgents(moleculer, logger, result.name, buffer).then((agentResults) => {
+                logger.info('propagation done', {
+                    meta: { packageName: result.name, agents: agentResults },
+                });
+            });
+        }
+        return reply.send({
+            success: true,
+            target: 'hub',
+            packageName: result.name,
+            version: result.version,
+            loaded: loadResult.loaded,
+            restartingInBackground: preInstallAddonIds,
+            propagatingToAgentsInBackground: propagatable,
+            failures: loadResult.failed,
+        });
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+function isAgentDeployResponse(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const v = value;
+    if (typeof v.success !== 'boolean')
+        return false;
+    if (typeof v.addonId !== 'string')
+        return false;
+    if (v.path !== undefined && typeof v.path !== 'string')
+        return false;
+    return true;
+}
+async function deployToAgent(reply, moleculer, nodeId, addonId, buffer) {
+    try {
+        const broker = moleculer.broker;
+        const raw = await broker.call('$agent.deploy', { addonId, bundle: buffer }, { nodeID: nodeId, timeout: AGENT_DEPLOY_TIMEOUT_MS });
+        if (!isAgentDeployResponse(raw)) {
+            return reply.status(502).send({ error: 'Agent deploy returned malformed response' });
+        }
+        return reply.send({
+            success: true,
+            target: nodeId,
+            addonId: raw.addonId,
+            path: raw.path,
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return reply.status(502).send({ error: `Agent deploy failed: ${msg}` });
+    }
+}

package/dist/api/addons-custom.router.js ADDED Viewed

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAddonsCustomProcedures = createAddonsCustomProcedures;
+/**
+ * `api.addons.custom` — generic dispatcher for addon-defined custom actions.
+ *
+ * Task 7.2 of the device-proxy redesign. Addons declare a catalog of
+ * custom actions at boot via `AddonInitResult.customActions` + a single
+ * `handleCustomAction(action, input)` handler. The catalog is registered
+ * with a per-process `CustomActionRegistry` (Task 7.1). This endpoint is
+ * the single tRPC entry point that resolves an `(addonId, action)` pair,
+ * validates input + output against the action's Zod schemas, enforces the
+ * action's declared auth level, and dispatches to the addon handler.
+ *
+ * The factory returns a record of procedures (not a router) so the caller
+ * can spread it into the existing `addons` namespace:
+ *
+ *   trpcRouter({
+ *     ...existingAddonsProcedures,
+ *     ...createAddonsCustomProcedures({ getCustomActionRegistry: ... }),
+ *   })
+ *
+ * This avoids `mergeRouters` (which requires sharing the `t` instance
+ * across modules) while still mounting the procedure at `api.addons.custom`.
+ */
+const zod_1 = require("zod");
+const server_1 = require("@trpc/server");
+const trpc_middleware_js_1 = require("./trpc/trpc.middleware.js");
+/**
+ * Build the procedure record for the `custom` endpoint.
+ *
+ * The OUTER procedure is `protectedProcedure` — every caller must be
+ * authenticated. The INNER per-action auth declared in `spec.auth` is
+ * enforced manually by `ensureAuth` because the auth level is not known
+ * until after the registry lookup.
+ */
+function createAddonsCustomProcedures(deps) {
+    return {
+        custom: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({
+            addonId: zod_1.z.string().min(1),
+            action: zod_1.z.string().min(1),
+            input: zod_1.z.unknown(),
+        }))
+            .output(zod_1.z.unknown())
+            .mutation(async ({ input, ctx }) => {
+            const registry = deps.getCustomActionRegistry();
+            const entry = registry.resolve(input.addonId, input.action);
+            if (!entry) {
+                throw new server_1.TRPCError({
+                    code: 'NOT_FOUND',
+                    message: `addon '${input.addonId}' has no custom action '${input.action}'`,
+                });
+            }
+            // Per-action authorization. The outer procedure already requires
+            // authentication; here we additionally enforce the declared role
+            // when it's stricter than 'protected'.
+            ensureAuth(ctx, entry.spec.auth);
+            // Validate input against the action's declared Zod schema.
+            const parsedInput = entry.spec.input.parse(input.input);
+            // Dispatch through the addon handler.
+            const result = await entry.handler(parsedInput);
+            // Validate the addon's output. Crash-early on misbehaving addons.
+            return entry.spec.output.parse(result);
+        }),
+    };
+}
+/**
+ * Enforce the action's declared auth level.
+ *
+ * Mirrors the role checks performed by `protectedProcedure` and
+ * `adminProcedure` in trpc.middleware.ts:
+ *   - public:    no auth
+ *   - protected: any authenticated user
+ *   - admin:     isAdmin only (scoped tokens bounce)
+ */
+function ensureAuth(ctx, level) {
+    if (level === 'public')
+        return;
+    if (!ctx.user) {
+        throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+    }
+    if (level === 'protected')
+        return;
+    if (level === 'admin') {
+        if (!ctx.user.isAdmin) {
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'custom action requires admin' });
+        }
+        return;
+    }
+}

package/dist/api/auth-whoami.js ADDED Viewed

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAuthWhoamiRoute = registerAuthWhoamiRoute;
+async function registerAuthWhoamiRoute(fastify, authService, addonRegistry) {
+    fastify.get('/api/auth/whoami', async (request, reply) => {
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            return reply.status(401).send({ ok: false, error: 'No Authorization header' });
+        }
+        const token = authHeader.replace('Bearer ', '');
+        // JWT fast path — same logic as addon-upload auth chain.
+        try {
+            const payload = authService.verifyToken(token);
+            const ok = {
+                ok: true,
+                kind: 'jwt',
+                userId: payload.userId ?? payload.keyId ?? 'unknown',
+                username: payload.username ?? 'unknown',
+                isAdmin: payload.isAdmin,
+            };
+            return reply.send(ok);
+        }
+        catch {
+            // Not a JWT — try scoped token via cap registry.
+        }
+        try {
+            const capRegistry = addonRegistry.getCapabilityRegistry();
+            const userMgmt = capRegistry.getSingleton('user-management');
+            if (!userMgmt) {
+                return reply.status(503).send({ ok: false, error: 'user-management cap not mounted' });
+            }
+            const record = await userMgmt.validateScopedToken({ token });
+            if (!record) {
+                return reply
+                    .status(401)
+                    .send({ ok: false, error: 'Token not recognised (revoked, expired, or never issued)' });
+            }
+            const ok = {
+                ok: true,
+                kind: 'scoped',
+                userId: record.userId,
+                username: record.userId,
+                tokenPrefix: record.tokenPrefix,
+                scopes: record.scopes,
+                expiresAt: record.expiresAt ?? null,
+                createdAt: record.createdAt,
+            };
+            return reply.send(ok);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return reply.status(500).send({ ok: false, error: `Validation failed: ${msg}` });
+        }
+    });
+}