@camstack/server 1.0.4 → 1.0.5

package/dist/core/addon/addon-package.service.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AddonPackageService = exports.SYSTEM_PACKAGE = void 0;
 exports.isFrameworkPackage = isFrameworkPackage;
+exports.sweepStaleFrameworkBackups = sweepStaleFrameworkBackups;
+exports.swapInFrameworkPackage = swapInFrameworkPackage;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
@@ -916,6 +918,69 @@ class AddonPackageService {
      * Returns BEFORE the exit fires so the admin UI receives `restartingAt`
      * and can pivot to the reconnect overlay.
      */
+    /**
+     * Install the framework by SWAPPING each package's own directory, exactly
+     * like every addon is installed (download the single-package tarball →
+     * extract → atomic dir swap). We NEVER run `npm install --prefix <appRoot>`.
+     *
+     * Why: `npm install --prefix /data` manages the WHOLE node_modules tree — it
+     * prunes every package not in @camstack/system's closure (the addons +
+     * ui-library), deletes the stray manifest.json, and (via temp-install + merge
+     * variants) can clobber working native bindings. A per-package tarball swap
+     * touches only that package's folder; nothing else can be pruned, deleted, or
+     * corrupted.
+     *
+     * Swaps the @camstack framework packages versioned in lockstep with system:
+     * the pure-JS libs (types, sdk) AND @camstack/shm-ring. shm-ring is native
+     * but SAFE to swap because it ships its compiled `.node` prebuilds INSIDE the
+     * npm tarball (prebuildify + node-gyp-build resolves the matching one at
+     * require-time) — a bare extract is sufficient, no build or download.
+     *
+     * It does NOT swap download/compile-on-install natives such as `better-sqlite3`
+     * (prebuild-install fetches the binary from GitHub releases at install time —
+     * a bare extract would leave it without a binding). Those are third-party,
+     * hoisted, change only across majors, and are updated by an image redeploy.
+     * System's own deps stay exactly where they are, bindings intact.
+     */
+    async installFrameworkPackages(packageName, toVersion, appRoot) {
+        const registry = process.env['CAMSTACK_NPM_REGISTRY'];
+        // @camstack/shm-ring is native but ships prebuilds in its tarball → safe.
+        const lockstepDeps = ['@camstack/types', '@camstack/sdk', '@camstack/shm-ring'];
+        const swapTargets = [packageName, ...lockstepDeps];
+        // Self-heal: a previous run killed mid-swap (e.g. process restart while a
+        // slow download was in flight) can leave a `<pkg>.fw-bak` backup behind.
+        // It's inert (not a valid package the loader picks up) but sweep it so the
+        // tree stays clean.
+        sweepStaleFrameworkBackups(appRoot);
+        const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-fw-'));
+        try {
+            for (const pkg of swapTargets) {
+                const isPrimary = pkg === packageName;
+                try {
+                    const tgzPath = await packTarball(pkg, toVersion, tmpRoot, registry);
+                    const extractDir = fs.mkdtempSync(path.join(tmpRoot, 'x-'));
+                    await execFileAsync('tar', ['-xzf', tgzPath, '-C', extractDir], { timeout: 60_000 });
+                    const result = swapInFrameworkPackage(path.join(extractDir, 'package'), appRoot);
+                    this.logger.info('updateFrameworkPackage: package swapped', {
+                        meta: { name: result.name, version: result.version },
+                    });
+                }
+                catch (err) {
+                    if (isPrimary)
+                        throw err;
+                    // A lockstep dep may not be published at this exact version (or the
+                    // download flaked) — keep the existing copy rather than fail the whole
+                    // framework update. System is the one that MUST succeed.
+                    this.logger.warn(`updateFrameworkPackage: lockstep dep ${pkg}@${toVersion} not swapped`, {
+                        meta: { error: (0, types_1.errMsg)(err) },
+                    });
+                }
+            }
+        }
+        finally {
+            fs.rmSync(tmpRoot, { recursive: true, force: true });
+        }
+    }
     async updateFrameworkPackage(input) {
         const { packageName } = input;
         if (packageName !== exports.SYSTEM_PACKAGE) {
@@ -928,20 +993,10 @@ class AddonPackageService {
             : 'unknown';
         const requestedVersion = input.version ?? 'latest';
         const toVersion = await resolveNpmVersion(packageName, requestedVersion, process.env['CAMSTACK_NPM_REGISTRY']);
-        const spec = `${packageName}@${toVersion}`;
         this.logger.info('updateFrameworkPackage: installing', {
             meta: { packageName, fromVersion, toVersion, appRoot },
         });
-        const registry = process.env['CAMSTACK_NPM_REGISTRY'];
-        const args = [
-            'install',
-            '--prefix',
-            appRoot,
-            spec,
-            '--no-save',
-            ...buildNpmRegistryArgs(registry),
-        ];
-        await execFileAsync('npm', args, { timeout: 180_000 });
+        await this.installFrameworkPackages(packageName, toVersion, appRoot);
         if (input.deferRestart === true) {
             this.logger.info(`updateFrameworkPackage(${packageName}@${toVersion}): install done, restart deferred`);
             // Sentinel: 0 signals "no restart scheduled" to the caller
@@ -1451,6 +1506,131 @@ function buildNpmRegistryArgs(registry) {
         return [];
     return ['--registry', registry, `--@camstack:registry=${registry}`];
 }
+/**
+ * Remove any leftover `<pkg>.fw-bak` backup dirs under `appRoot/node_modules/
+ * @camstack` — debris from a framework swap that was interrupted before its
+ * own cleanup ran. Best-effort; returns the swept names.
+ */
+function sweepStaleFrameworkBackups(appRoot) {
+    const scopeDir = path.join(appRoot, 'node_modules', '@camstack');
+    if (!fs.existsSync(scopeDir))
+        return [];
+    const swept = [];
+    for (const entry of fs.readdirSync(scopeDir, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !entry.name.endsWith('.fw-bak'))
+            continue;
+        try {
+            fs.rmSync(path.join(scopeDir, entry.name), { recursive: true, force: true });
+            swept.push(entry.name);
+        }
+        catch {
+            // ignore — inert leftover, next sweep retries
+        }
+    }
+    return swept;
+}
+/**
+ * Download the `.tgz` for an EXACT `pkg@version` into `destRoot`, returning its
+ * path. Prefers a direct HTTPS GET (registry metadata → tarball URL) because
+ * `fetch` + `AbortSignal.timeout` aborts RELIABLY on a slow/flaky network — an
+ * `npm pack` child can stall for minutes past its `execFile` timeout (npm holds
+ * its stdio pipes open, so the awaited promise never settles), which would wedge
+ * the whole framework update. Falls back to `npm pack` (SIGKILL on timeout) only
+ * when the HTTPS path fails (private registry quirks, auth, etc.).
+ */
+async function packTarball(pkg, version, destRoot, registry) {
+    const dir = fs.mkdtempSync(path.join(destRoot, 'dl-'));
+    try {
+        return await httpsDownloadTarball(pkg, version, dir, registry);
+    }
+    catch (httpErr) {
+        const args = [
+            'pack',
+            `${pkg}@${version}`,
+            '--pack-destination',
+            dir,
+            ...buildNpmRegistryArgs(registry),
+        ];
+        // SIGKILL (not the default SIGTERM): npm can ignore SIGTERM while a
+        // grandchild holds the pipes — SIGKILL guarantees the timeout fires.
+        await execFileAsync('npm', args, { timeout: 60_000, killSignal: 'SIGKILL' });
+        const tgz = fs.readdirSync(dir).find((f) => f.endsWith('.tgz'));
+        if (tgz === undefined) {
+            throw new Error(`download failed for ${pkg}@${version}: ${(0, types_1.errMsg)(httpErr)}`);
+        }
+        return path.join(dir, tgz);
+    }
+}
+/**
+ * Direct HTTPS download of an exact `pkg@version` tarball. Resolves the tarball
+ * URL from the registry packument, then streams it to a file. Every network
+ * call is bounded by an `AbortSignal.timeout` so a DNS/registry stall fails fast
+ * instead of hanging the framework update.
+ */
+async function httpsDownloadTarball(pkg, version, dir, registry) {
+    const reg = (registry ?? 'https://registry.npmjs.org').replace(/\/+$/, '');
+    const metaUrl = `${reg}/${encodeURIComponent(pkg).replace(/^%40/, '@')}`;
+    const metaRes = await fetch(metaUrl, { signal: AbortSignal.timeout(20_000) });
+    if (!metaRes.ok)
+        throw new Error(`registry GET ${metaUrl} → ${metaRes.status}`);
+    const meta = (await metaRes.json());
+    const tarballUrl = meta.versions?.[version]?.dist?.tarball;
+    if (typeof tarballUrl !== 'string') {
+        throw new Error(`no tarball url for ${pkg}@${version}`);
+    }
+    const tarRes = await fetch(tarballUrl, { signal: AbortSignal.timeout(120_000) });
+    if (!tarRes.ok)
+        throw new Error(`tarball GET ${tarballUrl} → ${tarRes.status}`);
+    const buf = Buffer.from(await tarRes.arrayBuffer());
+    const outPath = path.join(dir, `${pkg.replace('@', '').replace('/', '-')}-${version}.tgz`);
+    fs.writeFileSync(outPath, buf);
+    return outPath;
+}
+/**
+ * Atomically replace one `@camstack/*` package directory in
+ * `appRoot/node_modules` with the contents of an extracted npm package dir
+ * (`stagedPackageDir` = the `package/` folder from a `.tgz`).
+ *
+ * This is the framework-update primitive: it touches ONLY the target package's
+ * folder. The current copy is renamed to a sibling `.fw-bak` backup first and
+ * restored if the copy fails, so a crash mid-swap can't leave a half-written
+ * package. Refuses anything outside the `@camstack/` scope as a safety guard.
+ * Returns the installed package name + version.
+ */
+function swapInFrameworkPackage(stagedPackageDir, appRoot) {
+    const pkgJsonPath = path.join(stagedPackageDir, 'package.json');
+    if (!fs.existsSync(pkgJsonPath)) {
+        throw new Error(`swapInFrameworkPackage: no package.json in ${stagedPackageDir}`);
+    }
+    const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+    const pkg = parsed;
+    if (typeof pkg.name !== 'string' || typeof pkg.version !== 'string') {
+        throw new Error(`swapInFrameworkPackage: invalid package.json in ${stagedPackageDir}`);
+    }
+    if (!pkg.name.startsWith('@camstack/')) {
+        throw new Error(`swapInFrameworkPackage: refusing non-@camstack package ${pkg.name}`);
+    }
+    const targetDir = path.join(appRoot, 'node_modules', pkg.name);
+    const backupDir = `${targetDir}.fw-bak`;
+    fs.rmSync(backupDir, { recursive: true, force: true });
+    const hadExisting = fs.existsSync(targetDir);
+    if (hadExisting)
+        fs.renameSync(targetDir, backupDir);
+    try {
+        fs.mkdirSync(path.dirname(targetDir), { recursive: true });
+        fs.cpSync(stagedPackageDir, targetDir, { recursive: true });
+    }
+    catch (err) {
+        // Roll back to the previous copy so a failed swap never leaves the
+        // package missing or half-written.
+        fs.rmSync(targetDir, { recursive: true, force: true });
+        if (hadExisting)
+            fs.renameSync(backupDir, targetDir);
+        throw err;
+    }
+    fs.rmSync(backupDir, { recursive: true, force: true });
+    return { name: pkg.name, version: pkg.version };
+}
 /**
  * Resolve the directory whose `node_modules/<pkg>/` holds the currently-
  * installed copy of a framework package. `npm install --prefix <appRoot>`

package/dist/launcher.js

@@ -266,6 +266,26 @@ async function launch() {
     else {
         await installer.ensureRequiredPackages();
     }
+    // Reconcile the install manifest with what is on disk. Addons baked
+    // into the image are copied straight into addonsDir by the container
+    // entrypoint and never pass through an install codepath, so they are
+    // absent from manifest.json — which makes runtime "Update" reject them
+    // with "not currently tracked in manifest". Idempotent; safe every boot.
+    //
+    // Guarded with a typeof check: the backend and @camstack/system normally
+    // ship together in one image, but a system-only framework update can
+    // swap in a build that predates `reconcileManifest`. A missing method
+    // must not crash boot — the manifest is already persisted from a prior
+    // boot, so skipping reconcile is harmless.
+    if (typeof installer.reconcileManifest === 'function') {
+        const reconciled = installer.reconcileManifest();
+        if (reconciled > 0) {
+            console.log(`[launcher] Manifest reconciled — ${reconciled} seeded addon(s) registered`);
+        }
+    }
+    else {
+        console.warn('[launcher] installer.reconcileManifest unavailable — skipping manifest reconcile');
+    }
     // Self-contained addon bundles (build preset `self-contained`) inline
     // @camstack/types + zod + @camstack/sdk into each addon's dist. The
     // hub no longer plants peer-dep symlinks under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "private": false,
   "files": [
     "dist",