@camstack/server 1.0.8 → 1.1.0

package/dist/api/addon-upload.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDeployStageRegistry = getDeployStageRegistry;
+exports.registerDeployBundleRoute = registerDeployBundleRoute;
+exports.buildHubHttpSource = buildHubHttpSource;
 exports.registerAddonUploadRoute = registerAddonUploadRoute;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -40,6 +43,34 @@ const os = __importStar(require("node:os"));
 const node_child_process_1 = require("node:child_process");
 const scope_access_js_1 = require("./trpc/scope-access.js");
 const addon_package_service_js_1 = require("../core/addon/addon-package.service.js");
+const deploy_stage_registry_js_1 = require("./deploy-stage-registry.js");
+const deployStageRegistry = new deploy_stage_registry_js_1.DeployStageRegistry();
+function getDeployStageRegistry() {
+    return deployStageRegistry;
+}
+/**
+ * One-time-token route agents pull a staged addon tgz from. Bearer token is
+ * the per-deploy token minted in `DeployStageRegistry.stage()` and carried to
+ * the agent in the `$agent.deploy` `hub-http` source descriptor.
+ */
+function registerDeployBundleRoute(fastify) {
+    fastify.get('/api/addons/deploy-bundle/:id', (request, reply) => {
+        const auth = request.headers.authorization ?? '';
+        const token = auth.startsWith('Bearer ') ? auth.slice('Bearer '.length) : '';
+        if (!token) {
+            reply.status(401).send({ error: 'missing bearer token' });
+            return;
+        }
+        const buffer = deployStageRegistry.consume(request.params.id, token);
+        if (!buffer) {
+            reply
+                .status(deployStageRegistry.peekExists(request.params.id) ? 401 : 404)
+                .send({ error: 'bundle not available' });
+            return;
+        }
+        reply.header('content-type', 'application/octet-stream').send(buffer);
+    });
+}
 /**
  * Validate a `cst_*` scoped token via the `user-management` cap singleton.
  *
@@ -76,6 +107,20 @@ function isUploadAllowed(scoped) {
 const TARBALL_EXTENSIONS = ['.tgz', '.tar.gz'];
 const MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 const AGENT_DEPLOY_TIMEOUT_MS = 60_000;
+const AGENT_DEPLOY_CONTROL_TIMEOUT_MS = 30_000;
+function hubBundleBaseUrl() {
+    return process.env['CAMSTACK_HUB_PUBLIC_URL'] ?? 'https://127.0.0.1:4443';
+}
+function buildHubHttpSource(buffer, hubBaseUrl) {
+    const staged = getDeployStageRegistry().stage(buffer);
+    return {
+        kind: 'hub-http',
+        url: `${hubBaseUrl.replace(/\/$/, '')}/api/addons/deploy-bundle/${staged.id}`,
+        token: staged.token,
+        sha256: staged.sha256,
+        bytes: staged.bytes,
+    };
+}
 function isTarball(filename) {
     return TARBALL_EXTENSIONS.some((ext) => filename.endsWith(ext));
 }
@@ -119,6 +164,7 @@ async function registerAddonUploadRoute(fastify, addonBridge, authService, molec
     await fastify.register(Promise.resolve().then(() => __importStar(require('@fastify/multipart'))), {
         limits: { fileSize: MAX_UPLOAD_BYTES },
     });
+    registerDeployBundleRoute(fastify);
     fastify.post('/api/addons/upload', async (request, reply) => {
         const authHeader = request.headers.authorization;
         if (!authHeader) {
@@ -206,11 +252,12 @@ async function registerAddonUploadRoute(fastify, addonBridge, authService, molec
         // the hub AND broadcasts to every connected agent that can run any of
         // the package's addons (i.e. anything not marked hub-only). Any other
         // explicit `nodeId` value routes only to that agent via `$agent.deploy`.
+        const baseUrl = hubBundleBaseUrl();
         if (!nodeId || nodeId === 'hub') {
-            return installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, data.filename, buffer);
+            return installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, data.filename, buffer, baseUrl);
         }
         const agentAddonId = addonIdHint ?? manifest.name;
-        return deployToAgent(reply, moleculer, nodeId, agentAddonId, buffer);
+        return deployToAgent(reply, moleculer, nodeId, agentAddonId, buffer, baseUrl);
     });
 }
 /**
@@ -248,7 +295,7 @@ function packageHasAgentDeployable(addonsDir, packageName) {
  * without an agent restart. Agents that fail are reported per-node — one
  * unreachable agent must not block the others or the hub install.
  */
-async function propagateToAgents(moleculer, logger, packageName, buffer) {
+async function propagateToAgents(moleculer, logger, packageName, buffer, hubBaseUrl) {
     const broker = moleculer.broker;
     const nodes = broker.registry?.getNodeList?.({ onlyAvailable: true }) ?? [];
     // Moleculer reports both top-level nodes (`hub`, `dev-agent-0`, …) AND
@@ -270,7 +317,13 @@ async function propagateToAgents(moleculer, logger, packageName, buffer) {
     const results = [];
     for (const nodeId of agentNodeIds) {
         try {
-            const deployRaw = await broker.call('$agent.deploy', { addonId: packageName, bundle: buffer }, { nodeID: nodeId, timeout: AGENT_DEPLOY_TIMEOUT_MS });
+            // The hub currently only ever sends the `hub-http` source (agent streams
+            // the tgz directly from this hub). The `{kind:'npm'}` source is a reserved
+            // follow-up (published-addon optimization) and is intentionally not produced
+            // yet. Wiring it later must also make the agent's npm path evict the addon's
+            // declaration ids before `$agent.reload`, otherwise an npm update pins the
+            // stale version.
+            const deployRaw = await broker.call('$agent.deploy', { addonId: packageName, source: buildHubHttpSource(buffer, hubBaseUrl) }, { nodeID: nodeId, timeout: AGENT_DEPLOY_CONTROL_TIMEOUT_MS });
             if (!isAgentDeployResponse(deployRaw)) {
                 results.push({ nodeId, success: false, error: 'malformed deploy response' });
                 continue;
@@ -302,7 +355,7 @@ async function propagateToAgents(moleculer, logger, packageName, buffer) {
  * Without this the CLI push was write-to-disk-only and required a server
  * restart to actually run the new code.
  */
-async function installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, filename, buffer) {
+async function installToHub(reply, addonBridge, addonRegistry, addonPackageService, moleculer, logger, filename, buffer, hubBaseUrl) {
     const tmpDir = path.join(os.tmpdir(), `camstack-addon-upload-${Date.now()}`);
     fs.mkdirSync(tmpDir, { recursive: true });
     const tgzPath = path.join(tmpDir, filename);
@@ -401,7 +454,7 @@ async function installToHub(reply, addonBridge, addonRegistry, addonPackageServi
             });
         }
         if (propagatable) {
-            void propagateToAgents(moleculer, logger, result.name, buffer).then((agentResults) => {
+            void propagateToAgents(moleculer, logger, result.name, buffer, hubBaseUrl).then((agentResults) => {
                 logger.info('propagation done', {
                     meta: { packageName: result.name, agents: agentResults },
                 });
@@ -434,10 +487,16 @@ function isAgentDeployResponse(value) {
         return false;
     return true;
 }
-async function deployToAgent(reply, moleculer, nodeId, addonId, buffer) {
+async function deployToAgent(reply, moleculer, nodeId, addonId, buffer, hubBaseUrl) {
     try {
         const broker = moleculer.broker;
-        const raw = await broker.call('$agent.deploy', { addonId, bundle: buffer }, { nodeID: nodeId, timeout: AGENT_DEPLOY_TIMEOUT_MS });
+        // The hub currently only ever sends the `hub-http` source (agent streams
+        // the tgz directly from this hub). The `{kind:'npm'}` source is a reserved
+        // follow-up (published-addon optimization) and is intentionally not produced
+        // yet. Wiring it later must also make the agent's npm path evict the addon's
+        // declaration ids before `$agent.reload`, otherwise an npm update pins the
+        // stale version.
+        const raw = await broker.call('$agent.deploy', { addonId, source: buildHubHttpSource(buffer, hubBaseUrl) }, { nodeID: nodeId, timeout: AGENT_DEPLOY_CONTROL_TIMEOUT_MS });
         if (!isAgentDeployResponse(raw)) {
             return reply.status(502).send({ error: 'Agent deploy returned malformed response' });
         }

package/dist/api/deploy-stage-registry.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeployStageRegistry = void 0;
+const node_crypto_1 = require("node:crypto");
+/**
+ * In-memory, single-use, TTL-bounded store of staged addon tarballs the hub
+ * serves to agents over HTTP. One entry per deploy target; the token is
+ * consumed on the first successful read so a bundle URL is never reusable.
+ */
+class DeployStageRegistry {
+    entries = new Map();
+    ttlMs;
+    now;
+    constructor(opts) {
+        this.ttlMs = opts?.ttlMs ?? 300_000;
+        this.now = opts?.now ?? Date.now;
+    }
+    stage(buffer) {
+        // Reclaim abandoned (never-consumed) entries before inserting a new one.
+        this.sweepExpired();
+        const id = (0, node_crypto_1.randomUUID)();
+        const token = (0, node_crypto_1.randomUUID)();
+        const sha256 = (0, node_crypto_1.createHash)('sha256').update(buffer).digest('hex');
+        this.entries.set(id, { token, buffer, sha256, expiresAt: this.now() + this.ttlMs });
+        return { id, token, sha256, bytes: buffer.length };
+    }
+    consume(id, token) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            return null;
+        if (this.now() > entry.expiresAt) {
+            this.entries.delete(id);
+            return null;
+        }
+        // Constant-time comparison: different byte lengths → not equal (no timing oracle).
+        const entryBuf = Buffer.from(entry.token);
+        const tokenBuf = Buffer.from(token);
+        if (entryBuf.length !== tokenBuf.length || !(0, node_crypto_1.timingSafeEqual)(entryBuf, tokenBuf))
+            return null;
+        this.entries.delete(id); // single-use
+        return entry.buffer;
+    }
+    peekExists(id) {
+        const e = this.entries.get(id);
+        if (!e)
+            return false;
+        if (this.now() > e.expiresAt) {
+            this.entries.delete(id);
+            return false;
+        }
+        return true;
+    }
+    sweepExpired() {
+        const t = this.now();
+        for (const [id, e] of this.entries)
+            if (t > e.expiresAt)
+                this.entries.delete(id);
+    }
+}
+exports.DeployStageRegistry = DeployStageRegistry;

package/dist/core/addon/addon-package.service.js

@@ -793,11 +793,11 @@ class AddonPackageService {
             // hub/node_modules/@camstack/ — addons resolve everything from
             // their own inlined deps.
             const addonsDir = this.resolveAddonsDir();
-            const { installPackageFromNpmSync } = await Promise.resolve().then(() => __importStar(require('@camstack/system')));
+            const { installPackageFromNpm } = await Promise.resolve().then(() => __importStar(require('@camstack/system')));
             const dirName = name.replace(/^@camstack\//, '');
             const targetDir = path.join(addonsDir, dirName);
             const packageSpec = version ? `${name}@${version}` : name;
-            installPackageFromNpmSync(packageSpec, targetDir);
+            await installPackageFromNpm(packageSpec, targetDir);
             updatedVersion = this.getInstalledPackageVersion(name);
             // Invalidate cache after update
             this.cachedUpdates = null;
@@ -1794,7 +1794,9 @@ async function packTarball(pkg, version, destRoot, registry) {
         await execFileAsync('npm', args, { timeout: 60_000, killSignal: 'SIGKILL' });
         const tgz = fs.readdirSync(dir).find((f) => f.endsWith('.tgz'));
         if (tgz === undefined) {
-            throw new Error(`download failed for ${pkg}@${version}: ${(0, types_1.errMsg)(httpErr)}`);
+            throw new Error(`download failed for ${pkg}@${version}: ${(0, types_1.errMsg)(httpErr)}`, {
+                cause: httpErr,
+            });
         }
         return path.join(dir, tgz);
     }

package/dist/core/addon/addon-registry.service.js

@@ -119,14 +119,14 @@ function parseSerializableRouteDescriptors(raw) {
             throw new Error('addon-routes: route descriptor is not an object');
         }
         const method = Reflect.get(entry, 'method');
-        const path = Reflect.get(entry, 'path');
-        if (typeof method !== 'string' || typeof path !== 'string') {
+        const routePath = Reflect.get(entry, 'path');
+        if (typeof method !== 'string' || typeof routePath !== 'string') {
             throw new Error('addon-routes: route descriptor missing method/path');
         }
         const description = Reflect.get(entry, 'description');
         return {
             method: asRouteMethod(method),
-            path,
+            path: routePath,
             access: asRouteAccess(Reflect.get(entry, 'access')),
             ...(typeof description === 'string' ? { description } : {}),
         };
@@ -2431,6 +2431,10 @@ class AddonRegistryService {
             capabilityRegistry: this.capabilityRegistry,
             streamProbe: kernelStreamProbe,
         });
+        // Captured for use inside the `ctx` object-literal getters/methods below
+        // (e.g. `get api()`), where `this` rebinds to the literal — an arrow can't
+        // be used for an accessor, so an explicit alias is required.
+        // eslint-disable-next-line @typescript-eslint/no-this-alias
         const registry = this;
         const rr = this.moleculer.readinessRegistry;
         const capHandleCache = new Map();

package/dist/core/addon/addon-settings-provider.js

@@ -58,12 +58,16 @@ function createAddonSettingsProvider(deps) {
                 const addon = getAddon(input.addonId);
                 if (!addon || typeof addon.getGlobalSettings !== 'function')
                     return null;
-                const result = await addon.getGlobalSettings(input.overlay, input.cap);
+                // Pass the REQUESTED nodeId so an addon serving a cluster-central,
+                // per-node config (the store is hub-resident) can scope to that node —
+                // the hub addon answers for every node, so it must not assume "self".
+                const result = await addon.getGlobalSettings(input.overlay, input.cap, input.nodeId);
                 return result ? reshapeForOutput(result) : null;
             }
             return forkedGet(input.addonId, 'getGlobalSettings', {
                 ...(input.overlay ? { overlay: input.overlay } : {}),
                 ...(input.cap ? { cap: input.cap } : {}),
+                ...(input.nodeId ? { nodeId: input.nodeId } : {}),
             }, input.nodeId);
         },
         async updateGlobalSettings(input) {
@@ -72,10 +76,10 @@ function createAddonSettingsProvider(deps) {
                 if (!addon || typeof addon.updateGlobalSettings !== 'function') {
                     throw new Error(`Addon "${input.addonId}" does not implement updateGlobalSettings`);
                 }
-                await addon.updateGlobalSettings(input.patch);
+                await addon.updateGlobalSettings(input.patch, input.nodeId);
                 return { success: true };
             }
-            return forkedUpdate(input.addonId, 'updateGlobalSettings', { patch: input.patch }, input.nodeId);
+            return forkedUpdate(input.addonId, 'updateGlobalSettings', { patch: input.patch, ...(input.nodeId ? { nodeId: input.nodeId } : {}) }, input.nodeId);
         },
         async getDeviceSettings(input) {
             if (gateway.isInProcess(input.addonId, input.nodeId)) {

package/dist/core/auth/auth.service.js

@@ -3,8 +3,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthService = void 0;
 const system_1 = require("@camstack/system");
 class AuthService extends system_1.AuthManager {
-    constructor(config) {
-        super(config);
-    }
 }
 exports.AuthService = AuthService;

package/dist/core/config/config.service.js

@@ -3,8 +3,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConfigService = void 0;
 const system_1 = require("@camstack/system");
 class ConfigService extends system_1.ConfigManager {
-    constructor(configPath) {
-        super(configPath);
-    }
 }
 exports.ConfigService = ConfigService;

package/dist/core/feature/feature.service.js

@@ -3,8 +3,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FeatureService = void 0;
 const system_1 = require("@camstack/system");
 class FeatureService extends system_1.FeatureManager {
-    constructor(configService) {
-        super(configService);
-    }
 }
 exports.FeatureService = FeatureService;

package/dist/core/moleculer/moleculer.service.js

@@ -266,18 +266,18 @@ class MoleculerService {
             // double-apply is idempotent (same nodeId + same caps → no-op on the second call).
             registry.onChildRegistered((child) => {
                 const hubNodeId = this.brokerSafe.nodeID;
-                const nodeId = `${hubNodeId}/${child.childId}`;
-                const params = buildChildUdsManifest(nodeId, child.childId, child.caps);
+                const childNodeId = `${hubNodeId}/${child.childId}`;
+                const params = buildChildUdsManifest(childNodeId, child.childId, child.caps);
                 this.onRegisterNode(params);
-                logger.info('UDS child registered — manifest applied', { meta: { nodeId } });
+                logger.info('UDS child registered — manifest applied', { meta: { nodeId: childNodeId } });
             });
             // E1: cleanup on child disconnect — same effect as `$node.disconnected`
             // for hub-local children. The Moleculer path stays for AGENT nodes.
             registry.onChildGone((childId) => {
                 const hubNodeId = this.brokerSafe.nodeID;
-                const nodeId = `${hubNodeId}/${childId}`;
+                const childNodeId = `${hubNodeId}/${childId}`;
                 logger.info('UDS child gone — removing from registry', { meta: { childId } });
-                this.removeNodeFromRegistry(nodeId);
+                this.removeNodeFromRegistry(childNodeId);
             });
             // B2: ingest UDS child logs into the hub's LoggingService so they appear
             // in the LogManager / admin-UI log stream alongside broker-forwarded logs.

package/dist/main.js

@@ -358,10 +358,10 @@ async function bootstrap() {
             trpcOptions: {
                 router: appRouter,
                 createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry),
-                onError: ({ path, error, }) => {
+                onError: ({ path: trpcPath, error, }) => {
                     const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC');
                     trpcLogger.warn('tRPC error', {
-                        meta: { code: error.code, path: path ?? '?', message: error.message },
+                        meta: { code: error.code, path: trpcPath ?? '?', message: error.message },
                     });
                     if (error.cause)
                         trpcLogger.warn('tRPC error cause', {
@@ -715,11 +715,11 @@ async function bootstrap() {
                     }
                 }
                 const qIdx = request.url.indexOf('?');
-                const query = qIdx >= 0 ? request.url.slice(qIdx) : '';
+                const queryString = qIdx >= 0 ? request.url.slice(qIdx) : '';
                 // Forward the FULL sub-path INCLUDING the prefix — the addon's facility
                 // multiplexes by prefix, so it strips the prefix itself. (`dpMatch.rest`
                 // is only used to pick the endpoint, not to rewrite the path.)
-                const upstreamPath = `/${subPath}${query}`;
+                const upstreamPath = `/${subPath}${queryString}`;
                 // Take over the socket — `proxyToUpstream` drives the raw response.
                 reply.hijack();
                 (0, system_1.proxyToUpstream)({
@@ -838,10 +838,10 @@ async function bootstrap() {
             wss,
             router: appRouter,
             createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry),
-            onError: ({ path, error, }) => {
+            onError: ({ path: trpcPath, error, }) => {
                 const trpcLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
                 trpcLogger.warn('tRPC error', {
-                    meta: { code: error.code, path: path ?? '?', message: error.message },
+                    meta: { code: error.code, path: trpcPath ?? '?', message: error.message },
                 });
                 if (error.cause)
                     trpcLogger.warn('tRPC error cause', {
@@ -899,8 +899,8 @@ async function bootstrap() {
     // no static file serving' warn that left the SPA unserved until next
     // restart.
     try {
-        const addonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
-        const capRegistry = addonRegistry.getCapabilityRegistry();
+        const bootAddonRegistry = app.get(addon_registry_service_1.AddonRegistryService);
+        const capRegistry = bootAddonRegistry.getCapabilityRegistry();
         let adminUI = capRegistry?.getSingleton('admin-ui');
         // CAMSTACK_SKIP_ADMIN_UI_WAIT — bypass the 60s poll. Used by the
         // e2e harness, which doesn't need the SPA served and spawns hubs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "private": false,
   "files": [
     "dist",