@camstack/server 1.1.38 → 1.1.40

package/dist/api/trpc/trpc.router.js

@@ -17,10 +17,8 @@ const repl_router_js_1 = require("../core/repl.router.js");
 const settings_backend_router_js_1 = require("../core/settings-backend.router.js");
 const stream_probe_router_js_1 = require("../core/stream-probe.router.js");
 const system_events_router_js_1 = require("../core/system-events.router.js");
-const cap_mount_helpers_js_1 = require("./cap-mount-helpers.js");
 const cap_router_runtime_js_1 = require("./cap-router-runtime.js");
 const client_ip_js_1 = require("./client-ip.js");
-const generated_cap_routers_1 = require("./generated-cap-routers");
 const trpc_middleware_1 = require("./trpc.middleware");
 /**
  * Merge the server-read User-Agent into a signaling call's
@@ -67,15 +65,18 @@ function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
     };
 }
 /**
- * Build the service-backed provider factory map (BIG PLAN 2). Caps marked
- * `mount: { kind: 'service-backed' }` have NO addon-registered provider —
- * the provider is composed from backend services. The runtime builder
- * resolves them through this map (keyed by cap NAME) instead of the
- * registry, keeping backend composition in `@camstack/server` (the
- * self-sufficiency invariant — `@camstack/system` never touches a backend
+ * Build the `server-provided` provider factory map (BIG PLAN 2). Caps marked
+ * `mount: { kind: 'server-provided' }` have their provider supplied by the
+ * server, keyed by cap NAME. The factory either composes backend services
+ * (`system`, `nodes`, `integrations`, `addons`, `network-quality`, `toast`) or
+ * transforms a registry provider (`webrtc-session` wraps the broker to inject
+ * the request User-Agent). The runtime builder mounts the route from the live
+ * def schemas and resolves the provider through this map instead of the
+ * registry — keeping backend composition in `@camstack/server` (the
+ * self-sufficiency invariant: `@camstack/system` never touches a backend
  * service). Each factory receives the per-request tRPC `ctx`.
  */
-function buildServiceProviders(services) {
+function buildServerProviders(services) {
     const wrap = (fn) => (ctx) => fn(ctx);
     return {
         'network-quality': wrap(() => (0, cap_providers_js_1.buildNetworkQualityProvider)(services.networkQualityService)),
@@ -84,6 +85,15 @@ function buildServiceProviders(services) {
         integrations: wrap(() => (0, cap_providers_js_1.buildIntegrationsProvider)(services.addonRegistry, services.eventBus, services.loggingService, services.capabilityRegistry)),
         nodes: wrap(() => (0, cap_providers_js_1.buildNodesProvider)(services.agentRegistry, services.moleculer, services.addonRegistry)),
         addons: wrap((ctx) => (0, cap_providers_js_1.buildAddonsProvider)(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx)),
+        // webrtc-session — the resolved broker singleton, wrapped per request to
+        // inject the server-read User-Agent into signaling attribution (the broker
+        // is a forked addon that can't see the HTTP request). Cross-node (agent-
+        // hosted broker) calls route through the generic remote-proxy leg and skip
+        // this local factory, exactly as the retired custom mount did.
+        'webrtc-session': wrap((ctx) => {
+            const provider = services.capabilityRegistry?.getSingleton('webrtc-session') ?? null;
+            return provider ? wrapWebrtcSessionProviderWithRelay(provider, ctx) : null;
+        }),
     };
 }
 /**
@@ -102,11 +112,10 @@ function buildServiceProviders(services) {
  * full procedure inference and `generate-api-types.ts` resolves the same
  * expanded type as before.
  *
- * Override-by-spread is preserved: spread the dynamic caps first, then the
- * hand-written core routers + the two `custom`-mount overrides
- * (snapshot-provider's probe fan-out, webrtc-session's relay enrichment),
- * which the generic builder intentionally leaves unmounted for the server
- * to fill.
+ * Spread order: the dynamic caps first, then the hand-written core (non-cap)
+ * routers. Every cap — including the former `custom` ones — is now built by the
+ * runtime builder; the server only supplies `server-provided` provider factories
+ * (`buildServerProviders`), never a hand-written cap-router override.
  */
 function buildCapabilityRouters(services) {
     // ── Dynamic cap routers (value) → static cap-router map (type). ──────
@@ -120,13 +129,15 @@ function buildCapabilityRouters(services) {
     const dynamicCaps = (0, cap_router_runtime_js_1.buildRuntimeCapRouters)({
         capabilityRegistry: services.capabilityRegistry,
         moleculer: services.moleculer,
-        serviceProviders: buildServiceProviders(services),
+        serverProviders: buildServerProviders(services),
     });
     return {
-        // ── Runtime-built cap routers: every cap whose mount is
-        //    `singleton` / `collection` / `device-native` / `service-backed`
-        //    / `hub-only`. `custom` + `skip` caps are NOT here — `skip` is
-        //    never mounted; `custom` is filled by the overrides below. ──────
+        // ── Runtime-built cap routers: EVERY cap whose mount is
+        //    `singleton` / `collection` / `device-native` / `server-provided`
+        //    / `hub-only`. Only `skip` caps are excluded (never mounted). The
+        //    former `custom` caps are gone: `snapshot-provider` was dead
+        //    (deleted); `webrtc-session` is now a `server-provided` cap resolved
+        //    by `buildServerProviders`. ──────
         ...dynamicCaps,
         // ── Non-cap (core) routers — hand-written, single-impl ──────────
         notifications: (0, notifications_router_js_1.createNotificationsRouter)(services.notificationService),
@@ -153,35 +164,6 @@ function buildCapabilityRouters(services) {
         // offline-node history (Track A "Forget node"); read side is push-only.
         clusterNodes: (0, cluster_nodes_router_js_1.createClusterNodesRouter)(services.agentRegistry),
         auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry),
-        // ── Cap overrides: `mount: { kind: 'custom' }` ──────────────────
-        // `snapshot-provider.supportsDevice` is an OR across providers;
-        // `getSnapshot` picks the first one that claims the device. The
-        // generic builder's first-provider/concat collection resolver can't
-        // model this — we hand-write the probe + fan-out logic.
-        snapshotProvider: (0, generated_cap_routers_1.createCapRouter_snapshotProvider)((_ctx) => {
-            const reg = services.capabilityRegistry;
-            if (!reg)
-                return null;
-            const providers = reg.getCollection('snapshot-provider');
-            if (!providers || providers.length === 0)
-                return null;
-            const supportsDevice = (0, cap_mount_helpers_js_1.anySupports)(providers, 'supportsDevice');
-            const getSnapshot = (0, cap_mount_helpers_js_1.firstSupported)(providers, 'supportsDevice', 'getSnapshot');
-            return { supportsDevice, getSnapshot };
-        }),
-        // `webrtc-session` — server-detected remote → relay-only. The broker
-        // (a forked addon) can't see the HTTP request, so it can't tell a LAN
-        // viewer from a remote one. We override `getProvider` to return a
-        // per-request provider whose `createSession` carries a server-computed
-        // `relayOnly` flag derived from the client IP in `ctx.req`. Remote
-        // (CGNAT/4G) viewers force TURN-relay-only ICE; LAN viewers keep the
-        // direct host/srflx path. All other methods delegate straight through,
-        // and the cross-node remote-proxy routing is preserved (forked/agent-
-        // hosted brokers).
-        webrtcSession: (0, generated_cap_routers_1.createCapRouter_webrtcSession)((ctx) => {
-            const provider = services.capabilityRegistry?.getSingleton('webrtc-session') ?? null;
-            return provider ? wrapWebrtcSessionProviderWithRelay(provider, ctx) : null;
-        }, (capName, nodeId) => services.moleculer.createCapabilityProxy(capName, nodeId)),
         // NOT MOUNTED — `mount: { kind: 'skip' }` legacy provider shapes
         // (positional args / sync returns) that don't match the codegen
         // routers' {input}-object + Promise<T> contract. The runtime builder

package/dist/core/addon/framework-live-sync.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveHubClosurePackageDir = resolveHubClosurePackageDir;
 exports.resolveOverlayPackageDir = resolveOverlayPackageDir;
 exports.computeDistBuildId = computeDistBuildId;
+exports.swapDist = swapDist;
 exports.syncFrameworkDist = syncFrameworkDist;
 /**
  * Framework live-sync — make a `camstack deploy` of a framework package
@@ -202,17 +203,27 @@ function computeDistBuildId(distDir) {
 // ---------------------------------------------------------------------------
 // Atomic dist swap (rename-aside)
 // ---------------------------------------------------------------------------
+function isCrossDeviceError(err) {
+    return err instanceof Error && err.code === 'EXDEV';
+}
 /**
- * Replace `<targetPkgDir>/dist` with a copy of `sourceDistDir`, atomically.
+ * Replace `<targetPkgDir>/dist` with a copy of `sourceDistDir`.
+ *
+ * 1. COPY `sourceDistDir` → a staging dir INSIDE the target dir. The live
+ *    `dist/` is untouched, so a mid-copy failure cannot corrupt it.
+ * 2. Evict the current `dist/` aside (rename), then rename the staging dir into
+ *    place. Both renames are metadata ops WITHIN the target fs (atomic). If the
+ *    final swap fails, the previous `dist/` is restored.
  *
- * 1. Cross-device COPY `sourceDistDir` → a staging dir INSIDE the target's
- *    filesystem. The live `dist/` is untouched, so a mid-copy failure cannot
- *    corrupt it.
- * 2. Rename the current `dist/` aside, then rename the staging dir into place.
- *    Both renames are metadata ops WITHIN the target fs (atomic). If the final
- *    swap fails, the previous `dist/` is restored so the target is never left
- *    without one.
- * 3. Best-effort delete of the evicted copy.
+ * OVERLAYFS FALLBACK: the hub-closure target (`/opt/.../@camstack/system`) lives
+ * on the container's overlay rootfs. A `dist/` materialized from a LOWER image
+ * layer cannot be `rename()`d (overlayfs returns `EXDEV: cross-device link`),
+ * so the atomic aside/swap is impossible there. On EXDEV we fall back to a
+ * copy-aside restore point + in-place replace. This opens a brief non-atomic
+ * window, but it is safe here: the running process already holds the old
+ * modules in memory (nothing reads `dist/` until the scheduled restart), and
+ * the copy-aside is kept until the replace completes so a failure is
+ * recoverable.
  */
 async function swapDist(sourceDistDir, targetPkgDir) {
     const targetDist = path.join(targetPkgDir, 'dist');
@@ -227,24 +238,63 @@ async function swapDist(sourceDistDir, targetPkgDir) {
         await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
         throw err;
     }
-    // Step 2 — atomic swap within the target fs.
     const hadDist = fs.existsSync(targetDist);
+    // How the previous dist was preserved: 'rename' (moved aside, same fs),
+    // 'copy' (overlayfs EXDEV — copied aside then removed in place), or 'none'.
+    let asideKind = 'none';
+    const restorePreviousDist = async () => {
+        if (asideKind === 'none' || fs.existsSync(targetDist))
+            return;
+        if (asideKind === 'rename') {
+            await fs.promises.rename(aside, targetDist).catch(() => undefined);
+        }
+        else {
+            await fs.promises
+                .cp(aside, targetDist, { recursive: true, force: true })
+                .catch(() => undefined);
+        }
+    };
+    // Step 2 — evict the current dist. Prefer the atomic rename; fall back to
+    // copy-aside + in-place remove on overlayfs EXDEV.
     if (hadDist) {
-        await fs.promises.rename(targetDist, aside);
+        try {
+            await fs.promises.rename(targetDist, aside);
+            asideKind = 'rename';
+        }
+        catch (err) {
+            if (!isCrossDeviceError(err)) {
+                await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+                throw err;
+            }
+            await fs.promises.cp(targetDist, aside, { recursive: true, force: true });
+            await fs.promises.rm(targetDist, { recursive: true, force: true });
+            asideKind = 'copy';
+        }
     }
+    // Step 3 — move the incoming dist into place; fall back to copy on EXDEV.
     try {
         await fs.promises.rename(incoming, targetDist);
     }
-    catch (swapErr) {
-        // Restore the previous dist so the target is never left without one.
-        if (hadDist) {
-            await fs.promises.rename(aside, targetDist).catch(() => undefined);
+    catch (err) {
+        if (isCrossDeviceError(err)) {
+            try {
+                await fs.promises.cp(incoming, targetDist, { recursive: true, force: true });
+                await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+            }
+            catch (copyErr) {
+                await restorePreviousDist();
+                await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+                throw copyErr;
+            }
+        }
+        else {
+            await restorePreviousDist();
+            await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+            throw err;
         }
-        await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
-        throw swapErr;
     }
-    // Step 3 — best-effort cleanup of the evicted copy.
-    if (hadDist) {
+    // Step 4 — best-effort cleanup of the evicted copy.
+    if (asideKind !== 'none') {
         await fs.promises.rm(aside, { recursive: true, force: true }).catch(() => undefined);
     }
 }

package/dist/core/moleculer/moleculer.service.js

@@ -6,6 +6,7 @@ const node_crypto_1 = require("node:crypto");
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 const cap_router_runtime_js_1 = require("../../api/trpc/cap-router-runtime.js");
+const core_cap_bridge_js_1 = require("../../api/trpc/core-cap-bridge.js");
 const cap_call_fn_js_1 = require("./cap-call-fn.js");
 const cap_route_authority_js_1 = require("./cap-route-authority.js");
 class MoleculerService {
@@ -280,6 +281,16 @@ class MoleculerService {
                         return null;
                     return [];
                 },
+                // Hub-core `$`-service discriminant for the general
+                // provider-not-yet-registered recovery. A resolver miss on a NON-core
+                // cap (any addon-provided system/singleton cap, e.g.
+                // `pipeline-orchestrator`) means its broker-less forked provider hasn't
+                // registered YET — the unpinned broker fallback is a dead path that
+                // 30s-deadlines into `${cap}.${cap}.${method}`. Feeding the handler this
+                // predicate lets it retry the resolver + throw a precise error instead.
+                // Derived from the already-maintained core-router list, so a new
+                // multi-node addon cap is covered with no change here.
+                isCoreServiceCap: (capName) => (0, core_cap_bridge_js_1.isCoreServiceCapName)(capName),
                 logger: {
                     warn: (msg, meta) => logger.warn(msg, meta !== null && meta !== undefined
                         ? { meta: meta }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.38",
+  "version": "1.1.40",
   "private": false,
   "files": [
     "dist",