@camstack/server 1.1.42 → 1.1.44

package/dist/api/addon-upload.js

@@ -43,7 +43,7 @@ const os = __importStar(require("node:os"));
 const node_child_process_1 = require("node:child_process");
 const scope_access_js_1 = require("./trpc/scope-access.js");
 const addon_package_service_js_1 = require("../core/addon/addon-package.service.js");
-const framework_live_sync_js_1 = require("../core/addon/framework-live-sync.js");
+const index_js_1 = require("../server-root/index.js");
 const deploy_stage_registry_js_1 = require("./deploy-stage-registry.js");
 const deployStageRegistry = new deploy_stage_registry_js_1.DeployStageRegistry();
 function getDeployStageRegistry() {
@@ -406,38 +406,43 @@ async function installToHub(reply, addonBridge, addonRegistry, addonPackageServi
         // and re-runs boot initialization. The 10s restart grace lets this response
         // flush before the process exits, so the CLI sees a clean confirmation.
         if ((0, addon_package_service_js_1.isFrameworkPackage)(result.name)) {
-            // `installFromTgz` wrote the built tree to `${addonsDir}/<pkg>` — a path
-            // NO runtime consumer loads: the hub main resolves the framework from its
-            // OWN node_modules closure (walk-up beats NODE_PATH) and forked addon
-            // runners resolve it from CAMSTACK_FRAMEWORK_DIR via the ESM hook. Mirror
-            // the freshly-built `dist/` into BOTH so the restart below actually loads
-            // the new code (otherwise the bounce reloads the identical old code).
-            const sourceDistDir = path.join(addonsDir, result.name, 'dist');
-            const frameworkSync = await (0, framework_live_sync_js_1.syncFrameworkDist)({
-                packageName: result.name,
-                sourceDistDir,
-                logger,
-            });
-            const syncFailed = frameworkSync.results.filter((r) => !r.ok);
-            logger.info('framework package deployed — scheduling server restart', {
-                meta: {
-                    packageName: result.name,
-                    packageVersion: result.version,
-                    syncedTargets: frameworkSync.results.filter((r) => r.ok).map((r) => r.role),
-                    failedTargets: syncFailed.map((r) => r.role),
-                },
+            // Framework live-sync is GONE (superseded by the runtime-updatable root
+            // package — the hub main + its framework deps now update as ONE
+            // `@camstack/server` closure via the `server-management` cap).
+            //
+            // Dev loop compatibility: in a workspace checkout the hub resolves the
+            // framework straight from `packages/<pkg>/dist`, which the CLI rebuilt
+            // BEFORE uploading — a plain restart loads the new code, no mirror
+            // needed. `camstack deploy packages/system` therefore keeps working in
+            // dev unchanged.
+            const workspaceRoot = (0, index_js_1.detectWorkspaceRoot)(__dirname);
+            if (workspaceRoot !== null) {
+                logger.info('framework package deployed (workspace) — scheduling server restart', {
+                    meta: { packageName: result.name, packageVersion: result.version, workspaceRoot },
+                });
+                addonPackageService.restartServer(`addon-upload: ${result.name}@${result.version}`);
+                return reply.send({
+                    success: true,
+                    name: result.name,
+                    version: result.version,
+                    requiresRestart: true,
+                    restarting: true,
+                    message: 'Framework package installed — server is restarting to load it from the workspace',
+                });
+            }
+            // Production (baked/data-root): the upload landed in the addons dir — a
+            // location the hub main never loads the framework from. Direct the
+            // operator to the supported path instead of pretending it went live.
+            logger.warn('framework package upload REJECTED for live update (non-workspace hub)', {
+                meta: { packageName: result.name, packageVersion: result.version },
             });
-            addonPackageService.restartServer(`addon-upload: ${result.name}@${result.version}`);
-            return reply.send({
-                success: true,
+            return reply.status(409).send({
+                success: false,
                 name: result.name,
                 version: result.version,
-                requiresRestart: true,
-                restarting: true,
-                frameworkSync: frameworkSync.results,
-                message: syncFailed.length > 0
-                    ? 'Framework package installed but one or more live locations could not be updated — restarting anyway'
-                    : 'Framework package installed — server is restarting to load it',
+                error: 'Framework packages no longer live-update via upload on a deployed hub. ' +
+                    'Update the @camstack/server root package instead (Server management → Update, ' +
+                    'or the server-management.applyServerUpdate cap method).',
             });
         }
         // `addonRegistry.loadNewAddons()` already runs its own fresh filesystem

package/dist/api/core/auth.router.js

@@ -10,20 +10,37 @@ exports.createAuthRouter = createAuthRouter;
  * JWT signing stays in the server — it's a transport-level concern
  * (the server owns the secret and the HTTP session).
  *
- * External auth providers are listed via the `auth-provider` cap collection.
+ * Pre-auth login surfaces (OIDC / magic-link redirect buttons + the
+ * passkey second-factor widget) are aggregated for the login page by the
+ * public `listLoginMethods` procedure from the `login-method` cap
+ * collection — the single, generic mechanism every auth addon contributes
+ * to (superseding the removed `auth.listProviders`).
  */
 const zod_1 = require("zod");
+const types_1 = require("@camstack/types");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 /**
- * Login response — discriminated on `requiresTotp`.
+ * The available second-factor kinds a user may satisfy after the
+ * password leg. Capability-driven — `totp` maps to the
+ * `user-management` cap's TOTP surface, `passkey` to ANY provider of
+ * the `user-passkeys` cap. The client renders a chooser from this list
+ * so a future alternate 2FA cap works with zero login-flow changes.
+ */
+const SecondFactorSchema = zod_1.z.enum(['totp', 'passkey']);
+/**
+ * Login response.
+ *
+ *   • `secondFactors` empty / absent: the credentials were sufficient,
+ *     `token` is the real session JWT.
+ *   • `secondFactors` non-empty: the user has one or more second
+ *     factors enrolled. `token` is a short-lived (5 min) challenge
+ *     token, NOT a session. The client presents the factor chooser and
+ *     completes ONE of: `loginVerifyTotp` (`totp`) or
+ *     `loginBeginPasskey` + `loginVerifyPasskey` (`passkey`). Only on
+ *     success does the server mint the real session.
  *
- *   • `requiresTotp: false` (or absent in the legacy path): the
- *     credentials were sufficient, `token` is the real session JWT.
- *   • `requiresTotp: true`: the user has TOTP enrolled. `token` is a
- *     short-lived (5 min) challenge token, NOT a session. The client
- *     prompts for a 6-digit code and submits to `loginVerifyTotp`
- *     with `{challengeToken, code}`. Only on success does the server
- *     mint the real session.
+ * `requiresTotp` is retained (`= secondFactors.includes('totp')`) for
+ * backward compatibility with older SDK builds that branch on it.
  */
 const LoginResultSchema = zod_1.z.object({
     token: zod_1.z.string(),
@@ -33,13 +50,79 @@ const LoginResultSchema = zod_1.z.object({
         isAdmin: zod_1.z.boolean(),
     }),
     requiresTotp: zod_1.z.boolean().optional(),
+    secondFactors: zod_1.z.array(SecondFactorSchema).optional(),
 });
-const AuthProviderSummarySchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    name: zod_1.z.string(),
-    icon: zod_1.z.string(),
-    flowType: zod_1.z.string(),
+// ── Passkey (user-passkeys cap) resolution ───────────────────────────
+//
+// Cap-agnostic: the passkey provider is resolved through the
+// `user-passkeys` CAPABILITY, never by addon id. Any addon registering
+// the cap works. Resolution mirrors `hwaccel.router`:
+//   1. hub-in-process collection provider (a future hub-resident impl),
+//   2. else the hub-local forked child over UDS via the Moleculer cap
+//      proxy (`createCapabilityProxy(cap, 'hub')`) — the same routing the
+//      generated cap routers use.
+// The proxy is loosely typed (`Record<method, (params)=>Promise<unknown>>`);
+// its outputs are narrowed through the cap's own Zod schemas rather than
+// cast to the provider type (repo rule: no `as` on cross-boundary values).
+const OptionsJsonSchema = zod_1.z.object({ optionsJSON: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) });
+const FinishRegistrationSchema = zod_1.z.object({ success: zod_1.z.literal(true), credentialId: zod_1.z.string() });
+const FinishAuthenticationSchema = zod_1.z.object({ verified: zod_1.z.boolean() });
+const RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+function proxyPasskeyProvider(proxy) {
+    const call = async (method, params) => {
+        const fn = proxy[method];
+        if (typeof fn !== 'function')
+            throw new Error(`user-passkeys proxy missing method '${method}'`);
+        return fn(params);
+    };
+    return {
+        beginRegistration: async (input) => OptionsJsonSchema.parse(await call('beginRegistration', input)),
+        finishRegistration: async (input) => FinishRegistrationSchema.parse(await call('finishRegistration', input)),
+        beginAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginAuthentication', input)),
+        finishAuthentication: async (input) => FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
+        listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
+        removePasskey: async (input) => RemovePasskeySchema.parse(await call('removePasskey', input)),
+    };
+}
+function resolvePasskeyProvider(registry, moleculer) {
+    const local = registry?.getCollection('user-passkeys')?.[0] ?? null;
+    if (local)
+        return local;
+    const proxy = moleculer?.createCapabilityProxy('user-passkeys', 'hub') ?? null;
+    return proxy ? proxyPasskeyProvider(proxy) : null;
+}
+/**
+ * Whether the user has at least one enrolled passkey. Never throws — a
+ * missing provider or a transport hiccup degrades to `false` so the
+ * login flow is never blocked by passkey introspection.
+ */
+async function userHasPasskey(userId, provider) {
+    if (!provider)
+        return false;
+    try {
+        const list = await provider.listPasskeys({ userId });
+        return list.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+// ── Login-method aggregation (login-method cap) ──────────────────────
+//
+// The PUBLIC `listLoginMethods` procedure walks the `login-method`
+// collection and returns the union that the login page renders directly:
+// `redirect` buttons (OIDC / magic-link) + pre-auth `widget`s (passkey).
+// The widget arm is enriched server-side with a public `bundleUrl` from
+// `addonId` + `bundle`, so the addon never encodes the static-route
+// scheme. `?v=<now>` guards against a stale cached bundle after an addon
+// update (the login page loads rarely, so cache-busting is free here).
+const PublicWidgetLoginMethodSchema = types_1.WidgetLoginMethodSchema.extend({
+    bundleUrl: zod_1.z.string(),
 });
+const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
+    types_1.RedirectLoginMethodSchema,
+    PublicWidgetLoginMethodSchema,
+]);
 /** Wire shape of the authenticated user returned by `auth.me`. */
 const MeSchema = zod_1.z
     .object({
@@ -55,7 +138,7 @@ const MeSchema = zod_1.z
     agentId: zod_1.z.string().optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry) {
+function createAuthRouter(auth, registry, moleculer = null) {
     return (0, trpc_middleware_js_1.trpcRouter)({
         login: trpc_middleware_js_1.publicProcedure
             .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string() }))
@@ -78,19 +161,25 @@ function createAuthRouter(auth, registry) {
             });
             if (!user)
                 throw new Error('Invalid credentials');
-            // ── TOTP gate ────────────────────────────────────────────────
-            // After credentials validate, check whether the user has
-            // active 2FA enrollment. If yes, mint a SHORT-LIVED challenge
-            // token instead of the real session — the client must follow
-            // up via `loginVerifyTotp` with a valid 6-digit code before
-            // we hand out the actual JWT. The challenge token carries
-            // `kind: 'totp-challenge'` so it can't be replayed against
-            // protected endpoints (the auth middleware rejects anything
-            // without the standard session shape).
+            // ── Second-factor gate ───────────────────────────────────────
+            // After credentials validate, check every enrolled second
+            // factor. If ANY is present, mint a SHORT-LIVED challenge token
+            // instead of the real session — the client must complete one
+            // factor before we hand out the actual JWT. The challenge token
+            // carries `kind: 'totp-challenge'` so it can't be replayed
+            // against protected endpoints (the auth middleware rejects
+            // anything without the standard session shape); the same token
+            // binds both the TOTP and the passkey second legs (same userId).
             const totpStatus = typeof userMgmt.getTotpStatus === 'function'
                 ? await userMgmt.getTotpStatus({ userId: user.id })
                 : { enabled: false };
-            if (totpStatus.enabled) {
+            const passkeyEnrolled = await userHasPasskey(user.id, resolvePasskeyProvider(registry, moleculer));
+            const secondFactors = [];
+            if (totpStatus.enabled)
+                secondFactors.push('totp');
+            if (passkeyEnrolled)
+                secondFactors.push('passkey');
+            if (secondFactors.length > 0) {
                 const challengeToken = auth.signTotpChallengeToken({
                     userId: user.id,
                     username: user.username,
@@ -99,7 +188,8 @@ function createAuthRouter(auth, registry) {
                 return {
                     token: challengeToken,
                     user: { id: user.id, username: user.username, isAdmin: user.isAdmin },
-                    requiresTotp: true,
+                    requiresTotp: totpStatus.enabled,
+                    secondFactors,
                 };
             }
             // Snapshot `scopes` into the JWT payload. Admins ignore the
@@ -177,6 +267,75 @@ function createAuthRouter(auth, registry) {
                 requiresTotp: false,
             };
         }),
+        /**
+         * Passkey second leg — step 1 of 2. Accepts the challenge token
+         * minted by `login` and returns the WebAuthn assertion options
+         * (`PublicKeyCredentialRequestOptionsJSON`) scoped to the user's
+         * enrolled credentials (strict-user `allowCredentials`). PUBLIC —
+         * the client is still pre-session at this point.
+         */
+        loginBeginPasskey: trpc_middleware_js_1.publicProcedure
+            .input(zod_1.z.object({ challengeToken: zod_1.z.string() }))
+            .output(OptionsJsonSchema)
+            .mutation(async ({ input }) => {
+            const claims = auth.verifyTotpChallengeToken(input.challengeToken);
+            if (!claims) {
+                throw new Error('Invalid or expired login challenge — please re-enter your password');
+            }
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey authentication is not available');
+            return provider.beginAuthentication({ userId: claims.userId });
+        }),
+        /**
+         * Passkey second leg — step 2 of 2. Accepts the challenge token +
+         * the browser assertion (`AuthenticationResponseJSON`). Verifies the
+         * assertion via the `user-passkeys` cap and, on success, mints the
+         * real session JWT through the SAME `auth.signToken` path
+         * `loginVerifyTotp` uses (fresh user re-fetch for up-to-date scopes).
+         */
+        loginVerifyPasskey: trpc_middleware_js_1.publicProcedure
+            .input(zod_1.z.object({ challengeToken: zod_1.z.string(), response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
+            .output(LoginResultSchema)
+            .mutation(async ({ input }) => {
+            const claims = auth.verifyTotpChallengeToken(input.challengeToken);
+            if (!claims) {
+                throw new Error('Invalid or expired login challenge — please re-enter your password');
+            }
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey authentication is not available');
+            const result = await provider.finishAuthentication({
+                userId: claims.userId,
+                response: input.response,
+            });
+            if (!result.verified) {
+                throw new Error('Passkey verification failed');
+            }
+            const userMgmt = registry?.getSingleton('user-management');
+            if (!userMgmt) {
+                throw new Error('Login unavailable — `user-management` capability not registered');
+            }
+            const fresh = typeof userMgmt.listUsers === 'function'
+                ? (await userMgmt.listUsers()).find((u) => u.id === claims.userId)
+                : null;
+            if (!fresh) {
+                throw new Error('User no longer exists');
+            }
+            const sessionToken = auth.signToken({
+                userId: fresh.id,
+                username: fresh.username,
+                isAdmin: fresh.isAdmin,
+                allowedProviders: fresh.allowedProviders ?? '*',
+                allowedDevices: fresh.allowedDevices ?? {},
+                scopes: fresh.scopes ?? [],
+            });
+            return {
+                token: sessionToken,
+                user: { id: fresh.id, username: fresh.username, isAdmin: fresh.isAdmin },
+                requiresTotp: false,
+            };
+        }),
         me: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
             .output(MeSchema)
@@ -259,26 +418,114 @@ function createAuthRouter(auth, registry) {
                 return { enabled: false, confirmedAt: null };
             return userMgmt.getTotpStatus({ userId: ctx.user.id });
         }),
+        // ── Self-service passkey enrollment (the signed-in user) ──────────
+        //
+        // The `user-passkeys` cap gates registration/management as `admin`
+        // at the trpc layer. These bind `userId` to `ctx.user.id` and call
+        // the provider server-side, so a non-admin user can enroll / revoke
+        // THEIR OWN passkeys — the router is the trust boundary, exactly like
+        // the TOTP self-service block above. Cap-agnostic: resolved through
+        // the `user-passkeys` cap, never an addon id.
+        beginOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(OptionsJsonSchema)
+            .mutation(async ({ ctx }) => {
+            if (!ctx.user)
+                throw new Error('Not authenticated');
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey enrollment is not available');
+            return provider.beginRegistration({ userId: ctx.user.id, username: ctx.user.username });
+        }),
+        finishOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()), label: zod_1.z.string() }))
+            .output(FinishRegistrationSchema)
+            .mutation(async ({ input, ctx }) => {
+            if (!ctx.user)
+                throw new Error('Not authenticated');
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey enrollment is not available');
+            return provider.finishRegistration({
+                userId: ctx.user.id,
+                response: input.response,
+                label: input.label,
+            });
+        }),
+        listOwnPasskeys: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(types_1.PasskeySummarySchema))
+            .query(async ({ ctx }) => {
+            if (!ctx.user)
+                return [];
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                return [];
+            try {
+                return await provider.listPasskeys({ userId: ctx.user.id });
+            }
+            catch {
+                return [];
+            }
+        }),
+        removeOwnPasskey: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ credentialId: zod_1.z.string() }))
+            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
+            .mutation(async ({ input, ctx }) => {
+            if (!ctx.user)
+                throw new Error('Not authenticated');
+            const provider = resolvePasskeyProvider(registry, moleculer);
+            if (!provider)
+                throw new Error('Passkey management is not available');
+            return provider.removePasskey({ userId: ctx.user.id, credentialId: input.credentialId });
+        }),
         logout: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
             .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
             .mutation(() => ({ success: true })),
-        listProviders: trpc_middleware_js_1.publicProcedure
+        /**
+         * PUBLIC — the login page's single source of pre-auth login surfaces.
+         * Aggregates the `login-method` collection: every auth addon (OIDC,
+         * magic-link, WebAuthn) contributes `redirect` buttons and/or pre-auth
+         * `widget`s, each tagged `stage: 'primary' | 'second-factor'`. The
+         * login page renders `redirect` methods as generic buttons and mounts
+         * `widget` methods via `loadRemoteBundle` — a future SSO addon plugs
+         * in with ZERO shell change.
+         *
+         * A failing / slow provider is skipped independently (mirrors
+         * `listProviders`' old resilience) so one bad addon can't lock every
+         * login method out of the UI.
+         */
+        listLoginMethods: trpc_middleware_js_1.publicProcedure
             .input(zod_1.z.void())
-            .output(zod_1.z.array(AuthProviderSummarySchema).readonly())
-            .query(() => {
+            .output(zod_1.z.array(PublicLoginMethodSchema).readonly())
+            .query(async () => {
             if (!registry)
                 return [];
-            // Validate each auth-provider entry independently. A single
-            // malformed entry (e.g. an auth addon that registers without an
-            // `icon`) must NOT sink the whole array through the tRPC output
-            // validator — that would 500 the query and lock every login
-            // method out of the UI. Drop the bad entry, keep the rest.
             const out = [];
-            for (const entry of registry.getCollection('auth-provider')) {
-                const parsed = AuthProviderSummarySchema.safeParse(entry);
-                if (parsed.success)
-                    out.push(parsed.data);
+            for (const provider of registry.getCollection('login-method')) {
+                let contributions;
+                try {
+                    contributions = await provider.getLoginMethods();
+                }
+                catch {
+                    continue;
+                }
+                for (const raw of contributions) {
+                    if (raw.kind === 'redirect') {
+                        const parsed = types_1.RedirectLoginMethodSchema.safeParse(raw);
+                        if (parsed.success)
+                            out.push(parsed.data);
+                        continue;
+                    }
+                    // Widget arm — stamp a public bundleUrl from addonId + bundle.
+                    const parsed = PublicWidgetLoginMethodSchema.safeParse({
+                        ...raw,
+                        bundleUrl: `/api/addon-widgets/${raw.addonId}/${raw.bundle}?v=${Date.now()}`,
+                    });
+                    if (parsed.success)
+                        out.push(parsed.data);
+                }
             }
             return out;
         }),

package/dist/api/core/cap-providers.js

@@ -38,6 +38,7 @@ exports.buildSystemProvider = buildSystemProvider;
 exports.buildNetworkQualityProvider = buildNetworkQualityProvider;
 exports.buildToastProvider = buildToastProvider;
 exports.computeTopology = computeTopology;
+exports.createNodeRootPackageLookup = createNodeRootPackageLookup;
 exports.buildNodesProvider = buildNodesProvider;
 exports.buildIntegrationsProvider = buildIntegrationsProvider;
 exports.buildAddonsProvider = buildAddonsProvider;
@@ -165,7 +166,7 @@ function getLocalIps() {
  * `nodes.topology` cap procedure. Extracted so the topology emitter
  * service can produce identical snapshots without going through tRPC.
  */
-async function computeTopology(agentRegistry, addonRegistry) {
+async function computeTopology(agentRegistry, addonRegistry, getNodeRootPackage) {
     const nodes = await agentRegistry.listNodes();
     // A2: durable offline-node history. `listNodes()` (above) has just
     // snapshotted every ONLINE node into this store, so `lastActive` is fresh
@@ -300,6 +301,10 @@ async function computeTopology(agentRegistry, addonRegistry) {
             addons: allNodeAddons,
             processes: [mainProcess, ...childProcesses],
             categories: categoriesProjection,
+            // Runtime-updatable node packages: the node's root-package identity
+            // (hub: the running @camstack/server; agents: their registerNode
+            // manifest via HubNodeRegistry). Null when unknown.
+            rootPackage: getNodeRootPackage?.(node.info.id, node.isHub) ?? null,
         };
     });
     // A2: union in OFFLINE rows for every persisted node no longer present in the
@@ -332,13 +337,30 @@ async function computeTopology(agentRegistry, addonRegistry) {
         })),
         processes: [],
         categories: [],
+        rootPackage: null,
     }));
     return [...liveNodes, ...offlineNodes];
 }
-function buildNodesProvider(agentRegistry, moleculer, addonRegistry) {
+/**
+ * Build the standard {@link NodeRootPackageLookup}: hub rows come from the
+ * running `@camstack/server` package (ServerUpdateService), agent rows from
+ * the `registerNode`-fed HubNodeRegistry (via MoleculerService).
+ */
+function createNodeRootPackageLookup(moleculer, serverUpdate) {
+    return (nodeId, isHub) => {
+        if (isHub) {
+            const running = serverUpdate?.getRunningRootPackage();
+            return running === undefined || running.version === null
+                ? null
+                : { name: running.name, version: running.version };
+        }
+        return moleculer.getNodeRootPackage(nodeId);
+    };
+}
+function buildNodesProvider(agentRegistry, moleculer, addonRegistry, getNodeRootPackage) {
     const broker = moleculer.broker;
     return {
-        topology: async () => computeTopology(agentRegistry, addonRegistry),
+        topology: async () => computeTopology(agentRegistry, addonRegistry, getNodeRootPackage),
         deployAddon: async () => {
             // Placeholder — actual deployment orchestration TBD
             return { success: true };

package/dist/api/core/server-management.provider.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildServerManagementProvider = buildServerManagementProvider;
+function buildServerManagementProvider(service) {
+    if (service === null)
+        return null;
+    return {
+        getServerPackageStatus: () => service.getServerPackageStatus(),
+        checkServerUpdate: () => service.checkServerUpdate(),
+        applyServerUpdate: (input) => service.applyServerUpdate(input),
+        rollbackServerUpdate: () => service.rollbackServerUpdate(),
+        restartServer: () => Promise.resolve(service.restartNode()),
+    };
+}

package/dist/api/health/health.routes.js

@@ -75,6 +75,11 @@ function registerHealthRoutes(fastify, deps) {
             reply.status(503);
         return health;
     });
+    // Zero-config LAN discovery — unauthenticated, always 200. See DiscoveryInfo.
+    fastify.get('/discovery', async () => {
+        const name = process.env['CAMSTACK_HUB_NAME'] ?? 'CamStack Hub';
+        return { service: 'camstack-hub', nodeId: 'hub', version: deps.hubVersion, name };
+    });
     fastify.get('/health/agents', async () => {
         const nodes = deps.agentRegistry.listNodeLiveness();
         return { agents: nodes.filter((n) => !n.isHub && n.isOnline).map((n) => n.id) };

package/dist/api/static/spa-static.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * spa-static — shared static-serving helpers for the SPAs the hub mounts
+ * (admin-ui at `/`, viewer-ui at `/viewer/camstack`). Extracted so both
+ * mount points apply IDENTICAL cache policy: content-hashed build assets are
+ * immutable; the service worker / registration / web manifest + the SPA shell
+ * (`index.html`) always revalidate so a redeploy actually reaches clients.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spaAssetCacheControl = spaAssetCacheControl;
+exports.contentTypeForPath = contentTypeForPath;
+/**
+ * Cache-Control value for a static SPA asset addressed by its dist-relative
+ * path. Policy (shared by admin-ui + viewer-ui):
+ *   - `sw.js` / `registerSW.js` / `workbox-*.js` / `manifest.webmanifest`
+ *     → `no-cache, must-revalidate` (PWA update propagation).
+ *   - Content-hashed build assets under `assets/` (Vite) or `_expo/` (Expo
+ *     web export) → `public, max-age=31536000, immutable`.
+ *   - Everything else (index.html, favicon, non-hashed files) → `no-cache`.
+ */
+function spaAssetCacheControl(rel) {
+    const base = rel.split('/').pop() ?? rel;
+    if (/^(sw\.js|registerSW\.js|workbox-.*\.js|manifest\.webmanifest)$/.test(base)) {
+        return 'no-cache, must-revalidate';
+    }
+    const inAssetDir = rel.startsWith('assets/') || rel.startsWith('_expo/');
+    if (inAssetDir && /-[A-Za-z0-9_-]{8,}\./.test(base)) {
+        return 'public, max-age=31536000, immutable';
+    }
+    return 'no-cache';
+}
+const CONTENT_TYPES = {
+    html: 'text/html; charset=utf-8',
+    js: 'text/javascript; charset=utf-8',
+    mjs: 'text/javascript; charset=utf-8',
+    css: 'text/css; charset=utf-8',
+    json: 'application/json; charset=utf-8',
+    map: 'application/json; charset=utf-8',
+    webmanifest: 'application/manifest+json; charset=utf-8',
+    wasm: 'application/wasm',
+    txt: 'text/plain; charset=utf-8',
+    xml: 'application/xml; charset=utf-8',
+    svg: 'image/svg+xml',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    avif: 'image/avif',
+    ico: 'image/x-icon',
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    ttf: 'font/ttf',
+    otf: 'font/otf',
+    eot: 'application/vnd.ms-fontobject',
+    mp4: 'video/mp4',
+    webm: 'video/webm',
+};
+/**
+ * Best-effort MIME type for a static file path. Used when streaming viewer
+ * assets directly (the admin-ui path goes through @fastify/static). Defaults
+ * to `application/octet-stream` for unknown extensions.
+ */
+function contentTypeForPath(pathname) {
+    const base = pathname.split('/').pop() ?? pathname;
+    const dot = base.lastIndexOf('.');
+    const ext = dot >= 0 ? base.slice(dot + 1).toLowerCase() : '';
+    return CONTENT_TYPES[ext] ?? 'application/octet-stream';
+}