@camstack/server 1.1.53 → 1.1.55

package/dist/api/addon-upload.js

@@ -40,8 +40,8 @@ exports.registerAddonUploadRoute = registerAddonUploadRoute;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
-const node_child_process_1 = require("node:child_process");
-const scope_access_js_1 = require("./trpc/scope-access.js");
+const tarball_manifest_js_1 = require("./tarball-manifest.js");
+const upload_auth_js_1 = require("./upload-auth.js");
 const addon_package_service_js_1 = require("../core/addon/addon-package.service.js");
 const index_js_1 = require("../server-root/index.js");
 const deploy_stage_registry_js_1 = require("./deploy-stage-registry.js");
@@ -78,40 +78,6 @@ function registerDeployBundleRoute(fastify) {
         reply.header('content-type', 'application/octet-stream').send(buffer);
     });
 }
-/**
- * Validate a `cst_*` scoped token via the `user-management` cap singleton.
- *
- * The local `AuthService.validateScopedToken` indirection is unused (the
- * `setScopedTokenManager` wire-up was never invoked), so we go straight
- * to the cap registry — same path the generic addon-route handler in
- * `main.ts` uses (the one that actually works end-to-end).
- *
- * Returns null when the singleton isn't mounted yet (boot race) or the
- * token doesn't validate. Caller treats both as auth failure.
- */
-async function validateScopedTokenViaCap(addonRegistry, token) {
-    const capRegistry = addonRegistry.getCapabilityRegistry();
-    const userMgmt = capRegistry.getSingleton('user-management');
-    if (!userMgmt)
-        return null;
-    return userMgmt.validateScopedToken({ token });
-}
-/**
- * REST endpoint `/api/addons/upload` shares the scope-gate of the
- * `addons.installPackage` cap method (semantically equivalent — both
- * install a tarball under the system-scope `addons` cap with `create`
- * access). Reuse the shared scope matcher so the gate stays in sync
- * with the tRPC middleware — no parallel REST-only ACL.
- *
- * Why not `addons.upload`? There is no `upload` method on the cap
- * definition (this endpoint is Fastify-only), so `METHOD_ACCESS_MAP`
- * has no row for it and `checkScopeAccess` falls through to deny.
- */
-const UPLOAD_TRPC_PATH = 'addons.installPackage';
-function isUploadAllowed(scoped) {
-    return (0, scope_access_js_1.checkScopeAccess)(scoped.scopes, UPLOAD_TRPC_PATH).ok;
-}
-const TARBALL_EXTENSIONS = ['.tgz', '.tar.gz'];
 const MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 const AGENT_DEPLOY_TIMEOUT_MS = 60_000;
 const AGENT_DEPLOY_CONTROL_TIMEOUT_MS = 30_000;
@@ -128,104 +94,28 @@ function buildHubHttpSource(buffer, hubBaseUrl) {
         bytes: staged.bytes,
     };
 }
-function isTarball(filename) {
-    return TARBALL_EXTENSIONS.some((ext) => filename.endsWith(ext));
-}
-/**
- * Validate an uploaded tarball by extracting its `package.json` and
- * checking it declares `name` + `version`. Runs BEFORE the hub/agent
- * branch so broken archives are rejected at the gateway instead of
- * failing mid-extraction on the agent (which has no clean rollback).
- *
- * The routine writes the buffer to a scratch path and invokes `tar` with
- * `-xzO` to stream-extract just `package/package.json` to stdout. No full
- * unpack is needed — npm-pack layout always puts the manifest at that
- * fixed inner path. Returns null (not throw) on malformed archives so
- * the caller can surface a precise 400 response.
- */
-function validateTarball(buffer, filename) {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-tarball-check-'));
-    const tgzPath = path.join(tmpDir, filename);
-    try {
-        fs.writeFileSync(tgzPath, buffer);
-        const output = (0, node_child_process_1.execFileSync)('tar', ['-xzO', '-f', tgzPath, 'package/package.json'], {
-            timeout: 5_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        const parsed = JSON.parse(output.toString('utf8'));
-        if (!parsed || typeof parsed !== 'object')
-            return null;
-        const pkg = parsed;
-        if (typeof pkg['name'] !== 'string' || typeof pkg['version'] !== 'string')
-            return null;
-        return { name: pkg['name'], version: pkg['version'] };
-    }
-    catch {
-        return null;
-    }
-    finally {
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-}
 async function registerAddonUploadRoute(fastify, addonBridge, authService, moleculer, addonRegistry, addonPackageService, logger) {
     await fastify.register(Promise.resolve().then(() => __importStar(require('@fastify/multipart'))), {
         limits: { fileSize: MAX_UPLOAD_BYTES },
     });
     registerDeployBundleRoute(fastify);
     fastify.post('/api/addons/upload', async (request, reply) => {
-        const authHeader = request.headers.authorization;
-        if (!authHeader) {
-            return reply.status(401).send({ error: 'Unauthorized' });
-        }
-        // Auth chain: JWT (isAdmin) OR scoped token whose scopes grant
-        // `create` access on the `addons` capability. The scoped path is the
-        // CLI's `camstack login` flow — fetches a long-lived upload-scoped
-        // token so headless deploys don't need an admin password on disk.
-        const token = authHeader.replace('Bearer ', '');
-        let authOk = false;
-        let authReason;
-        // Try JWT first — fastest path + carries isAdmin flag directly.
-        try {
-            const payload = authService.verifyToken(token);
-            if (payload.isAdmin) {
-                authOk = true;
-            }
-            else {
-                authReason = 'JWT is not admin';
-            }
-        }
-        catch {
-            // Not a JWT (or invalid signature) — fall through to scoped-token path.
-        }
-        if (!authOk) {
-            // `cst_*` scoped tokens — only the cap-registry singleton actually
-            // validates; the local AuthService bridge was never wired. See main.ts:652.
-            try {
-                const record = await validateScopedTokenViaCap(addonRegistry, token);
-                if (!record) {
-                    authReason = authReason ?? 'token not recognised';
-                }
-                else if (isUploadAllowed(record)) {
-                    authOk = true;
-                }
-                else {
-                    authReason = `scoped token lacks create access on '${UPLOAD_TRPC_PATH}'`;
-                }
-            }
-            catch (err) {
-                authReason = `scoped token validation failed: ${err instanceof Error ? err.message : String(err)}`;
-            }
-        }
-        if (!authOk) {
-            return reply
-                .status(403)
-                .send({ error: `Forbidden: ${authReason ?? 'admin or upload-scoped token required'}` });
+        // Auth chain (shared with /api/server-upload): JWT (isAdmin) OR scoped
+        // token whose scopes grant `create` access on the `addons` capability.
+        // See upload-auth.ts for the full rationale.
+        const auth = await (0, upload_auth_js_1.authorizeUploadRequest)({
+            authHeader: request.headers.authorization,
+            authService,
+            addonRegistry,
+        });
+        if (!auth.ok) {
+            return reply.status(auth.status).send({ error: auth.error });
         }
         const data = await request.file();
         if (!data) {
             return reply.status(400).send({ error: 'No file uploaded' });
         }
-        if (!isTarball(data.filename)) {
+        if (!(0, tarball_manifest_js_1.isTarballFilename)(data.filename)) {
             return reply.status(400).send({ error: 'File must be a .tgz or .tar.gz archive' });
         }
         // `nodeId` and `addonId` come through as multipart text fields.
@@ -249,7 +139,7 @@ async function registerAddonUploadRoute(fastify, addonBridge, authService, molec
         // Gate: reject archives that don't expose a parseable package.json with
         // name + version. The hub installer did this implicitly via npm; the
         // agent path would otherwise fail mid-extraction with no clean rollback.
-        const manifest = validateTarball(buffer, data.filename);
+        const manifest = (0, tarball_manifest_js_1.readTarballManifest)(buffer, data.filename);
         if (!manifest) {
             return reply.status(400).send({
                 error: 'Tarball missing or malformed package/package.json (name + version required)',

package/dist/api/core/auth.router.js

@@ -24,6 +24,36 @@ const share_token_service_js_1 = require("../../core/auth/share-token.service.js
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+// ── Public-auth rate limiting ────────────────────────────────────────
+// The public surface below (credential validation, passkey ceremonies,
+// one-time-code redemption) had NO throttling — unlimited online
+// guessing. Two tiers, fixed window per (procedure, client ip):
+//   • credential tier — anything that VERIFIES a secret (password, TOTP,
+//     passkey assertion, handoff code, session exchange): 10/min,
+//   • ceremony tier — begin-legs that only mint a challenge: 30/min.
+// Mesh-internal calls (no originating request) are never limited.
+const CREDENTIAL_ATTEMPT_LIMITER = (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10 });
+const CEREMONY_LIMITER = (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 30 });
+function makeRateLimitedProcedure(limiter) {
+    return trpc_middleware_js_1.publicProcedure.use(({ ctx, path, next }) => {
+        const key = (0, auth_rate_limit_js_1.clientKeyFromRequest)(ctx.req);
+        if (key !== null) {
+            const verdict = limiter.check(`${path}:${key}`);
+            if (!verdict.allowed) {
+                throw new server_1.TRPCError({
+                    code: 'TOO_MANY_REQUESTS',
+                    message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
+                });
+            }
+        }
+        return next({ ctx });
+    });
+}
+/** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
+const credentialProcedure = makeRateLimitedProcedure(CREDENTIAL_ATTEMPT_LIMITER);
+/** Challenge-minting begin-legs — looser, they verify nothing. */
+const ceremonyProcedure = makeRateLimitedProcedure(CEREMONY_LIMITER);
 /**
  * The available second-factor kinds a user may satisfy after the
  * password leg. Capability-driven — `totp` maps to the
@@ -351,7 +381,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         return factors;
     };
     return (0, trpc_middleware_js_1.trpcRouter)({
-        login: trpc_middleware_js_1.publicProcedure
+        login: credentialProcedure
             .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string() }))
             .output(LoginResultSchema)
             .mutation(async ({ input }) => {
@@ -431,7 +461,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *   • User vanished between leg 1 and leg 2 → 401 (operator was
          *     deleted concurrently — rare).
          */
-        loginVerifyTotp: trpc_middleware_js_1.publicProcedure
+        loginVerifyTotp: credentialProcedure
             .input(zod_1.z.object({ challengeToken: zod_1.z.string(), code: zod_1.z.string() }))
             .output(LoginResultSchema)
             .mutation(async ({ input }) => {
@@ -458,7 +488,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * enrolled credentials (strict-user `allowCredentials`). PUBLIC —
          * the client is still pre-session at this point.
          */
-        loginBeginPasskey: trpc_middleware_js_1.publicProcedure
+        loginBeginPasskey: ceremonyProcedure
             .input(zod_1.z.object({ challengeToken: zod_1.z.string() }))
             .output(OptionsJsonSchema)
             .mutation(async ({ input }) => {
@@ -478,7 +508,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * real session JWT through the SAME `auth.signToken` path
          * `loginVerifyTotp` uses (fresh user re-fetch for up-to-date scopes).
          */
-        loginVerifyPasskey: trpc_middleware_js_1.publicProcedure
+        loginVerifyPasskey: credentialProcedure
             .input(zod_1.z.object({ challengeToken: zod_1.z.string(), response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
             .output(LoginResultSchema)
             .mutation(async ({ input }) => {
@@ -510,7 +540,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * public auth procedure today; the challenge store is bounded only
          * by its 5-min TTL prune.
          */
-        passkeyLoginBegin: trpc_middleware_js_1.publicProcedure
+        passkeyLoginBegin: ceremonyProcedure
             .input(zod_1.z.void())
             .output(OptionsJsonSchema)
             .mutation(async () => {
@@ -534,7 +564,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * itself is skipped here — the primary factor WAS the passkey, and
          * re-proving it adds nothing.
          */
-        passkeyLoginFinish: trpc_middleware_js_1.publicProcedure
+        passkeyLoginFinish: credentialProcedure
             .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }))
             .output(LoginResultSchema)
             .mutation(async ({ input }) => {
@@ -588,7 +618,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     `mintSessionForUserId` tail (re-fetched user → up-to-date
          *     scopes), equivalent to what `auth.login` hands out.
          */
-        exchangeSession: trpc_middleware_js_1.publicProcedure
+        exchangeSession: credentialProcedure
             .input(zod_1.z.object({}).optional())
             .output(LoginResultSchema)
             .mutation(async ({ ctx }) => {
@@ -639,7 +669,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         }),
         /** PUBLIC — redeem a one-time handoff code for a session bearer.
          *  Unknown / expired / already-used codes → UNAUTHORIZED. */
-        redeemHandoffCode: trpc_middleware_js_1.publicProcedure
+        redeemHandoffCode: credentialProcedure
             .input(zod_1.z.object({ code: zod_1.z.string().min(1) }))
             .output(LoginResultSchema)
             .mutation(async ({ input }) => {

package/dist/api/health/health.routes.js

@@ -21,7 +21,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHubHealth = buildHubHealth;
+exports.isAuthorizedHealthRequest = isAuthorizedHealthRequest;
 exports.registerHealthRoutes = registerHealthRoutes;
+const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const AGENT_HEALTH_TIMEOUT_MS = 3_000;
 function nowIso() {
     return new Date().toISOString();
@@ -68,23 +70,64 @@ async function fetchAgentHealth(deps, nodeId) {
         };
     }
 }
+/**
+ * True when the request carries a valid SESSION-grade credential: a Bearer
+ * JWT or the httpOnly session cookie. Health details expose topology
+ * (agent ids, versions, pids) — public probes get only `{ok}`.
+ * Pure over (headers, verifier) so the spec exercises it directly.
+ */
+function isAuthorizedHealthRequest(headers, verifyToken) {
+    const bearer = headers.authorization?.startsWith('Bearer ')
+        ? headers.authorization.slice('Bearer '.length)
+        : null;
+    const cookieToken = (0, session_cookie_js_1.readSessionCookieFromHeader)(headers.cookie);
+    for (const token of [bearer, cookieToken]) {
+        if (!token)
+            continue;
+        try {
+            if ((0, session_cookie_js_1.isSessionGradeJwtPayload)(verifyToken(token)))
+                return true;
+        }
+        catch {
+            /* invalid/expired — try the next credential */
+        }
+    }
+    return false;
+}
 function registerHealthRoutes(fastify, deps) {
+    const authorized = (req) => isAuthorizedHealthRequest({
+        ...(typeof req.headers.authorization === 'string'
+            ? { authorization: req.headers.authorization }
+            : {}),
+        ...(typeof req.headers.cookie === 'string' ? { cookie: req.headers.cookie } : {}),
+    }, deps.verifyToken);
+    // PUBLIC probe: liveness only. Everything beyond `ok` (version, uptime,
+    // pid, agent topology) moved to the AUTHENTICATED /health/details — a
+    // public endpoint must not enumerate the deployment.
     fastify.get('/health', async (_req, reply) => {
+        const ok = deps.isReady();
+        if (!ok)
+            reply.status(503);
+        return { ok };
+    });
+    // AUTHENTICATED detailed health — the payload /health used to return.
+    fastify.get('/health/details', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const health = await buildHubHealth(deps);
         if (!health.ok)
             reply.status(503);
         return health;
     });
-    // Zero-config LAN discovery — unauthenticated, always 200. See DiscoveryInfo.
-    fastify.get('/discovery', async () => {
-        const name = process.env['CAMSTACK_HUB_NAME'] ?? 'CamStack Hub';
-        return { service: 'camstack-hub', nodeId: 'hub', version: deps.hubVersion, name };
-    });
-    fastify.get('/health/agents', async () => {
+    fastify.get('/health/agents', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const nodes = deps.agentRegistry.listNodeLiveness();
         return { agents: nodes.filter((n) => !n.isHub && n.isOnline).map((n) => n.id) };
     });
     fastify.get('/health/agents/:nodeId', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const { nodeId } = req.params;
         if (!nodeId) {
             return reply.status(400).send({ ok: false, error: 'nodeId required' });
@@ -95,7 +138,9 @@ function registerHealthRoutes(fastify, deps) {
         }
         return result;
     });
-    fastify.get('/health/cluster', async () => {
+    fastify.get('/health/cluster', async (req, reply) => {
+        if (!authorized(req))
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
         const hub = await buildHubHealth(deps);
         // Enumeration only (fan-out-free); the $agent.health fan-out below is intentional.
         const nodes = deps.agentRegistry.listNodeLiveness();

package/dist/api/server-upload.js

@@ -0,0 +1,188 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateTarballSet = validateTarballSet;
+exports.registerServerUploadRoute = registerServerUploadRoute;
+/**
+ * POST /api/server-upload — the dev server-deploy channel's upload gateway.
+ *
+ * `camstack deploy-server` packs the whole `@camstack/server` workspace
+ * closure at one uniform dev version (`<base>-dev.<epochSeconds>`) and
+ * uploads every tarball here in ONE multipart request (plus a `version`
+ * field). The route validates fail-closed and stores the set under
+ * `<dataDir>/server-root/dev-uploads/<version>/` together with a
+ * `manifest.json` (package name → tgz filename) — which
+ * `RootUpdateService.stageAndActivate` later consumes to stage from the
+ * tarballs instead of the npm registry.
+ *
+ * Guards (all fail-closed, nothing is written until EVERY check passes):
+ *   - same admin/upload-scope auth chain as `/api/addons/upload`
+ *     (`authorizeUploadRequest`),
+ *   - the version MUST be dev-channel shaped (`-dev.<epoch>` suffix) — this
+ *     route serves ONLY the dev channel,
+ *   - no path traversal in the version or any filename,
+ *   - every tarball must carry `package/package.json` with an
+ *     `@camstack/*` name and a version equal to the declared dev version.
+ *
+ * REGISTRATION ORDER: `@fastify/multipart` must already be registered on
+ * the instance (done by `registerAddonUploadRoute`) — this route only adds
+ * the handler.
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const index_js_1 = require("../server-root/index.js");
+const tarball_manifest_js_1 = require("./tarball-manifest.js");
+const upload_auth_js_1 = require("./upload-auth.js");
+/**
+ * Version chars beyond the dev-channel shape check: strictly semver-ish
+ * (alnum, dots, dashes) so the version can never traverse out of
+ * `dev-uploads/` when used as a directory name.
+ */
+const SAFE_VERSION_RE = /^[0-9A-Za-z][0-9A-Za-z.-]*$/;
+function isValidationFailure(value) {
+    return 'error' in value;
+}
+function hasPathTraversal(name) {
+    return name.includes('/') || name.includes('\\') || name.includes('..');
+}
+/** `@camstack/server` → `camstack-server.tgz` — server-derived, never client-named. */
+function flattenedTgzName(packageName) {
+    return `${packageName.replace(/^@/, '').replace(/\//g, '-')}.tgz`;
+}
+/**
+ * Validate the whole tarball set against the declared dev version.
+ * Fail-closed: the FIRST failure rejects the entire upload — nothing is
+ * written unless every tarball passes.
+ *
+ * The path-traversal guard is defense-in-depth: `@fastify/multipart`
+ * already normalises filenames to their basename, and the stored tgz name
+ * is derived server-side from the validated PACKAGE name — a client
+ * filename never becomes a filesystem path.
+ */
+function validateTarballSet(files, version) {
+    const seen = new Set();
+    const validated = [];
+    for (const file of files) {
+        if (hasPathTraversal(file.filename)) {
+            return { error: `Refused: filename contains path separators (${file.filename})` };
+        }
+        if (!(0, tarball_manifest_js_1.isTarballFilename)(file.filename)) {
+            return { error: `Refused: ${file.filename} is not a .tgz/.tar.gz archive` };
+        }
+        const manifest = (0, tarball_manifest_js_1.readTarballManifest)(file.buffer, file.filename);
+        if (manifest === null) {
+            return {
+                error: `Refused: ${file.filename} is missing or has a malformed package/package.json`,
+            };
+        }
+        if (!manifest.name.startsWith('@camstack/')) {
+            return {
+                error: `Refused: ${file.filename} declares non-@camstack package "${manifest.name}"`,
+            };
+        }
+        if (manifest.version !== version) {
+            return {
+                error: `Refused: ${file.filename} (${manifest.name}) declares version ` +
+                    `${manifest.version}, expected the uploaded dev version ${version}`,
+            };
+        }
+        if (seen.has(manifest.name)) {
+            return { error: `Refused: duplicate package in upload set (${manifest.name})` };
+        }
+        seen.add(manifest.name);
+        validated.push({ name: manifest.name, buffer: file.buffer });
+    }
+    return validated;
+}
+function registerServerUploadRoute(fastify, options) {
+    const { authService, addonRegistry, logger } = options;
+    fastify.post('/api/server-upload', async (request, reply) => {
+        const auth = await (0, upload_auth_js_1.authorizeUploadRequest)({
+            authHeader: request.headers.authorization,
+            authService,
+            addonRegistry,
+        });
+        if (!auth.ok) {
+            return reply.status(auth.status).send({ error: auth.error });
+        }
+        // Drain the multipart stream first (files can precede or follow the
+        // version field), then validate the whole set before touching disk.
+        let version = null;
+        const files = [];
+        for await (const part of request.parts()) {
+            if (part.type === 'file') {
+                files.push({ filename: part.filename, buffer: await part.toBuffer() });
+            }
+            else if (part.fieldname === 'version' && typeof part.value === 'string') {
+                version = part.value;
+            }
+        }
+        if (version === null || version.length === 0) {
+            return reply.status(400).send({ error: 'Missing "version" field' });
+        }
+        if (!SAFE_VERSION_RE.test(version) || !(0, index_js_1.isDevChannelVersion)(version)) {
+            return reply.status(400).send({
+                error: `Refused: version "${version}" is not dev-channel shaped — this route only ` +
+                    'accepts `<base>-dev.<epochSeconds>` versions produced by `camstack deploy-server`.',
+            });
+        }
+        if (files.length === 0) {
+            return reply.status(400).send({ error: 'No tarballs uploaded' });
+        }
+        const validated = validateTarballSet(files, version);
+        if (isValidationFailure(validated)) {
+            logger.warn('server-upload rejected', { meta: { version, error: validated.error } });
+            return reply.status(400).send({ error: validated.error });
+        }
+        const dataDir = path.resolve(options.dataDir ?? process.env['CAMSTACK_DATA'] ?? 'camstack-data');
+        const versionDir = (0, index_js_1.devUploadVersionDir)((0, index_js_1.serverRootDir)(dataDir), version);
+        fs.mkdirSync(versionDir, { recursive: true });
+        const packages = {};
+        for (const pkg of validated) {
+            const tgzName = flattenedTgzName(pkg.name);
+            fs.writeFileSync(path.join(versionDir, tgzName), pkg.buffer);
+            packages[pkg.name] = tgzName;
+        }
+        (0, index_js_1.writeDevUploadManifest)(versionDir, { version, packages });
+        logger.info('server-upload stored dev closure', {
+            meta: { version, packages: Object.keys(packages), dir: versionDir },
+        });
+        return reply.send({
+            success: true,
+            version,
+            packages: Object.keys(packages),
+        });
+    });
+}

package/dist/api/static/spa-static.js

@@ -8,6 +8,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.spaAssetCacheControl = spaAssetCacheControl;
+exports.addonBundleCacheControl = addonBundleCacheControl;
 exports.contentTypeForPath = contentTypeForPath;
 /**
  * Cache-Control value for a static SPA asset addressed by its dist-relative
@@ -29,6 +30,28 @@ function spaAssetCacheControl(rel) {
     }
     return 'no-cache';
 }
+/**
+ * Cache-Control for an addon MF bundle file (`/api/addon-widgets/…`).
+ *
+ * Immutable is granted ONLY to filenames carrying a Vite/rolldown content
+ * hash (`<name>-<hash8>.mjs`) — never by exclusion. The previous policy
+ * ("everything that isn't the entry is hashed") aged out the moment the
+ * rolldown MF plugin emitted `_stub.js`: a FIXED filename with MUTABLE
+ * content (the real exposes module). Browsers kept the year-long
+ * immutable copy across addon updates, its imports pointed at hashed
+ * sibling chunks that no longer existed, and the widget failed to load
+ * until a manual hard-reload. Unknown fixed names now revalidate — the
+ * cost is a cheap 304.
+ */
+function addonBundleCacheControl(filePath) {
+    const base = filePath.split('/').pop() ?? filePath;
+    // Vite/rolldown content hash: exactly 8 base64url chars between a
+    // hyphen and the extension (`dist-CYZr2fwk.mjs`, `….js-CQ-aEQ9b.mjs`).
+    if (/-[A-Za-z0-9_-]{8}\.(mjs|js|css)$/.test(base)) {
+        return 'public, max-age=31536000, immutable';
+    }
+    return 'no-cache, must-revalidate';
+}
 const CONTENT_TYPES = {
     html: 'text/html; charset=utf-8',
     js: 'text/javascript; charset=utf-8',