@camstack/server 1.1.53 → 1.1.55

package/dist/server-root/index.js

@@ -74,6 +74,9 @@ var require_dist = __commonJS({
     var src_exports = {};
     __export2(src_exports, {
       AGENT_ROOT_SPEC: /* @__PURE__ */ __name(() => AGENT_ROOT_SPEC, "AGENT_ROOT_SPEC"),
+      DEV_UPLOADS_DIRNAME: /* @__PURE__ */ __name(() => DEV_UPLOADS_DIRNAME, "DEV_UPLOADS_DIRNAME"),
+      DEV_UPLOADS_KEEP_COUNT: /* @__PURE__ */ __name(() => DEV_UPLOADS_KEEP_COUNT, "DEV_UPLOADS_KEEP_COUNT"),
+      DEV_UPLOAD_MANIFEST_FILE: /* @__PURE__ */ __name(() => DEV_UPLOAD_MANIFEST_FILE, "DEV_UPLOAD_MANIFEST_FILE"),
       HOST_EXTERNAL_SPECIFIERS: /* @__PURE__ */ __name(() => HOST_EXTERNAL_SPECIFIERS, "HOST_EXTERNAL_SPECIFIERS"),
       HUB_ROOT_SPEC: /* @__PURE__ */ __name(() => HUB_ROOT_SPEC2, "HUB_ROOT_SPEC"),
       RESTART_INTENT_FILE: /* @__PURE__ */ __name(() => RESTART_INTENT_FILE, "RESTART_INTENT_FILE"),
@@ -83,11 +86,17 @@ var require_dist = __commonJS({
       clearRestartIntentMarker: /* @__PURE__ */ __name(() => clearRestartIntentMarker, "clearRestartIntentMarker"),
       compareSemver: /* @__PURE__ */ __name(() => compareSemver, "compareSemver"),
       detectWorkspaceRoot: /* @__PURE__ */ __name(() => detectWorkspaceRoot, "detectWorkspaceRoot"),
+      devChannelEpoch: /* @__PURE__ */ __name(() => devChannelEpoch, "devChannelEpoch"),
+      devUploadManifestPath: /* @__PURE__ */ __name(() => devUploadManifestPath, "devUploadManifestPath"),
+      devUploadVersionDir: /* @__PURE__ */ __name(() => devUploadVersionDir, "devUploadVersionDir"),
+      devUploadsDir: /* @__PURE__ */ __name(() => devUploadsDir, "devUploadsDir"),
       emptyServerRootState: /* @__PURE__ */ __name(() => emptyServerRootState, "emptyServerRootState"),
+      isDevChannelVersion: /* @__PURE__ */ __name(() => isDevChannelVersion, "isDevChannelVersion"),
       isHostExternal: /* @__PURE__ */ __name(() => isHostExternal, "isHostExternal"),
       isServerRootState: /* @__PURE__ */ __name(() => isServerRootState, "isServerRootState"),
       minNodeMajorOf: /* @__PURE__ */ __name(() => minNodeMajorOf, "minNodeMajorOf"),
       planBoot: /* @__PURE__ */ __name(() => planBoot, "planBoot"),
+      readDevUploadManifest: /* @__PURE__ */ __name(() => readDevUploadManifest, "readDevUploadManifest"),
       readRestartIntentMarker: /* @__PURE__ */ __name(() => readRestartIntentMarker, "readRestartIntentMarker"),
       readServerRootState: /* @__PURE__ */ __name(() => readServerRootState, "readServerRootState"),
       registerActiveRootResolver: /* @__PURE__ */ __name(() => registerActiveRootResolver, "registerActiveRootResolver"),
@@ -100,10 +109,68 @@ var require_dist = __commonJS({
       validateVersionDir: /* @__PURE__ */ __name(() => validateVersionDir, "validateVersionDir"),
       versionDir: /* @__PURE__ */ __name(() => versionDir, "versionDir"),
       versionsDir: /* @__PURE__ */ __name(() => versionsDir, "versionsDir"),
+      writeDevUploadManifest: /* @__PURE__ */ __name(() => writeDevUploadManifest, "writeDevUploadManifest"),
       writeRestartIntentMarker: /* @__PURE__ */ __name(() => writeRestartIntentMarker, "writeRestartIntentMarker"),
       writeServerRootState: /* @__PURE__ */ __name(() => writeServerRootState, "writeServerRootState")
     });
     module2.exports = __toCommonJS2(src_exports);
+    var fs = __toESM2(require("fs"));
+    var path = __toESM2(require("path"));
+    var DEV_UPLOADS_DIRNAME = "dev-uploads";
+    var DEV_UPLOAD_MANIFEST_FILE = "manifest.json";
+    var DEV_UPLOADS_KEEP_COUNT = 3;
+    var DEV_CHANNEL_VERSION_RE = /-dev\.\d+$/;
+    function isDevChannelVersion(version) {
+      return DEV_CHANNEL_VERSION_RE.test(version);
+    }
+    __name(isDevChannelVersion, "isDevChannelVersion");
+    function devChannelEpoch(version) {
+      const match = /-dev\.(\d+)$/.exec(version);
+      if (match === null) return null;
+      const epoch = Number.parseInt(match[1] ?? "", 10);
+      return Number.isNaN(epoch) ? null : epoch;
+    }
+    __name(devChannelEpoch, "devChannelEpoch");
+    function devUploadsDir(rootDir) {
+      return path.join(rootDir, DEV_UPLOADS_DIRNAME);
+    }
+    __name(devUploadsDir, "devUploadsDir");
+    function devUploadVersionDir(rootDir, version) {
+      return path.join(devUploadsDir(rootDir), version);
+    }
+    __name(devUploadVersionDir, "devUploadVersionDir");
+    function devUploadManifestPath(versionDirPath) {
+      return path.join(versionDirPath, DEV_UPLOAD_MANIFEST_FILE);
+    }
+    __name(devUploadManifestPath, "devUploadManifestPath");
+    function isDevUploadManifest(v) {
+      if (typeof v !== "object" || v === null) return false;
+      const m = v;
+      if (typeof m["version"] !== "string") return false;
+      const packages = m["packages"];
+      if (typeof packages !== "object" || packages === null || Array.isArray(packages)) return false;
+      return Object.values(packages).every((filename) => typeof filename === "string");
+    }
+    __name(isDevUploadManifest, "isDevUploadManifest");
+    function readDevUploadManifest(versionDirPath) {
+      try {
+        const raw = JSON.parse(fs.readFileSync(devUploadManifestPath(versionDirPath), "utf-8"));
+        return isDevUploadManifest(raw) ? raw : null;
+      } catch {
+        return null;
+      }
+    }
+    __name(readDevUploadManifest, "readDevUploadManifest");
+    function writeDevUploadManifest(versionDirPath, manifest) {
+      fs.mkdirSync(versionDirPath, {
+        recursive: true
+      });
+      const target = devUploadManifestPath(versionDirPath);
+      const tmp = `${target}.tmp`;
+      fs.writeFileSync(tmp, JSON.stringify(manifest, null, 2), "utf-8");
+      fs.renameSync(tmp, target);
+    }
+    __name(writeDevUploadManifest, "writeDevUploadManifest");
     var HUB_ROOT_SPEC2 = {
       packageName: "@camstack/server",
       entryRelPath: [
@@ -118,8 +185,8 @@ var require_dist = __commonJS({
         "cli.js"
       ]
     };
-    var fs = __toESM2(require("fs"));
-    var path = __toESM2(require("path"));
+    var fs2 = __toESM2(require("fs"));
+    var path2 = __toESM2(require("path"));
     var SERVER_ROOT_DIRNAME = "server-root";
     var SERVER_ROOT_STATE_FILE = "state.json";
     var RESTART_INTENT_FILE = ".restart-intent";
@@ -134,27 +201,27 @@ var require_dist = __commonJS({
     }
     __name(emptyServerRootState, "emptyServerRootState");
     function serverRootDir(dataDir) {
-      return path.join(dataDir, SERVER_ROOT_DIRNAME);
+      return path2.join(dataDir, SERVER_ROOT_DIRNAME);
     }
     __name(serverRootDir, "serverRootDir");
     function versionsDir(rootDir) {
-      return path.join(rootDir, "versions");
+      return path2.join(rootDir, "versions");
     }
     __name(versionsDir, "versionsDir");
     function versionDir(rootDir, version) {
-      return path.join(versionsDir(rootDir), version);
+      return path2.join(versionsDir(rootDir), version);
     }
     __name(versionDir, "versionDir");
     function rootPackageDir2(versionDirPath, spec) {
-      return path.join(versionDirPath, "node_modules", ...spec.packageName.split("/"));
+      return path2.join(versionDirPath, "node_modules", ...spec.packageName.split("/"));
     }
     __name(rootPackageDir2, "rootPackageDir");
     function rootEntryPath2(versionDirPath, spec) {
-      return path.join(rootPackageDir2(versionDirPath, spec), ...spec.entryRelPath);
+      return path2.join(rootPackageDir2(versionDirPath, spec), ...spec.entryRelPath);
     }
     __name(rootEntryPath2, "rootEntryPath");
     function stateFilePath(rootDir) {
-      return path.join(rootDir, SERVER_ROOT_STATE_FILE);
+      return path2.join(rootDir, SERVER_ROOT_STATE_FILE);
     }
     __name(stateFilePath, "stateFilePath");
     function isNullableString(v) {
@@ -186,7 +253,7 @@ var require_dist = __commonJS({
     __name(isServerRootState, "isServerRootState");
     function readServerRootState(rootDir) {
       try {
-        const raw = JSON.parse(fs.readFileSync(stateFilePath(rootDir), "utf-8"));
+        const raw = JSON.parse(fs2.readFileSync(stateFilePath(rootDir), "utf-8"));
         return isServerRootState(raw) ? raw : null;
       } catch {
         return null;
@@ -194,17 +261,17 @@ var require_dist = __commonJS({
     }
     __name(readServerRootState, "readServerRootState");
     function writeServerRootState(rootDir, state) {
-      fs.mkdirSync(rootDir, {
+      fs2.mkdirSync(rootDir, {
         recursive: true
       });
       const target = stateFilePath(rootDir);
       const tmp = `${target}.tmp`;
-      fs.writeFileSync(tmp, JSON.stringify(state, null, 2), "utf-8");
-      fs.renameSync(tmp, target);
+      fs2.writeFileSync(tmp, JSON.stringify(state, null, 2), "utf-8");
+      fs2.renameSync(tmp, target);
     }
     __name(writeServerRootState, "writeServerRootState");
     function restartIntentMarkerPath(rootDir) {
-      return path.join(rootDir, RESTART_INTENT_FILE);
+      return path2.join(rootDir, RESTART_INTENT_FILE);
     }
     __name(restartIntentMarkerPath, "restartIntentMarkerPath");
     function isRestartIntentMarker(v) {
@@ -214,18 +281,18 @@ var require_dist = __commonJS({
     }
     __name(isRestartIntentMarker, "isRestartIntentMarker");
     function writeRestartIntentMarker(rootDir, marker) {
-      fs.mkdirSync(rootDir, {
+      fs2.mkdirSync(rootDir, {
         recursive: true
       });
       const target = restartIntentMarkerPath(rootDir);
       const tmp = `${target}.tmp`;
-      fs.writeFileSync(tmp, JSON.stringify(marker, null, 2), "utf-8");
-      fs.renameSync(tmp, target);
+      fs2.writeFileSync(tmp, JSON.stringify(marker, null, 2), "utf-8");
+      fs2.renameSync(tmp, target);
     }
     __name(writeRestartIntentMarker, "writeRestartIntentMarker");
     function readRestartIntentMarker(rootDir) {
       try {
-        const raw = JSON.parse(fs.readFileSync(restartIntentMarkerPath(rootDir), "utf-8"));
+        const raw = JSON.parse(fs2.readFileSync(restartIntentMarkerPath(rootDir), "utf-8"));
         return isRestartIntentMarker(raw) ? raw : null;
       } catch {
         return null;
@@ -234,7 +301,7 @@ var require_dist = __commonJS({
     __name(readRestartIntentMarker, "readRestartIntentMarker");
     function clearRestartIntentMarker(rootDir) {
       try {
-        fs.rmSync(restartIntentMarkerPath(rootDir), {
+        fs2.rmSync(restartIntentMarkerPath(rootDir), {
           force: true
         });
       } catch {
@@ -251,13 +318,13 @@ var require_dist = __commonJS({
     function validateVersionDir(rootDir, version, nodeMajor, spec) {
       const vDir = versionDir(rootDir, version);
       const entry = rootEntryPath2(vDir, spec);
-      if (!fs.existsSync(entry)) {
+      if (!fs2.existsSync(entry)) {
         return `root entry missing: ${entry}`;
       }
-      const pkgJsonPath = path.join(rootPackageDir2(vDir, spec), "package.json");
+      const pkgJsonPath = path2.join(rootPackageDir2(vDir, spec), "package.json");
       let pkg;
       try {
-        const raw = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+        const raw = JSON.parse(fs2.readFileSync(pkgJsonPath, "utf-8"));
         if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
           return `package.json malformed: ${pkgJsonPath}`;
         }
@@ -418,26 +485,26 @@ var require_dist = __commonJS({
       return 0;
     }
     __name(compareSemver, "compareSemver");
-    var fs2 = __toESM2(require("fs"));
-    var path2 = __toESM2(require("path"));
+    var fs3 = __toESM2(require("fs"));
+    var path3 = __toESM2(require("path"));
     function detectWorkspaceRoot(fromDir) {
-      let dir = path2.resolve(fromDir);
+      let dir = path3.resolve(fromDir);
       for (; ; ) {
-        const pkgPath = path2.join(dir, "package.json");
+        const pkgPath = path3.join(dir, "package.json");
         try {
-          const raw = JSON.parse(fs2.readFileSync(pkgPath, "utf-8"));
+          const raw = JSON.parse(fs3.readFileSync(pkgPath, "utf-8"));
           if (typeof raw === "object" && raw !== null && raw["workspaces"] !== void 0) {
             return dir;
           }
         } catch {
         }
-        const parent = path2.dirname(dir);
+        const parent = path3.dirname(dir);
         if (parent === dir) return null;
         dir = parent;
       }
     }
     __name(detectWorkspaceRoot, "detectWorkspaceRoot");
-    var path3 = __toESM2(require("path"));
+    var path4 = __toESM2(require("path"));
     var import_node_url = require("url");
     var HOST_EXTERNAL_SPECIFIERS = [
       "@camstack/system",
@@ -461,7 +528,7 @@ var require_dist = __commonJS({
         console.warn("[starter] module.registerHooks unavailable (Node < 22.15) \u2014 host-external redirect skipped");
         return;
       }
-      const anchorURL = (0, import_node_url.pathToFileURL)(path3.join(activeRootDir, "node_modules", "__camstack_starter_anchor__.js")).href;
+      const anchorURL = (0, import_node_url.pathToFileURL)(path4.join(activeRootDir, "node_modules", "__camstack_starter_anchor__.js")).href;
       const hooks = {
         resolve: /* @__PURE__ */ __name((specifier, context, nextResolve) => {
           if (isHostExternal(specifier)) {
@@ -537,8 +604,8 @@ var require_dist = __commonJS({
     }
     __name(runNodeStarter, "runNodeStarter");
     var import_node_child_process = require("child_process");
-    var fs3 = __toESM2(require("fs"));
-    var path4 = __toESM2(require("path"));
+    var fs4 = __toESM2(require("fs"));
+    var path5 = __toESM2(require("path"));
     var import_node_util = require("util");
     var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
     function buildNpmRegistryArgs(registry) {
@@ -555,7 +622,7 @@ var require_dist = __commonJS({
     var RESTART_REASON_PREFIX = "server-update";
     function readPackageVersion(pkgJsonPath) {
       try {
-        const raw = JSON.parse(fs3.readFileSync(pkgJsonPath, "utf-8"));
+        const raw = JSON.parse(fs4.readFileSync(pkgJsonPath, "utf-8"));
         if (typeof raw === "object" && raw !== null) {
           const version = raw["version"];
           if (typeof version === "string") return version;
@@ -586,7 +653,7 @@ var require_dist = __commonJS({
         this.envNames = options.envNames;
         this.logger = options.logger;
         this.restartServerFn = options.restartServer;
-        this.dataDir = path4.resolve(options.dataDir);
+        this.dataDir = path5.resolve(options.dataDir);
         this.execNpm = options.execNpm ?? (async (args, opts) => {
           const { stdout } = await execFileAsync("npm", [
             ...args
@@ -622,7 +689,7 @@ var require_dist = __commonJS({
       seedVersion() {
         const seedDir = this.env[this.envNames.seedDir];
         if (seedDir === void 0 || seedDir.length === 0) return null;
-        return readPackageVersion(path4.join(seedDir, "package.json"));
+        return readPackageVersion(path5.join(seedDir, "package.json"));
       }
       rootDir() {
         return serverRootDir(this.dataDir);
@@ -645,7 +712,7 @@ var require_dist = __commonJS({
         };
         return {
           state: emptyServerRootState(),
-          corrupt: fs3.existsSync(stateFilePath(rootDir))
+          corrupt: fs4.existsSync(stateFilePath(rootDir))
         };
       }
       updateState(state) {
@@ -796,6 +863,17 @@ var require_dist = __commonJS({
             message: `Refused: ${this.spec.packageName}@${target} is already running.`
           };
         }
+        if (isDevChannelVersion(target)) {
+          const uploadsDir = devUploadVersionDir(this.rootDir(), target);
+          if (!fs4.existsSync(uploadsDir)) {
+            return {
+              accepted: false,
+              targetVersion: target,
+              restarting: false,
+              message: `Refused: dev-channel version ${target} has no uploaded tarballs on this node (${uploadsDir} is missing). Dev server deploys are hub-only in this phase \u2014 upload via \`camstack deploy-server\` against this node first.`
+            };
+          }
+        }
         this.inFlight = "staging";
         try {
           await this.stageAndActivate(target);
@@ -848,57 +926,116 @@ var require_dist = __commonJS({
       async stageAndActivate(target) {
         const rootDir = this.rootDir();
         const vDir = versionsDir(rootDir);
-        fs3.mkdirSync(vDir, {
+        fs4.mkdirSync(vDir, {
           recursive: true
         });
-        const stagingDir = path4.join(vDir, `.staging-${target}-${process.pid}-${this.now()}`);
-        fs3.mkdirSync(stagingDir, {
+        const stagingDir = path5.join(vDir, `.staging-${target}-${process.pid}-${this.now()}`);
+        fs4.mkdirSync(stagingDir, {
           recursive: true
         });
         try {
-          fs3.writeFileSync(path4.join(stagingDir, "package.json"), JSON.stringify({
-            name: "camstack-node-root",
-            private: true
-          }, null, 2), "utf-8");
+          const devDir = devUploadVersionDir(rootDir, target);
           const registry = this.env["CAMSTACK_NPM_REGISTRY"];
-          await this.execNpm([
+          const installArgs = [
             "install",
             "--omit=dev",
             "--no-audit",
             "--no-fund",
-            "--loglevel=error",
-            `${this.spec.packageName}@${target}`,
-            ...buildNpmRegistryArgs(registry)
-          ], {
-            cwd: stagingDir,
-            timeoutMs: NPM_INSTALL_TIMEOUT_MS
-          });
+            "--loglevel=error"
+          ];
+          if (fs4.existsSync(devDir)) {
+            fs4.writeFileSync(path5.join(stagingDir, "package.json"), JSON.stringify(this.buildDevUploadsPackageJson(devDir, target), null, 2), "utf-8");
+            await this.execNpm([
+              ...installArgs,
+              ...buildNpmRegistryArgs(registry)
+            ], {
+              cwd: stagingDir,
+              timeoutMs: NPM_INSTALL_TIMEOUT_MS
+            });
+          } else {
+            fs4.writeFileSync(path5.join(stagingDir, "package.json"), JSON.stringify({
+              name: "camstack-node-root",
+              private: true
+            }, null, 2), "utf-8");
+            await this.execNpm([
+              ...installArgs,
+              `${this.spec.packageName}@${target}`,
+              ...buildNpmRegistryArgs(registry)
+            ], {
+              cwd: stagingDir,
+              timeoutMs: NPM_INSTALL_TIMEOUT_MS
+            });
+          }
           const entry = rootEntryPath2(stagingDir, this.spec);
-          if (!fs3.existsSync(entry)) {
+          if (!fs4.existsSync(entry)) {
             throw new Error(`staged closure is missing the root entry (${entry})`);
           }
-          const stagedVersion = readPackageVersion(path4.join(rootPackageDir2(stagingDir, this.spec), "package.json"));
+          const stagedVersion = readPackageVersion(path5.join(rootPackageDir2(stagingDir, this.spec), "package.json"));
           if (stagedVersion !== target) {
             throw new Error(`staged closure version mismatch: expected ${target}, got ${stagedVersion ?? "unknown"}`);
           }
           const dest = versionDir(rootDir, target);
-          if (fs3.existsSync(dest)) {
+          if (fs4.existsSync(dest)) {
             const aside = `${dest}.evicted-${this.now()}`;
-            await fs3.promises.rename(dest, aside);
-            await fs3.promises.rm(aside, {
+            await fs4.promises.rename(dest, aside);
+            await fs4.promises.rm(aside, {
               recursive: true,
               force: true
             }).catch(() => void 0);
           }
-          await fs3.promises.rename(stagingDir, dest);
+          await fs4.promises.rename(stagingDir, dest);
         } catch (err) {
-          await fs3.promises.rm(stagingDir, {
+          await fs4.promises.rm(stagingDir, {
             recursive: true,
             force: true
           }).catch(() => void 0);
           throw err;
         }
       }
+      /**
+      * Synthetic staging package.json for the dev server-deploy channel:
+      * `dependencies` carries the root package as a `file:` ref to its uploaded
+      * tgz; `overrides` maps EVERY OTHER uploaded `@camstack/<name>` to its tgz
+      * so any transitive occurrence resolves to the uploaded copy, never npm.
+      * Fail-closed: a missing/invalid manifest, a manifest for a different
+      * version, a missing root package, or a listed-but-absent tgz all throw
+      * (surfaced by `applyServerUpdate` as a staging failure).
+      */
+      buildDevUploadsPackageJson(devDir, target) {
+        const manifest = readDevUploadManifest(devDir);
+        if (manifest === null) {
+          throw new Error(`dev-uploads manifest missing or invalid in ${devDir}`);
+        }
+        if (manifest.version !== target) {
+          throw new Error(`dev-uploads manifest version mismatch: dir is for ${target}, manifest says ${manifest.version}`);
+        }
+        const rootTgz = manifest.packages[this.spec.packageName];
+        if (rootTgz === void 0) {
+          throw new Error(`dev-uploads for ${target} do not include the root package ${this.spec.packageName}`);
+        }
+        const fileRef = /* @__PURE__ */ __name((filename) => {
+          const abs = path5.join(devDir, filename);
+          if (!fs4.existsSync(abs)) {
+            throw new Error(`dev-uploads tarball listed in the manifest is missing: ${abs}`);
+          }
+          return `file:${abs}`;
+        }, "fileRef");
+        const overrides = {};
+        for (const [pkgName, filename] of Object.entries(manifest.packages)) {
+          if (pkgName === this.spec.packageName) continue;
+          overrides[pkgName] = fileRef(filename);
+        }
+        return {
+          name: "camstack-node-root",
+          private: true,
+          dependencies: {
+            [this.spec.packageName]: fileRef(rootTgz)
+          },
+          ...Object.keys(overrides).length > 0 ? {
+            overrides
+          } : {}
+        };
+      }
       // ── Rollback ──────────────────────────────────────────────────────────
       async rollbackServerUpdate() {
         if (this.inFlight !== "idle") {
@@ -1031,6 +1168,7 @@ var require_dist = __commonJS({
           promoted.currentVersion,
           promoted.previousVersion
         ].filter((v) => typeof v === "string"));
+        this.sweepDevUploads(DEV_UPLOADS_KEEP_COUNT);
         this.logger.info("root package update confirmed healthy", {
           meta: {
             version: promoted.currentVersion,
@@ -1056,23 +1194,23 @@ var require_dist = __commonJS({
         const vDir = versionsDir(this.rootDir());
         let entries;
         try {
-          entries = fs3.readdirSync(vDir);
+          entries = fs4.readdirSync(vDir);
         } catch {
           return;
         }
         for (const entry of entries) {
           if (keep.includes(entry)) continue;
-          const full = path4.join(vDir, entry);
+          const full = path5.join(vDir, entry);
           if (entry.startsWith(".")) {
             try {
-              const ageMs = this.now() - fs3.statSync(full).mtimeMs;
+              const ageMs = this.now() - fs4.statSync(full).mtimeMs;
               if (ageMs < _RootUpdateService.STALE_TRANSIENT_MS) continue;
             } catch {
               continue;
             }
           }
           try {
-            fs3.rmSync(full, {
+            fs4.rmSync(full, {
               recursive: true,
               force: true
             });
@@ -1091,6 +1229,71 @@ var require_dist = __commonJS({
           }
         }
       }
+      /**
+      * Promote-time sweep of `server-root/dev-uploads/`: keep only the
+      * `keepCount` most recent entries (ordered by the self-describing
+      * `-dev.<epochSeconds>` suffix; non-dev-shaped residue counts as oldest).
+      * Uses the same rename-aside graveyard pattern as the addon installer —
+      * a rename is a metadata op that succeeds even when a tarball is held
+      * open, and residue in the graveyard is re-swept on the next promote.
+      */
+      sweepDevUploads(keepCount) {
+        const dir = devUploadsDir(this.rootDir());
+        let entries;
+        try {
+          entries = fs4.readdirSync(dir);
+        } catch {
+          return;
+        }
+        const graveyard = path5.join(dir, ".sweeping");
+        try {
+          for (const residue of fs4.readdirSync(graveyard)) {
+            try {
+              fs4.rmSync(path5.join(graveyard, residue), {
+                recursive: true,
+                force: true
+              });
+            } catch {
+            }
+          }
+        } catch {
+        }
+        const versions = entries.filter((name) => !name.startsWith("."));
+        const byNewestFirst = [
+          ...versions
+        ].sort((a, b) => (devChannelEpoch(b) ?? -1) - (devChannelEpoch(a) ?? -1));
+        const doomed = byNewestFirst.slice(keepCount);
+        if (doomed.length === 0) return;
+        fs4.mkdirSync(graveyard, {
+          recursive: true
+        });
+        for (const entry of doomed) {
+          const aside = path5.join(graveyard, `${entry}-${this.now()}`);
+          try {
+            fs4.renameSync(path5.join(dir, entry), aside);
+          } catch (err) {
+            this.logger.warn("failed to move dev-uploads entry aside for sweep", {
+              meta: {
+                entry,
+                error: err instanceof Error ? err.message : String(err)
+              }
+            });
+            continue;
+          }
+          try {
+            fs4.rmSync(aside, {
+              recursive: true,
+              force: true
+            });
+            this.logger.debug("swept dev-uploads entry", {
+              meta: {
+                entry
+              }
+            });
+          } catch {
+          }
+        }
+      }
       /** Transient (.staging- / .evicted-) dirs younger than this are never pruned. */
       static STALE_TRANSIENT_MS = 24 * 60 * 60 * 1e3;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.53",
+  "version": "1.1.55",
   "private": false,
   "files": [
     "dist",
@@ -23,17 +23,17 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.1.45",
+    "@camstack/addon-admin-ui": "1.1.47",
     "@camstack/addon-advanced-notifier": "1.1.21",
     "@camstack/addon-auth": "1.1.6",
     "@camstack/addon-decoder-nodeav": "1.1.9",
     "@camstack/addon-notifiers": "1.1.21",
     "@camstack/addon-pipeline": "1.1.51",
-    "@camstack/addon-pipeline-orchestrator": "1.1.39",
+    "@camstack/addon-pipeline-orchestrator": "1.1.40",
     "@camstack/addon-post-analysis": "1.1.23",
     "@camstack/sdk": "1.1.22",
     "@camstack/shm-ring": "1.0.21",
-    "@camstack/system": "1.1.41",
+    "@camstack/system": "1.1.42",
     "@camstack/types": "1.1.39",
     "@camstack/ui-library": "1.1.31",
     "@fastify/compress": "^9.0.0",