@camstack/server 1.1.56 → 1.1.58

package/dist/core/addon-widgets/addon-widgets.service.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AddonWidgetsService = void 0;
+exports.stripBundleVersionSegment = stripBundleVersionSegment;
 const path = __importStar(require("node:path"));
 const fs = __importStar(require("node:fs"));
 /**
@@ -45,6 +46,23 @@ function stripNodeSuffix(registryKey) {
     const at = registryKey.indexOf('@');
     return at === -1 ? registryKey : registryKey.slice(0, at);
 }
+/** A content-version namespace segment: `v<hex>` (the aggregator's dir hash). */
+const VERSION_SEGMENT_RE = /^v[0-9a-f]{6,}$/;
+/**
+ * Strip the optional leading content-version segment (`v<hash>/`) from a
+ * requested bundle path. The version is a cache-busting NAMESPACE only — the
+ * real file lives at `distDir/<rest>`; MF relative imports resolve against the
+ * versioned URL, so `v<hash>/_stub.js` must resolve to `_stub.js`. Returns
+ * `{ filePath, versioned }` — `versioned` lets the route serve content-
+ * addressed files as `immutable`. Pure + exported for the spec.
+ */
+function stripBundleVersionSegment(rawPath) {
+    const slash = rawPath.indexOf('/');
+    if (slash > 0 && VERSION_SEGMENT_RE.test(rawPath.slice(0, slash))) {
+        return { filePath: rawPath.slice(slash + 1), versioned: true };
+    }
+    return { filePath: rawPath, versioned: false };
+}
 /**
  * AddonWidgetsService — server-side helper that backs the static file
  * route `/api/addon-widgets/:addonId/*` (registered in `main.ts`).
@@ -103,8 +121,11 @@ class AddonWidgetsService {
             this.logger.warn('Bundle resolve failed: addon install path not found', { tags: { addonId } });
             return null;
         }
+        // Drop the content-version namespace (`v<hash>/`) the aggregator stamps —
+        // it exists only to atomically cache-bust the bundle on update.
+        const { filePath: bareFilePath } = stripBundleVersionSegment(filePath);
         const resolvedBase = path.resolve(installPath.distDir);
-        const resolvedFile = path.resolve(installPath.distDir, filePath);
+        const resolvedFile = path.resolve(installPath.distDir, bareFilePath);
         // Path traversal protection
         if (!resolvedFile.startsWith(resolvedBase + path.sep) && resolvedFile !== resolvedBase) {
             this.logger.warn('Path traversal denied for addon', { tags: { addonId }, meta: { filePath } });

package/dist/main.js

@@ -475,11 +475,17 @@ async function bootstrap() {
                         : ext === '.html'
                             ? 'text/html'
                             : 'application/octet-stream';
+            // A content-versioned request (`v<hash>/…`) is content-addressed: the
+            // URL changes iff the bundle changed, so EVERYTHING under it — even the
+            // fixed-name `_stub.js`/`remoteEntry.js` — is safely immutable (this
+            // defeats a CDN edge serving a stale stub). Legacy unversioned requests
+            // keep the per-file revalidation policy.
+            const { versioned } = (0, addon_widgets_service_1.stripBundleVersionSegment)(filePath);
+            const cacheControl = versioned
+                ? 'public, max-age=31536000, immutable'
+                : (0, spa_static_1.addonBundleCacheControl)(resolved);
             const stream = fs.createReadStream(resolved);
-            return reply
-                .header('cache-control', (0, spa_static_1.addonBundleCacheControl)(resolved))
-                .type(contentType)
-                .send(stream);
+            return reply.header('cache-control', cacheControl).type(contentType).send(stream);
         });
         // Serve static assets (e.g. SVG icons) from an addon's package directory
         fastify.get('/api/addon-assets/:addonId/*', async (request, reply) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.56",
+  "version": "1.1.58",
   "private": false,
   "files": [
     "dist",
@@ -28,12 +28,12 @@
     "@camstack/addon-auth": "1.1.6",
     "@camstack/addon-decoder-nodeav": "1.1.9",
     "@camstack/addon-notifiers": "1.1.21",
-    "@camstack/addon-pipeline": "1.1.51",
-    "@camstack/addon-pipeline-orchestrator": "1.1.41",
+    "@camstack/addon-pipeline": "1.1.52",
+    "@camstack/addon-pipeline-orchestrator": "1.1.42",
     "@camstack/addon-post-analysis": "1.1.24",
     "@camstack/sdk": "1.1.22",
     "@camstack/shm-ring": "1.0.21",
-    "@camstack/system": "1.1.43",
+    "@camstack/system": "1.1.45",
     "@camstack/types": "1.1.40",
     "@camstack/ui-library": "1.1.32",
     "@fastify/compress": "^9.0.0",