@camstack/server 1.1.62 → 1.1.64

package/dist/core/addon/addon-registry.service.js

@@ -38,19 +38,21 @@ exports.shouldEmitProviderRegisteredReady = shouldEmitProviderRegisteredReady;
 /* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-member-access -- pre-existing lint debt across this 2200-line orchestration class. The flagged sites (StorageService.setLocationManager / setSettingsBackend, LoggingService.addDestination, RouteRegistry, etc.) are typed as `unknown` by their owning services to break circular construction-order dependencies; runtime contracts are validated structurally. Tracked separately; do not amend in unrelated edits. */
 const os = __importStar(require("node:os"));
 const addon_row_manifest_1 = require("./addon-row-manifest");
+const runner_convergence_1 = require("./runner-convergence");
 const types_1 = require("@camstack/types");
 const system_1 = require("@camstack/system");
 const system_2 = require("@camstack/system");
 const client_1 = require("@trpc/client");
 const system_3 = require("@camstack/system");
 const system_4 = require("@camstack/system");
+const system_5 = require("@camstack/system");
 const node_crypto_1 = require("node:crypto");
 const path = __importStar(require("node:path"));
 const fs = __importStar(require("node:fs"));
 const node_url_1 = require("node:url");
 const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
 const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
-const system_5 = require("@camstack/system");
+const system_6 = require("@camstack/system");
 const types_2 = require("@camstack/types");
 /**
  * Type predicate: true when an `ISettingsBackend` also satisfies the
@@ -84,6 +86,15 @@ function isSettingsStore(backend) {
 function isAddonRoutesInvoker(provider) {
     return typeof Reflect.get(provider, 'invoke') === 'function';
 }
+/**
+ * Window within which a second `restart:true` respawn of the SAME group runner
+ * is coalesced to a no-op (a package reload loops `restartAddon` over every
+ * group member — see `recentGroupRespawns`). Chosen comfortably longer than a
+ * single group respawn (child fork + init) so all members of one reload pass
+ * fall inside it, and short enough that a genuinely independent later restart
+ * still respawns.
+ */
+const GROUP_RESPAWN_COALESCE_MS = 10_000;
 const ROUTE_METHODS = [
     'GET',
     'POST',
@@ -197,6 +208,17 @@ class AddonRegistryService {
      * `restartAddon` completes (success or failure) or by a 90s safety timer.
      */
     restartingAddons = new Map();
+    /**
+     * `runnerId → last-respawn epoch-ms`, used ONLY to coalesce redundant group
+     * respawns. A package reload loops `restartAddon` over EVERY addon in the
+     * package (`tryReloadPackage`); for a co-location group that maps N members
+     * onto ONE runner, the first member's restart already respawns the whole
+     * group (all members reboot from fresh on-disk code), so the 2nd..Nth
+     * restarts must NOT respawn again — that churns the runner N times and risks
+     * tripping the crash circuit-breaker. Consulted by `ensureForkedRunner`; only
+     * groups (roster > 1) are coalesced, so solo-addon restart stays byte-identical.
+     */
+    recentGroupRespawns = new Map();
     logger;
     addonLoader;
     healthMonitor;
@@ -355,7 +377,7 @@ class AddonRegistryService {
         // Register the addon-settings singleton provider — replaces the
         // former `$addonHost` Moleculer service. The provider resolves
         // addonId → local addon instance (hub) or remote Moleculer call.
-        this.capabilityRegistry.declareCapability(system_5.addonSettingsCapability);
+        this.capabilityRegistry.declareCapability(system_6.addonSettingsCapability);
         // The SINGLE router for addon-level calls (routes / custom / settings).
         // It classifies in-process | hub-local-child (UDS) | remote-agent
         // (Moleculer) in ONE place — `resolveNode` reports only the BASE node
@@ -1096,17 +1118,22 @@ class AddonRegistryService {
         // `@camstack/system` builtins reach the in-process path below) it
         // boots in-process on the hub.
         if (this.isForkedAddonEntry(entry)) {
-            // D5: one-addon-one-process. A forked addon ALWAYS boots in its
-            // own runner — there is NO in-process-on-the-hub fallback. If the
-            // runner spawn fails, the addon is `failed`, surfaced as
-            // `addon.error` + recorded on the health monitor; it does not
-            // silently run on the hub. (Task 7's circuit breaker governs the
-            // retry policy on top of this.)
+            // D5 + co-location: a forked addon ALWAYS boots in a runner — there is
+            // NO in-process-on-the-hub fallback. `ensureForkedRunner` resolves the
+            // addon's runner id (`resolveRunnerId`) and spawns/joins the FULL
+            // co-located roster: a groupless addon gets its own runner (one addon,
+            // one process — unchanged), while a `execution.group` member co-locates
+            // with its siblings so cross-addon cap calls resolve in-process (zero
+            // copy). Idempotent when a sibling already brought the group up. If the
+            // spawn fails, the addon is `failed`, surfaced as `addon.error` +
+            // recorded on the health monitor; it does not silently run on the hub.
+            // (Task 7's circuit breaker governs the retry policy on top of this.)
+            //
+            // Provider registration for forkable addons is delegated to the
+            // `CapabilityBridge` (see `MoleculerService.onProviderConnected`);
+            // custom actions are (re-)registered inside `ensureForkedRunner`.
             try {
-                await this.broker.call('$process.spawnRunner', {
-                    runnerId: id,
-                    addons: [{ addonId: id, addonDir: entry.addonDir }],
-                });
+                await this.ensureForkedRunner(id, { restart: false });
             }
             catch (err) {
                 const msg = (0, types_1.errMsg)(err);
@@ -1121,23 +1148,6 @@ class AddonRegistryService {
                 this.healthMonitor.recordFailure(entry.packageName, err, id);
                 throw new Error(`Failed to spawn runner for addon "${id}": ${msg}`, { cause: err });
             }
-            // Provider registration for forkable addons is delegated to the
-            // `CapabilityBridge` (see `MoleculerService.onProviderConnected`).
-            // When the spawned child announces its Moleculer service via
-            // NODE_INFO, the bridge builds a proxy from the capability
-            // definition (`{ id, nodeId, ...methods }`) and registers it.
-            //
-            // Custom actions: read the catalog fresh from the on-disk bundle
-            // and register it against the hub-side `CustomActionRegistry`.
-            // `registerForkedAddonCustomActions` re-`import()`s the entry
-            // (cache-busted), so it covers the hot-load path — where the addon
-            // was registered via `freshLoader` and `this.addonLoader`'s cached
-            // `module` namespace is stale or absent. Dispatch routes through
-            // `broker.call('<addonId>.custom.<action>')`, the only divergence
-            // vs in-process being the transport, exactly like cap methods.
-            await this.registerForkedAddonCustomActions(id, 
-            // `isForkedAddonEntry` narrowed `entry.declaration` to non-null.
-            (0, types_1.resolveRunnerId)(entry.declaration, id));
             entry.initialized = true;
             this.logger.info('Addon spawned as isolated process', { tags: { addonId: id } });
             this.emitAddonLifecycleEvent('addon.started', id);
@@ -1357,23 +1367,40 @@ class AddonRegistryService {
         // restarts. The Moleculer `$node.disconnected` handler skips entries
         // present in `restartingAddons`; a 90s safety timer clears the flag
         // even if the restart path throws before the finally block runs.
-        const existingTimer = this.restartingAddons.get(addonId);
-        if (existingTimer)
-            clearTimeout(existingTimer);
-        const safetyTimer = setTimeout(() => {
-            this.restartingAddons.delete(addonId);
-        }, 90_000);
-        this.restartingAddons.set(addonId, safetyTimer);
+        // Suppress the banner for the restarted addon AND — for a co-location
+        // group — every SIBLING sharing its runner. `ensureForkedRunner` respawns
+        // the WHOLE group process, so all members briefly `$node.disconnect`; without
+        // suppressing the siblings too, each would flash a spurious "Failed to load".
+        const suppressed = new Set([addonId]);
+        if (this.isForkedAddonEntry(entry)) {
+            const runnerId = (0, types_1.resolveRunnerId)(entry.declaration, addonId);
+            for (const { addonId: siblingId } of this.buildAddonGroupPlan([
+                ...this.addonEntries.keys(),
+            ]).get(runnerId) ?? []) {
+                suppressed.add(siblingId);
+            }
+        }
+        for (const id of suppressed) {
+            const prior = this.restartingAddons.get(id);
+            if (prior)
+                clearTimeout(prior);
+            const timer = setTimeout(() => {
+                this.restartingAddons.delete(id);
+            }, 90_000);
+            this.restartingAddons.set(id, timer);
+        }
         try {
-            // Group-runner-hosted addon — delegate to $process.restart for the group
+            // Group-runner-hosted addon — converge the runner topology onto the
+            // declared group, then respawn it. `ensureForkedRunner({ restart: true })`
+            // both (a) adopts a NEW roster if `execution.group` changed since the
+            // runner last spawned (stop stale solo runners → spawn the group; a plain
+            // `$process.restart` would respawn the OLD roster forever), and (b) on the
+            // common path respawns the group in place so the child reboots the WHOLE
+            // roster from the freshly-swapped on-disk bundle. Updating ONE member of a
+            // group therefore respawns the ENTIRE group — they share a process.
             if (this.isForkedAddonEntry(entry)) {
-                const result = (await this.broker.call('$process.restart', {
-                    name: addonId,
-                }));
-                if (!result.success) {
-                    throw new Error(`Process restart failed: ${result.reason ?? 'unknown'}`);
-                }
-                // $process.restart resolves as soon as the child is respawned, not when its
+                await this.ensureForkedRunner(addonId, { restart: true });
+                // The respawn resolves as soon as the child is up, not when its
                 // capabilities are re-registered. Callers (integrations.create, UI forms) may
                 // immediately try to route to the provider and hit a transient null. Block here
                 // until every declared capability is back on the registry so the restart is
@@ -1413,16 +1440,10 @@ class AddonRegistryService {
                             `(re-register asynchronously — e.g. device-scoped caps awaiting devices): ${missing.join(', ')}`, { tags: { addonId } });
                     }
                 }
-                // Re-register the addon's custom-action catalog. `$process.restart`
-                // respawns the group child and `CapabilityBridge` re-registers cap
-                // providers — but custom actions live in the hub-side
-                // `CustomActionRegistry`, which the restart path never touched.
-                // Without this, every hot-update of a group-hosted addon silently
-                // drops its custom actions (the catalog is only registered once,
-                // at boot, in `initializeAddonGroup`). Reads a fresh catalog from
-                // the just-updated on-disk bundle.
-                const runnerId = (0, types_1.resolveRunnerId)(entry.declaration, addonId);
-                await this.registerForkedAddonCustomActions(addonId, runnerId);
+                // Custom actions are re-registered inside `ensureForkedRunner` for
+                // every roster member (custom actions live in the hub-side
+                // `CustomActionRegistry`, which the process spawn never touches — a
+                // hot-update would otherwise silently drop them).
                 this.logAddonLifecycle('restarted', addonId, 'isolated');
                 this.emitAddonLifecycleEvent('addon.restarted', addonId);
                 return { success: true };
@@ -1483,13 +1504,16 @@ class AddonRegistryService {
             return { success: false, error: msg };
         }
         finally {
-            // Clear the suppression flag regardless of success/failure — if the
-            // restart failed, the operator will see the real error via the
-            // mutation result rather than a misleading transient health blip.
-            const timer = this.restartingAddons.get(addonId);
-            if (timer)
-                clearTimeout(timer);
-            this.restartingAddons.delete(addonId);
+            // Clear the suppression flags (restarted addon + any group siblings)
+            // regardless of success/failure — if the restart failed, the operator
+            // sees the real error via the mutation result rather than a misleading
+            // transient health blip.
+            for (const id of suppressed) {
+                const timer = this.restartingAddons.get(id);
+                if (timer)
+                    clearTimeout(timer);
+                this.restartingAddons.delete(id);
+            }
         }
     }
     getAddon(id) {
@@ -2488,6 +2512,25 @@ class AddonRegistryService {
             capHandleCache.set(key, handle);
             return handle;
         }
+        // In-process HTTP data-plane for co-located hub builtins (e.g. the snapshot
+        // wrapper's per-device image endpoint). The facility binds a `127.0.0.1`
+        // listener in the hub process on first `serve()`; the sink publishes its
+        // endpoints straight into the hub's `DataPlaneRegistry` (bare `addonId`, the
+        // same key the `/addon/:addonId/*` reverse-proxy matches), so a builtin
+        // serves media exactly like a forked addon — no per-builtin proxy plumbing.
+        // `mountAddonDataPlanes` handles only FORKED addons; this covers the
+        // co-located path it defers. Disposed via the addon's disposer chain.
+        const dataPlaneSink = {
+            set: (id, endpoints) => {
+                registry.dataPlaneRegistry?.registerAddon(id, endpoints);
+            },
+        };
+        const dataPlaneFacility = (0, system_5.createAddonDataPlaneFacility)({
+            addonId,
+            logger,
+            sink: dataPlaneSink,
+        });
+        this.getOrCreateDisposerChain(addonId).add(() => dataPlaneFacility.dispose());
         const ctx = {
             id: `addon:${addonId}`,
             logger,
@@ -2495,6 +2538,7 @@ class AddonRegistryService {
             addonConfig: bootstrapConfig,
             dataDir,
             nodeDataDir,
+            dataPlane: dataPlaneFacility.dataPlane,
             get api() {
                 return registry.getBrokerApi();
             },
@@ -2705,6 +2749,107 @@ class AddonRegistryService {
             meta: { runnerId, addonCount: addons.length, addonIds: addons.map((a) => a.addonId) },
         });
     }
+    /**
+     * Snapshot of the live runner subprocesses (`$process.list`), reduced to the
+     * `{ runnerId, addonIds }` shape the convergence planner needs. Returns `[]`
+     * on any broker error so the caller degrades to a fresh spawn rather than
+     * throwing — a missing list can only mean "nothing is running".
+     */
+    async listRunnerProcesses() {
+        try {
+            // `$process.*` is an untyped Moleculer infra boundary (returns `unknown`);
+            // the process-service owns the `ProcessInfo` shape. Narrow to the two
+            // fields the planner reads.
+            const procs = (await this.broker.call('$process.list'));
+            return procs.map((p) => ({ name: p.name, addonIds: p.addonIds }));
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Group-aware, convergent forked-runner spawn — the SINGLE authority for
+     * bringing an addon's runner up OUTSIDE the boot plan (hot-install, retry,
+     * operator restart, deploy hot-reload). The boot plan
+     * (`buildAddonGroupPlan` → `initializeAddonGroup`) already groups; this makes
+     * every OTHER lifecycle path honour `execution.group` too, so co-location is
+     * not silently lost the moment an addon is (re)spawned post-boot.
+     *
+     * Resolves the runner id via `resolveRunnerId` and the FULL co-located roster
+     * via `buildAddonGroupPlan` (the same authority the boot plan uses), then
+     * converges the live process topology onto that roster (see
+     * `planRunnerConvergence`): stop stale/mismatched runners, then spawn or
+     * restart the group runner. Idempotent — safe to call once per roster member
+     * (the 2nd..Nth calls see the correct topology and no-op). A groupless addon
+     * keys to a size-1 roster whose runner id is its own id, so its behaviour is
+     * byte-identical to the pre-group solo path.
+     *
+     * `opts.restart` respawns the group in place even when the roster already
+     * matches — the deploy hot-reload path, so the child reboots the WHOLE roster
+     * from the freshly-swapped on-disk bundle. This is why updating ONE member of
+     * a group respawns the ENTIRE group (they share a process): the operator's
+     * "update one → respawn the whole group" invariant.
+     */
+    async ensureForkedRunner(addonId, opts) {
+        const entry = this.addonEntries.get(addonId);
+        if (!entry?.declaration || !entry.addonDir) {
+            throw new Error(`ensureForkedRunner("${addonId}") requires an on-disk forked addon`);
+        }
+        const runnerId = (0, types_1.resolveRunnerId)(entry.declaration, addonId);
+        const roster = this.buildAddonGroupPlan([...this.addonEntries.keys()]).get(runnerId) ?? [
+            { addonId, addonDir: entry.addonDir },
+        ];
+        // Coalesce redundant group respawns: a package reload loops `restartAddon`
+        // over every member of a co-location group, but the FIRST member's restart
+        // already respawned the whole runner (every member rebooted from fresh disk
+        // code). For a GROUP (roster > 1) whose runner was respawned inside the
+        // coalesce window, downgrade a restart request to a plain topology check so
+        // the 2nd..Nth members don't churn the runner. Solo addons (roster == 1) are
+        // never coalesced — their behaviour stays byte-identical.
+        const effectiveRestart = opts.restart &&
+            roster.length > 1 &&
+            Date.now() - (this.recentGroupRespawns.get(runnerId) ?? 0) < GROUP_RESPAWN_COALESCE_MS
+            ? false
+            : opts.restart;
+        const running = await this.listRunnerProcesses();
+        const plan = (0, runner_convergence_1.planRunnerConvergence)(runnerId, roster.map((r) => r.addonId), running, { restart: effectiveRestart });
+        // 1. Tear down every stale/mismatched runner that hosts a roster member.
+        for (const name of plan.stop) {
+            await this.broker.call('$process.stop', { name }).catch((err) => {
+                this.logger.warn('ensureForkedRunner: failed to stop stale runner (continuing)', {
+                    meta: { runnerId, stale: name, error: (0, types_1.errMsg)(err) },
+                });
+            });
+        }
+        // 2. Bring the target runner to the correct roster.
+        if (plan.action === 'spawn') {
+            await this.broker.call('$process.spawnRunner', { runnerId, addons: roster }).catch((err) => {
+                // A concurrent path may have won the spawn race — treat "already
+                // running" as success (idempotent), rethrow anything else.
+                if (!/already running/i.test((0, types_1.errMsg)(err)))
+                    throw err;
+            });
+            this.recentGroupRespawns.set(runnerId, Date.now());
+        }
+        else if (plan.action === 'restart') {
+            const res = (await this.broker.call('$process.restart', { name: runnerId }));
+            if (!res.success) {
+                throw new Error(`Process restart failed: ${res.reason ?? 'unknown'}`);
+            }
+            this.recentGroupRespawns.set(runnerId, Date.now());
+        }
+        // 3. Bookkeeping for EVERY roster member. Custom actions live in the
+        //    hub-side registry the process spawn never touches; a hot-update would
+        //    otherwise silently drop them (the boot plan is the only other place
+        //    they register). Mark each member initialized so the in-process
+        //    core-builtin boot passes skip them.
+        for (const { addonId: memberId } of roster) {
+            await this.registerForkedAddonCustomActions(memberId, runnerId);
+            const memberEntry = this.addonEntries.get(memberId);
+            if (memberEntry)
+                memberEntry.initialized = true;
+        }
+    }
     /**
      * (Re-)register the custom-action catalog for a forked / group-hosted
      * addon against the shared `CustomActionRegistry`.

package/dist/core/addon/runner-convergence.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * Group-runner convergence planner (pure).
+ *
+ * Group membership is decided ONCE, at a runner's FIRST spawn — the `addons`
+ * array handed to `$process.spawnRunner`. Every later lifecycle op preserves
+ * it: `$process.restart` respawns a runner from its CAPTURED `runnerAddons`,
+ * never from a freshly-declared roster. That means the boot plan
+ * (`buildAddonGroupPlan` → `initializeAddonGroup`) is not the only place that
+ * has to be group-aware: any path that (re)spawns an addon's runner outside
+ * boot (hot-install, retry, operator restart, deploy hot-reload) must converge
+ * the LIVE process topology onto the addon's DECLARED runner id
+ * (`resolveRunnerId`) and its full co-located roster.
+ *
+ * This module holds the decision as a pure function so it is unit-testable
+ * without the heavyweight `AddonRegistryService`. The caller
+ * (`ensureForkedRunner`) executes the plan against `$process.*`.
+ *
+ * Why not just `$process.restart` the addon? Because restart respawns the
+ * runner's OLD roster. A runner named `detection` that was spawned solo (with
+ * only `pipeline-runner`, before the group manifest shipped) would be respawned
+ * solo forever. To adopt a NEW roster the stale runner(s) must be STOPPED and
+ * the group spawned fresh — the convergence this planner encodes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planRunnerConvergence = planRunnerConvergence;
+function sameRoster(addonIds, rosterSet) {
+    return addonIds.length === rosterSet.size && addonIds.every((a) => rosterSet.has(a));
+}
+/**
+ * Decide how to converge the live runner topology onto the declared group.
+ *
+ * @param runnerId       the addon's resolved runner id (`resolveRunnerId`).
+ * @param rosterAddonIds the FULL co-located roster (every eligible addon that
+ *                       resolves to `runnerId`). Always includes the addon
+ *                       itself; size-1 for a groupless addon.
+ * @param running        current runner subprocesses (`$process.list`).
+ * @param opts.restart   true when the caller wants an in-place respawn even if
+ *                       the roster already matches (deploy hot-reload path).
+ */
+function planRunnerConvergence(runnerId, rosterAddonIds, running, opts) {
+    const rosterSet = new Set(rosterAddonIds);
+    const target = running.find((p) => p.name === runnerId);
+    const targetIsCorrect = target !== undefined && sameRoster(target.addonIds, rosterSet);
+    if (targetIsCorrect) {
+        // The exact group runner is already up. Only stragglers to stop are OTHER
+        // runners that (wrongly) host a roster member.
+        const stop = running
+            .filter((p) => p.name !== runnerId && p.addonIds.some((a) => rosterSet.has(a)))
+            .map((p) => p.name);
+        return { stop, action: opts.restart ? 'restart' : 'none' };
+    }
+    // No correct runner: either nothing hosts the roster, or a same-id runner
+    // carries the WRONG roster, or roster members are scattered across stale
+    // solo runners. Stop every runner that hosts a roster member (INCLUDING a
+    // wrong-roster same-id runner — restart would just re-spawn its stale
+    // roster), then spawn the group fresh.
+    const stop = running
+        .filter((p) => p.name === runnerId || p.addonIds.some((a) => rosterSet.has(a)))
+        .map((p) => p.name);
+    return { stop, action: 'spawn' };
+}

package/dist/main.js

@@ -721,7 +721,14 @@ async function bootstrap() {
         // Addon HTTP API route catch-all: /addon/:addonId/*
         // Only handles non-GET or routes that actually exist in the addon route registry.
         // GET requests that don't match an addon route are SPA pages — handled by the /* fallback.
-        fastify.all('/addon/:addonId/*', async (request, reply) => {
+        //
+        // `compress: false`: the bridged reply body of a FORKED addon crosses the
+        // UDS route bridge as opaque bytes; piping those through the hub's global
+        // @fastify/compress emits an EMPTY brotli stream for any compressible body
+        // >1KiB (live-diagnosed 2026-07-16 — broke the notifier SVG icons; same
+        // class addon-upload.ts already dodges). Addons that care about coding own
+        // it end-to-end (see the notifier icon routes).
+        fastify.all('/addon/:addonId/*', { compress: false }, async (request, reply) => {
             const { addonId } = request.params;
             const subPath = request.params['*'] ?? '';
             const method = request.method;

package/dist/server-root/index.js

@@ -98,6 +98,7 @@ var require_dist = __commonJS({
       planBoot: /* @__PURE__ */ __name(() => planBoot, "planBoot"),
       readDevUploadManifest: /* @__PURE__ */ __name(() => readDevUploadManifest, "readDevUploadManifest"),
       readRestartIntentMarker: /* @__PURE__ */ __name(() => readRestartIntentMarker, "readRestartIntentMarker"),
+      readSeedVersion: /* @__PURE__ */ __name(() => readSeedVersion, "readSeedVersion"),
       readServerRootState: /* @__PURE__ */ __name(() => readServerRootState, "readServerRootState"),
       registerActiveRootResolver: /* @__PURE__ */ __name(() => registerActiveRootResolver, "registerActiveRootResolver"),
       restartIntentMarkerPath: /* @__PURE__ */ __name(() => restartIntentMarkerPath, "restartIntentMarkerPath"),
@@ -351,7 +352,39 @@ var require_dist = __commonJS({
       return null;
     }
     __name(validateVersionDir, "validateVersionDir");
-    function planBoot(state, isValidVersion, now) {
+    function parse(version) {
+      const dashIdx = version.indexOf("-");
+      const base = dashIdx === -1 ? version : version.slice(0, dashIdx);
+      const prerelease = dashIdx === -1 ? null : version.slice(dashIdx + 1);
+      const nums = base.split(".").map((seg) => {
+        const n = Number.parseInt(seg, 10);
+        return Number.isNaN(n) ? 0 : n;
+      });
+      return {
+        nums,
+        prerelease
+      };
+    }
+    __name(parse, "parse");
+    function compareSemver(a, b) {
+      const pa = parse(a);
+      const pb = parse(b);
+      const len = Math.max(pa.nums.length, pb.nums.length);
+      for (let i = 0; i < len; i++) {
+        const na = pa.nums[i] ?? 0;
+        const nb = pb.nums[i] ?? 0;
+        if (na < nb) return -1;
+        if (na > nb) return 1;
+      }
+      if (pa.prerelease === null && pb.prerelease === null) return 0;
+      if (pa.prerelease === null) return 1;
+      if (pb.prerelease === null) return -1;
+      if (pa.prerelease < pb.prerelease) return -1;
+      if (pa.prerelease > pb.prerelease) return 1;
+      return 0;
+    }
+    __name(compareSemver, "compareSemver");
+    function planBoot(state, isValidVersion, now, seedVersion = null) {
       if (state === null) {
         return {
           kind: "baked",
@@ -404,6 +437,19 @@ var require_dist = __commonJS({
       }
       if (next.currentVersion !== null) {
         if (isValidVersion(next.currentVersion)) {
+          if (!changed && seedVersion !== null && compareSemver(seedVersion, next.currentVersion) > 0) {
+            return {
+              kind: "baked",
+              reason: `baked seed ${seedVersion} is newer than active data-root ${next.currentVersion} \u2014 adopting the image seed`,
+              stateToWrite: {
+                ...next,
+                currentVersion: null,
+                previousVersion: null,
+                pendingBoot: null,
+                rolledBack: null
+              }
+            };
+          }
           return {
             kind: "data-root",
             version: next.currentVersion,
@@ -453,38 +499,6 @@ var require_dist = __commonJS({
       };
     }
     __name(planBoot, "planBoot");
-    function parse(version) {
-      const dashIdx = version.indexOf("-");
-      const base = dashIdx === -1 ? version : version.slice(0, dashIdx);
-      const prerelease = dashIdx === -1 ? null : version.slice(dashIdx + 1);
-      const nums = base.split(".").map((seg) => {
-        const n = Number.parseInt(seg, 10);
-        return Number.isNaN(n) ? 0 : n;
-      });
-      return {
-        nums,
-        prerelease
-      };
-    }
-    __name(parse, "parse");
-    function compareSemver(a, b) {
-      const pa = parse(a);
-      const pb = parse(b);
-      const len = Math.max(pa.nums.length, pb.nums.length);
-      for (let i = 0; i < len; i++) {
-        const na = pa.nums[i] ?? 0;
-        const nb = pb.nums[i] ?? 0;
-        if (na < nb) return -1;
-        if (na > nb) return 1;
-      }
-      if (pa.prerelease === null && pb.prerelease === null) return 0;
-      if (pa.prerelease === null) return 1;
-      if (pb.prerelease === null) return -1;
-      if (pa.prerelease < pb.prerelease) return -1;
-      if (pa.prerelease > pb.prerelease) return 1;
-      return 0;
-    }
-    __name(compareSemver, "compareSemver");
     var fs3 = __toESM2(require("fs"));
     var path3 = __toESM2(require("path"));
     function detectWorkspaceRoot(fromDir) {
@@ -504,6 +518,7 @@ var require_dist = __commonJS({
       }
     }
     __name(detectWorkspaceRoot, "detectWorkspaceRoot");
+    var fs4 = __toESM2(require("fs"));
     var path4 = __toESM2(require("path"));
     var import_node_url = require("url");
     var HOST_EXTERNAL_SPECIFIERS = [
@@ -546,6 +561,20 @@ var require_dist = __commonJS({
       registerHooks(hooks);
     }
     __name(registerActiveRootResolver, "registerActiveRootResolver");
+    function readSeedVersion(seedEntry) {
+      try {
+        const pkgJsonPath = path4.join(path4.dirname(seedEntry), "..", "package.json");
+        const raw = JSON.parse(fs4.readFileSync(pkgJsonPath, "utf-8"));
+        if (typeof raw === "object" && raw !== null) {
+          const version = raw["version"];
+          if (typeof version === "string") return version;
+        }
+        return null;
+      } catch {
+        return null;
+      }
+    }
+    __name(readSeedVersion, "readSeedVersion");
     function runNodeStarter(options) {
       const env = options.env ?? process.env;
       const now = options.now ?? Date.now;
@@ -572,7 +601,8 @@ var require_dist = __commonJS({
         if (reason !== null) console.warn(`[starter] version ${version} invalid: ${reason}`);
         return reason === null;
       }, "isValidVersion");
-      const plan = planBoot(state, isValidVersion, now);
+      const seedVersion = readSeedVersion(options.seedEntry);
+      const plan = planBoot(state, isValidVersion, now, seedVersion);
       if (plan.stateToWrite !== null) {
         try {
           writeServerRootState(rootDir, plan.stateToWrite);
@@ -604,7 +634,7 @@ var require_dist = __commonJS({
     }
     __name(runNodeStarter, "runNodeStarter");
     var import_node_child_process = require("child_process");
-    var fs4 = __toESM2(require("fs"));
+    var fs5 = __toESM2(require("fs"));
     var path5 = __toESM2(require("path"));
     var import_node_util = require("util");
     var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
@@ -622,7 +652,7 @@ var require_dist = __commonJS({
     var RESTART_REASON_PREFIX = "server-update";
     function readPackageVersion(pkgJsonPath) {
       try {
-        const raw = JSON.parse(fs4.readFileSync(pkgJsonPath, "utf-8"));
+        const raw = JSON.parse(fs5.readFileSync(pkgJsonPath, "utf-8"));
         if (typeof raw === "object" && raw !== null) {
           const version = raw["version"];
           if (typeof version === "string") return version;
@@ -712,7 +742,7 @@ var require_dist = __commonJS({
         };
         return {
           state: emptyServerRootState(),
-          corrupt: fs4.existsSync(stateFilePath(rootDir))
+          corrupt: fs5.existsSync(stateFilePath(rootDir))
         };
       }
       updateState(state) {
@@ -865,7 +895,7 @@ var require_dist = __commonJS({
         }
         if (isDevChannelVersion(target)) {
           const uploadsDir = devUploadVersionDir(this.rootDir(), target);
-          if (!fs4.existsSync(uploadsDir)) {
+          if (!fs5.existsSync(uploadsDir)) {
             return {
               accepted: false,
               targetVersion: target,
@@ -926,11 +956,11 @@ var require_dist = __commonJS({
       async stageAndActivate(target) {
         const rootDir = this.rootDir();
         const vDir = versionsDir(rootDir);
-        fs4.mkdirSync(vDir, {
+        fs5.mkdirSync(vDir, {
           recursive: true
         });
         const stagingDir = path5.join(vDir, `.staging-${target}-${process.pid}-${this.now()}`);
-        fs4.mkdirSync(stagingDir, {
+        fs5.mkdirSync(stagingDir, {
           recursive: true
         });
         try {
@@ -943,8 +973,8 @@ var require_dist = __commonJS({
             "--no-fund",
             "--loglevel=error"
           ];
-          if (fs4.existsSync(devDir)) {
-            fs4.writeFileSync(path5.join(stagingDir, "package.json"), JSON.stringify(this.buildDevUploadsPackageJson(devDir, target), null, 2), "utf-8");
+          if (fs5.existsSync(devDir)) {
+            fs5.writeFileSync(path5.join(stagingDir, "package.json"), JSON.stringify(this.buildDevUploadsPackageJson(devDir, target), null, 2), "utf-8");
             await this.execNpm([
               ...installArgs,
               ...buildNpmRegistryArgs(registry)
@@ -953,7 +983,7 @@ var require_dist = __commonJS({
               timeoutMs: NPM_INSTALL_TIMEOUT_MS
             });
           } else {
-            fs4.writeFileSync(path5.join(stagingDir, "package.json"), JSON.stringify({
+            fs5.writeFileSync(path5.join(stagingDir, "package.json"), JSON.stringify({
               name: "camstack-node-root",
               private: true
             }, null, 2), "utf-8");
@@ -967,7 +997,7 @@ var require_dist = __commonJS({
             });
           }
           const entry = rootEntryPath2(stagingDir, this.spec);
-          if (!fs4.existsSync(entry)) {
+          if (!fs5.existsSync(entry)) {
             throw new Error(`staged closure is missing the root entry (${entry})`);
           }
           const stagedVersion = readPackageVersion(path5.join(rootPackageDir2(stagingDir, this.spec), "package.json"));
@@ -975,17 +1005,17 @@ var require_dist = __commonJS({
             throw new Error(`staged closure version mismatch: expected ${target}, got ${stagedVersion ?? "unknown"}`);
           }
           const dest = versionDir(rootDir, target);
-          if (fs4.existsSync(dest)) {
+          if (fs5.existsSync(dest)) {
             const aside = `${dest}.evicted-${this.now()}`;
-            await fs4.promises.rename(dest, aside);
-            await fs4.promises.rm(aside, {
+            await fs5.promises.rename(dest, aside);
+            await fs5.promises.rm(aside, {
               recursive: true,
               force: true
             }).catch(() => void 0);
           }
-          await fs4.promises.rename(stagingDir, dest);
+          await fs5.promises.rename(stagingDir, dest);
         } catch (err) {
-          await fs4.promises.rm(stagingDir, {
+          await fs5.promises.rm(stagingDir, {
             recursive: true,
             force: true
           }).catch(() => void 0);
@@ -1015,7 +1045,7 @@ var require_dist = __commonJS({
         }
         const fileRef = /* @__PURE__ */ __name((filename) => {
           const abs = path5.join(devDir, filename);
-          if (!fs4.existsSync(abs)) {
+          if (!fs5.existsSync(abs)) {
             throw new Error(`dev-uploads tarball listed in the manifest is missing: ${abs}`);
           }
           return `file:${abs}`;
@@ -1194,7 +1224,7 @@ var require_dist = __commonJS({
         const vDir = versionsDir(this.rootDir());
         let entries;
         try {
-          entries = fs4.readdirSync(vDir);
+          entries = fs5.readdirSync(vDir);
         } catch {
           return;
         }
@@ -1203,14 +1233,14 @@ var require_dist = __commonJS({
           const full = path5.join(vDir, entry);
           if (entry.startsWith(".")) {
             try {
-              const ageMs = this.now() - fs4.statSync(full).mtimeMs;
+              const ageMs = this.now() - fs5.statSync(full).mtimeMs;
               if (ageMs < _RootUpdateService.STALE_TRANSIENT_MS) continue;
             } catch {
               continue;
             }
           }
           try {
-            fs4.rmSync(full, {
+            fs5.rmSync(full, {
               recursive: true,
               force: true
             });
@@ -1241,15 +1271,15 @@ var require_dist = __commonJS({
         const dir = devUploadsDir(this.rootDir());
         let entries;
         try {
-          entries = fs4.readdirSync(dir);
+          entries = fs5.readdirSync(dir);
         } catch {
           return;
         }
         const graveyard = path5.join(dir, ".sweeping");
         try {
-          for (const residue of fs4.readdirSync(graveyard)) {
+          for (const residue of fs5.readdirSync(graveyard)) {
             try {
-              fs4.rmSync(path5.join(graveyard, residue), {
+              fs5.rmSync(path5.join(graveyard, residue), {
                 recursive: true,
                 force: true
               });
@@ -1264,13 +1294,13 @@ var require_dist = __commonJS({
         ].sort((a, b) => (devChannelEpoch(b) ?? -1) - (devChannelEpoch(a) ?? -1));
         const doomed = byNewestFirst.slice(keepCount);
         if (doomed.length === 0) return;
-        fs4.mkdirSync(graveyard, {
+        fs5.mkdirSync(graveyard, {
           recursive: true
         });
         for (const entry of doomed) {
           const aside = path5.join(graveyard, `${entry}-${this.now()}`);
           try {
-            fs4.renameSync(path5.join(dir, entry), aside);
+            fs5.renameSync(path5.join(dir, entry), aside);
           } catch (err) {
             this.logger.warn("failed to move dev-uploads entry aside for sweep", {
               meta: {
@@ -1281,7 +1311,7 @@ var require_dist = __commonJS({
             continue;
           }
           try {
-            fs4.rmSync(aside, {
+            fs5.rmSync(aside, {
               recursive: true,
               force: true
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.1.62",
+  "version": "1.1.64",
   "private": false,
   "files": [
     "dist",
@@ -23,19 +23,19 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.1.51",
-    "@camstack/addon-advanced-notifier": "1.1.24",
-    "@camstack/addon-auth": "1.1.9",
-    "@camstack/addon-decoder-nodeav": "1.1.11",
-    "@camstack/addon-notifiers": "1.1.23",
-    "@camstack/addon-pipeline": "1.1.56",
-    "@camstack/addon-pipeline-orchestrator": "1.1.46",
-    "@camstack/addon-post-analysis": "1.1.28",
-    "@camstack/sdk": "1.1.24",
-    "@camstack/shm-ring": "1.0.23",
-    "@camstack/system": "1.1.49",
-    "@camstack/types": "1.1.44",
-    "@camstack/ui-library": "1.1.36",
+    "@camstack/addon-admin-ui": "1.1.53",
+    "@camstack/addon-advanced-notifier": "1.1.25",
+    "@camstack/addon-auth": "1.1.10",
+    "@camstack/addon-decoder-nodeav": "1.1.13",
+    "@camstack/addon-notifiers": "1.1.25",
+    "@camstack/addon-pipeline": "1.1.58",
+    "@camstack/addon-pipeline-orchestrator": "1.1.48",
+    "@camstack/addon-post-analysis": "1.1.30",
+    "@camstack/sdk": "1.1.25",
+    "@camstack/shm-ring": "1.0.24",
+    "@camstack/system": "1.1.51",
+    "@camstack/types": "1.1.46",
+    "@camstack/ui-library": "1.1.37",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/multipart": "^10.0.0",