@camstack/server 1.1.70 → 1.1.72

package/dist/api/core/cap-providers.js

@@ -1136,17 +1136,6 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             (0, collection_preference_js_1.persistCollectionDisabled)(configService, input.capName, updated?.disabledProviders ?? []);
             return { success: true };
         },
-        updateFrameworkPackage: async (input) => ps.updateFrameworkPackage({
-            packageName: input.packageName,
-            ...(input.version !== undefined ? { version: input.version } : {}),
-            ...(ctx.user?.username !== undefined
-                ? { requestedBy: ctx.user.username }
-                : ctx.user?.id !== undefined
-                    ? { requestedBy: ctx.user.id }
-                    : {}),
-            ...(input.deferRestart !== undefined ? { deferRestart: input.deferRestart } : {}),
-            runner: lifecycleRunner,
-        }),
         getVersions: async (input) => ps.getPackageVersions(input.name),
         restartAddon: async (input) => ar.restartAddon(input.addonId),
         retryLoad: async (input) => {

package/dist/api/core/lifecycle-job-runner.js

@@ -75,8 +75,6 @@ function createLifecycleJobRunner(deps) {
         applyAddonUpdate: deps.applyAddonUpdate,
         emit: deps.emit,
         now: nowFn,
-        stageFramework: deps.stageFramework,
-        requestFrameworkSwap: deps.requestFrameworkSwap,
     });
     /**
      * Set of jobIds currently executing — used to guard cancellation.

package/dist/api/trpc/generated-cap-routers.js

@@ -605,14 +605,6 @@ function createCapRouter_addons(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setCapabilityProviderEnabled(input);
         }),
-        updateFrameworkPackage: trpc_middleware_js_1.adminProcedure
-            .input(types_10.addonsCapability.methods.updateFrameworkPackage.input.loose())
-            .output(types_10.addonsCapability.methods.updateFrameworkPackage.output)
-            .mutation(async ({ input, ctx }) => {
-            const p = requireCapProvider('addons', () => getProvider(ctx));
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.updateFrameworkPackage(input);
-        }),
         getVersions: trpc_middleware_js_1.protectedProcedure
             .input(types_10.addonsCapability.methods.getVersions.input.loose())
             .output(types_10.addonsCapability.methods.getVersions.output)

package/dist/api/trpc/trpc.router.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enrichInputWithUserAgent = enrichInputWithUserAgent;
 exports.enrichInputWithRelayClass = enrichInputWithRelayClass;
+exports.enrichHintsWithClientClass = enrichHintsWithClientClass;
 exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
 exports.buildAppRouter = buildAppRouter;
 const addon_settings_router_js_1 = require("../core/addon-settings.router.js");
@@ -87,6 +88,52 @@ function enrichInputWithRelayClass(input, clientClass) {
     const relayOnly = FORCE_RELAY_REMOTE ? (0, client_ip_js_1.deriveRelayOnly)(clientClass) : false;
     return { ...input, relayOnly };
 }
+/**
+ * Initial adaptive rung for a genuinely-REMOTE viewer.
+ *
+ * A `remote` (public / CGNAT-4G / internet) client cannot reliably receive the
+ * high tier's large keyframe over a lossy relay path — LAN can, which is why
+ * adaptive works on LAN but a remote adaptive viewer sees a permanent black
+ * frame (ICE/DTLS up, no decodable frame). So a remote adaptive session STARTS
+ * on the smallest tier; the broker's `AdaptiveController` upgrades from there
+ * once the link proves healthy. `lan` and `vpn` (Tailscale, direct overlay)
+ * keep the full-quality default and are never biased.
+ */
+const REMOTE_INITIAL_ADAPTIVE_TIER = 'low';
+/**
+ * Bias the INITIAL adaptive-tier selection for a genuinely-remote viewer by
+ * injecting a `prefersTier` hint the broker's `selectBestBroker` already
+ * honours. The hub is the only layer that knows the client's network class
+ * (the forked broker cannot see the HTTP request), so — exactly like
+ * `relayOnly` and the User-Agent — the class is read here and threaded down
+ * through the EXISTING `hints` cap field (no cap/schema change: `prefersTier`
+ * is already part of `webrtcClientHintsSchema`).
+ *
+ * Applied ONLY when:
+ *  - the client class is `remote` (lan/vpn keep the full-quality default), and
+ *  - the target is adaptive (`handleOffer` defaults an absent target to
+ *    adaptive; a pinned profile/cam-stream is the operator's explicit choice
+ *    and passes through untouched), and
+ *  - the caller did not already set `prefersTier` (no client does today, but
+ *    keep the trusted-injection rule symmetric with relayOnly/userAgent).
+ *
+ * Immutable — builds a NEW input (and a new `hints`), never mutates the
+ * caller's. On a downgrade re-offer the broker's controller-chosen tier intent
+ * overrides this hint, so a healthy remote session can still climb above `low`.
+ */
+function enrichHintsWithClientClass(input, clientClass) {
+    if (clientClass !== 'remote')
+        return input;
+    const isAdaptive = input.target === undefined || input.target.kind === 'adaptive';
+    if (!isAdaptive)
+        return input;
+    if (input.hints?.prefersTier !== undefined)
+        return input;
+    return {
+        ...input,
+        hints: { ...input.hints, prefersTier: REMOTE_INITIAL_ADAPTIVE_TIER },
+    };
+}
 /**
  * Per-request wrapper around the resolved `webrtc-session` broker singleton.
  *
@@ -125,8 +172,8 @@ function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
     const clientClass = (0, client_ip_js_1.classifyClientRequest)(ctx.req);
     return {
         ...provider,
-        createSession: (input) => provider.createSession(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass)),
-        handleOffer: (input) => provider.handleOffer(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass)),
+        createSession: (input) => provider.createSession(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
+        handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
     };
 }
 /**

package/dist/boot/post-boot.service.js

@@ -4,7 +4,6 @@ exports.PostBootService = void 0;
 const node_crypto_1 = require("node:crypto");
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
-const resume_framework_swap_js_1 = require("./resume-framework-swap.js");
 const reconcile_lifecycle_jobs_js_1 = require("./reconcile-lifecycle-jobs.js");
 class PostBootService {
     eventBus;
@@ -57,24 +56,12 @@ class PostBootService {
         // restart, …). `readPendingRestart` clears the marker atomically so
         // we never re-fire on a crash-loop boot.
         this.emitRestartCompletedIfPending(dataPath);
-        // If a framework swap was applied on the previous boot and left a
-        // `.framework-swap-confirm.json` marker, mark the journal job done and
-        // delete the marker + backups now that the hub is healthy.  This also
-        // disarms the crash-loop rollback (the NEXT boot won't roll back a
-        // healthy update).
-        await this.resumeFrameworkSwapIfPending(dataPath);
-        // Then re-drive every other non-terminal lifecycle job (addon task phases)
-        // from its on-disk checkpoint. Order matters: framework resume FIRST (marks
-        // the framework task `applied`→`done`), THEN addon reconcile (which leaves
-        // framework tasks untouched).
+        // Re-drive every non-terminal lifecycle job (addon task phases) from its
+        // on-disk checkpoint. Framework tasks are no longer applied by the engine
+        // (single-copy collapse — framework updates ship via applyServerUpdate);
+        // any stray framework task is skipped during reconcile.
         await this.reconcileLifecycleJobsIfAny();
     }
-    async resumeFrameworkSwapIfPending(dataDir) {
-        const result = await (0, resume_framework_swap_js_1.resumeFrameworkSwapJob)(dataDir);
-        if (result.resumed) {
-            this.logger.info('Framework update completed', { meta: { jobId: result.jobId } });
-        }
-    }
     async reconcileLifecycleJobsIfAny() {
         const { resumed, failed } = await (0, reconcile_lifecycle_jobs_js_1.reconcileLifecycleJobsAtBoot)();
         if (resumed + failed > 0) {

package/dist/boot/reconcile-lifecycle-jobs.js

@@ -8,12 +8,13 @@
  * resumes from its checkpoint (reusing a still-valid `stagedPath` or
  * re-fetching, then applying).
  *
- * Best-effort, mirrors `resume-framework-swap.ts`: this NEVER throws — any error
- * (runner not initialized, journal corruption, …) is swallowed and reported as
- * `{ resumed: 0, failed: 0 }` so the post-boot path can never crash the hub.
+ * Best-effort: this NEVER throws — any error (runner not initialized, journal
+ * corruption, …) is swallowed and reported as `{ resumed: 0, failed: 0 }` so the
+ * post-boot path can never crash the hub.
  *
- * Ordering note: the framework `applied`→`done` resume (`resumeFrameworkSwapJob`)
- * MUST run BEFORE this — reconcile deliberately leaves framework tasks untouched.
+ * Framework tasks are no longer applied by the engine (single-copy collapse —
+ * framework updates ship via `applyServerUpdate`); any stray non-terminal
+ * framework task is marked `skipped` during reconcile so the job can finalize.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.reconcileLifecycleJobsAtBoot = reconcileLifecycleJobsAtBoot;

package/dist/core/addon/addon-package.service.js

@@ -36,8 +36,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AddonPackageService = exports.FRAMEWORK_PACKAGES = exports.SYSTEM_PACKAGE = void 0;
 exports.isFrameworkPackage = isFrameworkPackage;
 exports.extractTgzStripped = extractTgzStripped;
-exports.sweepStaleFrameworkBackups = sweepStaleFrameworkBackups;
-exports.swapInFrameworkPackage = swapInFrameworkPackage;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
@@ -911,9 +909,9 @@ class AddonPackageService {
     /**
      * Download the npm tarball for `name@version` as a Buffer.
      *
-     * Wraps the module-level `httpsDownloadTarball` for use by the
-     * lifecycle job engine (TarballFetcher signature). The `signal` is
-     * forwarded to the underlying fetch calls so the AbortController
+     * Resolves the tarball URL from the registry packument, then fetches it,
+     * for use by the lifecycle job engine (TarballFetcher signature). The
+     * `signal` is forwarded to the underlying fetch calls so the AbortController
      * timeout wired in LifecycleJobEngine fires correctly.
      */
     async fetchAddonTarball(name, version, signal) {
@@ -1040,210 +1038,6 @@ class AddonPackageService {
         }));
         return rows;
     }
-    /**
-     * Update one of the framework packages (manifest `camstack.system:
-     * true`) and schedule a hub restart.
-     *
-     * Steps:
-     *   1. Allow-list the package name (refuses anything not framework).
-     *   2. Resolve `'latest'`/`undefined` to a concrete version via `npm view`.
-     *   3. Run `npm install --prefix <appRoot> <name>@<version> --no-save`.
-     *   4. Write a `.restart-pending` marker (kind: `framework-update`).
-     *   5. Emit `system.restarting` event.
-     *   6. `scheduleSelfRestart({ delayMs: 500 })` — gives the cap method
-     *      time to return before the WS drops.
-     *
-     * Returns BEFORE the exit fires so the admin UI receives `restartingAt`
-     * and can pivot to the reconnect overlay.
-     */
-    /**
-     * Install the framework by SWAPPING each package's own directory, exactly
-     * like every addon is installed (download the single-package tarball →
-     * extract → atomic dir swap). We NEVER run `npm install --prefix <appRoot>`.
-     *
-     * Why: `npm install --prefix /data` manages the WHOLE node_modules tree — it
-     * prunes every package not in @camstack/system's closure (the addons +
-     * ui-library), deletes the stray manifest.json, and (via temp-install + merge
-     * variants) can clobber working native bindings. A per-package tarball swap
-     * touches only that package's folder; nothing else can be pruned, deleted, or
-     * corrupted.
-     *
-     * Swaps the @camstack framework packages versioned in lockstep with system:
-     * the pure-JS libs (types, sdk) AND @camstack/shm-ring. shm-ring is native
-     * but SAFE to swap because it ships its compiled `.node` prebuilds INSIDE the
-     * npm tarball (prebuildify + node-gyp-build resolves the matching one at
-     * require-time) — a bare extract is sufficient, no build or download.
-     *
-     * It does NOT swap download/compile-on-install natives such as `better-sqlite3`
-     * (prebuild-install fetches the binary from GitHub releases at install time —
-     * a bare extract would leave it without a binding). Those are third-party,
-     * hoisted, change only across majors, and are updated by an image redeploy.
-     * System's own deps stay exactly where they are, bindings intact.
-     */
-    async installFrameworkPackages(packageName, toVersion, appRoot) {
-        const registry = process.env['CAMSTACK_NPM_REGISTRY'];
-        // @camstack/shm-ring is native but ships prebuilds in its tarball → safe.
-        const lockstepDeps = ['@camstack/types', '@camstack/sdk', '@camstack/shm-ring'];
-        const swapTargets = [packageName, ...lockstepDeps];
-        // Self-heal: a previous run killed mid-swap (e.g. process restart while a
-        // slow download was in flight) can leave a `<pkg>.fw-bak` backup behind.
-        // It's inert (not a valid package the loader picks up) but sweep it so the
-        // tree stays clean.
-        sweepStaleFrameworkBackups(appRoot);
-        const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-fw-'));
-        try {
-            for (const pkg of swapTargets) {
-                const isPrimary = pkg === packageName;
-                try {
-                    const tgzPath = await packTarball(pkg, toVersion, tmpRoot, registry);
-                    const extractDir = fs.mkdtempSync(path.join(tmpRoot, 'x-'));
-                    await execFileAsync('tar', ['-xzf', tgzPath, '-C', extractDir], { timeout: 60_000 });
-                    const result = swapInFrameworkPackage(path.join(extractDir, 'package'), appRoot);
-                    this.logger.info('updateFrameworkPackage: package swapped', {
-                        meta: { name: result.name, version: result.version },
-                    });
-                }
-                catch (err) {
-                    if (isPrimary)
-                        throw err;
-                    // A lockstep dep may not be published at this exact version (or the
-                    // download flaked) — keep the existing copy rather than fail the whole
-                    // framework update. System is the one that MUST succeed.
-                    this.logger.warn(`updateFrameworkPackage: lockstep dep ${pkg}@${toVersion} not swapped`, {
-                        meta: { error: (0, types_1.errMsg)(err) },
-                    });
-                }
-            }
-        }
-        finally {
-            fs.rmSync(tmpRoot, { recursive: true, force: true });
-        }
-    }
-    /**
-     * Resolve a version specifier (`'latest'`, semver tag, exact) for a
-     * framework package to a concrete version via `npm view`.
-     * Delegates to the module-level `resolveNpmVersion` helper.
-     * Exposed as a public method so the lifecycle job engine wiring in
-     * cap-providers can pass it as `resolveVersion` without duplicating the
-     * npm-view/manifest logic.
-     */
-    async resolveFrameworkVersion(packageName, versionSpec) {
-        return resolveNpmVersion(packageName, versionSpec, process.env['CAMSTACK_NPM_REGISTRY']);
-    }
-    /**
-     * Return the currently-installed version of a framework package, or `null`
-     * when it cannot be determined (not installed / no manifest).
-     * Delegates to the module-level `readResolvedPackageManifest` helper.
-     * Exposed as a public method for use by the lifecycle job engine wiring.
-     */
-    currentFrameworkVersionOf(packageName) {
-        const manifest = readResolvedPackageManifest(packageName);
-        if (manifest !== null && typeof manifest['version'] === 'string') {
-            return manifest['version'];
-        }
-        return null;
-    }
-    /**
-     * Update a framework package via the staged launcher-swap engine.
-     *
-     * New path (when `runner` is provided):
-     *   1. Resolve toVersion via `npm view`.
-     *   2. Delegate to `runner.startJob` with a `target:'framework'` task.
-     *      The engine calls `stageFramework` → downloads+stages the 4 lockstep
-     *      packages → calls the wired `requestFrameworkSwap`
-     *      (`requestFrameworkSwapAndRestart`), which writes the
-     *      `.pending-framework-swap.json` marker AND schedules the self-restart.
-     *      The hub exits; the launcher applies the swap on the next boot. The
-     *      restart is owned by that seam, so this method does NOT schedule one.
-     *   3. Return `{ packageName, fromVersion, toVersion, restartingAt }`.
-     *      `restartingAt = 0` only on the legacy in-hub path when `deferRestart`
-     *      is set (engine path always restarts once the framework is staged).
-     *
-     * Legacy path (when no `runner`): keeps the original in-hub live-swap for
-     * backward compatibility with callers (e.g. tests) that have not wired the
-     * engine deps.
-     */
-    async updateFrameworkPackage(input) {
-        const { packageName } = input;
-        if (packageName !== exports.SYSTEM_PACKAGE) {
-            throw new Error(`updateFrameworkPackage: '${packageName}' is not a framework package. Allowed: ${exports.SYSTEM_PACKAGE}`);
-        }
-        const fromVersion = this.currentFrameworkVersionOf(packageName) ?? 'unknown';
-        const requestedVersion = input.version ?? 'latest';
-        const toVersion = await this.resolveFrameworkVersion(packageName, requestedVersion);
-        // ── New staged-swap engine path ──────────────────────────────────
-        if (input.runner !== undefined) {
-            this.logger.info('updateFrameworkPackage: delegating to staged swap engine', {
-                meta: { packageName, fromVersion, toVersion, deferRestart: input.deferRestart ?? false },
-            });
-            await input.runner.startJob({
-                kind: 'update',
-                targets: [{ name: packageName, version: toVersion, target: 'framework' }],
-                createdBy: input.requestedBy ?? 'system',
-            });
-            // The engine's framework task already wrote the pending-swap marker AND
-            // scheduled the self-restart via the wired `requestFrameworkSwap`
-            // (`requestFrameworkSwapAndRestart`) — that is the single restart owner,
-            // so we must NOT schedule a second one here. We only surface the
-            // pre-restart toast event for the interactive single-update path.
-            if (input.deferRestart !== true) {
-                this.eventBusService.emit({
-                    id: (0, node_crypto_1.randomUUID)(),
-                    timestamp: new Date(),
-                    source: { type: 'core', id: 'addon-package-service' },
-                    category: types_1.EventCategory.SystemRestarting,
-                    data: {
-                        kind: 'framework-update',
-                        packageName,
-                        fromVersion,
-                        toVersion,
-                        requestedAt: Date.now(),
-                    },
-                });
-            }
-            const restartingAt = input.deferRestart === true ? 0 : Date.now() + 500;
-            return { packageName, fromVersion, toVersion, restartingAt };
-        }
-        // ── Legacy in-hub live-swap path (no runner injected) ───────────
-        const appRoot = resolveFrameworkPackageAppRoot(packageName, this.logger);
-        this.logger.info('updateFrameworkPackage: installing (legacy in-hub path)', {
-            meta: { packageName, fromVersion, toVersion, appRoot },
-        });
-        await this.installFrameworkPackages(packageName, toVersion, appRoot);
-        if (input.deferRestart === true) {
-            this.logger.info(`updateFrameworkPackage(${packageName}@${toVersion}): install done, restart deferred`);
-            // Sentinel: 0 signals "no restart scheduled" to the caller
-            return { packageName, fromVersion, toVersion, restartingAt: 0 };
-        }
-        const restartingAt = Date.now();
-        const markerPayload = {
-            kind: 'framework-update',
-            packageName,
-            fromVersion,
-            toVersion,
-            requestedAt: restartingAt,
-            ...(input.requestedBy !== undefined ? { requestedBy: input.requestedBy } : {}),
-        };
-        try {
-            (0, system_1.writePendingRestart)(this.resolveDataDir(), markerPayload);
-        }
-        catch (err) {
-            // The npm install already completed — the restart will still
-            // pick up the new version, just without the completion toast.
-            this.logger.warn('Failed to write restart marker after framework update', {
-                meta: { error: (0, types_1.errMsg)(err) },
-            });
-        }
-        this.eventBusService.emit({
-            id: (0, node_crypto_1.randomUUID)(),
-            timestamp: new Date(),
-            source: { type: 'core', id: 'addon-package-service' },
-            category: types_1.EventCategory.SystemRestarting,
-            data: markerPayload,
-        });
-        (0, system_1.scheduleSelfRestart)({ delayMs: 500 });
-        return { packageName, fromVersion, toVersion, restartingAt };
-    }
     // =========================================================================
     // Reload
     // =========================================================================
@@ -1333,10 +1127,12 @@ class AddonPackageService {
     }
     /**
      * Run auto-update: check each installed package against its configured
-     * channel, then route ALL packages that have a newer version through ONE
-     * durable engine bulk job (F3 Task 5). The framework (`@camstack/system`) is
-     * auto-detected by the engine and ordered LAST; auto-updates survive a reboot
-     * via the boot reconcile, exactly like a manual "Update all".
+     * channel, then route ALL addon packages that have a newer version through ONE
+     * durable engine bulk job (F3 Task 5); auto-updates survive a reboot via the
+     * boot reconcile, exactly like a manual "Update all". The framework
+     * (`@camstack/system`) is NOT applied by the engine — it ships via
+     * `applyServerUpdate` (single-copy collapse), so a swept framework target is
+     * skipped by the engine.
      *
      * Candidate selection (channel resolution + npm metadata fetch + "is there a
      * newer version?" comparison) is unchanged from the previous per-item loop;
@@ -1394,9 +1190,10 @@ class AddonPackageService {
         // Execute as ONE durable engine bulk job. The runner singleton is resolved
         // lazily via a dynamic import (the singleton module transitively imports
         // SYSTEM_PACKAGE back from this module) to avoid an init-order cycle. The
-        // singleton is initialized at boot, before the scheduler timer fires. The
-        // framework target, if present, is ordered last by the engine. Wrap so a
-        // failure is logged, not thrown out of the timer callback.
+        // singleton is initialized at boot, before the scheduler timer fires. A
+        // framework target, if present, is skipped by the engine (framework updates
+        // ship via applyServerUpdate). Wrap so a failure is logged, not thrown out
+        // of the timer callback.
         try {
             const { getLifecycleRunner } = await Promise.resolve().then(() => __importStar(require('../lifecycle/lifecycle-runner.singleton.js')));
             const runner = getLifecycleRunner();
@@ -1754,7 +1551,7 @@ async function extractTgzStripped(tgz, destDir) {
     }
 }
 // ---------------------------------------------------------------------------
-// Framework live-update helpers
+// npm tarball / version helpers
 // ---------------------------------------------------------------------------
 /**
  * Build the npm CLI args that pin every relevant registry to
@@ -1763,179 +1560,16 @@ async function extractTgzStripped(tgz, destDir) {
  * user-home `.npmrc` files commonly declare
  * `@camstack:registry=https://registry.npmjs.org/`, and that scoped
  * entry takes precedence over the plain `--registry` CLI flag for
- * `@camstack/*` lookups — which is exactly the path framework-update
- * traverses.
+ * `@camstack/*` lookups.
  *
- * Without this, the e2e suite's verdaccio gets bypassed even with
- * `CAMSTACK_NPM_REGISTRY` set, AND in production any operator running
- * their own private npm proxy via `@camstack:registry` would have
- * `updateFrameworkPackage` silently route around it.
+ * Without this, an operator running their own private npm proxy via
+ * `@camstack:registry` would have package downloads silently route around it.
  */
 function buildNpmRegistryArgs(registry) {
     if (registry === undefined || registry.length === 0)
         return [];
     return ['--registry', registry, `--@camstack:registry=${registry}`];
 }
-/**
- * Remove any leftover `<pkg>.fw-bak` backup dirs under `appRoot/node_modules/
- * @camstack` — debris from a framework swap that was interrupted before its
- * own cleanup ran. Best-effort; returns the swept names.
- */
-function sweepStaleFrameworkBackups(appRoot) {
-    const scopeDir = path.join(appRoot, 'node_modules', '@camstack');
-    if (!fs.existsSync(scopeDir))
-        return [];
-    const swept = [];
-    for (const entry of fs.readdirSync(scopeDir, { withFileTypes: true })) {
-        if (!entry.isDirectory() || !entry.name.endsWith('.fw-bak'))
-            continue;
-        try {
-            fs.rmSync(path.join(scopeDir, entry.name), { recursive: true, force: true });
-            swept.push(entry.name);
-        }
-        catch {
-            // ignore — inert leftover, next sweep retries
-        }
-    }
-    return swept;
-}
-/**
- * Download the `.tgz` for an EXACT `pkg@version` into `destRoot`, returning its
- * path. Prefers a direct HTTPS GET (registry metadata → tarball URL) because
- * `fetch` + `AbortSignal.timeout` aborts RELIABLY on a slow/flaky network — an
- * `npm pack` child can stall for minutes past its `execFile` timeout (npm holds
- * its stdio pipes open, so the awaited promise never settles), which would wedge
- * the whole framework update. Falls back to `npm pack` (SIGKILL on timeout) only
- * when the HTTPS path fails (private registry quirks, auth, etc.).
- */
-async function packTarball(pkg, version, destRoot, registry) {
-    const dir = fs.mkdtempSync(path.join(destRoot, 'dl-'));
-    try {
-        return await httpsDownloadTarball(pkg, version, dir, registry);
-    }
-    catch (httpErr) {
-        const args = [
-            'pack',
-            `${pkg}@${version}`,
-            '--pack-destination',
-            dir,
-            ...buildNpmRegistryArgs(registry),
-        ];
-        // SIGKILL (not the default SIGTERM): npm can ignore SIGTERM while a
-        // grandchild holds the pipes — SIGKILL guarantees the timeout fires.
-        await execFileAsync('npm', args, { timeout: 60_000, killSignal: 'SIGKILL' });
-        const tgz = fs.readdirSync(dir).find((f) => f.endsWith('.tgz'));
-        if (tgz === undefined) {
-            throw new Error(`download failed for ${pkg}@${version}: ${(0, types_1.errMsg)(httpErr)}`, {
-                cause: httpErr,
-            });
-        }
-        return path.join(dir, tgz);
-    }
-}
-/**
- * Direct HTTPS download of an exact `pkg@version` tarball. Resolves the tarball
- * URL from the registry packument, then streams it to a file. Every network
- * call is bounded by an `AbortSignal.timeout` so a DNS/registry stall fails fast
- * instead of hanging the framework update.
- */
-async function httpsDownloadTarball(pkg, version, dir, registry) {
-    const reg = (registry ?? 'https://registry.npmjs.org').replace(/\/+$/, '');
-    const metaUrl = `${reg}/${encodeURIComponent(pkg).replace(/^%40/, '@')}`;
-    const metaRes = await fetch(metaUrl, { signal: AbortSignal.timeout(20_000) });
-    if (!metaRes.ok)
-        throw new Error(`registry GET ${metaUrl} → ${metaRes.status}`);
-    const meta = (await metaRes.json());
-    const tarballUrl = meta.versions?.[version]?.dist?.tarball;
-    if (typeof tarballUrl !== 'string') {
-        throw new Error(`no tarball url for ${pkg}@${version}`);
-    }
-    const tarRes = await fetch(tarballUrl, { signal: AbortSignal.timeout(120_000) });
-    if (!tarRes.ok)
-        throw new Error(`tarball GET ${tarballUrl} → ${tarRes.status}`);
-    const buf = Buffer.from(await tarRes.arrayBuffer());
-    const outPath = path.join(dir, `${pkg.replace('@', '').replace('/', '-')}-${version}.tgz`);
-    fs.writeFileSync(outPath, buf);
-    return outPath;
-}
-/**
- * Atomically replace one `@camstack/*` package directory in
- * `appRoot/node_modules` with the contents of an extracted npm package dir
- * (`stagedPackageDir` = the `package/` folder from a `.tgz`).
- *
- * This is the framework-update primitive: it touches ONLY the target package's
- * folder. The current copy is renamed to a sibling `.fw-bak` backup first and
- * restored if the copy fails, so a crash mid-swap can't leave a half-written
- * package. Refuses anything outside the `@camstack/` scope as a safety guard.
- * Returns the installed package name + version.
- */
-function swapInFrameworkPackage(stagedPackageDir, appRoot) {
-    const pkgJsonPath = path.join(stagedPackageDir, 'package.json');
-    if (!fs.existsSync(pkgJsonPath)) {
-        throw new Error(`swapInFrameworkPackage: no package.json in ${stagedPackageDir}`);
-    }
-    const parsed = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
-    const pkg = parsed;
-    if (typeof pkg.name !== 'string' || typeof pkg.version !== 'string') {
-        throw new Error(`swapInFrameworkPackage: invalid package.json in ${stagedPackageDir}`);
-    }
-    if (!pkg.name.startsWith('@camstack/')) {
-        throw new Error(`swapInFrameworkPackage: refusing non-@camstack package ${pkg.name}`);
-    }
-    const targetDir = path.join(appRoot, 'node_modules', pkg.name);
-    const backupDir = `${targetDir}.fw-bak`;
-    fs.rmSync(backupDir, { recursive: true, force: true });
-    const hadExisting = fs.existsSync(targetDir);
-    if (hadExisting)
-        fs.renameSync(targetDir, backupDir);
-    try {
-        fs.mkdirSync(path.dirname(targetDir), { recursive: true });
-        fs.cpSync(stagedPackageDir, targetDir, { recursive: true });
-    }
-    catch (err) {
-        // Roll back to the previous copy so a failed swap never leaves the
-        // package missing or half-written.
-        fs.rmSync(targetDir, { recursive: true, force: true });
-        if (hadExisting)
-            fs.renameSync(backupDir, targetDir);
-        throw err;
-    }
-    fs.rmSync(backupDir, { recursive: true, force: true });
-    return { name: pkg.name, version: pkg.version };
-}
-/**
- * Resolve the directory whose `node_modules/<pkg>/` holds the currently-
- * installed copy of a framework package. `npm install --prefix <appRoot>`
- * will then update that exact copy in place.
- *
- * Strategy: ask Node's resolver where it finds the package today, then walk
- * up to the `node_modules/`-parent. This matches whatever resolution path
- * the running hub actually uses (server-local node_modules in prod;
- * workspace-root in dev; bundled in Electron) without hard-coding either.
- *
- * Test knob: `CAMSTACK_FRAMEWORK_APP_ROOT_OVERRIDE` short-circuits the walk
- * and returns the env-supplied path. Used by the e2e suite to redirect the
- * `npm install --prefix` side-effects into an isolated temp dir instead of
- * the workspace's `server/backend/node_modules/`. Never set in production.
- */
-function resolveFrameworkPackageAppRoot(packageName, logger) {
-    const override = process.env['CAMSTACK_FRAMEWORK_APP_ROOT_OVERRIDE'];
-    if (override !== undefined && override.length > 0) {
-        return override;
-    }
-    const resolved = require.resolve(`${packageName}/package.json`);
-    // …/<appRoot>/node_modules/<scope>/<name>/package.json
-    // walk up: package.json → name → scope → node_modules → appRoot
-    let dir = path.dirname(resolved);
-    while (dir !== path.dirname(dir)) {
-        if (path.basename(dir) === 'node_modules') {
-            return path.dirname(dir);
-        }
-        dir = path.dirname(dir);
-    }
-    logger.warn(`Could not resolve appRoot for ${packageName}; falling back to process.cwd()`);
-    return process.cwd();
-}
 /**
  * Read a framework package's `package.json`, resolved however the
  * running hub actually loads it — workspace symlink in dev, a real
@@ -1946,11 +1580,6 @@ function resolveFrameworkPackageAppRoot(packageName, logger) {
  * `@camstack/sdk`, `@camstack/ui-library`) make that throw — so we
  * fall back to resolving the package's main entry and walking up to
  * the first `package.json` whose `name` matches.
- *
- * This is deliberately independent of `resolveFrameworkPackageAppRoot`:
- * that walk only finds a real `node_modules`-parent, which doesn't
- * exist for workspace-symlinked packages in dev — the cause of the
- * `vunknown` version label in the System Packages UI.
  */
 function readResolvedPackageManifest(packageName) {
     try {