@camstack/server 1.2.139 → 1.2.141

package/dist/core/moleculer/moleculer.service.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MoleculerService = void 0;
+exports.childOwnerToken = childOwnerToken;
 exports.buildChildUdsManifest = buildChildUdsManifest;
 const node_crypto_1 = require("node:crypto");
 const system_1 = require("@camstack/system");
@@ -27,6 +28,21 @@ class MoleculerService {
      * `$hub.registerNode`. Populated by `onRegisterNode` in `hubDeps`.
      */
     nodeRegistry = new system_1.HubNodeRegistry();
+    /**
+     * nodeId → the owner token of the INCARNATION whose manifest currently backs
+     * that node's capability registrations.
+     *
+     * A node id is not unique over time: `resolveRunnerId` is deterministic, so a
+     * runner replaced by an addon update reconnects as the same `hub/<runner>`
+     * node. Without an incarnation the predecessor's teardown and the successor's
+     * registration are the same `(cap, addonId)` key, and the teardown wins by
+     * arriving last — `recording`, `storage-evictable` and `recording-export`
+     * were unregistered from a healthy process for 7 hours on 2026-08-20.
+     * Populated only for transports that can observe an incarnation (UDS
+     * children); remote nodes stay ownerless and behave exactly as before.
+     * See `docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md`.
+     */
+    nodeOwners = new Map();
     /**
      * Fixed-period agent-readiness snapshot sweep (D8 reconcile) — repairs
      * agent-origin readiness deltas lost while the agent stayed connected.
@@ -405,16 +421,23 @@ class MoleculerService {
                 const hubNodeId = this.brokerSafe.nodeID;
                 const childNodeId = `${hubNodeId}/${child.childId}`;
                 const params = buildChildUdsManifest(childNodeId, child.childId, child.caps);
-                this.onRegisterNode(params);
-                logger.info('UDS child registered — manifest applied', { meta: { nodeId: childNodeId } });
+                // The UDS connection is the only thing that can tell two generations of
+                // the same runner apart — carry its incarnation into the registry as
+                // the owner of every registration this manifest makes.
+                this.onRegisterNode(params, childOwnerToken(childNodeId, child.incarnation));
+                logger.info('UDS child registered — manifest applied', {
+                    meta: { nodeId: childNodeId, incarnation: child.incarnation },
+                });
             });
             // E1: cleanup on child disconnect — same effect as `$node.disconnected`
             // for hub-local children. The Moleculer path stays for AGENT nodes.
-            registry.onChildGone((childId) => {
+            registry.onChildGone((childId, incarnation) => {
                 const hubNodeId = this.brokerSafe.nodeID;
                 const childNodeId = `${hubNodeId}/${childId}`;
-                logger.info('UDS child gone — removing from registry', { meta: { childId } });
-                this.removeNodeFromRegistry(childNodeId);
+                logger.info('UDS child gone — removing from registry', {
+                    meta: { childId, incarnation },
+                });
+                this.removeNodeFromRegistry(childNodeId, childOwnerToken(childNodeId, incarnation));
             });
             // B2: ingest UDS child logs into the hub's LoggingService so they appear
             // in the LogManager / admin-UI log stream alongside broker-forwarded logs.
@@ -449,6 +472,10 @@ class MoleculerService {
         // sent a $hub.registerNode manifest get cleaned up on disconnect.
         const bridgeBus = this.broker;
         bridgeBus.localBus.on('$node.disconnected', ({ node }) => {
+            // No owner token: this listener cannot observe WHICH incarnation died.
+            // For a hub-local child the UDS `onChildGone` is the authority (it holds
+            // the incarnation) and this call is refused if the id has been reclaimed;
+            // remote nodes register no owner at all, so they clean up as before.
             this.removeNodeFromRegistry(node.id);
         });
         // D8 reverse-leg snapshot-reconcile: on every agent (re)connect, pull
@@ -682,10 +709,15 @@ class MoleculerService {
      * CapabilityRegistry update is a diff (atomic replace) rather than an
      * unconditional re-register — see `applyNodeManifest` for the rationale.
      */
-    onRegisterNode(params) {
+    onRegisterNode(params, owner) {
         const previousManifest = this.nodeRegistry.getNodeManifest(params.nodeId);
+        const previousOwner = this.nodeOwners.get(params.nodeId);
         this.nodeRegistry.registerNode(params);
-        this.applyNodeManifest(params, previousManifest);
+        if (owner === undefined)
+            this.nodeOwners.delete(params.nodeId);
+        else
+            this.nodeOwners.set(params.nodeId, owner);
+        this.applyNodeManifest(params, previousManifest, owner, previousOwner);
         // Notify AgentRegistryService to reconcile placement for bare-ID
         // agent nodes (no '/' = not a hub child worker, not the hub itself).
         // The handshake is the authoritative completeness signal — the full
@@ -717,7 +749,7 @@ class MoleculerService {
      * already; this method handles only `params.addons` (system caps).
      * Native-cap wiring into device-manager is done in a later task.
      */
-    applyNodeManifest(params, previousManifest) {
+    applyNodeManifest(params, previousManifest, owner, previousOwner) {
         const { nodeId, addons } = params;
         const hubNodeId = this.brokerSafe.nodeID;
         const isLocalChild = nodeId.startsWith(hubNodeId + '/');
@@ -763,9 +795,23 @@ class MoleculerService {
         for (const [key, { addonId, capName }] of previous) {
             if (desired.has(key))
                 continue;
-            registry.unregisterProvider(capName, registryKeyFor(addonId));
+            // Present the token the DROPPED registration was made under — this node
+            // is dropping its own cap, and the registry refuses anything else.
+            registry.unregisterProvider(capName, registryKeyFor(addonId), previousOwner);
             this.nodeCallFns.delete(`${nodeId}::${capName}`);
         }
+        // ── TAKE OVER ── caps present in BOTH manifests when the node id has been
+        // reclaimed by a NEW incarnation. The registration is correct and stays
+        // (zero churn), but it is still stamped with the dead generation's token —
+        // leave it there and nothing the live generation can present would ever
+        // clean it up when IT dies. Re-stamp instead.
+        if (owner !== undefined && previousOwner !== undefined && owner !== previousOwner) {
+            for (const [key, { addonId, capName }] of desired) {
+                if (!previous.has(key))
+                    continue;
+                registry.reassignProviderOwner(capName, registryKeyFor(addonId), owner);
+            }
+        }
         // ── REGISTER ── caps the new manifest applies that the previous one
         // did not. Caps present in BOTH sets are left untouched — zero churn,
         // no duplicate `registerProvider`, no spurious page/widget re-emit.
@@ -810,7 +856,7 @@ class MoleculerService {
             for (const methodName of Object.keys((0, system_1.expandCapMethods)(capDef))) {
                 proxy[methodName] = (methodParams) => callFn(methodName, methodParams);
             }
-            registry.registerProvider(capName, registryKey, proxy);
+            registry.registerProvider(capName, registryKey, proxy, owner);
             // Local-first singleton preference (UDS regression fix). A
             // `placement: 'any-node'` singleton (e.g. `pipeline-executor`) can
             // register on BOTH the hub-local forked child and a remote agent.
@@ -857,7 +903,17 @@ class MoleculerService {
      * Unregisters every cap the node's last manifest declared and emits
      * synthetic readiness-down events for each.
      */
-    removeNodeFromRegistry(nodeId) {
+    removeNodeFromRegistry(nodeId, owner) {
+        const currentOwner = this.nodeOwners.get(nodeId);
+        if (currentOwner !== undefined && currentOwner !== owner) {
+            // The node id has been reclaimed by a newer incarnation since this
+            // teardown was scheduled. Tearing down here would unregister the LIVE
+            // process's capabilities and remove a node that is still connected.
+            this.logger.info('Node teardown ignored — node id reclaimed by a newer incarnation', {
+                meta: { nodeId, currentOwner, presentedOwner: owner ?? null },
+            });
+            return;
+        }
         const manifest = this.nodeRegistry.getNodeManifest(nodeId);
         if (!manifest)
             return; // node never sent a handshake — nothing to do
@@ -871,7 +927,7 @@ class MoleculerService {
             const registryKey = isLocalChild ? addonId : `${addonId}@${nodeId}`;
             if (registry) {
                 for (const capName of capabilities) {
-                    registry.unregisterProvider(capName, registryKey);
+                    registry.unregisterProvider(capName, registryKey, owner);
                 }
             }
             for (const capName of capabilities) {
@@ -893,6 +949,7 @@ class MoleculerService {
                 }
             }
         }
+        this.nodeOwners.delete(nodeId);
         this.nodeRegistry.removeNode(nodeId);
     }
     findCallFn(nodeId, capabilityName) {
@@ -1083,6 +1140,18 @@ exports.MoleculerService = MoleculerService;
 // ---------------------------------------------------------------------------
 // Module-level helpers
 // ---------------------------------------------------------------------------
+/**
+ * The owner token a hub-local UDS child's capability registrations carry.
+ *
+ * `nodeId` alone is NOT an identity over time — a runner replaced by an addon
+ * update reconnects under the same deterministic `hub/<runner>` id — so the
+ * connection's incarnation is what makes the pair unique. Exported for the
+ * regression suite: the rule is only worth anything if register and unregister
+ * derive the token the SAME way.
+ */
+function childOwnerToken(childNodeId, incarnation) {
+    return `${childNodeId}#${incarnation}`;
+}
 /**
  * E1: Adapt a child's UDS `ChildCapDescriptor[]` into a `RegisterNodeParams`
  * that `onRegisterNode` / `applyNodeManifest` can consume.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.139",
+  "version": "1.2.141",
   "private": false,
   "files": [
     "dist",
@@ -38,12 +38,12 @@
     "@camstack/addon-auth": "1.2.26",
     "@camstack/addon-decoder-nodeav": "1.2.22",
     "@camstack/addon-notifiers": "1.2.27",
-    "@camstack/addon-pipeline": "1.2.102",
-    "@camstack/addon-pipeline-orchestrator": "1.2.84",
-    "@camstack/addon-post-analysis": "1.2.102",
+    "@camstack/addon-pipeline": "1.2.103",
+    "@camstack/addon-pipeline-orchestrator": "1.2.86",
+    "@camstack/addon-post-analysis": "1.2.104",
     "@camstack/sdk": "1.2.25",
-    "@camstack/system": "1.2.110",
-    "@camstack/types": "1.2.92",
+    "@camstack/system": "1.2.112",
+    "@camstack/types": "1.2.93",
     "@camstack/ui-library": "1.2.63",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",