@camstack/server 1.2.477 → 1.2.478

package/dist/agent/agent-service.js

@@ -42,6 +42,7 @@ const path = __importStar(require("node:path"));
 const system_1 = require("@camstack/system");
 const moleculer_1 = require("moleculer");
 const agent_deploy_swap_js_1 = require("./agent-deploy-swap.js");
+const agent_undeploy_js_1 = require("./agent-undeploy.js");
 const apply_model_distribution_js_1 = require("./apply-model-distribution.js");
 const fetch_bundle_from_hub_js_1 = require("./fetch-bundle-from-hub.js");
 /**
@@ -57,6 +58,14 @@ const deploySwapLogger = {
     child: () => deploySwapLogger,
     withTags: () => deploySwapLogger,
 };
+/**
+ * Packages an agent bootstraps itself when the bootstrap does not say
+ * otherwise. Mirrors the hub reconcile's `AGENT_BOOTSTRAP_PACKAGES`.
+ */
+const DEFAULT_AGENT_BOOTSTRAP_PACKAGES = new Set([
+    '@camstack/system',
+    '@camstack/addon-agent-ui',
+]);
 /** Timeout for the agent-local `$process.restart` delegation. */
 const AGENT_PROCESS_RESTART_TIMEOUT_MS = 30_000;
 function getLocalIps() {
@@ -455,81 +464,28 @@ function createAgentService(deps) {
                 },
             },
             /**
-             * Genuinely drop a deployed addon from this agent.
-             *
-             * A plain `loadedAddons.delete()` only forgets the bookkeeping entry —
-             * the addon instance keeps running and, crucially, its Moleculer
-             * service keeps advertising the addon's capabilities into the cluster
-             * (the hub still sees the provider as a live `<cap>@<agent>` entry).
-             * To truly undeploy we must, in order:
-             *   1. `shutdown()` the running instance (releases timers, sockets,
-             *      native handles) — same hook the agent's SIGTERM path uses.
-             *   2. `broker.destroyService(addonId)` — the deployed-addon Moleculer
-             *      service is named after the addon DECLARATION id (see
-             *      `createAddonService` → `name: declaration.id`). Destroying it
-             *      unregisters every capability action so the cluster stops
-             *      routing to / advertising this agent's provider.
-             *   3. Drop the `loadedAddons` entry and delete the on-disk folder.
-             *
-             * `addonId` here is the addon DECLARATION id — the same key
-             * `loadedAddons` uses and the same value `$agent.status` reports, so
-             * the hub reconciler can match it directly.
+             * Genuinely drop a deployed addon — or a whole package — from this agent.
+             * `{ packageName }` is the operator's uninstall (`addons.uninstallPackage
+             * ({ nodeId })`); `{ addonId }` is the stale-addon reconcile. Both stop the
+             * runner(s) hosting the addon, which the old body never did: on an agent
+             * nearly every addon lives in a group runner, so deleting its folder left
+             * the process running and advertising its caps. See `agent-undeploy.ts`.
              */
             undeploy: {
                 handler: async (ctx) => {
                     const { params, broker } = ctx;
-                    const { addonId } = params;
-                    const entry = deps.loadedAddons.get(addonId);
-                    // 1. Shut the running instance down (best-effort — a throwing
-                    //    disposer must not block the rest of the teardown).
-                    if (entry?.addon?.shutdown) {
-                        try {
-                            await entry.addon.shutdown();
-                        }
-                        catch (err) {
-                            broker.logger.warn(`$agent.undeploy: ${addonId} shutdown() threw`, {
-                                error: String(err),
-                            });
-                        }
-                    }
-                    // 2. Destroy the Moleculer service so the cluster stops seeing
-                    //    this agent's capability providers for the addon.
-                    try {
-                        await broker.destroyService(addonId);
-                    }
-                    catch {
-                        // Service may not exist (group-spawned addons have no per-addon
-                        // service on the agent broker, or it was never created).
-                    }
-                    // 3. Forget the entry and remove the deployed folder. The deploy
-                    //    handler keys the on-disk dir by the PACKAGE name, but $agent
-                    //    redeploys for a single addon use addonId === packageName for
-                    //    unscoped packages; remove whichever folder matches.
-                    deps.loadedAddons.delete(addonId);
-                    const addonDir = path.join(deps.addonsDir, addonId);
-                    if (fs.existsSync(addonDir)) {
-                        fs.rmSync(addonDir, { recursive: true, force: true });
-                    }
-                    // Defense-in-depth: one package dir can host MANY addons (e.g.
-                    // `@camstack/addon-pipeline` ships decoder-ffmpeg, recorder,
-                    // motion-wasm, …). Removing the whole bundle because ONE member was
-                    // undeployed is destructive — every sibling runner would crash-loop
-                    // on the missing package.json. Only remove the package dir when no
-                    // OTHER loaded addon still lives in it (this addon's own entry was
-                    // already deleted from `loadedAddons` above, so the remaining
-                    // values are exactly the siblings).
-                    const pkgName = entry?.packageName;
-                    if (pkgName && pkgName !== addonId) {
-                        const pkgShared = [...deps.loadedAddons.values()].some((e) => e.packageName === pkgName);
-                        if (!pkgShared) {
-                            const pkgDir = path.join(deps.addonsDir, pkgName);
-                            if (fs.existsSync(pkgDir)) {
-                                fs.rmSync(pkgDir, { recursive: true, force: true });
-                            }
-                        }
-                    }
-                    broker.logger.info(`$agent.undeploy: ${addonId} disposed (instance + service + folder)`);
-                    return { success: true, addonId };
+                    return (0, agent_undeploy_js_1.undeployFromAgent)({
+                        addonsDir: deps.addonsDir,
+                        loadedAddons: deps.loadedAddons,
+                        bootstrapPackages: deps.bootstrapPackages ?? DEFAULT_AGENT_BOOTSTRAP_PACKAGES,
+                        listRunnersByAddon: (addonId) => broker.call('$process.listByAddon', { addonId }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
+                        stopRunner: (name) => broker.call('$process.stop', { name }, { nodeID: broker.nodeID, timeout: AGENT_PROCESS_RESTART_TIMEOUT_MS }),
+                        destroyService: (addonId) => broker.destroyService(addonId),
+                        unregisterProvider: (capName, addonId) => deps.unregisterProvider?.(capName, addonId),
+                        respawnSurvivors: deps.reloadDeployedAddons,
+                        reconcileNodeRegistration: deps.reconcileNodeRegistration,
+                        logger: deploySwapLogger,
+                    }, { addonId: params.addonId, packageName: params.packageName });
                 },
             },
             /**

package/dist/agent/agent-undeploy.js

@@ -0,0 +1,255 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.undeployFromAgent = undeployFromAgent;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const agent_group_runner_js_1 = require("./agent-group-runner.js");
+function capName(cap) {
+    return typeof cap === 'string' ? cap : cap.name;
+}
+function packageDirFor(addonsDir, packageName) {
+    const resolved = path.resolve(addonsDir, packageName);
+    const root = path.resolve(addonsDir);
+    // A package name is data from the network. It must name a dir INSIDE the
+    // addon root and never the root itself.
+    if (resolved === root || !resolved.startsWith(root + path.sep))
+        return null;
+    return resolved;
+}
+function resolveTarget(seam, request) {
+    const packageName = request.packageName ??
+        (request.addonId !== undefined
+            ? seam.loadedAddons.get(request.addonId)?.packageName
+            : undefined);
+    const packageDir = packageName !== undefined ? packageDirFor(seam.addonsDir, packageName) : null;
+    const manifest = packageDir !== null ? (0, agent_group_runner_js_1.readPackageManifestAddons)(packageDir) : null;
+    const capsByAddon = new Map();
+    let protectedBy = null;
+    for (const decl of manifest?.declarations ?? []) {
+        capsByAddon.set(decl.id, (decl.capabilities ?? []).map(capName));
+        if (decl.protected === true)
+            protectedBy = decl.id;
+    }
+    if (request.packageName === undefined) {
+        return {
+            packageName,
+            addonIds: request.addonId !== undefined ? [request.addonId] : [],
+            capsByAddon,
+            packageDir,
+            protectedBy,
+        };
+    }
+    const ids = new Set(capsByAddon.keys());
+    for (const entry of seam.loadedAddons.values()) {
+        if (entry.packageName === request.packageName)
+            ids.add(entry.id);
+    }
+    return { packageName, addonIds: [...ids], capsByAddon, packageDir, protectedBy };
+}
+function refusalReason(seam, target) {
+    if (target.packageName !== undefined && seam.bootstrapPackages.has(target.packageName)) {
+        return `${target.packageName} is this node's bootstrap infrastructure and cannot be uninstalled`;
+    }
+    if (target.protectedBy !== null) {
+        return `${target.packageName ?? 'package'} is protected (addon "${target.protectedBy}" declares protected: true)`;
+    }
+    if (target.packageName === undefined && target.addonIds.length === 0) {
+        return 'neither addonId nor packageName was given';
+    }
+    return null;
+}
+async function shutdownInProcess(seam, addonId) {
+    const entry = seam.loadedAddons.get(addonId);
+    if (entry?.addon?.shutdown) {
+        try {
+            await entry.addon.shutdown();
+        }
+        catch (err) {
+            seam.logger.warn(`undeploy: ${addonId} shutdown() threw`, {
+                tags: { addonId },
+                meta: { error: err instanceof Error ? err.message : String(err) },
+            });
+        }
+    }
+    try {
+        await seam.destroyService(addonId);
+    }
+    catch {
+        // Group-runner addons have no per-addon service on the agent broker.
+    }
+}
+async function stopHostingRunners(seam, addonIds) {
+    const removing = new Set(addonIds);
+    const runners = new Map();
+    const warnings = [];
+    for (const id of addonIds) {
+        try {
+            for (const row of await seam.listRunnersByAddon(id))
+                runners.set(row.name, row);
+        }
+        catch (err) {
+            warnings.push(`could not list runners for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const stopped = [];
+    const survivors = [];
+    for (const runner of runners.values()) {
+        const result = await seam.stopRunner(runner.name).catch((err) => ({
+            success: false,
+            reason: err instanceof Error ? err.message : String(err),
+        }));
+        if (!result.success) {
+            warnings.push(`runner "${runner.name}" did not stop: ${result.reason ?? 'unknown'}`);
+            continue;
+        }
+        stopped.push(runner.name);
+        for (const id of runner.addonIds) {
+            if (!removing.has(id))
+                survivors.push(id);
+        }
+    }
+    return { stopped, survivors, warnings };
+}
+function removeDirs(seam, request, target) {
+    const removed = [];
+    const rm = (dir) => {
+        if (dir === null || !fs.existsSync(dir))
+            return;
+        fs.rmSync(dir, { recursive: true, force: true });
+        removed.push(dir);
+    };
+    if (request.packageName !== undefined) {
+        rm(target.packageDir);
+        return removed;
+    }
+    // Addon mode — the reconcile's per-id removal. One package dir can host MANY
+    // addons; only remove it when no OTHER loaded addon still lives in it (this
+    // addon's own row is already gone from `loadedAddons`).
+    const addonId = request.addonId;
+    if (addonId !== undefined)
+        rm(packageDirFor(seam.addonsDir, addonId));
+    const pkg = target.packageName;
+    if (pkg !== undefined && pkg !== addonId) {
+        const shared = [...seam.loadedAddons.values()].some((e) => e.packageName === pkg);
+        if (!shared)
+            rm(target.packageDir);
+    }
+    return removed;
+}
+/** Run one `$agent.undeploy`. Never throws for a refusal — it answers `refused`. */
+async function undeployFromAgent(seam, request) {
+    const target = resolveTarget(seam, request);
+    const scope = request.packageName !== undefined ? 'package' : 'addon';
+    const base = {
+        scope,
+        addonId: request.addonId,
+        packageName: target.packageName,
+        addonIds: target.addonIds,
+    };
+    const refused = refusalReason(seam, target);
+    if (refused !== null) {
+        seam.logger.warn(`undeploy refused: ${refused}`, { meta: { request } });
+        return {
+            ...base,
+            success: false,
+            outcome: 'refused',
+            reason: refused,
+            runnersStopped: [],
+            runnersRespawned: [],
+            removedDirs: [],
+            warnings: [],
+        };
+    }
+    const present = target.addonIds.some((id) => seam.loadedAddons.has(id)) ||
+        (target.packageDir !== null && fs.existsSync(target.packageDir));
+    if (scope === 'package' && !present) {
+        return {
+            ...base,
+            success: true,
+            outcome: 'not-installed',
+            runnersStopped: [],
+            runnersRespawned: [],
+            removedDirs: [],
+            warnings: [],
+        };
+    }
+    for (const id of target.addonIds)
+        await shutdownInProcess(seam, id);
+    const runners = await stopHostingRunners(seam, target.addonIds);
+    for (const id of target.addonIds) {
+        for (const cap of target.capsByAddon.get(id) ?? [])
+            seam.unregisterProvider(cap, id);
+        seam.loadedAddons.delete(id);
+    }
+    // A survivor's row is dropped too, so the discovery pass below sees it as
+    // not-loaded and respawns its runner — without the removed addons, whose
+    // code is gone by then.
+    for (const id of runners.survivors) {
+        for (const cap of target.capsByAddon.get(id) ?? [])
+            seam.unregisterProvider(cap, id);
+        seam.loadedAddons.delete(id);
+    }
+    const removedDirs = removeDirs(seam, request, target);
+    const warnings = [...runners.warnings];
+    let runnersRespawned = [];
+    if (runners.survivors.length > 0) {
+        if (seam.respawnSurvivors) {
+            try {
+                await seam.respawnSurvivors();
+                runnersRespawned = runners.stopped;
+            }
+            catch (err) {
+                warnings.push(`survivors ${runners.survivors.join(', ')} were not respawned: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        else {
+            warnings.push(`survivors ${runners.survivors.join(', ')} were stopped and not respawned`);
+        }
+    }
+    seam.reconcileNodeRegistration?.();
+    seam.logger.info(`undeploy: ${target.packageName ?? request.addonId ?? '?'} removed ` +
+        `(addons=${target.addonIds.join(',') || '-'} runnersStopped=${runners.stopped.join(',') || '-'} ` +
+        `dirs=${removedDirs.length})`, { meta: { warnings } });
+    return {
+        ...base,
+        success: true,
+        outcome: 'uninstalled',
+        runnersStopped: runners.stopped,
+        runnersRespawned,
+        removedDirs,
+        warnings,
+    };
+}

package/dist/agent/main.js

@@ -470,6 +470,19 @@ async function startAgent(configPath) {
         // (manifest strip + runtime deps + native deps + atomic swap) instead of
         // the bare tar swap that shipped addons without their node_modules.
         installBundleTgz: (tgzPath) => installer.installFromTgz(tgzPath),
+        // `$agent.undeploy` refuses what this node bootstraps itself, and drops the
+        // group-runner cap proxies it removes (registered by
+        // `registerGroupRunnerProviders`, ownerless — so a plain unregister owns them).
+        bootstrapPackages: new Set([
+            '@camstack/system',
+            '@camstack/addon-agent-ui',
+            ...system_1.AddonInstaller.AGENT_PACKAGES,
+        ]),
+        unregisterProvider: (capName, addonId) => {
+            if (capabilityRegistry.hasProvider(capName, addonId)) {
+                capabilityRegistry.unregisterProvider(capName, addonId);
+            }
+        },
     });
     broker.createService(agentServiceSchema);
     // $process service — manages forked child processes (same as hub).

package/dist/api/core/cap-providers.js

@@ -77,6 +77,7 @@ const types_1 = require("@camstack/types");
 const server_1 = require("@trpc/server");
 const integration_id_backfill_1 = require("../../boot/integration-id-backfill");
 const addon_package_service_js_1 = require("../../core/addon/addon-package.service.js");
+const addon_uninstall_js_1 = require("../../core/addon/addon-uninstall.js");
 const lifecycle_runner_singleton_js_1 = require("../../core/lifecycle/lifecycle-runner.singleton.js");
 const agent_installed_packages_js_1 = require("../../core/updates/agent-installed-packages.js");
 const http_request_census_singleton_js_1 = require("../trpc/http-request-census.singleton.js");
@@ -1318,8 +1319,82 @@ function isHubNode(nodeId) {
  * filter it out to make the list look clean — the number reaching zero is the
  * point of the number.
  */
-function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
+/**
+ * How long the hub waits for an agent's `$agent.undeploy`. It stops runners
+ * (each up to a 5 s SIGTERM grace plus the group reap) and may respawn a shared
+ * runner's survivors, so it is far longer than a status read.
+ */
+const AGENT_UNDEPLOY_TIMEOUT_MS = 120_000;
+function parseAgentStatusAddons(reply) {
+    if (typeof reply !== 'object' || reply === null || !('addons' in reply))
+        return [];
+    const addons = reply.addons;
+    if (!Array.isArray(addons))
+        return [];
+    const rows = [];
+    for (const raw of addons) {
+        if (typeof raw !== 'object' || raw === null || !('id' in raw) || typeof raw.id !== 'string') {
+            continue;
+        }
+        const packageName = 'packageName' in raw && typeof raw.packageName === 'string' ? raw.packageName : undefined;
+        const version = 'version' in raw && typeof raw.version === 'string' ? raw.version : undefined;
+        rows.push({ id: raw.id, packageName, version });
+    }
+    return rows;
+}
+/**
+ * The real seam behind `addons.uninstallPackage` / `listInstallations`. The
+ * agent leg is the same hub-side `broker.call({ nodeID })` to the agent's
+ * `$agent` service that `updatePackage({ nodeId })` uses.
+ */
+function buildUninstallSeam(ar, ps, broker, agentRegistry) {
+    return {
+        isProtected: (name) => ps.isProtected(name),
+        listHubPackages: () => {
+            let installed;
+            try {
+                installed = ps.listInstalled();
+            }
+            catch {
+                return [];
+            }
+            const idsByPackage = new Map();
+            for (const row of ar.listAddons()) {
+                const ids = idsByPackage.get(row.manifest.packageName) ?? [];
+                ids.push(row.manifest.id);
+                idsByPackage.set(row.manifest.packageName, ids);
+            }
+            return installed.map((p) => ({
+                name: p.name,
+                version: p.version,
+                addonIds: idsByPackage.get(p.name) ?? [],
+            }));
+        },
+        uninstallOnHub: async (name) => {
+            await ps.uninstallAndReload(name);
+        },
+        listAgents: async () => {
+            if (!agentRegistry)
+                return [];
+            const directory = await agentRegistry.listNodeDirectory();
+            return directory.nodes
+                .filter((n) => !n.isHub && !n.id.includes('/'))
+                .map((n) => ({ id: n.id, name: n.name, isOnline: n.isOnline }));
+        },
+        agentAddons: async (nodeId) => parseAgentStatusAddons(await broker.call('$agent.status', {}, { nodeID: nodeId, timeout: agent_installed_packages_js_1.AGENT_STATUS_TIMEOUT_MS })),
+        agentUndeploy: (nodeId, request) => broker.call('$agent.undeploy', request, {
+            nodeID: nodeId,
+            timeout: AGENT_UNDEPLOY_TIMEOUT_MS,
+        }),
+        recordedPackages: async (nodeId) => agentRegistry ? agentRegistry.getRecordedPackages(nodeId) : [],
+        notePackageUndeployed: async (nodeId, packageName, addonIds) => {
+            await agentRegistry?.notePackageUndeployed(nodeId, packageName, addonIds);
+        },
+    };
+}
+function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx, agentRegistry) {
     const broker = moleculer.broker;
+    const uninstallSeam = buildUninstallSeam(ar, ps, broker, agentRegistry);
     const frameworkAllowSet = new Set([addon_package_service_js_1.SYSTEM_PACKAGE]);
     // Process-wide runner built once at boot (manual-boot wires its deps from the
     // addon-package service + event bus). `createdBy` travels per `startJob` call.
@@ -1349,7 +1424,18 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
         installFromWorkspace: async (input) => ps.installFromWorkspaceAndLoad(input.packageName),
         isWorkspaceAvailable: async () => ps.isWorkspaceAvailable(),
         listWorkspacePackages: async () => ps.listWorkspacePackages(),
-        uninstallPackage: async (input) => ps.uninstallAndReload(input.packageName),
+        uninstallPackage: async (input) => {
+            try {
+                return await (0, addon_uninstall_js_1.uninstallPackage)(uninstallSeam, input);
+            }
+            catch (err) {
+                if (err instanceof addon_uninstall_js_1.PackageProtectedError) {
+                    throw new server_1.TRPCError({ code: 'FORBIDDEN', message: err.message });
+                }
+                throw err;
+            }
+        },
+        listInstallations: async (input) => (0, addon_uninstall_js_1.listInstallations)(uninstallSeam, input.packageName),
         reloadPackages: async () => ps.reloadPackages(),
         searchAvailable: async (input) => {
             const results = await ps.searchNpm(input?.query);
@@ -1486,7 +1572,9 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             if (offNode.length > 0) {
                 throw new server_1.TRPCError({
                     code: 'BAD_REQUEST',
-                    message: `The lifecycle job engine is hub-local; it cannot target ${offNode.join(', ')}. Update an agent's packages via updatePackage({ nodeId }).`,
+                    message: input.kind === 'uninstall'
+                        ? `The lifecycle job engine is hub-local; it cannot target ${offNode.join(', ')}. Uninstall from an agent via uninstallPackage({ packageName, nodeId }), or from every node via uninstallPackage({ packageName, everywhere: true }).`
+                        : `The lifecycle job engine is hub-local; it cannot target ${offNode.join(', ')}. Update an agent's packages via updatePackage({ nodeId }).`,
                 });
             }
             return lifecycleRunner.startJob({

package/dist/api/trpc/generated-cap-routers.js

@@ -569,6 +569,14 @@ function createCapRouter_addons(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.uninstallPackage(input);
         }),
+        listInstallations: trpc_middleware_js_1.adminProcedure
+            .input(types_10.addonsCapability.methods.listInstallations.input.loose())
+            .output(types_10.addonsCapability.methods.listInstallations.output)
+            .query(async ({ input, ctx }) => {
+            const p = requireCapProvider('addons', () => getProvider(ctx));
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listInstallations(input);
+        }),
         reloadPackages: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_10.addonsCapability.methods.reloadPackages.output)
@@ -2434,15 +2442,6 @@ function createCapRouter_dayNight(getProvider, createRemoteProxy) {
 }
 function createCapRouter_decoder(getProvider, createRemoteProxy) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        supportsCodec: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.supportsCodec.input.loose())
-            .output(types_42.decoderCapability.methods.supportsCodec.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.supportsCodec(methodInput);
-        }),
         getInfo: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_42.decoderCapability.methods.getInfo.output)
@@ -2450,103 +2449,6 @@ function createCapRouter_decoder(getProvider, createRemoteProxy) {
             const p = resolveProvider('decoder', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
             return p.getInfo();
         }),
-        createSession: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.createSession.input.loose())
-            .output(types_42.decoderCapability.methods.createSession.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.createSession(methodInput);
-        }),
-        destroySession: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.destroySession.input.loose())
-            .output(types_42.decoderCapability.methods.destroySession.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.destroySession(methodInput);
-        }),
-        pushPacket: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.pushPacket.input.loose())
-            .output(types_42.decoderCapability.methods.pushPacket.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pushPacket(methodInput);
-        }),
-        openStream: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.openStream.input.loose())
-            .output(types_42.decoderCapability.methods.openStream.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.openStream(methodInput);
-        }),
-        pullFrames: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.pullFrames.input.loose())
-            .output(types_42.decoderCapability.methods.pullFrames.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pullFrames(methodInput);
-        }),
-        pullHandles: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.pullHandles.input.loose())
-            .output(types_42.decoderCapability.methods.pullHandles.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pullHandles(methodInput);
-        }),
-        getFrame: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.getFrame.input.loose())
-            .output(types_42.decoderCapability.methods.getFrame.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.getFrame(methodInput);
-        }),
-        getShmStats: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.getShmStats.input.loose())
-            .output(types_42.decoderCapability.methods.getShmStats.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.getShmStats(methodInput);
-        }),
-        updateConfig: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.updateConfig.input.loose())
-            .output(types_42.decoderCapability.methods.updateConfig.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.updateConfig(methodInput);
-        }),
-        getStats: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.getStats.input.loose())
-            .output(types_42.decoderCapability.methods.getStats.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.getStats(methodInput);
-        }),
-        listActiveSessions: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
-            .output(types_42.decoderCapability.methods.listActiveSessions.output)
-            .query(async ({ input, ctx }) => {
-            const p = resolveProvider('decoder', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
-            return p.listActiveSessions();
-        }),
         reprobeHwaccel: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_42.decoderCapability.methods.reprobeHwaccel.output)
@@ -10255,33 +10157,6 @@ function createCapRouter_streamBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.unsubscribeAudioChunks(methodInput);
         }),
-        subscribeFrames: trpc_middleware_js_1.protectedProcedure
-            .input(types_118.streamBrokerCapability.methods.subscribeFrames.input.loose())
-            .output(types_118.streamBrokerCapability.methods.subscribeFrames.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.subscribeFrames(methodInput);
-        }),
-        pullFrameHandles: trpc_middleware_js_1.protectedProcedure
-            .input(types_118.streamBrokerCapability.methods.pullFrameHandles.input.loose())
-            .output(types_118.streamBrokerCapability.methods.pullFrameHandles.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pullFrameHandles(methodInput);
-        }),
-        unsubscribeFrames: trpc_middleware_js_1.protectedProcedure
-            .input(types_118.streamBrokerCapability.methods.unsubscribeFrames.input.loose())
-            .output(types_118.streamBrokerCapability.methods.unsubscribeFrames.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.unsubscribeFrames(methodInput);
-        }),
         setPreBufferDuration: trpc_middleware_js_1.adminProcedure
             .input(types_118.streamBrokerCapability.methods.setPreBufferDuration.input.loose())
             .output(types_118.streamBrokerCapability.methods.setPreBufferDuration.output)

package/dist/api/trpc/trpc.router.js

@@ -170,7 +170,7 @@ function buildServerProviders(services) {
         nodes: wrap(() => (0, cap_providers_js_1.buildNodesProvider)(services.agentRegistry, services.moleculer, services.addonRegistry, (0, cap_providers_js_1.createNodeRootPackageLookup)(services.moleculer, services.serverUpdateService), services.loggingService.createLogger('nodes'))),
         // server-management — runtime-updatable root package (phase 1: hub only).
         'server-management': wrap(() => (0, server_management_provider_js_1.buildServerManagementProvider)(services.serverUpdateService)),
-        addons: wrap((ctx) => (0, cap_providers_js_1.buildAddonsProvider)(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx)),
+        addons: wrap((ctx) => (0, cap_providers_js_1.buildAddonsProvider)(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx, services.agentRegistry)),
         // webrtc-session — the resolved broker singleton, wrapped per request to
         // inject the server-read User-Agent into signaling attribution (the broker
         // is a forked addon that can't see the HTTP request). Cross-node (agent-

package/dist/core/addon/addon-uninstall.js

@@ -0,0 +1,259 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageProtectedError = void 0;
+exports.isHubNodeId = isHubNodeId;
+exports.uninstallPackage = uninstallPackage;
+exports.listInstallations = listInstallations;
+/** The hub refuses before touching any node. Mapped to FORBIDDEN by the router. */
+class PackageProtectedError extends Error {
+    constructor(packageName) {
+        super(`Package ${packageName} is required and cannot be uninstalled`);
+        this.name = 'PackageProtectedError';
+    }
+}
+exports.PackageProtectedError = PackageProtectedError;
+/** A node id that refers to the hub itself (top-level or a hub group runner). */
+function isHubNodeId(nodeId) {
+    return nodeId === 'hub' || nodeId.startsWith('hub/');
+}
+const OK_OUTCOMES = new Set([
+    'uninstalled',
+    'not-installed',
+    'pending-reconnect',
+]);
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function nodeResult(nodeId, outcome, extra = {}) {
+    return {
+        nodeId,
+        outcome,
+        addonIds: extra.addonIds ?? [],
+        runnersStopped: extra.runnersStopped ?? [],
+        warnings: extra.warnings ?? [],
+        ...(extra.error !== undefined ? { error: extra.error } : {}),
+    };
+}
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function parseUndeployReply(reply) {
+    if (!isRecord(reply)) {
+        return {
+            packageScoped: false,
+            outcome: null,
+            reason: undefined,
+            addonIds: [],
+            runnersStopped: null,
+            warnings: [],
+        };
+    }
+    const outcome = reply['outcome'];
+    return {
+        packageScoped: reply['scope'] === 'package',
+        outcome: outcome === 'uninstalled' || outcome === 'not-installed' || outcome === 'refused'
+            ? outcome
+            : null,
+        reason: typeof reply['reason'] === 'string' ? reply['reason'] : undefined,
+        addonIds: stringArray(reply['addonIds']),
+        runnersStopped: Array.isArray(reply['runnersStopped'])
+            ? stringArray(reply['runnersStopped'])
+            : null,
+        warnings: stringArray(reply['warnings']),
+    };
+}
+/**
+ * An agent built before package mode answers `{ success, addonId }` and removes
+ * ONE addon — its folder, not its runner. Its packages are still removed (one
+ * call per addon id), and the result says the runner outlives it.
+ */
+const LEGACY_AGENT_WARNING = 'this agent predates runner teardown: the addon is removed from disk but its runner keeps running until the agent restarts — update the agent';
+async function uninstallFromOnlineAgent(seam, nodeId, packageName) {
+    let listed;
+    try {
+        listed = (await seam.agentAddons(nodeId))
+            .filter((a) => a.packageName === packageName)
+            .map((a) => a.id);
+    }
+    catch (err) {
+        return nodeResult(nodeId, 'failed', { error: `status read failed: ${errMessage(err)}` });
+    }
+    try {
+        // `addonId` is for an agent that predates package mode: it reads only that
+        // field. With no listed addon, the package name doubles as the dir to drop.
+        const first = parseUndeployReply(await seam.agentUndeploy(nodeId, { packageName, addonId: listed[0] ?? packageName }));
+        if (first.packageScoped && first.outcome !== null) {
+            if (first.outcome === 'refused') {
+                return nodeResult(nodeId, 'refused', { error: first.reason, addonIds: first.addonIds });
+            }
+            await seam.notePackageUndeployed(nodeId, packageName, first.addonIds);
+            return nodeResult(nodeId, first.outcome, {
+                addonIds: first.addonIds,
+                runnersStopped: first.runnersStopped ?? [],
+                warnings: first.warnings,
+            });
+        }
+        for (const addonId of listed.slice(1)) {
+            await seam.agentUndeploy(nodeId, { packageName, addonId });
+        }
+        await seam.notePackageUndeployed(nodeId, packageName, listed);
+        return nodeResult(nodeId, listed.length > 0 ? 'uninstalled' : 'not-installed', {
+            addonIds: listed,
+            warnings: listed.length > 0 ? [LEGACY_AGENT_WARNING] : [],
+        });
+    }
+    catch (err) {
+        return nodeResult(nodeId, 'failed', { addonIds: listed, error: errMessage(err) });
+    }
+}
+async function uninstallFromAgent(seam, node, packageName) {
+    if (node.isOnline)
+        return uninstallFromOnlineAgent(seam, node.id, packageName);
+    // Offline: nothing can be called. Pruning the record is what keeps the
+    // back-fill from returning it; the copy itself is the stale sweep's on rejoin.
+    try {
+        await seam.notePackageUndeployed(node.id, packageName, []);
+        return nodeResult(node.id, 'pending-reconnect', {
+            warnings: [
+                'node is offline — its copy is removed when it reconnects, provided the hub no longer installs the package',
+            ],
+        });
+    }
+    catch (err) {
+        return nodeResult(node.id, 'failed', { error: errMessage(err) });
+    }
+}
+async function uninstallFromHub(seam, packageName) {
+    const row = seam.listHubPackages().find((p) => p.name === packageName);
+    if (!row)
+        return nodeResult('hub', 'not-installed');
+    try {
+        await seam.uninstallOnHub(packageName);
+        return nodeResult('hub', 'uninstalled', { addonIds: row.addonIds });
+    }
+    catch (err) {
+        return nodeResult('hub', 'failed', { addonIds: row.addonIds, error: errMessage(err) });
+    }
+}
+function summarize(packageName, results) {
+    return { success: results.every((r) => OK_OUTCOMES.has(r.outcome)), packageName, results };
+}
+/**
+ * Agents that have (or are recorded to have) the package. An online agent
+ * whose status read fails is still targeted — the undeploy leg reports the
+ * failure for that node rather than silently skipping it.
+ */
+async function agentsHolding(seam, packageName) {
+    const agents = await seam.listAgents();
+    const holding = await Promise.all(agents.map(async (node) => {
+        if (node.isOnline) {
+            try {
+                const addons = await seam.agentAddons(node.id);
+                if (addons.some((a) => a.packageName === packageName))
+                    return node;
+            }
+            catch {
+                return node;
+            }
+        }
+        const recorded = await seam.recordedPackages(node.id).catch(() => []);
+        return recorded.some((p) => p.name === packageName) ? node : null;
+    }));
+    return holding.filter((n) => n !== null);
+}
+async function uninstallPackage(seam, request) {
+    const { packageName } = request;
+    if (seam.isProtected(packageName))
+        throw new PackageProtectedError(packageName);
+    if (request.everywhere === true) {
+        const agents = await agentsHolding(seam, packageName);
+        // Agents first, hub last — the hub routes every call to the agents, and a
+        // hub uninstall that fails must not leave the agents' records already
+        // pruned for nothing: each leg records only its own success.
+        const results = [];
+        for (const node of agents)
+            results.push(await uninstallFromAgent(seam, node, packageName));
+        results.push(await uninstallFromHub(seam, packageName));
+        return summarize(packageName, results);
+    }
+    const nodeId = request.nodeId;
+    if (nodeId === undefined || isHubNodeId(nodeId)) {
+        // The original contract: hub-only, and a failure THROWS.
+        await seam.uninstallOnHub(packageName);
+        const row = seam.listHubPackages().find((p) => p.name === packageName);
+        return summarize(packageName, [
+            nodeResult('hub', 'uninstalled', { addonIds: row?.addonIds ?? [] }),
+        ]);
+    }
+    const node = (await seam.listAgents()).find((n) => n.id === nodeId);
+    if (!node) {
+        return summarize(packageName, [
+            nodeResult(nodeId, 'failed', { error: `unknown node ${nodeId}` }),
+        ]);
+    }
+    return summarize(packageName, [await uninstallFromAgent(seam, node, packageName)]);
+}
+async function listInstallations(seam, packageName) {
+    const wanted = (name) => packageName === undefined || name === packageName;
+    const hubPackages = seam.listHubPackages();
+    const onHub = new Set(hubPackages.map((p) => p.name));
+    const installations = hubPackages
+        .filter((p) => wanted(p.name))
+        .map((p) => ({
+        packageName: p.name,
+        nodeId: 'hub',
+        nodeName: 'Hub',
+        isHub: true,
+        isOnline: true,
+        version: p.version,
+        addonIds: p.addonIds,
+        source: 'live',
+        onHub: true,
+    }));
+    const unreachable = [];
+    const perAgent = await Promise.all((await seam.listAgents()).map(async (node) => {
+        const base = { nodeId: node.id, nodeName: node.name, isHub: false, isOnline: node.isOnline };
+        if (node.isOnline) {
+            try {
+                const byPackage = new Map();
+                for (const addon of await seam.agentAddons(node.id)) {
+                    if (addon.packageName === undefined || !wanted(addon.packageName))
+                        continue;
+                    const row = byPackage.get(addon.packageName) ?? {
+                        version: addon.version ?? null,
+                        addonIds: [],
+                    };
+                    row.addonIds.push(addon.id);
+                    byPackage.set(addon.packageName, row);
+                }
+                return [...byPackage].map(([name, row]) => ({
+                    ...base,
+                    packageName: name,
+                    version: row.version,
+                    addonIds: row.addonIds,
+                    source: 'live',
+                    onHub: onHub.has(name),
+                }));
+            }
+            catch (err) {
+                unreachable.push({ nodeId: node.id, error: errMessage(err) });
+                return [];
+            }
+        }
+        const recorded = await seam.recordedPackages(node.id).catch(() => []);
+        return recorded
+            .filter((p) => wanted(p.name))
+            .map((p) => ({
+            ...base,
+            packageName: p.name,
+            version: p.version,
+            addonIds: [],
+            source: 'recorded',
+            onHub: onHub.has(p.name),
+        }));
+    }));
+    return { installations: [...installations, ...perAgent.flat()], unreachable };
+}

package/dist/core/addon-bridge/addon-bridge.service.js

@@ -50,11 +50,11 @@ const types_1 = require("@camstack/types");
  *
  * What's left is ONLY the addon package management surface: the installer
  * + the loader + `reloadPackages` + `listAvailableAddons`. These are still
- * used by:
- *  - `server/backend/src/api/addon-upload.ts` (multipart upload → install
- *    → loader reload)
- *  - `server/backend/src/api/bridge-addons.router.ts` (install/uninstall
- *    package lifecycle, addon list via the loader)
+ * used by `server/backend/src/api/addon-upload.ts` (multipart upload →
+ * install → loader reload). The `bridge-addons.router.ts` that also used it
+ * was never mounted and was deleted on 2026-10-08 — its hard-coded REQUIRED
+ * set read like the uninstall guard and was not; uninstall is the `addons`
+ * cap's (`core/addon/addon-uninstall.ts`).
  */
 class AddonBridgeService {
     loggingService;

package/dist/core/agent/agent-addon-backfill.js

@@ -24,13 +24,20 @@
  * both mutations are attributable actions rather than heuristics.
  *
  * THE INTENDED VERSION
- * The hub's own installed version wins, falling back to the version the node
- * last reported. Never `latest` — resolving `latest` per node is exactly the
- * silent per-node drift the bootstrap installer already suffers from
- * (`addon-installer.ts` installs unpinned and `ensureRequiredPackages` never
- * re-installs, so whatever `latest` meant at a node's first boot is what that
- * node runs forever). A package with no resolvable version is reported, not
- * guessed at.
+ * The hub's own installed version, and only that. Never `latest` — resolving
+ * `latest` per node is exactly the silent per-node drift the bootstrap
+ * installer already suffers from (`addon-installer.ts` installs unpinned and
+ * `ensureRequiredPackages` never re-installs, so whatever `latest` meant at a
+ * node's first boot is what that node runs forever).
+ *
+ * A package the hub does NOT install is never delivered, whatever the node last
+ * reported. It used to fall back to the node's last-reported version, which
+ * made the back-fill the one path that could put an UNINSTALLED addon back: an
+ * operator removes `@camstack/addon-decoder-ffmpeg` from the hub and moves the
+ * agent's copy aside, and the next reconnect reinstalled it from npm at the
+ * version the node last ran — while the same pass's stale sweep exists to
+ * remove exactly such an addon. The two directions disagreed; now the hub's
+ * install set bounds both. Such packages are reported as `notOnHub`.
  *
  * BOUNDING
  * Delivery failures are counted per `(node, package, version)` and the pair is
@@ -66,7 +73,7 @@ function computeBackfillPlan(input) {
     const liveNames = new Set(input.live.map((p) => p.name));
     const targets = [];
     const retired = [];
-    const unresolvable = [];
+    const notOnHub = [];
     for (const entry of input.recorded) {
         if (liveNames.has(entry.name))
             continue;
@@ -79,18 +86,13 @@ function computeBackfillPlan(input) {
             continue;
         }
         const hubVersion = input.hubVersions.get(entry.name);
-        const version = hubVersion ?? entry.version;
-        if (version === null || version === undefined || version.length === 0) {
-            unresolvable.push(entry.name);
+        if (hubVersion === undefined) {
+            notOnHub.push(entry.name);
             continue;
         }
-        targets.push({
-            name: entry.name,
-            version,
-            versionSource: hubVersion === undefined ? 'node-last-reported' : 'hub-installed',
-        });
+        targets.push({ name: entry.name, version: hubVersion, versionSource: 'hub-installed' });
     }
-    return { targets, retired, unresolvable, liveCount: liveNames.size };
+    return { targets, retired, notOnHub, liveCount: liveNames.size };
 }
 function confirmBackfillPlan(plan, secondRead) {
     const present = new Set(secondRead.map((p) => p.name));
@@ -187,5 +189,5 @@ async function executeBackfill(seam, nodeId, plan, tracker) {
     if (delivered.length > 0) {
         await seam.reload(nodeId);
     }
-    return { delivered, failed, skipped: plan.retired, unresolvable: plan.unresolvable };
+    return { delivered, failed, skipped: plan.retired, notOnHub: plan.notOnHub };
 }

package/dist/core/agent/agent-registry.service.js

@@ -281,6 +281,32 @@ class AgentRegistryService {
             return;
         await this.historyStore?.prunePackages(nodeId, [packageName]);
     }
+    /**
+     * The operator removed a whole PACKAGE from a node (`addons.uninstallPackage`
+     * with a `nodeId`, or `everywhere`). Same intent as
+     * {@link noteAddonUndeployed}, keyed by package — which is what an uninstall
+     * names, and the only key that still resolves once the hub itself no longer
+     * has the package. Emits one `AddonUninstalled` per addon removed, like the
+     * stale-addon reconcile does.
+     */
+    async notePackageUndeployed(nodeId, packageName, addonIds) {
+        if (AGENT_BOOTSTRAP_PACKAGES.has(packageName))
+            return;
+        await this.historyStore?.prunePackages(nodeId, [packageName]);
+        for (const addonId of addonIds) {
+            this.eventBus.emit({
+                id: (0, node_crypto_1.randomUUID)(),
+                timestamp: new Date(),
+                source: { type: 'core', id: 'agent-registry' },
+                category: types_1.EventCategory.AddonUninstalled,
+                data: { addonId, agentId: nodeId, packageName, reason: 'operator uninstall' },
+            });
+        }
+    }
+    /** The packages a node last declared (its intended set). `[]` with no store. */
+    async getRecordedPackages(nodeId) {
+        return this.historyStore ? this.historyStore.getPackages(nodeId) : [];
+    }
     /** Map an addon declaration id to the package that ships it, via the hub registry. */
     resolvePackageForAddon(addonId) {
         if (!this.addonRegistry)
@@ -744,9 +770,14 @@ class AgentRegistryService {
             retired: this.backfillTracker.retiredFor(agentId),
             hubVersions,
         });
-        if (planned.targets.length === 0 &&
-            planned.retired.length === 0 &&
-            planned.unresolvable.length === 0) {
+        // Never a delivery, and said so: an addon the hub no longer installs stays
+        // off the node even though the node once declared it (the stale sweep above
+        // removes a copy that is still there).
+        if (planned.notOnHub.length > 0) {
+            console.log(`[agent-registry] Back-fill ${agentId}: NOT delivering ${planned.notOnHub.join(', ')} — ` +
+                `in the node's declared roster but not installed on the hub`);
+        }
+        if (planned.targets.length === 0 && planned.retired.length === 0) {
             return;
         }
         // GATE 1 — the trigger allowlist. A pass that must not install says so and
@@ -773,7 +804,7 @@ class AgentRegistryService {
         const plan = await this.confirmBackfillTargets(agentId, planned);
         if (plan === null)
             return;
-        if (plan.targets.length === 0 && plan.retired.length === 0 && plan.unresolvable.length === 0) {
+        if (plan.targets.length === 0 && plan.retired.length === 0) {
             return;
         }
         // Hold the delivery window open for the whole pass, so the reload this
@@ -813,9 +844,6 @@ class AgentRegistryService {
         for (const name of outcome.skipped) {
             console.error(`[agent-registry] Back-fill ${agentId}: ${name} is still missing and RETIRED — the node is degraded until an operator intervenes`);
         }
-        for (const name of outcome.unresolvable) {
-            console.error(`[agent-registry] Back-fill ${agentId}: ${name} is missing but no version could be resolved (not installed on the hub, no version recorded) — not guessing "latest"`);
-        }
     }
     /**
      * Re-read the node's roster and drop every target the second read reports

package/dist/server-root/index.js

@@ -961,7 +961,6 @@ var require_dist = __commonJS({
     var import_node_url = require("url");
     var HOST_EXTERNAL_SPECIFIERS = [
       "@camstack/system",
-      "@camstack/shm-ring",
       "@camstack/types",
       "@camstack/sdk",
       "zod",

package/dist/single-copy-cleanup.js

@@ -189,7 +189,6 @@ exports.CLOSURE_PROVIDED_PACKAGES = [
     '@camstack/system',
     '@camstack/types',
     '@camstack/sdk',
-    '@camstack/shm-ring',
     '@camstack/ui-library',
 ];
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.477",
+  "version": "1.2.478",
   "license": "MIT",
   "private": false,
   "files": [
@@ -18,8 +18,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json && tsup && node scripts/copy-closure-patches.mjs",
     "postinstall": "node scripts/closure-postinstall.mjs",
-    "dev": "npx concurrently -n server,ui -c blue,magenta \"CAMSTACK_RESTART_TOUCH_FILE=src/launcher.ts tsx watch --env-file=.env --ignore=./camstack-data --ignore=../../packages/core/dist --ignore=../../packages/sdk/dist --ignore=../../packages/ui-library/dist --ignore=../../packages/shm-ring/dist src/launcher.ts\" \"cd ../../packages/addon-admin-ui && npx vite --port 3001\"",
-    "serve": "CAMSTACK_RESTART_TOUCH_FILE=src/launcher.ts tsx watch --env-file=.env --ignore=./camstack-data --ignore=../../packages/core/dist --ignore=../../packages/sdk/dist --ignore=../../packages/ui-library/dist --ignore=../../packages/shm-ring/dist src/launcher.ts",
+    "dev": "npx concurrently -n server,ui -c blue,magenta \"CAMSTACK_RESTART_TOUCH_FILE=src/launcher.ts tsx watch --env-file=.env --ignore=./camstack-data --ignore=../../packages/core/dist --ignore=../../packages/sdk/dist --ignore=../../packages/ui-library/dist src/launcher.ts\" \"cd ../../packages/addon-admin-ui && npx vite --port 3001\"",
+    "serve": "CAMSTACK_RESTART_TOUCH_FILE=src/launcher.ts tsx watch --env-file=.env --ignore=./camstack-data --ignore=../../packages/core/dist --ignore=../../packages/sdk/dist --ignore=../../packages/ui-library/dist src/launcher.ts",
     "serve:once": "tsx --env-file=.env src/launcher.ts",
     "start": "node --env-file=.env dist/launcher.js",
     "typecheck": "tsc --noEmit -p tsconfig.spec.json",
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.349",
-    "@camstack/addon-agent-ui": "1.2.188",
+    "@camstack/addon-admin-ui": "1.2.351",
+    "@camstack/addon-agent-ui": "1.2.190",
     "@camstack/addon-auth": "1.2.130",
-    "@camstack/addon-decoder-nodeav": "1.2.119",
+    "@camstack/addon-decoder-nodeav": "1.2.121",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.342",
-    "@camstack/addon-pipeline-orchestrator": "1.2.295",
-    "@camstack/addon-post-analysis": "1.2.340",
-    "@camstack/sdk": "1.2.124",
-    "@camstack/system": "1.2.371",
-    "@camstack/types": "1.2.322",
-    "@camstack/ui-library": "1.2.246",
+    "@camstack/addon-pipeline": "1.2.344",
+    "@camstack/addon-pipeline-orchestrator": "1.2.297",
+    "@camstack/addon-post-analysis": "1.2.342",
+    "@camstack/sdk": "1.2.126",
+    "@camstack/system": "1.2.373",
+    "@camstack/types": "1.2.324",
+    "@camstack/ui-library": "1.2.248",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/api/bridge-addons.router.js

@@ -1,109 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createBridgeAddonsRouter = createBridgeAddonsRouter;
-const zod_1 = require("zod");
-const server_1 = require("@trpc/server");
-const trpc_middleware_1 = require("./trpc/trpc.middleware");
-function createBridgeAddonsRouter(bridge, addonSearch, addonRegistry, toastService) {
-    return (0, trpc_middleware_1.trpcRouter)({
-        /** List all addon packages installed in the addons directory */
-        listPackages: trpc_middleware_1.protectedProcedure.query(() => {
-            const installer = bridge.getInstaller();
-            if (!installer)
-                return [];
-            return installer.listInstalled();
-        }),
-        /** List all available addons across all loaded packages */
-        listAddons: trpc_middleware_1.protectedProcedure.query(() => {
-            return bridge.listAvailableAddons().map((id) => {
-                const addon = bridge.getLoader().getAddon(id);
-                return {
-                    id,
-                    packageName: addon?.packageName ?? 'unknown',
-                    slot: addon?.declaration.slot ?? null,
-                };
-            });
-        }),
-        /** Install a community addon package from npm */
-        installPackage: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ packageName: zod_1.z.string(), version: zod_1.z.string().optional() }))
-            .mutation(async ({ input }) => {
-            const installer = bridge.getInstaller();
-            if (!installer) {
-                throw new server_1.TRPCError({
-                    code: 'PRECONDITION_FAILED',
-                    message: 'Addon installer not available — bridge may have failed to initialize',
-                });
-            }
-            await installer.install(input.packageName, input.version);
-            await bridge.reloadPackages();
-            const result = addonRegistry
-                ? await addonRegistry.loadNewAddons()
-                : { loaded: [], failed: [] };
-            toastService?.broadcast({
-                title: 'Addon Installed',
-                message: `${input.packageName} installed successfully${result.loaded.length ? ` (${result.loaded.join(', ')})` : ''}`,
-                severity: result.failed.length ? 'warning' : 'info',
-            });
-            return { success: true, loaded: result.loaded, failed: result.failed };
-        }),
-        /** Uninstall a community addon package */
-        uninstallPackage: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ packageName: zod_1.z.string() }))
-            .mutation(async ({ input }) => {
-            // Server-side guard: prevent uninstalling required packages.
-            // After Phase D bundle merge, the pipeline-related packages
-            // (stream-broker, detection-pipeline, motion-wasm, decoders,
-            // audio) all live in @camstack/addon-pipeline.
-            const REQUIRED = new Set([
-                '@camstack/system',
-                '@camstack/addon-pipeline',
-                '@camstack/addon-pipeline-orchestrator',
-                '@camstack/addon-post-analysis',
-                '@camstack/addon-admin-ui',
-            ]);
-            if (REQUIRED.has(input.packageName)) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: `Package ${input.packageName} is required and cannot be uninstalled`,
-                });
-            }
-            const installer = bridge.getInstaller();
-            if (!installer) {
-                throw new server_1.TRPCError({
-                    code: 'PRECONDITION_FAILED',
-                    message: 'Addon installer not available — bridge may have failed to initialize',
-                });
-            }
-            await installer.uninstall(input.packageName);
-            await bridge.reloadPackages();
-            if (addonRegistry)
-                await addonRegistry.loadNewAddons();
-            toastService?.broadcast({
-                title: 'Addon Uninstalled',
-                message: `${input.packageName} has been removed`,
-                severity: 'info',
-            });
-            return { success: true };
-        }),
-        /** Force reload all addon packages (re-scan directories, re-import modules) */
-        reloadPackages: trpc_middleware_1.adminProcedure.mutation(async () => {
-            await bridge.reloadPackages();
-            return { success: true, message: 'Addon packages reloaded' };
-        }),
-        /** Search npm for available CamStack addons */
-        searchAvailable: trpc_middleware_1.protectedProcedure
-            .input(zod_1.z.object({ query: zod_1.z.string().optional() }).optional())
-            .query(async ({ input }) => {
-            const results = await addonSearch.searchAddons(input?.query);
-            // Enrich with install status from locally installed packages
-            const installed = bridge.getInstaller()?.listInstalled() ?? [];
-            const installedMap = new Map(installed.map((p) => [p.name, p.version]));
-            return results.map((r) => ({
-                ...r,
-                installed: installedMap.has(r.name),
-                installedVersion: installedMap.get(r.name),
-            }));
-        }),
-    });
-}