@camstack/server 1.2.477 → 1.2.479

package/dist/api/trpc/generated-cap-routers.js

@@ -569,6 +569,14 @@ function createCapRouter_addons(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.uninstallPackage(input);
         }),
+        listInstallations: trpc_middleware_js_1.adminProcedure
+            .input(types_10.addonsCapability.methods.listInstallations.input.loose())
+            .output(types_10.addonsCapability.methods.listInstallations.output)
+            .query(async ({ input, ctx }) => {
+            const p = requireCapProvider('addons', () => getProvider(ctx));
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listInstallations(input);
+        }),
         reloadPackages: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_10.addonsCapability.methods.reloadPackages.output)
@@ -2434,15 +2442,6 @@ function createCapRouter_dayNight(getProvider, createRemoteProxy) {
 }
 function createCapRouter_decoder(getProvider, createRemoteProxy) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        supportsCodec: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.supportsCodec.input.loose())
-            .output(types_42.decoderCapability.methods.supportsCodec.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.supportsCodec(methodInput);
-        }),
         getInfo: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_42.decoderCapability.methods.getInfo.output)
@@ -2450,103 +2449,6 @@ function createCapRouter_decoder(getProvider, createRemoteProxy) {
             const p = resolveProvider('decoder', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
             return p.getInfo();
         }),
-        createSession: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.createSession.input.loose())
-            .output(types_42.decoderCapability.methods.createSession.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.createSession(methodInput);
-        }),
-        destroySession: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.destroySession.input.loose())
-            .output(types_42.decoderCapability.methods.destroySession.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.destroySession(methodInput);
-        }),
-        pushPacket: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.pushPacket.input.loose())
-            .output(types_42.decoderCapability.methods.pushPacket.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pushPacket(methodInput);
-        }),
-        openStream: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.openStream.input.loose())
-            .output(types_42.decoderCapability.methods.openStream.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.openStream(methodInput);
-        }),
-        pullFrames: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.pullFrames.input.loose())
-            .output(types_42.decoderCapability.methods.pullFrames.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pullFrames(methodInput);
-        }),
-        pullHandles: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.pullHandles.input.loose())
-            .output(types_42.decoderCapability.methods.pullHandles.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pullHandles(methodInput);
-        }),
-        getFrame: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.getFrame.input.loose())
-            .output(types_42.decoderCapability.methods.getFrame.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.getFrame(methodInput);
-        }),
-        getShmStats: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.getShmStats.input.loose())
-            .output(types_42.decoderCapability.methods.getShmStats.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.getShmStats(methodInput);
-        }),
-        updateConfig: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.updateConfig.input.loose())
-            .output(types_42.decoderCapability.methods.updateConfig.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.updateConfig(methodInput);
-        }),
-        getStats: trpc_middleware_js_1.protectedProcedure
-            .input(types_42.decoderCapability.methods.getStats.input.loose())
-            .output(types_42.decoderCapability.methods.getStats.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('decoder', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.getStats(methodInput);
-        }),
-        listActiveSessions: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
-            .output(types_42.decoderCapability.methods.listActiveSessions.output)
-            .query(async ({ input, ctx }) => {
-            const p = resolveProvider('decoder', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
-            return p.listActiveSessions();
-        }),
         reprobeHwaccel: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_42.decoderCapability.methods.reprobeHwaccel.output)
@@ -10255,33 +10157,6 @@ function createCapRouter_streamBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.unsubscribeAudioChunks(methodInput);
         }),
-        subscribeFrames: trpc_middleware_js_1.protectedProcedure
-            .input(types_118.streamBrokerCapability.methods.subscribeFrames.input.loose())
-            .output(types_118.streamBrokerCapability.methods.subscribeFrames.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.subscribeFrames(methodInput);
-        }),
-        pullFrameHandles: trpc_middleware_js_1.protectedProcedure
-            .input(types_118.streamBrokerCapability.methods.pullFrameHandles.input.loose())
-            .output(types_118.streamBrokerCapability.methods.pullFrameHandles.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.pullFrameHandles(methodInput);
-        }),
-        unsubscribeFrames: trpc_middleware_js_1.protectedProcedure
-            .input(types_118.streamBrokerCapability.methods.unsubscribeFrames.input.loose())
-            .output(types_118.streamBrokerCapability.methods.unsubscribeFrames.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('stream-broker', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.unsubscribeFrames(methodInput);
-        }),
         setPreBufferDuration: trpc_middleware_js_1.adminProcedure
             .input(types_118.streamBrokerCapability.methods.setPreBufferDuration.input.loose())
             .output(types_118.streamBrokerCapability.methods.setPreBufferDuration.output)

package/dist/api/trpc/trpc.router.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enrichInputWithUserAgent = enrichInputWithUserAgent;
 exports.enrichInputWithRelayClass = enrichInputWithRelayClass;
+exports.stripTalkbackFromRequest = stripTalkbackFromRequest;
 exports.enrichHintsWithClientClass = enrichHintsWithClientClass;
 exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
 exports.buildAppRouter = buildAppRouter;
@@ -95,6 +96,25 @@ function enrichInputWithRelayClass(input, clientClass) {
     const relayOnly = FORCE_RELAY_REMOTE ? (0, client_ip_js_1.deriveRelayOnly)(clientClass) : false;
     return { ...input, relayOnly };
 }
+/**
+ * Strip `talkback` from a REQUEST-bound `handleOffer` (D771).
+ *
+ * Talk-back sends the peer's microphone to the camera's speaker. Only a
+ * trusted, mesh-originated caller may ask for it — today the Alexa export,
+ * which has already checked the linked user may control the camera. A
+ * browser's talk permission lives on the intercom cap's own surface (share
+ * tokens gate it there); letting a request-bound `handleOffer` set this flag
+ * would be a second door to the speaker. Same rule as `relayOnly`: a
+ * mesh-originated call (`clientClass === null`) passes through unchanged.
+ *
+ * Immutable — builds a NEW input object, never mutates the caller's.
+ */
+function stripTalkbackFromRequest(input, clientClass) {
+    if (clientClass === null || input.talkback === undefined)
+        return input;
+    const { talkback: _dropped, ...rest } = input;
+    return rest;
+}
 /**
  * Bias used to live here (`prefersTier: 'low'` for `remote`). That pinned
  * every phone-sized session — including LAN IPv6 GUA misclassified as remote
@@ -145,7 +165,7 @@ function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
     return {
         ...provider,
         createSession: (input) => provider.createSession(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
-        handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
+        handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(stripTalkbackFromRequest(input, clientClass), userAgent), clientClass), clientClass)),
     };
 }
 /**
@@ -170,7 +190,7 @@ function buildServerProviders(services) {
         nodes: wrap(() => (0, cap_providers_js_1.buildNodesProvider)(services.agentRegistry, services.moleculer, services.addonRegistry, (0, cap_providers_js_1.createNodeRootPackageLookup)(services.moleculer, services.serverUpdateService), services.loggingService.createLogger('nodes'))),
         // server-management — runtime-updatable root package (phase 1: hub only).
         'server-management': wrap(() => (0, server_management_provider_js_1.buildServerManagementProvider)(services.serverUpdateService)),
-        addons: wrap((ctx) => (0, cap_providers_js_1.buildAddonsProvider)(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx)),
+        addons: wrap((ctx) => (0, cap_providers_js_1.buildAddonsProvider)(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx, services.agentRegistry)),
         // webrtc-session — the resolved broker singleton, wrapped per request to
         // inject the server-read User-Agent into signaling attribution (the broker
         // is a forked addon that can't see the HTTP request). Cross-node (agent-

package/dist/core/addon/addon-uninstall.js

@@ -0,0 +1,259 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageProtectedError = void 0;
+exports.isHubNodeId = isHubNodeId;
+exports.uninstallPackage = uninstallPackage;
+exports.listInstallations = listInstallations;
+/** The hub refuses before touching any node. Mapped to FORBIDDEN by the router. */
+class PackageProtectedError extends Error {
+    constructor(packageName) {
+        super(`Package ${packageName} is required and cannot be uninstalled`);
+        this.name = 'PackageProtectedError';
+    }
+}
+exports.PackageProtectedError = PackageProtectedError;
+/** A node id that refers to the hub itself (top-level or a hub group runner). */
+function isHubNodeId(nodeId) {
+    return nodeId === 'hub' || nodeId.startsWith('hub/');
+}
+const OK_OUTCOMES = new Set([
+    'uninstalled',
+    'not-installed',
+    'pending-reconnect',
+]);
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function nodeResult(nodeId, outcome, extra = {}) {
+    return {
+        nodeId,
+        outcome,
+        addonIds: extra.addonIds ?? [],
+        runnersStopped: extra.runnersStopped ?? [],
+        warnings: extra.warnings ?? [],
+        ...(extra.error !== undefined ? { error: extra.error } : {}),
+    };
+}
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function parseUndeployReply(reply) {
+    if (!isRecord(reply)) {
+        return {
+            packageScoped: false,
+            outcome: null,
+            reason: undefined,
+            addonIds: [],
+            runnersStopped: null,
+            warnings: [],
+        };
+    }
+    const outcome = reply['outcome'];
+    return {
+        packageScoped: reply['scope'] === 'package',
+        outcome: outcome === 'uninstalled' || outcome === 'not-installed' || outcome === 'refused'
+            ? outcome
+            : null,
+        reason: typeof reply['reason'] === 'string' ? reply['reason'] : undefined,
+        addonIds: stringArray(reply['addonIds']),
+        runnersStopped: Array.isArray(reply['runnersStopped'])
+            ? stringArray(reply['runnersStopped'])
+            : null,
+        warnings: stringArray(reply['warnings']),
+    };
+}
+/**
+ * An agent built before package mode answers `{ success, addonId }` and removes
+ * ONE addon — its folder, not its runner. Its packages are still removed (one
+ * call per addon id), and the result says the runner outlives it.
+ */
+const LEGACY_AGENT_WARNING = 'this agent predates runner teardown: the addon is removed from disk but its runner keeps running until the agent restarts — update the agent';
+async function uninstallFromOnlineAgent(seam, nodeId, packageName) {
+    let listed;
+    try {
+        listed = (await seam.agentAddons(nodeId))
+            .filter((a) => a.packageName === packageName)
+            .map((a) => a.id);
+    }
+    catch (err) {
+        return nodeResult(nodeId, 'failed', { error: `status read failed: ${errMessage(err)}` });
+    }
+    try {
+        // `addonId` is for an agent that predates package mode: it reads only that
+        // field. With no listed addon, the package name doubles as the dir to drop.
+        const first = parseUndeployReply(await seam.agentUndeploy(nodeId, { packageName, addonId: listed[0] ?? packageName }));
+        if (first.packageScoped && first.outcome !== null) {
+            if (first.outcome === 'refused') {
+                return nodeResult(nodeId, 'refused', { error: first.reason, addonIds: first.addonIds });
+            }
+            await seam.notePackageUndeployed(nodeId, packageName, first.addonIds);
+            return nodeResult(nodeId, first.outcome, {
+                addonIds: first.addonIds,
+                runnersStopped: first.runnersStopped ?? [],
+                warnings: first.warnings,
+            });
+        }
+        for (const addonId of listed.slice(1)) {
+            await seam.agentUndeploy(nodeId, { packageName, addonId });
+        }
+        await seam.notePackageUndeployed(nodeId, packageName, listed);
+        return nodeResult(nodeId, listed.length > 0 ? 'uninstalled' : 'not-installed', {
+            addonIds: listed,
+            warnings: listed.length > 0 ? [LEGACY_AGENT_WARNING] : [],
+        });
+    }
+    catch (err) {
+        return nodeResult(nodeId, 'failed', { addonIds: listed, error: errMessage(err) });
+    }
+}
+async function uninstallFromAgent(seam, node, packageName) {
+    if (node.isOnline)
+        return uninstallFromOnlineAgent(seam, node.id, packageName);
+    // Offline: nothing can be called. Pruning the record is what keeps the
+    // back-fill from returning it; the copy itself is the stale sweep's on rejoin.
+    try {
+        await seam.notePackageUndeployed(node.id, packageName, []);
+        return nodeResult(node.id, 'pending-reconnect', {
+            warnings: [
+                'node is offline — its copy is removed when it reconnects, provided the hub no longer installs the package',
+            ],
+        });
+    }
+    catch (err) {
+        return nodeResult(node.id, 'failed', { error: errMessage(err) });
+    }
+}
+async function uninstallFromHub(seam, packageName) {
+    const row = seam.listHubPackages().find((p) => p.name === packageName);
+    if (!row)
+        return nodeResult('hub', 'not-installed');
+    try {
+        await seam.uninstallOnHub(packageName);
+        return nodeResult('hub', 'uninstalled', { addonIds: row.addonIds });
+    }
+    catch (err) {
+        return nodeResult('hub', 'failed', { addonIds: row.addonIds, error: errMessage(err) });
+    }
+}
+function summarize(packageName, results) {
+    return { success: results.every((r) => OK_OUTCOMES.has(r.outcome)), packageName, results };
+}
+/**
+ * Agents that have (or are recorded to have) the package. An online agent
+ * whose status read fails is still targeted — the undeploy leg reports the
+ * failure for that node rather than silently skipping it.
+ */
+async function agentsHolding(seam, packageName) {
+    const agents = await seam.listAgents();
+    const holding = await Promise.all(agents.map(async (node) => {
+        if (node.isOnline) {
+            try {
+                const addons = await seam.agentAddons(node.id);
+                if (addons.some((a) => a.packageName === packageName))
+                    return node;
+            }
+            catch {
+                return node;
+            }
+        }
+        const recorded = await seam.recordedPackages(node.id).catch(() => []);
+        return recorded.some((p) => p.name === packageName) ? node : null;
+    }));
+    return holding.filter((n) => n !== null);
+}
+async function uninstallPackage(seam, request) {
+    const { packageName } = request;
+    if (seam.isProtected(packageName))
+        throw new PackageProtectedError(packageName);
+    if (request.everywhere === true) {
+        const agents = await agentsHolding(seam, packageName);
+        // Agents first, hub last — the hub routes every call to the agents, and a
+        // hub uninstall that fails must not leave the agents' records already
+        // pruned for nothing: each leg records only its own success.
+        const results = [];
+        for (const node of agents)
+            results.push(await uninstallFromAgent(seam, node, packageName));
+        results.push(await uninstallFromHub(seam, packageName));
+        return summarize(packageName, results);
+    }
+    const nodeId = request.nodeId;
+    if (nodeId === undefined || isHubNodeId(nodeId)) {
+        // The original contract: hub-only, and a failure THROWS.
+        await seam.uninstallOnHub(packageName);
+        const row = seam.listHubPackages().find((p) => p.name === packageName);
+        return summarize(packageName, [
+            nodeResult('hub', 'uninstalled', { addonIds: row?.addonIds ?? [] }),
+        ]);
+    }
+    const node = (await seam.listAgents()).find((n) => n.id === nodeId);
+    if (!node) {
+        return summarize(packageName, [
+            nodeResult(nodeId, 'failed', { error: `unknown node ${nodeId}` }),
+        ]);
+    }
+    return summarize(packageName, [await uninstallFromAgent(seam, node, packageName)]);
+}
+async function listInstallations(seam, packageName) {
+    const wanted = (name) => packageName === undefined || name === packageName;
+    const hubPackages = seam.listHubPackages();
+    const onHub = new Set(hubPackages.map((p) => p.name));
+    const installations = hubPackages
+        .filter((p) => wanted(p.name))
+        .map((p) => ({
+        packageName: p.name,
+        nodeId: 'hub',
+        nodeName: 'Hub',
+        isHub: true,
+        isOnline: true,
+        version: p.version,
+        addonIds: p.addonIds,
+        source: 'live',
+        onHub: true,
+    }));
+    const unreachable = [];
+    const perAgent = await Promise.all((await seam.listAgents()).map(async (node) => {
+        const base = { nodeId: node.id, nodeName: node.name, isHub: false, isOnline: node.isOnline };
+        if (node.isOnline) {
+            try {
+                const byPackage = new Map();
+                for (const addon of await seam.agentAddons(node.id)) {
+                    if (addon.packageName === undefined || !wanted(addon.packageName))
+                        continue;
+                    const row = byPackage.get(addon.packageName) ?? {
+                        version: addon.version ?? null,
+                        addonIds: [],
+                    };
+                    row.addonIds.push(addon.id);
+                    byPackage.set(addon.packageName, row);
+                }
+                return [...byPackage].map(([name, row]) => ({
+                    ...base,
+                    packageName: name,
+                    version: row.version,
+                    addonIds: row.addonIds,
+                    source: 'live',
+                    onHub: onHub.has(name),
+                }));
+            }
+            catch (err) {
+                unreachable.push({ nodeId: node.id, error: errMessage(err) });
+                return [];
+            }
+        }
+        const recorded = await seam.recordedPackages(node.id).catch(() => []);
+        return recorded
+            .filter((p) => wanted(p.name))
+            .map((p) => ({
+            ...base,
+            packageName: p.name,
+            version: p.version,
+            addonIds: [],
+            source: 'recorded',
+            onHub: onHub.has(p.name),
+        }));
+    }));
+    return { installations: [...installations, ...perAgent.flat()], unreachable };
+}

package/dist/core/addon-bridge/addon-bridge.service.js

@@ -50,11 +50,11 @@ const types_1 = require("@camstack/types");
  *
  * What's left is ONLY the addon package management surface: the installer
  * + the loader + `reloadPackages` + `listAvailableAddons`. These are still
- * used by:
- *  - `server/backend/src/api/addon-upload.ts` (multipart upload → install
- *    → loader reload)
- *  - `server/backend/src/api/bridge-addons.router.ts` (install/uninstall
- *    package lifecycle, addon list via the loader)
+ * used by `server/backend/src/api/addon-upload.ts` (multipart upload →
+ * install → loader reload). The `bridge-addons.router.ts` that also used it
+ * was never mounted and was deleted on 2026-10-08 — its hard-coded REQUIRED
+ * set read like the uninstall guard and was not; uninstall is the `addons`
+ * cap's (`core/addon/addon-uninstall.ts`).
  */
 class AddonBridgeService {
     loggingService;

package/dist/core/agent/agent-addon-backfill.js

@@ -24,13 +24,20 @@
  * both mutations are attributable actions rather than heuristics.
  *
  * THE INTENDED VERSION
- * The hub's own installed version wins, falling back to the version the node
- * last reported. Never `latest` — resolving `latest` per node is exactly the
- * silent per-node drift the bootstrap installer already suffers from
- * (`addon-installer.ts` installs unpinned and `ensureRequiredPackages` never
- * re-installs, so whatever `latest` meant at a node's first boot is what that
- * node runs forever). A package with no resolvable version is reported, not
- * guessed at.
+ * The hub's own installed version, and only that. Never `latest` — resolving
+ * `latest` per node is exactly the silent per-node drift the bootstrap
+ * installer already suffers from (`addon-installer.ts` installs unpinned and
+ * `ensureRequiredPackages` never re-installs, so whatever `latest` meant at a
+ * node's first boot is what that node runs forever).
+ *
+ * A package the hub does NOT install is never delivered, whatever the node last
+ * reported. It used to fall back to the node's last-reported version, which
+ * made the back-fill the one path that could put an UNINSTALLED addon back: an
+ * operator removes `@camstack/addon-decoder-ffmpeg` from the hub and moves the
+ * agent's copy aside, and the next reconnect reinstalled it from npm at the
+ * version the node last ran — while the same pass's stale sweep exists to
+ * remove exactly such an addon. The two directions disagreed; now the hub's
+ * install set bounds both. Such packages are reported as `notOnHub`.
  *
  * BOUNDING
  * Delivery failures are counted per `(node, package, version)` and the pair is
@@ -66,7 +73,7 @@ function computeBackfillPlan(input) {
     const liveNames = new Set(input.live.map((p) => p.name));
     const targets = [];
     const retired = [];
-    const unresolvable = [];
+    const notOnHub = [];
     for (const entry of input.recorded) {
         if (liveNames.has(entry.name))
             continue;
@@ -79,18 +86,13 @@ function computeBackfillPlan(input) {
             continue;
         }
         const hubVersion = input.hubVersions.get(entry.name);
-        const version = hubVersion ?? entry.version;
-        if (version === null || version === undefined || version.length === 0) {
-            unresolvable.push(entry.name);
+        if (hubVersion === undefined) {
+            notOnHub.push(entry.name);
             continue;
         }
-        targets.push({
-            name: entry.name,
-            version,
-            versionSource: hubVersion === undefined ? 'node-last-reported' : 'hub-installed',
-        });
+        targets.push({ name: entry.name, version: hubVersion, versionSource: 'hub-installed' });
     }
-    return { targets, retired, unresolvable, liveCount: liveNames.size };
+    return { targets, retired, notOnHub, liveCount: liveNames.size };
 }
 function confirmBackfillPlan(plan, secondRead) {
     const present = new Set(secondRead.map((p) => p.name));
@@ -187,5 +189,5 @@ async function executeBackfill(seam, nodeId, plan, tracker) {
     if (delivered.length > 0) {
         await seam.reload(nodeId);
     }
-    return { delivered, failed, skipped: plan.retired, unresolvable: plan.unresolvable };
+    return { delivered, failed, skipped: plan.retired, notOnHub: plan.notOnHub };
 }

package/dist/core/agent/agent-registry.service.js

@@ -281,6 +281,32 @@ class AgentRegistryService {
             return;
         await this.historyStore?.prunePackages(nodeId, [packageName]);
     }
+    /**
+     * The operator removed a whole PACKAGE from a node (`addons.uninstallPackage`
+     * with a `nodeId`, or `everywhere`). Same intent as
+     * {@link noteAddonUndeployed}, keyed by package — which is what an uninstall
+     * names, and the only key that still resolves once the hub itself no longer
+     * has the package. Emits one `AddonUninstalled` per addon removed, like the
+     * stale-addon reconcile does.
+     */
+    async notePackageUndeployed(nodeId, packageName, addonIds) {
+        if (AGENT_BOOTSTRAP_PACKAGES.has(packageName))
+            return;
+        await this.historyStore?.prunePackages(nodeId, [packageName]);
+        for (const addonId of addonIds) {
+            this.eventBus.emit({
+                id: (0, node_crypto_1.randomUUID)(),
+                timestamp: new Date(),
+                source: { type: 'core', id: 'agent-registry' },
+                category: types_1.EventCategory.AddonUninstalled,
+                data: { addonId, agentId: nodeId, packageName, reason: 'operator uninstall' },
+            });
+        }
+    }
+    /** The packages a node last declared (its intended set). `[]` with no store. */
+    async getRecordedPackages(nodeId) {
+        return this.historyStore ? this.historyStore.getPackages(nodeId) : [];
+    }
     /** Map an addon declaration id to the package that ships it, via the hub registry. */
     resolvePackageForAddon(addonId) {
         if (!this.addonRegistry)
@@ -744,9 +770,14 @@ class AgentRegistryService {
             retired: this.backfillTracker.retiredFor(agentId),
             hubVersions,
         });
-        if (planned.targets.length === 0 &&
-            planned.retired.length === 0 &&
-            planned.unresolvable.length === 0) {
+        // Never a delivery, and said so: an addon the hub no longer installs stays
+        // off the node even though the node once declared it (the stale sweep above
+        // removes a copy that is still there).
+        if (planned.notOnHub.length > 0) {
+            console.log(`[agent-registry] Back-fill ${agentId}: NOT delivering ${planned.notOnHub.join(', ')} — ` +
+                `in the node's declared roster but not installed on the hub`);
+        }
+        if (planned.targets.length === 0 && planned.retired.length === 0) {
             return;
         }
         // GATE 1 — the trigger allowlist. A pass that must not install says so and
@@ -773,7 +804,7 @@ class AgentRegistryService {
         const plan = await this.confirmBackfillTargets(agentId, planned);
         if (plan === null)
             return;
-        if (plan.targets.length === 0 && plan.retired.length === 0 && plan.unresolvable.length === 0) {
+        if (plan.targets.length === 0 && plan.retired.length === 0) {
             return;
         }
         // Hold the delivery window open for the whole pass, so the reload this
@@ -813,9 +844,6 @@ class AgentRegistryService {
         for (const name of outcome.skipped) {
             console.error(`[agent-registry] Back-fill ${agentId}: ${name} is still missing and RETIRED — the node is degraded until an operator intervenes`);
         }
-        for (const name of outcome.unresolvable) {
-            console.error(`[agent-registry] Back-fill ${agentId}: ${name} is missing but no version could be resolved (not installed on the hub, no version recorded) — not guessing "latest"`);
-        }
     }
     /**
      * Re-read the node's roster and drop every target the second read reports

package/dist/server-root/index.js

@@ -961,7 +961,6 @@ var require_dist = __commonJS({
     var import_node_url = require("url");
     var HOST_EXTERNAL_SPECIFIERS = [
       "@camstack/system",
-      "@camstack/shm-ring",
       "@camstack/types",
       "@camstack/sdk",
       "zod",

package/dist/single-copy-cleanup.js

@@ -189,7 +189,6 @@ exports.CLOSURE_PROVIDED_PACKAGES = [
     '@camstack/system',
     '@camstack/types',
     '@camstack/sdk',
-    '@camstack/shm-ring',
     '@camstack/ui-library',
 ];
 /**