@camstack/server 1.2.482 → 1.2.483

package/dist/agent/agent-infra-capabilities.js

@@ -40,8 +40,8 @@ exports.resolveAgentInfraCapabilities = resolveAgentInfraCapabilities;
  *
  * **To roll back:** set `CAMSTACK_AGENT_LOCAL_DATA_STORE=1` in the agent
  * container's environment and restart it. That restores `INFRA_CAPABILITIES`
- * EXACTLY — same entries, same order, same `required` flags — so the agent
- * boots its own `sqlite-settings` again and the data door resolves that engine
+ * EXACTLY (same entries, same order, same `required` flags) minus the hub-only
+ * `keychain`, which no flag brings to an agent — so the agent boots its own `sqlite-settings` again and the data door resolves that engine
  * instead of the hub (a local engine always wins over the remote; see
  * `data-store-dispatch.ts`). No redeploy, no revert, and the other two commits
  * in this series stay in place: commit 1 is inert whenever a local engine
@@ -56,6 +56,21 @@ const system_1 = require("@camstack/system");
 exports.AGENT_LOCAL_DATA_STORE_ENV = 'CAMSTACK_AGENT_LOCAL_DATA_STORE';
 /** The capability an agent no longer boots. */
 const DATA_STORE_PROVIDER = 'data-store-provider';
+/**
+ * The keychain (D787) is the HUB's, always — whatever the rollback flag says.
+ *
+ * Booting it on an agent was the bug that locked the hub on 2026-10-08: the
+ * agent's settings door forwards to the hub, so an agent's keychain wrote the
+ * `keychain:keys` row INTO THE HUB'S DATABASE while writing the master key to
+ * the AGENT's `<dataDir>/.keychain/master.key`. The Mac agent booted first,
+ * generated the key on the Mac, and the hub's next boot found a wrapped data
+ * key and no key file under `/data` — `key-missing`, locked. An agent-local
+ * keychain also shadowed `$hub-cap-fwd` for the agent's own forked addons, so
+ * their secrets resolved against a keychain that could only ever be locked.
+ *
+ * An agent reaches the keychain the way it reaches every hub cap: forwarded.
+ */
+const HUB_ONLY_INFRA = new Set(['keychain']);
 /**
  * Truthy spellings an operator actually types into a docker `-e`. Anything
  * else — including the empty string a declared-but-unset variable produces —
@@ -77,7 +92,6 @@ function isEnabled(raw) {
  * `INFRA_CAPABILITIES` itself is never touched: the hub reads the same array.
  */
 function resolveAgentInfraCapabilities(env) {
-    if (isEnabled(env[exports.AGENT_LOCAL_DATA_STORE_ENV]))
-        return system_1.INFRA_CAPABILITIES;
-    return system_1.INFRA_CAPABILITIES.filter((cap) => cap.name !== DATA_STORE_PROVIDER);
+    const keepLocalStore = isEnabled(env[exports.AGENT_LOCAL_DATA_STORE_ENV]);
+    return system_1.INFRA_CAPABILITIES.filter((cap) => !HUB_ONLY_INFRA.has(cap.name) && (keepLocalStore || cap.name !== DATA_STORE_PROVIDER));
 }

package/dist/api/trpc/generated-cap-routers.js

@@ -7235,6 +7235,51 @@ function createCapRouter_pipelineAnalytics(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.writeRetrainArchive(methodInput);
         }),
+        previewRetrainDataset: trpc_middleware_js_1.adminProcedure
+            .input(types_94.pipelineAnalyticsCapability.methods.previewRetrainDataset.input.loose())
+            .output(types_94.pipelineAnalyticsCapability.methods.previewRetrainDataset.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.previewRetrainDataset(methodInput);
+        }),
+        createRetrainDatasetVersion: trpc_middleware_js_1.adminProcedure
+            .input(types_94.pipelineAnalyticsCapability.methods.createRetrainDatasetVersion.input.loose())
+            .output(types_94.pipelineAnalyticsCapability.methods.createRetrainDatasetVersion.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.createRetrainDatasetVersion(methodInput);
+        }),
+        listRetrainDatasetVersions: trpc_middleware_js_1.adminProcedure
+            .input(types_94.pipelineAnalyticsCapability.methods.listRetrainDatasetVersions.input.loose())
+            .output(types_94.pipelineAnalyticsCapability.methods.listRetrainDatasetVersions.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listRetrainDatasetVersions(methodInput);
+        }),
+        deleteRetrainDatasetVersion: trpc_middleware_js_1.adminProcedure
+            .input(types_94.pipelineAnalyticsCapability.methods.deleteRetrainDatasetVersion.input.loose())
+            .output(types_94.pipelineAnalyticsCapability.methods.deleteRetrainDatasetVersion.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.deleteRetrainDatasetVersion(methodInput);
+        }),
+        verifyRetrainDatasetVersion: trpc_middleware_js_1.adminProcedure
+            .input(types_94.pipelineAnalyticsCapability.methods.verifyRetrainDatasetVersion.input.loose())
+            .output(types_94.pipelineAnalyticsCapability.methods.verifyRetrainDatasetVersion.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.verifyRetrainDatasetVersion(methodInput);
+        }),
         listRetrainAssistProfiles: trpc_middleware_js_1.adminProcedure
             .input(types_94.pipelineAnalyticsCapability.methods.listRetrainAssistProfiles.input.loose())
             .output(types_94.pipelineAnalyticsCapability.methods.listRetrainAssistProfiles.output)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.482",
+  "version": "1.2.483",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.355",
-    "@camstack/addon-agent-ui": "1.2.192",
+    "@camstack/addon-admin-ui": "1.2.356",
+    "@camstack/addon-agent-ui": "1.2.193",
     "@camstack/addon-auth": "1.2.132",
     "@camstack/addon-decoder-nodeav": "1.2.121",
     "@camstack/addon-notifiers": "1.2.128",
     "@camstack/addon-pipeline": "1.2.346",
     "@camstack/addon-pipeline-orchestrator": "1.2.298",
-    "@camstack/addon-post-analysis": "1.2.344",
+    "@camstack/addon-post-analysis": "1.2.345",
     "@camstack/sdk": "1.2.126",
-    "@camstack/system": "1.2.377",
-    "@camstack/types": "1.2.328",
-    "@camstack/ui-library": "1.2.250",
+    "@camstack/system": "1.2.378",
+    "@camstack/types": "1.2.329",
+    "@camstack/ui-library": "1.2.251",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",