@camstack/server 1.2.566 → 1.2.568

package/dist/agent/agent-node-certificates.js

@@ -10,7 +10,8 @@ exports.createAgentNodeCertificates = createAgentNodeCertificates;
  * leaves it) and keeps it in memory only. When the signed leaf arrives it is persisted
  * into `agent.json` (0600) BESIDE the old one (`meshTlsPrevious`) together with the
  * swap's state (`meshSwap`: which leaf, until when), then the agent reconnects through
- * the same `reconnect()` the UI uses, which rebuilds the broker from the file.
+ * the same `reconnect()` the UI uses, which replaces the broker transport from the file
+ * (the broker, its services and its child runners stay).
  *
  * A swap is PENDING from install until the hub confirms. Only while it is pending may
  * the node go back, and only to a previous leaf that is still unexpired:

package/dist/agent/main.js

@@ -213,7 +213,7 @@ async function startAgent(configPath) {
     // The HTTP/HTTPS listener on the agent port (D856); set once it is up.
     let agentHttpListener = null;
     console.log(`[Agent] Mesh transport: ${currentMeshTls !== null ? 'tls' : 'clear'}`);
-    let broker = (0, system_1.createBroker)({
+    const broker = (0, system_1.createBroker)({
         nodeID: config.nodeId,
         mode: 'agent',
         hubAddress: config.hubAddress,
@@ -223,32 +223,40 @@ async function startAgent(configPath) {
     });
     meshJoin.attach(broker);
     /**
-     * Reconnect: stop the current broker, reload config from file,
-     * create a new broker with the updated hub/secret, and restart.
-     * The HTTP server stays alive throughout.
+     * Reconnect: reload the config from file and replace the broker's TRANSPORT (the new hub
+     * address, secret or mesh leaf) IN PLACE. The broker itself is never rebuilt: its services
+     * (`$agent`, `$process`, `$agent-cap-fwd`, the event bus, the addon services), its registries and
+     * the forked child runners all outlive the wire. Rebuilding the broker stopped `$process`, which
+     * SIGTERMed every runner, and left the node capless with no `$agent-cap-fwd` (D856 amendment,
+     * 2026-10-15 incident). The HTTP server stays alive throughout.
      */
     // ONE reconnect at a time (serial-queue.ts): the UI, a mesh leaf swap and its rollback can
-    // all ask for one, and two interleaved stop/rebuild cycles would leave two brokers or none.
+    // all ask for one, and two interleaved disconnect/connect cycles would leave two wires or none.
     const reconnect = (0, serial_queue_js_1.createSerialQueue)(() => reconnectNow(), {
         deadlineMs: RECONNECT_DEADLINE_MS,
         onTimeout: () => {
-            // A broker whose start() never settles must not hold every later reconnect (including
-            // the rollback of a failed leaf swap): tear down what was half-built and move on.
-            consoleLogger.error('Reconnect did not finish in time - destroying the half-built broker', {
+            // A transport whose connect never settles must not hold every later reconnect (including
+            // the rollback of a failed leaf swap): drop the wire and move on. The broker, and the
+            // runners behind it, stay.
+            consoleLogger.error('Reconnect did not finish in time - dropping the half-connected transport', {
                 meta: { deadlineMs: RECONNECT_DEADLINE_MS },
             });
-            void broker.stop().catch(() => undefined);
+            void (0, system_1.disconnectBrokerTransport)(broker).catch(() => undefined);
         },
     });
     // The cycle itself runs through a generation guard: a run the queue abandoned at its deadline
-    // that resumes later builds nothing (agent-reconnect.ts), so two brokers never share a node id.
+    // that resumes later installs nothing (agent-reconnect.ts), so two transports never share a broker.
     let pendingConfig = null;
     const reconnectNow = (0, agent_reconnect_js_1.createReconnectRunner)({
-        current: () => broker,
-        assign: (next) => {
-            broker = next;
+        current: () => (0, system_1.currentBrokerTransporter)(broker),
+        assign: (next) => (0, system_1.installBrokerTransporter)(broker, next),
+        stop: async (target) => {
+            // Only the transport installed right now: a late, abandoned run must not tear down a
+            // newer run's transport.
+            if ((0, system_1.isInstalledTransporter)(broker, target)) {
+                await (0, system_1.disconnectBrokerTransport)(broker);
+            }
         },
-        stop: (target) => target.stop(),
         prepare: () => {
             console.log('[Agent] Reconnecting with updated config...');
             // Reload config from file (UI may have written new hubAddress/secret)
@@ -274,24 +282,21 @@ async function startAgent(configPath) {
             const fresh = pendingConfig;
             if (fresh === null)
                 throw new Error('reconnect: no configuration was prepared');
-            const next = (0, system_1.createBroker)({
+            return (0, system_1.buildTransporter)((0, system_1.createAgentTransport)({
                 nodeID: config.nodeId,
                 mode: 'agent',
                 hubAddress: fresh.hubAddress,
                 logLevel: fresh.logLevel,
-                middlewares: meshJoin.middlewares,
                 ...(currentMeshTls !== null ? { meshTls: currentMeshTls } : {}),
-            });
-            meshJoin.attach(next);
-            return next;
+            }));
         },
-        // The new broker's hub connection runs a join, and its settle re-sends
-        // the manifest (`registration.onJoinSettled`).
-        start: async (next) => {
-            await next.start();
+        // The new wire's hub connection runs a join, and its settle re-sends the manifest
+        // (`registration.onJoinSettled`): the subtree union, every child included (D3).
+        start: async () => {
+            await (0, system_1.connectBrokerTransport)(broker);
             console.log('[Agent] Reconnected successfully');
         },
-        onSuperseded: (stage) => consoleLogger.warn('A superseded reconnect stopped without building a second broker', {
+        onSuperseded: (stage) => consoleLogger.warn('A superseded reconnect stopped without installing a second transport', {
             meta: { stage },
         }),
     });

package/dist/api/core/certificates.router.js

@@ -461,6 +461,7 @@ function createCertificatesRouter(deps) {
                 crl: crl(),
                 peers,
                 registrations,
+                ...(deps.nodeAddonIds !== undefined ? { expectedAddons: deps.nodeAddonIds } : {}),
                 log: deps.log,
                 ...(deps.reconnectTimeoutMs !== undefined
                     ? { reconnectTimeoutMs: deps.reconnectTimeoutMs }

package/dist/api/trpc/generated-cap-mounts.js

@@ -2,7 +2,7 @@
 // AUTO-GENERATED by scripts/generate-cap-mounts.ts — DO NOT EDIT
 // Re-run: npx tsx scripts/generate-cap-mounts.ts
 //
-// Mounted: 169    Skipped (legacy): 3
+// Mounted: 170    Skipped (legacy): 3
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGACY_SHAPE_SKIP = void 0;
 exports.mountAllCaps = mountAllCaps;
@@ -208,6 +208,7 @@ function mountAllCaps(services) {
             };
         }, remoteCapProxy),
         deviceExtension: (0, generated_cap_routers_js_1.createCapRouter_deviceExtension)((_ctx) => (0, device_collection_dispatch_js_1.requireDeviceCollection)(reg, 'device-extension'), remoteCapProxy),
+        deviceHistory: (0, generated_cap_routers_js_1.createCapRouter_deviceHistory)((_ctx) => reg?.getSingleton('device-history') ?? null, remoteCapProxy),
         deviceManager: (0, generated_cap_routers_js_1.createCapRouter_deviceManager)((_ctx) => reg?.getSingleton('device-manager') ?? null, remoteCapProxy),
         deviceOps: (0, generated_cap_routers_js_1.createCapRouter_deviceOps)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'device-ops'), remoteCapProxy),
         deviceProvider: (0, generated_cap_routers_js_1.createCapRouter_deviceProvider)((_ctx, addonId) => {