@camstack/server 1.2.687 → 1.2.688

package/dist/core/addon/addon-registry.service.js

@@ -402,6 +402,7 @@ class AddonRegistryService {
     activeSettingsBackend = null;
     integrationRegistry = null;
     clusterNodeHistoryStore = null;
+    nodeTombstoneStore = null;
     clusterAgentRecords = null;
     credentialTokenService = null;
     // Device architecture — in-memory registry of live IDevice instances.
@@ -1392,6 +1393,19 @@ class AddonRegistryService {
         const kind = records.kind(system_1.clusterNodeHistoryRecordKind);
         clusterStore.bindRecordsKind(() => kind);
     }
+    /** Durable node tombstones (#265) — bound to the `cluster-agent` records like the history. */
+    setNodeTombstoneStore(store) {
+        this.nodeTombstoneStore = store;
+        this.bindNodeTombstoneRecordsKind();
+    }
+    bindNodeTombstoneRecordsKind() {
+        const store = this.nodeTombstoneStore;
+        const records = this.clusterAgentRecords;
+        if (store === null || records === null)
+            return;
+        const kind = records.kind(system_1.clusterNodeTombstoneRecordKind);
+        store.bindRecordsKind(() => kind);
+    }
     /** The unified token store (D892), bound to its `core-auth` records. */
     setCredentialTokenService(service) {
         this.credentialTokenService = service;
@@ -1409,6 +1423,7 @@ class AddonRegistryService {
         await clusterRecords.declare(system_1.clusterAgentRecordKinds);
         this.clusterAgentRecords = clusterRecords;
         this.bindClusterNodeHistoryRecordsKind();
+        this.bindNodeTombstoneRecordsKind();
         const credentialTokens = this.credentialTokenService;
         if (credentialTokens !== null) {
             const coreRecords = this.recordsForOwner('core-auth', this.secretsForOwner('core-auth'));

package/dist/core/agent/agent-registry.service.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentRegistryService = exports.AGENT_BACKFILL_RPC_TIMEOUT_MS = void 0;
+exports.AgentRegistryService = exports.AGENT_BACKFILL_RPC_TIMEOUT_MS = exports.FORGOTTEN_NODE_REVOCATION_REASON = void 0;
 exports.toNodeLiveness = toNodeLiveness;
 exports.toDescriptor = toDescriptor;
 const node_crypto_1 = require("node:crypto");
@@ -45,6 +45,20 @@ const agent_delivery_ledger_1 = require("./agent-delivery-ledger");
 const agent_liveness_event_1 = require("./agent-liveness-event");
 const cluster_node_history_mirror_1 = require("./cluster-node-history-mirror");
 const node_directory_1 = require("./node-directory");
+/** The reason recorded on a certificate revoked because its node was forgotten. */
+exports.FORGOTTEN_NODE_REVOCATION_REASON = 'forgotten';
+function describeRevocation(revocation) {
+    switch (revocation.outcome) {
+        case 'not-attempted':
+            return '';
+        case 'revoked':
+            return ` ${revocation.serials.length} certificate(s) revoked - the node must be paired again.`;
+        case 'registry-unavailable':
+            return ' Its certificates were NOT revoked (the certificate registry is not loaded) - it can still reconnect.';
+        case 'failed':
+            return ` Its certificates were NOT revoked (${revocation.error}) - it can still reconnect.`;
+    }
+}
 /** Turn a forget outcome into the sentence the operator reads. */
 function describeForgetOutcome(nodeId, history, registryRemoved, stillListed) {
     const parts = [];
@@ -133,7 +147,11 @@ function toNodeLiveness(nodes) {
         // (seen live 2026-07-16 after agent churn): guard it or every consumer of
         // this projection 500s on `undefined.includes`.
         .filter((node) => typeof node.id === 'string' && !node.id.includes('/'))
-        .map((node) => ({ id: node.id, isHub: node.id === 'hub', isOnline: node.available })));
+        .map((node) => ({
+        id: node.id,
+        isHub: node.id === 'hub',
+        isOnline: node.available,
+    })));
 }
 /**
  * Project a live `AgentListItem` into the durable history descriptor. Field
@@ -245,6 +263,52 @@ class AgentRegistryService {
     setAddonRegistry(addonRegistry) {
         this.addonRegistry = addonRegistry;
     }
+    /**
+     * Wire what runs AFTER a node is really forgotten: the `node-removal-hook`
+     * dispatch and the hub-owned node-scoped data (#265). It never runs for a
+     * refused or a no-op forget.
+     */
+    setNodeRemovalCleanup(cleanup) {
+        this.nodeRemovalCleanup = cleanup;
+    }
+    nodeRemovalCleanup = null;
+    /**
+     * Wire the revocation of a forgotten node's mesh certificates (D857). Injected so this service
+     * never imports the pairing router; unwired reads as `registry-unavailable`.
+     */
+    setNodeCertificateRevoker(revoker) {
+        this.nodeCertificateRevoker = revoker;
+    }
+    nodeCertificateRevoker = null;
+    async revokeForgottenNodeCertificates(nodeId) {
+        let revocation;
+        try {
+            const serials = (await this.nodeCertificateRevoker?.(nodeId, exports.FORGOTTEN_NODE_REVOCATION_REASON)) ?? null;
+            revocation =
+                serials === null
+                    ? { outcome: 'registry-unavailable' }
+                    : { outcome: 'revoked', serials: [...serials] };
+        }
+        catch (err) {
+            revocation = {
+                outcome: 'failed',
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+        if (revocation.outcome === 'revoked') {
+            this.logger?.info('node forgotten: certificates revoked', {
+                tags: { nodeId },
+                meta: { serials: revocation.serials },
+            });
+        }
+        else {
+            this.logger?.warn('node forgotten: certificates were NOT revoked', {
+                tags: { nodeId },
+                meta: { outcome: revocation.outcome },
+            });
+        }
+        return revocation;
+    }
     /** Wire the durable offline-node history store (A1). */
     setClusterNodeHistoryStore(store) {
         this.historyStore = store;
@@ -300,7 +364,12 @@ class AgentRegistryService {
                 timestamp: new Date(),
                 source: { type: 'core', id: 'agent-registry' },
                 category: types_1.EventCategory.AddonUninstalled,
-                data: { addonId, agentId: nodeId, packageName, reason: 'operator uninstall' },
+                data: {
+                    addonId,
+                    agentId: nodeId,
+                    packageName,
+                    reason: 'operator uninstall',
+                },
             });
         }
     }
@@ -366,9 +435,12 @@ class AgentRegistryService {
                 historyRemoved: false,
                 registryRemoved: false,
                 stillListed: true,
+                certificates: { outcome: 'not-attempted' },
                 message,
             };
         }
+        // First: a forgotten node whose leaf stays valid walks back in on its next boot (D857).
+        const certificates = await this.revokeForgottenNodeCertificates(nodeId);
         const historyOutcome = this.historyStore
             ? await this.historyStore.forget(nodeId)
             : 'store-unavailable';
@@ -388,7 +460,8 @@ class AgentRegistryService {
         }));
         const historyRemoved = historyOutcome === 'removed';
         const stillListed = this.isNodeKnown(nodeId);
-        const message = describeForgetOutcome(nodeId, historyOutcome, registryRemoved, stillListed);
+        const message = describeForgetOutcome(nodeId, historyOutcome, registryRemoved, stillListed) +
+            describeRevocation(certificates);
         this.logger?.info('forget cluster node', {
             tags: { nodeId },
             meta: { historyOutcome, historyRemoved, registryRemoved, stillListed },
@@ -398,6 +471,17 @@ class AgentRegistryService {
         // operator had to refresh by hand. `TopologyEmitterService` listens for
         // `AgentUnregistered` and re-emits immediately.
         if (historyRemoved || registryRemoved) {
+            // The recorded fact the owners of node-scoped data are driven from. A
+            // failure here must not turn a forget that happened into an error.
+            try {
+                await this.nodeRemovalCleanup?.(nodeId, Date.now());
+            }
+            catch (err) {
+                this.logger?.warn('node removal cleanup failed', {
+                    tags: { nodeId },
+                    meta: { error: err instanceof Error ? err.message : String(err) },
+                });
+            }
             this.eventBus.emit({
                 id: (0, node_crypto_1.randomUUID)(),
                 timestamp: new Date(),
@@ -411,6 +495,7 @@ class AgentRegistryService {
             historyRemoved,
             registryRemoved,
             stillListed,
+            certificates,
             message,
         };
     }
@@ -481,7 +566,10 @@ class AgentRegistryService {
                     timestamp: new Date(),
                     source: { type: 'core', id: 'agent-registry' },
                     category: types_1.EventCategory.AgentOnline,
-                    data: { agentId: node.id, ...(nodeName !== undefined ? { nodeName } : {}) },
+                    data: {
+                        agentId: node.id,
+                        ...(nodeName !== undefined ? { nodeName } : {}),
+                    },
                 });
             }
             else {
@@ -807,7 +895,9 @@ class AgentRegistryService {
         if (priorRoster.length === 0) {
             this.logger?.info('back-fill: fresh node (no prior declared roster), plan from the hub any-node set', {
                 tags: { nodeId: agentId },
-                meta: { planned: planned.targets.map((t) => `${t.name}@${t.version}`) },
+                meta: {
+                    planned: planned.targets.map((t) => `${t.name}@${t.version}`),
+                },
             });
             for (const skip of planned.skipped) {
                 this.logger?.info('back-fill: fresh node not given a hub package', {

package/dist/core/agent/forgotten-node-revoker.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createForgottenNodeRevoker = createForgottenNodeRevoker;
+/**
+ * The hub's revocation of a FORGOTTEN node's mesh certificates (D857, #265).
+ *
+ * `AgentRegistryService.forgetClusterNode` is handed this as a seam so it never imports the
+ * pairing router; the revocation is the same one the operator's "unpair" performs
+ * (`revokeMeshCertificate`: every leaf of the node onto the CRL, its sockets cut) with the
+ * reason `forgotten`, which is what the node is told when it asks why it is refused.
+ */
+const system_1 = require("@camstack/system");
+function createForgottenNodeRevoker(deps) {
+    const registry = deps.registry ?? system_1.getProcessMeshCertificateRegistry;
+    const crl = deps.crl ?? system_1.processMeshCrl;
+    const peers = deps.peers ?? {
+        peerLeaf: (nodeId) => (0, system_1.getProcessPeerLeaf)(nodeId),
+        dropPeer: (nodeId) => (0, system_1.dropProcessPeer)(nodeId),
+    };
+    return async (nodeId, reason) => {
+        const loaded = registry();
+        if (loaded === null)
+            return null;
+        const result = await (0, system_1.revokeMeshCertificate)({
+            nodeId,
+            registry: loaded,
+            crl: crl(),
+            peers,
+            reason,
+            log: deps.logger,
+        });
+        return result.revokedSerials;
+    };
+}

package/dist/core/agent/node-removal-hooks.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeRemovalDispatcher = exports.NodeTombstoneStore = void 0;
+exports.registryNodeRemovalHooks = registryNodeRemovalHooks;
+exports.clearSingletonNodeOverrides = clearSingletonNodeOverrides;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const capability_preference_writes_1 = require("../../api/core/capability-preference-writes");
+/** Durable tombstones over the `cluster-agent` `node-tombstones` records kind. */
+class NodeTombstoneStore {
+    logger;
+    resolveKind;
+    constructor(logger, resolveKind = () => null) {
+        this.logger = logger;
+        this.resolveKind = resolveKind;
+    }
+    /** Hub wiring once the records provider is up. */
+    bindRecordsKind(resolver) {
+        this.resolveKind = resolver;
+    }
+    /** Record the forget. `false` = not persisted (kind unbound, or the write failed). */
+    async record(nodeId, removedAt, pending) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return false;
+        try {
+            await kind.put({ id: nodeId, at: removedAt, data: { removedAt, pending } });
+            return true;
+        }
+        catch (err) {
+            this.logger.warn('could not record node tombstone', {
+                tags: { nodeId },
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+            return false;
+        }
+    }
+    /** One implementer acknowledged: drop it from `pending`; delete the row when none is left. */
+    async acknowledge(nodeId, addonId) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return;
+        try {
+            const row = await kind.get(nodeId);
+            if (row === null)
+                return;
+            const pending = row.data.pending.filter((id) => id !== addonId);
+            if (pending.length === 0)
+                await kind.delete(nodeId);
+            else
+                await kind.put({ id: nodeId, at: row.data.removedAt, data: { ...row.data, pending } });
+        }
+        catch (err) {
+            this.logger.warn('could not acknowledge node tombstone', {
+                tags: { nodeId },
+                meta: { addonId, error: (0, types_1.errMsg)(err) },
+            });
+        }
+    }
+    /** Tombstones with an unacknowledged implementer. Unanswered read = none (a retry, never a delete). */
+    async listPending() {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return [];
+        try {
+            const out = [];
+            for (const row of await (0, system_1.readAllRows)(kind)) {
+                const parsed = system_1.ClusterNodeTombstoneBodySchema.safeParse(row.data);
+                if (parsed.success && parsed.data.pending.length > 0) {
+                    out.push({ nodeId: row.id, removedAt: parsed.data.removedAt, pending: parsed.data.pending });
+                }
+            }
+            return out;
+        }
+        catch (err) {
+            this.logger.warn('could not list node tombstones', { meta: { error: (0, types_1.errMsg)(err) } });
+            return [];
+        }
+    }
+}
+exports.NodeTombstoneStore = NodeTombstoneStore;
+const DEFAULT_ATTEMPTS = 3;
+class NodeRemovalDispatcher {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** A node was forgotten: record the tombstone, then tell every implementer. */
+    async nodeForgotten(nodeId, removedAt) {
+        const implementers = this.deps.hooks.implementers();
+        if (implementers.length === 0)
+            return { acknowledged: [], pending: [] };
+        const persisted = await this.deps.store.record(nodeId, removedAt, implementers);
+        if (!persisted) {
+            this.deps.logger.warn('node tombstone not persisted — implementers are told now but cannot be re-driven', { tags: { nodeId } });
+        }
+        return this.drive({ nodeId, removedAt, pending: implementers });
+    }
+    /** Re-drive every tombstone that still has a registered, unacknowledged implementer. */
+    async redrive() {
+        for (const tombstone of await this.deps.store.listPending()) {
+            await this.drive(tombstone);
+        }
+    }
+    async drive(tombstone) {
+        const { nodeId, removedAt } = tombstone;
+        const registered = new Set(this.deps.hooks.implementers());
+        const attempts = this.deps.maxAttempts ?? DEFAULT_ATTEMPTS;
+        const acknowledged = [];
+        const pending = [];
+        for (const addonId of tombstone.pending) {
+            if (!registered.has(addonId)) {
+                pending.push(addonId);
+                continue;
+            }
+            const done = await this.callWithRetries(addonId, { nodeId, removedAt }, attempts);
+            if (done) {
+                acknowledged.push(addonId);
+                await this.deps.store.acknowledge(nodeId, addonId);
+            }
+            else {
+                pending.push(addonId);
+            }
+        }
+        return { acknowledged, pending };
+    }
+    async callWithRetries(addonId, input, attempts) {
+        for (let attempt = 1; attempt <= attempts; attempt++) {
+            try {
+                const result = await this.deps.hooks.call(addonId, input);
+                this.deps.logger.info('node removal hook done', {
+                    tags: { nodeId: input.nodeId },
+                    meta: { addonId, counts: result.counts },
+                });
+                return true;
+            }
+            catch (err) {
+                this.deps.logger.warn('node removal hook failed', {
+                    tags: { nodeId: input.nodeId },
+                    meta: { addonId, attempt, attempts, error: (0, types_1.errMsg)(err) },
+                });
+            }
+        }
+        return false;
+    }
+}
+exports.NodeRemovalDispatcher = NodeRemovalDispatcher;
+const NODE_REMOVAL_HOOK_CAP = 'node-removal-hook';
+function isNodeRemovalHook(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof Reflect.get(value, 'onNodeRemoved') === 'function');
+}
+/** {@link NodeRemovalHooks} over the capability registry (keys include `addon@node`). */
+function registryNodeRemovalHooks(registry) {
+    return {
+        implementers: () => registry.getProviderAddonIds(NODE_REMOVAL_HOOK_CAP),
+        call: async (addonId, input) => {
+            const provider = registry.getProviderByAddonId(NODE_REMOVAL_HOOK_CAP, addonId);
+            if (!isNodeRemovalHook(provider)) {
+                throw new Error(`"${addonId}" no longer provides ${NODE_REMOVAL_HOOK_CAP}`);
+            }
+            return provider.onNodeRemoved(input);
+        },
+    };
+}
+/**
+ * A forgotten node leaves no per-node singleton override behind: for every
+ * singleton capability, the persisted preference is cleared FIRST, then the
+ * live override (the order `capabilities.clearSingletonNodeOverride` uses).
+ * Returns how many overrides were cleared. A failed write leaves that override
+ * in place and the error propagates — the caller reports it, nothing is hidden.
+ */
+async function clearSingletonNodeOverrides(nodeId, registry, config) {
+    let cleared = 0;
+    for (const cap of registry.listCapabilities()) {
+        if (cap.mode !== 'singleton')
+            continue;
+        if (!registry.getSingletonNodeOverrides(cap.name).has(nodeId))
+            continue;
+        await config.set((0, capability_preference_writes_1.singletonPreferenceKey)(cap.name, nodeId), null);
+        registry.clearSingletonNodeOverride(cap.name, nodeId);
+        cleared += 1;
+    }
+    return cleared;
+}

package/dist/main.js

@@ -59,6 +59,7 @@ const fastify_1 = require("@trpc/server/adapters/fastify");
 const ws_1 = require("@trpc/server/adapters/ws");
 const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
+const mesh_membership_routes_1 = require("./api/mesh-membership-routes");
 const auth_whoami_1 = require("./api/auth-whoami");
 const backup_download_js_1 = require("./api/backup-download.js");
 const cap_providers_1 = require("./api/core/cap-providers");
@@ -482,6 +483,10 @@ async function bootstrap() {
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
         console.log('[bootstrap] Auth whoami route registered at GET /api/auth/whoami');
+        // A refused (forgotten / unpaired) agent asks here whether it is still a member (D857).
+        (0, mesh_membership_routes_1.registerMeshMembershipRoutes)(fastify, {
+            logger: app.get(logging_service_1.LoggingService).createLogger('mesh-membership'),
+        });
     }
     catch (err) {
         console.warn('[bootstrap] Failed to register addon upload route:', err);
@@ -743,7 +748,10 @@ async function bootstrap() {
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
         (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify, {
             verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
-            limiter: (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE }),
+            limiter: (0, auth_rate_limit_1.createRateLimiter)({
+                windowMs: 60_000,
+                max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE,
+            }),
             network: authNetwork,
         });
     }
@@ -981,7 +989,9 @@ async function bootstrap() {
                 const um = capabilityRegistry.getSingleton('user-management');
                 return (0, second_factors_js_1.collectSecondFactors)({
                     ...(um && typeof um.getTotpStatus === 'function'
-                        ? { getTotpStatus: (input) => um.getTotpStatus(input) }
+                        ? {
+                            getTotpStatus: (input) => um.getTotpStatus(input),
+                        }
                         : {}),
                     passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(capabilityRegistry, app.get(moleculer_service_1.MoleculerService)),
                 }, userId, 'passkey');
@@ -1106,7 +1116,12 @@ async function bootstrap() {
                     const auth = await (0, addon_route_auth_js_1.authorizeAddonBearer)({
                         bearer: token,
                         verifier: addonVerifier,
-                        target: { addonId, method, access, share: dpMatch.endpoint.share ?? [] },
+                        target: {
+                            addonId,
+                            method,
+                            access,
+                            share: dpMatch.endpoint.share ?? [],
+                        },
                         facts: (0, trpc_context_1.requestFacts)(request),
                         logger: addonGateLogger,
                     });
@@ -1579,7 +1594,9 @@ async function bootstrap() {
     }
     const logger = app.get(logging_service_1.LoggingService).createLogger('System');
     const protocol = tlsOptions ? 'https' : 'http';
-    logger.info('CamStack server listening', { meta: { protocol, host, port, trpcRegistered } });
+    logger.info('CamStack server listening', {
+        meta: { protocol, host, port, trpcRegistered },
+    });
     // Certificate actions (Network → Local access) swap the served certificate
     // in place through this registration — without it an upload sat on disk
     // while the listener kept serving the boot-time leaf (D726).
@@ -1608,7 +1625,9 @@ async function bootstrap() {
             logger.info('LAN HTTP listening', { meta: { port: lanHttp.port } });
         }
         else if (lanHttp.error) {
-            logger.warn('LAN HTTP not bound', { meta: { error: lanHttp.error, port: lanHttp.port } });
+            logger.warn('LAN HTTP not bound', {
+                meta: { error: lanHttp.error, port: lanHttp.port },
+            });
         }
     }
     catch (err) {

package/dist/manual-boot.js

@@ -62,6 +62,8 @@ const addon_pages_service_1 = require("./core/addon-pages/addon-pages.service");
 const addon_widgets_service_1 = require("./core/addon-widgets/addon-widgets.service");
 const agent_registry_service_1 = require("./core/agent/agent-registry.service");
 const cluster_node_history_store_1 = require("./core/agent/cluster-node-history-store");
+const forgotten_node_revoker_1 = require("./core/agent/forgotten-node-revoker");
+const node_removal_hooks_1 = require("./core/agent/node-removal-hooks");
 const auth_service_1 = require("./core/auth/auth.service");
 const capability_service_1 = require("./core/capability/capability.service");
 const config_service_1 = require("./core/config/config.service");
@@ -163,6 +165,11 @@ async function bootManual(opts) {
     // Same post-construction reason: the cluster-node lifecycle (forget, catalog
     // removal) must leave a per-node line, and `console.log` is not a log store.
     agentRegistryService.setLogger(loggingService.createLogger('ClusterNodes'));
+    // Forgetting a node revokes its mesh certificates, so an old box that is powered on again
+    // is refused instead of walking back in (D857).
+    agentRegistryService.setNodeCertificateRevoker((0, forgotten_node_revoker_1.createForgottenNodeRevoker)({
+        logger: loggingService.createLogger('ClusterNodes'),
+    }));
     // A1: durable, routing-blind offline-node history — the `cluster-agent`
     // records kind, bound by the addon registry once the records provider is up
     // (unavailable until then, D902). Wired post-construction so the service's
@@ -170,6 +177,33 @@ async function bootManual(opts) {
     const clusterNodeHistoryStore = new cluster_node_history_store_1.ClusterNodeHistoryStore(loggingService.createLogger('cluster-node-history'));
     agentRegistryService.setClusterNodeHistoryStore(clusterNodeHistoryStore);
     addonRegistryService.setClusterNodeHistoryStore(clusterNodeHistoryStore);
+    // A forgotten node leaves no node-scoped data behind (#265): a tombstone is
+    // recorded, then every `node-removal-hook` implementer is told; the hub-owned
+    // per-node singleton overrides are cleared in the same step.
+    const nodeRemovalLogger = loggingService.createLogger('node-removal');
+    const nodeTombstoneStore = new node_removal_hooks_1.NodeTombstoneStore(nodeRemovalLogger);
+    addonRegistryService.setNodeTombstoneStore(nodeTombstoneStore);
+    const nodeRemovalDispatcher = new node_removal_hooks_1.NodeRemovalDispatcher({
+        hooks: (0, node_removal_hooks_1.registryNodeRemovalHooks)(addonRegistryService.getCapabilityRegistry()),
+        store: nodeTombstoneStore,
+        logger: nodeRemovalLogger,
+    });
+    agentRegistryService.setNodeRemovalCleanup(async (nodeId, removedAt) => {
+        const overrides = await (0, node_removal_hooks_1.clearSingletonNodeOverrides)(nodeId, addonRegistryService.getCapabilityRegistry(), configService);
+        if (overrides > 0) {
+            nodeRemovalLogger.info('cleared per-node singleton overrides of a forgotten node', {
+                tags: { nodeId },
+                meta: { overrides },
+            });
+        }
+        await nodeRemovalDispatcher.nodeForgotten(nodeId, removedAt);
+    });
+    // An implementer that was down at forget time is told once the addons are up.
+    eventBusService.subscribe({ category: types_1.EventCategory.SystemAddonsReady }, () => {
+        void nodeRemovalDispatcher.redrive().catch((err) => nodeRemovalLogger.warn('node removal re-drive failed', {
+            meta: { error: err instanceof Error ? err.message : String(err) },
+        }));
+    });
     // ---- Layer 4: need AddonRegistry ---------------------------------------
     // AddonWidgetsService — needs AddonRegistryService for the bundled-addon
     // dist sub-folder lookup (see service docstring).
@@ -210,7 +244,10 @@ async function bootManual(opts) {
             return (installed ?? (await addonPackageService.packPackage(name, version))).buffer;
         },
         deploy: async (nodeId, packageName, bundle) => {
-            await moleculerService.broker.call('$agent.deploy', { addonId: packageName, source: (0, addon_upload_1.buildHubHttpSource)(bundle, await resolveClusterBaseUrl()) }, { nodeID: nodeId, timeout: agent_registry_service_1.AGENT_BACKFILL_RPC_TIMEOUT_MS });
+            await moleculerService.broker.call('$agent.deploy', {
+                addonId: packageName,
+                source: (0, addon_upload_1.buildHubHttpSource)(bundle, await resolveClusterBaseUrl()),
+            }, { nodeID: nodeId, timeout: agent_registry_service_1.AGENT_BACKFILL_RPC_TIMEOUT_MS });
         },
         reload: async (nodeId) => {
             await moleculerService.broker.call('$agent.reload', {}, { nodeID: nodeId, timeout: agent_registry_service_1.AGENT_BACKFILL_RPC_TIMEOUT_MS });
@@ -281,7 +318,10 @@ async function bootManual(opts) {
                     expected: check.expected,
                     running: check.running,
                     failed: [...check.failed],
-                    refused: check.refused.map((r) => ({ runnerId: r.runnerId, reason: r.reason })),
+                    refused: check.refused.map((r) => ({
+                        runnerId: r.runnerId,
+                        reason: r.reason,
+                    })),
                     missing: [...check.missing],
                 },
             });
@@ -325,8 +365,7 @@ async function bootManual(opts) {
     // downloads this process makes anyway.
     const registryReachability = new registry_reachability_js_1.RegistryReachabilityTracker({
         logger: updateCheckLogger,
-        getAlerts: () => addonRegistryService.getCapabilityRegistry().getSingleton('alerts') ??
-            undefined,
+        getAlerts: () => addonRegistryService.getCapabilityRegistry().getSingleton('alerts') ?? undefined,
     });
     addonPackageService.setNpmReachabilityObserver({
         reached: () => registryReachability.reached('npm'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.687",
+  "version": "1.2.688",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -49,20 +49,20 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.515",
-    "@camstack/addon-agent-ui": "1.2.290",
+    "@camstack/addon-admin-ui": "1.2.516",
+    "@camstack/addon-agent-ui": "1.2.291",
     "@camstack/addon-auth": "1.2.170",
-    "@camstack/addon-benchmark": "1.2.289",
+    "@camstack/addon-benchmark": "1.2.290",
     "@camstack/addon-decoder-nodeav": "1.2.144",
     "@camstack/addon-notifiers": "1.2.623",
     "@camstack/addon-pipeline": "1.2.634",
-    "@camstack/addon-pipeline-orchestrator": "1.2.638",
-    "@camstack/addon-post-analysis": "1.2.650",
+    "@camstack/addon-pipeline-orchestrator": "1.2.639",
+    "@camstack/addon-post-analysis": "1.2.651",
     "@camstack/develop": "0.1.39",
     "@camstack/sdk": "1.2.154",
-    "@camstack/system": "1.2.516",
-    "@camstack/types": "1.2.442",
-    "@camstack/ui-library": "1.2.348",
+    "@camstack/system": "1.2.517",
+    "@camstack/types": "1.2.443",
+    "@camstack/ui-library": "1.2.349",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",