@camstack/server 1.2.688 → 1.2.690

package/dist/api/trpc/trpc.router.js

@@ -254,7 +254,7 @@ function buildServerProviders(services) {
         integrations: wrap(() => (0, cap_providers_js_1.buildIntegrationsProvider)(services.addonRegistry, services.eventBus, services.loggingService, services.capabilityRegistry)),
         nodes: wrap(() => (0, cap_providers_js_1.buildNodesProvider)(services.agentRegistry, services.moleculer, services.addonRegistry, (0, cap_providers_js_1.createNodeRootPackageLookup)(services.moleculer, services.serverUpdateService), services.loggingService.createLogger('nodes'))),
         // server-management — runtime-updatable root package (phase 1: hub only).
-        'server-management': wrap(() => (0, server_management_provider_js_1.buildServerManagementProvider)(services.serverUpdateService)),
+        'server-management': wrap(() => (0, server_management_provider_js_1.buildServerManagementProvider)(services.serverUpdateService, path.resolve(process.env['CAMSTACK_DATA'] ?? 'camstack-data'))),
         addons: wrap((ctx) => (0, cap_providers_js_1.buildAddonsProvider)(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx, services.agentRegistry)),
         // webrtc-session — the resolved broker singleton, wrapped per request to
         // inject the server-read User-Agent into signaling attribution (the broker

package/dist/core/agent/agent-registry.service.js

@@ -418,27 +418,17 @@ class AgentRegistryService {
      * nothing re-announces it, and the operator has no reason to wait for a
      * timer they cannot see.
      *
-     * An ONLINE node is REFUSED: dropping a live node from the routing catalog
-     * would break every cap call pinned to it, and it re-registers on the next
-     * heartbeat anyway — "forget" of a live node is not a slow success, it is
-     * not a thing.
+     * An ONLINE node is forgotten too (operator ruling 2026-10-29, D966). The old refusal said a
+     * live node re-registers at once; since D857 its leaf is on the CRL, so it cannot. The order
+     * matters: (1) revoke (the revoker also closes the node's mutual-TLS sockets, because the CRL is
+     * only read at a handshake), (2) `disconnected` in the catalog, which unregisters its services and
+     * rejects the cap calls still waiting on it with `RequestRejectedError` - a bare `nodes.delete`
+     * would leave both behind, (3) the delete and the rest of the cleanup. The agent finds out on
+     * its own: refused at the next handshake, it asks the hub (`agent-membership-watch`) and resets
+     * to unpaired after two CA-signed `revoked` answers. `stillListed` is read back at the end, so a
+     * node that came straight back (revocation failed) is reported as listed, never as forgotten.
      */
     async forgetClusterNode(nodeId) {
-        if (this.isNodeOnline(nodeId)) {
-            const message = `Refused: ${nodeId} is ONLINE. Take the node down first — a live node re-registers immediately.`;
-            this.logger?.warn('forget cluster node refused', {
-                tags: { nodeId },
-                meta: { reason: 'node-online' },
-            });
-            return {
-                forgotten: false,
-                historyRemoved: false,
-                registryRemoved: false,
-                stillListed: true,
-                certificates: { outcome: 'not-attempted' },
-                message,
-            };
-        }
         // First: a forgotten node whose leaf stays valid walks back in on its next boot (D857).
         const certificates = await this.revokeForgottenNodeCertificates(nodeId);
         const historyOutcome = this.historyStore
@@ -446,6 +436,8 @@ class AgentRegistryService {
             : 'store-unavailable';
         // The mirror still lists the forgotten node: the next directory re-reads.
         this.historyMirror?.invalidate();
+        if (this.isNodeOnline(nodeId))
+            this.disconnectFromNodeCatalog(nodeId);
         const registryRemoved = this.removeFromNodeCatalog(nodeId);
         // Its intended set is gone with the row, so the back-fill breaker's memory
         // of failed deliveries to it is meaningless — drop it too.
@@ -499,6 +491,20 @@ class AgentRegistryService {
             message,
         };
     }
+    /**
+     * Take a LIVE node out of routing the way Moleculer does when its transport drops: services
+     * unregistered, pending requests rejected (typed, not left to time out). Idempotent.
+     */
+    disconnectFromNodeCatalog(nodeId) {
+        const nodes = this.nodeCatalogRegistry()?.nodes;
+        if (nodes?.disconnected === undefined) {
+            this.logger?.warn('cluster node catalog does not expose disconnected - calls may hang', {
+                tags: { nodeId },
+            });
+            return;
+        }
+        nodes.disconnected(nodeId, false);
+    }
     /** Is the node currently AVAILABLE in Moleculer's catalog? */
     isNodeOnline(nodeId) {
         return this.catalogNodeIds({ onlyAvailable: true }).includes(nodeId);
@@ -1173,7 +1179,8 @@ class AgentRegistryService {
             status: {
                 activeCameras: 0,
                 cpuPercent: status.cpuPercent ?? 0,
-                memoryPercent: status.memoryPercent ?? 0,
+                memoryPercent: typeof status.memoryPercent === 'number' ? status.memoryPercent : null,
+                processRssBytes: typeof status.processRssBytes === 'number' ? status.processRssBytes : null,
                 fps: {},
                 errors: [],
             },
@@ -1237,7 +1244,7 @@ class AgentRegistryService {
             status: {
                 activeCameras: 0,
                 cpuPercent: 0,
-                memoryPercent: 0,
+                memoryPercent: null,
                 fps: {},
                 errors: [],
             },
@@ -1254,7 +1261,7 @@ class AgentRegistryService {
         // The cap contract only exposes async snapshots; the cached read is cheap
         // because the addon's background sampler keeps the snapshot warm.
         let cpuPercent = 0;
-        let memoryPercent = 0;
+        let memoryPercent = null;
         const registry = this.capabilityService.getRegistry();
         if (registry) {
             const metricsProvider = registry.getSingleton('metrics-provider');
@@ -1283,6 +1290,7 @@ class AgentRegistryService {
                 activeCameras: 0,
                 cpuPercent,
                 memoryPercent,
+                processRssBytes: process.memoryUsage().rss,
                 fps: {},
                 errors: [],
             },

package/dist/core/moleculer/moleculer.service.js

@@ -759,6 +759,14 @@ class MoleculerService {
             // agents (non-retaining nodes).
             const hubChildRegistry = this.localChildRegistry;
             (0, system_1.setNodeEventInterest)(this.broker, () => hubChildRegistry.aggregateEventInterest());
+            // Producer-side suppression (D8): tell each forked child which categories
+            // someone else wants — siblings plus the hub's own in-process subscribers
+            // (the admin live stream is one) — so a high-frequency category nobody
+            // wants never leaves its process. Hub only: an agent cannot see the hub's
+            // subscribers, so its children keep sending everything. A remote node's
+            // interest in a ring-denied category is NOT visible here (ADR 0969).
+            hubChildRegistry.setEventInterestSource(() => (0, system_1.getLocalEventInterest)(this.broker));
+            (0, system_1.onLocalEventInterestChange)(this.broker, () => hubChildRegistry.refreshEventInterest());
         }
     }
     /**

package/dist/launch-args.js

@@ -0,0 +1,255 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOCATOR_ENV_DEFAULTS = exports.OVERRIDE_MAX_MB = exports.OVERRIDE_MIN_MB = exports.AGENT_HEAP_CAP_MB = exports.AGENT_HEAP_FLOOR_MB = exports.HEAP_CEILING_SOURCE_ENV = exports.LAUNCH_OVERRIDES_FILE = void 0;
+exports.computedAgentHeapMb = computedAgentHeapMb;
+exports.planLaunch = planLaunch;
+exports.renderLaunchPlan = renderLaunchPlan;
+exports.overridesPath = overridesPath;
+exports.readHeapOverrideMb = readHeapOverrideMb;
+exports.writeHeapOverrideMb = writeHeapOverrideMb;
+exports.readCgroupLimitBytes = readCgroupLimitBytes;
+exports.runLaunchCli = runLaunchCli;
+/**
+ * NODE LAUNCH ARGUMENTS — decided by the server closure, executed by the image.
+ *
+ * `node <closure>/dist/launch-args.js --role hub|agent [--allocator-env]` prints
+ * what the launcher should add to the node's command line, so the Docker
+ * entrypoint, the Electron shell and the Windows service supervisor carry NO copy
+ * of the formula: changing it (or a node's override) needs a closure update and a
+ * restart, never a new image or app.
+ *
+ * Zero dependencies (node built-ins only): it runs BEFORE the closure's own
+ * `node_modules` resolution, from either the active closure or the baked seed.
+ *
+ * ## Output (stdout, one record per line, `\n` separated)
+ *
+ *     arg --max-old-space-size=2048      an extra node argv entry (flags only)
+ *     env NAME=value                     an environment variable to export
+ *     source override|legacy-env|computed|v8-default
+ *     warn <free text>                   something the launcher should log
+ *
+ * Nothing else is printed. A launcher treats any line it does not recognise as
+ * absent, and a non-zero exit, a timeout or empty output as "no extra args".
+ *
+ * ## The heap ceiling
+ *
+ *  - `override` — `<dataDir>/launch-overrides.json` `{ "heapMb": N }`, set from
+ *    the hub (`serverManagement.setLaunchOverrides`) and persisted on the node.
+ *  - `legacy-env` — `CAMSTACK_HUB_HEAP_MB` (hub) / `CAMSTACK_AGENT_HEAP_MB`
+ *    (agent), still honoured when no override is set.
+ *  - `computed` — AGENT only: clamp(min(RAM, cgroup limit) / 4, 1536, 4096) MB.
+ *    V8's own quarter-of-RAM rule with a floor above every measured agent RSS
+ *    (0.8-1.4 GB), so it bounds a runaway and never a healthy root.
+ *  - `v8-default` — HUB only, nothing set: no flag. A hardcoded 1536 killed the
+ *    hub four times in 15 h (see the history in the Dockerfile); V8's default
+ *    here was 4288 MB and is still bounded.
+ *
+ * Set on argv, never NODE_OPTIONS: forked addon runners are sized separately.
+ */
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+exports.LAUNCH_OVERRIDES_FILE = 'launch-overrides.json';
+/** Env var carrying {@link CeilingSource} to the node so its heartbeat can say who chose. */
+exports.HEAP_CEILING_SOURCE_ENV = 'CAMSTACK_HEAP_CEILING_SOURCE';
+exports.AGENT_HEAP_FLOOR_MB = 1536;
+exports.AGENT_HEAP_CAP_MB = 4096;
+/** An override outside this range is ignored with a warning, never applied. */
+exports.OVERRIDE_MIN_MB = 512;
+exports.OVERRIDE_MAX_MB = 65536;
+/**
+ * The native allocator pair, welded: glibc reads MALLOC_ARENA_MAX once at malloc
+ * init, so it must exist before `exec node`; sharp restores libvips concurrency
+ * from 1 to `availableParallelism()` the moment it appears, so the pair travels
+ * together or not at all. Defaults only: an operator value already in the
+ * environment wins (the launcher applies them with `: "${NAME:=value}"` semantics).
+ */
+exports.ALLOCATOR_ENV_DEFAULTS = {
+    MALLOC_ARENA_MAX: '2',
+    VIPS_CONCURRENCY: '1',
+};
+const BYTES_PER_MB = 1024 * 1024;
+/** cgroup v1 reports "unlimited" as a value near 2^63. */
+const CGROUP_UNLIMITED_BYTES = 2 ** 60;
+function validMb(value) {
+    return Number.isInteger(value) && value >= exports.OVERRIDE_MIN_MB && value <= exports.OVERRIDE_MAX_MB;
+}
+/** The agent's computed ceiling for `host`, in MB. */
+function computedAgentHeapMb(host) {
+    const limits = [host.totalMemBytes, host.cgroupLimitBytes ?? Number.POSITIVE_INFINITY].filter((n) => Number.isFinite(n) && n > 0);
+    if (limits.length === 0)
+        return exports.AGENT_HEAP_FLOOR_MB;
+    const quarterMb = Math.floor(Math.min(...limits) / BYTES_PER_MB / 4);
+    return Math.min(exports.AGENT_HEAP_CAP_MB, Math.max(exports.AGENT_HEAP_FLOOR_MB, quarterMb));
+}
+function planLaunch(input) {
+    const warnings = [];
+    let source = input.role === 'agent' ? 'computed' : 'v8-default';
+    let heapMb = input.role === 'agent' ? computedAgentHeapMb(input.host) : null;
+    const legacy = input.legacyEnv;
+    if (legacy !== undefined && legacy !== '') {
+        const mb = /^[1-9][0-9]*$/.test(legacy) ? Number(legacy) : Number.NaN;
+        if (validMb(mb)) {
+            source = 'legacy-env';
+            heapMb = mb;
+        }
+        else {
+            warnings.push(`ignoring the legacy heap env "${legacy}": not an integer in ${exports.OVERRIDE_MIN_MB}-${exports.OVERRIDE_MAX_MB} MB`);
+        }
+    }
+    if (input.overrideMb !== null) {
+        if (validMb(input.overrideMb)) {
+            source = 'override';
+            heapMb = input.overrideMb;
+        }
+        else {
+            warnings.push(`ignoring the heap override ${input.overrideMb}: not an integer in ${exports.OVERRIDE_MIN_MB}-${exports.OVERRIDE_MAX_MB} MB`);
+        }
+    }
+    return {
+        args: heapMb === null ? [] : [`--max-old-space-size=${heapMb}`],
+        env: {
+            [exports.HEAP_CEILING_SOURCE_ENV]: source,
+            ...(input.allocatorEnv ? exports.ALLOCATOR_ENV_DEFAULTS : {}),
+        },
+        source,
+        warnings,
+    };
+}
+function renderLaunchPlan(plan) {
+    const lines = [
+        ...plan.args.map((a) => `arg ${a}`),
+        ...Object.entries(plan.env).map(([k, v]) => `env ${k}=${v}`),
+        `source ${plan.source}`,
+        ...plan.warnings.map((w) => `warn ${w.replace(/[\r\n]+/g, ' ')}`),
+    ];
+    return `${lines.join('\n')}\n`;
+}
+const realFs = {
+    readFile(file) {
+        try {
+            return fs.readFileSync(file, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    },
+};
+function overridesPath(dataDir) {
+    return path.join(dataDir, exports.LAUNCH_OVERRIDES_FILE);
+}
+/** The persisted heap override in MB; `null` when absent, unreadable or not a number. */
+function readHeapOverrideMb(dataDir, io = realFs) {
+    const raw = io.readFile(overridesPath(dataDir));
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || !('heapMb' in parsed))
+            return null;
+        const value = parsed.heapMb;
+        return typeof value === 'number' ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Persist (or, with `null`, clear) the heap override. Validated against the same
+ * range the launcher enforces, so a value the next launch would ignore is refused
+ * here instead of silently doing nothing. Written atomically (temp + rename).
+ */
+function writeHeapOverrideMb(dataDir, heapMb) {
+    const file = overridesPath(dataDir);
+    if (heapMb === null) {
+        fs.rmSync(file, { force: true });
+        return;
+    }
+    if (!validMb(heapMb)) {
+        throw new Error(`heap override must be an integer in ${exports.OVERRIDE_MIN_MB}-${exports.OVERRIDE_MAX_MB} MB, got ${heapMb}`);
+    }
+    fs.mkdirSync(dataDir, { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify({ heapMb })}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+function readCgroupLimitBytes(io = realFs, files) {
+    for (const file of files ?? [
+        '/sys/fs/cgroup/memory.max',
+        '/sys/fs/cgroup/memory/memory.limit_in_bytes',
+    ]) {
+        const raw = io.readFile(file)?.trim();
+        if (raw === undefined || !/^[0-9]+$/.test(raw))
+            continue;
+        const bytes = Number(raw);
+        if (bytes > 0 && bytes < CGROUP_UNLIMITED_BYTES)
+            return bytes;
+    }
+    return null;
+}
+function parseRole(argv) {
+    const i = argv.indexOf('--role');
+    const value = i >= 0 ? argv[i + 1] : undefined;
+    return value === 'hub' || value === 'agent' ? value : null;
+}
+/** Run the CLI; returns the stdout text and the exit code. Never throws. */
+function runLaunchCli(argv, deps) {
+    const role = parseRole(argv);
+    if (role === null)
+        return { stdout: '', code: 2 };
+    const dataDir = path.resolve(deps.env['CAMSTACK_DATA'] ?? 'camstack-data');
+    const legacyName = role === 'hub' ? 'CAMSTACK_HUB_HEAP_MB' : 'CAMSTACK_AGENT_HEAP_MB';
+    const plan = planLaunch({
+        role,
+        host: {
+            totalMemBytes: deps.totalMemBytes,
+            cgroupLimitBytes: readCgroupLimitBytes(deps.io, deps.cgroupFiles),
+        },
+        overrideMb: readHeapOverrideMb(dataDir, deps.io),
+        legacyEnv: deps.env[legacyName],
+        allocatorEnv: argv.includes('--allocator-env'),
+    });
+    return { stdout: renderLaunchPlan(plan), code: 0 };
+}
+if (require.main === module) {
+    const result = runLaunchCli(process.argv.slice(2), {
+        env: process.env,
+        io: realFs,
+        totalMemBytes: os.totalmem(),
+    });
+    process.stdout.write(result.stdout);
+    process.exitCode = result.code;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.688",
+  "version": "1.2.690",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -24,7 +24,8 @@
     "./package.json": "./package.json",
     "./main.js": "./dist/main.js",
     "./launcher.js": "./dist/launcher.js",
-    "./starter.js": "./dist/starter.js"
+    "./starter.js": "./dist/starter.js",
+    "./launch-args.js": "./dist/launch-args.js"
   },
   "scripts": {
     "build": "../../scripts/tsc7 -p tsconfig.build.json && tsup && node scripts/copy-closure-patches.mjs",
@@ -49,10 +50,10 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.516",
-    "@camstack/addon-agent-ui": "1.2.291",
+    "@camstack/addon-admin-ui": "1.2.518",
+    "@camstack/addon-agent-ui": "1.2.293",
     "@camstack/addon-auth": "1.2.170",
-    "@camstack/addon-benchmark": "1.2.290",
+    "@camstack/addon-benchmark": "1.2.292",
     "@camstack/addon-decoder-nodeav": "1.2.144",
     "@camstack/addon-notifiers": "1.2.623",
     "@camstack/addon-pipeline": "1.2.634",
@@ -60,9 +61,9 @@
     "@camstack/addon-post-analysis": "1.2.651",
     "@camstack/develop": "0.1.39",
     "@camstack/sdk": "1.2.154",
-    "@camstack/system": "1.2.517",
-    "@camstack/types": "1.2.443",
-    "@camstack/ui-library": "1.2.349",
+    "@camstack/system": "1.2.519",
+    "@camstack/types": "1.2.445",
+    "@camstack/ui-library": "1.2.351",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",