@camstack/server 1.2.8 → 1.2.10

package/dist/core/addon/addon-package.service.js

@@ -33,7 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AddonPackageService = exports.FRAMEWORK_PACKAGES = exports.SYSTEM_PACKAGE = void 0;
+exports.AddonPackageService = exports.FRAMEWORK_PACKAGES = exports.AUTO_UPDATE_EXCLUDED_PACKAGES = exports.SYSTEM_PACKAGE = void 0;
+exports.isVersionNewer = isVersionNewer;
 exports.isFrameworkPackage = isFrameworkPackage;
 exports.extractTgzStripped = extractTgzStripped;
 const fs = __importStar(require("node:fs"));
@@ -51,6 +52,53 @@ const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
  * export because `lifecycle-job-runner` + several tests reference it directly.
  */
 exports.SYSTEM_PACKAGE = '@camstack/system';
+/**
+ * Packages the npm auto-updater must NEVER touch: the framework/system tier
+ * ships exclusively via `applyServerUpdate` (single-copy collapse). Listed
+ * explicitly (not via a manifest flag) because the updater runs against
+ * `listInstalled()` package names before any manifest is loaded.
+ */
+exports.AUTO_UPDATE_EXCLUDED_PACKAGES = new Set([
+    exports.SYSTEM_PACKAGE,
+    '@camstack/types',
+    '@camstack/kernel',
+    '@camstack/core',
+    '@camstack/sdk',
+    '@camstack/ui-library',
+    '@camstack/server',
+]);
+/**
+ * True when `target` is a STRICTLY newer semver than `current`. Minimal
+ * x.y.z(-prerelease) comparator — our registry versions are plain publishes,
+ * and a dedicated semver dependency isn't declared in this package. Numeric
+ * triples compare first; a prerelease ranks BELOW its release (1.2.6-dev <
+ * 1.2.6); when both carry prereleases they compare lexicographically.
+ * Unparseable versions are never "newer" (fail safe: no update).
+ */
+function isVersionNewer(target, current) {
+    const parse = (v) => {
+        const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(v.trim());
+        if (!m)
+            return null;
+        return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
+    };
+    const t = parse(target);
+    const c = parse(current);
+    if (!t || !c)
+        return false;
+    for (let i = 0; i < 3; i += 1) {
+        if (t.nums[i] !== c.nums[i])
+            return t.nums[i] > c.nums[i];
+    }
+    // Same triple: release > prerelease; two prereleases compare lexically.
+    if (t.pre === null && c.pre !== null)
+        return true;
+    if (t.pre !== null && c.pre === null)
+        return false;
+    if (t.pre !== null && c.pre !== null)
+        return t.pre > c.pre;
+    return false;
+}
 /**
  * Host-provided framework packages that take a special path through
  * `camstack deploy` (the addon-upload route) instead of the normal
@@ -1145,6 +1193,13 @@ class AddonPackageService {
         const targets = [];
         for (const pkg of installed) {
             try {
+                // Framework packages NEVER auto-update from npm — they ship via
+                // `applyServerUpdate` (single-copy collapse). The engine already
+                // skipped a swept framework target; excluding it here also kills the
+                // useless candidate churn that participated in the 2026-07-22 hub
+                // wedge (mass staged swap right after a publish train).
+                if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(pkg.name))
+                    continue;
                 // Determine effective channel for this addon
                 const addonId = pkg.name.replace('@camstack/addon-', '').replace('@camstack/', '');
                 const override = this.autoUpdateConfig.overrides[addonId];
@@ -1165,7 +1220,13 @@ class AddonPackageService {
                 const targetVersion = effectiveChannel === 'beta'
                     ? asString(distTags['beta']) || asString(distTags['latest'])
                     : asString(distTags['latest']);
-                if (!targetVersion || targetVersion === pkg.version)
+                // FORWARD-ONLY: update only when the registry advertises a STRICTLY
+                // NEWER semver. The old `!==` comparison happily "updated" BACKWARD —
+                // on 2026-07-22 it replaced same-day CLI-deployed builds (labelled
+                // with the older workspace version) with the freshly published npm
+                // artifacts, rolling back live fixes. A dev build whose label equals
+                // or exceeds the npm tag is left alone.
+                if (!targetVersion || !isVersionNewer(targetVersion, pkg.version))
                     continue;
                 this.logger.info('Auto-update candidate', {
                     meta: {

package/dist/core/addon/addon-registry.service.js

@@ -1225,11 +1225,11 @@ class AddonRegistryService {
         if (initResult?.customActions && initResult.actionHandlers) {
             const handlers = initResult.actionHandlers;
             try {
-                this.customActionRegistry.registerAddon(id, initResult.customActions, (action, input) => {
+                this.customActionRegistry.registerAddon(id, initResult.customActions, (action, input, caller) => {
                     const fn = handlers[action];
                     if (!fn)
                         throw new Error(`addon '${id}' has no handler for custom action '${action}'`);
-                    return fn(input);
+                    return fn(input, caller);
                 });
             }
             catch (err) {
@@ -2987,7 +2987,7 @@ class AddonRegistryService {
             });
             return;
         }
-        this.customActionRegistry.registerAddon(addonId, catalog, (action, input) => this.dispatchForkedCustomAction(addonId, action, input));
+        this.customActionRegistry.registerAddon(addonId, catalog, (action, input, caller) => this.dispatchForkedCustomAction(addonId, action, input, caller));
         this.logger.info('Runner addon custom actions registered', {
             tags: { addonId },
             meta: { runnerId },
@@ -2999,11 +2999,15 @@ class AddonRegistryService {
      * routing + the child-availability error; there is no broker fallback after
      * the per-addon Moleculer broker was removed.
      */
-    async dispatchForkedCustomAction(addonId, action, input) {
+    async dispatchForkedCustomAction(addonId, action, input, caller) {
         return this.addonCallGateway.callForked(addonId, {
             target: 'custom',
             action,
             args: input,
+            // Additive: only carry `caller` when the hub actually forwarded one (the
+            // router populates it exclusively for a `caller:'required'` action of an
+            // authenticated request). Never blanket; never from client input.
+            ...(caller ? { caller } : {}),
         });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "private": false,
   "files": [
     "dist",
@@ -33,20 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.6",
-    "@camstack/addon-advanced-notifier": "1.2.4",
+    "@camstack/addon-admin-ui": "1.2.7",
     "@camstack/addon-agent-ui": "1.2.4",
     "@camstack/addon-auth": "1.2.4",
     "@camstack/addon-decoder-nodeav": "1.2.4",
-    "@camstack/addon-notifiers": "1.2.4",
-    "@camstack/addon-pipeline": "1.2.6",
-    "@camstack/addon-pipeline-orchestrator": "1.2.7",
-    "@camstack/addon-post-analysis": "1.2.6",
+    "@camstack/addon-notifiers": "1.2.5",
+    "@camstack/addon-pipeline": "1.2.8",
+    "@camstack/addon-pipeline-orchestrator": "1.2.9",
+    "@camstack/addon-post-analysis": "1.2.8",
     "@camstack/sdk": "1.2.4",
     "@camstack/shm-ring": "1.1.4",
-    "@camstack/system": "1.2.7",
-    "@camstack/types": "1.2.7",
-    "@camstack/ui-library": "1.2.5",
+    "@camstack/system": "1.2.9",
+    "@camstack/types": "1.2.9",
+    "@camstack/ui-library": "1.2.6",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/api/addons-custom.router.js

@@ -1,91 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAddonsCustomProcedures = createAddonsCustomProcedures;
-/**
- * `api.addons.custom` — generic dispatcher for addon-defined custom actions.
- *
- * Task 7.2 of the device-proxy redesign. Addons declare a catalog of
- * custom actions at boot via `AddonInitResult.customActions` + a single
- * `handleCustomAction(action, input)` handler. The catalog is registered
- * with a per-process `CustomActionRegistry` (Task 7.1). This endpoint is
- * the single tRPC entry point that resolves an `(addonId, action)` pair,
- * validates input + output against the action's Zod schemas, enforces the
- * action's declared auth level, and dispatches to the addon handler.
- *
- * The factory returns a record of procedures (not a router) so the caller
- * can spread it into the existing `addons` namespace:
- *
- *   trpcRouter({
- *     ...existingAddonsProcedures,
- *     ...createAddonsCustomProcedures({ getCustomActionRegistry: ... }),
- *   })
- *
- * This avoids `mergeRouters` (which requires sharing the `t` instance
- * across modules) while still mounting the procedure at `api.addons.custom`.
- */
-const zod_1 = require("zod");
-const server_1 = require("@trpc/server");
-const trpc_middleware_js_1 = require("./trpc/trpc.middleware.js");
-/**
- * Build the procedure record for the `custom` endpoint.
- *
- * The OUTER procedure is `protectedProcedure` — every caller must be
- * authenticated. The INNER per-action auth declared in `spec.auth` is
- * enforced manually by `ensureAuth` because the auth level is not known
- * until after the registry lookup.
- */
-function createAddonsCustomProcedures(deps) {
-    return {
-        custom: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            addonId: zod_1.z.string().min(1),
-            action: zod_1.z.string().min(1),
-            input: zod_1.z.unknown(),
-        }))
-            .output(zod_1.z.unknown())
-            .mutation(async ({ input, ctx }) => {
-            const registry = deps.getCustomActionRegistry();
-            const entry = registry.resolve(input.addonId, input.action);
-            if (!entry) {
-                throw new server_1.TRPCError({
-                    code: 'NOT_FOUND',
-                    message: `addon '${input.addonId}' has no custom action '${input.action}'`,
-                });
-            }
-            // Per-action authorization. The outer procedure already requires
-            // authentication; here we additionally enforce the declared role
-            // when it's stricter than 'protected'.
-            ensureAuth(ctx, entry.spec.auth);
-            // Validate input against the action's declared Zod schema.
-            const parsedInput = entry.spec.input.parse(input.input);
-            // Dispatch through the addon handler.
-            const result = await entry.handler(parsedInput);
-            // Validate the addon's output. Crash-early on misbehaving addons.
-            return entry.spec.output.parse(result);
-        }),
-    };
-}
-/**
- * Enforce the action's declared auth level.
- *
- * Mirrors the role checks performed by `protectedProcedure` and
- * `adminProcedure` in trpc.middleware.ts:
- *   - public:    no auth
- *   - protected: any authenticated user
- *   - admin:     isAdmin only (scoped tokens bounce)
- */
-function ensureAuth(ctx, level) {
-    if (level === 'public')
-        return;
-    if (!ctx.user) {
-        throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
-    }
-    if (level === 'protected')
-        return;
-    if (level === 'admin') {
-        if (!ctx.user.isAdmin) {
-            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'custom action requires admin' });
-        }
-        return;
-    }
-}