@camstack/server 1.2.8 → 1.2.9

package/dist/core/addon/addon-package.service.js

@@ -33,7 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AddonPackageService = exports.FRAMEWORK_PACKAGES = exports.SYSTEM_PACKAGE = void 0;
+exports.AddonPackageService = exports.FRAMEWORK_PACKAGES = exports.AUTO_UPDATE_EXCLUDED_PACKAGES = exports.SYSTEM_PACKAGE = void 0;
+exports.isVersionNewer = isVersionNewer;
 exports.isFrameworkPackage = isFrameworkPackage;
 exports.extractTgzStripped = extractTgzStripped;
 const fs = __importStar(require("node:fs"));
@@ -51,6 +52,53 @@ const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
  * export because `lifecycle-job-runner` + several tests reference it directly.
  */
 exports.SYSTEM_PACKAGE = '@camstack/system';
+/**
+ * Packages the npm auto-updater must NEVER touch: the framework/system tier
+ * ships exclusively via `applyServerUpdate` (single-copy collapse). Listed
+ * explicitly (not via a manifest flag) because the updater runs against
+ * `listInstalled()` package names before any manifest is loaded.
+ */
+exports.AUTO_UPDATE_EXCLUDED_PACKAGES = new Set([
+    exports.SYSTEM_PACKAGE,
+    '@camstack/types',
+    '@camstack/kernel',
+    '@camstack/core',
+    '@camstack/sdk',
+    '@camstack/ui-library',
+    '@camstack/server',
+]);
+/**
+ * True when `target` is a STRICTLY newer semver than `current`. Minimal
+ * x.y.z(-prerelease) comparator — our registry versions are plain publishes,
+ * and a dedicated semver dependency isn't declared in this package. Numeric
+ * triples compare first; a prerelease ranks BELOW its release (1.2.6-dev <
+ * 1.2.6); when both carry prereleases they compare lexicographically.
+ * Unparseable versions are never "newer" (fail safe: no update).
+ */
+function isVersionNewer(target, current) {
+    const parse = (v) => {
+        const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(v.trim());
+        if (!m)
+            return null;
+        return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
+    };
+    const t = parse(target);
+    const c = parse(current);
+    if (!t || !c)
+        return false;
+    for (let i = 0; i < 3; i += 1) {
+        if (t.nums[i] !== c.nums[i])
+            return t.nums[i] > c.nums[i];
+    }
+    // Same triple: release > prerelease; two prereleases compare lexically.
+    if (t.pre === null && c.pre !== null)
+        return true;
+    if (t.pre !== null && c.pre === null)
+        return false;
+    if (t.pre !== null && c.pre !== null)
+        return t.pre > c.pre;
+    return false;
+}
 /**
  * Host-provided framework packages that take a special path through
  * `camstack deploy` (the addon-upload route) instead of the normal
@@ -1145,6 +1193,13 @@ class AddonPackageService {
         const targets = [];
         for (const pkg of installed) {
             try {
+                // Framework packages NEVER auto-update from npm — they ship via
+                // `applyServerUpdate` (single-copy collapse). The engine already
+                // skipped a swept framework target; excluding it here also kills the
+                // useless candidate churn that participated in the 2026-07-22 hub
+                // wedge (mass staged swap right after a publish train).
+                if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(pkg.name))
+                    continue;
                 // Determine effective channel for this addon
                 const addonId = pkg.name.replace('@camstack/addon-', '').replace('@camstack/', '');
                 const override = this.autoUpdateConfig.overrides[addonId];
@@ -1165,7 +1220,13 @@ class AddonPackageService {
                 const targetVersion = effectiveChannel === 'beta'
                     ? asString(distTags['beta']) || asString(distTags['latest'])
                     : asString(distTags['latest']);
-                if (!targetVersion || targetVersion === pkg.version)
+                // FORWARD-ONLY: update only when the registry advertises a STRICTLY
+                // NEWER semver. The old `!==` comparison happily "updated" BACKWARD —
+                // on 2026-07-22 it replaced same-day CLI-deployed builds (labelled
+                // with the older workspace version) with the freshly published npm
+                // artifacts, rolling back live fixes. A dev build whose label equals
+                // or exceeds the npm tag is left alone.
+                if (!targetVersion || !isVersionNewer(targetVersion, pkg.version))
                     continue;
                 this.logger.info('Auto-update candidate', {
                     meta: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.8",
+  "version": "1.2.9",
   "private": false,
   "files": [
     "dist",
@@ -39,13 +39,13 @@
     "@camstack/addon-auth": "1.2.4",
     "@camstack/addon-decoder-nodeav": "1.2.4",
     "@camstack/addon-notifiers": "1.2.4",
-    "@camstack/addon-pipeline": "1.2.6",
-    "@camstack/addon-pipeline-orchestrator": "1.2.7",
-    "@camstack/addon-post-analysis": "1.2.6",
+    "@camstack/addon-pipeline": "1.2.7",
+    "@camstack/addon-pipeline-orchestrator": "1.2.8",
+    "@camstack/addon-post-analysis": "1.2.7",
     "@camstack/sdk": "1.2.4",
     "@camstack/shm-ring": "1.1.4",
-    "@camstack/system": "1.2.7",
-    "@camstack/types": "1.2.7",
+    "@camstack/system": "1.2.8",
+    "@camstack/types": "1.2.8",
     "@camstack/ui-library": "1.2.5",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",