@camstack/server 1.2.89 → 1.2.91

package/dist/api/addons-custom.router.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAddonsCustomProcedures = createAddonsCustomProcedures;
+/**
+ * `api.addons.custom` — generic dispatcher for addon-defined custom actions.
+ *
+ * Task 7.2 of the device-proxy redesign. Addons declare a catalog of
+ * custom actions at boot via `AddonInitResult.customActions` + a single
+ * `handleCustomAction(action, input)` handler. The catalog is registered
+ * with a per-process `CustomActionRegistry` (Task 7.1). This endpoint is
+ * the single tRPC entry point that resolves an `(addonId, action)` pair,
+ * validates input + output against the action's Zod schemas, enforces the
+ * action's declared auth level, and dispatches to the addon handler.
+ *
+ * The factory returns a record of procedures (not a router) so the caller
+ * can spread it into the existing `addons` namespace:
+ *
+ *   trpcRouter({
+ *     ...existingAddonsProcedures,
+ *     ...createAddonsCustomProcedures({ getCustomActionRegistry: ... }),
+ *   })
+ *
+ * This avoids `mergeRouters` (which requires sharing the `t` instance
+ * across modules) while still mounting the procedure at `api.addons.custom`.
+ */
+const zod_1 = require("zod");
+const server_1 = require("@trpc/server");
+const trpc_middleware_js_1 = require("./trpc/trpc.middleware.js");
+/**
+ * Build the procedure record for the `custom` endpoint.
+ *
+ * The OUTER procedure is `protectedProcedure` — every caller must be
+ * authenticated. The INNER per-action auth declared in `spec.auth` is
+ * enforced manually by `ensureAuth` because the auth level is not known
+ * until after the registry lookup.
+ */
+function createAddonsCustomProcedures(deps) {
+    return {
+        custom: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({
+            addonId: zod_1.z.string().min(1),
+            action: zod_1.z.string().min(1),
+            input: zod_1.z.unknown(),
+        }))
+            .output(zod_1.z.unknown())
+            .mutation(async ({ input, ctx }) => {
+            const registry = deps.getCustomActionRegistry();
+            const entry = registry.resolve(input.addonId, input.action);
+            if (!entry) {
+                throw new server_1.TRPCError({
+                    code: 'NOT_FOUND',
+                    message: `addon '${input.addonId}' has no custom action '${input.action}'`,
+                });
+            }
+            // Per-action authorization. The outer procedure already requires
+            // authentication; here we additionally enforce the declared role
+            // when it's stricter than 'protected'.
+            ensureAuth(ctx, entry.spec.auth);
+            // Validate input against the action's declared Zod schema.
+            const parsedInput = entry.spec.input.parse(input.input);
+            // Dispatch through the addon handler, forwarding the authenticated
+            // caller when the action declares `caller: 'required'`. The caller is
+            // derived server-side from the request principal (never trusted from
+            // input); `ctx.user` is guaranteed present because `ensureAuth` above
+            // rejects unauthenticated callers for any non-public action, and the
+            // outer `protectedProcedure` rejects them for public ones.
+            const caller = entry.spec.caller === 'required' && ctx.user
+                ? { userId: ctx.user.id, isAdmin: ctx.user.isAdmin }
+                : undefined;
+            const result = await entry.handler(parsedInput, caller);
+            // Validate the addon's output. Crash-early on misbehaving addons.
+            return entry.spec.output.parse(result);
+        }),
+    };
+}
+/**
+ * Enforce the action's declared auth level.
+ *
+ * Mirrors the role checks performed by `protectedProcedure` and
+ * `adminProcedure` in trpc.middleware.ts:
+ *   - public:    no auth
+ *   - protected: any authenticated user
+ *   - admin:     isAdmin only (scoped tokens bounce)
+ */
+function ensureAuth(ctx, level) {
+    if (level === 'public')
+        return;
+    if (!ctx.user) {
+        throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+    }
+    if (level === 'protected')
+        return;
+    if (level === 'admin') {
+        if (!ctx.user.isAdmin) {
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'custom action requires admin' });
+        }
+        return;
+    }
+}

package/dist/api/core/bulk-update-coordinator.js

@@ -0,0 +1,229 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BulkUpdateCoordinator = void 0;
+/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-argument -- The server installs @camstack/types@0.1.38 (last published) in server/backend/node_modules, while the workspace has 0.1.39 with the new BulkUpdate* types. ESLint's type-checker resolves against 0.1.38 and treats the new imports as `any`. Runtime is correct because Node module resolution walks up to root node_modules → workspace symlink. This disable mirrors the pattern in cap-providers.ts (same root cause). Will resolve when 0.1.39 is published and the local dist is synced. */
+const node_crypto_1 = require("node:crypto");
+const types_1 = require("@camstack/types");
+const DEFAULT_CLEANUP_AFTER_MS = 5 * 60 * 1_000;
+class BulkUpdateCoordinator {
+    deps;
+    states = new Map();
+    cancelFlags = new Map();
+    /**
+     * Tracks wall-clock time (ms) when each bulk completed. Used for lazy
+     * cleanup in `get()` — avoids scheduling a fake-timer `setTimeout` that
+     * would be eagerly fired by `vi.runAllTimersAsync()` in tests.
+     */
+    completedWallMs = new Map();
+    /** Tracks which nodeIds currently have an active (non-completed) bulk update. */
+    activeNodeIds = new Set();
+    now;
+    cleanupAfterMs;
+    /** Wall-clock source. Fake timers intercept `Date.now`, so tests can advance via `advanceTimersByTimeAsync`. */
+    wallNow;
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.clock ?? (() => Date.now());
+        this.cleanupAfterMs = deps.cleanupAfterMs ?? DEFAULT_CLEANUP_AFTER_MS;
+        this.wallNow = () => Date.now();
+    }
+    // ── Public API ────────────────────────────────────────────────────
+    start(input) {
+        if (this.activeNodeIds.has(input.nodeId)) {
+            throw new Error(`Bulk update already in progress for node ${input.nodeId}`);
+        }
+        const id = (0, node_crypto_1.randomUUID)();
+        const items = input.items.map((i) => ({
+            name: i.name,
+            isSystem: i.isSystem,
+            // fromVersion: the cap interface receives name+version+isSystem only;
+            // the caller (cap-providers.ts) may enrich this with the current version
+            // if available. Empty string is acceptable per plan spec.
+            fromVersion: '',
+            toVersion: i.version,
+            status: 'queued',
+        }));
+        const state = {
+            id,
+            nodeId: input.nodeId,
+            startedAtMs: this.now(),
+            total: items.length,
+            completed: 0,
+            failed: 0,
+            current: null,
+            phase: 'regular',
+            cancelled: false,
+            items,
+        };
+        this.states.set(id, state);
+        this.activeNodeIds.add(input.nodeId);
+        const cancelFlag = { cancelled: false };
+        this.cancelFlags.set(id, cancelFlag);
+        // Emit initial state so clients see the bulk as started immediately
+        this.emit(state);
+        void this.runLoop(id, cancelFlag).catch((err) => {
+            this.deps.logger.error('BulkUpdateCoordinator: loop crashed unexpectedly', err);
+        });
+        return { id };
+    }
+    get(id) {
+        const state = this.states.get(id);
+        if (state === undefined)
+            return null;
+        // Lazy cleanup: purge if the wall-clock elapsed since completion exceeds threshold.
+        // This avoids scheduling a long-lived setTimeout that would be eagerly fired
+        // by vi.runAllTimersAsync() in tests.
+        const completedWall = this.completedWallMs.get(id);
+        if (completedWall !== undefined && this.wallNow() - completedWall >= this.cleanupAfterMs) {
+            this.purge(id);
+            return null;
+        }
+        return state;
+    }
+    list(nodeId) {
+        const all = [...this.states.keys()]
+            .map((id) => this.get(id)) // get() applies lazy-cleanup
+            .filter((s) => s !== null);
+        return nodeId === undefined ? all : all.filter((s) => s.nodeId === nodeId);
+    }
+    cancel(id) {
+        const state = this.states.get(id);
+        const flag = this.cancelFlags.get(id);
+        if (state === undefined || flag === undefined)
+            return { cancelled: false };
+        // Once restarting, the hub restart is committed — cancel has no effect.
+        if (state.phase === 'restarting')
+            return { cancelled: false };
+        // Already completed.
+        if (state.completedAtMs !== undefined)
+            return { cancelled: false };
+        flag.cancelled = true;
+        this.mutate(id, (s) => ({ ...s, cancelled: true }));
+        return { cancelled: true };
+    }
+    // ── Internal loop ─────────────────────────────────────────────────
+    async runLoop(id, cancelFlag) {
+        const initial = this.states.get(id);
+        // ── Phase 1: regular addons ──────────────────────────────────────
+        this.transitionPhase(id, 'regular');
+        for (const item of initial.items.filter((i) => !i.isSystem)) {
+            if (cancelFlag.cancelled)
+                break;
+            await this.processItem(id, item, false);
+        }
+        // ── Phase 2: system packages (deferRestart: true) ────────────────
+        if (!cancelFlag.cancelled && initial.items.some((i) => i.isSystem)) {
+            this.transitionPhase(id, 'system');
+            for (const item of initial.items.filter((i) => i.isSystem)) {
+                if (cancelFlag.cancelled)
+                    break;
+                await this.processItem(id, item, true);
+            }
+            // ── Phase 3: single restart ──────────────────────────────────
+            const anySystemPendingRestart = this.states
+                .get(id)
+                .items.some((i) => i.isSystem && i.status === 'done-pending-restart');
+            if (anySystemPendingRestart && !cancelFlag.cancelled) {
+                this.transitionPhase(id, 'restarting');
+                try {
+                    await this.deps.restartServer({ confirm: true });
+                    // NOTE: In production, restartServer kills+respawns the hub process.
+                    // Code below this point will not execute in that scenario.
+                    // If the mock/stub returns (e.g. in tests), we fall through to finalizing.
+                }
+                catch (err) {
+                    // Restart failed but the npm installs already completed. Promote all
+                    // done-pending-restart items to done with a caveat error so the UI
+                    // can inform the user that a manual restart is needed.
+                    this.deps.logger.error('BulkUpdateCoordinator: restart failed', err);
+                    const errMsg = err instanceof Error ? err.message : String(err);
+                    for (const it of this.states.get(id).items) {
+                        if (it.status === 'done-pending-restart') {
+                            this.setItemStatus(id, it.name, 'done', {
+                                error: `Restart failed; manual restart required (${errMsg})`,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        // ── Phase 4: finalize ────────────────────────────────────────────
+        // Reached when:
+        //  a) no system packages at all, OR
+        //  b) restart failed (process continued), OR
+        //  c) cancelled before the restart phase.
+        this.transitionPhase(id, 'finalizing');
+        this.completeBulk(id);
+    }
+    async processItem(id, item, isSystem) {
+        this.setItemStatus(id, item.name, 'updating', { startedAtMs: this.now() });
+        this.mutate(id, (s) => ({ ...s, current: item.name }));
+        this.emit(this.states.get(id));
+        try {
+            if (isSystem) {
+                await this.deps.updateFrameworkPackage({
+                    packageName: item.name,
+                    version: item.toVersion,
+                    deferRestart: true,
+                });
+                this.setItemStatus(id, item.name, 'done-pending-restart', { completedAtMs: this.now() });
+            }
+            else {
+                await this.deps.updateAddon({ name: item.name, version: item.toVersion });
+                this.setItemStatus(id, item.name, 'done', { completedAtMs: this.now() });
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.setItemStatus(id, item.name, 'failed', { error: msg, completedAtMs: this.now() });
+        }
+        this.mutate(id, (s) => ({ ...s, current: null }));
+        this.emit(this.states.get(id));
+    }
+    // ── State mutation helpers ────────────────────────────────────────
+    setItemStatus(id, name, status, fields = {}) {
+        this.mutate(id, (s) => {
+            const items = s.items.map((it) => (it.name === name ? { ...it, status, ...fields } : it));
+            // completed = all terminal states: done | done-pending-restart | failed
+            const completed = items.filter((it) => it.status === 'done' || it.status === 'done-pending-restart' || it.status === 'failed').length;
+            const failed = items.filter((it) => it.status === 'failed').length;
+            return { ...s, items, completed, failed };
+        });
+    }
+    transitionPhase(id, phase) {
+        this.mutate(id, (s) => ({ ...s, phase }));
+        this.emit(this.states.get(id));
+    }
+    completeBulk(id) {
+        this.mutate(id, (s) => ({ ...s, completedAtMs: this.now(), current: null }));
+        this.emit(this.states.get(id));
+        // Free the nodeId slot so a new bulk for the same node can be started
+        const nodeId = this.states.get(id).nodeId;
+        this.activeNodeIds.delete(nodeId);
+        // Record wall-clock completion time for lazy cleanup in `get()`.
+        // We intentionally avoid scheduling a setTimeout here: a long-lived
+        // setTimeout (5 min) would be eagerly fired by vi.runAllTimersAsync()
+        // in tests, causing `get()` to return null immediately after the run.
+        // Instead, `get()` lazily checks whether the cleanup threshold has
+        // elapsed using Date.now() — which fake timers DO advance via
+        // advanceTimersByTimeAsync(), making the cleanup testable without
+        // a long-running timer.
+        this.completedWallMs.set(id, this.wallNow());
+    }
+    purge(id) {
+        this.states.delete(id);
+        this.cancelFlags.delete(id);
+        this.completedWallMs.delete(id);
+    }
+    /** Immutably update the state for the given id. No-op if id is unknown. */
+    mutate(id, update) {
+        const current = this.states.get(id);
+        if (current === undefined)
+            return;
+        this.states.set(id, update(current));
+    }
+    emit(state) {
+        this.deps.eventBus.emit(types_1.EventCategory.AddonsBulkUpdateProgress, state);
+    }
+}
+exports.BulkUpdateCoordinator = BulkUpdateCoordinator;

package/dist/api/core/cap-providers.js

@@ -1232,7 +1232,7 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             const nodeId = input.nodeId;
             const updates = nodeId === undefined || isHubNode(nodeId)
                 ? await ps.checkUpdates()
-                : await ps.checkUpdatesForInstalled(await fetchAgentInstalledPackages(broker, nodeId));
+                : await ps.checkUpdatesForInstalled(await fetchAgentInstalledPackages(broker, nodeId), nodeId);
             return updates.map((u) => ({ ...u, isSystem: frameworkAllowSet.has(u.name) }));
         },
         updatePackage: async (input) => {
@@ -1271,7 +1271,7 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
                 return ps.checkUpdates(true);
             // Agent rosters carry no hub-side cache — the diff is always live.
             const installed = await fetchAgentInstalledPackages(broker, nodeId);
-            return ps.checkUpdatesForInstalled(installed);
+            return ps.checkUpdatesForInstalled(installed, nodeId);
         },
         restartServer: async () => ps.restartServer(ctx.user?.username ?? ctx.user?.id),
         getLastRestart: async () => {

package/dist/api/core/settings-backend.router.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSettingsBackendRouter = createSettingsBackendRouter;
+/**
+ * Settings backend router — tRPC proxy for ISettingsBackend operations.
+ *
+ * Exposes the core collection-based operations (get, set, query, insert,
+ * update, delete, count, isEmpty) so forked worker addons can use
+ * context.settingsBackend via tRPC instead of requiring in-process access
+ * to the SQLite database.
+ *
+ * Introduced for Task 11 — TrpcSettingsBackend for forked workers.
+ */
+const zod_1 = require("zod");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+// ---------------------------------------------------------------------------
+// Zod schemas
+// ---------------------------------------------------------------------------
+const CollectionKeySchema = zod_1.z.object({
+    collection: zod_1.z.string(),
+    key: zod_1.z.string(),
+});
+const SetValueSchema = zod_1.z.object({
+    collection: zod_1.z.string(),
+    key: zod_1.z.string(),
+    value: zod_1.z.unknown(),
+});
+const QueryFilterSchema = zod_1.z
+    .object({
+    where: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    whereIn: zod_1.z.record(zod_1.z.string(), zod_1.z.array(zod_1.z.unknown())).optional(),
+    whereBetween: zod_1.z.record(zod_1.z.string(), zod_1.z.tuple([zod_1.z.unknown(), zod_1.z.unknown()])).optional(),
+    orderBy: zod_1.z
+        .object({
+        field: zod_1.z.string(),
+        direction: zod_1.z.enum(['asc', 'desc']),
+    })
+        .optional(),
+    limit: zod_1.z.number().optional(),
+    offset: zod_1.z.number().optional(),
+})
+    .optional();
+const QueryInputSchema = zod_1.z.object({
+    collection: zod_1.z.string(),
+    filter: QueryFilterSchema,
+});
+const InsertInputSchema = zod_1.z.object({
+    collection: zod_1.z.string(),
+    record: zod_1.z.object({
+        id: zod_1.z.string(),
+        data: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    }),
+});
+const UpdateInputSchema = zod_1.z.object({
+    collection: zod_1.z.string(),
+    id: zod_1.z.string(),
+    data: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+});
+const CountInputSchema = zod_1.z.object({
+    collection: zod_1.z.string(),
+    filter: QueryFilterSchema,
+});
+const IsEmptyInputSchema = zod_1.z.object({
+    collection: zod_1.z.string(),
+});
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+function createSettingsBackendRouter(getBackend) {
+    const requireBackend = () => {
+        const backend = getBackend();
+        if (!backend) {
+            throw new Error('Settings backend not available — settings-store addon may not be initialized yet');
+        }
+        return backend;
+    };
+    return (0, trpc_middleware_js_1.trpcRouter)({
+        get: trpc_middleware_js_1.protectedProcedure.input(CollectionKeySchema).query(async ({ input }) => {
+            const result = await requireBackend().get(input);
+            return { value: result };
+        }),
+        set: trpc_middleware_js_1.protectedProcedure.input(SetValueSchema).mutation(async ({ input }) => {
+            await requireBackend().set({
+                collection: input.collection,
+                key: input.key,
+                value: input.value,
+            });
+            return { success: true };
+        }),
+        query: trpc_middleware_js_1.protectedProcedure.input(QueryInputSchema).query(async ({ input }) => {
+            const records = await requireBackend().query({
+                collection: input.collection,
+                filter: input.filter ?? undefined,
+            });
+            return { records: records.map((r) => ({ id: r.id, data: r.data })) };
+        }),
+        insert: trpc_middleware_js_1.protectedProcedure.input(InsertInputSchema).mutation(async ({ input }) => {
+            await requireBackend().insert(input);
+            return { success: true };
+        }),
+        update: trpc_middleware_js_1.protectedProcedure.input(UpdateInputSchema).mutation(async ({ input }) => {
+            await requireBackend().update(input);
+            return { success: true };
+        }),
+        delete: trpc_middleware_js_1.protectedProcedure.input(CollectionKeySchema).mutation(async ({ input }) => {
+            await requireBackend().delete(input);
+            return { success: true };
+        }),
+        count: trpc_middleware_js_1.protectedProcedure.input(CountInputSchema).query(async ({ input }) => {
+            const result = await requireBackend().count({
+                collection: input.collection,
+                filter: input.filter ?? undefined,
+            });
+            return { count: result };
+        }),
+        isEmpty: trpc_middleware_js_1.protectedProcedure.input(IsEmptyInputSchema).query(async ({ input }) => {
+            const result = await requireBackend().isEmpty(input);
+            return { empty: result };
+        }),
+    });
+}

package/dist/api/static/spa-static.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.spaAssetCacheControl = spaAssetCacheControl;
 exports.addonBundleCacheControl = addonBundleCacheControl;
 exports.contentTypeForPath = contentTypeForPath;
+exports.isRetiredPublicPath = isRetiredPublicPath;
 /**
  * Cache-Control value for a static SPA asset addressed by its dist-relative
  * path. Policy (shared by admin-ui + viewer-ui):
@@ -24,7 +25,10 @@ function spaAssetCacheControl(rel) {
     if (/^(sw\.js|registerSW\.js|workbox-.*\.js|manifest\.webmanifest)$/.test(base)) {
         return 'no-cache, must-revalidate';
     }
-    const inAssetDir = rel.startsWith('assets/') || rel.startsWith('_expo/');
+    const inAssetDir = rel.startsWith('assets/') ||
+        rel.startsWith('_expo/') ||
+        rel.includes('/assets/') ||
+        rel.includes('/_expo/');
     if (inAssetDir && /-[A-Za-z0-9_-]{8,}\./.test(base)) {
         return 'public, max-age=31536000, immutable';
     }
@@ -90,3 +94,8 @@ function contentTypeForPath(pathname) {
     const ext = dot >= 0 ? base.slice(dot + 1).toLowerCase() : '';
     return CONTENT_TYPES[ext] ?? 'application/octet-stream';
 }
+/** Paths intentionally retired instead of falling through to the admin SPA. */
+function isRetiredPublicPath(url) {
+    const pathname = url.split('?')[0] ?? url;
+    return (pathname === '/addon/stream-broker/embed' || pathname.startsWith('/addon/stream-broker/embed/'));
+}

package/dist/api/trpc/generated-cap-routers.js

@@ -8770,6 +8770,24 @@ function createCapRouter_terminalSession(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.resize(methodInput);
         }),
+        pullOutput: trpc_middleware_js_1.adminProcedure
+            .input(types_109.terminalSessionCapability.methods.pullOutput.input.loose())
+            .output(types_109.terminalSessionCapability.methods.pullOutput.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('terminal-session', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.pullOutput(methodInput);
+        }),
+        writeInput: trpc_middleware_js_1.adminProcedure
+            .input(types_109.terminalSessionCapability.methods.writeInput.input.loose())
+            .output(types_109.terminalSessionCapability.methods.writeInput.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('terminal-session', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.writeInput(methodInput);
+        }),
         close: trpc_middleware_js_1.adminProcedure
             .input(types_109.terminalSessionCapability.methods.close.input.loose())
             .output(types_109.terminalSessionCapability.methods.close.output)

package/dist/boot/resume-framework-swap.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * Boot-time framework-swap job resume + health confirm.
+ *
+ * After a framework swap reboot, `post-boot.service.ts` calls this once the
+ * hub is healthy.  It:
+ *   1. Reads `.framework-swap-confirm.json` (written by the launcher on apply).
+ *   2. Marks the journal task `applied` → `done`, then finalises the job →
+ *      `completed`.
+ *   3. Calls `confirmFrameworkSwapHealthy` to delete the confirm marker +
+ *      backup dirs (disarms the crash-loop rollback).
+ *
+ * Best-effort: a missing/corrupt journal is tolerated — `confirmFrameworkSwapHealthy`
+ * is still called so the rollback is always disarmed when the hub boots healthy.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resumeFrameworkSwapJob = resumeFrameworkSwapJob;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const types_1 = require("@camstack/types");
+const system_1 = require("@camstack/system");
+const launcher_framework_swap_js_1 = require("../launcher-framework-swap.js");
+const lifecycle_journal_path_js_1 = require("../lifecycle-journal-path.js");
+const SWAP_CONFIRM_FILE = '.framework-swap-confirm.json';
+/**
+ * Resume a framework-swap journal job to `done`/`completed` and confirm the
+ * hub is healthy (deletes the confirm marker + backups).
+ *
+ * @returns `{ resumed: false }` when no confirm marker exists.
+ *          `{ resumed: true, jobId }` when the marker was found and processed.
+ *          Never throws — errors are swallowed to avoid crashing the post-boot path.
+ */
+async function resumeFrameworkSwapJob(dataDir) {
+    try {
+        const confirmMarker = readConfirmMarker(dataDir);
+        if (confirmMarker === null) {
+            return { resumed: false };
+        }
+        const { jobId, taskId } = confirmMarker;
+        let journalPatched = false;
+        try {
+            const journal = new system_1.JobJournal((0, lifecycle_journal_path_js_1.lifecycleJobsDir)(dataDir));
+            const job = journal.getJob(jobId);
+            if (job !== null) {
+                const task = job.tasks.find((t) => t.taskId === taskId);
+                if (task !== undefined && task.phase === 'applied') {
+                    journal.patchTask(jobId, taskId, { phase: 'done', finishedAtMs: Date.now() });
+                    // Single-task framework job: if all tasks are now terminal and none
+                    // failed, mark the job completed (mirrors the engine's finalize logic).
+                    const updatedJob = journal.getJob(jobId);
+                    if (updatedJob !== null) {
+                        const allTerminal = updatedJob.tasks.every((t) => t.phase === 'done' || t.phase === 'failed' || t.phase === 'skipped');
+                        const anyFailed = updatedJob.tasks.some((t) => t.phase === 'failed');
+                        if (allTerminal && !anyFailed) {
+                            journal.setJobState(jobId, 'completed');
+                        }
+                    }
+                    journalPatched = true;
+                }
+            }
+        }
+        catch {
+            // Journal is missing or corrupt — still clean up the confirm marker so
+            // the rollback is disarmed on a healthy hub boot.
+        }
+        (0, launcher_framework_swap_js_1.confirmFrameworkSwapHealthy)(dataDir);
+        return journalPatched ? { resumed: true, jobId } : { resumed: false };
+    }
+    catch {
+        // Never crash the caller (post-boot service).
+        return { resumed: false };
+    }
+}
+/** Read and shape-check the confirm marker.  Returns null on any error. */
+function readConfirmMarker(dataDir) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(dataDir, SWAP_CONFIRM_FILE), 'utf-8'));
+        const parsed = types_1.frameworkSwapConfirmSchema.safeParse(raw);
+        if (!parsed.success)
+            return null;
+        return { jobId: parsed.data.jobId, taskId: parsed.data.taskId };
+    }
+    catch {
+        return null;
+    }
+}