@camstack/server 1.2.89 → 1.2.91

package/dist/core/addon/addon-package.service.js

@@ -46,6 +46,7 @@ const node_util_1 = require("node:util");
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 const package_dir_utils_js_1 = require("./package-dir-utils.js");
+const update_availability_emitter_js_1 = require("../update-availability-emitter.js");
 const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 /**
  * The primary host-provided framework package (kernel + core). Kept as a named
@@ -189,6 +190,7 @@ class AddonPackageService {
     cachedUpdates = null;
     searchCache = null;
     versionCache = new Map();
+    updateAvailability;
     // -- Auto-update state ----------------------------------------------------
     autoUpdateConfig = {
         global: { channel: 'off', intervalSeconds: 21600 },
@@ -213,6 +215,10 @@ class AddonPackageService {
         this.notificationService = notificationService;
         this.toastService = toastService;
         this.logger = this.loggingService.createLogger('AddonPackageService');
+        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(this.eventBusService, {
+            type: 'core',
+            id: 'addon-package-service',
+        });
         // Initialize installer eagerly (no async needed).
         // Ensures install/uninstall works before full module init completes.
         try {
@@ -620,6 +626,12 @@ class AddonPackageService {
             updates,
             expiresAt: now + AddonPackageService.UPDATE_CACHE_TTL_MS,
         };
+        this.updateAvailability.publishSnapshot('addon', updates.map((update) => ({
+            target: 'addon',
+            packageName: update.name,
+            currentVersion: update.currentVersion,
+            latestVersion: update.latestVersion,
+        })));
         return updates;
     }
     /** Clear the cached update check results */
@@ -636,7 +648,7 @@ class AddonPackageService {
      * Not cached: the caller decides freshness (an agent roster changes
      * per deploy, and `forceRefresh` must always be live).
      */
-    async checkUpdatesForInstalled(installed) {
+    async checkUpdatesForInstalled(installed, nodeId) {
         // De-dup by package name — one npm package may bundle several addons.
         const seen = new Map();
         for (const pkg of installed) {
@@ -648,7 +660,7 @@ class AddonPackageService {
             if (!this.isAllowedPackage(name))
                 return;
             const latestVersion = await this.fetchLatestVersion(name);
-            if (latestVersion === null || latestVersion === version)
+            if (latestVersion === null || !isVersionNewer(latestVersion, version))
                 return;
             const category = this.categorize(name);
             updates.push({
@@ -659,6 +671,13 @@ class AddonPackageService {
                 requiresRestart: category === 'core',
             });
         }));
+        this.updateAvailability.publishSnapshot('addon', updates.map((update) => ({
+            target: 'addon',
+            packageName: update.name,
+            currentVersion: update.currentVersion,
+            latestVersion: update.latestVersion,
+            ...(nodeId !== undefined ? { nodeId } : {}),
+        })), nodeId);
         return updates;
     }
     /**
@@ -1243,6 +1262,7 @@ class AddonPackageService {
         this.logger.info('Running auto-update check...');
         const installed = this.listInstalled();
         const targets = [];
+        const available = [];
         for (const pkg of installed) {
             try {
                 // Framework packages NEVER auto-update from npm — they ship via
@@ -1289,6 +1309,12 @@ class AddonPackageService {
                     },
                 });
                 targets.push({ name: pkg.name, version: targetVersion });
+                available.push({
+                    target: 'addon',
+                    packageName: pkg.name,
+                    currentVersion: pkg.version,
+                    latestVersion: targetVersion,
+                });
             }
             catch (err) {
                 this.logger.warn('Auto-update check failed', {
@@ -1296,6 +1322,7 @@ class AddonPackageService {
                 });
             }
         }
+        this.updateAvailability.publishCandidates(available);
         if (targets.length === 0) {
             this.logger.debug('Auto-update: all packages up-to-date');
             return;
@@ -1431,7 +1458,7 @@ class AddonPackageService {
                 const latestVersion = await this.fetchLatestVersion(name);
                 if (!latestVersion)
                     continue;
-                if (latestVersion !== version) {
+                if (isVersionNewer(latestVersion, version)) {
                     updates.push({
                         name,
                         currentVersion: version,

package/dist/core/addon/framework-live-sync.js

@@ -0,0 +1,344 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHubClosurePackageDir = resolveHubClosurePackageDir;
+exports.resolveOverlayPackageDir = resolveOverlayPackageDir;
+exports.computeDistBuildId = computeDistBuildId;
+exports.swapDist = swapDist;
+exports.syncFrameworkDist = syncFrameworkDist;
+/**
+ * Framework live-sync — make a `camstack deploy` of a framework package
+ * (`@camstack/system`, …) actually reach the code the running hub loads.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * `installFromTgz` writes the freshly-built framework tree to
+ * `CAMSTACK_ADDONS_DIR/<pkg>` (`/data/addons/@camstack/system`). NO runtime
+ * consumer loads from there:
+ *   • the hub main process resolves `@camstack/system` from its OWN
+ *     `node_modules` closure (Node's `node_modules` walk-up from
+ *     `@camstack/server` finds the co-located copy BEFORE `NODE_PATH` is ever
+ *     consulted — so the `/data/framework` overlay is a no-op for it);
+ *   • the forked addon runners resolve it from `CAMSTACK_FRAMEWORK_DIR`
+ *     (`/data/framework/node_modules/<pkg>`) via the ESM resolver hook.
+ * So a framework deploy landed on disk in a dead location and the subsequent
+ * hub restart reloaded the SAME unchanged code.
+ *
+ * This module mirrors the freshly-built `dist/` into BOTH live locations with
+ * an atomic rename-aside swap (mirrors `AddonInstaller.evictInstallDir`), so the
+ * scheduled restart actually loads the new framework code in the hub main AND
+ * the addon runners. Only `dist/` is swapped — native prebuilds and sibling
+ * packages in each closure are left untouched.
+ *
+ * All failures are surfaced (logged + returned) but never thrown: a failed
+ * mirror must not brick the restart, and the rename-aside guarantees a live
+ * `dist/` is never left half-written (the incoming copy is staged first, and
+ * the previous `dist/` is restored if the final swap fails).
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const node_module_1 = require("node:module");
+// Resolve framework packages the same way the running hub does — from THIS
+// module's location, whose walk-up lands on the hub's own `node_modules`
+// closure (identical to the hub main's `@camstack/system` resolution).
+const requireFromHere = (0, node_module_1.createRequire)(__filename);
+// ---------------------------------------------------------------------------
+// Tiny cast-free JSON helper (mirror of addon-package.service.readJsonObject).
+// ---------------------------------------------------------------------------
+function readJsonObjectSafe(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return { ...parsed };
+        }
+    }
+    catch {
+        /* missing / malformed — treat as absent */
+    }
+    return null;
+}
+function packageNameOf(pkgJsonPath) {
+    const obj = readJsonObjectSafe(pkgJsonPath);
+    const name = obj?.['name'];
+    return typeof name === 'string' ? name : null;
+}
+// ---------------------------------------------------------------------------
+// Target resolution
+// ---------------------------------------------------------------------------
+/**
+ * The package directory the HUB MAIN process loads `<packageName>` from — its
+ * own `node_modules` closure. `require.resolve('<pkg>/package.json')` is the
+ * happy path; packages whose `exports` map omits that subpath fall back to
+ * resolving the main entry and walking up to the matching `package.json`.
+ * Returns null when the package is not resolvable.
+ */
+function resolveHubClosurePackageDir(packageName) {
+    try {
+        return path.dirname(requireFromHere.resolve(`${packageName}/package.json`));
+    }
+    catch {
+        // `exports` map blocks the package.json subpath — fall through.
+    }
+    try {
+        let dir = path.dirname(requireFromHere.resolve(packageName));
+        while (dir !== path.dirname(dir)) {
+            const candidate = path.join(dir, 'package.json');
+            if (fs.existsSync(candidate) && packageNameOf(candidate) === packageName) {
+                return dir;
+            }
+            dir = path.dirname(dir);
+        }
+    }
+    catch {
+        // package itself not resolvable — treat as not installed.
+    }
+    return null;
+}
+/**
+ * The package directory the forked ADDON RUNNERS load `<packageName>` from —
+ * the `CAMSTACK_FRAMEWORK_DIR` overlay. Returns null when the env is unset
+ * (dev / no overlay) or the dir does not exist.
+ */
+function resolveOverlayPackageDir(packageName) {
+    const frameworkDir = process.env['CAMSTACK_FRAMEWORK_DIR'];
+    if (frameworkDir === undefined || frameworkDir.length === 0)
+        return null;
+    const dir = path.join(frameworkDir, 'node_modules', packageName);
+    return fs.existsSync(dir) ? dir : null;
+}
+function resolveLiveTargets(packageName) {
+    const out = [];
+    const hub = resolveHubClosurePackageDir(packageName);
+    if (hub !== null)
+        out.push({ role: 'hub-closure', packageDir: hub });
+    const overlay = resolveOverlayPackageDir(packageName);
+    if (overlay !== null)
+        out.push({ role: 'overlay', packageDir: overlay });
+    return out;
+}
+function safeRealpath(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+// ---------------------------------------------------------------------------
+// Build-id (content hash of a `dist/` tree)
+// ---------------------------------------------------------------------------
+function collectJsFiles(root, dir, out) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            collectJsFiles(root, full, out);
+        }
+        else if (entry.isFile() && (entry.name.endsWith('.js') || entry.name.endsWith('.mjs'))) {
+            out.push(path.relative(root, full));
+        }
+    }
+}
+/**
+ * Content build-id of a `dist/` tree — md5 over every `.js`/`.mjs` file's
+ * relative path + bytes (sorted for determinism). Analogous to the Docker
+ * image's `seed-version` fingerprint. Returns null when the dir is missing or
+ * empty. Used to surface "same semver, new code" instead of trusting `version`.
+ */
+function computeDistBuildId(distDir) {
+    if (!fs.existsSync(distDir))
+        return null;
+    const files = [];
+    collectJsFiles(distDir, distDir, files);
+    if (files.length === 0)
+        return null;
+    files.sort();
+    const hash = (0, node_crypto_1.createHash)('md5');
+    for (const rel of files) {
+        hash.update(rel);
+        hash.update('\0');
+        hash.update(fs.readFileSync(path.join(distDir, rel)));
+    }
+    return hash.digest('hex');
+}
+// ---------------------------------------------------------------------------
+// Atomic dist swap (rename-aside)
+// ---------------------------------------------------------------------------
+function isCrossDeviceError(err) {
+    return err instanceof Error && err.code === 'EXDEV';
+}
+/**
+ * Replace `<targetPkgDir>/dist` with a copy of `sourceDistDir`.
+ *
+ * 1. COPY `sourceDistDir` → a staging dir INSIDE the target dir. The live
+ *    `dist/` is untouched, so a mid-copy failure cannot corrupt it.
+ * 2. Evict the current `dist/` aside (rename), then rename the staging dir into
+ *    place. Both renames are metadata ops WITHIN the target fs (atomic). If the
+ *    final swap fails, the previous `dist/` is restored.
+ *
+ * OVERLAYFS FALLBACK: the hub-closure target (`/opt/.../@camstack/system`) lives
+ * on the container's overlay rootfs. A `dist/` materialized from a LOWER image
+ * layer cannot be `rename()`d (overlayfs returns `EXDEV: cross-device link`),
+ * so the atomic aside/swap is impossible there. On EXDEV we fall back to a
+ * copy-aside restore point + in-place replace. This opens a brief non-atomic
+ * window, but it is safe here: the running process already holds the old
+ * modules in memory (nothing reads `dist/` until the scheduled restart), and
+ * the copy-aside is kept until the replace completes so a failure is
+ * recoverable.
+ */
+async function swapDist(sourceDistDir, targetPkgDir) {
+    const targetDist = path.join(targetPkgDir, 'dist');
+    const stamp = `${process.pid}-${Date.now()}`;
+    const incoming = path.join(targetPkgDir, `.dist-incoming-${stamp}`);
+    const aside = path.join(targetPkgDir, `.dist-evicted-${stamp}`);
+    // Step 1 — stage the incoming dist (cross-device copy is fine here).
+    try {
+        await fs.promises.cp(sourceDistDir, incoming, { recursive: true, force: true });
+    }
+    catch (err) {
+        await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+        throw err;
+    }
+    const hadDist = fs.existsSync(targetDist);
+    // How the previous dist was preserved: 'rename' (moved aside, same fs),
+    // 'copy' (overlayfs EXDEV — copied aside then removed in place), or 'none'.
+    let asideKind = 'none';
+    const restorePreviousDist = async () => {
+        if (asideKind === 'none' || fs.existsSync(targetDist))
+            return;
+        if (asideKind === 'rename') {
+            await fs.promises.rename(aside, targetDist).catch(() => undefined);
+        }
+        else {
+            await fs.promises
+                .cp(aside, targetDist, { recursive: true, force: true })
+                .catch(() => undefined);
+        }
+    };
+    // Step 2 — evict the current dist. Prefer the atomic rename; fall back to
+    // copy-aside + in-place remove on overlayfs EXDEV.
+    if (hadDist) {
+        try {
+            await fs.promises.rename(targetDist, aside);
+            asideKind = 'rename';
+        }
+        catch (err) {
+            if (!isCrossDeviceError(err)) {
+                await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+                throw err;
+            }
+            await fs.promises.cp(targetDist, aside, { recursive: true, force: true });
+            await fs.promises.rm(targetDist, { recursive: true, force: true });
+            asideKind = 'copy';
+        }
+    }
+    // Step 3 — move the incoming dist into place; fall back to copy on EXDEV.
+    try {
+        await fs.promises.rename(incoming, targetDist);
+    }
+    catch (err) {
+        if (isCrossDeviceError(err)) {
+            try {
+                await fs.promises.cp(incoming, targetDist, { recursive: true, force: true });
+                await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+            }
+            catch (copyErr) {
+                await restorePreviousDist();
+                await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+                throw copyErr;
+            }
+        }
+        else {
+            await restorePreviousDist();
+            await fs.promises.rm(incoming, { recursive: true, force: true }).catch(() => undefined);
+            throw err;
+        }
+    }
+    // Step 4 — best-effort cleanup of the evicted copy.
+    if (asideKind !== 'none') {
+        await fs.promises.rm(aside, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+// ---------------------------------------------------------------------------
+// Public entry
+// ---------------------------------------------------------------------------
+/**
+ * Mirror a freshly-installed framework `dist/` into every live location the
+ * runtime actually loads it from (hub-main closure + addon-runner overlay).
+ * Never throws — returns a per-target outcome. Call BEFORE the scheduled hub
+ * restart so the bounce loads the new code.
+ */
+async function syncFrameworkDist(args) {
+    const { packageName, sourceDistDir, logger } = args;
+    if (!fs.existsSync(sourceDistDir)) {
+        logger.warn('framework sync: source dist missing — nothing to mirror', {
+            meta: { packageName, sourceDistDir },
+        });
+        return { results: [] };
+    }
+    const sourcePkgReal = safeRealpath(path.dirname(sourceDistDir));
+    const seen = new Set();
+    const results = [];
+    for (const target of resolveLiveTargets(packageName)) {
+        const real = safeRealpath(target.packageDir);
+        // Dedupe (a dev symlink can point both roles at one dir) and never mirror
+        // a package dir onto its own source (would delete the code mid-swap).
+        if (seen.has(real) || real === sourcePkgReal)
+            continue;
+        seen.add(real);
+        try {
+            await swapDist(sourceDistDir, target.packageDir);
+            results.push({ role: target.role, packageDir: target.packageDir, ok: true });
+            logger.info('framework sync: dist swapped into live location', {
+                meta: { packageName, role: target.role, packageDir: target.packageDir },
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            results.push({ role: target.role, packageDir: target.packageDir, ok: false, error: message });
+            logger.error('framework sync: dist swap FAILED (live dir left intact)', {
+                meta: { packageName, role: target.role, packageDir: target.packageDir, error: message },
+            });
+        }
+    }
+    return { results };
+}

package/dist/core/server-update/server-update.service.js

@@ -55,7 +55,9 @@ const path = __importStar(require("node:path"));
 const index_js_1 = require("../../server-root/index.js");
 const system_exec_npm_js_1 = require("./system-exec-npm.js");
 const system_ensure_prebuilds_js_1 = require("./system-ensure-prebuilds.js");
+const update_availability_emitter_js_1 = require("../update-availability-emitter.js");
 class ServerUpdateService extends index_js_1.RootUpdateService {
+    updateAvailability;
     constructor(options) {
         const dataDir = path.resolve(options.dataDir ??
             options.env?.['CAMSTACK_DATA'] ??
@@ -90,6 +92,29 @@ class ServerUpdateService extends index_js_1.RootUpdateService {
             env: options.env,
             now: options.now,
         });
+        this.updateAvailability =
+            options.eventBus !== undefined
+                ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, {
+                    type: 'core',
+                    id: 'server-update-service',
+                })
+                : null;
+    }
+    async checkServerUpdate() {
+        const result = await super.checkServerUpdate();
+        if (result.error !== null)
+            return result;
+        this.updateAvailability?.publishSnapshot('server', result.updateAvailable && result.runningVersion !== null && result.latestVersion !== null
+            ? [
+                {
+                    target: 'server',
+                    packageName: result.packageName,
+                    currentVersion: result.runningVersion,
+                    latestVersion: result.latestVersion,
+                },
+            ]
+            : []);
+        return result;
     }
 }
 exports.ServerUpdateService = ServerUpdateService;

package/dist/core/update-availability-emitter.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateAvailabilityEmitter = void 0;
+const types_1 = require("@camstack/types");
+/**
+ * Emits update availability only when a successful check changes the observed
+ * `(currentVersion, latestVersion)` pair. A successful empty snapshot clears
+ * prior state; failed checks should not call this method.
+ */
+class UpdateAvailabilityEmitter {
+    eventBus;
+    source;
+    signatures = new Map();
+    constructor(eventBus, source) {
+        this.eventBus = eventBus;
+        this.source = source;
+    }
+    publishSnapshot(target, candidates, nodeId) {
+        const scope = nodeId ?? 'hub';
+        const present = new Set();
+        for (const candidate of candidates) {
+            if (candidate.target !== target)
+                continue;
+            const key = this.key(candidate);
+            present.add(key);
+            this.publish(candidate);
+        }
+        for (const key of this.signatures.keys()) {
+            if (key.startsWith(`${target}:${scope}:`) && !present.has(key)) {
+                this.signatures.delete(key);
+            }
+        }
+    }
+    /** Publish a partial candidate set without treating omissions as up-to-date. */
+    publishCandidates(candidates) {
+        for (const candidate of candidates)
+            this.publish(candidate);
+    }
+    publish(candidate) {
+        const key = this.key(candidate);
+        const signature = `${candidate.currentVersion}->${candidate.latestVersion}`;
+        if (this.signatures.get(key) === signature)
+            return;
+        this.signatures.set(key, signature);
+        this.eventBus.emit({
+            id: `update.available:${key}:${signature}`,
+            timestamp: new Date(),
+            source: this.source,
+            category: types_1.EventCategory.UpdateAvailable,
+            data: candidate,
+        });
+    }
+    key(candidate) {
+        return `${candidate.target}:${candidate.nodeId ?? 'hub'}:${candidate.packageName}`;
+    }
+}
+exports.UpdateAvailabilityEmitter = UpdateAvailabilityEmitter;