@camstack/server 1.2.99 → 1.2.101

package/dist/agent/main.js

@@ -488,6 +488,12 @@ async function startAgent(configPath) {
                 args: input.args,
                 ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                 ...(input.nodeId !== undefined ? { nodeId: input.nodeId } : {}),
+                // The native-only hint must survive the forward: the agent has no
+                // native authority of its own (no CapRouteResolver, no cluster
+                // CapabilityRegistry), so the hub answers "native or nothing" on
+                // its behalf. Dropping it here would let the hub resolve the cap
+                // NAME instead — i.e. the wrapper the caller is trying to skip.
+                ...(input.native === true ? { native: true } : {}),
             }, { timeout: 60_000 }),
             logger: { warn: (msg) => consoleLogger.warn(`[uds-fallback] ${msg}`) },
         });

package/dist/api/core/addon-settings.router.js

@@ -4,6 +4,30 @@ exports.createAddonSettingsRouter = createAddonSettingsRouter;
 /**
  * Addon settings router — raw DB proxy for the common settings API.
  *
+ * ## ⚠️ This is NOT the store `ctx.settings.readAddonStore()` reads
+ *
+ * Two different physical stores wear the name "addon-settings", and mistaking
+ * one for the other costs a whole debugging session — it did on 2026-08-13,
+ * where a per-node inference override was written here, read back here
+ * (looking perfectly correct), and was invisible to the addon forever:
+ *
+ * | Surface | Physical shape | Read by |
+ * | --- | --- | --- |
+ * | THIS router (`ConfigService.getAddonConfig` → `getAllAddon`) | the `addon-settings` table, **one row per key**, `id = "<addonId>.<key>"`, `data = {addonId, key, value}` | `buildAddonConfig` → `ctx.addonConfig`, and `virtual-doorbell` |
+ * | `settings-store` cap (`ctx.settings.readAddonStore()`) | **ONE blob row**, namespace `<addonId>`, collection `addon-settings`, key `root` | `BaseAddon.resolveConfig` / every addon's global settings |
+ *
+ * Nothing bridges them. To write an addon's global setting — including a
+ * `perNode: true` key — go through the `addonSettings` CAP
+ * (`updateGlobalSettings`, which applies the schema's per-node scoping), or
+ * read it back with
+ * `settingsStore.get {namespace:<addonId>, collection:'addon-settings', key:'root'}`.
+ * `addonSettingsRaw.getGlobal` answering `{}` for an addon that plainly has
+ * settings is the tell.
+ *
+ * `setAllAddon` is also a **bulk replace**: `updateGlobal` read-modify-writes
+ * the whole per-key set, so a write here deletes every other row of that addon
+ * in this table.
+ *
  * Exposes four protected procedures consumed by:
  *   1. Forked addons (via the tRPC WSS client in `WorkerBootstrapService`)
  *      to read/write their 3-level settings chain from the worker process.

package/dist/api/core/system-events.router.js

@@ -63,11 +63,17 @@ const GetRecentInputSchema = ScopeFieldsSchema.extend({
     limit: zod_1.z.number().int().min(1).max(500).optional(),
 });
 /**
- * `subscribe` keeps category as a single string. The bus's
- * `extractCategoryPattern` keys handlers by a single pattern; passing
- * an array would silently route only the first category. UIs that
- * need multi-category live filtering must subscribe by deviceId
- * (single-category-per-call or wildcard) and narrow client-side.
+ * `subscribe` keeps category as a single string — a WIRE choice now, not a bus
+ * limitation.
+ *
+ * It used to be a limitation, and a silent one: the bus keyed handlers by
+ * `extractCategoryPattern`, so an array filter routed only its FIRST category
+ * and dropped the rest with no error. `extractCategoryPatterns` +
+ * `registerSubscriber` (2026-08-12) register a subscriber under every category
+ * it names, so an array here would now work. The single string stays because
+ * one live SSE stream per category is what every consumer of this endpoint
+ * actually opens; a UI that wants several can open several or subscribe by
+ * wildcard and narrow client-side.
  */
 const SubscribeInputSchema = ScopeFieldsSchema.extend({
     category: zod_1.z.string().optional(),

package/dist/api/static/spa-static.js

@@ -7,10 +7,31 @@
  * (`index.html`) always revalidate so a redeploy actually reaches clients.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.spaShellCacheControl = spaShellCacheControl;
 exports.spaAssetCacheControl = spaAssetCacheControl;
 exports.addonBundleCacheControl = addonBundleCacheControl;
 exports.contentTypeForPath = contentTypeForPath;
 exports.isRetiredPublicPath = isRetiredPublicPath;
+/**
+ * Cache-Control for the SPA SHELL (`index.html`) — the HTML entry only, never a
+ * hashed asset.
+ *
+ * The shell is the one file that must never survive a deploy: it carries the
+ * `<script src="assets/index-<hash>.js">` pointers, so a stale copy loads a
+ * build whose hashed assets no longer exist — the operator sees the previous UI
+ * or a blank page and has to force-refresh. It is a few KB, and every in-app
+ * navigation is client-side, so re-fetching it costs nothing measurable.
+ *
+ * `no-store`, not `no-cache`: the shell is streamed with no ETag and no
+ * Last-Modified, so a revalidation could never answer 304 anyway — and
+ * `no-store` additionally keeps the response out of the heuristic and
+ * back/forward caches that made this visible. The addon-route fallback used to
+ * send the shell with NO header at all, which is where the stale copies came
+ * from.
+ */
+function spaShellCacheControl() {
+    return 'no-store';
+}
 /**
  * Cache-Control value for a static SPA asset addressed by its dist-relative
  * path. Policy (shared by admin-ui + viewer-ui):
@@ -18,7 +39,10 @@ exports.isRetiredPublicPath = isRetiredPublicPath;
  *     → `no-cache, must-revalidate` (PWA update propagation).
  *   - Content-hashed build assets under `assets/` (Vite) or `_expo/` (Expo
  *     web export) → `public, max-age=31536000, immutable`.
- *   - Everything else (index.html, favicon, non-hashed files) → `no-cache`.
+ *   - The shell requested BY NAME (`/index.html`) reaches this function rather
+ *     than the shell branch of the handler — it gets {@link spaShellCacheControl}
+ *     so the same bytes never carry two different policies.
+ *   - Everything else (favicon, non-hashed files) → `no-cache`.
  */
 function spaAssetCacheControl(rel) {
     const base = rel.split('/').pop() ?? rel;
@@ -32,6 +56,8 @@ function spaAssetCacheControl(rel) {
     if (inAssetDir && /-[A-Za-z0-9_-]{8,}\./.test(base)) {
         return 'public, max-age=31536000, immutable';
     }
+    if (base === 'index.html')
+        return spaShellCacheControl();
     return 'no-cache';
 }
 /**

package/dist/api/trpc/generated-cap-routers.js

@@ -7499,6 +7499,51 @@ function createCapRouter_recording(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.cancelStorageMigrationMove(methodInput);
         }),
+        relocateFootage: trpc_middleware_js_1.adminProcedure
+            .input(types_92.recordingCapability.methods.relocateFootage.input.loose())
+            .output(types_92.recordingCapability.methods.relocateFootage.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('recording', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.relocateFootage(methodInput);
+        }),
+        listRelocateJobs: trpc_middleware_js_1.adminProcedure
+            .input(types_92.recordingCapability.methods.listRelocateJobs.input.loose())
+            .output(types_92.recordingCapability.methods.listRelocateJobs.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('recording', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listRelocateJobs(methodInput);
+        }),
+        cancelRelocateJob: trpc_middleware_js_1.adminProcedure
+            .input(types_92.recordingCapability.methods.cancelRelocateJob.input.loose())
+            .output(types_92.recordingCapability.methods.cancelRelocateJob.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('recording', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.cancelRelocateJob(methodInput);
+        }),
+        planStorageRebalance: trpc_middleware_js_1.adminProcedure
+            .input(types_92.recordingCapability.methods.planStorageRebalance.input.loose())
+            .output(types_92.recordingCapability.methods.planStorageRebalance.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('recording', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.planStorageRebalance(methodInput);
+        }),
+        startStorageRebalance: trpc_middleware_js_1.adminProcedure
+            .input(types_92.recordingCapability.methods.startStorageRebalance.input.loose())
+            .output(types_92.recordingCapability.methods.startStorageRebalance.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('recording', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.startStorageRebalance(methodInput);
+        }),
     });
 }
 function createCapRouter_recordingExport(getProvider, createRemoteProxy) {

package/dist/core/addon/addon-registry.service.js

@@ -666,14 +666,15 @@ class AddonRegistryService {
         // one were declared — the mechanism stays available as an explicit
         // opt-in for future co-location needs.
         //
-        // `@camstack/system` builtins and `placement: 'agent-only'` addons are
-        // excluded from the plan (filtered inside `buildAddonGroupPlan`).
+        // `placement: 'agent-only'` addons and `@camstack/system` builtins are
+        // excluded from the plan (filtered inside `buildAddonGroupPlan`) — except
+        // a builtin declaring `execution.isolate`, which is spawned AFTER the
+        // in-process passes below (see `spawnRunnerPlan`'s two calls).
         // A failed runner spawn is logged and the addon surfaces as
         // `addon.error` — there is NO in-process-on-the-hub fallback (it
         // would violate one-addon-one-process). Retry policy for a failed
         // spawn is governed by the kernel circuit-breaker.
-        {
-            const plan = this.buildAddonGroupPlan(allIds);
+        const spawnRunnerPlan = async (plan) => {
             for (const [runnerId, runnerAddons] of plan) {
                 try {
                     await this.initializeAddonGroup(runnerId, runnerAddons);
@@ -694,7 +695,24 @@ class AddonRegistryService {
                     });
                 }
             }
-        }
+        };
+        // An ISOLATED builtin is a builtin: everything it stores lives behind
+        // `settings-store`, which is one of the in-process builtins booted below.
+        // Spawned here it would race them, and the failure would not look like a
+        // race — the snapshot wrapper mints its link-signing secret at init, so a
+        // store that answers "not ready" once yields either no signed-link plane
+        // for the life of the process or a NEW secret that invalidates every link
+        // a client is holding. Ordinary addons tolerate the same window because
+        // `readAddonStoreWithRetry` rides it out; an isolated builtin does not
+        // need to be lucky, because it can simply be spawned second.
+        const isolatedBuiltinIds = allIds.filter((id) => {
+            const entry = this.addonEntries.get(id);
+            return (entry?.packageName === '@camstack/system' &&
+                entry.declaration !== undefined &&
+                (0, types_1.isIsolatedBuiltin)(entry.declaration));
+        });
+        const isolatedBuiltins = new Set(isolatedBuiltinIds);
+        await spawnRunnerPlan(this.buildAddonGroupPlan(allIds.filter((id) => !isolatedBuiltins.has(id))));
         // In-process boot for `@camstack/system` builtins. Core builtins stay
         // resident on the hub process — they provide the storage / settings
         // / logging infrastructure every forked runner depends on, reachable
@@ -707,8 +725,12 @@ class AddonRegistryService {
         // A core builtin is identified by `packageName === "@camstack/system"`,
         // NOT by the absence of an `execution` declaration — a builtin may
         // still declare `execution` (e.g. `platform-probe`); the package
-        // boundary is the selection criterion.
-        const isCoreBuiltin = (id) => this.addonEntries.get(id)?.packageName === '@camstack/system';
+        // boundary is the selection criterion. The ONE exception is
+        // `execution.isolate`, which says "fork me": such a builtin must never
+        // boot in-process here, not even when its runner spawn failed. A spawn
+        // failure surfaces as `addon.error`; quietly running the addon on the hub
+        // instead would defeat the isolation on exactly the day it is needed.
+        const isCoreBuiltin = (id) => this.addonEntries.get(id)?.packageName === '@camstack/system' && !isolatedBuiltins.has(id);
         // Pass 1 — infrastructure builtins. A failed REQUIRED infra cap
         // aborts boot: nothing downstream can run without storage/settings.
         for (const infra of system_1.INFRA_CAPABILITIES) {
@@ -797,6 +819,15 @@ class AddonRegistryService {
                 }
             }
         }
+        // Isolated builtins, now that storage / settings / logging are resident.
+        // Same authority (`buildAddonGroupPlan`), same failure semantics — only the
+        // ORDER differs, and the order is the point.
+        if (isolatedBuiltinIds.length > 0) {
+            this.logger.info('Spawning isolated system builtins', {
+                meta: { addonIds: isolatedBuiltinIds },
+            });
+            await spawnRunnerPlan(this.buildAddonGroupPlan(isolatedBuiltinIds));
+        }
         const initializedIds = [...this.addonEntries.entries()]
             .filter(([, e]) => e.initialized)
             .map(([id]) => id);
@@ -1740,14 +1771,14 @@ class AddonRegistryService {
      * in-process by this predicate, so its route-mount took the co-located
      * path and received the async UDS cap proxy whose `getRoutes()` returns
      * a Promise (→ `getRoutes(...).map is not a function`). Only
-     * `@camstack/system` builtins boot in-process on the hub. The type
-     * predicate narrows both `addonDir` and `declaration` for callers.
+     * `@camstack/system` builtins boot in-process on the hub — except one that
+     * declares `execution.isolate`, which forks like anything else. Both
+     * questions are answered by `runsInOwnRunner`, so the two can no longer
+     * disagree. The type predicate narrows both `addonDir` and `declaration`
+     * for callers.
      */
     isForkedAddonEntry(entry) {
-        return !!(entry.declaration &&
-            entry.addonDir &&
-            entry.packageName !== '@camstack/system' &&
-            (0, types_1.resolveAddonPlacement)(entry.declaration) !== 'agent-only');
+        return !!(entry.declaration && entry.addonDir && this.runsInOwnRunner(entry));
     }
     /** Per-entry helper used by `listAddons()` to mark a row removable / not. */
     isRequiredEntry(entry) {
@@ -2798,12 +2829,18 @@ class AddonRegistryService {
      *     passes a live JS reference across a process boundary any more.
      *
      * Addons with `placement: 'agent-only'` are dropped (they don't run on
-     * the hub). `@camstack/system` builtins are dropped too — they stay
-     * in-process on the hub (every forked runner connects to the hub
-     * broker via static-URL TCP transit, so cap providers hosted on the
-     * hub broker are reachable from any runner with one hop; moving them
-     * into a sibling subprocess would isolate them on a separate Moleculer
-     * node that child brokers cannot reach).
+     * the hub). `@camstack/system` builtins are dropped too — UNLESS the
+     * manifest entry declares `execution.isolate: true`.
+     *
+     * The reason builtins stay in-process is that the infrastructure ones
+     * (storage, settings, logging, device-manager) must live in the process
+     * every runner depends on. It is NOT, as the comment here used to claim,
+     * that a subprocess would be unreachable: `docs/architecture/transport.md`
+     * is explicit that there is no per-addon Moleculer broker and that a child
+     * reaches the hub AND ITS SIBLINGS over the UDS channel —
+     * `LocalChildRegistry` implements exactly that. The old claim was wrong and
+     * nearly stopped the snapshot split; `docs/decisions/adr-0113.md` records
+     * what replaced it.
      *
      * Read-only. Used by the bootstrap to plan spawns up-front and by
      * diagnostics that want to render the current topology.
@@ -2814,10 +2851,7 @@ class AddonRegistryService {
             const entry = this.addonEntries.get(id);
             if (!entry?.declaration || !entry.addonDir)
                 continue;
-            if (entry.packageName === '@camstack/system')
-                continue;
-            const placement = (0, types_1.resolveAddonPlacement)(entry.declaration);
-            if (placement === 'agent-only')
+            if (!this.runsInOwnRunner(entry))
                 continue;
             const runnerId = (0, types_1.resolveRunnerId)(entry.declaration, id);
             const bucket = plan.get(runnerId) ?? [];
@@ -2826,6 +2860,26 @@ class AddonRegistryService {
         }
         return plan;
     }
+    /**
+     * THE fork predicate: does this entry boot in its own runner subprocess?
+     *
+     * Every consumer of "forked vs in-process" asks THIS — the runner plan, the
+     * in-process boot passes, route mounts, data-plane mounts, restart and
+     * uninstall. They are required to agree, and when they did not
+     * (`isForkedAddonEntry` demanding an `execution` block the plan did not)
+     * `auth-oidc` was forked at boot yet classified in-process, and its routes
+     * were registered against an async UDS proxy (`getRoutes(...).map is not a
+     * function`).
+     */
+    runsInOwnRunner(entry) {
+        if (!entry.declaration || !entry.addonDir)
+            return false;
+        if ((0, types_1.resolveAddonPlacement)(entry.declaration) === 'agent-only')
+            return false;
+        if (entry.packageName !== '@camstack/system')
+            return true;
+        return (0, types_1.isIsolatedBuiltin)(entry.declaration);
+    }
     /**
      * Spawn ONE runner subprocess that hosts every addon in `addons` and
      * register their custom-actions catalogs against the shared

package/dist/core/moleculer/moleculer.service.js

@@ -261,6 +261,17 @@ class MoleculerService {
                 // handler retries the hub-local route then throws a precise error rather
                 // than the unroutable broker fallback (`switch.switch.getStatus`).
                 isDeviceNativeCap: (capName) => this.capabilityService.getRegistry()?.getDefinition(capName)?.deviceNative === true,
+                // `native: true` route — a forked WRAPPER asking for the per-device
+                // native behind its own cap name (the snapshot wrapper, once it moved
+                // out of hub-main). `getNativeProvider` is the single authority that
+                // can tell the two apart: in-process natives, hub-local vendor children
+                // (via `setNativeFallback` → `resolveHubLocalUdsRoute`, which skips any
+                // in-hub provider shadowing the name) and remote agents. Every other
+                // route here resolves by cap name and would hand the wrapper back to
+                // itself.
+                resolveNative: (capName, deviceId) => this.capabilityService
+                    .getRegistry()
+                    ?.getNativeProvider(capName, deviceId) ?? null,
                 // `nodeIdMode: 'data'` signal: for these caps (`addon-settings`,
                 // `addons`, `nodes`, `pipeline-orchestrator`) an inline `args.nodeId`
                 // is provider DATA — the hub singleton dispatches internally — never a

package/dist/first-boot-addon-plan.js

@@ -0,0 +1,209 @@
+"use strict";
+/**
+ * What a node WOULD install at first boot once the image stops carrying an
+ * addon seed tree — [D45](../../../docs/decisions/adr-0045.md), task 32.
+ *
+ * Operator directive, 2026-08-12: the docker seed stays for `@camstack/server`
+ * and the system packages ("una copia di server e dei pacchetti di sistema"),
+ * and *"tutti gli altri addons devono rimanere copia unica, sempre, installati
+ * durante l'avvio iniziale"*. Dropping `/opt/camstack-seed-addons` moves the
+ * version decision from image-build time — where the Dockerfile installs the
+ * exact version the hub closure resolved — to boot time. Something then has to
+ * answer two questions the seed answered implicitly:
+ *
+ * 1. **Which version?** The closure's own `package.json` is the pin, and it is
+ *    not always there: `@camstack/server` 1.2.90…1.2.94 were published with
+ *    `"@camstack/addon-pipeline": "*"` (pin-root-deps did not run on those
+ *    releases), 1.2.96+ carry exact versions. Unpinned resolves to `latest`,
+ *    and that is REPORTED rather than hidden — a node that installed
+ *    latest-of-everything cannot answer "what shipped here".
+ * 2. **What about the copy already on disk?** It wins, always
+ *    ([D90](../../../docs/decisions/adr-0090.md)). The live hub runs
+ *    `addon-pipeline` 1.2.69 against an image seed of 1.2.64; replacing a
+ *    deployed copy with the closure's number is exactly the rollback the
+ *    unconditional `cp -a` caused. So an installed copy is ADOPTED — and a gap
+ *    against the pin is reported, never repaired behind the operator's back.
+ *
+ * Everything here is pure: the caller supplies the roster, the pins and what is
+ * on disk. It installs nothing and it decides nothing about booting — the
+ * launcher runs it in OBSERVE mode, which prints the plan and changes no
+ * behaviour.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWantedVersion = resolveWantedVersion;
+exports.compareVersions = compareVersions;
+exports.bootstrapPinsFrom = bootstrapPinsFrom;
+exports.planFirstBootAddons = planFirstBootAddons;
+exports.formatFirstBootPlan = formatFirstBootPlan;
+/** A plain `major.minor.patch`, optionally with a prerelease/build suffix. */
+const EXACT_VERSION = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/;
+/**
+ * The version a fetch should ask for, given whatever the closure declared.
+ *
+ * Only an EXACT version is a pin. A range (`^1.2.0`) is deliberately not
+ * honoured: `installFromNpm`'s registry path resolves exact versions and
+ * dist-tags only (ranges fall back to `npm pack`), so pretending to support one
+ * here would produce a spec the fetch cannot use. Everything else — `*`, a
+ * range, an absent dep — becomes `latest`, flagged as unpinned so the caller
+ * can say it out loud.
+ */
+function resolveWantedVersion(raw) {
+    if (raw !== undefined && EXACT_VERSION.test(raw))
+        return { spec: raw, pinned: true };
+    return { spec: 'latest', pinned: false };
+}
+/**
+ * Compare two plain versions. `1` when `a` is newer, `-1` when older, `0` when
+ * equal, `null` when either side is not a plain `x.y.z`.
+ *
+ * A local comparator rather than `@camstack/node-root`'s: that package is
+ * `private: true` and is ABSENT from the server closure, and this module is
+ * reached from `launcher.ts`, which is `tsc` output rather than a bundle — an
+ * import of it would be an unresolvable `require` at boot (the trap recorded in
+ * `docs/architecture/update-and-release.md`). Prerelease ordering is not
+ * modelled: nothing in the bootstrap roster ships one, and guessing at
+ * prerelease precedence would be a second, subtly different semver.
+ */
+function compareVersions(a, b) {
+    if (!EXACT_VERSION.test(a) || !EXACT_VERSION.test(b))
+        return null;
+    const parse = (v) => v
+        .split(/[-+]/)[0]
+        .split('.')
+        .map((n) => Number.parseInt(n, 10));
+    const left = parse(a);
+    const right = parse(b);
+    for (let i = 0; i < 3; i++) {
+        const l = left[i] ?? 0;
+        const r = right[i] ?? 0;
+        if (l !== r)
+            return l > r ? 1 : -1;
+    }
+    return 0;
+}
+/** The `@camstack/*` half of a closure manifest's dependencies — the pins. */
+function bootstrapPinsFrom(manifest) {
+    const out = {};
+    for (const [name, spec] of Object.entries(manifest.dependencies ?? {})) {
+        if (name.startsWith('@camstack/'))
+            out[name] = spec;
+    }
+    return out;
+}
+/** The plan. Pure; installs nothing. */
+function planFirstBootAddons(input) {
+    const provided = new Set(input.closureProvided);
+    const decisions = input.required.map((pkg) => decide(pkg, input.closurePins[pkg], input.installed, provided));
+    const wouldInstall = decisions.filter((d) => d.action === 'install-npm').map((d) => d.pkg);
+    return {
+        decisions,
+        wouldInstall,
+        unpinned: decisions
+            .filter((d) => d.action === 'install-npm' && !d.want.pinned)
+            .map((d) => d.pkg),
+        divergent: decisions.filter((d) => d.divergent).map((d) => d.pkg),
+        needsRegistry: wouldInstall.length > 0,
+    };
+}
+function decide(pkg, pin, installed, closureProvided) {
+    const want = resolveWantedVersion(pin);
+    const hasEntry = Object.hasOwn(installed, pkg);
+    const version = installed[pkg] ?? null;
+    // Host-provided and reachable: a copy under the addon root WINS over the
+    // closure and nothing refreshes it — the shape that left both agents 17
+    // versions behind. Same rule as `shouldSkipClosureProvidedSeed`.
+    if (closureProvided.has(pkg)) {
+        return {
+            pkg,
+            action: 'skip-closure-provided',
+            want,
+            installedVersion: version,
+            divergent: false,
+            reason: 'provided by the server closure — a copy here would shadow it (D15)',
+        };
+    }
+    if (version === null) {
+        return {
+            pkg,
+            action: 'install-npm',
+            want,
+            installedVersion: null,
+            divergent: false,
+            reason: hasEntry
+                ? `installed copy has an unreadable package.json — fetching ${want.spec}`
+                : want.pinned
+                    ? `absent — fetch ${want.spec}, the version the running closure pins`
+                    : 'absent, and the closure carries no pin — fetching latest',
+        };
+    }
+    return {
+        pkg,
+        action: 'adopt-installed',
+        want,
+        installedVersion: version,
+        ...adoptionVerdict(version, want),
+    };
+}
+/**
+ * Whether an installed copy agrees with the pin — and, when it does not, in
+ * which direction. The copy is adopted either way: `<dataDir>/addons` is the
+ * runtime authority and an image number must never outrank it (D90). What
+ * changes is whether the boot says something about it.
+ */
+function adoptionVerdict(version, want) {
+    if (!want.pinned) {
+        return { divergent: false, reason: `installed ${version}; the closure carries no pin to check` };
+    }
+    const order = compareVersions(version, want.spec);
+    if (order === null) {
+        return { divergent: true, reason: `installed ${version} is not comparable to pin ${want.spec}` };
+    }
+    if (order === 0)
+        return { divergent: false, reason: `installed ${version} matches the pin` };
+    const sameMajor = version.split('.')[0] === want.spec.split('.')[0];
+    if (!sameMajor) {
+        return {
+            divergent: true,
+            reason: `installed ${version} is a different major from the pinned ${want.spec} — a framework contract, not a version gap`,
+        };
+    }
+    if (order > 0) {
+        return {
+            divergent: false,
+            reason: `installed ${version} is ahead of the pinned ${want.spec} — a deploy outranks the image (D90)`,
+        };
+    }
+    return {
+        divergent: true,
+        reason: `installed ${version} is BEHIND the pinned ${want.spec} — kept, because replacing it is an un-deploy`,
+    };
+}
+/**
+ * The report.
+ *
+ * Always states the roster it checked and how much work it found, even when
+ * that is none: a boot that prints nothing is indistinguishable from a boot
+ * where the check did not run, and this repo has paid for that twice. In
+ * `observe` the lines say so explicitly — an observe line that reads like an
+ * install is worse than no line at all.
+ */
+function formatFirstBootPlan(plan, mode) {
+    const header = `first-boot addon plan (${mode}) — ${plan.decisions.length} package(s), ` +
+        `${plan.wouldInstall.length} to install, ${plan.divergent.length} divergent`;
+    const lines = [
+        mode === 'observe' ? `${header}; nothing was installed from this plan` : header,
+    ];
+    for (const d of plan.decisions) {
+        const target = d.action === 'install-npm' ? `@${d.want.spec}` : '';
+        lines.push(`  ${d.pkg}${target} — ${d.action}: ${d.reason}`);
+    }
+    if (plan.unpinned.length > 0) {
+        lines.push(`  unpinned (would resolve the registry's latest): ${plan.unpinned.join(', ')} — ` +
+            'the running closure declares no exact version for these, so what a node ends ' +
+            'up with depends on when it booted');
+    }
+    if (!plan.needsRegistry) {
+        lines.push('  no registry access needed — every required addon is already on disk');
+    }
+    return lines;
+}

package/dist/launcher.js

@@ -54,12 +54,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
-const tar = __importStar(require("tar"));
 const yaml = __importStar(require("js-yaml"));
-const framework_nodepath_js_1 = require("./framework-nodepath.js");
+const tar = __importStar(require("tar"));
 const addon_root_inventory_js_1 = require("./addon-root-inventory.js");
-const package_inventory_js_1 = require("./package-inventory.js");
 const bootstrap_packages_js_1 = require("./bootstrap-packages.js");
+const first_boot_addon_plan_js_1 = require("./first-boot-addon-plan.js");
+const framework_nodepath_js_1 = require("./framework-nodepath.js");
+const package_inventory_js_1 = require("./package-inventory.js");
 /** Path of the manifest file embedded inside every archive. */
 const ARCHIVE_MANIFEST_NAME = '.camstack-backup-manifest.json';
 /** Resolve the data directory from env or default */
@@ -206,15 +207,44 @@ function readBootstrapInstallSource(dataDir, bootstrapSchema) {
  * `launch()` on import, so nothing declared here can be imported by a spec).
  */
 function deriveBootstrapFromSelf() {
+    const pkg = readOwnManifest();
+    return pkg === null ? [] : (0, bootstrap_packages_js_1.selectHubBootstrapPackages)(pkg);
+}
+/**
+ * THIS server closure's own `package.json` — the roster's source and, when
+ * `pin-root-deps` ran for the release, the exact version of every bootstrap
+ * addon. Read by absolute path for the same reason `deriveBootstrapFromSelf`
+ * is: the slim image strips the `@camstack/*` symlinks, so `require.resolve`
+ * would answer nothing here.
+ */
+function readOwnManifest() {
     try {
         const pkgPath = path.resolve(__dirname, '..', 'package.json');
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
-        return (0, bootstrap_packages_js_1.selectHubBootstrapPackages)(pkg);
+        return JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
     }
     catch (err) {
-        console.warn(`[launcher] could not derive bootstrap list from package.json: ${err instanceof Error ? err.message : String(err)}`);
-        return [];
+        console.warn(`[launcher] could not read the server manifest: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+/** The version each required package currently has under the addon root. */
+function readInstalledAddonVersions(addonRoot, packages) {
+    const out = {};
+    for (const name of packages) {
+        const pkgJson = path.join(addonRoot, name, 'package.json');
+        if (!fs.existsSync(pkgJson))
+            continue;
+        try {
+            const raw = JSON.parse(fs.readFileSync(pkgJson, 'utf-8'));
+            const version = typeof raw === 'object' && raw !== null ? raw.version : undefined;
+            out[name] = typeof version === 'string' ? version : null;
+        }
+        catch {
+            // Present but unreadable is NOT absent — the plan says so in its own words.
+            out[name] = null;
+        }
     }
+    return out;
 }
 /**
  * Read `bootstrap.requiredAddons` from `<dataDir>/config.yaml` if present.
@@ -364,6 +394,44 @@ async function launch() {
     const roleDefaultBootstrap = role === 'agent' ? AddonInstaller.AGENT_PACKAGES : deriveBootstrapFromSelf();
     const bootstrapRequired = readBootstrapRequiredAddons(dataDir, bootstrapSchema) ?? roleDefaultBootstrap;
     console.log(`[launcher] bootstrap (${role}): ${bootstrapRequired.length} required package(s)`);
+    // WHAT WOULD A SEED-FREE IMAGE DO HERE? (D45 task 32 — OBSERVE ONLY)
+    //
+    // The image still bakes an addon seed tree, so `ensureRequiredPackages` below
+    // usually finds every package already on disk. Once the seed leaves the image
+    // ("tutti gli altri addons devono rimanere copia unica, sempre, installati
+    // durante l'avvio iniziale", 2026-08-12) this same roster has to come from the
+    // registry, at a version somebody chose. This block prints that plan and
+    // NOTHING ELSE: no install, no version argument, no branch. It exists so the
+    // decision can be read off real boots — how many packages a node would fetch,
+    // which ones the closure carries no pin for, and where a deployed copy already
+    // disagrees with it — before any of it is switched on.
+    //
+    // Diagnostics, so it can never end a boot: same policy as the inventories.
+    try {
+        const ownManifest = readOwnManifest();
+        const plan = (0, first_boot_addon_plan_js_1.planFirstBootAddons)({
+            required: bootstrapRequired,
+            closurePins: ownManifest === null ? {} : (0, first_boot_addon_plan_js_1.bootstrapPinsFrom)(ownManifest),
+            installed: readInstalledAddonVersions(addonsDir, bootstrapRequired),
+            // Mirrors `shouldSkipClosureProvidedSeed`: only `@camstack/system`, and
+            // only while it actually resolves.
+            closureProvided: (() => {
+                try {
+                    require.resolve('@camstack/system/package.json');
+                    return ['@camstack/system'];
+                }
+                catch {
+                    return [];
+                }
+            })(),
+        });
+        for (const line of (0, first_boot_addon_plan_js_1.formatFirstBootPlan)(plan, 'observe')) {
+            console.log(`[launcher] ${line}`);
+        }
+    }
+    catch (err) {
+        console.warn(`[launcher] first-boot addon plan failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     await installer.ensureRequiredPackages(bootstrapRequired);
     // Reconcile the install manifest against what is on disk — the directory is
     // the truth, because it is what the loader runs. Registers image-seeded
@@ -472,12 +540,21 @@ async function launch() {
     // 1.2.30), so every version the node reported was true of a copy nobody was
     // running.
     //
-    // Reported, not fatal. Every node in the fleet currently HAS extra copies —
-    // the image seeds under /opt and the legacy /data/framework — and D45 records
-    // their removal as a deliberate, scheduled migration with a container
-    // recreate as the escape hatch, not something a routine boot should enact by
-    // refusing to start. `CAMSTACK_INVENTORY_STRICT=1` makes it fatal, which is
-    // how a layout that HAS been cleaned keeps itself clean.
+    // Only the copies nobody deposits on purpose are reported. The /opt seeds
+    // are baked into the image and shadowed by the /data/server-root/current
+    // deposit on every applyServerUpdate — calling those a violation printed the
+    // banner at every boot on every node, which is how it stopped being read.
+    // They get one compact line instead; an unexpected location (the legacy
+    // /data/framework, a bootstrap install under /data/addons) and two copies
+    // that could both run still scream.
+    //
+    // NEVER fatal — operator directive, 2026-08-12: "non dovremmo mai prevenire
+    // il boot". There is no flag that turns this into a refusal. A node that
+    // cannot start is a camera system that is not recording, and the inventory is
+    // the thing that was supposed to EXPLAIN a bad layout, not enact a verdict on
+    // it. Removing a copy stays an operator decision.
+    //
+    // [inventory-diagnostics-begin] enforced by scripts/check-inventory-never-fatal.ts
     try {
         const inventory = (0, package_inventory_js_1.inventoryHostProvided)((0, package_inventory_js_1.hostProvidedSearchRoots)({
             nodePath: process.env['NODE_PATH'],
@@ -508,13 +585,12 @@ async function launch() {
                 }
             },
         });
+        for (const note of (0, package_inventory_js_1.formatShadowingNotes)(inventory)) {
+            console.log(`[launcher] ${note}`);
+        }
         const report = (0, package_inventory_js_1.formatInventoryReport)(inventory);
         if (report !== '') {
             console.error(`[launcher] ${report}`);
-            if (process.env['CAMSTACK_INVENTORY_STRICT'] === '1') {
-                console.error('[launcher] CAMSTACK_INVENTORY_STRICT=1 — refusing to boot on this layout');
-                process.exit(1);
-            }
         }
     }
     catch (err) {
@@ -532,10 +608,9 @@ async function launch() {
     // not run since June. Measured on the Mac agent: four addon roots, four
     // truthful `addon-pipeline` versions, one of them the running node's.
     //
-    // Reported, never fatal, never deleted here — same policy as D45. Making the
-    // second location LOUD is the whole job; removing it stays an operator
-    // decision. `CAMSTACK_INVENTORY_STRICT=1` makes it fatal, which is how a
-    // machine that HAS been cleaned keeps itself clean.
+    // Reported, never fatal, never deleted here — same policy as D45 above, and
+    // no flag changes it. Making the second location LOUD is the whole job;
+    // removing it stays an operator decision.
     try {
         const addonRoots = (0, addon_root_inventory_js_1.inventoryAddonRoots)({
             dataDir: DATA_DIR,
@@ -579,15 +654,12 @@ async function launch() {
         const addonRootReport = (0, addon_root_inventory_js_1.formatAddonRootReport)(addonRoots);
         if (addonRootReport !== '') {
             console.error(`[launcher] ${addonRootReport}`);
-            if (process.env['CAMSTACK_INVENTORY_STRICT'] === '1') {
-                console.error('[launcher] CAMSTACK_INVENTORY_STRICT=1 — refusing to boot on this layout');
-                process.exit(1);
-            }
         }
     }
     catch (err) {
         console.warn(`[launcher] addon-root inventory failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    // [inventory-diagnostics-end]
     // Now safe to load the role's runtime entry (both have static imports from
     // @camstack/system, resolved only after the framework dir + NODE_PATH setup
     // above). The agent boots from THIS same @camstack/server closure — there is

package/dist/main.js

@@ -888,7 +888,15 @@ async function bootstrap() {
                     return reply.status(404).send({ error: 'Not found' });
                 }
                 if (method === 'GET' && spaIndexHtml) {
-                    return reply.type('text/html').send(fs.createReadStream(spaIndexHtml));
+                    // An addon deep-link that is not an addon ROUTE is an admin-UI page —
+                    // serve the admin shell, under the SAME no-store policy as `/`. This
+                    // send used to carry no cache header at all, so browsers kept the
+                    // index.html of a previous build (and its dead hashed asset names)
+                    // across deploys until a force refresh.
+                    return reply
+                        .header('cache-control', (0, spa_static_1.spaShellCacheControl)())
+                        .type('text/html')
+                        .send(fs.createReadStream(spaIndexHtml));
                 }
                 return reply.status(404).send({ error: 'Not found' });
             }
@@ -1115,7 +1123,7 @@ async function bootstrap() {
             }
             return reply.callNotFound();
         }
-        reply.header('cache-control', 'no-cache, must-revalidate');
+        reply.header('cache-control', (0, spa_static_1.spaShellCacheControl)());
         return reply.type('text/html').send(fs.createReadStream(indexPath));
     });
     fastify.get('/*', async (request, reply) => {
@@ -1143,7 +1151,7 @@ async function bootstrap() {
             }
             return reply.callNotFound();
         }
-        reply.header('cache-control', 'no-cache, must-revalidate');
+        reply.header('cache-control', (0, spa_static_1.spaShellCacheControl)());
         return reply.type('text/html').send(fs.createReadStream(indexPath));
     });
     const resolveAdminUi = async () => {

package/dist/package-inventory.js

@@ -38,6 +38,7 @@ exports.hostProvidedSearchRoots = hostProvidedSearchRoots;
 exports.seedNodeModulesRoots = seedNodeModulesRoots;
 exports.inventoryHostProvided = inventoryHostProvided;
 exports.formatInventoryReport = formatInventoryReport;
+exports.formatShadowingNotes = formatShadowingNotes;
 /**
  * Boot-time inventory of host-provided packages — enforcement step 2 of
  * [D45](../../../docs/decisions/adr-0045.md).
@@ -54,6 +55,16 @@ exports.formatInventoryReport = formatInventoryReport;
  * This answers the other half — "what else is lying around that could have
  * run" — which is the question a resolved path alone cannot.
  *
+ * WHERE a copy sits decides whether it is noise or a violation. Two of the four
+ * copies above are EXPECTED: the `/opt` seed trees are baked into the image and
+ * deliberately shadowed by the `/data/server-root/current` deposit on every
+ * `applyServerUpdate`. Counting them as a violation printed the banner at every
+ * boot on every node, which taught the operator to scroll past the one boot
+ * where it mattered — the exact failure D45 exists to prevent. So the detector
+ * classifies locations and screams only for a copy nobody deposits on purpose,
+ * or for two copies that could BOTH be the one that runs. The expected
+ * shadowing gets one compact line instead.
+ *
  * Everything here is pure: the caller injects the three filesystem operations,
  * so the whole inventory is testable against a described layout rather than a
  * real disk.
@@ -78,24 +89,39 @@ exports.HOST_PROVIDED_PACKAGES = [
  * to a handful of stat calls at boot. `/data/addons` is a root in its own right
  * because the bootstrap-install layout puts the package DIRECTLY there
  * (`/data/addons/@camstack/system`), not under a `node_modules`.
+ *
+ * A `NODE_PATH` entry is classified by WHICH directory it names, not by being
+ * on `NODE_PATH`: the launcher puts the deposit and the seeds there itself, so
+ * "it is on NODE_PATH" would mark the whole fleet unexpected.
  */
 function hostProvidedSearchRoots(input) {
     const fromNodePath = (input.nodePath ?? '')
         .split(input.pathSeparator)
         .map((p) => p.trim())
         .filter((p) => p.length > 0);
+    const seedPaths = new Set(input.seedRoots);
+    const expectationFor = (dir) => {
+        if (dir === input.serverNodeModules)
+            return 'active';
+        if (seedPaths.has(dir))
+            return 'seed';
+        return 'unexpected';
+    };
     const roots = [
-        input.serverNodeModules,
-        ...fromNodePath,
-        path.join(input.dataDir, 'framework', 'node_modules'),
-        path.join(input.dataDir, 'addons'),
-        ...input.seedRoots,
+        { path: input.serverNodeModules, expectation: 'active' },
+        ...fromNodePath.map((p) => ({ path: p, expectation: expectationFor(p) })),
+        { path: path.join(input.dataDir, 'framework', 'node_modules'), expectation: 'unexpected' },
+        { path: path.join(input.dataDir, 'addons'), expectation: 'unexpected' },
+        ...input.seedRoots.map((p) => ({ path: p, expectation: expectationFor(p) })),
     ];
+    // First occurrence wins, and the deposit is listed first — so a directory
+    // that is both the closure and a seed keeps the classification that decides
+    // whether it runs.
     const seen = new Set();
     return roots.filter((r) => {
-        if (seen.has(r))
+        if (seen.has(r.path))
             return false;
-        seen.add(r);
+        seen.add(r.path);
         return true;
     });
 }
@@ -136,45 +162,106 @@ function inventoryHostProvided(roots, fs, packages = exports.HOST_PROVIDED_PACKA
         // them two would cry wolf on a node that is actually compliant.
         const seenReal = new Set();
         for (const root of roots) {
-            const dir = path.join(root, pkg);
+            const dir = path.join(root.path, pkg);
             if (!fs.exists(dir))
                 continue;
             const real = fs.realPath(dir);
             if (seenReal.has(real))
                 continue;
             seenReal.add(real);
-            copies.push({ pkg, path: dir, version: fs.readVersion(dir) });
+            copies.push({ pkg, path: dir, version: fs.readVersion(dir), location: root.expectation });
         }
     }
-    const countByPkg = new Map();
+    const byPkg = new Map();
     for (const c of copies)
-        countByPkg.set(c.pkg, (countByPkg.get(c.pkg) ?? 0) + 1);
-    const duplicated = [...countByPkg.entries()]
-        .filter(([, n]) => n > 1)
-        .map(([pkg]) => pkg)
-        .sort();
-    return { copies, duplicated, rootsScanned: roots };
+        byPkg.set(c.pkg, [...(byPkg.get(c.pkg) ?? []), c]);
+    const inventories = [...byPkg.entries()]
+        .map(([pkg, found]) => classifyPackage(pkg, found))
+        .sort((a, b) => a.pkg.localeCompare(b.pkg));
+    return {
+        copies,
+        packages: inventories,
+        violations: inventories.filter((p) => p.violation).map((p) => p.pkg),
+        rootsScanned: roots.map((r) => r.path),
+    };
+}
+/**
+ * Sort one package's copies into what each one means.
+ *
+ * A deposit copy shadows every seed — that is what `applyServerUpdate` does on
+ * every release, so those seeds are not candidates for anything. With no
+ * deposit copy the seeds ARE the candidates, and two of them is the resolution
+ * race D45 was written about.
+ */
+function classifyPackage(pkg, found) {
+    const active = found.filter((c) => c.location === 'active');
+    const seeds = found.filter((c) => c.location === 'seed');
+    const unexpected = found.filter((c) => c.location === 'unexpected');
+    const activeCandidates = active.length > 0 ? active : seeds;
+    const shadowedSeeds = active.length > 0 ? seeds : [];
+    return {
+        pkg,
+        copies: found,
+        activeCandidates,
+        shadowedSeeds,
+        unexpected,
+        violation: unexpected.length > 0 || activeCandidates.length > 1,
+    };
 }
 /**
- * The loud report. Empty string when the node is clean — a compliant boot says
- * nothing, so the one that isn't stands out instead of scrolling past.
+ * The loud report. Empty string unless a copy is somewhere nobody deposits on
+ * purpose, or two copies could both be the one that runs — an expected seed
+ * under the deposit is the fleet's normal shape and reports nothing here, or
+ * the banner would print on every boot of every node and be read on none.
  */
 function formatInventoryReport(result) {
-    if (result.duplicated.length === 0)
+    const violating = result.packages.filter((p) => p.violation);
+    if (violating.length === 0)
         return '';
     const lines = [
-        'D45 violation — a host-provided package exists more than once on this node.',
-        'Which copy runs is a module-resolution outcome, and every version this node',
-        'reports is a claim about one of them rather than about the node.',
+        'D45 violation — a host-provided package sits somewhere it must not, or two',
+        'copies could both be the one that runs. Which copy runs is then a',
+        'module-resolution outcome, and every version this node reports is a claim',
+        'about one of them rather than about the node.',
         '',
     ];
-    for (const pkg of result.duplicated) {
-        const found = result.copies.filter((c) => c.pkg === pkg);
-        lines.push(`  ${pkg} — ${found.length} copies:`);
-        for (const c of found) {
-            lines.push(`    ${c.version ?? '<unreadable package.json>'}  ${c.path}`);
+    for (const inv of violating) {
+        lines.push(`  ${inv.pkg} — ${inv.copies.length} copies:`);
+        for (const c of inv.copies) {
+            lines.push(`    ${c.version ?? '<unreadable package.json>'}  [${describeLocation(c, inv)}]  ${c.path}`);
         }
     }
     lines.push('', `  roots scanned: ${result.rootsScanned.join(', ')}`);
     return lines.join('\n');
 }
+/** Why this one copy is (or is not) part of the problem, in one word or two. */
+function describeLocation(copy, inv) {
+    if (copy.location === 'unexpected')
+        return 'UNEXPECTED — remove it';
+    if (inv.activeCandidates.includes(copy)) {
+        return inv.activeCandidates.length > 1 ? 'CONFLICTS — could run' : 'active';
+    }
+    return 'image seed, shadowed';
+}
+/**
+ * The quiet half: the expected seed shadowing, one compact line per package.
+ *
+ * Deliberately not a banner and deliberately not phrased as a fault — the image
+ * bakes these trees and the deposit shadows them on every release. A package
+ * already named in {@link formatInventoryReport} is skipped: the banner lists
+ * all of its copies, and a reassuring line beside it would read as verification.
+ */
+function formatShadowingNotes(result) {
+    return result.packages
+        .filter((p) => !p.violation && p.shadowedSeeds.length > 0)
+        .map((p) => {
+        const seedVersions = [...new Set(p.shadowedSeeds.map(describeVersion))].join(', ');
+        const active = p.activeCandidates[0];
+        const activeVersion = active === undefined ? 'unknown' : describeVersion(active);
+        const activePath = active === undefined ? '' : ` (${active.path})`;
+        return `${p.pkg} — seed ${seedVersions} shadowed by active ${activeVersion}${activePath}`;
+    });
+}
+function describeVersion(copy) {
+    return copy.version ?? '<unreadable package.json>';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.99",
+  "version": "1.2.101",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.49",
-    "@camstack/addon-agent-ui": "1.2.13",
-    "@camstack/addon-auth": "1.2.14",
-    "@camstack/addon-decoder-nodeav": "1.2.12",
-    "@camstack/addon-notifiers": "1.2.17",
-    "@camstack/addon-pipeline": "1.2.68",
-    "@camstack/addon-pipeline-orchestrator": "1.2.49",
-    "@camstack/addon-post-analysis": "1.2.65",
-    "@camstack/sdk": "1.2.14",
-    "@camstack/shm-ring": "1.1.12",
-    "@camstack/system": "1.2.83",
-    "@camstack/types": "1.2.62",
-    "@camstack/ui-library": "1.2.42",
+    "@camstack/addon-admin-ui": "1.2.51",
+    "@camstack/addon-agent-ui": "1.2.14",
+    "@camstack/addon-auth": "1.2.15",
+    "@camstack/addon-decoder-nodeav": "1.2.13",
+    "@camstack/addon-notifiers": "1.2.18",
+    "@camstack/addon-pipeline": "1.2.70",
+    "@camstack/addon-pipeline-orchestrator": "1.2.50",
+    "@camstack/addon-post-analysis": "1.2.67",
+    "@camstack/sdk": "1.2.15",
+    "@camstack/shm-ring": "1.1.13",
+    "@camstack/system": "1.2.85",
+    "@camstack/types": "1.2.64",
+    "@camstack/ui-library": "1.2.43",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",