@camstack/system 1.2.131 → 1.2.133

package/dist/kernel/moleculer/trpc-links.d.ts

@@ -1,7 +1,7 @@
-import { ServiceBroker } from 'moleculer';
 import { TRPCLink } from '@trpc/client';
 import { AnyRouter } from '@trpc/server';
-import { LocalChildRegistry, CapCallInput } from '../transport/index.js';
+import { ServiceBroker } from 'moleculer';
+import { CapCallInput, LocalChildRegistry } from '../transport/index.js';
 /**
  * Resolver for in-process capability providers.
  *
@@ -51,11 +51,39 @@ export type CapUsageObserver = (obs: CapUsageObservation) => void;
 export interface CapUsageObserverOptions {
     /** The addon whose `ctx.api` produced this link chain. */
     readonly callerAddonId: string;
-    /** Resolve which addon hosts the provider for `capName`. Return `null` to skip recording. */
+    /**
+     * Resolve which addon hosts the provider for `capName`. `null` means "not in
+     * the LOCAL registry" — which is every cross-process provider, and no longer
+     * means "do not record": see {@link UNRESOLVED_PROVIDER_ADDON_ID}.
+     */
     readonly providerAddonIdForCap: (capName: string) => string | null;
     /** Sink for observations. MUST NOT throw — wrapper catches anyway. */
     readonly observer: CapUsageObserver;
 }
+/**
+ * Stands in for a provider the LOCAL registry cannot name.
+ *
+ * `providerAddonIdForCap` only searches the local registry, so it returns
+ * `null` for every cross-process provider — which is every forked runner,
+ * `sqlite-settings` included. That `null` used to drop the whole observation,
+ * caller and all. The result: `nodes.getCapUsageGraph`, an admin API whose
+ * entire job is to show caller → provider → cap traffic, returned an EMPTY
+ * ARRAY on the live hub while the engine logged 39 717 calls a minute to a
+ * single collection. An empty graph reads as "nothing is calling anything".
+ *
+ * The caller is always known — it is whoever made the call — and "who is
+ * hammering this cap" is the question the graph exists to answer. So the
+ * observation is recorded and the unknown half stays VISIBLY unknown, which is
+ * a fact an operator can act on, rather than absent, which is a fact nobody can
+ * see. Naming the provider properly needs the cluster-wide cap list; until then
+ * this placeholder is the honest value.
+ */
+export declare const UNRESOLVED_PROVIDER_ADDON_ID = "(unresolved: cross-process)";
+/**
+ * Record one cap call, if an observer is configured. Extracted so the rule —
+ * an unresolved provider never erases the caller — has ONE place and a test.
+ */
+export declare function recordCapUsage(observerOpts: CapUsageObserverOptions, capName: string, methodName: string): void;
 /**
  * Non-terminating tRPC link that intercepts calls when the target
  * capability has a provider registered in the local process.

package/dist/{manifest-python-deps-Dmcnb287.mjs → manifest-python-deps-08rqn6xN.mjs}

@@ -6089,8 +6089,21 @@ function createHubCapForwardService(onUnownedCall) {
 		} } }
 	};
 }
-//#endregion
-//#region src/kernel/moleculer/trpc-links.ts
+/**
+* Record one cap call, if an observer is configured. Extracted so the rule —
+* an unresolved provider never erases the caller — has ONE place and a test.
+*/
+function recordCapUsage(observerOpts, capName, methodName) {
+	try {
+		observerOpts.observer({
+			callerAddonId: observerOpts.callerAddonId,
+			providerAddonId: observerOpts.providerAddonIdForCap(capName) ?? "(unresolved: cross-process)",
+			capName,
+			methodName,
+			atMs: Date.now()
+		});
+	} catch {}
+}
 /** Convert camelCase → kebab-case. */
 function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
@@ -6140,16 +6153,7 @@ function localProviderLink(resolver, observerOpts) {
 			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
 			if (typeof fn !== "function") return next(opWithDefaults);
-			if (observerOpts) try {
-				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
-				if (providerAddonId) observerOpts.observer({
-					callerAddonId: observerOpts.callerAddonId,
-					providerAddonId,
-					capName: parsed.capName,
-					methodName: parsed.method,
-					atMs: Date.now()
-				});
-			} catch {}
+			if (observerOpts) recordCapUsage(observerOpts, parsed.capName, parsed.method);
 			return observable((observer) => {
 				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
@@ -6410,9 +6414,9 @@ function brokerTransportLink(broker, serviceMap, observerOpts, linkOptions) {
 					}
 					if (observerOpts) try {
 						const providerAddonId = serviceName !== parsed.capName ? serviceName : observerOpts.providerAddonIdForCap(parsed.capName);
-						if (providerAddonId) observerOpts.observer({
+						observerOpts.observer({
 							callerAddonId: observerOpts.callerAddonId,
-							providerAddonId,
+							providerAddonId: providerAddonId ?? "(unresolved: cross-process)",
 							capName: parsed.capName,
 							methodName: parsed.method,
 							atMs: Date.now()

package/dist/{manifest-python-deps-BTkFwAk_.js → manifest-python-deps-C9x9vrqt.js}

@@ -6093,8 +6093,21 @@ function createHubCapForwardService(onUnownedCall) {
 		} } }
 	};
 }
-//#endregion
-//#region src/kernel/moleculer/trpc-links.ts
+/**
+* Record one cap call, if an observer is configured. Extracted so the rule —
+* an unresolved provider never erases the caller — has ONE place and a test.
+*/
+function recordCapUsage(observerOpts, capName, methodName) {
+	try {
+		observerOpts.observer({
+			callerAddonId: observerOpts.callerAddonId,
+			providerAddonId: observerOpts.providerAddonIdForCap(capName) ?? "(unresolved: cross-process)",
+			capName,
+			methodName,
+			atMs: Date.now()
+		});
+	} catch {}
+}
 /** Convert camelCase → kebab-case. */
 function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
@@ -6144,16 +6157,7 @@ function localProviderLink(resolver, observerOpts) {
 			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
 			if (typeof fn !== "function") return next(opWithDefaults);
-			if (observerOpts) try {
-				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
-				if (providerAddonId) observerOpts.observer({
-					callerAddonId: observerOpts.callerAddonId,
-					providerAddonId,
-					capName: parsed.capName,
-					methodName: parsed.method,
-					atMs: Date.now()
-				});
-			} catch {}
+			if (observerOpts) recordCapUsage(observerOpts, parsed.capName, parsed.method);
 			return observable((observer) => {
 				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
@@ -6414,9 +6418,9 @@ function brokerTransportLink(broker, serviceMap, observerOpts, linkOptions) {
 					}
 					if (observerOpts) try {
 						const providerAddonId = serviceName !== parsed.capName ? serviceName : observerOpts.providerAddonIdForCap(parsed.capName);
-						if (providerAddonId) observerOpts.observer({
+						observerOpts.observer({
 							callerAddonId: observerOpts.callerAddonId,
-							providerAddonId,
+							providerAddonId: providerAddonId ?? "(unresolved: cross-process)",
 							capName: parsed.capName,
 							methodName: parsed.method,
 							atMs: Date.now()

package/dist/{lan-http-bind-jKrj6OjQ.mjs → tls-CQhPGSJm.mjs}

@@ -8,6 +8,139 @@ import { tmpdir } from "node:os";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
+//#region src/http/lan-http-bind.ts
+/**
+* Second HTTP listener that shares the hub's existing request handler.
+*
+* Fastify is one protocol per instance; HTTPS stays on :4443 and this
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
+*/
+var DEFAULT_HTTP_PORT = 4480;
+var handlers = null;
+var server = null;
+var pending = null;
+var state = {
+	listening: false,
+	error: null,
+	port: DEFAULT_HTTP_PORT
+};
+var boundRequestedHost = null;
+var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
+function registerLanHttpHandler(next) {
+	handlers = next;
+}
+function readLanHttpState() {
+	return state;
+}
+async function applyLanHttp(options) {
+	pending = options;
+	if (!options.enabled) {
+		await closeLanHttp();
+		state = {
+			listening: false,
+			error: null,
+			port: options.port
+		};
+		return state;
+	}
+	if (handlers === null) {
+		state = {
+			listening: false,
+			error: "HTTP listener is not registered yet",
+			port: options.port
+		};
+		return state;
+	}
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
+	await closeLanHttp();
+	try {
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
+		state = {
+			listening: true,
+			error: null,
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
+		};
+		return state;
+	} catch (err) {
+		server = null;
+		state = {
+			listening: false,
+			error: err instanceof Error ? err.message : String(err),
+			port: options.port
+		};
+		return state;
+	}
+}
+/** After the hub registers the Fastify request handler, bind whatever was pending. */
+async function bindPendingLanHttp() {
+	if (pending === null) return applyLanHttp({
+		enabled: true,
+		port: DEFAULT_HTTP_PORT,
+		host: "0.0.0.0"
+	});
+	return applyLanHttp(pending);
+}
+async function closeLanHttp() {
+	const current = server;
+	server = null;
+	boundRequestedHost = null;
+	if (current === null) return;
+	await new Promise((resolve) => {
+		current.close(() => resolve());
+	});
+}
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
+	return new Promise((resolve, reject) => {
+		const created = createServer(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
+		const onError = (err) => {
+			created.off("listening", onListening);
+			created.close();
+			reject(err);
+		};
+		const onListening = () => {
+			created.off("error", onError);
+			resolve(created);
+		};
+		created.once("error", onError);
+		created.once("listening", onListening);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
+	});
+}
+//#endregion
 //#region src/tls/cert-evaluation.ts
 /**
 * The regeneration rule (D227), as a pure function.
@@ -616,137 +749,4 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 	}
 }
 //#endregion
-//#region src/http/lan-http-bind.ts
-/**
-* Second HTTP listener that shares the hub's existing request handler.
-*
-* Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
-* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
-*
-* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
-* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
-* hangs because nobody handles the upgrade on this socket.
-*/
-var DEFAULT_HTTP_PORT = 4480;
-var handlers = null;
-var server = null;
-var pending = null;
-var state = {
-	listening: false,
-	error: null,
-	port: DEFAULT_HTTP_PORT
-};
-var boundRequestedHost = null;
-var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
-/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
-function allFamiliesListenHost(host) {
-	if (host === "0.0.0.0" || host === "*" || host === "") return {
-		host: "::",
-		ipv6Only: false
-	};
-	return {
-		host,
-		ipv6Only: false
-	};
-}
-function registerLanHttpHandler(next) {
-	handlers = next;
-}
-function readLanHttpState() {
-	return state;
-}
-async function applyLanHttp(options) {
-	pending = options;
-	if (!options.enabled) {
-		await closeLanHttp();
-		state = {
-			listening: false,
-			error: null,
-			port: options.port
-		};
-		return state;
-	}
-	if (handlers === null) {
-		state = {
-			listening: false,
-			error: "HTTP listener is not registered yet",
-			port: options.port
-		};
-		return state;
-	}
-	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
-	await closeLanHttp();
-	try {
-		const bound = await listenHttp(options.port, options.host, handlers);
-		server = bound;
-		boundRequestedHost = options.host;
-		const addr = bound.address();
-		state = {
-			listening: true,
-			error: null,
-			port: typeof addr === "object" && addr !== null ? addr.port : options.port
-		};
-		return state;
-	} catch (err) {
-		server = null;
-		state = {
-			listening: false,
-			error: err instanceof Error ? err.message : String(err),
-			port: options.port
-		};
-		return state;
-	}
-}
-/** After the hub registers the Fastify request handler, bind whatever was pending. */
-async function bindPendingLanHttp() {
-	if (pending === null) return applyLanHttp({
-		enabled: true,
-		port: DEFAULT_HTTP_PORT,
-		host: "0.0.0.0"
-	});
-	return applyLanHttp(pending);
-}
-async function closeLanHttp() {
-	const current = server;
-	server = null;
-	boundRequestedHost = null;
-	if (current === null) return;
-	await new Promise((resolve) => {
-		current.close(() => resolve());
-	});
-}
-function listenHttp(port, host, next) {
-	const resolved = allFamiliesListenHost(host);
-	return listenOn(port, resolved, next).catch((err) => {
-		if (resolved.host === "::" && host !== "::") return listenOn(port, {
-			host: "0.0.0.0",
-			ipv6Only: false
-		}, next);
-		throw err;
-	});
-}
-function listenOn(port, bind, next) {
-	return new Promise((resolve, reject) => {
-		const created = createServer(next.onRequest);
-		created.on("upgrade", next.onUpgrade);
-		const onError = (err) => {
-			created.off("listening", onListening);
-			created.close();
-			reject(err);
-		};
-		const onListening = () => {
-			created.off("error", onError);
-			resolve(created);
-		};
-		created.once("error", onError);
-		created.once("listening", onListening);
-		created.listen({
-			port,
-			host: bind.host,
-			ipv6Only: bind.ipv6Only
-		});
-	});
-}
-//#endregion
-export { evaluateExistingCert as C, SERVER_AUTH_OID as S, CA_COMMON_NAME as _, closeLanHttp as a, LEAF_RENEWAL_WINDOW_DAYS as b, readExtraSans as c, writeExtraSans as d, writeTlsMode as f, reissueTlsLeaf as g, loadTlsCert as h, bindPendingLanHttp as i, readTlsAccessStatus as l, ensureTlsCert as m, allFamiliesListenHost as n, readLanHttpState as o, validateUploadedTls as p, applyLanHttp as r, registerLanHttpHandler as s, DEFAULT_LAN_HTTP_PORT as t, readTlsMode as u, collectCertIdentity as v, MAX_LEAF_VALIDITY_DAYS as x, CA_VALIDITY_DAYS as y };
+export { registerLanHttpHandler as C, readLanHttpState as S, DEFAULT_LAN_HTTP_PORT as _, writeTlsMode as a, bindPendingLanHttp as b, loadTlsCert as c, collectCertIdentity as d, CA_VALIDITY_DAYS as f, evaluateExistingCert as g, SERVER_AUTH_OID as h, writeExtraSans as i, reissueTlsLeaf as l, MAX_LEAF_VALIDITY_DAYS as m, readTlsAccessStatus as n, validateUploadedTls as o, LEAF_RENEWAL_WINDOW_DAYS as p, readTlsMode as r, ensureTlsCert as s, readExtraSans as t, CA_COMMON_NAME as u, allFamiliesListenHost as v, closeLanHttp as x, applyLanHttp as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.131",
+  "version": "1.2.133",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",