@checkstack/backend-api 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,81 @@
 # @checkstack/backend-api
 
+## 0.12.0
+
+### Minor Changes
+
+- 26d8bae: Distributed satellite health checks and Assignment IDE page
+
+  **Satellite System**
+
+  - New `satellite-backend`, `satellite-common`, `satellite-frontend`, and `satellite` agent packages for distributed health check execution
+  - WebSocket-based satellite connectivity with authentication, heartbeats, and live configuration push
+  - Satellite management UI with create dialog, status badges, and list page
+
+  **Live Configuration Updates**
+
+  - Added `assignmentChanged` hook to `healthcheck-backend` for cross-plugin communication
+  - `satellite-backend` subscribes to assignment changes and pushes config updates to connected satellites in real-time
+
+  **Assignment IDE Page**
+
+  - Replaced the 1028-line modal-based `SystemHealthCheckAssignment` component with a full-page IDE layout
+  - New modular components: `AssignmentTree`, `GeneralPanel`, `ThresholdsPanel`, `RetentionPanel`, `ExecutionPanel`
+  - Added unassign capability and sorted assignment lists for stable ordering
+
+  **Shared IDE Primitives**
+
+  - Extracted `IDETreeNode`, `IDETreeSection`, `IDEStatusBar`, `IDELayout` to `@checkstack/ui` for cross-plugin reuse
+  - Migrated existing health check IDE editor to use shared primitives
+
+  **Infrastructure**
+
+  - Added `Dockerfile.satellite` for containerized satellite deployment
+  - WebSocket route registry in `@checkstack/backend` and `@checkstack/backend-api`
+
+### Patch Changes
+
+- Updated dependencies [26d8bae]
+- Updated dependencies [26d8bae]
+  - @checkstack/healthcheck-common@0.11.0
+  - @checkstack/queue-api@0.2.13
+
+## 0.11.1
+
+### Patch Changes
+
+- d1a2796: Enforce stricter code quality standards and eliminate AI slop anti-patterns.
+
+  **New utility**
+
+  - `extractErrorMessage(error, fallback?)` in `@checkstack/common` for consistent error extraction
+
+  **ESLint rules**
+
+  - `react-hooks/rules-of-hooks` and `exhaustive-deps` for hook correctness
+  - `no-console` in frontend packages — forces `toast` over silent `console.error`
+  - `no-restricted-syntax` banning `instanceof Error` — forces `extractErrorMessage`
+  - Custom `no-eslint-disable-any` rule preventing `@typescript-eslint/no-explicit-any` circumvention
+
+  **Refactoring**
+
+  - Replace 141 `instanceof Error` boilerplate patterns across the codebase
+  - Replace swallowed `console.error` with user-visible `toast.error()` feedback
+  - Remove 15 redundant `as` type casts in IntegrationsPage and ProviderConnectionsPage
+  - Consolidate 3 identical callback handlers into `handleDialogClose`
+  - Fix conditional React hook call in `FormField.tsx`
+  - Fix unstable useMemo deps in `Dashboard.tsx`
+  - Replace `useEffect`→`setState` with derived `useMemo` in `RegisterPage.tsx`
+  - Rewrite `keystore.test.ts` with typed `DrizzleMockChain` (eliminating 7 `any` suppressions)
+  - Delete obvious comments in `encryption.ts` and Teams `provider.ts`
+
+- Updated dependencies [d1a2796]
+- Updated dependencies [3c34b07]
+  - @checkstack/common@0.6.5
+  - @checkstack/healthcheck-common@0.10.1
+  - @checkstack/signal-common@0.1.9
+  - @checkstack/queue-api@0.2.12
+
 ## 0.11.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/backend-api",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "type": "module",
   "main": "./src/index.ts",
   "scripts": {
@@ -9,10 +9,10 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/common": "0.6.4",
-    "@checkstack/healthcheck-common": "0.8.4",
-    "@checkstack/queue-api": "0.2.9",
-    "@checkstack/signal-common": "0.1.8",
+    "@checkstack/common": "0.6.5",
+    "@checkstack/healthcheck-common": "0.10.1",
+    "@checkstack/queue-api": "0.2.12",
+    "@checkstack/signal-common": "0.1.9",
     "@orpc/client": "^1.13.14",
     "@orpc/contract": "^1.13.14",
     "@orpc/openapi": "^1.13.2",
@@ -25,7 +25,7 @@
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "@checkstack/tsconfig": "0.0.4",
+    "@checkstack/tsconfig": "0.0.5",
     "@checkstack/scripts": "0.1.2"
   },
   "peerDependencies": {

package/src/config-versioning.ts

@@ -66,8 +66,7 @@ export class MigrationBuilder<TCurrent> {
     migration: Migration<TCurrent, TNext>
   ): MigrationBuilder<TNext> {
     this.migrations.push(migration);
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    return this as any as MigrationBuilder<TNext>;
+    return this as unknown as MigrationBuilder<TNext>;
   }
 
   /**

package/src/core-services.ts

@@ -14,6 +14,7 @@ import {
   RpcClient,
 } from "./types";
 import type { EventBus } from "./event-bus-types";
+import type { WebSocketRouteRegistry } from "./ws-registry";
 
 export * from "./types";
 
@@ -43,4 +44,5 @@ export const coreServices = {
   config: createServiceRef<ConfigService>("core.config"),
   eventBus: createServiceRef<EventBus>("core.eventBus"),
   signalService: createServiceRef<SignalService>("core.signalService"),
+  wsRegistry: createServiceRef<WebSocketRouteRegistry>("core.wsRegistry"),
 };

package/src/encryption.ts

@@ -30,22 +30,18 @@ const getMasterKey = (): Buffer => {
 export const encrypt = (plaintext: string): string => {
   const key = getMasterKey();
 
-  // Generate random IV (12 bytes for GCM)
   const iv = crypto.randomBytes(12);
 
-  // Create cipher
   const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
 
-  // Encrypt
   const encrypted = Buffer.concat([
     cipher.update(plaintext, "utf8"),
     cipher.final(),
   ]);
 
-  // Get auth tag
   const authTag = cipher.getAuthTag();
 
-  // Return base64-encoded iv:authTag:ciphertext
+
   return `${iv.toString("base64")}:${authTag.toString(
     "base64"
   )}:${encrypted.toString("base64")}`;
@@ -58,7 +54,6 @@ export const encrypt = (plaintext: string): string => {
 export const decrypt = (encrypted: string): string => {
   const key = getMasterKey();
 
-  // Parse the encrypted string
   const parts = encrypted.split(":");
   if (parts.length !== 3) {
     throw new Error("Invalid encrypted format");
@@ -68,11 +63,9 @@ export const decrypt = (encrypted: string): string => {
   const authTag = Buffer.from(parts[1], "base64");
   const ciphertext = Buffer.from(parts[2], "base64");
 
-  // Create decipher
   const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
   decipher.setAuthTag(authTag);
 
-  // Decrypt
   const decrypted = Buffer.concat([
     decipher.update(ciphertext),
     decipher.final(),

package/src/index.ts

@@ -27,3 +27,4 @@ export * from "./collector-strategy";
 export * from "./collector-registry";
 export * from "./incremental-aggregation";
 export * from "./aggregated-result";
+export * from "./ws-registry";

package/src/oauth-handler.ts

@@ -7,6 +7,8 @@
  * @module @checkstack/backend-api/oauth-handler
  */
 
+import { extractErrorMessage } from "@checkstack/common";
+
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 // OAuth Configuration Interface
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
@@ -416,7 +418,7 @@ export function createOAuthHandler(
         return Response.json(result);
       } catch (error) {
         return Response.json(
-          { error: error instanceof Error ? error.message : "Refresh failed" },
+          { error: extractErrorMessage(error, "Refresh failed") },
           { status: 500 }
         );
       }

package/src/ws-registry.ts

@@ -0,0 +1,70 @@
+/**
+ * A generic interface for a WebSocket connection managed by the core server.
+ * Plugins interact with WebSocket clients through this adapter, insulating
+ * them from the underlying Bun WebSocket API.
+ */
+export interface WsConnection {
+  /** Send a string message to the client */
+  send(data: string): void;
+  /** Close the connection */
+  close(): void;
+}
+
+/**
+ * Per-connection handlers returned by a route handler's `onConnection` callback.
+ * These closures capture the connection's state (e.g., auth state, session data).
+ */
+export interface WsConnectionHandlers {
+  onMessage: (message: string) => void | Promise<void>;
+  onClose: () => void;
+}
+
+/**
+ * A WebSocket route handler registered by a plugin.
+ * The core server calls `onConnection` when a new WebSocket is opened on
+ * the handler's registered path, and the handler returns per-connection
+ * event callbacks.
+ */
+export interface WebSocketRouteHandler {
+  /**
+   * Called when a new WebSocket connection opens on this route.
+   * Return per-connection message/close handlers.
+   */
+  onConnection(ws: WsConnection): WsConnectionHandlers;
+}
+
+/**
+ * Scoped registry for plugin WebSocket route handlers.
+ * Each plugin receives a scoped instance (via factory) that auto-prefixes
+ * the pluginId — just like the RPC service.
+ *
+ * Plugins register handlers with a local path segment, and the core server
+ * makes them available under `/api/ws/{pluginId}{path}`.
+ *
+ * @example
+ * ```ts
+ * // In satellite-backend init (pluginId "satellite" is auto-prefixed):
+ * wsRegistry.register("/", handler);
+ * // → Available at /api/ws/satellite
+ *
+ * wsRegistry.register("/connect", handler);
+ * // → Available at /api/ws/satellite/connect
+ * ```
+ */
+export interface WebSocketRouteRegistry {
+  /**
+   * Register a WebSocket route handler at the given path.
+   * The pluginId prefix is applied automatically by the scoped factory.
+   */
+  register(path: string, handler: WebSocketRouteHandler): void;
+}
+
+/**
+ * Core-level store for all registered WS routes.
+ * The backend server uses this to look up handlers during WebSocket upgrade.
+ * Not exposed to plugins — they interact via the scoped `WebSocketRouteRegistry`.
+ */
+export interface WebSocketRouteStore {
+  /** Look up a handler by full path (e.g., "satellite" or "satellite/connect"). */
+  getHandler(fullPath: string): WebSocketRouteHandler | undefined;
+}