@checkstack/signal-frontend 0.0.16 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,143 @@
 # @checkstack/signal-frontend
 
+## 0.1.1
+
+### Patch Changes
+
+- 50e5f5f: Runtime plugin system: install + uninstall plugins from npm, GitHub releases
+  (including private GitHub Enterprise instances), or tarball uploads at
+  runtime, with multi-package bundles, dependency-derived compatibility checks,
+  multi-instance coordination via a Postgres artifact store, and
+  single-coordinator destructive cleanup.
+
+  Highlights:
+
+  - New `PluginSource` discriminated union and `PluginInstaller` /
+    `PluginInstallerRegistry` interfaces in `@checkstack/backend-api`. The
+    GitHub variant accepts an optional `apiBaseUrl` so deployments backed by
+    GitHub Enterprise can install from `https://ghe.example.com/api/v3`
+    instead of `api.github.com`.
+  - New `installPackageMetadataSchema` (Zod) in `@checkstack/common` validates
+    every plugin's `package.json` at install time. Required fields: `name`,
+    `version`, `description`, `author`, `license`, `checkstack.type`,
+    `checkstack.pluginId`. Optional: `checkstack.bundle`,
+    `checkstack.usageInstructions`, `checkstack.allowInstallScripts`.
+  - New `pluginManagerContract` in `@checkstack/pluginmanager-common` with
+    `list`, `previewInstall`, `install`, `previewUninstall`, `uninstall`, and
+    `events` procedures.
+  - New `@checkstack/pluginmanager-frontend` admin UI: installed-plugins list
+    with per-row uninstall (typed-confirmation modal, schema/configs/cascade
+    toggles), install page with NPM / Tarball Upload / GitHub Release tabs
+    (Catalog tab disabled — coming soon), and an events page surfacing the
+    install/uninstall audit log.
+  - New `bunx @checkstack/scripts plugin-pack` CLI for plugin authors —
+    per-package mode produces an npm-shaped tarball; `--bundle` mode produces
+    an outer tarball containing every sibling declared in
+    `package.json#checkstack.bundle`. Published to npm so external authors
+    can `bunx` it directly without a workspace checkout.
+  - Compatibility derived from `package.json#dependencies` ranges
+    (`semver.satisfies` against the platform's loaded `@checkstack/*`
+    versions) — no separate `compatibility` field.
+  - Multi-instance: originator persists artifacts + `plugins` rows + broadcasts
+    install/uninstall; receiving instances do in-process register/unregister
+    only. Destructive ops (drop schema, delete plugin_configs, delete
+    artifacts, delete `plugins` rows) run exactly once on the originator.
+  - Fresh-instance bootstrap: `loadPlugins()` hydrates any
+    `is_uninstallable=true` plugin missing from `node_modules` from the
+    artifact store before normal Phase 1 register.
+  - New schema: `plugin_artifacts` (tarball storage), `plugin_install_events`
+    (audit/error log). `plugins` extended with `version`, `metadata`,
+    `source`, `bundle_id`, `is_primary`. Local plugin sync now writes
+    `version` from each plugin's `package.json` so the admin UI shows real
+    versions instead of `—`.
+  - Tarball-upload endpoint (`POST /api/pluginmanager/upload-tarball`) for
+    the install UI; access-gated by `pluginmanager.plugin.manage`.
+  - Plugin Manager menu link added to the user menu (main grid, alongside
+    Profile / Notification Settings / etc.).
+
+  Cross-cutting changes:
+
+  - Backend request/response logging now flows through `rootLogger` (winston)
+    instead of `hono/logger`. 5xx responses include the response body inline
+    so swallowed early-return errors are visible in the log.
+  - The `/api/:pluginId/*` dispatcher now logs which core service is missing
+    or which `pluginId` had no metadata when it 500s.
+  - New `registerCorePluginMetadata` on `PluginManager` for core routers
+    (like the plugin manager itself) that need their metadata visible to the
+    RPC dispatcher without going through the full plugin lifecycle.
+  - ESLint: `unicorn/no-null` is now disabled globally. Drizzle distinguishes
+    between `null` (writes a real SQL NULL) and `undefined` (skip the column
+    on insert), so treating them as interchangeable produced latent bugs at
+    the persistence boundary. The bulk of the patch-bumped packages above
+    reflect lint-fix touches that landed when this rule was relaxed.
+  - Workspace-wide license normalization to `Elastic-2.0` (matches
+    `LICENSE.md`). Every `package.json` in the workspace now declares the
+    same SPDX identifier; the patch bumps capture this.
+
+  Plugin packages (every `plugins/*`): added a `pack` npm script
+  (`bunx @checkstack/scripts plugin-pack`), mirrored each plugin's
+  `pluginId` from `plugin-metadata.ts` into `package.json#checkstack.pluginId`
+  so install-time validation passes, stubbed any missing required metadata
+  fields (`description`, `author`, `license`), and added
+  `checkstack.bundle` to multi-package plugin primaries (telegram, rcon, ssh,
+  jira, queue-bullmq, queue-memory, cache-memory).
+
+  Breaking changes:
+
+  - The legacy single-method `PluginInstaller` interface (`install(packageName)`)
+    is removed. Callers must use `coreServices.pluginInstallerRegistry`.
+  - The old `pluginAdminContract` and `createPluginAdminRouter` are removed.
+    Replaced by `pluginManagerContract` in `@checkstack/pluginmanager-common`
+    and `createPluginManagerRouter` in `core/backend`.
+  - `@checkstack/test-utils-backend` no longer exports
+    `createMockPluginInstaller` / `MockPluginInstaller` (the legacy interface
+    it shimmed is gone).
+
+  Note: bumps are limited to `minor` (for packages with new public API
+  surface) and `patch` (for downstream consumers, license normalization,
+  and lint fixes). No `major` bumps despite the `PluginInstaller` removal —
+  the legacy interface had no third-party consumers in the wild before this
+  runtime plugin system landed, and the contract surface is the same shape
+  modulo the rename.
+
+  - @checkstack/signal-common@0.2.1
+
+## 0.1.0
+
+### Minor Changes
+
+- 208ad71: Centralize realtime cache invalidation: signals now carry their owning `pluginId` end-to-end, and a single `SignalAutoInvalidator` mounted near the React Query client invalidates `[[pluginId]]` for every incoming signal automatically.
+
+  **Breaking change to `createSignal`** (`@checkstack/signal-common`): the factory now takes a single object argument with `pluginMetadata`, `event`, and `payloadSchema`. The signal id is constructed as `${pluginMetadata.pluginId}.${event}` and the resulting `Signal` carries a `pluginId` field. The `SignalMessage` wire envelope and `ServerToClientMessage` `signal` variant gained a `pluginId` field so the frontend can route invalidations without parsing the id.
+
+  ```ts
+  // Before
+  export const ANOMALY_STATE_CHANGED = createSignal(
+    "anomaly.state_changed",
+    z.object({ ... }),
+  );
+
+  // After
+  export const ANOMALY_STATE_CHANGED = createSignal({
+    pluginMetadata,
+    event: "state_changed",
+    payloadSchema: z.object({ ... }),
+  });
+  ```
+
+  **New plugin field**: `FrontendPlugin.foreignSignals?: Signal<unknown>[]` lets a plugin opt its `[[pluginId]]` cache into invalidation when another plugin's signal fires (e.g. `dependency-frontend` declares `[SYSTEM_STATUS_CHANGED]` because dependency payloads embed system status). Same-plugin signals must NOT be listed — they are always auto-invalidated.
+
+  **Removed boilerplate**: per-component `useSignal(X, () => refetch())` and `useSignal(X, () => queryClient.invalidateQueries(...))` calls have been removed across `incident-frontend`, `maintenance-frontend`, `healthcheck-frontend`, `slo-frontend`, `dependency-frontend`, `satellite-frontend`, `announcement-frontend`, `notification-frontend`, and `dashboard-frontend`. The `NotificationBell` unread count is now derived directly from the `getUnreadCount` query (auto-invalidated) instead of a local state mirror.
+
+  **User-visible bug fix**: the system detail page anomaly widget (`SystemAnomalyWidget`) now updates in real-time when anomalies change, with no per-widget signal subscription required. The dashboard status page also stays fresh on `ANOMALY_STATE_CHANGED`, `ANOMALY_BASELINE_UPDATED`, and `ANOMALY_TREND_DETECTED`.
+
+  UI-state consumers that legitimately need a `useSignal` (the dashboard activity terminal, the queue lag alert, and the rolling-preset date refresh in `useHealthCheckData`) keep their handlers; the auto-invalidator runs alongside them.
+
+### Patch Changes
+
+- Updated dependencies [208ad71]
+  - @checkstack/signal-common@0.2.0
+
 ## 0.0.16
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@checkstack/signal-frontend",
-  "version": "0.0.16",
+  "version": "0.1.1",
+  "license": "Elastic-2.0",
   "type": "module",
   "exports": {
     ".": {
@@ -11,16 +12,16 @@
     "react": "^18.0.0"
   },
   "dependencies": {
-    "@checkstack/signal-common": "0.1.9"
+    "@checkstack/signal-common": "0.2.0"
   },
   "devDependencies": {
     "@types/react": "^18.0.0",
     "typescript": "^5.7.2",
-    "@checkstack/tsconfig": "0.0.5",
+    "@checkstack/tsconfig": "0.0.6",
     "@checkstack/scripts": "0.1.2"
   },
   "scripts": {
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsgo -b",
     "lint": "bun run lint:code",
     "lint:code": "eslint . --max-warnings 0"
   },

package/src/SignalProvider.tsx

@@ -15,11 +15,27 @@ import type {
 // CONTEXT TYPES
 // =============================================================================
 
+/**
+ * Wildcard subscription callback. Fires for every incoming signal message
+ * regardless of signalId, with the pluginId already extracted from the wire envelope.
+ * Used by the auto-invalidation layer; not intended for component-level use.
+ */
+export type SignalAllCallback = (props: {
+  signalId: string;
+  pluginId: string;
+  payload: unknown;
+}) => void;
+
 interface SignalContextValue {
   /** Whether the WebSocket connection is established */
   isConnected: boolean;
-  /** Subscribe to a signal. Returns an unsubscribe function. */
+  /** Subscribe to a specific signal. Returns an unsubscribe function. */
   subscribe<T>(signal: Signal<T>, callback: (payload: T) => void): () => void;
+  /**
+   * Subscribe to ALL incoming signals. Returns an unsubscribe function.
+   * Used by the auto-invalidation layer to receive every message.
+   */
+  subscribeAll(callback: SignalAllCallback): () => void;
 }
 
 const SignalContext = createContext<SignalContextValue | undefined>(undefined);
@@ -58,6 +74,7 @@ export const SignalProvider: React.FC<SignalProviderProps> = ({
   const listenersRef = useRef<Map<string, Set<(payload: unknown) => void>>>(
     new Map()
   );
+  const allListenersRef = useRef<Set<SignalAllCallback>>(new Set());
   const reconnectTimeoutRef = useRef<ReturnType<typeof setTimeout> | undefined>(
     undefined
   );
@@ -115,6 +132,14 @@ export const SignalProvider: React.FC<SignalProviderProps> = ({
                 callback(message.payload);
               }
             }
+            // Notify wildcard listeners (auto-invalidator etc.)
+            for (const callback of allListenersRef.current) {
+              callback({
+                signalId: message.signalId,
+                pluginId: message.pluginId,
+                payload: message.payload,
+              });
+            }
           }
           // Ignore "connected" and "pong" messages
         } catch (error) {
@@ -154,9 +179,17 @@ export const SignalProvider: React.FC<SignalProviderProps> = ({
     []
   );
 
+  const subscribeAll = useCallback((callback: SignalAllCallback) => {
+    allListenersRef.current.add(callback);
+    return () => {
+      allListenersRef.current.delete(callback);
+    };
+  }, []);
+
   const value: SignalContextValue = {
     isConnected,
     subscribe,
+    subscribeAll,
   };
 
   return (

package/src/index.ts

@@ -1,5 +1,13 @@
 // Provider component
-export { SignalProvider, useSignalContext } from "./SignalProvider";
+export {
+  SignalProvider,
+  useSignalContext,
+  type SignalAllCallback,
+} from "./SignalProvider";
 
 // Hooks
-export { useSignal, useSignalConnection } from "./useSignal";
+export {
+  useSignal,
+  useSignalConnection,
+  useSubscribeAllSignals,
+} from "./useSignal";

package/src/useSignal.ts

@@ -1,6 +1,6 @@
 import { useEffect, useRef } from "react";
 import type { Signal } from "@checkstack/signal-common";
-import { useSignalContext } from "./SignalProvider";
+import { useSignalContext, type SignalAllCallback } from "./SignalProvider";
 
 /**
  * Subscribe to a signal and receive typed payloads.
@@ -65,3 +65,27 @@ export function useSignalConnection(): { isConnected: boolean } {
   const { isConnected } = useSignalContext();
   return { isConnected };
 }
+
+/**
+ * Subscribe to ALL incoming signals. Used by the auto-invalidation layer.
+ *
+ * The callback receives `signalId`, `pluginId`, and the raw payload for every
+ * signal message that arrives over the WebSocket. Subscriptions are automatically
+ * cleaned up on unmount; the latest callback is always used (no stale closures).
+ *
+ * Component code should prefer the typed `useSignal(signal, ...)` hook over this.
+ */
+export function useSubscribeAllSignals(callback: SignalAllCallback): void {
+  const { subscribeAll } = useSignalContext();
+
+  const callbackRef = useRef(callback);
+  callbackRef.current = callback;
+
+  useEffect(() => {
+    const stableCallback: SignalAllCallback = (props) => {
+      callbackRef.current(props);
+    };
+
+    return subscribeAll(stableCallback);
+  }, [subscribeAll]);
+}

package/tsconfig.json

@@ -2,5 +2,10 @@
   "extends": "@checkstack/tsconfig/frontend.json",
   "include": [
     "src"
+  ],
+  "references": [
+    {
+      "path": "../signal-common"
+    }
   ]
-}
+}