@camstack/server 1.2.110 → 1.2.111

package/dist/api/core/cap-providers.js

@@ -77,11 +77,13 @@ const integration_id_backfill_1 = require("../../boot/integration-id-backfill");
 const addon_package_service_js_1 = require("../../core/addon/addon-package.service.js");
 const lifecycle_runner_singleton_js_1 = require("../../core/lifecycle/lifecycle-runner.singleton.js");
 const collection_preference_js_1 = require("./collection-preference.js");
+const site_location_js_1 = require("./site-location.js");
 // ── system ──────────────────────────────────────────────────────────
 function getRetention(registry) {
     return (registry?.getSingleton('analysis-data-persistence')?.retention ?? null);
 }
-function buildSystemProvider(feature, registry) {
+function buildSystemProvider(feature, registry, moleculer, logger) {
+    const siteLocation = buildSiteLocationService(moleculer, logger);
     return {
         info: async () => feature.getManifest(),
         health: async () => ({ status: 'ok', uptime: process.uptime() }),
@@ -109,8 +111,37 @@ function buildSystemProvider(feature, registry) {
         forceRetentionCleanup: async () => {
             await getRetention(registry)?.forceCleanup();
         },
+        getSiteLocation: async () => siteLocation.get(),
+        setSiteLocation: async (input) => siteLocation.set(input),
+        detectSiteLocation: async () => siteLocation.detect(),
     };
 }
+/**
+ * Site location, backed by the `system-settings` collection through the broker.
+ *
+ * Without a broker (unit tests that build the provider bare) the store fails
+ * closed: reads throw, so the derivation cannot fire and cannot invent a
+ * location out of a missing dependency.
+ */
+function buildSiteLocationService(moleculer, logger) {
+    const broker = moleculer?.broker;
+    const store = {
+        get: async (input) => {
+            if (broker === undefined)
+                throw new Error('settings-store unavailable: no broker');
+            return broker.call('settings-store.get', input);
+        },
+        set: async (input) => {
+            if (broker === undefined)
+                throw new Error('settings-store unavailable: no broker');
+            await broker.call('settings-store.set', input);
+        },
+    };
+    return new site_location_js_1.SiteLocationService({
+        store,
+        ...(logger !== undefined ? { logger } : {}),
+    });
+}
 // ── network-quality ─────────────────────────────────────────────────
 function buildNetworkQualityProvider(nq) {
     return {

package/dist/api/core/site-location.js

@@ -0,0 +1,389 @@
+"use strict";
+/**
+ * Site location — the installation's coordinates, as a fact of the SITE.
+ *
+ * ## Why this is not an addon setting
+ *
+ * Latitude and longitude used to live in `pipeline-analytics`' global settings,
+ * because scene monitoring was the first thing to need sun-times. That made a
+ * property of the *building* a property of one analytics addon: a second
+ * consumer would either import the first addon's key (addons never import each
+ * other) or grow a second knob that disagrees with it — the mistake
+ * [D62](../../../../../docs/decisions/adr-0062.md) records. It lives here, on
+ * the hub, behind `system.getSiteLocation`, and every consumer reads that one
+ * authority over the transport.
+ *
+ * ## The default, and why it is derived exactly once
+ *
+ * With no coordinates the sun-times consumers fall back to a coarse **UTC**
+ * clock split, which is wrong by an hour or two at the edges for most of
+ * Europe. A hub can do better without asking: its public IP geolocates to
+ * within a few kilometres, which is far below the resolution sunrise needs.
+ *
+ * So the FIRST read that finds nothing stored derives one — and the derivation
+ * is one-shot in the strong sense:
+ *
+ *   - one outbound request, `GEO_IP_TIMEOUT_MS` bounded, single-flighted so
+ *     concurrent readers share it;
+ *   - the OUTCOME is persisted either way. A success stores the coordinates
+ *     with `source: 'derived-from-ip'`; a failure stores
+ *     `derivationAttemptedAt` + `derivationError` and nothing ever retries on a
+ *     read path again. A hub with no internet pays four seconds once, in its
+ *     entire life;
+ *   - nothing gates on it. Boot does not wait for it, and a caller that finds
+ *     `location: null` degrades exactly as it did before this module existed.
+ *
+ * The only retry is an operator pressing detect (`detectSiteLocation`). That is
+ * deliberate: an automatic retry loop against a third-party service is how a
+ * homelab ends up rate-limited, and the value it would eventually fetch is one
+ * the operator can type in five seconds.
+ *
+ * ## Provenance is part of the value
+ *
+ * `source` distinguishes a guess from an operator's input, and the UI shows it.
+ * An operator who cannot tell the two apart will eventually trust the guess —
+ * and a derivation must never overwrite a typed value, which is why
+ * `SiteLocationService.detect` refuses when `source === 'operator-set'`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SiteLocationService = exports.GEO_IP_ENDPOINTS = exports.GEO_IP_TIMEOUT_MS = exports.SITE_LOCATION_KEY = void 0;
+exports.isUsableCoordinate = isUsableCoordinate;
+exports.toStatus = toStatus;
+exports.parseGeoIpPayload = parseGeoIpPayload;
+exports.geolocatePublicIp = geolocatePublicIp;
+const types_1 = require("@camstack/types");
+/** The `system-settings` row this module owns. */
+exports.SITE_LOCATION_KEY = 'site-location';
+const SYSTEM_SETTINGS_COLLECTION = 'system-settings';
+/**
+ * The addon store the coordinates used to live in. Read ONCE, lazily, to
+ * migrate an operator who already typed them — see {@link readLegacyAddonCoordinates}.
+ */
+const LEGACY_ADDON_NAMESPACE = 'pipeline-analytics';
+const LEGACY_ADDON_COLLECTION = 'addon-settings';
+const LEGACY_ADDON_KEY = 'root';
+const LEGACY_LAT_KEY = 'siteLatitude';
+const LEGACY_LNG_KEY = 'siteLongitude';
+/**
+ * Bound on the geo-IP request. Short on purpose: this sits on the first read of
+ * a lazily-derived default, so it is latency an operator can feel. Four seconds
+ * is long enough for a cold TLS handshake to a CDN and short enough that a
+ * captive-portal black hole does not look like a hang.
+ */
+exports.GEO_IP_TIMEOUT_MS = 4_000;
+/**
+ * No-key, HTTPS geo-IP endpoints, tried in order until one parses.
+ *
+ * Both answer an unauthenticated GET with the caller's own public IP resolved
+ * to a city centroid. Neither is contacted unless a derivation actually runs,
+ * and the request carries nothing but the hub's IP — which the endpoint would
+ * see regardless, since seeing it is the entire mechanism.
+ */
+exports.GEO_IP_ENDPOINTS = [
+    'https://ipinfo.io/json',
+    'https://ipapi.co/json/',
+];
+// ── pure helpers ────────────────────────────────────────────────────────────
+/**
+ * `(0, 0)` is Null Island, not a homelab. Anything non-finite or out of range
+ * is treated as absent rather than clamped: a wrong-but-plausible coordinate
+ * produces a wrong sunrise silently, which is worse than the declared fallback.
+ */
+function isUsableCoordinate(lat, lng) {
+    if (typeof lat !== 'number' || typeof lng !== 'number')
+        return false;
+    if (!Number.isFinite(lat) || !Number.isFinite(lng))
+        return false;
+    if (lat < -90 || lat > 90 || lng < -180 || lng > 180)
+        return false;
+    return lat !== 0 || lng !== 0;
+}
+/** Project a stored row onto the wire shape. */
+function toStatus(record) {
+    if (record === null) {
+        return { location: null, derivationAttemptedAt: null, derivationError: null };
+    }
+    const attempted = typeof record.derivationAttemptedAt === 'number';
+    const status = {
+        location: isUsableCoordinate(record.latitude, record.longitude)
+            ? {
+                // The guard above proves both are numbers; the narrowing does not
+                // survive the property read, so re-assert with a finite fallback
+                // rather than a cast.
+                latitude: Number(record.latitude),
+                longitude: Number(record.longitude),
+                source: record.source === 'operator-set' ? 'operator-set' : 'derived-from-ip',
+                updatedAt: typeof record.updatedAt === 'number' ? record.updatedAt : 0,
+                ...(record.label !== undefined ? { label: record.label } : {}),
+            }
+            : null,
+        derivationAttemptedAt: attempted ? Number(record.derivationAttemptedAt) : null,
+        derivationError: typeof record.derivationError === 'string' ? record.derivationError : null,
+    };
+    return status;
+}
+function asRecord(raw) {
+    if (raw === null || raw === undefined || typeof raw !== 'object')
+        return null;
+    const obj = { ...raw };
+    const record = {
+        ...(typeof obj['latitude'] === 'number' ? { latitude: obj['latitude'] } : {}),
+        ...(typeof obj['longitude'] === 'number' ? { longitude: obj['longitude'] } : {}),
+        ...(obj['source'] === 'operator-set' || obj['source'] === 'derived-from-ip'
+            ? { source: obj['source'] }
+            : {}),
+        ...(typeof obj['updatedAt'] === 'number' ? { updatedAt: obj['updatedAt'] } : {}),
+        ...(typeof obj['label'] === 'string' ? { label: obj['label'] } : {}),
+        ...(typeof obj['derivationAttemptedAt'] === 'number'
+            ? { derivationAttemptedAt: obj['derivationAttemptedAt'] }
+            : {}),
+        ...(typeof obj['derivationError'] === 'string'
+            ? { derivationError: obj['derivationError'] }
+            : {}),
+    };
+    return record;
+}
+/**
+ * Parse either supported geo-IP payload.
+ *
+ * `ipinfo.io` answers `{ loc: "40.8518,14.2681", city, region, country }`;
+ * `ipapi.co` answers `{ latitude, longitude, city, country_code }`. Both are
+ * handled here rather than behind two adapters because the whole difference is
+ * three field names, and an adapter per vendor is how a 30-line fetch becomes a
+ * folder.
+ */
+function parseGeoIpPayload(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return null;
+    const obj = payload;
+    let lat = obj['latitude'];
+    let lng = obj['longitude'];
+    const loc = obj['loc'];
+    if (typeof loc === 'string') {
+        const [rawLat, rawLng] = loc.split(',');
+        if (rawLat !== undefined && rawLng !== undefined) {
+            lat = Number(rawLat);
+            lng = Number(rawLng);
+        }
+    }
+    if (!isUsableCoordinate(lat, lng))
+        return null;
+    const city = obj['city'];
+    const country = obj['country'] ?? obj['country_code'];
+    const parts = [city, country].filter((p) => typeof p === 'string' && p.length > 0);
+    return {
+        latitude: Number(lat),
+        longitude: Number(lng),
+        ...(parts.length > 0 ? { label: parts.join(', ') } : {}),
+    };
+}
+/**
+ * One pass over {@link GEO_IP_ENDPOINTS}. Returns the first fix that parses.
+ *
+ * Every failure mode collapses to `null` plus a log line: this is a *default*,
+ * and a default that throws would take down whatever asked for it.
+ */
+async function geolocatePublicIp(fetchImpl, logger, endpoints = exports.GEO_IP_ENDPOINTS) {
+    for (const url of endpoints) {
+        try {
+            const response = await fetchImpl(url, {
+                headers: { Accept: 'application/json' },
+                signal: AbortSignal.timeout(exports.GEO_IP_TIMEOUT_MS),
+            });
+            if (!response.ok) {
+                logger?.debug('geo-IP endpoint refused', { meta: { url, status: response.status } });
+                continue;
+            }
+            const fix = parseGeoIpPayload(await response.json());
+            if (fix !== null)
+                return fix;
+            logger?.debug('geo-IP endpoint answered without usable coordinates', { meta: { url } });
+        }
+        catch (err) {
+            logger?.debug('geo-IP endpoint failed', { meta: { url, error: (0, types_1.errMsg)(err) } });
+        }
+    }
+    return null;
+}
+/**
+ * Reads and writes the site location, owning the one-shot derivation.
+ *
+ * Constructed per request by `buildSystemProvider` — the single-flight promise
+ * therefore bounds concurrent readers *within* a request, and the persisted
+ * `derivationAttemptedAt` bounds them across requests and across restarts. The
+ * durable marker is the real guarantee; the in-process one only stops a burst.
+ */
+class SiteLocationService {
+    deps;
+    static inFlight = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Test seam: the static single-flight outlives a request by design. */
+    static __resetForTests() {
+        SiteLocationService.inFlight = null;
+    }
+    now() {
+        return this.deps.now?.() ?? Date.now();
+    }
+    async read() {
+        try {
+            return asRecord(await this.deps.store.get({
+                collection: SYSTEM_SETTINGS_COLLECTION,
+                key: exports.SITE_LOCATION_KEY,
+            }));
+        }
+        catch (err) {
+            // A failed READ must never look like "not configured" — that would send
+            // the derivation off to overwrite a value that exists. Rethrow-as-null is
+            // exactly the D49 shape this repo has been bitten by, so the caller is
+            // told instead.
+            this.deps.logger?.warn('site location read failed', { meta: { error: (0, types_1.errMsg)(err) } });
+            throw err;
+        }
+    }
+    async write(record) {
+        await this.deps.store.set({
+            collection: SYSTEM_SETTINGS_COLLECTION,
+            key: exports.SITE_LOCATION_KEY,
+            value: record,
+        });
+    }
+    /**
+     * The coordinates an operator already typed into `pipeline-analytics`, if any.
+     *
+     * Lazy migration, read once on the first system-level read that finds nothing:
+     * those numbers are `operator-set` by definition, and deriving over them would
+     * silently replace a deliberate value with a guess. A failure here is not
+     * fatal — it just means the derivation runs.
+     */
+    async readLegacyAddonCoordinates() {
+        try {
+            const raw = await this.deps.store.get({
+                namespace: LEGACY_ADDON_NAMESPACE,
+                collection: LEGACY_ADDON_COLLECTION,
+                key: LEGACY_ADDON_KEY,
+            });
+            if (raw === null || typeof raw !== 'object')
+                return null;
+            const obj = raw;
+            const lat = Number(obj[LEGACY_LAT_KEY]);
+            const lng = Number(obj[LEGACY_LNG_KEY]);
+            if (!isUsableCoordinate(lat, lng))
+                return null;
+            return { latitude: lat, longitude: lng };
+        }
+        catch (err) {
+            this.deps.logger?.debug('legacy site coordinates read failed', {
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+            return null;
+        }
+    }
+    /**
+     * Current value, deriving a default on the first read that finds nothing.
+     *
+     * Order: stored value → already-attempted marker (stop, no retry) → lazy
+     * migration from the old addon setting → geo-IP.
+     */
+    async get() {
+        const record = await this.read();
+        if (record !== null && isUsableCoordinate(record.latitude, record.longitude)) {
+            return toStatus(record);
+        }
+        if (record !== null && typeof record.derivationAttemptedAt === 'number') {
+            // Spent. `detectSiteLocation` is the only way back.
+            return toStatus(record);
+        }
+        const existing = SiteLocationService.inFlight;
+        if (existing !== null)
+            return existing;
+        const run = this.deriveDefault().finally(() => {
+            SiteLocationService.inFlight = null;
+        });
+        SiteLocationService.inFlight = run;
+        return run;
+    }
+    async deriveDefault() {
+        const legacy = await this.readLegacyAddonCoordinates();
+        if (legacy !== null) {
+            this.deps.logger?.info('site location migrated from the pipeline-analytics addon setting — operator-set');
+            return this.persist(legacy, 'operator-set');
+        }
+        return this.derive();
+    }
+    /**
+     * Run the geo-IP lookup and persist the outcome — success or failure.
+     *
+     * Persisting the FAILURE is the point: without it every read retries, which
+     * is a request per scene check against a free third-party endpoint.
+     */
+    async derive() {
+        const fetchImpl = this.deps.fetchImpl ?? ((url, init) => fetch(url, init));
+        const fix = await geolocatePublicIp(fetchImpl, this.deps.logger);
+        if (fix !== null) {
+            this.deps.logger?.info('site location derived from the public IP', {
+                meta: { label: fix.label ?? 'unknown', source: 'derived-from-ip' },
+            });
+            return this.persist(fix, 'derived-from-ip');
+        }
+        const failure = {
+            derivationAttemptedAt: this.now(),
+            derivationError: 'no geo-IP endpoint answered with usable coordinates',
+        };
+        // A branch that DROPS a default silently reads as "never happened".
+        this.deps.logger?.warn('site location could not be derived from the public IP — consumers fall back to the UTC clock split until an operator sets it. This will NOT be retried automatically.');
+        try {
+            await this.write(failure);
+        }
+        catch (err) {
+            // The marker is what makes it one-shot. Losing it costs a retry on the
+            // next read, never a wrong value.
+            this.deps.logger?.warn('site location failure marker could not be persisted', {
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+        }
+        return toStatus(failure);
+    }
+    async persist(fix, source) {
+        const record = {
+            latitude: fix.latitude,
+            longitude: fix.longitude,
+            source,
+            updatedAt: this.now(),
+            ...(fix.label !== undefined ? { label: fix.label } : {}),
+            derivationAttemptedAt: this.now(),
+        };
+        await this.write(record);
+        return toStatus(record);
+    }
+    /** Operator input. Clears the value when `input` is `null`. */
+    async set(input) {
+        if (input === null) {
+            // The derivation stays spent: clearing means "I do not want coordinates",
+            // not "guess again". Detect is the button for that.
+            const cleared = { derivationAttemptedAt: this.now() };
+            await this.write(cleared);
+            return toStatus(cleared);
+        }
+        return this.persist({ latitude: input.latitude, longitude: input.longitude }, 'operator-set');
+    }
+    /**
+     * Explicit re-derivation. The only retry path.
+     *
+     * Refuses to overwrite an `operator-set` value — a detect button next to a
+     * typed coordinate must not be able to destroy it by mis-click. The operator
+     * clears first, then detects.
+     */
+    async detect() {
+        const record = await this.read();
+        if (record !== null &&
+            record.source === 'operator-set' &&
+            isUsableCoordinate(record.latitude, record.longitude)) {
+            this.deps.logger?.info('site location detect skipped — an operator-set value already exists');
+            return toStatus(record);
+        }
+        return this.derive();
+    }
+}
+exports.SiteLocationService = SiteLocationService;

package/dist/api/trpc/generated-cap-routers.js

@@ -4067,6 +4067,14 @@ function createCapRouter_llm(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.generateVision(input);
         }),
+        cancel: trpc_middleware_js_1.protectedProcedure
+            .input(types_55.llmCapability.methods.cancel.input.loose())
+            .output(types_55.llmCapability.methods.cancel.output)
+            .mutation(async ({ input, ctx }) => {
+            const p = requireCapProvider('llm', () => getProvider(ctx));
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.cancel(input);
+        }),
         listProfileKinds: trpc_middleware_js_1.protectedProcedure
             .input(types_55.llmCapability.methods.listProfileKinds.input.loose())
             .output(types_55.llmCapability.methods.listProfileKinds.output)
@@ -8892,6 +8900,27 @@ function createCapRouter_system(getProvider, createRemoteProxy) {
             const p = resolveProvider('system', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
             return p.forceRetentionCleanup();
         }),
+        getSiteLocation: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
+            .output(types_109.systemCapability.methods.getSiteLocation.output)
+            .query(async ({ input, ctx }) => {
+            const p = resolveProvider('system', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
+            return p.getSiteLocation();
+        }),
+        setSiteLocation: trpc_middleware_js_1.adminProcedure
+            .input(types_109.systemCapability.methods.setSiteLocation.input)
+            .output(types_109.systemCapability.methods.setSiteLocation.output)
+            .mutation(async ({ input, ctx }) => {
+            const p = requireCapProvider('system', () => getProvider(ctx));
+            return p.setSiteLocation(input);
+        }),
+        detectSiteLocation: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
+            .output(types_109.systemCapability.methods.detectSiteLocation.output)
+            .mutation(async ({ input, ctx }) => {
+            const p = resolveProvider('system', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
+            return p.detectSiteLocation();
+        }),
     });
 }
 function createCapRouter_tamper(getProvider, createRemoteProxy) {

package/dist/api/trpc/trpc.router.js

@@ -191,7 +191,7 @@ function buildServerProviders(services) {
     const wrap = (fn) => (ctx) => fn(ctx);
     return {
         'network-quality': wrap(() => (0, cap_providers_js_1.buildNetworkQualityProvider)(services.networkQualityService)),
-        system: wrap(() => (0, cap_providers_js_1.buildSystemProvider)(services.featureService, services.capabilityRegistry)),
+        system: wrap(() => (0, cap_providers_js_1.buildSystemProvider)(services.featureService, services.capabilityRegistry, services.moleculer, services.loggingService.createLogger('site-location'))),
         toast: wrap((ctx) => (0, cap_providers_js_1.buildToastProvider)(services.toastService, ctx)),
         integrations: wrap(() => (0, cap_providers_js_1.buildIntegrationsProvider)(services.addonRegistry, services.eventBus, services.loggingService, services.capabilityRegistry)),
         nodes: wrap(() => (0, cap_providers_js_1.buildNodesProvider)(services.agentRegistry, services.moleculer, services.addonRegistry, (0, cap_providers_js_1.createNodeRootPackageLookup)(services.moleculer, services.serverUpdateService), services.loggingService.createLogger('nodes'))),

package/dist/core/agent/cluster-node-history-store.js

@@ -26,6 +26,21 @@ const RowDataSchema = zod_1.z.object({
     lastActive: zod_1.z.number(),
     descriptor: DescriptorSchema,
 });
+/**
+ * @durable class=ledger owner=cluster-agent
+ *   write="one row per node the hub has ever seen online, GATED BY A READ-BACK.
+ *     `snapshot()` runs on every 30 s topology pass but commits only when there is no
+ *     existing row, when the descriptor differs field-by-field, or when the stored
+ *     `lastActive` has aged past LAST_ACTIVE_HEARTBEAT_MS (5 min) — an unchanged online
+ *     node therefore writes 288 times a day instead of 2,880, ~864/day for three rows
+ *     (D131). Off that gate: `touch()` on `$node.disconnected` (the offline edge, always
+ *     written), `recordPackages` on a node's own declaration (grow-only merge) and
+ *     `prunePackages` on an explicit undeploy"
+ *   retention="none — nothing ages a row out; the only deletion is the operator's
+ *     `forget(nodeId)` behind the inline Forget-node action. Losing the table makes every
+ *     node that is not in the live Moleculer window vanish from the topology instead of
+ *     rendering OFFLINE, and empties the package roster the addon back-fill converges to."
+ */
 const COLLECTION = 'cluster-node-history';
 /**
  * How stale `lastActive` may get on an ONLINE node before an otherwise

package/dist/core/auth/share-token.service.js

@@ -60,7 +60,35 @@ exports.ShareTokenService = exports.ShareTokenRecordSchema = exports.ShareTokenS
  */
 const crypto = __importStar(require("node:crypto"));
 const zod_1 = require("zod");
+/**
+ * @durable class=config owner=core-auth
+ *   write="a user mints a share link; and a best-effort lastUsedAt touch on every successful validation"
+ *   retention="none — no sweep and no TTL reaper. A row goes only when the owner or an admin revokes it. expiresAt is enforced at VALIDATION, so an expired token keeps its row and keeps being scanned; the table is bounded only by how many links people mint."
+ */
 const SHARE_TOKENS_COLLECTION = 'share_view_tokens';
+/**
+ * The two predicates this service actually issues, indexed.
+ *
+ * The collection is KV-shaped — `(id TEXT PK, data TEXT)` — so `tokenHash` and
+ * `userId` live inside the `data` blob and the backend rewrites both predicates
+ * to `json_extract`. Declaring an index on a blob field makes the backend emit
+ * a matching EXPRESSION index (`sqlite-settings-backend.ts`, `ensureTable`),
+ * which is the only kind SQLite can use for these queries.
+ *
+ * Why it matters: `validate()` runs on EVERY request carrying a `csv_*` token,
+ * and without this it was a full-table scan that parsed the JSON of every row
+ * to compare one hash. Six rows today, so it never showed up — but it is the
+ * authentication path for share links, so it is the one that gets hit hardest
+ * the day a link is shared widely.
+ *
+ * Adding indexes is NOT a shape change: the column list is untouched, so
+ * `ensureTable` takes neither the rebuild nor the `ALTER TABLE` branch, and no
+ * row is migrated or lost.
+ */
+const SHARE_TOKENS_INDEXES = [
+    { name: 'idx_share_view_tokens_hash', columns: ['tokenHash'] },
+    { name: 'idx_share_view_tokens_user', columns: ['userId'] },
+];
 /** Wire prefix — `csv_` = CamStack Share View (cf. `cst_` scoped tokens). */
 exports.SHARE_TOKEN_PREFIX = 'csv_';
 // ── TTL / scope bounds (enforced at mint, re-checked by the router schema) ──
@@ -140,6 +168,7 @@ class ShareTokenService {
                     { name: 'id', type: 'TEXT', primaryKey: true, notNull: true },
                     { name: 'data', type: 'TEXT', notNull: true },
                 ],
+                indexes: SHARE_TOKENS_INDEXES,
             });
             this.collectionDeclared = true;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.110",
+  "version": "1.2.111",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.59",
+    "@camstack/addon-admin-ui": "1.2.60",
     "@camstack/addon-agent-ui": "1.2.17",
-    "@camstack/addon-auth": "1.2.18",
+    "@camstack/addon-auth": "1.2.19",
     "@camstack/addon-decoder-nodeav": "1.2.16",
     "@camstack/addon-notifiers": "1.2.21",
-    "@camstack/addon-pipeline": "1.2.76",
-    "@camstack/addon-pipeline-orchestrator": "1.2.57",
-    "@camstack/addon-post-analysis": "1.2.75",
+    "@camstack/addon-pipeline": "1.2.77",
+    "@camstack/addon-pipeline-orchestrator": "1.2.58",
+    "@camstack/addon-post-analysis": "1.2.76",
     "@camstack/sdk": "1.2.19",
     "@camstack/shm-ring": "1.1.16",
-    "@camstack/system": "1.2.90",
-    "@camstack/types": "1.2.72",
-    "@camstack/ui-library": "1.2.50",
+    "@camstack/system": "1.2.91",
+    "@camstack/types": "1.2.73",
+    "@camstack/ui-library": "1.2.51",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",