@camstack/server 1.2.128 → 1.2.130

package/dist/api/core/addon-settings.router.js

@@ -28,11 +28,24 @@ exports.createAddonSettingsRouter = createAddonSettingsRouter;
  * the whole per-key set, so a write here deletes every other row of that addon
  * in this table.
  *
- * Exposes four protected procedures consumed by:
- *   1. Forked addons (via the tRPC WSS client in `WorkerBootstrapService`)
- *      to read/write their 3-level settings chain from the worker process.
- *   2. Future UI flows that want to inspect/mutate addon settings through
- *      a single well-typed endpoint.
+ * ## ⚠️ ADMIN-ONLY — every method here is `adminProcedure`
+ *
+ * Reads (`getGlobal` / `getDeviceOverrides`) return RAW, un-redacted addon
+ * config — the same blob that holds notifier tokens, webhook secrets and API
+ * keys; writes (`updateGlobal` / `updateDevice` / `replaceGlobal`) overwrite it
+ * with no schema gate. Before 2026-08-13 these were `protectedProcedure`, so
+ * any authenticated non-admin token could read and rewrite every addon's
+ * config. The `:139` comment claimed "only workers with valid hub tokens can
+ * call this" but nothing enforced it.
+ *
+ * Gating with `adminProcedure` costs the legitimate callers NOTHING: this
+ * router is in `CORE_NAMESPACES` (`core-cap-bridge.ts`), so a forked addon's
+ * `ctx.api.addonSettingsRaw.*` arrives over the trusted core-cap/UDS mesh whose
+ * context is `createMeshTrpcContext` (`isAdmin: true`), and the admin UI is an
+ * admin session. The two consumers:
+ *   1. Forked addons (via `ctx.api` over the mesh) reading/writing their
+ *      3-level settings chain from the worker process.
+ *   2. Admin UI flows inspecting/mutating addon settings.
  *
  * The router is deliberately thin — it does NOT perform schema-based
  * resolver merging (defaults → global → per-device). That happens on the

package/dist/api/core/event-bus-proxy.router.js

@@ -89,6 +89,12 @@ function serializeRecentEvent(e) {
 }
 function createEventBusProxyRouter(eventBus) {
     return (0, trpc_middleware_js_1.trpcRouter)({
+        // ADMIN-ONLY. `emit` injects a fully-attributed SystemEvent onto the hub's
+        // real EventBus — including a spoofable `source` (a fake `device`/`addon`
+        // origin). Forked addons that legitimately emit reach this over the
+        // trusted core-cap/UDS mesh, whose context is `createMeshTrpcContext`
+        // (`isAdmin: true`), so gating it here withholds the surface from
+        // non-admin HTTP/WS principals without blinding a worker.
         emit: trpc_middleware_js_1.adminProcedure
             .input(SystemEventInputSchema)
             .output(zod_1.z.object({ ok: zod_1.z.literal(true) }))

package/dist/core/addon/addon-package.service.js

@@ -1195,7 +1195,15 @@ class AddonPackageService {
                     meta: { packageName, error: (0, types_1.errMsg)(err) },
                 });
             }
-            const hasUpdate = latestVersion !== null && currentVersion !== 'unknown' && latestVersion !== currentVersion;
+            // STRICTLY newer, never merely different. The hub runs
+            // `1.2.x-dev.<timestamp>` builds that are AHEAD of the npm tag, and
+            // `latest !== current` lit an "update available" badge whose only
+            // possible outcome was a downgrade. `publishFrameworkAvailability`
+            // already gated on this; the row the UI reads did not, so the same
+            // page disagreed with itself.
+            const hasUpdate = latestVersion !== null &&
+                currentVersion !== 'unknown' &&
+                isVersionNewer(latestVersion, currentVersion);
             return {
                 packageName,
                 currentVersion,

package/dist/core/logging/logging.service.js

@@ -28,11 +28,14 @@ class LoggingService extends system_1.LogManager {
         // keep their sparse history. `eventBus.ringBufferSize` still sizes the
         // separate system-event ring; logs get their own per-addon cap.
         const perAddonCapacity = configService.get('eventBus.perAddonLogBufferSize') ?? 5000;
-        // Soft total ceiling across all buckets, null (unbounded) by default so this
-        // changes nothing until an operator opts in. `?? null` rather than a numeric
-        // default on purpose: the per-addon rings are already a hard bound, and picking
-        // a total for someone would silently start discarding their debug history.
-        const maxTotalEntries = configService.get('eventBus.maxTotalLogBufferSize') ?? null;
+        // Total ceiling across all buckets. Left UNSET here on purpose so the buffer
+        // applies its own default (`DEFAULT_MAX_TOTAL_LOG_ENTRIES`): the per-addon
+        // rings are a hard bound only per bucket, and their product grows with the
+        // roster — hub-main ingests from every local runner AND every agent, so
+        // "unbounded by default" meant ~300k retained entries (~92MB) on the one
+        // process that must fit inside the cgroup. An operator who genuinely wants
+        // no aggregate bound writes an explicit `null`, which is preserved.
+        const maxTotalEntries = configService.get('eventBus.maxTotalLogBufferSize');
         // Only entries at or below this level are ever discarded to meet the total.
         const pruneLevel = configService.get('eventBus.logBufferPruneLevel') ?? 'debug';
         super(perAddonCapacity, { maxTotalEntries, pruneLevel });

package/dist/core/streaming/stream-probe.service.js

@@ -3,17 +3,38 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.StreamProbeService = void 0;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
+const ttl_cache_1 = require("./ttl-cache");
 const types_1 = require("@camstack/types");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const CACHE_TTL_MS = 3_600_000; // 1 hour
 const PROBE_TIMEOUT_MS = 5_000;
+/**
+ * Ceiling on cached probes.
+ *
+ * The cache is keyed by stream URL, and a URL is not a bounded quantity: every
+ * credential rotation, every edited field, every per-camera probe of a value
+ * that was later changed mints a new key. 512 is far above any real camera
+ * roster (the live cluster runs 27), so a working deployment never evicts;
+ * the ceiling exists so the key space cannot be walked into the OOM.
+ */
+const CACHE_MAX_ENTRIES = 512;
 /** Codec aliases normalised to canonical names. */
 const CODEC_ALIASES = {
     hevc: 'h265',
 };
 class StreamProbeService {
     logger;
-    cache = new Map();
+    /**
+     * Probe results, bounded by BOTH a swept TTL and an entry ceiling.
+     *
+     * It used to be a plain `Map` whose age was consulted only when the same URL
+     * was probed again — so an entry nobody asked about a second time was never
+     * found expired and never removed. See {@link TtlCache}.
+     */
+    cache = new ttl_cache_1.TtlCache({
+        ttlMs: CACHE_TTL_MS,
+        maxEntries: CACHE_MAX_ENTRIES,
+    });
     constructor(loggingService) {
         this.logger = loggingService.createLogger('StreamProbeService');
     }
@@ -25,12 +46,11 @@ class StreamProbeService {
         const force = options?.force ?? false;
         if (!force) {
             const cached = this.cache.get(url);
-            if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
-                return cached.metadata;
-            }
+            if (cached)
+                return cached;
         }
         const metadata = await this.runProbe(url);
-        this.cache.set(url, { metadata, timestamp: Date.now() });
+        this.cache.set(url, metadata);
         return metadata;
     }
     /**

package/dist/core/streaming/ttl-cache.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TtlCache = void 0;
+class TtlCache {
+    entries = new Map();
+    ttlMs;
+    maxEntries;
+    now;
+    constructor(options) {
+        this.ttlMs = options.ttlMs;
+        this.maxEntries = options.maxEntries;
+        this.now = options.now ?? (() => Date.now());
+    }
+    /** The live value, or undefined when absent or expired. An expired entry is
+     *  DELETED here, not merely reported missing. */
+    get(key) {
+        const slot = this.entries.get(key);
+        if (slot === undefined)
+            return undefined;
+        const at = this.now();
+        if (at - slot.storedAt >= this.ttlMs) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        slot.lastAccessAt = at;
+        return slot.value;
+    }
+    /**
+     * Store a value, then bring the map back inside both bounds.
+     *
+     * The sweep runs on WRITE and not on a timer on purpose: a timer would have
+     * to be owned, unref'd and stopped by every holder of a cache, and a cache
+     * that is never written to is a cache that is not growing.
+     */
+    set(key, value) {
+        const at = this.now();
+        this.entries.set(key, { value, storedAt: at, lastAccessAt: at });
+        this.sweepExpired(at);
+        this.enforceMaxEntries(key);
+    }
+    delete(key) {
+        this.entries.delete(key);
+    }
+    clear() {
+        this.entries.clear();
+    }
+    /** Entries currently retained. The number that used to only go up. */
+    size() {
+        return this.entries.size;
+    }
+    sweepExpired(at) {
+        for (const [key, slot] of this.entries) {
+            if (at - slot.storedAt >= this.ttlMs)
+                this.entries.delete(key);
+        }
+    }
+    /** Evict least-recently-USED first. `protectedKey` is the entry just written —
+     *  evicting it would make `set` a no-op. */
+    enforceMaxEntries(protectedKey) {
+        if (this.entries.size <= this.maxEntries)
+            return;
+        const coldestFirst = [...this.entries.entries()]
+            .filter(([key]) => key !== protectedKey)
+            .toSorted((a, b) => a[1].lastAccessAt - b[1].lastAccessAt);
+        for (const [key] of coldestFirst) {
+            if (this.entries.size <= this.maxEntries)
+                return;
+            this.entries.delete(key);
+        }
+    }
+}
+exports.TtlCache = TtlCache;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.128",
+  "version": "1.2.130",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.77",
-    "@camstack/addon-agent-ui": "1.2.20",
-    "@camstack/addon-auth": "1.2.22",
-    "@camstack/addon-decoder-nodeav": "1.2.19",
-    "@camstack/addon-notifiers": "1.2.24",
-    "@camstack/addon-pipeline": "1.2.93",
-    "@camstack/addon-pipeline-orchestrator": "1.2.76",
-    "@camstack/addon-post-analysis": "1.2.91",
-    "@camstack/sdk": "1.2.22",
-    "@camstack/shm-ring": "1.1.19",
-    "@camstack/system": "1.2.102",
-    "@camstack/types": "1.2.85",
-    "@camstack/ui-library": "1.2.58",
+    "@camstack/addon-admin-ui": "1.2.78",
+    "@camstack/addon-agent-ui": "1.2.21",
+    "@camstack/addon-auth": "1.2.23",
+    "@camstack/addon-decoder-nodeav": "1.2.20",
+    "@camstack/addon-notifiers": "1.2.25",
+    "@camstack/addon-pipeline": "1.2.95",
+    "@camstack/addon-pipeline-orchestrator": "1.2.78",
+    "@camstack/addon-post-analysis": "1.2.93",
+    "@camstack/sdk": "1.2.23",
+    "@camstack/shm-ring": "1.1.20",
+    "@camstack/system": "1.2.104",
+    "@camstack/types": "1.2.87",
+    "@camstack/ui-library": "1.2.59",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",