@camstack/server 1.2.263 → 1.2.266

package/dist/api/core/cap-providers.js

@@ -809,7 +809,7 @@ async function runConnectionTest(ar, addonId, settings, logger) {
 }
 /**
  * Marker caps that flag an addon as a creatable integration type:
- *   - `device-provider` — classic providers (Reolink/ONVIF/Frigate)
+ *   - `device-provider` — classic providers (Reolink/ONVIF)
  *     that expose `createDevice` + `discoverDevices` via their
  *     device-provider cap.
  *   - `device-adoption` — integration-style providers (Home Assistant

package/dist/api/static/frame-policy.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAME_ANCESTORS_POLICY = void 0;
+exports.isFramePolicyTarget = isFramePolicyTarget;
+exports.registerFramePolicy = registerFramePolicy;
+/** The one directive: frame me from my origin only. */
+exports.FRAME_ANCESTORS_POLICY = "frame-ancestors 'self'";
+const CSP_HEADER = 'content-security-policy';
+/** Only a document can be framed; assets, JSON and streams are never one. */
+function isFramePolicyTarget(contentType) {
+    return typeof contentType === 'string' && contentType.trim().toLowerCase().startsWith('text/html');
+}
+/**
+ * Install the `onSend` hook on the hub's one Fastify instance. Replies that
+ * bypass Fastify's reply pipeline (`reply.raw`, `reply.hijack()` — the addon
+ * reverse proxy's streaming path) are not seen here; they carry no HTML
+ * shell of ours.
+ */
+function registerFramePolicy(fastify) {
+    fastify.addHook('onSend', async (_request, reply, payload) => {
+        if (!isFramePolicyTarget(reply.getHeader('content-type')))
+            return payload;
+        if (reply.getHeader(CSP_HEADER) !== undefined)
+            return payload;
+        reply.header(CSP_HEADER, exports.FRAME_ANCESTORS_POLICY);
+        return payload;
+    });
+}

package/dist/api/trpc/generated-cap-routers.js

@@ -7380,6 +7380,33 @@ function createCapRouter_pipelineRunner(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.runStatelessStep(methodInput);
         }),
+        parkTrackFrame: trpc_middleware_js_1.protectedProcedure
+            .input(types_89.pipelineRunnerCapability.methods.parkTrackFrame.input.loose())
+            .output(types_89.pipelineRunnerCapability.methods.parkTrackFrame.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-runner', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.parkTrackFrame(methodInput);
+        }),
+        getParkedTrackFrame: trpc_middleware_js_1.protectedProcedure
+            .input(types_89.pipelineRunnerCapability.methods.getParkedTrackFrame.input.loose())
+            .output(types_89.pipelineRunnerCapability.methods.getParkedTrackFrame.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-runner', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getParkedTrackFrame(methodInput);
+        }),
+        releaseParkedTrackFrames: trpc_middleware_js_1.protectedProcedure
+            .input(types_89.pipelineRunnerCapability.methods.releaseParkedTrackFrames.input.loose())
+            .output(types_89.pipelineRunnerCapability.methods.releaseParkedTrackFrames.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('pipeline-runner', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.releaseParkedTrackFrames(methodInput);
+        }),
     });
 }
 function createCapRouter_plateGallery(getProvider, createRemoteProxy) {

package/dist/main.js

@@ -67,6 +67,7 @@ const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
 const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
 const spa_static_1 = require("./api/static/spa-static");
 const spa_mount_1 = require("./api/static/spa-mount");
+const frame_policy_1 = require("./api/static/frame-policy");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
 const request_census_settings_1 = require("./api/core/request-census-settings");
@@ -326,6 +327,10 @@ async function bootstrap() {
     app.enableCors();
     const fastify = app.getHttpAdapter().getInstance();
     await fastify.register(cookie_1.default);
+    // Every HTML document the hub serves may be framed by its own origin only
+    // (D425). Stamped here, on the one instance, so no shell-send site added
+    // later can ship without it.
+    (0, frame_policy_1.registerFramePolicy)(fastify);
     // Gzip/Brotli compression for all responses (including static JS/CSS).
     // Registered before @fastify/static so the compress plugin wraps the
     // static send path — hashed admin-ui chunks go from ~2MB to ~600KB on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.263",
+  "version": "1.2.266",
   "private": false,
   "files": [
     "dist",