@camstack/server 1.2.380 → 1.2.382

package/dist/api/core/cap-providers.js

@@ -218,6 +218,8 @@ function buildNetworkQualityProvider(nq) {
                 jitterMs: input.jitterMs,
                 estimatedBandwidthKbps: input.estimatedBandwidthKbps,
                 packetLossPercent: input.packetLossPercent,
+                ...(input.downlinkMbps !== undefined ? { downlinkMbps: input.downlinkMbps } : {}),
+                ...(input.downlinkAgeMs !== undefined ? { downlinkAgeMs: input.downlinkAgeMs } : {}),
             });
         },
     };

package/dist/api/health/adaptive-probe.routes.js

@@ -1,12 +1,66 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ADAPTIVE_PROBE_BYTES = void 0;
+exports.ADAPTIVE_PROBE_PER_IP_PER_MINUTE = exports.ADAPTIVE_PROBE_BYTES = void 0;
 exports.registerAdaptiveProbeRoute = registerAdaptiveProbeRoute;
-exports.ADAPTIVE_PROBE_BYTES = 128 * 1024;
-const BODY = Buffer.alloc(exports.ADAPTIVE_PROBE_BYTES, 0x61);
-function registerAdaptiveProbeRoute(fastify) {
-    fastify.get('/adaptive-probe', async (_req, reply) => {
+/**
+ * Burst blob for adaptive-tier downlink measurement (D635).
+ *
+ * Size: 1 MiB. The client times the body from its FIRST byte and decides
+ * against 2.5 Mbps (`mid`) and 8 Mbps (`high`). At 8 Mbps, 1 MiB is ~1.05 s of
+ * transfer, so a 16 ms WebView timer tick is ~1.5 % of the reading and a WAN
+ * slow start (~3 RTTs at 50 ms) is ~15 %; the previous 128 KiB was 131 ms at
+ * the same rate — a single timer tick was 12 % of it, and timed from the
+ * request on a busy hub it measured latency (1.2–1.46 Mbps on a LAN).
+ *
+ * Cost, including cellular: one probe per camera app-wide per 30 s cache
+ * window (the client single-flights it), cut by the client's 2.5 s deadline —
+ * at most ~0.8 MB at 2.5 Mbps, 1 MiB on anything faster. That is about three
+ * minutes of a 41 kbps sub stream per camera OPEN, not per minute of viewing;
+ * renegotiations reuse the cached value and never probe.
+ *
+ * Access (round 3, review I6): a 100-byte request that returns 1 MiB is an
+ * amplifier, and the hub is reachable through relays. The route therefore
+ * requires a SESSION — Bearer JWT or the session cookie, the same session-grade
+ * check the stream data plane applies — and is rate-limited per client IP.
+ * Everything a refusal returns is a few bytes.
+ */
+const node_crypto_1 = require("node:crypto");
+const health_routes_js_1 = require("./health.routes.js");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+exports.ADAPTIVE_PROBE_BYTES = 1024 * 1024;
+/**
+ * Probes a client IP may draw per minute: 12. The client probes at most once
+ * per 30 s per app (single-flight + cache), so 12 leaves room for several
+ * apps/devices behind one NAT and caps an abuser at 12 MiB/min.
+ */
+exports.ADAPTIVE_PROBE_PER_IP_PER_MINUTE = 12;
+/**
+ * Random, so it is INCOMPRESSIBLE. The previous body was one repeated byte and
+ * `@fastify/compress` (global in `main.ts`; its default types include
+ * `octet-stream`) gzipped it to a few hundred bytes — the client timed a round
+ * trip and called it bandwidth. `compress: false` below stops our own
+ * compressor; randomness also defeats one in a relay on the way.
+ */
+const BODY = (0, node_crypto_1.randomBytes)(exports.ADAPTIVE_PROBE_BYTES);
+function registerAdaptiveProbeRoute(fastify, deps) {
+    fastify.get('/adaptive-probe', { compress: false }, async (req, reply) => {
         reply.header('cache-control', 'no-store');
+        const authorized = (0, health_routes_js_1.isAuthorizedHealthRequest)({
+            ...(typeof req.headers.authorization === 'string'
+                ? { authorization: req.headers.authorization }
+                : {}),
+            ...(typeof req.headers.cookie === 'string' ? { cookie: req.headers.cookie } : {}),
+        }, deps.verifyToken);
+        if (!authorized)
+            return reply.status(401).send({ ok: false, error: 'unauthorized' });
+        const key = (0, auth_rate_limit_js_1.clientKeyFromRequest)(req);
+        if (key !== null) {
+            const verdict = deps.limiter.check(`adaptive-probe:${key}`);
+            if (!verdict.allowed) {
+                reply.header('retry-after', String(verdict.retryAfterSeconds));
+                return reply.status(429).send({ ok: false, error: 'rate limited' });
+            }
+        }
         reply.header('content-type', 'application/octet-stream');
         return reply.send(BODY);
     });

package/dist/api/trpc/device-config-secret-redaction.js

@@ -46,6 +46,11 @@ exports.redactDeviceInfoSecrets = redactDeviceInfoSecrets;
 exports.redactDeviceInfoRecordSecrets = redactDeviceInfoRecordSecrets;
 exports.redactSettingsSections = redactSettingsSections;
 exports.redactSettingsAggregate = redactSettingsAggregate;
+exports.redactSettingsForm = redactSettingsForm;
+exports.redactExportSetup = redactExportSetup;
+exports.redactDeepSecrets = redactDeepSecrets;
+exports.redactStatusAggregateSetup = redactStatusAggregateSetup;
+exports.redactStatusAggregateBatchSetup = redactStatusAggregateBatchSetup;
 exports.redactConfigEntries = redactConfigEntries;
 exports.redactStreamUrlSecrets = redactStreamUrlSecrets;
 /** What a non-admin sees instead of the value. Matches the `***` convention
@@ -131,18 +136,6 @@ function redactDeviceInfoRecordSecrets(data) {
         out[key] = redactDeviceInfoSecrets(value);
     return out;
 }
-/** One settings field as the aggregate emits it: `{ key, value, … }`. */
-function redactField(field) {
-    if (!isRecord(field))
-        return field;
-    const key = field['key'];
-    if (typeof key !== 'string' || !isSecretConfigKey(key))
-        return field;
-    const value = field['value'];
-    if (typeof value !== 'string' || value.length === 0)
-        return field;
-    return { ...field, value: exports.REDACTED_SECRET };
-}
 /**
  * Project a `SettingsSchemaWithValues` (`{ sections: [{ fields: [...] }] }`).
  * Used by `getDeviceSettingsAggregate` and `getSettingsSchema`.
@@ -161,7 +154,10 @@ function redactSettingsSections(data) {
             const fields = section['fields'];
             if (!Array.isArray(fields))
                 return section;
-            return { ...section, fields: fields.map(redactField) };
+            // The same field-aware walk as the addon forms: by TYPE, at any depth,
+            // into array rows — a device form carries `password`-typed fields whose
+            // key no keyword catches, and HomeKit's pairing `qr-code` (D634 r2).
+            return { ...section, fields: fields.map(redactFormField) };
         }),
     };
 }
@@ -177,11 +173,173 @@ function redactSettingsAggregate(data) {
         return data;
     return { ...data, settings: redactSettingsSections(settings) };
 }
+/** True when a hydrated form field carries a credential: by TYPE first, then by name. */
+function isSecretFormField(field) {
+    // A `qr-code` in a settings form is a PAIRING code (HomeKit `X-HM://…`):
+    // whoever scans it controls the accessory.
+    if (field['type'] === 'password' || field['secret'] === true || field['type'] === 'qr-code') {
+        return true;
+    }
+    const key = field['key'];
+    return typeof key === 'string' && isSecretConfigKey(key);
+}
+/** The `itemFields` of an array field, when it declares them. */
+function itemFieldsOf(field) {
+    const items = field?.['itemFields'];
+    return Array.isArray(items) ? items : undefined;
+}
+/** The declared item field named `key`, if any. */
+function itemField(itemFields, key) {
+    const found = itemFields?.find((f) => isRecord(f) && f['key'] === key);
+    return isRecord(found) ? found : undefined;
+}
+/**
+ * Withhold every secret inside one form VALUE, whatever its shape.
+ *
+ * Round 1 replaced only a secret field's string value, so an array of rows
+ * (`editable-array` — mqtt-broker `brokers[].password`), a `multiple` secret
+ * (an array of strings) and a JSON object holding a `token` all went out
+ * whole. So the value is walked: an array element by element, an object key
+ * by key — a key is secret when its declared item field is (`password` /
+ * `secret: true`) or its NAME is — and everything under a secret is withheld.
+ * A non-secret string that is a URL loses its userinfo / credential params
+ * (`mqtt://user:pass@host`), the same masker the stream URLs use.
+ */
+function redactFormValue(value, secret, itemFields) {
+    if (typeof value === 'string') {
+        if (value.length === 0)
+            return value;
+        if (secret)
+            return exports.REDACTED_SECRET;
+        return value.includes('://') ? (0, types_1.maskUrlCredentials)(value) : value;
+    }
+    if (Array.isArray(value))
+        return value.map((el) => redactFormValue(el, secret, itemFields));
+    if (!isRecord(value))
+        return value;
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+        const declared = itemField(itemFields, key);
+        const childSecret = secret || (declared !== undefined && isSecretFormField(declared)) || isSecretConfigKey(key);
+        out[key] = redactFormValue(child, childSecret, itemFieldsOf(declared));
+    }
+    return out;
+}
+/** One hydrated form field, its secret withheld and its children walked. */
+function redactFormField(field) {
+    if (!isRecord(field))
+        return field;
+    const nested = field['fields'];
+    const tabs = field['tabs'];
+    if (Array.isArray(nested))
+        return { ...field, fields: nested.map(redactFormField) };
+    if (Array.isArray(tabs)) {
+        return {
+            ...field,
+            tabs: tabs.map((tab) => {
+                if (!isRecord(tab))
+                    return tab;
+                const tabFields = tab['fields'];
+                return Array.isArray(tabFields) ? { ...tab, fields: tabFields.map(redactFormField) } : tab;
+            }),
+        };
+    }
+    if (!('value' in field))
+        return field;
+    const redacted = {
+        ...field,
+        value: redactFormValue(field['value'], isSecretFormField(field), itemFieldsOf(field)),
+    };
+    // The HomeKit QR caption spells the setup code out in prose.
+    const caption = field['caption'];
+    return field['type'] === 'qr-code' && typeof caption === 'string' && caption.length > 0
+        ? { ...redacted, caption: exports.REDACTED_SECRET }
+        : redacted;
+}
+/**
+ * Project an ADDON settings form (`addonSettings.getGlobalSettings` /
+ * `getIntegrationSettings` / `getDeviceSettings`, a `SettingsSchemaWithValues`).
+ *
+ * Unlike {@link redactSettingsSections} (device forms, whose secrets are named
+ * by key convention) this decides by the FIELD: an addon's credential is often
+ * called something no keyword catches — an ntfy `topic`, a PEM `privateKey`
+ * marked `secret: true` — and addon forms nest fields in groups and sub-tabs.
+ * `hydrateSchema` fills a password field with its stored value on purpose (a
+ * masked value clobbered secrets on save), so this boundary is the only place
+ * the value is withheld from a non-admin; an admin still gets the real form,
+ * and `updateGlobalSettings` / `updateDeviceSettings` are admin-only, so a
+ * redacted value can never be written back (D634).
+ */
+function redactSettingsForm(data) {
+    if (!isRecord(data))
+        return data;
+    const sections = data['sections'];
+    if (!Array.isArray(sections))
+        return data;
+    return {
+        ...data,
+        sections: sections.map((section) => {
+            if (!isRecord(section))
+                return section;
+            const fields = section['fields'];
+            return Array.isArray(fields) ? { ...section, fields: fields.map(redactFormField) } : section;
+        }),
+    };
+}
+/**
+ * Project a `deviceExport.getStatus` answer: drop the `setup` block.
+ *
+ * `setup` is the export's PAIRING material — HomeKit's `X-HM://` setup URI as
+ * `qr`, the Alexa export's Lambda ingress token as a `secret: true` row. The
+ * row flag only masks in the UI; the value travels. Only the admin export
+ * panel renders it, so a non-admin keeps the link state and counts and never
+ * receives the block (D634 r2). One object or a fanned-out array.
+ */
+function redactExportSetup(data) {
+    if (Array.isArray(data))
+        return data.map((row) => redactExportSetup(row));
+    if (!isRecord(data) || !('setup' in data))
+        return data;
+    const { setup: _setup, ...rest } = data;
+    return rest;
+}
+/**
+ * Walk an arbitrary payload and withhold every secret-NAMED key's value and
+ * every URL's credentials — for surfaces with no schema to consult: the raw
+ * upstream state a device exposes (Home Assistant attributes carry
+ * `access_token` and `?token=` picture URLs), an integration's `info`, a
+ * broker list's `url` (D634 r3).
+ */
+function redactDeepSecrets(data) {
+    return redactFormValue(data, false, undefined);
+}
+/** The status-aggregate entry that carries export pairing material. */
+const DEVICE_EXPORT_CAP = 'device-export';
+/**
+ * Project a single status aggregate (`Record<capName, status | null>`): the
+ * `device-export` entry loses its `setup` (D634 r3 — defence in depth; the
+ * aggregation itself no longer asks a system collection cap per device).
+ */
+function redactStatusAggregateSetup(data) {
+    if (!isRecord(data) || !(DEVICE_EXPORT_CAP in data))
+        return data;
+    return { ...data, [DEVICE_EXPORT_CAP]: redactExportSetup(data[DEVICE_EXPORT_CAP]) };
+}
+/** Project a batch status aggregate (`Record<deviceId, Record<capName, status>>`). */
+function redactStatusAggregateBatchSetup(data) {
+    if (!isRecord(data))
+        return data;
+    const out = {};
+    for (const [deviceId, statuses] of Object.entries(data)) {
+        out[deviceId] = redactStatusAggregateSetup(statuses);
+    }
+    return out;
+}
 /** Project a flat `ConfigEntry[]` — `getConfigSchema`'s `{ key, value }` rows. */
 function redactConfigEntries(data) {
     if (!Array.isArray(data))
         return data;
-    return data.map(redactField);
+    return data.map(redactFormField);
 }
 /**
  * URL fields whose VALUE is an RTSP/RTMP restream address and can embed
@@ -237,6 +395,21 @@ function redactStreamUrlSecrets(data) {
  * failing test rather than a silent leak.
  */
 exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
+    // ── Addon settings forms (D634) — hydrated with the STORED secret ──
+    ['addonSettings.getGlobalSettings', redactSettingsForm],
+    ['addonSettings.getIntegrationSettings', redactSettingsForm],
+    ['addonSettings.getDeviceSettings', redactSettingsForm],
+    ['deviceExport.getStatus', redactExportSetup],
+    // ── Round-3 sweep: the per-device device-ops twins and the listings ──
+    ['deviceOps.getConfigEntries', redactConfigEntries],
+    ['deviceOps.getSettingsSchema', redactSettingsSections],
+    ['deviceOps.getRawState', redactDeepSecrets],
+    ['mqttBroker.listBrokers', redactDeepSecrets],
+    ['integrations.list', redactDeepSecrets],
+    ['integrations.get', redactDeepSecrets],
+    ['integrations.getByAddonId', redactDeepSecrets],
+    ['deviceManager.getDeviceStatusAggregate', redactStatusAggregateSetup],
+    ['deviceManager.getDeviceStatusAggregateBatch', redactStatusAggregateBatchSetup],
     ['deviceManager.getDevice', redactDeviceInfoSecrets],
     ['deviceManager.listAll', redactDeviceInfoSecrets],
     ['deviceManager.getChildren', redactDeviceInfoSecrets],

package/dist/api/trpc/generated-cap-routers.js

@@ -1523,7 +1523,7 @@ function createCapRouter_broker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.unsubscribe(methodInput);
         }),
-        getState: trpc_middleware_js_1.protectedProcedure
+        getState: trpc_middleware_js_1.adminProcedure
             .input(types_23.brokerCapability.methods.getState.input.loose())
             .output(types_23.brokerCapability.methods.getState.output)
             .query(async ({ input, ctx }) => {
@@ -2582,7 +2582,7 @@ function createCapRouter_deviceExport(getProvider, createRemoteProxy) {
             const p = resolveProvider('device-export', input?.nodeId, () => getProvider(ctx, input?.addonId), createRemoteProxy);
             return p.listExposedDevices();
         }),
-        exposeDevice: trpc_middleware_js_1.protectedProcedure
+        exposeDevice: trpc_middleware_js_1.adminProcedure
             .input(types_42.deviceExportCapability.methods.exposeDevice.input.loose())
             .output(types_42.deviceExportCapability.methods.exposeDevice.output)
             .mutation(async ({ input, ctx }) => {
@@ -2591,7 +2591,7 @@ function createCapRouter_deviceExport(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.exposeDevice(methodInput);
         }),
-        unexposeDevice: trpc_middleware_js_1.protectedProcedure
+        unexposeDevice: trpc_middleware_js_1.adminProcedure
             .input(types_42.deviceExportCapability.methods.unexposeDevice.input.loose())
             .output(types_42.deviceExportCapability.methods.unexposeDevice.output)
             .mutation(async ({ input, ctx }) => {
@@ -2667,7 +2667,7 @@ function createCapRouter_deviceManager(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.removeDevice(methodInput);
         }),
-        persistConfig: trpc_middleware_js_1.protectedProcedure
+        persistConfig: trpc_middleware_js_1.adminProcedure
             .input(types_43.deviceManagerCapability.methods.persistConfig.input.loose())
             .output(types_43.deviceManagerCapability.methods.persistConfig.output)
             .mutation(async ({ input, ctx }) => {
@@ -2676,7 +2676,7 @@ function createCapRouter_deviceManager(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.persistConfig(methodInput);
         }),
-        loadConfig: trpc_middleware_js_1.protectedProcedure
+        loadConfig: trpc_middleware_js_1.adminProcedure
             .input(types_43.deviceManagerCapability.methods.loadConfig.input.loose())
             .output(types_43.deviceManagerCapability.methods.loadConfig.output)
             .query(async ({ input, ctx }) => {
@@ -2685,7 +2685,7 @@ function createCapRouter_deviceManager(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.loadConfig(methodInput);
         }),
-        loadRuntimeState: trpc_middleware_js_1.protectedProcedure
+        loadRuntimeState: trpc_middleware_js_1.adminProcedure
             .input(types_43.deviceManagerCapability.methods.loadRuntimeState.input.loose())
             .output(types_43.deviceManagerCapability.methods.loadRuntimeState.output)
             .query(async ({ input, ctx }) => {
@@ -3136,6 +3136,15 @@ function createCapRouter_deviceManager(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getAllBindings(methodInput);
         }),
+        listDeviceIdsByCaps: trpc_middleware_js_1.protectedProcedure
+            .input(types_43.deviceManagerCapability.methods.listDeviceIdsByCaps.input.loose())
+            .output(types_43.deviceManagerCapability.methods.listDeviceIdsByCaps.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('device-manager', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listDeviceIdsByCaps(methodInput);
+        }),
         setWrapperActive: trpc_middleware_js_1.adminProcedure
             .input(types_43.deviceManagerCapability.methods.setWrapperActive.input.loose())
             .output(types_43.deviceManagerCapability.methods.setWrapperActive.output)
@@ -3437,7 +3446,7 @@ function createCapRouter_deviceOps(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getConfigEntries(methodInput);
         }),
-        setConfig: trpc_middleware_js_1.protectedProcedure
+        setConfig: trpc_middleware_js_1.adminProcedure
             .input(types_44.deviceOpsCapability.methods.setConfig.input.loose())
             .output(types_44.deviceOpsCapability.methods.setConfig.output)
             .mutation(async ({ input, ctx }) => {
@@ -3455,7 +3464,7 @@ function createCapRouter_deviceOps(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.runAction(methodInput);
         }),
-        removeDevice: trpc_middleware_js_1.protectedProcedure
+        removeDevice: trpc_middleware_js_1.adminProcedure
             .input(types_44.deviceOpsCapability.methods.removeDevice.input.loose())
             .output(types_44.deviceOpsCapability.methods.removeDevice.output)
             .mutation(async ({ input, ctx }) => {
@@ -5233,7 +5242,7 @@ function createCapRouter_mqttBroker(getProvider, createRemoteProxy) {
             const p = resolveProvider('mqtt-broker', input?.nodeId, () => getProvider(ctx, input?.addonId), createRemoteProxy);
             return p.listBrokers();
         }),
-        getBrokerConfig: trpc_middleware_js_1.protectedProcedure
+        getBrokerConfig: trpc_middleware_js_1.adminProcedure
             .input(types_74.mqttBrokerCapability.methods.getBrokerConfig.input.loose())
             .output(types_74.mqttBrokerCapability.methods.getBrokerConfig.output)
             .query(async ({ input, ctx }) => {
@@ -5242,7 +5251,7 @@ function createCapRouter_mqttBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getBrokerConfig(methodInput);
         }),
-        addBroker: trpc_middleware_js_1.protectedProcedure
+        addBroker: trpc_middleware_js_1.adminProcedure
             .input(types_74.mqttBrokerCapability.methods.addBroker.input.loose())
             .output(types_74.mqttBrokerCapability.methods.addBroker.output)
             .mutation(async ({ input, ctx }) => {
@@ -5251,7 +5260,7 @@ function createCapRouter_mqttBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.addBroker(methodInput);
         }),
-        removeBroker: trpc_middleware_js_1.protectedProcedure
+        removeBroker: trpc_middleware_js_1.adminProcedure
             .input(types_74.mqttBrokerCapability.methods.removeBroker.input.loose())
             .output(types_74.mqttBrokerCapability.methods.removeBroker.output)
             .mutation(async ({ input, ctx }) => {
@@ -5260,7 +5269,7 @@ function createCapRouter_mqttBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.removeBroker(methodInput);
         }),
-        testConnection: trpc_middleware_js_1.protectedProcedure
+        testConnection: trpc_middleware_js_1.adminProcedure
             .input(types_74.mqttBrokerCapability.methods.testConnection.input.loose())
             .output(types_74.mqttBrokerCapability.methods.testConnection.output)
             .mutation(async ({ input, ctx }) => {
@@ -5269,7 +5278,7 @@ function createCapRouter_mqttBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.testConnection(methodInput);
         }),
-        startEmbeddedBroker: trpc_middleware_js_1.protectedProcedure
+        startEmbeddedBroker: trpc_middleware_js_1.adminProcedure
             .input(types_74.mqttBrokerCapability.methods.startEmbeddedBroker.input.loose())
             .output(types_74.mqttBrokerCapability.methods.startEmbeddedBroker.output)
             .mutation(async ({ input, ctx }) => {
@@ -5278,7 +5287,7 @@ function createCapRouter_mqttBroker(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.startEmbeddedBroker(methodInput);
         }),
-        stopEmbeddedBroker: trpc_middleware_js_1.protectedProcedure
+        stopEmbeddedBroker: trpc_middleware_js_1.adminProcedure
             .input(types_74.mqttBrokerCapability.methods.stopEmbeddedBroker.input.loose())
             .output(types_74.mqttBrokerCapability.methods.stopEmbeddedBroker.output)
             .mutation(async ({ input, ctx }) => {
@@ -5632,7 +5641,7 @@ function createCapRouter_notificationOutput(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listTargetKinds(methodInput);
         }),
-        listTargets: trpc_middleware_js_1.protectedProcedure
+        listTargets: trpc_middleware_js_1.adminProcedure
             .input(types_80.notificationOutputCapability.methods.listTargets.input.loose())
             .output(types_80.notificationOutputCapability.methods.listTargets.output)
             .query(async ({ input, ctx }) => {
@@ -5641,7 +5650,7 @@ function createCapRouter_notificationOutput(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listTargets(methodInput);
         }),
-        discoverTargets: trpc_middleware_js_1.protectedProcedure
+        discoverTargets: trpc_middleware_js_1.adminProcedure
             .input(types_80.notificationOutputCapability.methods.discoverTargets.input.loose())
             .output(types_80.notificationOutputCapability.methods.discoverTargets.output)
             .query(async ({ input, ctx }) => {
@@ -5650,7 +5659,7 @@ function createCapRouter_notificationOutput(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.discoverTargets(methodInput);
         }),
-        send: trpc_middleware_js_1.protectedProcedure
+        send: trpc_middleware_js_1.adminProcedure
             .input(types_80.notificationOutputCapability.methods.send.input.loose())
             .output(types_80.notificationOutputCapability.methods.send.output)
             .mutation(async ({ input, ctx }) => {
@@ -5659,7 +5668,7 @@ function createCapRouter_notificationOutput(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.send(methodInput);
         }),
-        testTarget: trpc_middleware_js_1.protectedProcedure
+        testTarget: trpc_middleware_js_1.adminProcedure
             .input(types_80.notificationOutputCapability.methods.testTarget.input.loose())
             .output(types_80.notificationOutputCapability.methods.testTarget.output)
             .mutation(async ({ input, ctx }) => {
@@ -5668,7 +5677,7 @@ function createCapRouter_notificationOutput(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.testTarget(methodInput);
         }),
-        upsertTarget: trpc_middleware_js_1.protectedProcedure
+        upsertTarget: trpc_middleware_js_1.adminProcedure
             .input(types_80.notificationOutputCapability.methods.upsertTarget.input.loose())
             .output(types_80.notificationOutputCapability.methods.upsertTarget.output)
             .mutation(async ({ input, ctx }) => {
@@ -5677,7 +5686,7 @@ function createCapRouter_notificationOutput(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.upsertTarget(methodInput);
         }),
-        deleteTarget: trpc_middleware_js_1.protectedProcedure
+        deleteTarget: trpc_middleware_js_1.adminProcedure
             .input(types_80.notificationOutputCapability.methods.deleteTarget.input.loose())
             .output(types_80.notificationOutputCapability.methods.deleteTarget.output)
             .mutation(async ({ input, ctx }) => {
@@ -5686,7 +5695,7 @@ function createCapRouter_notificationOutput(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.deleteTarget(methodInput);
         }),
-        setTargetEnabled: trpc_middleware_js_1.protectedProcedure
+        setTargetEnabled: trpc_middleware_js_1.adminProcedure
             .input(types_80.notificationOutputCapability.methods.setTargetEnabled.input.loose())
             .output(types_80.notificationOutputCapability.methods.setTargetEnabled.output)
             .mutation(async ({ input, ctx }) => {
@@ -8745,7 +8754,7 @@ function createCapRouter_serverManagement(getProvider, createRemoteProxy) {
 }
 function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        get: trpc_middleware_js_1.protectedProcedure
+        get: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.get.input.loose())
             .output(types_104.settingsStoreCapability.methods.get.output)
             .query(async ({ input, ctx }) => {
@@ -8754,7 +8763,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.get(methodInput);
         }),
-        set: trpc_middleware_js_1.protectedProcedure
+        set: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.set.input.loose())
             .output(types_104.settingsStoreCapability.methods.set.output)
             .mutation(async ({ input, ctx }) => {
@@ -8763,7 +8772,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.set(methodInput);
         }),
-        query: trpc_middleware_js_1.protectedProcedure
+        query: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.query.input.loose())
             .output(types_104.settingsStoreCapability.methods.query.output)
             .query(async ({ input, ctx }) => {
@@ -8772,7 +8781,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.query(methodInput);
         }),
-        upsert: trpc_middleware_js_1.protectedProcedure
+        upsert: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.upsert.input.loose())
             .output(types_104.settingsStoreCapability.methods.upsert.output)
             .mutation(async ({ input, ctx }) => {
@@ -8781,7 +8790,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.upsert(methodInput);
         }),
-        insert: trpc_middleware_js_1.protectedProcedure
+        insert: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.insert.input.loose())
             .output(types_104.settingsStoreCapability.methods.insert.output)
             .mutation(async ({ input, ctx }) => {
@@ -8790,7 +8799,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.insert(methodInput);
         }),
-        insertMany: trpc_middleware_js_1.protectedProcedure
+        insertMany: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.insertMany.input.loose())
             .output(types_104.settingsStoreCapability.methods.insertMany.output)
             .mutation(async ({ input, ctx }) => {
@@ -8799,7 +8808,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.insertMany(methodInput);
         }),
-        update: trpc_middleware_js_1.protectedProcedure
+        update: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.update.input.loose())
             .output(types_104.settingsStoreCapability.methods.update.output)
             .mutation(async ({ input, ctx }) => {
@@ -8808,7 +8817,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.update(methodInput);
         }),
-        delete: trpc_middleware_js_1.protectedProcedure
+        delete: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.delete.input.loose())
             .output(types_104.settingsStoreCapability.methods.delete.output)
             .mutation(async ({ input, ctx }) => {
@@ -8817,7 +8826,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.delete(methodInput);
         }),
-        deleteWhere: trpc_middleware_js_1.protectedProcedure
+        deleteWhere: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.deleteWhere.input.loose())
             .output(types_104.settingsStoreCapability.methods.deleteWhere.output)
             .mutation(async ({ input, ctx }) => {
@@ -8826,7 +8835,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.deleteWhere(methodInput);
         }),
-        updateWhere: trpc_middleware_js_1.protectedProcedure
+        updateWhere: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.updateWhere.input.loose())
             .output(types_104.settingsStoreCapability.methods.updateWhere.output)
             .mutation(async ({ input, ctx }) => {
@@ -8835,7 +8844,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.updateWhere(methodInput);
         }),
-        count: trpc_middleware_js_1.protectedProcedure
+        count: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.count.input.loose())
             .output(types_104.settingsStoreCapability.methods.count.output)
             .query(async ({ input, ctx }) => {
@@ -8844,7 +8853,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.count(methodInput);
         }),
-        aggregate: trpc_middleware_js_1.protectedProcedure
+        aggregate: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.aggregate.input.loose())
             .output(types_104.settingsStoreCapability.methods.aggregate.output)
             .query(async ({ input, ctx }) => {
@@ -8853,7 +8862,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.aggregate(methodInput);
         }),
-        histogram: trpc_middleware_js_1.protectedProcedure
+        histogram: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.histogram.input.loose())
             .output(types_104.settingsStoreCapability.methods.histogram.output)
             .query(async ({ input, ctx }) => {
@@ -8862,7 +8871,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.histogram(methodInput);
         }),
-        isEmpty: trpc_middleware_js_1.protectedProcedure
+        isEmpty: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.isEmpty.input.loose())
             .output(types_104.settingsStoreCapability.methods.isEmpty.output)
             .query(async ({ input, ctx }) => {
@@ -8871,7 +8880,7 @@ function createCapRouter_settingsStore(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.isEmpty(methodInput);
         }),
-        declareCollection: trpc_middleware_js_1.protectedProcedure
+        declareCollection: trpc_middleware_js_1.adminProcedure
             .input(types_104.settingsStoreCapability.methods.declareCollection.input.loose())
             .output(types_104.settingsStoreCapability.methods.declareCollection.output)
             .mutation(async ({ input, ctx }) => {
@@ -9031,7 +9040,7 @@ function createCapRouter_ssoBridge(getProvider, createRemoteProxy) {
 }
 function createCapRouter_storage(getProvider, createRemoteProxy) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        resolve: trpc_middleware_js_1.protectedProcedure
+        resolve: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.resolve.input.loose())
             .output(types_108.storageCapability.methods.resolve.output)
             .query(async ({ input, ctx }) => {
@@ -9040,7 +9049,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.resolve(methodInput);
         }),
-        write: trpc_middleware_js_1.protectedProcedure
+        write: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.write.input.loose())
             .output(types_108.storageCapability.methods.write.output)
             .mutation(async ({ input, ctx }) => {
@@ -9049,7 +9058,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.write(methodInput);
         }),
-        read: trpc_middleware_js_1.protectedProcedure
+        read: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.read.input.loose())
             .output(types_108.storageCapability.methods.read.output)
             .query(async ({ input, ctx }) => {
@@ -9058,7 +9067,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.read(methodInput);
         }),
-        exists: trpc_middleware_js_1.protectedProcedure
+        exists: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.exists.input.loose())
             .output(types_108.storageCapability.methods.exists.output)
             .query(async ({ input, ctx }) => {
@@ -9067,7 +9076,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.exists(methodInput);
         }),
-        list: trpc_middleware_js_1.protectedProcedure
+        list: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.list.input.loose())
             .output(types_108.storageCapability.methods.list.output)
             .query(async ({ input, ctx }) => {
@@ -9076,7 +9085,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.list(methodInput);
         }),
-        delete: trpc_middleware_js_1.protectedProcedure
+        delete: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.delete.input.loose())
             .output(types_108.storageCapability.methods.delete.output)
             .mutation(async ({ input, ctx }) => {
@@ -9094,7 +9103,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getAvailableSpace(methodInput);
         }),
-        beginUpload: trpc_middleware_js_1.protectedProcedure
+        beginUpload: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.beginUpload.input.loose())
             .output(types_108.storageCapability.methods.beginUpload.output)
             .mutation(async ({ input, ctx }) => {
@@ -9103,7 +9112,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.beginUpload(methodInput);
         }),
-        writeChunk: trpc_middleware_js_1.protectedProcedure
+        writeChunk: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.writeChunk.input.loose())
             .output(types_108.storageCapability.methods.writeChunk.output)
             .mutation(async ({ input, ctx }) => {
@@ -9112,7 +9121,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.writeChunk(methodInput);
         }),
-        finalizeUpload: trpc_middleware_js_1.protectedProcedure
+        finalizeUpload: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.finalizeUpload.input.loose())
             .output(types_108.storageCapability.methods.finalizeUpload.output)
             .mutation(async ({ input, ctx }) => {
@@ -9121,7 +9130,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.finalizeUpload(methodInput);
         }),
-        abortUpload: trpc_middleware_js_1.protectedProcedure
+        abortUpload: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.abortUpload.input.loose())
             .output(types_108.storageCapability.methods.abortUpload.output)
             .mutation(async ({ input, ctx }) => {
@@ -9130,7 +9139,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.abortUpload(methodInput);
         }),
-        beginDownload: trpc_middleware_js_1.protectedProcedure
+        beginDownload: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.beginDownload.input.loose())
             .output(types_108.storageCapability.methods.beginDownload.output)
             .mutation(async ({ input, ctx }) => {
@@ -9139,7 +9148,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.beginDownload(methodInput);
         }),
-        readChunk: trpc_middleware_js_1.protectedProcedure
+        readChunk: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.readChunk.input.loose())
             .output(types_108.storageCapability.methods.readChunk.output)
             .query(async ({ input, ctx }) => {
@@ -9148,7 +9157,7 @@ function createCapRouter_storage(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.readChunk(methodInput);
         }),
-        endDownload: trpc_middleware_js_1.protectedProcedure
+        endDownload: trpc_middleware_js_1.adminProcedure
             .input(types_108.storageCapability.methods.endDownload.input.loose())
             .output(types_108.storageCapability.methods.endDownload.output)
             .mutation(async ({ input, ctx }) => {

package/dist/main.js

@@ -60,6 +60,7 @@ const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
 const backup_download_js_1 = require("./api/backup-download.js");
 const health_routes_1 = require("./api/health/health.routes");
+const auth_rate_limit_1 = require("./auth/auth-rate-limit");
 const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
@@ -583,7 +584,10 @@ async function bootstrap() {
             verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
         });
         console.log(`[bootstrap] Health routes registered (hub v${hubVersion})`);
-        (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify);
+        (0, adaptive_probe_routes_1.registerAdaptiveProbeRoute)(fastify, {
+            verifyToken: (token) => app.get(auth_service_1.AuthService).verifyToken(token),
+            limiter: (0, auth_rate_limit_1.createRateLimiter)({ windowMs: 60_000, max: adaptive_probe_routes_1.ADAPTIVE_PROBE_PER_IP_PER_MINUTE }),
+        });
     }
     catch (err) {
         console.warn('[bootstrap] Failed to register health routes:', err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.380",
+  "version": "1.2.382",
   "private": false,
   "files": [
     "dist",
@@ -35,18 +35,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.261",
-    "@camstack/addon-agent-ui": "1.2.143",
+    "@camstack/addon-admin-ui": "1.2.264",
+    "@camstack/addon-agent-ui": "1.2.145",
     "@camstack/addon-auth": "1.2.123",
     "@camstack/addon-decoder-nodeav": "1.2.115",
-    "@camstack/addon-notifiers": "1.2.119",
-    "@camstack/addon-pipeline": "1.2.290",
-    "@camstack/addon-pipeline-orchestrator": "1.2.247",
-    "@camstack/addon-post-analysis": "1.2.276",
+    "@camstack/addon-notifiers": "1.2.120",
+    "@camstack/addon-pipeline": "1.2.292",
+    "@camstack/addon-pipeline-orchestrator": "1.2.249",
+    "@camstack/addon-post-analysis": "1.2.279",
     "@camstack/sdk": "1.2.118",
-    "@camstack/system": "1.2.294",
-    "@camstack/types": "1.2.250",
-    "@camstack/ui-library": "1.2.201",
+    "@camstack/system": "1.2.297",
+    "@camstack/types": "1.2.253",
+    "@camstack/ui-library": "1.2.203",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",