@camstack/server 1.2.403 → 1.2.405

package/dist/api/core/event-bus-proxy.router.js

@@ -26,6 +26,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createEventBusProxyRouter = createEventBusProxyRouter;
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
+const public_event_filter_js_1 = require("./public-event-filter.js");
 /**
  * Upper bound on the `getRecent` limit — kept in step with the hub's
  * `recent[]` ring-buffer size (`MAX_RECENT_EVENTS` in `event-bus-core.ts`).
@@ -111,10 +113,15 @@ function createEventBusProxyRouter(eventBus) {
         getRecent: trpc_middleware_js_1.protectedProcedure
             .input(GetRecentInputSchema)
             .output(zod_1.z.array(RecentEventOutputSchema))
-            .query(({ input }) => {
-            return eventBus
-                .getRecent(input.category !== undefined ? { category: input.category } : undefined, input.limit)
-                .map(serializeRecentEvent);
+            .query(({ input, ctx }) => {
+            // This router is on the PUBLIC app router too, not only the worker
+            // bridge: the same two projections as `systemEvents.getRecent` apply —
+            // owner-only categories are never served (D224) and a device-restricted
+            // scoped token reads only its devices (F0.5). A worker reaches this over
+            // the mesh context (`isAdmin: true`), so it skips only the SCOPE
+            // projection — owner-only categories are stripped for every caller.
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
+            return (0, public_event_filter_js_1.publicRecent)(eventBus, input.category !== undefined ? { category: input.category } : undefined, input.limit, keep).map(serializeRecentEvent);
         }),
     });
 }

package/dist/api/core/live-events.router.js

@@ -11,6 +11,7 @@ const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const share_view_access_js_1 = require("../trpc/share-view-access.js");
 const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
+const public_event_filter_js_1 = require("./public-event-filter.js");
 // The pushed wire shape is `SystemEvent` from @camstack/types — the exact
 // type `EventBusService.subscribe` hands its handlers. It MUST be a type
 // exported from @camstack/types (not a local interface): the AppRouter
@@ -27,14 +28,15 @@ function createLiveEventsRouter(eb, ar) {
         })
             .optional())
             .query(({ input, ctx }) => {
-            const recent = eb.getRecent(input ?? {}, input?.limit ?? 50);
             // SECURITY (F0.5): a device-restricted scoped token must not read the
             // whole deployment's event history. `scopedEventVisibility` returns null
             // for admins and broad category-view operators (no filtering), or a
             // per-event predicate that keeps only events for devices the caller may
             // view. (Share-view tokens cannot reach this method — not allowlisted.)
+            // An owner-only category (D224) is not history anyone may read. Both
+            // projections run BEFORE the limit (`publicRecent`).
             const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
-            return keep ? recent.filter((evt) => keep(evt)) : recent;
+            return (0, public_event_filter_js_1.publicRecent)(eb, input?.category ? { category: input.category } : {}, input?.limit ?? 50, keep);
         }),
         onEvent: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ category: zod_1.z.string().optional() }))
@@ -52,20 +54,25 @@ function createLiveEventsRouter(eb, ar) {
                 const filter = {};
                 if (input.category)
                     filter.category = input.category;
+                // Every branch refuses an owner-only category first (D224): a
+                // subscriber that names no category gets every PUBLIC one.
                 if (shareScope) {
                     const allowedDeviceIds = new Set(shareScope.deviceIds);
                     return eb.subscribe(filter, (evt) => {
-                        if ((0, share_view_access_js_1.liveEventInShareScope)(evt, allowedDeviceIds))
+                        if ((0, public_event_filter_js_1.isPublicEvent)(evt) && (0, share_view_access_js_1.liveEventInShareScope)(evt, allowedDeviceIds))
                             push(evt);
                     });
                 }
                 if (scopedKeep) {
                     return eb.subscribe(filter, (evt) => {
-                        if (scopedKeep(evt))
+                        if ((0, public_event_filter_js_1.isPublicEvent)(evt) && scopedKeep(evt))
                             push(evt);
                     });
                 }
-                return eb.subscribe(filter, push);
+                return eb.subscribe(filter, (evt) => {
+                    if ((0, public_event_filter_js_1.isPublicEvent)(evt))
+                        push(evt);
+                });
             });
         }),
         onDeviceEvent: trpc_middleware_js_1.protectedProcedure
@@ -93,7 +100,10 @@ function createLiveEventsRouter(eb, ar) {
                         throw new Error('Access denied');
                     }
                 }
-                return eb.subscribe({ source: { type: 'device', id: input.deviceId } }, push);
+                return eb.subscribe({ source: { type: 'device', id: input.deviceId } }, (evt) => {
+                    if ((0, public_event_filter_js_1.isPublicEvent)(evt))
+                        push(evt);
+                });
             });
         }),
     });

package/dist/api/core/public-event-filter.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPublicEvent = isPublicEvent;
+exports.publicRecent = publicRecent;
+/**
+ * The one predicate every public event procedure applies before an event
+ * leaves the hub (D224, D663): an owner-only category — today the native
+ * shadow of a claimed cap — is never served, whatever the caller's role or
+ * filter. A subscriber that omits `category` gets every PUBLIC category, not
+ * every category.
+ *
+ * `publicRecent` is the history half: it filters BEFORE the limit, so a
+ * client asking for N public events gets N — an owner-only row in the window
+ * never costs the caller a slot. The ring is bounded (`MAX_RECENT_EVENTS`), so
+ * reading it whole and cutting afterwards is one bounded pass.
+ */
+const types_1 = require("@camstack/types");
+function isPublicEvent(evt) {
+    return !(0, types_1.isOwnerOnlyEventCategory)(evt.category);
+}
+function publicRecent(source, filter, limit, keep) {
+    const visible = source
+        .getRecent(filter)
+        .filter((evt) => isPublicEvent(evt) && (keep === null || keep(evt)));
+    return limit !== undefined ? visible.slice(-limit) : visible;
+}

package/dist/api/core/system-events.router.js

@@ -12,6 +12,7 @@ exports.createSystemEventsRouter = createSystemEventsRouter;
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
+const public_event_filter_js_1 = require("./public-event-filter.js");
 function serialize(e) {
     return {
         id: e.id,
@@ -82,17 +83,18 @@ const SubscribeInputSchema = ScopeFieldsSchema.extend({
 function createSystemEventsRouter(eb) {
     return (0, trpc_middleware_js_1.trpcRouter)({
         getRecent: trpc_middleware_js_1.protectedProcedure.input(GetRecentInputSchema).query(({ input, ctx }) => {
-            const recent = eb.getRecent({
+            // SECURITY (F0.5): filter the history to what a device-restricted scoped
+            // token may view. null ⇒ admin / broad category-view operator ⇒ unfiltered.
+            // An owner-only category (D224) is not history anyone may read. Both
+            // projections run BEFORE the limit, so N asked is N public rows answered.
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
+            return (0, public_event_filter_js_1.publicRecent)(eb, {
                 ...(input.source ? { source: input.source } : {}),
                 ...(input.agentId ? { agentId: input.agentId } : {}),
                 ...(input.addonId ? { addonId: input.addonId } : {}),
                 ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                 ...(input.category ? { category: input.category } : {}),
-            }, input.limit);
-            // SECURITY (F0.5): filter the history to what a device-restricted scoped
-            // token may view. null ⇒ admin / broad category-view operator ⇒ unfiltered.
-            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
-            return (keep ? recent.filter((evt) => keep(evt)) : recent).map(serialize);
+            }, input.limit, keep).map(serialize);
         }),
         subscribe: trpc_middleware_js_1.protectedProcedure.input(SubscribeInputSchema).subscription(({ input, ctx }) => {
             // SECURITY (F0.5): a device-restricted scoped token must not receive every
@@ -106,6 +108,8 @@ function createSystemEventsRouter(eb) {
                     ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                     ...(input.category ? { category: input.category } : {}),
                 }, (event) => {
+                    if (!(0, public_event_filter_js_1.isPublicEvent)(event))
+                        return;
                     if (!keep || keep(event))
                         push(serialize(event));
                 });

package/dist/api/trpc/generated-cap-routers.js

@@ -2053,6 +2053,15 @@ function createCapRouter_coreBlocks(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listCompositions(methodInput);
         }),
+        getCustomization: trpc_middleware_js_1.adminProcedure
+            .input(types_34.coreBlocksCapability.methods.getCustomization.input.loose())
+            .output(types_34.coreBlocksCapability.methods.getCustomization.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('core-blocks', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getCustomization(methodInput);
+        }),
         validateComposition: trpc_middleware_js_1.adminProcedure
             .input(types_34.coreBlocksCapability.methods.validateComposition.input.loose())
             .output(types_34.coreBlocksCapability.methods.validateComposition.output)
@@ -3737,6 +3746,51 @@ function createCapRouter_deviceState(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setCapSlice(methodInput);
         }),
+        claimFields: trpc_middleware_js_1.adminProcedure
+            .input(types_48.deviceStateCapability.methods.claimFields.input.loose())
+            .output(types_48.deviceStateCapability.methods.claimFields.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('device-state', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.claimFields(methodInput);
+        }),
+        patchOwnedFields: trpc_middleware_js_1.adminProcedure
+            .input(types_48.deviceStateCapability.methods.patchOwnedFields.input.loose())
+            .output(types_48.deviceStateCapability.methods.patchOwnedFields.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('device-state', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.patchOwnedFields(methodInput);
+        }),
+        releaseClaim: trpc_middleware_js_1.adminProcedure
+            .input(types_48.deviceStateCapability.methods.releaseClaim.input.loose())
+            .output(types_48.deviceStateCapability.methods.releaseClaim.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('device-state', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.releaseClaim(methodInput);
+        }),
+        listClaims: trpc_middleware_js_1.adminProcedure
+            .input(types_48.deviceStateCapability.methods.listClaims.input.loose())
+            .output(types_48.deviceStateCapability.methods.listClaims.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('device-state', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listClaims(methodInput);
+        }),
+        getNativeCapSlice: trpc_middleware_js_1.adminProcedure
+            .input(types_48.deviceStateCapability.methods.getNativeCapSlice.input.loose())
+            .output(types_48.deviceStateCapability.methods.getNativeCapSlice.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('device-state', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getNativeCapSlice(methodInput);
+        }),
     });
 }
 function createCapRouter_deviceStatus(getProvider, createRemoteProxy) {

package/dist/core/moleculer/moleculer.service.js

@@ -311,6 +311,12 @@ class MoleculerService {
                 resolveNative: (capName, deviceId) => this.capabilityService
                     .getRegistry()
                     ?.getNativeProvider(capName, deviceId) ?? null,
+                // `getStatus` of a CLAIMED cap (D663, S3) — the hub mirror answers a
+                // forked child's `battery.getStatus({ deviceId })` (exporters, the
+                // notification center) before the resolver would dispatch it to the
+                // owning runner, whose `getStatus` is the native slice. The SAME
+                // question the registry's resolvers ask, through the same method.
+                claimedStatus: (capName, deviceId) => this.resolveClaimedStatus(capName, deviceId),
                 // `nodeIdMode: 'data'` signal: for these caps (`addon-settings`,
                 // `addons`, `nodes`, `pipeline-orchestrator`) an inline `args.nodeId`
                 // is provider DATA — the hub singleton dispatches internally — never a
@@ -397,6 +403,10 @@ class MoleculerService {
                 // onUnownedCall (a pin to ANOTHER node still bypasses the sibling).
                 ownNodeId: nodeId,
                 onUnownedCall,
+                // `getStatus` of a CLAIMED cap is answered by the hub mirror BEFORE the
+                // sibling short-circuit can dispatch it to the owning child (D663, S3)
+                // — the same resolver the handler above and `callCapabilityOnNode` use.
+                claimedStatus: (capName, deviceId) => this.resolveClaimedStatus(capName, deviceId),
                 // A collection ARRAY method must reach `onUnownedCall` (which fans it
                 // across every provider) instead of being short-circuited to ONE local
                 // sibling. Same predicate the aggregate itself uses, so the two agree
@@ -719,6 +729,17 @@ class MoleculerService {
     registerCoreCapService(service) {
         this.brokerSafe.createService(service);
     }
+    /**
+     * The hub's claim authority (D663, S3): `CapabilityRegistry.resolveClaimedStatus`,
+     * which resolves the device's claims first. Every entry that routes a
+     * device-scoped `getStatus` by name asks it through `answerClaimedGetStatus`.
+     */
+    resolveClaimedStatus(capName, deviceId) {
+        const registry = this.capabilityService.getRegistry();
+        return registry !== null
+            ? registry.resolveClaimedStatus(capName, deviceId)
+            : Promise.resolve(system_1.UNCLAIMED);
+    }
     /**
      * Call a capability method on a specific node.
      *
@@ -737,6 +758,14 @@ class MoleculerService {
      * have run before the resolver was constructed).
      */
     async callCapabilityOnNode(nodeId, capabilityName, methodName, params) {
+        // `getStatus` of a CLAIMED cap — the hub mirror answers (D663, S3). This is
+        // the third entry that resolves a cap call by name (the hub's own tRPC with
+        // a `nodeId` pin — the generated DeviceProxy always sends one — and every
+        // hub in-process addon's `ctx.api` through `deviceCapResolverLink`); a pin
+        // does not bypass the claim authority. Same shared function as the other two.
+        const claimed = await (0, system_1.answerClaimedGetStatus)((capName, deviceId) => this.resolveClaimedStatus(capName, deviceId), { capName: capabilityName, method: methodName, args: params });
+        if (claimed !== null)
+            return claimed.slice;
         const resolver = this.resolver;
         if (resolver !== null) {
             // Extract deviceId from params so device-scoped native caps (ptz, motion-zones, …)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.403",
+  "version": "1.2.405",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.280",
-    "@camstack/addon-agent-ui": "1.2.152",
+    "@camstack/addon-admin-ui": "1.2.282",
+    "@camstack/addon-agent-ui": "1.2.154",
     "@camstack/addon-auth": "1.2.123",
     "@camstack/addon-decoder-nodeav": "1.2.115",
     "@camstack/addon-notifiers": "1.2.121",
     "@camstack/addon-pipeline": "1.2.304",
     "@camstack/addon-pipeline-orchestrator": "1.2.261",
-    "@camstack/addon-post-analysis": "1.2.292",
+    "@camstack/addon-post-analysis": "1.2.293",
     "@camstack/sdk": "1.2.118",
-    "@camstack/system": "1.2.313",
-    "@camstack/types": "1.2.267",
-    "@camstack/ui-library": "1.2.210",
+    "@camstack/system": "1.2.314",
+    "@camstack/types": "1.2.268",
+    "@camstack/ui-library": "1.2.212",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",