@camstack/server 1.2.455 → 1.2.457

package/THIRD_PARTY_MODELS.md

@@ -30,13 +30,13 @@ under [Non-commercial models](#non-commercial-models).
 
 ## Required attributions
 
-- © Ultralytics, AGPL-3.0. Corresponding source: the upstream Ultralytics checkpoint and scripts/build-camstack-models.py in https://github.com/camstack/server. https://github.com/ultralytics/ultralytics
+- © Ultralytics, AGPL-3.0. Corresponding source: the upstream Ultralytics checkpoint and build-camstack-models.py (with convert_lib.py) published at https://huggingface.co/camstack/camstack-models/tree/main/source. https://github.com/ultralytics/ultralytics
 - Coral Edge TPU models and AIY Vision Birds V1 © Google LLC, Apache-2.0. https://github.com/google-coral/test_data
-- © Ultralytics, AGPL-3.0 (Ultralytics YOLOv9 weights). YOLOv9 architecture: Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). Corresponding source: the upstream Ultralytics checkpoint and scripts/build-camstack-models.py in https://github.com/camstack/server. https://github.com/ultralytics/ultralytics
+- © Ultralytics, AGPL-3.0 (Ultralytics YOLOv9 weights). YOLOv9 architecture: Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). Corresponding source: the upstream Ultralytics checkpoint and build-camstack-models.py (with convert_lib.py) published at https://huggingface.co/camstack/camstack-models/tree/main/source. https://github.com/ultralytics/ultralytics
 - RF-DETR © Roboflow, Apache-2.0. https://github.com/roboflow/rf-detr
 - YuNet weights Copyright (c) 2020 Shiqi Yu, MIT. Training code: ShiqiYu/libfacedetection.train, BSD-3-Clause. https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet
 - AuraFace v1 by fal.ai, Apache-2.0. https://huggingface.co/fal/AuraFace-v1
-- © Ultralytics, AGPL-3.0 (YOLOv8n base, fine-tuned for plates by an unidentified third party). CamStack holds no training checkpoint; the ONNX file is the only form it has. https://github.com/ultralytics/ultralytics
+- open-lpr models, Copyright the open-lpr contributors, Apache-2.0 (https://huggingface.co/faisalthaheem/open-lpr-models, tag detector-2026.10.1). YOLOX architecture and COCO pretraining by Megvii (https://github.com/Megvii-BaseDetection/YOLOX), Apache-2.0. The upstream NOTICE is reproduced verbatim (`NOTICE-open-lpr.txt`). https://huggingface.co/faisalthaheem/open-lpr-models
 - fast-plate-ocr, MIT License, copyright (c) 2024 ankandrew (full notice: licenses/models/MIT-fast-plate-ocr.txt). https://github.com/ankandrew/fast-plate-ocr
 - EfficientNet-Lite0 via timm (Ross Wightman), Apache-2.0. Open Images V7 annotations © Google LLC, CC BY 4.0; images listed by Google as CC BY 2.0, without warranty. https://github.com/huggingface/pytorch-image-models
 - torchvision MobileNetV3, BSD-3-Clause. Trained on the Vehicle classification dataset by DrBimmer (https://huggingface.co/datasets/DrBimmer/vehicle-classification), CC BY-NC 4.0. https://github.com/pytorch/vision
@@ -45,11 +45,10 @@ under [Non-commercial models](#non-commercial-models).
 - YAMNet © Google LLC, Apache-2.0. AudioSet ontology and labels © Google LLC, CC BY 4.0. https://github.com/tensorflow/models/tree/master/research/audioset/yamnet
 - Qwen models © Alibaba Cloud, Apache-2.0. https://huggingface.co/Qwen · https://huggingface.co/unsloth · https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF
 - Built with Llama. Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved. https://huggingface.co/bartowski/Llama-3.2-3B-Instruct-GGUF
-- Scrypted YOLOv9 ReLU detectors, Koushik Dutta (scrypted/plugin-models, repository tagged MIT); trained with the YOLOv9 code of Chien-Yao Wang, I-Hau Yeh, Hong-Yuan Mark Liao, GPL-3.0 (https://github.com/WongKinYiu/yolov9). https://huggingface.co/scrypted/plugin-models
 
 Training data under attribution terms:
 
-- **COCO 2017** (training data of `yolo26n` and 51 more): annotations CC-BY-4.0; images under their Flickr owners' terms. https://cocodataset.org/#termsofuse
+- **COCO 2017** (training data of `yolo26n` and 50 more): annotations CC-BY-4.0; images under their Flickr owners' terms. https://cocodataset.org/#termsofuse
 - **WIDER FACE** (training data of `yunet-2023mar`): research-oriented terms; images CC BY-NC-ND. http://shuoyang1213.me/WIDERFACE/
 - **Open Images V7** (training data of `animal-classifier`): annotations CC-BY-4.0 (Google LLC); images listed as CC-BY-2.0, no warranty. https://storage.googleapis.com/openimages/web/factsfigures_v7.html
 - **DrBimmer/vehicle-classification** (training data of `vehicle-type-v1`): CC-BY-NC-4.0 — treated as binding the trained weights (conservative reading). https://huggingface.co/datasets/DrBimmer/vehicle-classification
@@ -63,32 +62,42 @@ Training data under attribution terms:
   cards link here instead of repeating it.
 -->
 
-The folders `objectDetection/yolo26`, `objectDetection/yolov9`, `plateDetection/yolov8-plate` and `segmentation/yolo26-seg` of the model mirror hold Ultralytics weights,
+The folders `objectDetection/yolo26`, `objectDetection/yolov9` and `segmentation/yolo26-seg` of the model mirror hold Ultralytics weights,
 modified by CamStack and distributed under AGPL-3.0. Their Corresponding Source
-is the public CamStack source repository, **https://github.com/camstack/server**
-(MIT), together with the upstream checkpoints it starts from:
-
-1. **The upstream checkpoints**, published by Ultralytics at
-   https://github.com/ultralytics/assets/releases: `yolo26{n,s,m,l,x}.pt`,
-   `yolov9{t,s,m,c}.pt`, `yolo26{n,s,m}-seg.pt`.
-2. **The export scripts** in https://github.com/camstack/server:
-   `scripts/build-camstack-models.py` (ONNX with a dynamic batch axis, CoreML
-   FP16, OpenVINO IR, OpenVINO NNCF INT8) and `scripts/export-models.py`. The
-   build instructions (Python environment, invocation, calibration images for
-   INT8) are in each script's header.
-3. **The software** that downloads and runs these weights, CamStack itself, is
-   the same repository.
-
-What the repository does **not** cover yet:
-
-- **Some hosted sizes and input resolutions.** The export scripts do not list
-  every variant in the mirror (for example the `-320`/`-256` YOLO26 exports,
-  `yolov9m`/`yolov9c`, and the `yolo26*-seg` models). Each one is the same
-  Ultralytics `export()` with a different model id or `imgsz`, but no script in
-  the repository reproduces it as-is.
-- **`yolov8n-plate` has no training checkpoint.** It is a third-party model
-  (trained 2023-12-05 according to its own metadata, origin not identified).
-  The ONNX file is the only form CamStack has.
+is published in the mirror itself, in its **`source/`** folder,
+**https://huggingface.co/camstack/camstack-models/tree/main/source**, together
+with the upstream checkpoints it starts from:
+
+1. **The upstream checkpoints.** Ultralytics publishes
+   `yolo26{n,s,m,l,x}.pt`, `yolov9{t,s,m,c}.pt` and `yolo26{n,s,m}-seg.pt` at
+   https://github.com/ultralytics/assets/releases.
+2. **The build script** in `source/`: `build-camstack-models.py`, with
+   `convert_lib.py` (the ONNX to OpenVINO / INT8 converter it calls, the same
+   file CamStack's Model Studio runs) and `requirements.txt`. It holds one
+   recipe per hosted file: the upstream checkpoint, the input size, the
+   Ultralytics `export()` arguments, the OpenVINO precision and the INT8
+   calibration count that file records about itself. Every hosted
+   Ultralytics-derived file is rebuilt by one invocation:
+   `build-camstack-models.py --variant <file stem>` (for example
+   `camstack-yolo26n-320` or `camstack-yolov9m-640`), `--family <folder>`
+   or `--all`; `--list` prints the recipes and `--check-hosted` confirms
+   against the mirror that every hosted file is a recipe output. The INT8
+   builds are NNCF post-training quantisation calibrated on COCO images: 128
+   for YOLO26, 300 for YOLOv9, as each IR records; the documented set is the
+   first N of COCO val2017 in file-name order. The Python
+   environment, the recorded tool versions and the calibration set are in
+   `source/README.md` and the script's header. These scripts are CamStack's
+   own code and are offered under the MIT licence; the weights they produce
+   keep their upstream licence.
+
+Limits of a rebuild:
+
+- **Tool versions.** With the Ultralytics, PyTorch, coremltools and OpenVINO
+  versions each recipe names, a rebuild reproduces the hosted weights. Other
+  versions give the same weights in a possibly different graph.
+- **INT8 calibration.** An IR records how many images calibrated it, not
+  which ones. Calibrating on the same COCO images gives the documented build;
+  a different set gives an equivalent, not bit-identical, INT8 model.
 
 ## Non-commercial models
 
@@ -137,7 +146,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yolov8n-plate` (default) | [Ultralytics](https://github.com/ultralytics/ultralytics) | AGPL-3.0 / AGPL-3.0 (`AGPL-3.0.txt`) | unidentified plate dataset (third-party model, trained 2023-12-05 per its ONNX metadata): UNKNOWN | converted to OpenVINO IR and CoreML | mirror `plateDetection/yolov8-plate` |
+| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py) | mirror `plateDetection/yolox-tiny-plate` |
 
 ### Licence plate reading
 
@@ -155,7 +164,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `bird-classifier` (default) | [Google AIY Vision birds_V1](https://github.com/google-coral/test_data) | — / Apache-2.0 (`Apache-2.0.txt`) | — | converted from TensorFlow with tf2onnx; OpenVINO IR and CoreML derived from it | mirror `animalClassification/bird-classifier` |
+| `bird-classifier` (default) | [Google AIY Vision birds_V1](https://github.com/google-coral/test_data) | — / Apache-2.0 (`Apache-2.0.txt`) | — | converted from TensorFlow with tf2onnx; OpenVINO IR and CoreML derived from it; the Edge TPU build is the Google full-integer quantised TFLite of the same model, compiled with edgetpu_compiler 14 (scripts/build-bird-classifier-edgetpu.py) | mirror `animalClassification/bird-classifier` |
 
 ### Vehicle classifier
 
@@ -205,16 +214,13 @@ entry kept resolvable for a saved selection but no longer offered.
 | `llm-qwen3-vl-8b-instruct-q4` | [Qwen3-VL (GGUF by unsloth)](https://huggingface.co/unsloth) | — / Apache-2.0 (`Apache-2.0.txt`) | — | Q4_K_M GGUF quantisation by unsloth (not re-hosted by CamStack) | https://huggingface.co/unsloth/Qwen3-VL-8B-Instruct-GGUF |
 | `llm-qwen3.6-35b-a3b-ud-q4` | [Qwen3.6-35B-A3B (GGUF by unsloth)](https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF) | — / Apache-2.0 (`Apache-2.0.txt`) | — | UD-Q4_K_M GGUF quantisation by unsloth (not re-hosted by CamStack) | https://huggingface.co/unsloth/Qwen3.6-35B-A3B-GGUF |
 
-### Model Studio catalogs (object detection, imported on request)
-
-| Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
-| --- | --- | --- | --- | --- | --- |
-| `scrypted-yolov9t-relu-320`, `scrypted-yolov9t-relu_test-320`, `scrypted-yolov9s-relu-320`, `scrypted-yolov9s-relu_test-320`, `scrypted-yolov9m-relu-320`, `scrypted-yolov9m-relu_test-320`, `scrypted-yolov9c-relu-320`, `scrypted-yolov9c-relu_test-320`, `scrypted-yolov9t-relu-int8-320`, `scrypted-yolov9t-relu_test-int8-320`, `scrypted-yolov9s-relu-int8-320`, `scrypted-yolov9s-relu_test-int8-320`, `scrypted-yolov9m-relu-int8-320`, `scrypted-yolov9m-relu_test-int8-320`, `scrypted-yolov9c-relu-int8-320`, `scrypted-yolov9c-relu_test-int8-320` | [Scrypted plugin-models (repository tagged MIT, no per-model terms)](https://huggingface.co/scrypted/plugin-models) | GPL-3.0 (`GPL-3.0.txt`) / **Unknown** | not stated by Scrypted: UNKNOWN | none: downloaded as published, at a pinned revision | https://huggingface.co/scrypted/plugin-models |
-| `frigate-mobiledet-edgetpu` | [Google Coral test_data](https://github.com/google-coral/test_data) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | COCO 2017: annotations CC-BY-4.0; images under their Flickr owners' terms | none | https://github.com/google-coral/test_data |
-
 ### Your own models
 
-The Scrypted and Frigate catalogs that Model Studio offers are listed above. A
-model you upload or convert yourself, or pull from your own Frigate+ account,
-keeps whatever licence its author published. CamStack does not change it and
-does not record it.
+Model Studio can import third-party models (for example community
+object-detection catalogs) on request. They are downloaded from their
+publishers, are not hosted or redistributed by CamStack, and keep their
+publishers' licences; Model Studio shows the licence where the source declares
+one. A model you upload or convert
+yourself, or pull from your own Frigate+ account, likewise keeps whatever
+licence its author published. CamStack does not change it and does not record
+it.

package/dist/agent/agent-config.js

@@ -81,7 +81,7 @@ function ensurePersistedNodeId(configPath, dataDir) {
     return id;
 }
 function loadAgentConfig(configPath, dataDirOverride) {
-    const filePath = configPath ?? process.env.CAMSTACK_AGENT_CONFIG ?? 'agent.json';
+    const filePath = configPath ?? 'agent.json';
     const dataDir = dataDirOverride ?? process.env.CAMSTACK_DATA ?? './camstack-data';
     const resolvedDataDir = path.resolve(dataDir);
     // Name: config file takes priority over env (allows UI rename to stick).

package/dist/agent/main.js

@@ -721,8 +721,7 @@ async function startAgent(configPath) {
         // agent drops hub-origin categories no local subscriber cares about instead
         // of fanning every category into its bus. Read per-event, so a child
         // (un)subscribing takes effect immediately. Fails OPEN when a child is
-        // undeclared (aggregateEventInterest → null). Gated by
-        // CAMSTACK_MOLECULER_EVENT_FANOUT (filter|shadow|broadcast).
+        // undeclared (aggregateEventInterest → null).
         const interestRegistry = agentUdsRegistry;
         (0, system_1.setNodeEventInterest)(broker, () => interestRegistry.aggregateEventInterest());
         // D1: answer readiness-snapshot requests from UDS children over the

package/dist/api/core/auth.router.js

@@ -22,6 +22,7 @@ const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
 const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const session_mint_js_1 = require("../../auth/session-mint.js");
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
 const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
@@ -331,46 +332,18 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         return shareTokens;
     };
     /**
-     * Mint the REAL session JWT for `userId` — the single shared tail of
-     * every successful login leg (TOTP second factor, passkey second
-     * factor, usernameless passkey-first). Re-fetches the user record so
-     * scopes / allowedDevices reflect any admin change made mid-flow —
-     * signing from stale claims could mint a stale-scope session.
+     * THE session mint (`auth/session-mint.ts`, D712) — the single shared tail
+     * of every successful login leg, including `/api/auth/sso/finish`. It
+     * re-reads the user record so scopes / allowedDevices / isAdmin reflect any
+     * admin change made mid-flow; signing from stale claims could mint a
+     * stale-scope session.
      */
-    /**
-     * Fresh user record for `userId` via `user-management` — shared by the
-     * session-mint tail and the second-factor challenge legs (both need
-     * live identity claims, never stale ones).
-     */
-    const findUserById = async (userId) => {
-        const userMgmt = registry?.getSingleton('user-management');
-        if (!userMgmt) {
-            throw new Error('Login unavailable — `user-management` capability not registered');
-        }
-        const fresh = typeof userMgmt.listUsers === 'function'
-            ? (await userMgmt.listUsers()).find((u) => u.id === userId)
-            : null;
-        if (!fresh) {
-            throw new Error('User no longer exists');
-        }
-        return fresh;
-    };
-    const mintSessionForUserId = async (userId) => {
-        const fresh = await findUserById(userId);
-        const sessionToken = auth.signToken({
-            userId: fresh.id,
-            username: fresh.username,
-            isAdmin: fresh.isAdmin,
-            allowedProviders: fresh.allowedProviders ?? '*',
-            allowedDevices: fresh.allowedDevices ?? {},
-            scopes: fresh.scopes ?? [],
-        });
-        return {
-            token: sessionToken,
-            user: { id: fresh.id, username: fresh.username, isAdmin: fresh.isAdmin },
-            requiresTotp: false,
-        };
-    };
+    const minter = (0, session_mint_js_1.createSessionMinter)({
+        signer: auth,
+        directory: () => registry?.getSingleton('user-management'),
+    });
+    const findUserById = minter.findUser;
+    const mintSessionForUserId = minter.mintForUserId;
     /**
      * `mintSessionForUserId` with the "user vanished" failure mapped to a
      * clean 401 — for the token-exchange legs (`exchangeSession`,
@@ -383,7 +356,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return await mintSessionForUserId(userId);
         }
         catch (error) {
-            if (error instanceof Error && error.message === 'User no longer exists') {
+            if (error instanceof session_mint_js_1.SessionUserGoneError) {
                 throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'User no longer exists' });
             }
             throw error;
@@ -469,26 +442,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     secondFactors,
                 };
             }
-            // Snapshot `scopes` into the JWT payload. Admins ignore the
-            // field (middleware bypass); for non-admins this drives the
-            // entire scope-access check until the user logs out + back in.
-            // setUserScopes mutations take effect on next login — old JWTs
-            // carry the snapshot from issue time. This is the standard JWT
-            // staleness tradeoff; if you need immediate revocation, force a
-            // logout from the admin UI.
-            const token = auth.signToken({
-                userId: user.id,
-                username: user.username,
-                isAdmin: user.isAdmin,
-                allowedProviders: user.allowedProviders ?? '*',
-                allowedDevices: user.allowedDevices ?? {},
-                scopes: user.scopes ?? [],
-            });
-            return {
-                token,
-                user: { id: user.id, username: user.username, isAdmin: user.isAdmin },
-                requiresTotp: false,
-            };
+            // `user` is the record `validateCredentials` just read — fresh.
+            return minter.mintForRecord(user);
         }),
         /**
          * Second leg of the 2FA login. Accepts the challenge token minted

package/dist/api/cors/cors-policy.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * cors-policy — which browser origins may READ this hub's responses (D707).
+ *
+ * The viewer PWA is hosted at {@link VIEWER_PWA_ORIGIN} and talks to each
+ * operator's own hub straight from the browser — no proxy, no cloud. Before
+ * D707 the hub answered every request with `Access-Control-Allow-Origin: *`,
+ * which let ANY web page a user visited read any hub response its script could
+ * reach (an unauthenticated probe of a LAN hub, for one). The policy is now an
+ * allowlist:
+ *
+ *  - the hub's OWN origin — the `Origin` whose host is the request's `Host`
+ *    (or `X-Forwarded-Host`, which a relay such as the Home Assistant panel
+ *    proxy sets to ITS origin). Same-origin calls never needed CORS; this
+ *    entry exists for the WebSocket check, where a browser always sends
+ *    `Origin` and the native clients send their target's;
+ *  - {@link VIEWER_PWA_ORIGIN}, the hosted viewer;
+ *  - {@link OPAQUE_ORIGIN} (`null`): the native app's OTA-bundled embed is a
+ *    `file://` page inside a WKWebView, whose origin is opaque. Removing it
+ *    breaks live view on iOS;
+ *  - `CAMSTACK_HUB_PUBLIC_URL`, when set, and the operator's extras
+ *    (`server.corsOrigins` in config.yaml / `CAMSTACK_CORS_ORIGINS`).
+ *
+ * The answer to an allowed origin REFLECTS it exactly — never `*` — and never
+ * carries `Access-Control-Allow-Credentials`. The cross-origin viewer
+ * authenticates with a bearer token in `Authorization` (or tRPC
+ * `connectionParams` on the socket), which needs no credentials mode; the
+ * httpOnly session cookie therefore never rides a cross-origin request, so the
+ * cookie-gated surfaces (`auth.exchangeSession`, `/api/embed-auth`, the
+ * admin-ui) stay same-origin by construction.
+ *
+ * Pure: no Fastify, no I/O — `register-cors-policy.ts` is the glue.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CORS_PREFLIGHT_MAX_AGE_SEC = exports.CORS_EXPOSED_HEADERS = exports.CORS_ALLOWED_HEADERS = exports.CORS_ALLOWED_METHODS = exports.OPAQUE_ORIGIN = exports.VIEWER_PWA_ORIGIN = void 0;
+exports.normalizeOrigin = normalizeOrigin;
+exports.parseConfiguredOrigins = parseConfiguredOrigins;
+exports.builtInOrigins = builtInOrigins;
+exports.judgeCorsOrigin = judgeCorsOrigin;
+exports.corsResponseHeaders = corsResponseHeaders;
+exports.appendVary = appendVary;
+/** The hosted viewer PWA (operator decision 2026-10-06). */
+exports.VIEWER_PWA_ORIGIN = 'https://camstack.zentik.app';
+/**
+ * The serialisation of an opaque origin. The native app's OTA embed
+ * (`assets/embed/camstack-embed.html`, loaded from `file://`) sends it.
+ */
+exports.OPAQUE_ORIGIN = 'null';
+/** Every method a hub route answers. */
+exports.CORS_ALLOWED_METHODS = 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS';
+/**
+ * Request headers a cross-origin caller may send. `authorization` is the
+ * whole point; `range` is recorded-media seeking; the `trpc-*` / `x-trpc-*`
+ * names are what `@trpc/client` links may add. NOT `x-camstack-exchange`:
+ * the cookie→bearer exchange is a same-origin mechanism and a cross-origin
+ * page has no business asking for it.
+ */
+exports.CORS_ALLOWED_HEADERS = 'authorization, content-type, range, if-range, if-none-match, cache-control, trpc-accept, x-trpc-source, x-trpc-batch-mode';
+/**
+ * Response headers a cross-origin script may read. The byte-range trio is
+ * recorded playback (a seek reads `content-range`); `content-disposition` is
+ * export downloads; `retry-after` is the rate limiter; the `x-camstack-*`
+ * trio is the clip-still contract (a 204 that says WHY there is no image).
+ */
+exports.CORS_EXPOSED_HEADERS = 'content-range, accept-ranges, content-length, content-disposition, etag, retry-after, x-camstack-reason, x-camstack-reason-code, x-camstack-disposition';
+/** Preflight cache. Chromium caps at 7200 s; Firefox honours up to 86400. */
+exports.CORS_PREFLIGHT_MAX_AGE_SEC = 7200;
+/**
+ * The canonical serialisation of an origin (`scheme://host[:port]`, lower
+ * case, default port dropped), or `null` when `raw` is not an http(s) origin.
+ * `null` (the opaque origin) is accepted verbatim.
+ */
+function normalizeOrigin(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === exports.OPAQUE_ORIGIN)
+        return exports.OPAQUE_ORIGIN;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return null;
+    // An origin has no path, query, fragment or credentials. Accept a bare
+    // trailing slash (a common paste), refuse anything that names more.
+    if (url.username !== '' || url.password !== '')
+        return null;
+    if ((url.pathname !== '/' && url.pathname !== '') || url.search !== '' || url.hash !== '') {
+        return null;
+    }
+    return url.origin;
+}
+/** Read the configured value (array from YAML, already split from env). */
+function parseConfiguredOrigins(value) {
+    if (!Array.isArray(value))
+        return { origins: [], rejected: [] };
+    const origins = [];
+    const rejected = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string') {
+            rejected.push(String(entry));
+            continue;
+        }
+        const normalized = normalizeOrigin(entry);
+        if (normalized === null)
+            rejected.push(entry);
+        else
+            origins.push(normalized);
+    }
+    return { origins, rejected };
+}
+/** The built-in entries plus the optional public origin. */
+function builtInOrigins(publicOrigin) {
+    const entries = [exports.VIEWER_PWA_ORIGIN, exports.OPAQUE_ORIGIN];
+    const pub = publicOrigin !== undefined ? normalizeOrigin(publicOrigin) : null;
+    if (pub !== null && pub !== exports.OPAQUE_ORIGIN)
+        entries.push(pub);
+    return entries;
+}
+/** The first value of a possibly comma-joined forwarding header, lower case. */
+function firstHost(value) {
+    if (value === undefined)
+        return null;
+    const first = value.split(',')[0]?.trim().toLowerCase() ?? '';
+    return first.length > 0 ? first : null;
+}
+/** `host[:port]` of an http(s) origin, or null. */
+function hostOfOrigin(origin) {
+    if (origin === exports.OPAQUE_ORIGIN)
+        return null;
+    try {
+        return new URL(origin).host.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Judge one request's `Origin`. `listed` is the full allowlist (built-ins and
+ * the operator's extras), already normalised.
+ */
+function judgeCorsOrigin(facts, listed) {
+    const raw = facts.origin;
+    if (raw === undefined || raw.length === 0)
+        return { kind: 'no-origin' };
+    const normalized = normalizeOrigin(raw);
+    if (normalized === null)
+        return { kind: 'denied', origin: raw };
+    if (listed.has(normalized))
+        return { kind: 'allowed', origin: raw, reason: 'listed' };
+    const originHost = hostOfOrigin(normalized);
+    if (originHost !== null) {
+        const ownHosts = [firstHost(facts.host), firstHost(facts.forwardedHost)];
+        if (ownHosts.includes(originHost))
+            return { kind: 'allowed', origin: raw, reason: 'own-host' };
+    }
+    return { kind: 'denied', origin: raw };
+}
+/**
+ * The headers an ALLOWED origin gets. `preflight` adds the method/header
+ * grants and the cache lifetime. The origin is the exact one the browser
+ * sent — reflecting it is what lets the browser hand the response to the
+ * page, and `Vary: Origin` (set by the glue on every response) keeps a cache
+ * from serving one origin's answer to another.
+ */
+function corsResponseHeaders(origin, preflight) {
+    const base = {
+        'access-control-allow-origin': origin,
+        'access-control-expose-headers': exports.CORS_EXPOSED_HEADERS,
+    };
+    if (preflight === null)
+        return base;
+    return {
+        ...base,
+        'access-control-allow-methods': exports.CORS_ALLOWED_METHODS,
+        'access-control-allow-headers': exports.CORS_ALLOWED_HEADERS,
+        'access-control-max-age': String(exports.CORS_PREFLIGHT_MAX_AGE_SEC),
+        // A public origin (the PWA) calling a LAN hub is a "private network"
+        // request to Chromium; its preflight must be answered explicitly.
+        ...(preflight.requestPrivateNetwork ? { 'access-control-allow-private-network': 'true' } : {}),
+    };
+}
+/** Append `token` to a `Vary` value unless it is already there. */
+function appendVary(existing, token) {
+    if (existing === undefined || existing.trim().length === 0)
+        return token;
+    const parts = existing.split(',').map((p) => p.trim().toLowerCase());
+    if (parts.includes('*') || parts.includes(token.toLowerCase()))
+        return existing;
+    return `${existing}, ${token}`;
+}

package/dist/api/cors/register-cors-policy.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCorsPolicy = createCorsPolicy;
+exports.registerCorsPolicy = registerCorsPolicy;
+exports.refuseForeignWsUpgrade = refuseForeignWsUpgrade;
+const cors_policy_js_1 = require("./cors-policy.js");
+/** Distinct refused origins remembered for log de-duplication. */
+const MAX_LOGGED_DENIALS = 256;
+function headerValue(value) {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+}
+function varyText(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === 'string').join(', ');
+    return undefined;
+}
+function createCorsPolicy(deps) {
+    const builtIns = (0, cors_policy_js_1.builtInOrigins)(deps.publicOrigin);
+    let lastConfigured = Symbol('unset');
+    let listed = new Set(builtIns);
+    const loggedDenials = new Set();
+    const currentList = () => {
+        const configured = deps.configuredOrigins();
+        if (configured === lastConfigured)
+            return listed;
+        lastConfigured = configured;
+        const parsed = (0, cors_policy_js_1.parseConfiguredOrigins)(configured);
+        if (parsed.rejected.length > 0) {
+            deps.logger.warn('cors: ignored configured origins that are not http(s) origins', {
+                meta: { rejected: parsed.rejected, setting: 'server.corsOrigins' },
+            });
+        }
+        listed = new Set([...builtIns, ...parsed.origins]);
+        return listed;
+    };
+    return {
+        judge(headers) {
+            const verdict = (0, cors_policy_js_1.judgeCorsOrigin)({
+                origin: headerValue(headers.origin),
+                host: headerValue(headers.host),
+                forwardedHost: headerValue(headers['x-forwarded-host']),
+            }, currentList());
+            if (verdict.kind === 'denied' && !loggedDenials.has(verdict.origin)) {
+                if (loggedDenials.size < MAX_LOGGED_DENIALS)
+                    loggedDenials.add(verdict.origin);
+                deps.logger.warn('cors: refused a cross-origin caller not on the allowlist', {
+                    meta: {
+                        origin: verdict.origin,
+                        host: headerValue(headers.host) ?? null,
+                        hint: 'add it to server.corsOrigins (config.yaml) or CAMSTACK_CORS_ORIGINS',
+                    },
+                });
+            }
+            return verdict;
+        },
+    };
+}
+/**
+ * Install the policy on the hub's Fastify instance. Every `OPTIONS` is
+ * answered here with 204 (as before D707) — with grants only for an allowed
+ * origin, so a refused preflight fails in the browser.
+ */
+function registerCorsPolicy(fastify, policy) {
+    fastify.addHook('onRequest', async (request, reply) => {
+        // The answer depends on Origin for every route, so every response says so
+        // — a cached same-origin answer must never be replayed to another origin.
+        const vary = (0, cors_policy_js_1.appendVary)(varyText(reply.getHeader('vary')), 'Origin');
+        reply.header('vary', vary);
+        reply.raw.setHeader('vary', vary);
+        const verdict = policy.judge(request.headers);
+        const isPreflight = request.method === 'OPTIONS' && request.headers['access-control-request-method'] !== undefined;
+        if (verdict.kind === 'allowed') {
+            const headers = (0, cors_policy_js_1.corsResponseHeaders)(verdict.origin, isPreflight
+                ? {
+                    requestPrivateNetwork: headerValue(request.headers['access-control-request-private-network']) === 'true',
+                }
+                : null);
+            for (const [name, value] of Object.entries(headers)) {
+                reply.header(name, value);
+                // Hijacked replies (the data-plane proxy) skip Fastify's header
+                // write; Node merges these into their `writeHead`.
+                reply.raw.setHeader(name, value);
+            }
+        }
+        if (request.method === 'OPTIONS') {
+            return reply.code(204).send();
+        }
+        return undefined;
+    });
+}
+/**
+ * Refuse a WebSocket upgrade whose `Origin` is not on the allowlist. Returns
+ * `true` when it refused (the socket is answered 403 and destroyed); the
+ * caller must then do nothing else with it. A request with no `Origin` (a
+ * Node client, an agent) passes — Origin is the browser's signal, and auth is
+ * the bearer in `connectionParams` either way.
+ */
+function refuseForeignWsUpgrade(policy, headers, socket) {
+    const verdict = policy.judge(headers);
+    if (verdict.kind !== 'denied')
+        return false;
+    socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+    socket.destroy();
+    return true;
+}

package/dist/api/oauth2/private-host.js

@@ -4,7 +4,7 @@
  *
  * Used by `/api/oauth2/authorize` to admit a `redirect_uri` whose host the hub
  * cannot know in advance — a self-hosted Home Assistant at
- * `http://192.168.x.x:8123/auth/external/callback`. Pairing "private host" with
+ * `http://192.168.10.40:8123/auth/external/callback`. Pairing "private host" with
  * "exact path" is what keeps that from being a wildcard prefix: a public host
  * never satisfies it, so the worst an attacker can aim a code at is a machine
  * they already need LAN presence to read.

package/dist/api/trpc/client-ip.js

@@ -101,7 +101,7 @@ function extractUserAgent(req) {
     return null;
 }
 /**
- * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.x.x` → `192.168.x.x`)
+ * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.10.5` → `192.168.10.5`)
  * and any zone id (`fe80::1%en0` → `fe80::1`) so the range checks below
  * see a clean address.
  */
@@ -216,13 +216,13 @@ function isPrivateIpv4(ip) {
     if (a === undefined || b === undefined)
         return false;
     if (a === 10)
-        return true; // 10.x.x.x/8
+        return true; // 10.0.0.0/8
     if (a === 127)
         return true; // 127.0.0.0/8 loopback
     if (a === 172 && b >= 16 && b <= 31)
         return true; // 172.16.0.0/12
     if (a === 192 && b === 168)
-        return true; // 192.168.x.x/16
+        return true; // 192.168.0.0/16
     if (a === 169 && b === 254)
         return true; // 169.254.0.0/16 link-local
     return false;

package/dist/api/trpc/device-config-secret-redaction.js

@@ -347,7 +347,7 @@ function redactConfigEntries(data) {
  *
  * The stream surfaces (`cameraStreams.getRtspEntries`,
  * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
- * non-admin caller `rtsp://admin:hunter2@192.168.x.x/…` verbatim: a
+ * non-admin caller `rtsp://admin:hunter2@192.168.10.139/…` verbatim: a
  * read-only token can open every camera by copy-pasting the string. These
  * are NOT config blobs, so {@link redactRecord} never sees them — the leak
  * lives in a plain `url` / `mutedUrl` string field.

package/dist/auth/session-mint.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionDirectoryUnavailableError = exports.SessionUserGoneError = void 0;
+exports.createSessionMinter = createSessionMinter;
+/** The user a credential names is not in `user-management` (deleted, or never existed). */
+class SessionUserGoneError extends Error {
+    userId;
+    constructor(userId) {
+        super('User no longer exists');
+        this.userId = userId;
+        this.name = 'SessionUserGoneError';
+    }
+}
+exports.SessionUserGoneError = SessionUserGoneError;
+/** `user-management` is not registered: an infrastructure failure, never a 401. */
+class SessionDirectoryUnavailableError extends Error {
+    constructor() {
+        super('Login unavailable — `user-management` capability not registered');
+        this.name = 'SessionDirectoryUnavailableError';
+    }
+}
+exports.SessionDirectoryUnavailableError = SessionDirectoryUnavailableError;
+function createSessionMinter(deps) {
+    const findUserOrNull = async (userId) => {
+        const directory = deps.directory();
+        if (!directory)
+            throw new SessionDirectoryUnavailableError();
+        if (typeof directory.listUsers !== 'function')
+            return null;
+        return (await directory.listUsers()).find((u) => u.id === userId) ?? null;
+    };
+    const findUser = async (userId) => {
+        const record = await findUserOrNull(userId);
+        if (record === null)
+            throw new SessionUserGoneError(userId);
+        return record;
+    };
+    const mintForRecord = (record) => ({
+        token: deps.signer.signToken({
+            userId: record.id,
+            username: record.username,
+            isAdmin: record.isAdmin,
+            allowedProviders: record.allowedProviders ?? '*',
+            allowedDevices: record.allowedDevices ?? {},
+            scopes: record.scopes ?? [],
+        }),
+        user: { id: record.id, username: record.username, isAdmin: record.isAdmin },
+        requiresTotp: false,
+    });
+    return {
+        findUser,
+        findUserOrNull,
+        mintForRecord,
+        mintForUserId: async (userId) => mintForRecord(await findUser(userId)),
+        mintForFederatedIdentity: (identity) => mintForRecord({
+            id: identity.userId,
+            username: identity.username,
+            isAdmin: identity.isAdmin,
+            allowedProviders: '*',
+            allowedDevices: {},
+            scopes: [],
+        }),
+    };
+}

package/dist/auth/sso-finish.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_FEDERATED_USER_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.isLoginBridge = isLoginBridge;
+exports.finishSsoLogin = finishSsoLogin;
+const session_mint_js_1 = require("./session-mint.js");
+/** The magic-link addon's bridge `provider`. */
+exports.MAGIC_LINK_BRIDGE_PROVIDER = 'auth-magic-link';
+/** `auth-oidc` signs `auth-oidc/<instance>`. */
+exports.OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
+/** `auth-oidc` names a federated identity `oidc:<instance>:<sub>`. */
+exports.OIDC_FEDERATED_USER_PREFIX = 'oidc:';
+function isOidcBridge(claims) {
+    return (claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX) &&
+        claims.userId.startsWith(exports.OIDC_FEDERATED_USER_PREFIX));
+}
+/** Whether `claims` is a LOGIN bridge — the only kind this endpoint swaps. */
+function isLoginBridge(claims) {
+    return claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER || isOidcBridge(claims);
+}
+/** A record wins; only an OIDC identity may stand without one. */
+async function mintForBridge(claims, minter) {
+    const record = await minter.findUserOrNull(claims.userId);
+    if (record !== null)
+        return minter.mintForRecord(record);
+    if (!isOidcBridge(claims))
+        throw new session_mint_js_1.SessionUserGoneError(claims.userId);
+    return minter.mintForFederatedIdentity({
+        userId: claims.userId,
+        username: claims.username,
+        isAdmin: claims.isAdmin,
+    });
+}
+function unauthorized(error) {
+    return { kind: 'error', status: 401, body: { error } };
+}
+async function finishSsoLogin(bridge, deps) {
+    if (!bridge)
+        return { kind: 'error', status: 400, body: { error: 'Missing bridge token' } };
+    const claims = deps.verifyBridge(bridge);
+    if (!claims)
+        return unauthorized('Invalid or expired bridge token');
+    if (!isLoginBridge(claims))
+        return unauthorized('Not a login bridge token');
+    try {
+        const session = await mintForBridge(claims, deps.minter);
+        // The token rides in the URL FRAGMENT: it never reaches a server log and
+        // is not resent on later requests; the SPA's auth-context reads it on mount.
+        return {
+            kind: 'redirect',
+            location: `/admin/login#token=${encodeURIComponent(session.token)}&provider=${encodeURIComponent(claims.provider)}`,
+        };
+    }
+    catch (error) {
+        if (error instanceof session_mint_js_1.SessionUserGoneError)
+            return unauthorized('User no longer exists');
+        return {
+            kind: 'error',
+            status: 500,
+            body: {
+                error: 'SSO finish failed',
+                message: error instanceof Error ? error.message : String(error),
+            },
+        };
+    }
+}

package/dist/boot/boot-config.js

@@ -66,9 +66,6 @@ const ENV_VAR_MAP = {
     CAMSTACK_JWT_SECRET: 'auth.jwtSecret',
     CAMSTACK_ADMIN_USER: 'auth.adminUsername',
     CAMSTACK_ADMIN_PASS: 'auth.adminPassword',
-    CAMSTACK_HUB_URL: 'hub.url',
-    CAMSTACK_HUB_TOKEN: 'hub.token',
-    CAMSTACK_AGENT_NAME: 'agent.name',
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
     CAMSTACK_TLS_CERT: 'tls.certPath',
     CAMSTACK_TLS_KEY: 'tls.keyPath',

package/dist/boot/public-url.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * The hub's public URL — ONE environment variable, resolved once at boot.
+ *
+ * Two names used to answer the same question ("at which address do clients
+ * reach this hub?"): `CAMSTACK_HUB_PUBLIC_URL` (addon bundle and model
+ * distribution, notification links, the Dreame RFC host) and
+ * `CAMSTACK_PUBLIC_ORIGIN` (magic-link, OIDC callback, WebAuthn relying party,
+ * the OAuth2 issuer and the CORS allowlist, D707). An operator who set one got
+ * half a configured hub and no line saying so.
+ *
+ * `CAMSTACK_HUB_PUBLIC_URL` is the survivor. `CAMSTACK_PUBLIC_ORIGIN` is still
+ * accepted, for hubs that already set it, and costs a WARN on every boot until
+ * it is renamed. The resolution writes the survivor back into `process.env`
+ * and deletes the retired name, so every forked addon runner — which inherits
+ * this process's environment — reads exactly one variable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RETIRED_PUBLIC_ORIGIN_ENV = exports.HUB_PUBLIC_URL_ENV = void 0;
+exports.resolveHubPublicUrl = resolveHubPublicUrl;
+exports.applyHubPublicUrl = applyHubPublicUrl;
+/** The single public-URL variable every reader uses. */
+exports.HUB_PUBLIC_URL_ENV = 'CAMSTACK_HUB_PUBLIC_URL';
+/** Retired alias, accepted with a deprecation warning. */
+exports.RETIRED_PUBLIC_ORIGIN_ENV = 'CAMSTACK_PUBLIC_ORIGIN';
+function readTrimmed(env, name) {
+    const raw = env[name]?.trim();
+    if (raw === undefined || raw === '')
+        return undefined;
+    return raw.replace(/\/+$/, '');
+}
+/** Pure: which URL wins, and what to warn about. */
+function resolveHubPublicUrl(env) {
+    const current = readTrimmed(env, exports.HUB_PUBLIC_URL_ENV);
+    const retired = readTrimmed(env, exports.RETIRED_PUBLIC_ORIGIN_ENV);
+    if (retired === undefined)
+        return { url: current, warning: undefined };
+    if (current === undefined) {
+        return {
+            url: retired,
+            warning: `${exports.RETIRED_PUBLIC_ORIGIN_ENV} is deprecated and was read as ${exports.HUB_PUBLIC_URL_ENV}=${retired}. ` +
+                `Rename it to ${exports.HUB_PUBLIC_URL_ENV}; the old name will stop being read in a future release.`,
+        };
+    }
+    const disagree = current !== retired;
+    return {
+        url: current,
+        warning: `${exports.RETIRED_PUBLIC_ORIGIN_ENV} is deprecated and IGNORED because ${exports.HUB_PUBLIC_URL_ENV} is set` +
+            (disagree ? ` (${current} wins over ${retired})` : '') +
+            `. Remove ${exports.RETIRED_PUBLIC_ORIGIN_ENV} from this container.`,
+    };
+}
+/**
+ * Apply the resolution to a process environment: the survivor is set (or left
+ * unset), the retired name is removed. Returns the warning to log once a
+ * logger exists. Called once, first thing in the hub's bootstrap, before any
+ * addon runner is forked.
+ */
+function applyHubPublicUrl(env) {
+    const { url, warning } = resolveHubPublicUrl(env);
+    if (url === undefined)
+        delete env[exports.HUB_PUBLIC_URL_ENV];
+    else
+        env[exports.HUB_PUBLIC_URL_ENV] = url;
+    delete env[exports.RETIRED_PUBLIC_ORIGIN_ENV];
+    return warning;
+}

package/dist/main.js

@@ -59,42 +59,46 @@ const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
 const backup_download_js_1 = require("./api/backup-download.js");
-const health_routes_1 = require("./api/health/health.routes");
-const auth_rate_limit_1 = require("./auth/auth-rate-limit");
+const cap_providers_1 = require("./api/core/cap-providers");
+const logging_settings_1 = require("./api/core/logging-settings");
+const request_census_settings_1 = require("./api/core/request-census-settings");
+const register_cors_policy_1 = require("./api/cors/register-cors-policy");
 const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
+const health_routes_1 = require("./api/health/health.routes");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
 const server_upload_1 = require("./api/server-upload");
 const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
+const frame_policy_1 = require("./api/static/frame-policy");
 const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
-const spa_static_1 = require("./api/static/spa-static");
 const spa_mount_1 = require("./api/static/spa-mount");
-const frame_policy_1 = require("./api/static/frame-policy");
-const cap_providers_1 = require("./api/core/cap-providers");
-const logging_settings_1 = require("./api/core/logging-settings");
-const request_census_settings_1 = require("./api/core/request-census-settings");
+const spa_static_1 = require("./api/static/spa-static");
 const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
-const http_request_census_hook_1 = require("./api/trpc/http-request-census-hook");
 const http_request_census_singleton_1 = require("./api/trpc/http-request-census.singleton");
+const http_request_census_hook_1 = require("./api/trpc/http-request-census-hook");
 const trpc_context_1 = require("./api/trpc/trpc.context");
 const trpc_router_1 = require("./api/trpc/trpc.router");
-const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
 const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
+const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
 const ws_request_census_1 = require("./api/trpc/ws-request-census");
 const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
+const auth_rate_limit_1 = require("./auth/auth-rate-limit");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
+const session_mint_js_1 = require("./auth/session-mint.js");
+const sso_finish_js_1 = require("./auth/sso-finish.js");
 const boot_config_1 = require("./boot/boot-config");
+const public_url_1 = require("./boot/public-url");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
 const addon_package_service_1 = require("./core/addon/addon-package.service");
-const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const addon_registry_service_1 = require("./core/addon/addon-registry.service");
 const addon_bridge_service_1 = require("./core/addon-bridge/addon-bridge.service");
 const addon_pages_service_1 = require("./core/addon-pages/addon-pages.service");
 const addon_widgets_service_1 = require("./core/addon-widgets/addon-widgets.service");
 const agent_registry_service_1 = require("./core/agent/agent-registry.service");
+const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const auth_service_1 = require("./core/auth/auth.service");
 const handoff_code_service_1 = require("./core/auth/handoff-code.service");
 const share_token_service_1 = require("./core/auth/share-token.service");
@@ -237,6 +241,11 @@ async function sendMaybePrecompressed(reply, absolutePath, acceptEncoding) {
 }
 // ---- Bootstrap ----
 async function bootstrap() {
+    // ONE public-URL variable (CAMSTACK_HUB_PUBLIC_URL). The retired
+    // CAMSTACK_PUBLIC_ORIGIN is folded into it here — before any addon runner is
+    // forked, so every child inherits one name — and warned about once a logger
+    // exists (below). See `boot/public-url.ts`.
+    const publicUrlWarning = (0, public_url_1.applyHubPublicUrl)(process.env);
     // hub-main's own memory, on the record. Deliberately started HERE and not in
     // the starter: the starter runs from the image's /opt closure, which only
     // changes with a new image, while this entry is what `applyServerUpdate`
@@ -279,10 +288,8 @@ async function bootstrap() {
     // watch is the slope — 181-330MB/min steady, one burst of >=1.3GB in <=11s —
     // and the traffic behind it is ~22 000 socket reads/s and ~22 500 writes/s at
     // a 0.33KB mean. `LocalChildRegistry` has counted that per child since the
-    // fan-out gate was built and NOTHING has ever read it; `getMoleculerEventStats`
-    // likewise, while the hub runs `CAMSTACK_MOLECULER_EVENT_FANOUT=shadow` — a
-    // burn-in with no end condition, because the evidence that would authorise the
-    // flip to `filter` was never surfaced. This surfaces it and changes no default.
+    // fan-out gate was built and NOTHING had ever read it; `getMoleculerEventStats`
+    // likewise. This surfaces both.
     //
     // Every source is read LAZILY: this runs as the first statement of bootstrap()
     // and `MoleculerService` does not exist for hundreds of lines. Until it does,
@@ -296,7 +303,6 @@ async function bootstrap() {
                 const broker = moleculerForEventPlane?.broker;
                 return broker === undefined ? null : (0, system_1.getMoleculerEventStats)(broker);
             },
-            crossNodeMode: () => (0, system_1.readMoleculerFanoutMode)(),
         }),
         // The fan-out counters above answered their own question and sharpened
         // this one: the event plane is 4% of this process's ~44 000 socket
@@ -347,8 +353,21 @@ async function bootstrap() {
     const fastifyOpts = tlsOptions ? { https: tlsOptions } : {};
     const app = await (0, manual_boot_1.bootManual)({ infra, fastifyOpts });
     app.enableShutdownHooks();
-    app.enableCors();
     const fastify = app.getHttpAdapter().getInstance();
+    // Which browser origins may read hub responses, and open the /trpc socket
+    // (D707): the hub's own, the hosted viewer PWA, the native embed's opaque
+    // `null`, and the operator's `server.corsOrigins`. First hook on the
+    // instance so every route — and every OPTIONS — is judged.
+    if (publicUrlWarning !== undefined) {
+        app.get(logging_service_1.LoggingService).createLogger('public-url').warn(publicUrlWarning);
+    }
+    const corsConfig = app.get(config_service_1.ConfigService);
+    const corsPolicy = (0, register_cors_policy_1.createCorsPolicy)({
+        configuredOrigins: () => corsConfig.get('server.corsOrigins'),
+        publicOrigin: process.env[public_url_1.HUB_PUBLIC_URL_ENV],
+        logger: app.get(logging_service_1.LoggingService).createLogger('cors'),
+    });
+    (0, register_cors_policy_1.registerCorsPolicy)(fastify, corsPolicy);
     await fastify.register(cookie_1.default);
     // Every HTML document the hub serves may be framed by its own origin only
     // (D425). Stamped here, on the one instance, so no shell-send site added
@@ -783,58 +802,25 @@ async function bootstrap() {
             return reply.send(fs.readFileSync(filePath));
         });
         // ── SSO finish endpoint ─────────────────────────────────────────
-        // OIDC / SAML / external auth providers redirect here after their
-        // own callback handler validated the IdP response. We trust the
-        // claims because:
-        //   1. The path is server-internal — providers run in-process and
-        //      issue the redirect with their own validated state.
-        //   2. The query string is consumed once and immediately swapped
-        //      for a JWT in the URL fragment (#token=...) which never hits
-        //      the server logs and isn't replayable.
-        //
-        // The provider prefixes the redirect with `provider=auth-oidc` so
-        // we can attribute the session. The mint is currently best-effort
-        // — a future hardening should require the provider to also pass a
-        // nonce signed with the auth.jwtSecret so we can verify the redirect
-        // came from the addon's own callback handler.
+        // OIDC / magic-link redirect here with an HMAC-signed LOGIN bridge
+        // (`sso-bridge` cap). The bridge says who signed in; the session is
+        // minted by THE session mint from the user record as it is now (D712) —
+        // `auth/sso-finish.ts` holds the rules, this route only maps the reply.
+        const ssoAuth = app.get(auth_service_1.AuthService);
+        const ssoMinter = (0, session_mint_js_1.createSessionMinter)({
+            signer: ssoAuth,
+            directory: () => capabilityRegistry.getSingleton('user-management'),
+        });
         fastify.get('/api/auth/sso/finish', async (request, reply) => {
-            // The auth-provider addon (OIDC, SAML, …) mints an HMAC-signed
-            // bridge token via the `sso-bridge` cap and 302s to here with
-            // `?bridge=<jwt>`. We verify the signature with the same JWT
-            // secret used elsewhere — only then do we trust the claims
-            // (including the `isAdmin` flag). This closes the prior gap
-            // where any client could call `?isAdmin=1` and become admin.
-            const bridge = request.query.bridge;
-            if (!bridge) {
-                return reply.status(400).send({ error: 'Missing bridge token' });
-            }
-            const ssoAuth = app.get(auth_service_1.AuthService);
-            const claims = ssoAuth.verifySsoBridgeToken(bridge);
-            if (!claims) {
-                return reply.status(401).send({ error: 'Invalid or expired bridge token' });
-            }
-            try {
-                const token = ssoAuth.signToken({
-                    userId: claims.userId,
-                    username: claims.username,
-                    isAdmin: claims.isAdmin,
-                    allowedProviders: '*',
-                    allowedDevices: {},
-                });
-                // Redirect to the admin UI with the token in the URL fragment.
-                // Fragments don't hit the server log + don't get sent on
-                // subsequent requests — the SPA's auth-context picks the
-                // token up on mount and stores it in localStorage.
-                reply.code(302);
-                reply.header('Location', `/admin/login#token=${encodeURIComponent(token)}&provider=${encodeURIComponent(claims.provider)}`);
-                return reply.send('');
-            }
-            catch (err) {
-                return reply.status(500).send({
-                    error: 'SSO finish failed',
-                    message: err instanceof Error ? err.message : String(err),
-                });
-            }
+            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, {
+                verifyBridge: (token) => ssoAuth.verifySsoBridgeToken(token),
+                minter: ssoMinter,
+            });
+            if (outcome.kind === 'error')
+                return reply.status(outcome.status).send(outcome.body);
+            reply.code(302);
+            reply.header('Location', outcome.location);
+            return reply.send('');
         });
         // ── Backup archive download ─────────────────────────────────────
         // Streams an archive through the storage cap's chunked-download
@@ -1130,7 +1116,7 @@ async function bootstrap() {
         (0, oauth2_routes_js_1.registerOauth2Routes)(fastify, {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
-            publicHubUrl: () => process.env.CAMSTACK_PUBLIC_ORIGIN ?? `https://localhost:${port}`,
+            publicHubUrl: () => process.env[public_url_1.HUB_PUBLIC_URL_ENV] ?? `https://localhost:${port}`,
             // Every /authorize refusal is a dropped account-linking attempt. Without
             // this scope the drop is invisible in Loki and the only signal left is an
             // operator noticing that linking stopped working.
@@ -1239,6 +1225,9 @@ async function bootstrap() {
         httpServer.on('upgrade', (request, socket, head) => {
             const pathname = (request.url ?? '').split('?')[0];
             if (pathname === '/trpc') {
+                // CORS does not cover a WebSocket: refuse a foreign page here (D707).
+                if ((0, register_cors_policy_1.refuseForeignWsUpgrade)(corsPolicy, request.headers, socket))
+                    return;
                 wss.handleUpgrade(request, socket, head, (ws) => {
                     wss.emit('connection', ws, request);
                 });
@@ -1411,8 +1400,7 @@ async function bootstrap() {
             // node's registration must never win the election for the provider
             // whose staticDir this process reads from local disk.
             let viewerUI = capRegistry?.getSingletonForNode('viewer-ui', 'hub');
-            const skipViewerUIWait = process.env['CAMSTACK_SKIP_VIEWER_UI_WAIT'] === '1';
-            if (!viewerUI && capRegistry && !skipViewerUIWait) {
+            if (!viewerUI && capRegistry) {
                 // The viewer-ui addon runs in its own forked runner and registers a few
                 // seconds after boot. Poll briefly (shorter than admin-ui's 60s — the
                 // viewer is non-critical and admin-ui already gated the slow cold boot).

package/dist/manual-boot.js

@@ -394,16 +394,6 @@ async function bootManual(opts) {
         getHttpAdapter() {
             return { getInstance: () => fastify };
         },
-        enableCors() {
-            fastify.addHook('onRequest', async (request, reply) => {
-                reply.header('access-control-allow-origin', '*');
-                reply.header('access-control-allow-methods', 'GET,POST,PUT,DELETE,OPTIONS,PATCH');
-                reply.header('access-control-allow-headers', 'content-type,authorization');
-                if (request.method === 'OPTIONS') {
-                    reply.status(204).send();
-                }
-            });
-        },
         enableShutdownHooks() {
             if (shutdownHooksRegistered)
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.455",
+  "version": "1.2.457",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.329",
-    "@camstack/addon-agent-ui": "1.2.173",
-    "@camstack/addon-auth": "1.2.126",
+    "@camstack/addon-admin-ui": "1.2.331",
+    "@camstack/addon-agent-ui": "1.2.175",
+    "@camstack/addon-auth": "1.2.127",
     "@camstack/addon-decoder-nodeav": "1.2.119",
-    "@camstack/addon-notifiers": "1.2.127",
-    "@camstack/addon-pipeline": "1.2.326",
-    "@camstack/addon-pipeline-orchestrator": "1.2.280",
-    "@camstack/addon-post-analysis": "1.2.332",
-    "@camstack/sdk": "1.2.120",
-    "@camstack/system": "1.2.353",
-    "@camstack/types": "1.2.304",
-    "@camstack/ui-library": "1.2.231",
+    "@camstack/addon-notifiers": "1.2.128",
+    "@camstack/addon-pipeline": "1.2.328",
+    "@camstack/addon-pipeline-orchestrator": "1.2.282",
+    "@camstack/addon-post-analysis": "1.2.334",
+    "@camstack/sdk": "1.2.121",
+    "@camstack/system": "1.2.355",
+    "@camstack/types": "1.2.306",
+    "@camstack/ui-library": "1.2.233",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",