@camstack/server 1.2.456 → 1.2.457

package/THIRD_PARTY_MODELS.md

@@ -36,7 +36,7 @@ under [Non-commercial models](#non-commercial-models).
 - RF-DETR © Roboflow, Apache-2.0. https://github.com/roboflow/rf-detr
 - YuNet weights Copyright (c) 2020 Shiqi Yu, MIT. Training code: ShiqiYu/libfacedetection.train, BSD-3-Clause. https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet
 - AuraFace v1 by fal.ai, Apache-2.0. https://huggingface.co/fal/AuraFace-v1
-- © Ultralytics, AGPL-3.0 (YOLOv8n base, fine-tuned for plates by an unidentified third party). CamStack holds no training checkpoint; the ONNX file is the only form it has. https://github.com/ultralytics/ultralytics
+- open-lpr models, Copyright the open-lpr contributors, Apache-2.0 (https://huggingface.co/faisalthaheem/open-lpr-models, tag detector-2026.10.1). YOLOX architecture and COCO pretraining by Megvii (https://github.com/Megvii-BaseDetection/YOLOX), Apache-2.0. The upstream NOTICE is reproduced verbatim (`NOTICE-open-lpr.txt`). https://huggingface.co/faisalthaheem/open-lpr-models
 - fast-plate-ocr, MIT License, copyright (c) 2024 ankandrew (full notice: licenses/models/MIT-fast-plate-ocr.txt). https://github.com/ankandrew/fast-plate-ocr
 - EfficientNet-Lite0 via timm (Ross Wightman), Apache-2.0. Open Images V7 annotations © Google LLC, CC BY 4.0; images listed by Google as CC BY 2.0, without warranty. https://github.com/huggingface/pytorch-image-models
 - torchvision MobileNetV3, BSD-3-Clause. Trained on the Vehicle classification dataset by DrBimmer (https://huggingface.co/datasets/DrBimmer/vehicle-classification), CC BY-NC 4.0. https://github.com/pytorch/vision
@@ -62,34 +62,42 @@ Training data under attribution terms:
   cards link here instead of repeating it.
 -->
 
-The folders `objectDetection/yolo26`, `objectDetection/yolov9`, `plateDetection/yolov8-plate` and `segmentation/yolo26-seg` of the model mirror hold Ultralytics weights,
+The folders `objectDetection/yolo26`, `objectDetection/yolov9` and `segmentation/yolo26-seg` of the model mirror hold Ultralytics weights,
 modified by CamStack and distributed under AGPL-3.0. Their Corresponding Source
 is published in the mirror itself, in its **`source/`** folder,
 **https://huggingface.co/camstack/camstack-models/tree/main/source**, together
 with the upstream checkpoints it starts from:
 
-1. **The upstream checkpoints**, published by Ultralytics at
-   https://github.com/ultralytics/assets/releases: `yolo26{n,s,m,l,x}.pt`,
-   `yolov9{t,s,m,c}.pt`, `yolo26{n,s,m}-seg.pt`.
-2. **The export scripts** in `source/`: `build-camstack-models.py` (ONNX
-   with a dynamic batch axis, CoreML FP16, OpenVINO IR, OpenVINO NNCF INT8),
-   `convert_lib.py` (the ONNX to OpenVINO / INT8 / CoreML converter it imports,
-   the same one CamStack's Model Studio runs), `requirements.txt` and
-   `export-models.py`. The build instructions (Python environment,
-   invocation, calibration images for INT8) are in `source/README.md` and in
-   each script's header. These scripts are CamStack's own code and are offered
-   under the MIT licence; the weights they produce keep their upstream licence.
-
-What the published scripts do **not** cover yet:
-
-- **Some hosted sizes and input resolutions.** The export scripts do not list
-  every variant in the mirror (for example the `-320`/`-256` YOLO26 exports,
-  `yolov9m`/`yolov9c`, and the `yolo26*-seg` models). Each one is the same
-  Ultralytics `export()` with a different model id or `imgsz`, but no
-  published script reproduces it as-is.
-- **`yolov8n-plate` has no training checkpoint.** It is a third-party model
-  (trained 2023-12-05 according to its own metadata, origin not identified).
-  The ONNX file is the only form CamStack has.
+1. **The upstream checkpoints.** Ultralytics publishes
+   `yolo26{n,s,m,l,x}.pt`, `yolov9{t,s,m,c}.pt` and `yolo26{n,s,m}-seg.pt` at
+   https://github.com/ultralytics/assets/releases.
+2. **The build script** in `source/`: `build-camstack-models.py`, with
+   `convert_lib.py` (the ONNX to OpenVINO / INT8 converter it calls, the same
+   file CamStack's Model Studio runs) and `requirements.txt`. It holds one
+   recipe per hosted file: the upstream checkpoint, the input size, the
+   Ultralytics `export()` arguments, the OpenVINO precision and the INT8
+   calibration count that file records about itself. Every hosted
+   Ultralytics-derived file is rebuilt by one invocation:
+   `build-camstack-models.py --variant <file stem>` (for example
+   `camstack-yolo26n-320` or `camstack-yolov9m-640`), `--family <folder>`
+   or `--all`; `--list` prints the recipes and `--check-hosted` confirms
+   against the mirror that every hosted file is a recipe output. The INT8
+   builds are NNCF post-training quantisation calibrated on COCO images: 128
+   for YOLO26, 300 for YOLOv9, as each IR records; the documented set is the
+   first N of COCO val2017 in file-name order. The Python
+   environment, the recorded tool versions and the calibration set are in
+   `source/README.md` and the script's header. These scripts are CamStack's
+   own code and are offered under the MIT licence; the weights they produce
+   keep their upstream licence.
+
+Limits of a rebuild:
+
+- **Tool versions.** With the Ultralytics, PyTorch, coremltools and OpenVINO
+  versions each recipe names, a rebuild reproduces the hosted weights. Other
+  versions give the same weights in a possibly different graph.
+- **INT8 calibration.** An IR records how many images calibrated it, not
+  which ones. Calibrating on the same COCO images gives the documented build;
+  a different set gives an equivalent, not bit-identical, INT8 model.
 
 ## Non-commercial models
 
@@ -138,7 +146,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yolov8n-plate` (default) | [Ultralytics](https://github.com/ultralytics/ultralytics) | AGPL-3.0 / AGPL-3.0 (`AGPL-3.0.txt`) | unidentified plate dataset (third-party model, trained 2023-12-05 per its ONNX metadata): UNKNOWN | converted to OpenVINO IR and CoreML | mirror `plateDetection/yolov8-plate` |
+| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py) | mirror `plateDetection/yolox-tiny-plate` |
 
 ### Licence plate reading
 
@@ -156,7 +164,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `bird-classifier` (default) | [Google AIY Vision birds_V1](https://github.com/google-coral/test_data) | — / Apache-2.0 (`Apache-2.0.txt`) | — | converted from TensorFlow with tf2onnx; OpenVINO IR and CoreML derived from it | mirror `animalClassification/bird-classifier` |
+| `bird-classifier` (default) | [Google AIY Vision birds_V1](https://github.com/google-coral/test_data) | — / Apache-2.0 (`Apache-2.0.txt`) | — | converted from TensorFlow with tf2onnx; OpenVINO IR and CoreML derived from it; the Edge TPU build is the Google full-integer quantised TFLite of the same model, compiled with edgetpu_compiler 14 (scripts/build-bird-classifier-edgetpu.py) | mirror `animalClassification/bird-classifier` |
 
 ### Vehicle classifier
 

package/dist/agent/agent-config.js

@@ -81,7 +81,7 @@ function ensurePersistedNodeId(configPath, dataDir) {
     return id;
 }
 function loadAgentConfig(configPath, dataDirOverride) {
-    const filePath = configPath ?? process.env.CAMSTACK_AGENT_CONFIG ?? 'agent.json';
+    const filePath = configPath ?? 'agent.json';
     const dataDir = dataDirOverride ?? process.env.CAMSTACK_DATA ?? './camstack-data';
     const resolvedDataDir = path.resolve(dataDir);
     // Name: config file takes priority over env (allows UI rename to stick).

package/dist/agent/main.js

@@ -721,8 +721,7 @@ async function startAgent(configPath) {
         // agent drops hub-origin categories no local subscriber cares about instead
         // of fanning every category into its bus. Read per-event, so a child
         // (un)subscribing takes effect immediately. Fails OPEN when a child is
-        // undeclared (aggregateEventInterest → null). Gated by
-        // CAMSTACK_MOLECULER_EVENT_FANOUT (filter|shadow|broadcast).
+        // undeclared (aggregateEventInterest → null).
         const interestRegistry = agentUdsRegistry;
         (0, system_1.setNodeEventInterest)(broker, () => interestRegistry.aggregateEventInterest());
         // D1: answer readiness-snapshot requests from UDS children over the

package/dist/api/core/auth.router.js

@@ -22,6 +22,7 @@ const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
 const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const session_mint_js_1 = require("../../auth/session-mint.js");
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
 const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
@@ -331,46 +332,18 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         return shareTokens;
     };
     /**
-     * Mint the REAL session JWT for `userId` — the single shared tail of
-     * every successful login leg (TOTP second factor, passkey second
-     * factor, usernameless passkey-first). Re-fetches the user record so
-     * scopes / allowedDevices reflect any admin change made mid-flow —
-     * signing from stale claims could mint a stale-scope session.
+     * THE session mint (`auth/session-mint.ts`, D712) — the single shared tail
+     * of every successful login leg, including `/api/auth/sso/finish`. It
+     * re-reads the user record so scopes / allowedDevices / isAdmin reflect any
+     * admin change made mid-flow; signing from stale claims could mint a
+     * stale-scope session.
      */
-    /**
-     * Fresh user record for `userId` via `user-management` — shared by the
-     * session-mint tail and the second-factor challenge legs (both need
-     * live identity claims, never stale ones).
-     */
-    const findUserById = async (userId) => {
-        const userMgmt = registry?.getSingleton('user-management');
-        if (!userMgmt) {
-            throw new Error('Login unavailable — `user-management` capability not registered');
-        }
-        const fresh = typeof userMgmt.listUsers === 'function'
-            ? (await userMgmt.listUsers()).find((u) => u.id === userId)
-            : null;
-        if (!fresh) {
-            throw new Error('User no longer exists');
-        }
-        return fresh;
-    };
-    const mintSessionForUserId = async (userId) => {
-        const fresh = await findUserById(userId);
-        const sessionToken = auth.signToken({
-            userId: fresh.id,
-            username: fresh.username,
-            isAdmin: fresh.isAdmin,
-            allowedProviders: fresh.allowedProviders ?? '*',
-            allowedDevices: fresh.allowedDevices ?? {},
-            scopes: fresh.scopes ?? [],
-        });
-        return {
-            token: sessionToken,
-            user: { id: fresh.id, username: fresh.username, isAdmin: fresh.isAdmin },
-            requiresTotp: false,
-        };
-    };
+    const minter = (0, session_mint_js_1.createSessionMinter)({
+        signer: auth,
+        directory: () => registry?.getSingleton('user-management'),
+    });
+    const findUserById = minter.findUser;
+    const mintSessionForUserId = minter.mintForUserId;
     /**
      * `mintSessionForUserId` with the "user vanished" failure mapped to a
      * clean 401 — for the token-exchange legs (`exchangeSession`,
@@ -383,7 +356,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return await mintSessionForUserId(userId);
         }
         catch (error) {
-            if (error instanceof Error && error.message === 'User no longer exists') {
+            if (error instanceof session_mint_js_1.SessionUserGoneError) {
                 throw new server_1.TRPCError({ code: 'UNAUTHORIZED', message: 'User no longer exists' });
             }
             throw error;
@@ -469,26 +442,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     secondFactors,
                 };
             }
-            // Snapshot `scopes` into the JWT payload. Admins ignore the
-            // field (middleware bypass); for non-admins this drives the
-            // entire scope-access check until the user logs out + back in.
-            // setUserScopes mutations take effect on next login — old JWTs
-            // carry the snapshot from issue time. This is the standard JWT
-            // staleness tradeoff; if you need immediate revocation, force a
-            // logout from the admin UI.
-            const token = auth.signToken({
-                userId: user.id,
-                username: user.username,
-                isAdmin: user.isAdmin,
-                allowedProviders: user.allowedProviders ?? '*',
-                allowedDevices: user.allowedDevices ?? {},
-                scopes: user.scopes ?? [],
-            });
-            return {
-                token,
-                user: { id: user.id, username: user.username, isAdmin: user.isAdmin },
-                requiresTotp: false,
-            };
+            // `user` is the record `validateCredentials` just read — fresh.
+            return minter.mintForRecord(user);
         }),
         /**
          * Second leg of the 2FA login. Accepts the challenge token minted

package/dist/api/cors/cors-policy.js

@@ -18,7 +18,7 @@
  *  - {@link OPAQUE_ORIGIN} (`null`): the native app's OTA-bundled embed is a
  *    `file://` page inside a WKWebView, whose origin is opaque. Removing it
  *    breaks live view on iOS;
- *  - `CAMSTACK_PUBLIC_ORIGIN`, when set, and the operator's extras
+ *  - `CAMSTACK_HUB_PUBLIC_URL`, when set, and the operator's extras
  *    (`server.corsOrigins` in config.yaml / `CAMSTACK_CORS_ORIGINS`).
  *
  * The answer to an allowed origin REFLECTS it exactly — never `*` — and never

package/dist/auth/session-mint.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionDirectoryUnavailableError = exports.SessionUserGoneError = void 0;
+exports.createSessionMinter = createSessionMinter;
+/** The user a credential names is not in `user-management` (deleted, or never existed). */
+class SessionUserGoneError extends Error {
+    userId;
+    constructor(userId) {
+        super('User no longer exists');
+        this.userId = userId;
+        this.name = 'SessionUserGoneError';
+    }
+}
+exports.SessionUserGoneError = SessionUserGoneError;
+/** `user-management` is not registered: an infrastructure failure, never a 401. */
+class SessionDirectoryUnavailableError extends Error {
+    constructor() {
+        super('Login unavailable — `user-management` capability not registered');
+        this.name = 'SessionDirectoryUnavailableError';
+    }
+}
+exports.SessionDirectoryUnavailableError = SessionDirectoryUnavailableError;
+function createSessionMinter(deps) {
+    const findUserOrNull = async (userId) => {
+        const directory = deps.directory();
+        if (!directory)
+            throw new SessionDirectoryUnavailableError();
+        if (typeof directory.listUsers !== 'function')
+            return null;
+        return (await directory.listUsers()).find((u) => u.id === userId) ?? null;
+    };
+    const findUser = async (userId) => {
+        const record = await findUserOrNull(userId);
+        if (record === null)
+            throw new SessionUserGoneError(userId);
+        return record;
+    };
+    const mintForRecord = (record) => ({
+        token: deps.signer.signToken({
+            userId: record.id,
+            username: record.username,
+            isAdmin: record.isAdmin,
+            allowedProviders: record.allowedProviders ?? '*',
+            allowedDevices: record.allowedDevices ?? {},
+            scopes: record.scopes ?? [],
+        }),
+        user: { id: record.id, username: record.username, isAdmin: record.isAdmin },
+        requiresTotp: false,
+    });
+    return {
+        findUser,
+        findUserOrNull,
+        mintForRecord,
+        mintForUserId: async (userId) => mintForRecord(await findUser(userId)),
+        mintForFederatedIdentity: (identity) => mintForRecord({
+            id: identity.userId,
+            username: identity.username,
+            isAdmin: identity.isAdmin,
+            allowedProviders: '*',
+            allowedDevices: {},
+            scopes: [],
+        }),
+    };
+}

package/dist/auth/sso-finish.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_FEDERATED_USER_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.isLoginBridge = isLoginBridge;
+exports.finishSsoLogin = finishSsoLogin;
+const session_mint_js_1 = require("./session-mint.js");
+/** The magic-link addon's bridge `provider`. */
+exports.MAGIC_LINK_BRIDGE_PROVIDER = 'auth-magic-link';
+/** `auth-oidc` signs `auth-oidc/<instance>`. */
+exports.OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
+/** `auth-oidc` names a federated identity `oidc:<instance>:<sub>`. */
+exports.OIDC_FEDERATED_USER_PREFIX = 'oidc:';
+function isOidcBridge(claims) {
+    return (claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX) &&
+        claims.userId.startsWith(exports.OIDC_FEDERATED_USER_PREFIX));
+}
+/** Whether `claims` is a LOGIN bridge — the only kind this endpoint swaps. */
+function isLoginBridge(claims) {
+    return claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER || isOidcBridge(claims);
+}
+/** A record wins; only an OIDC identity may stand without one. */
+async function mintForBridge(claims, minter) {
+    const record = await minter.findUserOrNull(claims.userId);
+    if (record !== null)
+        return minter.mintForRecord(record);
+    if (!isOidcBridge(claims))
+        throw new session_mint_js_1.SessionUserGoneError(claims.userId);
+    return minter.mintForFederatedIdentity({
+        userId: claims.userId,
+        username: claims.username,
+        isAdmin: claims.isAdmin,
+    });
+}
+function unauthorized(error) {
+    return { kind: 'error', status: 401, body: { error } };
+}
+async function finishSsoLogin(bridge, deps) {
+    if (!bridge)
+        return { kind: 'error', status: 400, body: { error: 'Missing bridge token' } };
+    const claims = deps.verifyBridge(bridge);
+    if (!claims)
+        return unauthorized('Invalid or expired bridge token');
+    if (!isLoginBridge(claims))
+        return unauthorized('Not a login bridge token');
+    try {
+        const session = await mintForBridge(claims, deps.minter);
+        // The token rides in the URL FRAGMENT: it never reaches a server log and
+        // is not resent on later requests; the SPA's auth-context reads it on mount.
+        return {
+            kind: 'redirect',
+            location: `/admin/login#token=${encodeURIComponent(session.token)}&provider=${encodeURIComponent(claims.provider)}`,
+        };
+    }
+    catch (error) {
+        if (error instanceof session_mint_js_1.SessionUserGoneError)
+            return unauthorized('User no longer exists');
+        return {
+            kind: 'error',
+            status: 500,
+            body: {
+                error: 'SSO finish failed',
+                message: error instanceof Error ? error.message : String(error),
+            },
+        };
+    }
+}

package/dist/boot/boot-config.js

@@ -66,9 +66,6 @@ const ENV_VAR_MAP = {
     CAMSTACK_JWT_SECRET: 'auth.jwtSecret',
     CAMSTACK_ADMIN_USER: 'auth.adminUsername',
     CAMSTACK_ADMIN_PASS: 'auth.adminPassword',
-    CAMSTACK_HUB_URL: 'hub.url',
-    CAMSTACK_HUB_TOKEN: 'hub.token',
-    CAMSTACK_AGENT_NAME: 'agent.name',
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
     CAMSTACK_TLS_CERT: 'tls.certPath',
     CAMSTACK_TLS_KEY: 'tls.keyPath',

package/dist/boot/public-url.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * The hub's public URL — ONE environment variable, resolved once at boot.
+ *
+ * Two names used to answer the same question ("at which address do clients
+ * reach this hub?"): `CAMSTACK_HUB_PUBLIC_URL` (addon bundle and model
+ * distribution, notification links, the Dreame RFC host) and
+ * `CAMSTACK_PUBLIC_ORIGIN` (magic-link, OIDC callback, WebAuthn relying party,
+ * the OAuth2 issuer and the CORS allowlist, D707). An operator who set one got
+ * half a configured hub and no line saying so.
+ *
+ * `CAMSTACK_HUB_PUBLIC_URL` is the survivor. `CAMSTACK_PUBLIC_ORIGIN` is still
+ * accepted, for hubs that already set it, and costs a WARN on every boot until
+ * it is renamed. The resolution writes the survivor back into `process.env`
+ * and deletes the retired name, so every forked addon runner — which inherits
+ * this process's environment — reads exactly one variable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RETIRED_PUBLIC_ORIGIN_ENV = exports.HUB_PUBLIC_URL_ENV = void 0;
+exports.resolveHubPublicUrl = resolveHubPublicUrl;
+exports.applyHubPublicUrl = applyHubPublicUrl;
+/** The single public-URL variable every reader uses. */
+exports.HUB_PUBLIC_URL_ENV = 'CAMSTACK_HUB_PUBLIC_URL';
+/** Retired alias, accepted with a deprecation warning. */
+exports.RETIRED_PUBLIC_ORIGIN_ENV = 'CAMSTACK_PUBLIC_ORIGIN';
+function readTrimmed(env, name) {
+    const raw = env[name]?.trim();
+    if (raw === undefined || raw === '')
+        return undefined;
+    return raw.replace(/\/+$/, '');
+}
+/** Pure: which URL wins, and what to warn about. */
+function resolveHubPublicUrl(env) {
+    const current = readTrimmed(env, exports.HUB_PUBLIC_URL_ENV);
+    const retired = readTrimmed(env, exports.RETIRED_PUBLIC_ORIGIN_ENV);
+    if (retired === undefined)
+        return { url: current, warning: undefined };
+    if (current === undefined) {
+        return {
+            url: retired,
+            warning: `${exports.RETIRED_PUBLIC_ORIGIN_ENV} is deprecated and was read as ${exports.HUB_PUBLIC_URL_ENV}=${retired}. ` +
+                `Rename it to ${exports.HUB_PUBLIC_URL_ENV}; the old name will stop being read in a future release.`,
+        };
+    }
+    const disagree = current !== retired;
+    return {
+        url: current,
+        warning: `${exports.RETIRED_PUBLIC_ORIGIN_ENV} is deprecated and IGNORED because ${exports.HUB_PUBLIC_URL_ENV} is set` +
+            (disagree ? ` (${current} wins over ${retired})` : '') +
+            `. Remove ${exports.RETIRED_PUBLIC_ORIGIN_ENV} from this container.`,
+    };
+}
+/**
+ * Apply the resolution to a process environment: the survivor is set (or left
+ * unset), the retired name is removed. Returns the warning to log once a
+ * logger exists. Called once, first thing in the hub's bootstrap, before any
+ * addon runner is forked.
+ */
+function applyHubPublicUrl(env) {
+    const { url, warning } = resolveHubPublicUrl(env);
+    if (url === undefined)
+        delete env[exports.HUB_PUBLIC_URL_ENV];
+    else
+        env[exports.HUB_PUBLIC_URL_ENV] = url;
+    delete env[exports.RETIRED_PUBLIC_ORIGIN_ENV];
+    return warning;
+}

package/dist/main.js

@@ -59,43 +59,46 @@ const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
 const backup_download_js_1 = require("./api/backup-download.js");
-const health_routes_1 = require("./api/health/health.routes");
-const auth_rate_limit_1 = require("./auth/auth-rate-limit");
+const cap_providers_1 = require("./api/core/cap-providers");
+const logging_settings_1 = require("./api/core/logging-settings");
+const request_census_settings_1 = require("./api/core/request-census-settings");
+const register_cors_policy_1 = require("./api/cors/register-cors-policy");
 const adaptive_probe_routes_1 = require("./api/health/adaptive-probe.routes");
+const health_routes_1 = require("./api/health/health.routes");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
 const server_upload_1 = require("./api/server-upload");
 const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
+const frame_policy_1 = require("./api/static/frame-policy");
 const precompressed_asset_js_1 = require("./api/static/precompressed-asset.js");
-const spa_static_1 = require("./api/static/spa-static");
 const spa_mount_1 = require("./api/static/spa-mount");
-const frame_policy_1 = require("./api/static/frame-policy");
-const register_cors_policy_1 = require("./api/cors/register-cors-policy");
-const cap_providers_1 = require("./api/core/cap-providers");
-const logging_settings_1 = require("./api/core/logging-settings");
-const request_census_settings_1 = require("./api/core/request-census-settings");
+const spa_static_1 = require("./api/static/spa-static");
 const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
-const http_request_census_hook_1 = require("./api/trpc/http-request-census-hook");
 const http_request_census_singleton_1 = require("./api/trpc/http-request-census.singleton");
+const http_request_census_hook_1 = require("./api/trpc/http-request-census-hook");
 const trpc_context_1 = require("./api/trpc/trpc.context");
 const trpc_router_1 = require("./api/trpc/trpc.router");
-const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
 const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
+const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
 const ws_request_census_1 = require("./api/trpc/ws-request-census");
 const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
 const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
+const auth_rate_limit_1 = require("./auth/auth-rate-limit");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
+const session_mint_js_1 = require("./auth/session-mint.js");
+const sso_finish_js_1 = require("./auth/sso-finish.js");
 const boot_config_1 = require("./boot/boot-config");
+const public_url_1 = require("./boot/public-url");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
 const addon_package_service_1 = require("./core/addon/addon-package.service");
-const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const addon_registry_service_1 = require("./core/addon/addon-registry.service");
 const addon_bridge_service_1 = require("./core/addon-bridge/addon-bridge.service");
 const addon_pages_service_1 = require("./core/addon-pages/addon-pages.service");
 const addon_widgets_service_1 = require("./core/addon-widgets/addon-widgets.service");
 const agent_registry_service_1 = require("./core/agent/agent-registry.service");
+const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const auth_service_1 = require("./core/auth/auth.service");
 const handoff_code_service_1 = require("./core/auth/handoff-code.service");
 const share_token_service_1 = require("./core/auth/share-token.service");
@@ -238,6 +241,11 @@ async function sendMaybePrecompressed(reply, absolutePath, acceptEncoding) {
 }
 // ---- Bootstrap ----
 async function bootstrap() {
+    // ONE public-URL variable (CAMSTACK_HUB_PUBLIC_URL). The retired
+    // CAMSTACK_PUBLIC_ORIGIN is folded into it here — before any addon runner is
+    // forked, so every child inherits one name — and warned about once a logger
+    // exists (below). See `boot/public-url.ts`.
+    const publicUrlWarning = (0, public_url_1.applyHubPublicUrl)(process.env);
     // hub-main's own memory, on the record. Deliberately started HERE and not in
     // the starter: the starter runs from the image's /opt closure, which only
     // changes with a new image, while this entry is what `applyServerUpdate`
@@ -280,10 +288,8 @@ async function bootstrap() {
     // watch is the slope — 181-330MB/min steady, one burst of >=1.3GB in <=11s —
     // and the traffic behind it is ~22 000 socket reads/s and ~22 500 writes/s at
     // a 0.33KB mean. `LocalChildRegistry` has counted that per child since the
-    // fan-out gate was built and NOTHING has ever read it; `getMoleculerEventStats`
-    // likewise, while the hub runs `CAMSTACK_MOLECULER_EVENT_FANOUT=shadow` — a
-    // burn-in with no end condition, because the evidence that would authorise the
-    // flip to `filter` was never surfaced. This surfaces it and changes no default.
+    // fan-out gate was built and NOTHING had ever read it; `getMoleculerEventStats`
+    // likewise. This surfaces both.
     //
     // Every source is read LAZILY: this runs as the first statement of bootstrap()
     // and `MoleculerService` does not exist for hundreds of lines. Until it does,
@@ -297,7 +303,6 @@ async function bootstrap() {
                 const broker = moleculerForEventPlane?.broker;
                 return broker === undefined ? null : (0, system_1.getMoleculerEventStats)(broker);
             },
-            crossNodeMode: () => (0, system_1.readMoleculerFanoutMode)(),
         }),
         // The fan-out counters above answered their own question and sharpened
         // this one: the event plane is 4% of this process's ~44 000 socket
@@ -353,10 +358,13 @@ async function bootstrap() {
     // (D707): the hub's own, the hosted viewer PWA, the native embed's opaque
     // `null`, and the operator's `server.corsOrigins`. First hook on the
     // instance so every route — and every OPTIONS — is judged.
+    if (publicUrlWarning !== undefined) {
+        app.get(logging_service_1.LoggingService).createLogger('public-url').warn(publicUrlWarning);
+    }
     const corsConfig = app.get(config_service_1.ConfigService);
     const corsPolicy = (0, register_cors_policy_1.createCorsPolicy)({
         configuredOrigins: () => corsConfig.get('server.corsOrigins'),
-        publicOrigin: process.env.CAMSTACK_PUBLIC_ORIGIN,
+        publicOrigin: process.env[public_url_1.HUB_PUBLIC_URL_ENV],
         logger: app.get(logging_service_1.LoggingService).createLogger('cors'),
     });
     (0, register_cors_policy_1.registerCorsPolicy)(fastify, corsPolicy);
@@ -794,58 +802,25 @@ async function bootstrap() {
             return reply.send(fs.readFileSync(filePath));
         });
         // ── SSO finish endpoint ─────────────────────────────────────────
-        // OIDC / SAML / external auth providers redirect here after their
-        // own callback handler validated the IdP response. We trust the
-        // claims because:
-        //   1. The path is server-internal — providers run in-process and
-        //      issue the redirect with their own validated state.
-        //   2. The query string is consumed once and immediately swapped
-        //      for a JWT in the URL fragment (#token=...) which never hits
-        //      the server logs and isn't replayable.
-        //
-        // The provider prefixes the redirect with `provider=auth-oidc` so
-        // we can attribute the session. The mint is currently best-effort
-        // — a future hardening should require the provider to also pass a
-        // nonce signed with the auth.jwtSecret so we can verify the redirect
-        // came from the addon's own callback handler.
+        // OIDC / magic-link redirect here with an HMAC-signed LOGIN bridge
+        // (`sso-bridge` cap). The bridge says who signed in; the session is
+        // minted by THE session mint from the user record as it is now (D712) —
+        // `auth/sso-finish.ts` holds the rules, this route only maps the reply.
+        const ssoAuth = app.get(auth_service_1.AuthService);
+        const ssoMinter = (0, session_mint_js_1.createSessionMinter)({
+            signer: ssoAuth,
+            directory: () => capabilityRegistry.getSingleton('user-management'),
+        });
         fastify.get('/api/auth/sso/finish', async (request, reply) => {
-            // The auth-provider addon (OIDC, SAML, …) mints an HMAC-signed
-            // bridge token via the `sso-bridge` cap and 302s to here with
-            // `?bridge=<jwt>`. We verify the signature with the same JWT
-            // secret used elsewhere — only then do we trust the claims
-            // (including the `isAdmin` flag). This closes the prior gap
-            // where any client could call `?isAdmin=1` and become admin.
-            const bridge = request.query.bridge;
-            if (!bridge) {
-                return reply.status(400).send({ error: 'Missing bridge token' });
-            }
-            const ssoAuth = app.get(auth_service_1.AuthService);
-            const claims = ssoAuth.verifySsoBridgeToken(bridge);
-            if (!claims) {
-                return reply.status(401).send({ error: 'Invalid or expired bridge token' });
-            }
-            try {
-                const token = ssoAuth.signToken({
-                    userId: claims.userId,
-                    username: claims.username,
-                    isAdmin: claims.isAdmin,
-                    allowedProviders: '*',
-                    allowedDevices: {},
-                });
-                // Redirect to the admin UI with the token in the URL fragment.
-                // Fragments don't hit the server log + don't get sent on
-                // subsequent requests — the SPA's auth-context picks the
-                // token up on mount and stores it in localStorage.
-                reply.code(302);
-                reply.header('Location', `/admin/login#token=${encodeURIComponent(token)}&provider=${encodeURIComponent(claims.provider)}`);
-                return reply.send('');
-            }
-            catch (err) {
-                return reply.status(500).send({
-                    error: 'SSO finish failed',
-                    message: err instanceof Error ? err.message : String(err),
-                });
-            }
+            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, {
+                verifyBridge: (token) => ssoAuth.verifySsoBridgeToken(token),
+                minter: ssoMinter,
+            });
+            if (outcome.kind === 'error')
+                return reply.status(outcome.status).send(outcome.body);
+            reply.code(302);
+            reply.header('Location', outcome.location);
+            return reply.send('');
         });
         // ── Backup archive download ─────────────────────────────────────
         // Streams an archive through the storage cap's chunked-download
@@ -1141,7 +1116,7 @@ async function bootstrap() {
         (0, oauth2_routes_js_1.registerOauth2Routes)(fastify, {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
-            publicHubUrl: () => process.env.CAMSTACK_PUBLIC_ORIGIN ?? `https://localhost:${port}`,
+            publicHubUrl: () => process.env[public_url_1.HUB_PUBLIC_URL_ENV] ?? `https://localhost:${port}`,
             // Every /authorize refusal is a dropped account-linking attempt. Without
             // this scope the drop is invisible in Loki and the only signal left is an
             // operator noticing that linking stopped working.
@@ -1425,8 +1400,7 @@ async function bootstrap() {
             // node's registration must never win the election for the provider
             // whose staticDir this process reads from local disk.
             let viewerUI = capRegistry?.getSingletonForNode('viewer-ui', 'hub');
-            const skipViewerUIWait = process.env['CAMSTACK_SKIP_VIEWER_UI_WAIT'] === '1';
-            if (!viewerUI && capRegistry && !skipViewerUIWait) {
+            if (!viewerUI && capRegistry) {
                 // The viewer-ui addon runs in its own forked runner and registers a few
                 // seconds after boot. Poll briefly (shorter than admin-ui's 60s — the
                 // viewer is non-critical and admin-ui already gated the slow cold boot).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.456",
+  "version": "1.2.457",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.330",
-    "@camstack/addon-agent-ui": "1.2.174",
-    "@camstack/addon-auth": "1.2.126",
+    "@camstack/addon-admin-ui": "1.2.331",
+    "@camstack/addon-agent-ui": "1.2.175",
+    "@camstack/addon-auth": "1.2.127",
     "@camstack/addon-decoder-nodeav": "1.2.119",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.327",
-    "@camstack/addon-pipeline-orchestrator": "1.2.281",
-    "@camstack/addon-post-analysis": "1.2.333",
+    "@camstack/addon-pipeline": "1.2.328",
+    "@camstack/addon-pipeline-orchestrator": "1.2.282",
+    "@camstack/addon-post-analysis": "1.2.334",
     "@camstack/sdk": "1.2.121",
-    "@camstack/system": "1.2.354",
-    "@camstack/types": "1.2.305",
-    "@camstack/ui-library": "1.2.232",
+    "@camstack/system": "1.2.355",
+    "@camstack/types": "1.2.306",
+    "@camstack/ui-library": "1.2.233",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",