@camstack/server 1.2.458 → 1.2.460

package/THIRD_PARTY_MODELS.md

@@ -134,7 +134,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yunet-2023mar` (default) | [OpenCV Zoo YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) | BSD-3-Clause (`BSD-3-Clause.txt`) / MIT (`MIT-yunet-reference.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | input contract baked into the graph (the pool RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather); internal tensor names cleared in the OpenVINO IR; ONNX fp32, OpenVINO IR fp32, CoreML fp16 (scripts/build-yunet-model.py) | mirror `faceDetection/yunet` |
+| `yunet-2023mar` (default) | [OpenCV Zoo YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) | BSD-3-Clause (`BSD-3-Clause.txt`) / MIT (`MIT-yunet-reference.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | input contract baked into the graph (the pool RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather); internal tensor names cleared in the OpenVINO IR; ONNX fp32, OpenVINO IR fp32, CoreML fp16 (scripts/build-yunet-model.py); Edge TPU build: the bake folded into the first Conv, full-integer int8 post-training quantisation calibrated on CamStack person crops, compiled with edgetpu_compiler 14 (scripts/build-yunet-edgetpu.py) | mirror `faceDetection/yunet` |
 
 ### Face recognition
 
@@ -146,7 +146,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py) | mirror `plateDetection/yolox-tiny-plate` |
+| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py); Edge TPU build: the Focus stem rewritten as the equivalent 6x6 stride-2 Conv with the input bake folded into it, the graph cut before the grid decode (raw per-stride head), full-integer int8 post-training quantisation calibrated on CamStack vehicle crops, compiled with edgetpu_compiler 14 (scripts/build-yolox-plate-edgetpu.py) | mirror `plateDetection/yolox-tiny-plate` |
 
 ### Licence plate reading
 

package/dist/agent/agent-update-service.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentUpdateService = exports.AGENT_RESTART_GRACE_MS = exports.AGENT_RUNTIME_ADDON_ID = void 0;
+exports.AgentUpdateService = exports.AgentRestartAnnouncer = exports.AGENT_RESTART_GRACE_MS = exports.AGENT_RUNTIME_ADDON_ID = void 0;
 exports.isRunningInContainer = isRunningInContainer;
 exports.resolveAgentPackageJsonPath = resolveAgentPackageJsonPath;
 exports.scheduleAgentRestart = scheduleAgentRestart;
@@ -149,7 +149,61 @@ function scheduleAgentRestart(logger, requestedBy, dataDir) {
     }, exports.AGENT_RESTART_GRACE_MS);
     grace.unref();
 }
+/**
+ * The agent's restart ANNOUNCEMENT (D723): `system.restarting`, emitted before
+ * the self-SIGTERM, through the agent's event bus — which broadcasts it to the
+ * hub, where the notification centre turns it into `node-restarting` or
+ * `node-updating`. Until D723 the agent emitted nothing before exiting, so an
+ * agent's restart was announced only after the fact (`system.restart-completed`).
+ *
+ * Its own small object because the restart seam is a closure handed to the base
+ * class BEFORE `this` exists, while the bus is bound later (`bindAvailability`,
+ * once the mesh is up). A restart before that has nobody to tell — said, never
+ * silent.
+ */
+class AgentRestartAnnouncer {
+    logger;
+    eventBus;
+    nodeId;
+    constructor(logger, eventBus, nodeId) {
+        this.logger = logger;
+        this.eventBus = eventBus;
+        this.nodeId = nodeId;
+    }
+    bind(eventBus, nodeId) {
+        this.eventBus = eventBus;
+        this.nodeId = nodeId;
+    }
+    announce(marker) {
+        const bus = this.eventBus;
+        if (bus === null) {
+            this.logger.warn('agent restart NOT announced — the event bus is not bound yet', {
+                meta: { nodeId: this.nodeId, kind: marker.kind },
+            });
+            return;
+        }
+        const payload = { ...marker, nodeId: this.nodeId };
+        try {
+            bus.emit({
+                id: (0, node_crypto_1.randomUUID)(),
+                timestamp: new Date(),
+                source: { type: 'core', id: 'agent-update-service' },
+                category: types_1.EventCategory.SystemRestarting,
+                data: payload,
+            });
+        }
+        catch (err) {
+            // Telemetry (D8): an announcement that could not go out must never block
+            // the restart it announces.
+            this.logger.warn('agent restart announcement failed', {
+                meta: { nodeId: this.nodeId, error: err instanceof Error ? err.message : String(err) },
+            });
+        }
+    }
+}
+exports.AgentRestartAnnouncer = AgentRestartAnnouncer;
 class AgentUpdateService extends index_js_1.RootUpdateService {
+    restartAnnouncer;
     updateAvailability;
     eventBus;
     nodeId;
@@ -164,6 +218,7 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
         // handshake settles the id; the log tag keeps the boot-time value, which is
         // the same string in every deployment that sets `CAMSTACK_NODE_ID`.
         const nodeId = options.nodeId ?? process.env['CAMSTACK_NODE_ID'] ?? 'agent';
+        const restartAnnouncer = new AgentRestartAnnouncer(options.logger, options.eventBus ?? null, nodeId);
         super({
             spec: index_js_1.HUB_ROOT_SPEC,
             nodeId,
@@ -177,7 +232,8 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
             },
             logger: options.logger,
             restartServer: (requestedBy, update) => {
-                writeAgentRestartMarker(options.dataDir, requestedBy, update);
+                const marker = writeAgentRestartMarker(options.dataDir, requestedBy, update);
+                restartAnnouncer.announce(marker);
                 restartAgent(requestedBy);
             },
             dataDir: options.dataDir,
@@ -204,6 +260,7 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
             now: options.now,
         });
         this.nodeId = nodeId;
+        this.restartAnnouncer = restartAnnouncer;
         this.agentDataDir = options.dataDir;
         this.agentLogger = options.logger;
         this.eventBus = options.eventBus ?? null;
@@ -220,6 +277,7 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
     bindAvailability(eventBus, nodeId) {
         this.eventBus = eventBus;
         this.nodeId = nodeId;
+        this.restartAnnouncer.bind(eventBus, nodeId);
         this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(eventBus, { type: 'core', id: 'agent-update-service' }, new update_availability_store_js_1.FileUpdateAvailabilityStore(this.agentDataDir, 'agent-update', this.agentLogger));
     }
     async checkServerUpdate() {
@@ -266,19 +324,22 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
     }
 }
 exports.AgentUpdateService = AgentUpdateService;
+/** Write the marker and return it — the same payload is the announcement (D723). */
 function writeAgentRestartMarker(dataDir, requestedBy, update) {
+    // Same builder as the hub: an agent's "Server aggiornato" notification must
+    // name both versions too — see `core/updates/restart-marker.ts`.
+    const marker = (0, restart_marker_js_1.buildRestartMarker)({
+        requestedAt: Date.now(),
+        requestedBy,
+        ...(update !== undefined ? { update } : {}),
+    });
     try {
-        // Same builder as the hub: an agent's "Server aggiornato" notification must
-        // name both versions too — see `core/updates/restart-marker.ts`.
-        (0, system_1.writePendingRestart)(dataDir, (0, restart_marker_js_1.buildRestartMarker)({
-            requestedAt: Date.now(),
-            requestedBy,
-            ...(update !== undefined ? { update } : {}),
-        }));
+        (0, system_1.writePendingRestart)(dataDir, marker);
     }
     catch {
         // Marker write must never block the restart.
     }
+    return marker;
 }
 /**
  * The manifest entry for the agent runtime's own providers. Appended to

package/dist/boot/boot-config.js

@@ -38,6 +38,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ignoredTlsCertSources = ignoredTlsCertSources;
 exports.loadBootstrapConfig = loadBootstrapConfig;
 exports.autoGenerateJwtSecret = autoGenerateJwtSecret;
 exports.setupInfra = setupInfra;
@@ -67,9 +68,15 @@ const ENV_VAR_MAP = {
     CAMSTACK_ADMIN_USER: 'auth.adminUsername',
     CAMSTACK_ADMIN_PASS: 'auth.adminPassword',
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
-    CAMSTACK_TLS_CERT: 'tls.certPath',
-    CAMSTACK_TLS_KEY: 'tls.keyPath',
 };
+/**
+ * Env variables that once set the node's certificate. Ignored since D726:
+ * the admin UI (Network → Local access) is the one way to set it. Still
+ * named here so a node that has them set is told, not silently re-keyed.
+ */
+const IGNORED_TLS_CERT_ENV = ['CAMSTACK_TLS_CERT', 'CAMSTACK_TLS_KEY'];
+/** The `config.yaml` keys those variables were mapped onto — ignored too. */
+const IGNORED_TLS_CERT_KEYS = ['certPath', 'keyPath'];
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -82,6 +89,20 @@ function setNested(obj, p, value) {
     const child = (0, types_1.asJsonObject)(obj[head]) ?? {};
     return { ...obj, [head]: setNested(child, rest.join('.'), value) };
 }
+/**
+ * Every env variable and `config.yaml` key that would once have set the
+ * certificate and is now ignored (D726). Blank env values count as unset,
+ * exactly as the override loop treats them.
+ */
+function ignoredTlsCertSources(env, raw) {
+    const fromEnv = IGNORED_TLS_CERT_ENV.filter((name) => {
+        const value = env[name];
+        return value !== undefined && value !== '';
+    });
+    const tls = (0, types_1.asJsonObject)(raw['tls']) ?? {};
+    const fromYaml = IGNORED_TLS_CERT_KEYS.filter((key) => tls[key] !== undefined).map((key) => `tls.${key}`);
+    return [...fromEnv, ...fromYaml];
+}
 // ---------------------------------------------------------------------------
 // loadBootstrapConfig
 // ---------------------------------------------------------------------------
@@ -145,6 +166,11 @@ function loadBootstrapConfig(configPath) {
         raw = setNested(raw, configPath_, coerced);
         console.log(`[Phase1] Env override: ${envKey} → ${configPath_}`);
     }
+    const ignored = ignoredTlsCertSources(process.env, raw);
+    if (ignored.length > 0) {
+        console.warn(`[Phase1] WARN ${ignored.join(', ')} ignored — the certificate is set only in the admin UI. ` +
+            'Upload the certificate in Network → Local access (D726).');
+    }
     return config_schema_1.bootstrapSchema.parse(raw);
 }
 // ---------------------------------------------------------------------------
@@ -210,22 +236,21 @@ async function setupInfra(configPath, bootstrapConfig) {
         // broken chunks with require("fs") when leaked .js files exist in core/src/.
         // CJS build works correctly and tsx supports require().
         const core = require('@camstack/system');
-        const { ensureTlsCert, loadTlsCert } = core;
-        if (config.tls.certPath && config.tls.keyPath) {
-            // User-provided cert
-            console.log(`[Phase2c] Loading custom TLS cert from ${config.tls.certPath}`);
-            const pair = loadTlsCert(config.tls.certPath, config.tls.keyPath);
-            tlsOptions = { key: pair.key, cert: pair.cert };
+        // The certificate comes only from the admin UI (D726): the generated
+        // local CA → leaf (D227), or an operator upload served verbatim.
+        const extraSans = [...core.readExtraSans(dataPath)];
+        const boot = await core.prepareBootTls(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
+        if (boot.uploadedMissing) {
+            console.warn(`[Phase2c] WARN the uploaded TLS certificate is missing from ${path.join(dataPath, 'tls')} — serving the generated one. Upload it again in Network → Local access.`);
+        }
+        if (boot.ensured !== undefined) {
+            tlsCert = boot.ensured;
+            logTlsCert(boot.ensured);
         }
         else {
-            // Hub-generated local CA → leaf (D227)
-            const extraSans = [...(core.readExtraSans?.(dataPath) ?? [])];
-            const tlsResult = await ensureTlsCert(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
-            tlsCert = tlsResult;
-            logTlsCert(tlsResult);
-            const pair = loadTlsCert(tlsResult.certPath, tlsResult.keyPath);
-            tlsOptions = { key: pair.key, cert: pair.cert };
+            console.log(`[Phase2c] Serving the uploaded TLS certificate from ${path.join(dataPath, 'tls')}`);
         }
+        tlsOptions = { key: boot.pair.key, cert: boot.pair.cert };
     }
     return {
         bootstrapConfig: config,

package/dist/core/addon/addon-package.service.js

@@ -1146,7 +1146,11 @@ class AddonPackageService {
             timestamp: new Date(),
             source: { type: 'core', id: 'addon-package-service' },
             category: types_1.EventCategory.SystemRestarting,
-            data: payload,
+            // The node, as `system.restart-completed` names it after the boot
+            // (`post-boot.service.ts`): the announcement and the landing of one
+            // restart must name the same node, or a stale `node-updating` could not
+            // be matched to the `server-updated` that supersedes it (D723).
+            data: { ...payload, nodeId: process.env['CAMSTACK_NODE_ID'] ?? 'hub' },
         });
         // 10s grace gives in-flight requests time to drain.
         (0, system_1.scheduleSelfRestart)({ delayMs: 10_000 });

package/dist/main.js

@@ -40,6 +40,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const node_tls_1 = require("node:tls");
 // Boot-time capability declaration runs over the auto-generated
 // `ALL_CAPABILITY_DEFINITIONS` array — every `*.cap.ts` file that ships
 // with `@camstack/types` is included automatically. Adding a new cap
@@ -1489,6 +1490,17 @@ async function bootstrap() {
     const logger = app.get(logging_service_1.LoggingService).createLogger('System');
     const protocol = tlsOptions ? 'https' : 'http';
     logger.info('CamStack server listening', { meta: { protocol, host, port, trpcRegistered } });
+    // Certificate actions (Network → Local access) swap the served certificate
+    // in place through this registration — without it an upload sat on disk
+    // while the listener kept serving the boot-time leaf (D726).
+    if (tlsOptions) {
+        if (fastify.server instanceof node_tls_1.Server) {
+            (0, system_1.registerHttpsListener)(fastify.server, tlsOptions);
+        }
+        else {
+            logger.warn('HTTPS listener is not a TLS server — certificate changes need a restart');
+        }
+    }
     // LAN HTTP sibling — same Fastify request graph, dedicated port. Handler
     // is registered as soon as we have the instance; bind happens after HTTPS
     // is up so a failed HTTPS listen does not leave HTTP serving alone.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.458",
+  "version": "1.2.460",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.332",
-    "@camstack/addon-agent-ui": "1.2.175",
+    "@camstack/addon-admin-ui": "1.2.334",
+    "@camstack/addon-agent-ui": "1.2.176",
     "@camstack/addon-auth": "1.2.127",
     "@camstack/addon-decoder-nodeav": "1.2.119",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.328",
-    "@camstack/addon-pipeline-orchestrator": "1.2.283",
-    "@camstack/addon-post-analysis": "1.2.334",
+    "@camstack/addon-pipeline": "1.2.329",
+    "@camstack/addon-pipeline-orchestrator": "1.2.284",
+    "@camstack/addon-post-analysis": "1.2.336",
     "@camstack/sdk": "1.2.122",
-    "@camstack/system": "1.2.355",
-    "@camstack/types": "1.2.306",
-    "@camstack/ui-library": "1.2.233",
+    "@camstack/system": "1.2.357",
+    "@camstack/types": "1.2.308",
+    "@camstack/ui-library": "1.2.234",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",