@camstack/server 1.2.459 → 1.2.460

package/THIRD_PARTY_MODELS.md

@@ -134,7 +134,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yunet-2023mar` (default) | [OpenCV Zoo YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) | BSD-3-Clause (`BSD-3-Clause.txt`) / MIT (`MIT-yunet-reference.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | input contract baked into the graph (the pool RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather); internal tensor names cleared in the OpenVINO IR; ONNX fp32, OpenVINO IR fp32, CoreML fp16 (scripts/build-yunet-model.py) | mirror `faceDetection/yunet` |
+| `yunet-2023mar` (default) | [OpenCV Zoo YuNet](https://github.com/opencv/opencv_zoo/tree/main/models/face_detection_yunet) | BSD-3-Clause (`BSD-3-Clause.txt`) / MIT (`MIT-yunet-reference.txt`) | WIDER FACE: research-oriented terms; images CC BY-NC-ND | input contract baked into the graph (the pool RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather); internal tensor names cleared in the OpenVINO IR; ONNX fp32, OpenVINO IR fp32, CoreML fp16 (scripts/build-yunet-model.py); Edge TPU build: the bake folded into the first Conv, full-integer int8 post-training quantisation calibrated on CamStack person crops, compiled with edgetpu_compiler 14 (scripts/build-yunet-edgetpu.py) | mirror `faceDetection/yunet` |
 
 ### Face recognition
 
@@ -146,7 +146,7 @@ entry kept resolvable for a saved selection but no longer offered.
 
 | Catalog ids | Upstream | Code / weights | Training data | CamStack changes | Downloaded from |
 | --- | --- | --- | --- | --- | --- |
-| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py) | mirror `plateDetection/yolox-tiny-plate` |
+| `yolox-tiny-plate` (default) | [open-lpr models (faisalthaheem/open-lpr-models), YOLOX-tiny](https://huggingface.co/faisalthaheem/open-lpr-models) | Apache-2.0 / Apache-2.0 (`Apache-2.0.txt`) | Simanno annotated plate corpus plus community-contributed photographs, pseudo-labelled by a teacher model (not published; the upstream NOTICE says the photographs were uploaded without consent obtained): UNKNOWN | input contract baked into the graph (static 1x3x640x640 RGB /255 becomes the upstream BGR 0..255: Mul(255) plus a channel Gather) and the output reshaped to the YOLOv8 layout (cx, cy, w, h, obj*cls); ONNX fp32, OpenVINO IR fp16, CoreML fp16 (scripts/build-yolox-plate-model.py); Edge TPU build: the Focus stem rewritten as the equivalent 6x6 stride-2 Conv with the input bake folded into it, the graph cut before the grid decode (raw per-stride head), full-integer int8 post-training quantisation calibrated on CamStack vehicle crops, compiled with edgetpu_compiler 14 (scripts/build-yolox-plate-edgetpu.py) | mirror `plateDetection/yolox-tiny-plate` |
 
 ### Licence plate reading
 

package/dist/boot/boot-config.js

@@ -38,6 +38,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ignoredTlsCertSources = ignoredTlsCertSources;
 exports.loadBootstrapConfig = loadBootstrapConfig;
 exports.autoGenerateJwtSecret = autoGenerateJwtSecret;
 exports.setupInfra = setupInfra;
@@ -67,9 +68,15 @@ const ENV_VAR_MAP = {
     CAMSTACK_ADMIN_USER: 'auth.adminUsername',
     CAMSTACK_ADMIN_PASS: 'auth.adminPassword',
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
-    CAMSTACK_TLS_CERT: 'tls.certPath',
-    CAMSTACK_TLS_KEY: 'tls.keyPath',
 };
+/**
+ * Env variables that once set the node's certificate. Ignored since D726:
+ * the admin UI (Network → Local access) is the one way to set it. Still
+ * named here so a node that has them set is told, not silently re-keyed.
+ */
+const IGNORED_TLS_CERT_ENV = ['CAMSTACK_TLS_CERT', 'CAMSTACK_TLS_KEY'];
+/** The `config.yaml` keys those variables were mapped onto — ignored too. */
+const IGNORED_TLS_CERT_KEYS = ['certPath', 'keyPath'];
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -82,6 +89,20 @@ function setNested(obj, p, value) {
     const child = (0, types_1.asJsonObject)(obj[head]) ?? {};
     return { ...obj, [head]: setNested(child, rest.join('.'), value) };
 }
+/**
+ * Every env variable and `config.yaml` key that would once have set the
+ * certificate and is now ignored (D726). Blank env values count as unset,
+ * exactly as the override loop treats them.
+ */
+function ignoredTlsCertSources(env, raw) {
+    const fromEnv = IGNORED_TLS_CERT_ENV.filter((name) => {
+        const value = env[name];
+        return value !== undefined && value !== '';
+    });
+    const tls = (0, types_1.asJsonObject)(raw['tls']) ?? {};
+    const fromYaml = IGNORED_TLS_CERT_KEYS.filter((key) => tls[key] !== undefined).map((key) => `tls.${key}`);
+    return [...fromEnv, ...fromYaml];
+}
 // ---------------------------------------------------------------------------
 // loadBootstrapConfig
 // ---------------------------------------------------------------------------
@@ -145,6 +166,11 @@ function loadBootstrapConfig(configPath) {
         raw = setNested(raw, configPath_, coerced);
         console.log(`[Phase1] Env override: ${envKey} → ${configPath_}`);
     }
+    const ignored = ignoredTlsCertSources(process.env, raw);
+    if (ignored.length > 0) {
+        console.warn(`[Phase1] WARN ${ignored.join(', ')} ignored — the certificate is set only in the admin UI. ` +
+            'Upload the certificate in Network → Local access (D726).');
+    }
     return config_schema_1.bootstrapSchema.parse(raw);
 }
 // ---------------------------------------------------------------------------
@@ -210,22 +236,21 @@ async function setupInfra(configPath, bootstrapConfig) {
         // broken chunks with require("fs") when leaked .js files exist in core/src/.
         // CJS build works correctly and tsx supports require().
         const core = require('@camstack/system');
-        const { ensureTlsCert, loadTlsCert } = core;
-        if (config.tls.certPath && config.tls.keyPath) {
-            // User-provided cert
-            console.log(`[Phase2c] Loading custom TLS cert from ${config.tls.certPath}`);
-            const pair = loadTlsCert(config.tls.certPath, config.tls.keyPath);
-            tlsOptions = { key: pair.key, cert: pair.cert };
+        // The certificate comes only from the admin UI (D726): the generated
+        // local CA → leaf (D227), or an operator upload served verbatim.
+        const extraSans = [...core.readExtraSans(dataPath)];
+        const boot = await core.prepareBootTls(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
+        if (boot.uploadedMissing) {
+            console.warn(`[Phase2c] WARN the uploaded TLS certificate is missing from ${path.join(dataPath, 'tls')} — serving the generated one. Upload it again in Network → Local access.`);
+        }
+        if (boot.ensured !== undefined) {
+            tlsCert = boot.ensured;
+            logTlsCert(boot.ensured);
         }
         else {
-            // Hub-generated local CA → leaf (D227)
-            const extraSans = [...(core.readExtraSans?.(dataPath) ?? [])];
-            const tlsResult = await ensureTlsCert(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
-            tlsCert = tlsResult;
-            logTlsCert(tlsResult);
-            const pair = loadTlsCert(tlsResult.certPath, tlsResult.keyPath);
-            tlsOptions = { key: pair.key, cert: pair.cert };
+            console.log(`[Phase2c] Serving the uploaded TLS certificate from ${path.join(dataPath, 'tls')}`);
         }
+        tlsOptions = { key: boot.pair.key, cert: boot.pair.cert };
     }
     return {
         bootstrapConfig: config,

package/dist/main.js

@@ -40,6 +40,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const node_tls_1 = require("node:tls");
 // Boot-time capability declaration runs over the auto-generated
 // `ALL_CAPABILITY_DEFINITIONS` array — every `*.cap.ts` file that ships
 // with `@camstack/types` is included automatically. Adding a new cap
@@ -1489,6 +1490,17 @@ async function bootstrap() {
     const logger = app.get(logging_service_1.LoggingService).createLogger('System');
     const protocol = tlsOptions ? 'https' : 'http';
     logger.info('CamStack server listening', { meta: { protocol, host, port, trpcRegistered } });
+    // Certificate actions (Network → Local access) swap the served certificate
+    // in place through this registration — without it an upload sat on disk
+    // while the listener kept serving the boot-time leaf (D726).
+    if (tlsOptions) {
+        if (fastify.server instanceof node_tls_1.Server) {
+            (0, system_1.registerHttpsListener)(fastify.server, tlsOptions);
+        }
+        else {
+            logger.warn('HTTPS listener is not a TLS server — certificate changes need a restart');
+        }
+    }
     // LAN HTTP sibling — same Fastify request graph, dedicated port. Handler
     // is registered as soon as we have the instance; bind happens after HTTPS
     // is up so a failed HTTPS listen does not leave HTTP serving alone.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.459",
+  "version": "1.2.460",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.333",
-    "@camstack/addon-agent-ui": "1.2.175",
+    "@camstack/addon-admin-ui": "1.2.334",
+    "@camstack/addon-agent-ui": "1.2.176",
     "@camstack/addon-auth": "1.2.127",
     "@camstack/addon-decoder-nodeav": "1.2.119",
     "@camstack/addon-notifiers": "1.2.128",
-    "@camstack/addon-pipeline": "1.2.328",
-    "@camstack/addon-pipeline-orchestrator": "1.2.283",
-    "@camstack/addon-post-analysis": "1.2.335",
+    "@camstack/addon-pipeline": "1.2.329",
+    "@camstack/addon-pipeline-orchestrator": "1.2.284",
+    "@camstack/addon-post-analysis": "1.2.336",
     "@camstack/sdk": "1.2.122",
-    "@camstack/system": "1.2.356",
-    "@camstack/types": "1.2.307",
-    "@camstack/ui-library": "1.2.233",
+    "@camstack/system": "1.2.357",
+    "@camstack/types": "1.2.308",
+    "@camstack/ui-library": "1.2.234",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",