@camstack/server 1.2.478 → 1.2.479

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -2,6 +2,7 @@
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.enrichInputWithUserAgent = enrichInputWithUserAgent;
4
4
  exports.enrichInputWithRelayClass = enrichInputWithRelayClass;
5
+ exports.stripTalkbackFromRequest = stripTalkbackFromRequest;
5
6
  exports.enrichHintsWithClientClass = enrichHintsWithClientClass;
6
7
  exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
7
8
  exports.buildAppRouter = buildAppRouter;
@@ -95,6 +96,25 @@ function enrichInputWithRelayClass(input, clientClass) {
95
96
  const relayOnly = FORCE_RELAY_REMOTE ? (0, client_ip_js_1.deriveRelayOnly)(clientClass) : false;
96
97
  return { ...input, relayOnly };
97
98
  }
99
+ /**
100
+ * Strip `talkback` from a REQUEST-bound `handleOffer` (D771).
101
+ *
102
+ * Talk-back sends the peer's microphone to the camera's speaker. Only a
103
+ * trusted, mesh-originated caller may ask for it — today the Alexa export,
104
+ * which has already checked the linked user may control the camera. A
105
+ * browser's talk permission lives on the intercom cap's own surface (share
106
+ * tokens gate it there); letting a request-bound `handleOffer` set this flag
107
+ * would be a second door to the speaker. Same rule as `relayOnly`: a
108
+ * mesh-originated call (`clientClass === null`) passes through unchanged.
109
+ *
110
+ * Immutable — builds a NEW input object, never mutates the caller's.
111
+ */
112
+ function stripTalkbackFromRequest(input, clientClass) {
113
+ if (clientClass === null || input.talkback === undefined)
114
+ return input;
115
+ const { talkback: _dropped, ...rest } = input;
116
+ return rest;
117
+ }
98
118
  /**
99
119
  * Bias used to live here (`prefersTier: 'low'` for `remote`). That pinned
100
120
  * every phone-sized session — including LAN IPv6 GUA misclassified as remote
@@ -145,7 +165,7 @@ function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
145
165
  return {
146
166
  ...provider,
147
167
  createSession: (input) => provider.createSession(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
148
- handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(input, userAgent), clientClass), clientClass)),
168
+ handleOffer: (input) => provider.handleOffer(enrichHintsWithClientClass(enrichInputWithRelayClass(enrichInputWithUserAgent(stripTalkbackFromRequest(input, clientClass), userAgent), clientClass), clientClass)),
149
169
  };
150
170
  }
151
171
  /**
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@camstack/server",
3
- "version": "1.2.478",
3
+ "version": "1.2.479",
4
4
  "license": "MIT",
5
5
  "private": false,
6
6
  "files": [
@@ -37,17 +37,17 @@
37
37
  ]
38
38
  },
39
39
  "dependencies": {
40
- "@camstack/addon-admin-ui": "1.2.351",
40
+ "@camstack/addon-admin-ui": "1.2.352",
41
41
  "@camstack/addon-agent-ui": "1.2.190",
42
42
  "@camstack/addon-auth": "1.2.130",
43
43
  "@camstack/addon-decoder-nodeav": "1.2.121",
44
44
  "@camstack/addon-notifiers": "1.2.128",
45
- "@camstack/addon-pipeline": "1.2.344",
45
+ "@camstack/addon-pipeline": "1.2.345",
46
46
  "@camstack/addon-pipeline-orchestrator": "1.2.297",
47
47
  "@camstack/addon-post-analysis": "1.2.342",
48
48
  "@camstack/sdk": "1.2.126",
49
- "@camstack/system": "1.2.373",
50
- "@camstack/types": "1.2.324",
49
+ "@camstack/system": "1.2.374",
50
+ "@camstack/types": "1.2.325",
51
51
  "@camstack/ui-library": "1.2.248",
52
52
  "@fastify/compress": "^9.0.0",
53
53
  "@fastify/cookie": "^11.0.2",