@camstack/server 1.2.582 → 1.2.584

package/dist/api/trpc/generated-cap-routers.js

@@ -5373,6 +5373,13 @@ function createCapRouter_localNetwork(getProvider, createRemoteProxy) {
             const p = resolveProvider('local-network', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
             return p.downloadCa();
         }),
+        useStoredUploadedCertificate: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
+            .output(types_70.localNetworkCapability.methods.useStoredUploadedCertificate.output)
+            .mutation(async ({ input, ctx }) => {
+            const p = resolveProvider('local-network', input?.nodeId, () => getProvider(ctx), createRemoteProxy);
+            return p.useStoredUploadedCertificate();
+        }),
         revertToGeneratedCertificate: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ nodeId: zod_1.z.string().optional() }).optional())
             .output(types_70.localNetworkCapability.methods.revertToGeneratedCertificate.output)

package/dist/boot/boot-config.js

@@ -245,6 +245,9 @@ async function setupInfra(_configPath, bootstrapConfig) {
         if (boot.uploadedMissing) {
             console.warn(`[Phase2c] WARN the uploaded TLS certificate is missing from ${path.join(dataPath, 'tls')} — serving the generated one. Upload it again in Network → Local access.`);
         }
+        if (boot.dormantCaReplaced) {
+            console.warn(`[Phase2c] WARN the local CA kept beside the uploaded certificate had no name constraints and was replaced by a constrained one (D873). The previous CA stays on disk until the listener is up. Clients that trusted it must download and trust the new CA again.`);
+        }
         if (boot.ensured !== undefined) {
             tlsCert = boot.ensured;
             logTlsCert(boot.ensured);
@@ -277,6 +280,12 @@ function logTlsCert(result) {
     console.log(`[Phase2c] TLS CERTIFICATE REISSUED — reason=${result.reason}, caRotated=${result.caRotated}`);
     console.log(`[Phase2c]   leaf ${result.previousFingerprintSha256 ?? '(none)'} → ${result.fingerprintSha256}`);
     console.log(`[Phase2c]   valid to ${result.validTo}, names: ${result.sans.join(', ')}`);
+    if (result.reason === 'ca-unconstrained') {
+        console.log(`[Phase2c]   The previous local CA had no name constraints (D873); it is kept on disk until the listener serves the new leaf, then removed.`);
+    }
+    if (result.droppedNames.length > 0) {
+        console.log(`[Phase2c]   WARN not certified (outside the local CA's name constraints): ${result.droppedNames.join(', ')}`);
+    }
     console.log(result.caRotated
         ? `[Phase2c]   ACTION REQUIRED: the local CA changed. Install ${result.caCertPath} (SHA-256 ${result.caFingerprintSha256}) on every device that trusted the previous certificate.`
         : `[Phase2c]   Local CA unchanged (${result.caFingerprintSha256}) — devices that trust ${result.caCertPath} keep working.`);

package/dist/boot/post-boot.service.js

@@ -59,6 +59,11 @@ class PostBootService {
         // A certificate that changed underneath the operator is an alert, not
         // a boot line they will never scroll back to (D227).
         this.emitTlsCertChangedIfReissued(tlsCert);
+        // The listener is up on the replacement CA's leaf: the retired unconstrained CA (and
+        // its key) kept on disk for the replacement window can go (D873).
+        if ((0, system_1.retirePreviousLocalCa)(dataPath)) {
+            this.logger.warn('Retired the previous local CA that had no name constraints (D873)');
+        }
         // Re-drive every non-terminal lifecycle job (addon task phases) from its
         // on-disk checkpoint. Framework tasks are no longer applied by the engine
         // (single-copy collapse — framework updates ship via applyServerUpdate);

package/dist/closure-patches/patch-reach.json

@@ -54,8 +54,15 @@
       "reach": "closure-postinstall",
       "markers": {
         "lib/ice/src/ice.js": ["camstack: relay-only SDP under forceTurn"],
-        "lib/index.mjs": ["camstack: relay-only SDP under forceTurn", "RTP_HISTORY_SIZE = 4096"],
-        "lib/webrtc/src/media/rtpSender.js": ["RTP_HISTORY_SIZE = 4096"]
+        "lib/index.mjs": [
+          "camstack: relay-only SDP under forceTurn",
+          "RTP_HISTORY_SIZE = 4096",
+          "camstack: D868 — SRTP output arena"
+        ],
+        "lib/webrtc/src/media/rtpSender.js": ["RTP_HISTORY_SIZE = 4096"],
+        "lib/rtp/src/rtp/rtp.js": ["camstack: D868 — SRTP output arena"],
+        "lib/rtp/src/srtp/cipher/ctr.js": ["camstack: D868 — header, ciphertext and tag in ONE arena slice"],
+        "lib/rtp/src/srtp/cipher/gcm.js": ["camstack: D868 — header, ciphertext and tag in ONE arena slice"]
       },
       "declaredBy": [
         "packages/addon-pipeline",

package/dist/closure-patches/werift+0.22.9.patch

@@ -25,10 +25,87 @@ index 74cf126..0c5cedf 100644
                          }
                          clearTimeout(timer);
 diff --git a/node_modules/werift/lib/index.mjs b/node_modules/werift/lib/index.mjs
-index 3e8b013..48823e7 100644
+index 3e8b013..f481aa5 100644
 --- a/node_modules/werift/lib/index.mjs
 +++ b/node_modules/werift/lib/index.mjs
-@@ -7940,7 +7940,10 @@ var Connection = class {
+@@ -4358,6 +4358,21 @@ var timestampOffset = 4;
+ var ssrcOffset = 8;
+ var csrcOffset = 12;
+ var csrcSize = 4;
++
++// camstack: D868 — SRTP output arena (see lib/rtp/src/rtp/rtp.js).
++var CAMSTACK_SRTP_ARENA_BYTES = 262144;
++var camstackSrtpArena = Buffer.allocUnsafeSlow(0);
++var camstackSrtpArenaOffset = 0;
++function camstackSrtpOut(size) {
++  if (size > CAMSTACK_SRTP_ARENA_BYTES >> 2) return Buffer.allocUnsafeSlow(size);
++  if (camstackSrtpArenaOffset + size > camstackSrtpArena.length) {
++    camstackSrtpArena = Buffer.allocUnsafeSlow(CAMSTACK_SRTP_ARENA_BYTES);
++    camstackSrtpArenaOffset = 0;
++  }
++  const out = camstackSrtpArena.subarray(camstackSrtpArenaOffset, camstackSrtpArenaOffset + size);
++  camstackSrtpArenaOffset += size;
++  return out;
++}
+ var RtpHeader = class _RtpHeader {
+   version = 2;
+   padding = false;
+@@ -4501,8 +4516,8 @@ var RtpHeader = class _RtpHeader {
+     }
+     return size;
+   }
+-  serialize(size) {
+-    const buf = Buffer.alloc(size);
++  serialize(size, into) {
++    const buf = into ? into.fill(0, 0, size) : Buffer.alloc(size);
+     let offset = 0;
+     const v_p_x_cc = new BitWriter(8);
+     v_p_x_cc.set(2, 0, this.version);
+@@ -4679,7 +4694,9 @@ var CipherAesCtr = class extends CipherAesBase {
+   }
+   authTagLength = 10;
+   encryptRtp(header, payload, rolloverCounter) {
+-    const headerBuffer = header.serialize(header.serializeSize);
++    const hdrSize = header.serializeSize;
++    const out = camstackSrtpOut(hdrSize + payload.length + this.authTagLength);
++    const headerBuffer = header.serialize(hdrSize, out.subarray(0, hdrSize));
+     const counter = this.generateCounter(
+       header.sequenceNumber,
+       rolloverCounter,
+@@ -4693,7 +4710,9 @@ var CipherAesCtr = class extends CipherAesBase {
+       headerBuffer,
+       enc
+     );
+-    return Buffer.concat([headerBuffer, enc, authTag]);
++    enc.copy(out, hdrSize);
++    authTag.copy(out, hdrSize + enc.length);
++    return out.subarray(0, hdrSize + enc.length + authTag.length);
+   }
+   decryptRtp(cipherText, rolloverCounter) {
+     const header = RtpHeader.deSerialize(cipherText);
+@@ -4800,15 +4819,18 @@ var CipherAesGcm = class extends CipherAesBase {
+     super(srtpSessionKey, srtpSessionSalt, srtcpSessionKey, srtcpSessionSalt);
+   }
+   encryptRtp(header, payload, rolloverCounter) {
+-    const hdr = header.serialize(header.serializeSize);
++    const hdrSize = header.serializeSize;
++    const out = camstackSrtpOut(hdrSize + payload.length + this.aeadAuthTagLen);
++    const hdr = header.serialize(hdrSize, out.subarray(0, hdrSize));
+     const iv = this.rtpInitializationVector(header, rolloverCounter);
+     const cipher = createCipheriv3("aes-128-gcm", this.srtpSessionKey, iv);
+     cipher.setAAD(hdr);
+     const enc = cipher.update(payload);
+     cipher.final();
+     const authTag = cipher.getAuthTag();
+-    const dst = Buffer.concat([hdr, enc, authTag]);
+-    return dst;
++    enc.copy(out, hdrSize);
++    authTag.copy(out, hdrSize + enc.length);
++    return out.subarray(0, hdrSize + enc.length + authTag.length);
+   }
+   decryptRtp(cipherText, rolloverCounter) {
+     const header = RtpHeader.deSerialize(cipherText);
+@@ -7940,7 +7962,10 @@ var Connection = class {
            this.localUsername
          );
          this.pairLocalProtocol(protocol);
@@ -40,7 +117,7 @@ index 3e8b013..48823e7 100644
          return protocol;
        } catch (error) {
          log22("error protocol STUN", error);
-@@ -7967,7 +7970,8 @@ var Connection = class {
+@@ -7967,7 +7992,8 @@ var Connection = class {
                  ).catch((error) => {
                    log22("error", error);
                  });
@@ -50,7 +127,7 @@ index 3e8b013..48823e7 100644
                    this.appendLocalCandidate(candidate);
                  }
                  clearTimeout(timer2);
-@@ -13565,7 +13569,7 @@ var SenderBandwidthEstimator = class {
+@@ -13565,7 +13591,7 @@ var SenderBandwidthEstimator = class {
  
  // src/media/rtpSender.ts
  var log33 = debug("werift:packages/webrtc/src/media/rtpSender.ts");
@@ -59,6 +136,100 @@ index 3e8b013..48823e7 100644
  var RTT_ALPHA = 0.85;
  var RTCRtpSender = class {
    constructor(trackOrKind) {
+diff --git a/node_modules/werift/lib/rtp/src/rtp/rtp.js b/node_modules/werift/lib/rtp/src/rtp/rtp.js
+index 97b2767..b8ee886 100644
+--- a/node_modules/werift/lib/rtp/src/rtp/rtp.js
++++ b/node_modules/werift/lib/rtp/src/rtp/rtp.js
+@@ -11,6 +11,26 @@ const timestampOffset = 4;
+ const ssrcOffset = 8;
+ const csrcOffset = 12;
+ const csrcSize = 4;
++
++// camstack: D868 — SRTP output arena. Every outgoing RTP packet used to cost a
++// Buffer.alloc for the header and a Buffer.concat for header + ciphertext + tag.
++// The packet now lands in a dense slice of a 256 KiB arena that is never reused
++// (a full arena is left to the GC and lives as long as the datagram in flight).
++const CAMSTACK_SRTP_ARENA_BYTES = 262144;
++let camstackSrtpArena = Buffer.allocUnsafeSlow(0);
++let camstackSrtpArenaOffset = 0;
++function camstackSrtpOut(size) {
++    if (size > CAMSTACK_SRTP_ARENA_BYTES >> 2)
++        return Buffer.allocUnsafeSlow(size);
++    if (camstackSrtpArenaOffset + size > camstackSrtpArena.length) {
++        camstackSrtpArena = Buffer.allocUnsafeSlow(CAMSTACK_SRTP_ARENA_BYTES);
++        camstackSrtpArenaOffset = 0;
++    }
++    const out = camstackSrtpArena.subarray(camstackSrtpArenaOffset, camstackSrtpArenaOffset + size);
++    camstackSrtpArenaOffset += size;
++    return out;
++}
++exports.camstackSrtpOut = camstackSrtpOut;
+ /*
+  *  0                   1                   2                   3
+  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+@@ -242,8 +262,9 @@ class RtpHeader {
+         }
+         return size;
+     }
+-    serialize(size) {
+-        const buf = Buffer.alloc(size);
++    serialize(size, into) {
++        // camstack: D868 — SRTP writes the header straight into its output buffer.
++        const buf = into ? into.fill(0, 0, size) : Buffer.alloc(size);
+         let offset = 0;
+         const v_p_x_cc = new src_1.BitWriter(8);
+         v_p_x_cc.set(2, 0, this.version);
+diff --git a/node_modules/werift/lib/rtp/src/srtp/cipher/ctr.js b/node_modules/werift/lib/rtp/src/srtp/cipher/ctr.js
+index e0c1380..13aa5aa 100644
+--- a/node_modules/werift/lib/rtp/src/srtp/cipher/ctr.js
++++ b/node_modules/werift/lib/rtp/src/srtp/cipher/ctr.js
+@@ -28,12 +28,17 @@ class CipherAesCtr extends _1.CipherAesBase {
+         });
+     }
+     encryptRtp(header, payload, rolloverCounter) {
+-        const headerBuffer = header.serialize(header.serializeSize);
++        // camstack: D868 — header, ciphertext and tag in ONE arena slice (no serialize alloc, no concat).
++        const hdrSize = header.serializeSize;
++        const out = rtp_1.camstackSrtpOut(hdrSize + payload.length + this.authTagLength);
++        const headerBuffer = header.serialize(hdrSize, out.subarray(0, hdrSize));
+         const counter = this.generateCounter(header.sequenceNumber, rolloverCounter, header.ssrc, this.srtpSessionSalt);
+         const cipher = (0, crypto_1.createCipheriv)("aes-128-ctr", this.srtpSessionKey, counter);
+         const enc = cipher.update(payload);
+         const authTag = this.generateSrtpAuthTag(rolloverCounter, headerBuffer, enc);
+-        return Buffer.concat([headerBuffer, enc, authTag]);
++        enc.copy(out, hdrSize);
++        authTag.copy(out, hdrSize + enc.length);
++        return out.subarray(0, hdrSize + enc.length + authTag.length);
+     }
+     decryptRtp(cipherText, rolloverCounter) {
+         const header = rtp_1.RtpHeader.deSerialize(cipherText);
+diff --git a/node_modules/werift/lib/rtp/src/srtp/cipher/gcm.js b/node_modules/werift/lib/rtp/src/srtp/cipher/gcm.js
+index 8d9d498..4cdd15b 100644
+--- a/node_modules/werift/lib/rtp/src/srtp/cipher/gcm.js
++++ b/node_modules/werift/lib/rtp/src/srtp/cipher/gcm.js
+@@ -36,15 +36,19 @@ class CipherAesGcm extends _1.CipherAesBase {
+         });
+     }
+     encryptRtp(header, payload, rolloverCounter) {
+-        const hdr = header.serialize(header.serializeSize);
++        // camstack: D868 — header, ciphertext and tag in ONE arena slice (no serialize alloc, no concat).
++        const hdrSize = header.serializeSize;
++        const out = rtp_1.camstackSrtpOut(hdrSize + payload.length + this.aeadAuthTagLen);
++        const hdr = header.serialize(hdrSize, out.subarray(0, hdrSize));
+         const iv = this.rtpInitializationVector(header, rolloverCounter);
+         const cipher = (0, crypto_1.createCipheriv)("aes-128-gcm", this.srtpSessionKey, iv);
+         cipher.setAAD(hdr);
+         const enc = cipher.update(payload);
+         cipher.final();
+         const authTag = cipher.getAuthTag();
+-        const dst = Buffer.concat([hdr, enc, authTag]);
+-        return dst;
++        enc.copy(out, hdrSize);
++        authTag.copy(out, hdrSize + enc.length);
++        return out.subarray(0, hdrSize + enc.length + authTag.length);
+     }
+     decryptRtp(cipherText, rolloverCounter) {
+         const header = rtp_1.RtpHeader.deSerialize(cipherText);
 diff --git a/node_modules/werift/lib/webrtc/src/media/rtpSender.js b/node_modules/werift/lib/webrtc/src/media/rtpSender.js
 index bc85968..64a5304 100644
 --- a/node_modules/werift/lib/webrtc/src/media/rtpSender.js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.582",
+  "version": "1.2.584",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.429",
-    "@camstack/addon-agent-ui": "1.2.236",
+    "@camstack/addon-admin-ui": "1.2.430",
+    "@camstack/addon-agent-ui": "1.2.237",
     "@camstack/addon-auth": "1.2.148",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.135",
-    "@camstack/addon-pipeline": "1.2.371",
-    "@camstack/addon-pipeline-orchestrator": "1.2.325",
-    "@camstack/addon-post-analysis": "1.2.370",
+    "@camstack/addon-pipeline": "1.2.373",
+    "@camstack/addon-pipeline-orchestrator": "1.2.326",
+    "@camstack/addon-post-analysis": "1.2.371",
     "@camstack/develop": "0.1.11",
     "@camstack/sdk": "1.2.132",
-    "@camstack/system": "1.2.438",
-    "@camstack/types": "1.2.374",
-    "@camstack/ui-library": "1.2.292",
+    "@camstack/system": "1.2.439",
+    "@camstack/types": "1.2.375",
+    "@camstack/ui-library": "1.2.293",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",