@camstack/server 1.2.72 → 1.2.74

package/dist/core/auth/share-token.service.js

@@ -98,15 +98,38 @@ function parseShareToken(data) {
 class ShareTokenService {
     getStore;
     logger;
+    /**
+     * Declaration is one-time per process; reset only if the backend itself
+     * is swapped (it never is at runtime — the getter is lazy solely because
+     * the sqlite builtin registers after this service is constructed).
+     */
+    collectionDeclared = false;
     constructor(getStore, logger = null) {
         this.getStore = getStore;
         this.logger = logger;
     }
-    store() {
+    /**
+     * Resolve the backend AND ensure `share_view_tokens` is declared before
+     * the first operation. The structured settings backend fail-closes on
+     * undeclared collections; this KV shape (`id` PK + `data` TEXT) is
+     * byte-identical to what the legacy on-demand path created, so existing
+     * rows keep working with no migration.
+     */
+    async store() {
         const store = this.getStore();
         if (!store) {
             throw new Error('Share tokens unavailable — settings backend not ready');
         }
+        if (!this.collectionDeclared) {
+            await store.declareCollection({
+                collection: SHARE_TOKENS_COLLECTION,
+                columns: [
+                    { name: 'id', type: 'TEXT', primaryKey: true, notNull: true },
+                    { name: 'data', type: 'TEXT', notNull: true },
+                ],
+            });
+            this.collectionDeclared = true;
+        }
         return store;
     }
     /**
@@ -137,7 +160,7 @@ class ShareTokenService {
             createdAt: now,
             expiresAt: ttlSec === 'never' ? null : now + ttlSec * 1000,
         };
-        await this.store().insert({
+        await (await this.store()).insert({
             collection: SHARE_TOKENS_COLLECTION,
             record: { id: record.id, data: { ...record } },
         });
@@ -161,7 +184,7 @@ class ShareTokenService {
         if (!rawToken.startsWith(exports.SHARE_TOKEN_PREFIX))
             return null;
         const tokenHash = crypto.createHash('sha256').update(rawToken).digest('hex');
-        const results = await this.store().query({
+        const results = await (await this.store()).query({
             collection: SHARE_TOKENS_COLLECTION,
             filter: { where: { tokenHash } },
         });
@@ -186,7 +209,7 @@ class ShareTokenService {
      * permission mismatch so the router surfaces a FORBIDDEN.
      */
     async revoke(input) {
-        const results = await this.store().query({
+        const results = await (await this.store()).query({
             collection: SHARE_TOKENS_COLLECTION,
             filter: { where: { id: input.id } },
         });
@@ -196,13 +219,13 @@ class ShareTokenService {
         const record = parseShareToken(first.data);
         if (!record) {
             // Corrupt record — delete it regardless (it can never validate).
-            await this.store().delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
+            await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
             return true;
         }
         if (!input.callerIsAdmin && record.userId !== input.callerUserId) {
             throw new Error('Only the token owner or an admin can revoke a share token');
         }
-        await this.store().delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
+        await (await this.store()).delete({ collection: SHARE_TOKENS_COLLECTION, key: input.id });
         this.logger?.info('Share token revoked', {
             meta: { id: record.id, byUserId: input.callerUserId },
         });
@@ -210,7 +233,7 @@ class ShareTokenService {
     }
     /** Every share token minted by `userId`, expired ones included. */
     async listForUser(userId) {
-        const results = await this.store().query({
+        const results = await (await this.store()).query({
             collection: SHARE_TOKENS_COLLECTION,
             filter: { where: { userId } },
         });
@@ -218,14 +241,14 @@ class ShareTokenService {
     }
     /** All share tokens (admin listing). */
     async listAll() {
-        const results = await this.store().query({
+        const results = await (await this.store()).query({
             collection: SHARE_TOKENS_COLLECTION,
             filter: {},
         });
         return results.map((r) => parseShareToken(r.data)).filter((r) => r !== null);
     }
     async touchLastUsed(record) {
-        await this.store().update({
+        await (await this.store()).update({
             collection: SHARE_TOKENS_COLLECTION,
             id: record.id,
             data: { ...record, lastUsedAt: Date.now() },

package/dist/main.js

@@ -42,6 +42,7 @@ const ws_1 = require("@trpc/server/adapters/ws");
 const static_1 = __importDefault(require("@fastify/static"));
 const compress_1 = __importDefault(require("@fastify/compress"));
 const cookie_1 = __importDefault(require("@fastify/cookie"));
+const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
 const ws_2 = require("ws");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -223,7 +224,16 @@ async function bootstrap() {
     // replaces — so the telemetry reaches a running hub the same day it is
     // written. See packages/system/src/kernel/heap-watch.ts for why it exists
     // (four silent OOMs in ~15h, one nine seconds after a viewer connected).
-    (0, system_2.startHeapWatch)();
+    //
+    // The reclaimer is what turns the heartbeat from a report into a fix. hub-main's
+    // RSS is a HIGH-WATER MARK — measured over 1019 samples and seven boots, it never
+    // once fell below the running maximum of heapTotal+external — because V8 keeps the
+    // 256KB pages it committed at a sawtooth peak, and an ordinary major GC does not
+    // return them. `createV8Reclaimer()` returns undefined if V8 declines, and the
+    // heartbeat then behaves exactly as it did before.
+    const heapReclaimer = (0, system_2.createV8Reclaimer)();
+    const heapReclaim = heapReclaimer === undefined ? undefined : { reclaim: heapReclaimer };
+    (0, system_2.startHeapWatch)('hub-main', undefined, undefined, heapReclaim);
     // Clean up orphaned processes from previous crashes before starting
     cleanupOrphanProcesses();
     // SPA fallback — set later when admin UI is resolved, used by addon route catch-all
@@ -252,6 +262,13 @@ async function bootstrap() {
     // Registered before @fastify/static so the compress plugin wraps the
     // static send path — hashed admin-ui chunks go from ~2MB to ~600KB on
     // the wire. threshold:1024 skips compression for tiny payloads.
+    //
+    // SSE opt-out FIRST: without it a gzipped low-rate event stream starves
+    // silently in the compressor buffer — see `api/sse-no-compression.ts` for
+    // the mechanism and the live measurement.
+    fastify.addHook('onRequest', async (request) => {
+        (0, sse_no_compression_js_1.markSseRequestNoCompression)(request);
+    });
     await fastify.register(compress_1.default, { global: true, threshold: 1024 });
     // Data-plane POST bodies: the addon reverse-proxy (`proxyToUpstream`) pipes
     // `request.raw` upstream, but Fastify's default application/json parser would

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.72",
+  "version": "1.2.74",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.33",
+    "@camstack/addon-admin-ui": "1.2.35",
     "@camstack/addon-agent-ui": "1.2.10",
     "@camstack/addon-auth": "1.2.11",
     "@camstack/addon-decoder-nodeav": "1.2.9",
     "@camstack/addon-notifiers": "1.2.13",
-    "@camstack/addon-pipeline": "1.2.44",
-    "@camstack/addon-pipeline-orchestrator": "1.2.27",
-    "@camstack/addon-post-analysis": "1.2.49",
+    "@camstack/addon-pipeline": "1.2.46",
+    "@camstack/addon-pipeline-orchestrator": "1.2.29",
+    "@camstack/addon-post-analysis": "1.2.51",
     "@camstack/sdk": "1.2.10",
     "@camstack/shm-ring": "1.1.9",
-    "@camstack/system": "1.2.59",
-    "@camstack/types": "1.2.43",
-    "@camstack/ui-library": "1.2.31",
+    "@camstack/system": "1.2.61",
+    "@camstack/types": "1.2.45",
+    "@camstack/ui-library": "1.2.33",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",