@camstack/system 1.2.83 → 1.2.85

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ft as nodePin, Ht as EventCategory, St as DeviceType, bt as DeviceFeature, dt as streamQualityLabel, gt as BaseAddon, ht as errMsg, i as BatteryStatusSchema, st as snapshotCapability, w as bareAddonId } from "../../dist-EAvNJD24.mjs";
+import { Ft as nodePin, Ht as EventCategory, St as DeviceType, bt as DeviceFeature, dt as streamQualityLabel, gt as BaseAddon, ht as errMsg, i as BatteryStatusSchema, st as snapshotCapability, w as bareAddonId } from "../../dist-DWuNENzg.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";
@@ -865,6 +865,11 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 	*  currently holding, which is a fleet-wide blank grid after each restart. */
 	linkSecret = null;
 	/**
+	* In-flight `serveLinkDataPlane` attempt, so the retry below cannot start a
+	* second one while the first is still awaiting the settings store.
+	*/
+	linkPlaneAttempt = null;
+	/**
 	* How a full frame becomes a card-sized one. Defaults to the real ffmpeg
 	* resize; injectable so the wrapper's own logic is testable without spawning a
 	* process for every fixture. `JpegResizer` was declared for exactly this and
@@ -893,7 +898,7 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 			if (typeof deviceId === "number") this.evictRemovedDevice(deviceId, "device-unregistered");
 		});
 		await this.serveMediaDataPlane();
-		await this.serveLinkDataPlane();
+		await this.ensureLinkDataPlane();
 		return [{
 			capability: snapshotCapability,
 			provider
@@ -926,6 +931,33 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 		}
 	}
 	/**
+	* Serve the link plane if it is not already served — at init, and again on
+	* the first `getSnapshotLinks` after an attempt that could not finish.
+	*
+	* The retry is not defensive padding, it is the whole reason this wrapper
+	* exists. The plane needs a persisted signing secret, and the secret needs
+	* the settings store; this addon now boots in its OWN process, so "the store
+	* is not answering yet" is a state it can genuinely observe. A one-shot
+	* attempt turns that instant into a permanent condition: `linkDataPlane`
+	* stays null, every `getSnapshotLinks` row answers `url: null`, and every
+	* tile on every grid stays blank until someone restarts the runner. Nothing
+	* in the logs would say why, because nothing failed twice.
+	*
+	* Single-flighted: a burst of link requests joins one attempt.
+	*/
+	async ensureLinkDataPlane() {
+		if (this.linkDataPlane !== null) return;
+		if (this.linkPlaneAttempt !== null) {
+			await this.linkPlaneAttempt;
+			return;
+		}
+		const attempt = this.serveLinkDataPlane().finally(() => {
+			this.linkPlaneAttempt = null;
+		});
+		this.linkPlaneAttempt = attempt;
+		await attempt;
+	}
+	/**
 	* Serve the PUBLIC link plane: `GET /addon/snapshot/link/<deviceId>.jpg?w&v&exp&sig`.
 	*
 	* `access: 'public'` is deliberate and is the only interesting decision here.
@@ -994,20 +1026,42 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 	linkRoutePrefix() {
 		return `/addon/${bareAddonId(this.ctx.id)}/link`;
 	}
-	/** Mint-once-and-persist the signing secret. Null if it cannot be stored — a
-	*  secret held only in memory would break every outstanding link on restart,
-	*  so no plane is better than a plane whose links die unpredictably. */
+	/**
+	* Mint-once-and-persist the signing secret. Null when it cannot be
+	* ESTABLISHED — a secret held only in memory would break every outstanding
+	* link on restart, so no plane is better than a plane whose links die
+	* unpredictably.
+	*
+	* A null is never cached, so the next `getSnapshotLinks` tries again. That
+	* matters now the wrapper runs in its own process: the settings store can be
+	* a moment behind at boot, and this used to be a one-shot.
+	*
+	* The read-back is the gate. `state.get()` cannot distinguish "no secret
+	* yet" from "the store could not be read" — `readAddonStoreWithRetry` gives
+	* up and answers `{}` — so a store that is merely slow reads as empty and
+	* this would mint a SECOND secret over a perfectly good first one, silently
+	* invalidating every link a client is holding. Reading back what we just
+	* wrote is the only evidence available at this layer that the store is
+	* actually answering, and a mismatch means it is not.
+	*/
 	async ensureLinkSecret() {
 		if (this.linkSecret !== null) return this.linkSecret;
 		try {
 			const state = this.state("snapshotLinkSecret", z.string(), "");
-			let secret = await state.get();
-			if (secret === "") {
-				secret = randomUUID().replace(/-/g, "");
-				await state.set(secret);
+			const stored = await state.get();
+			if (stored !== "") {
+				this.linkSecret = stored;
+				return stored;
+			}
+			const minted = randomUUID().replace(/-/g, "");
+			await state.set(minted);
+			const confirmed = await state.get();
+			if (confirmed !== minted) {
+				this.ctx.logger.warn("snapshot: link secret did not persist — deferring the link plane rather than signing with a secret that will not survive", { meta: { confirmedEmpty: confirmed === "" } });
+				return null;
 			}
-			this.linkSecret = secret;
-			return secret;
+			this.linkSecret = minted;
+			return minted;
 		} catch (err) {
 			this.ctx.logger.warn("snapshot: could not establish link signing secret", { meta: { error: errMsg(err) } });
 			return null;
@@ -1038,6 +1092,7 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 	* forward.
 	*/
 	async getSnapshotLinks(input) {
+		await this.ensureLinkDataPlane();
 		const secret = await this.ensureLinkSecret();
 		const expMs = snapshotLinkExpiry(Date.now(), SNAPSHOT_LINK_TTL_MS);
 		const served = this.linkDataPlane !== null && secret !== null;

package/dist/builtins/snapshot/snapshot.addon.d.ts

@@ -81,6 +81,11 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      *  secret that rolled on every boot would invalidate every link a client is
      *  currently holding, which is a fleet-wide blank grid after each restart. */
     private linkSecret;
+    /**
+     * In-flight `serveLinkDataPlane` attempt, so the retry below cannot start a
+     * second one while the first is still awaiting the settings store.
+     */
+    private linkPlaneAttempt;
     /**
      * How a full frame becomes a card-sized one. Defaults to the real ffmpeg
      * resize; injectable so the wrapper's own logic is testable without spawning a
@@ -101,6 +106,22 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      * base64 path.
      */
     private serveMediaDataPlane;
+    /**
+     * Serve the link plane if it is not already served — at init, and again on
+     * the first `getSnapshotLinks` after an attempt that could not finish.
+     *
+     * The retry is not defensive padding, it is the whole reason this wrapper
+     * exists. The plane needs a persisted signing secret, and the secret needs
+     * the settings store; this addon now boots in its OWN process, so "the store
+     * is not answering yet" is a state it can genuinely observe. A one-shot
+     * attempt turns that instant into a permanent condition: `linkDataPlane`
+     * stays null, every `getSnapshotLinks` row answers `url: null`, and every
+     * tile on every grid stays blank until someone restarts the runner. Nothing
+     * in the logs would say why, because nothing failed twice.
+     *
+     * Single-flighted: a burst of link requests joins one attempt.
+     */
+    private ensureLinkDataPlane;
     /**
      * Serve the PUBLIC link plane: `GET /addon/snapshot/link/<deviceId>.jpg?w&v&exp&sig`.
      *
@@ -128,9 +149,24 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      */
     private handleLinkRequest;
     private linkRoutePrefix;
-    /** Mint-once-and-persist the signing secret. Null if it cannot be stored — a
-     *  secret held only in memory would break every outstanding link on restart,
-     *  so no plane is better than a plane whose links die unpredictably. */
+    /**
+     * Mint-once-and-persist the signing secret. Null when it cannot be
+     * ESTABLISHED — a secret held only in memory would break every outstanding
+     * link on restart, so no plane is better than a plane whose links die
+     * unpredictably.
+     *
+     * A null is never cached, so the next `getSnapshotLinks` tries again. That
+     * matters now the wrapper runs in its own process: the settings store can be
+     * a moment behind at boot, and this used to be a one-shot.
+     *
+     * The read-back is the gate. `state.get()` cannot distinguish "no secret
+     * yet" from "the store could not be read" — `readAddonStoreWithRetry` gives
+     * up and answers `{}` — so a store that is merely slow reads as empty and
+     * this would mint a SECOND secret over a perfectly good first one, silently
+     * invalidating every link a client is holding. Reading back what we just
+     * wrote is the only evidence available at this layer that the store is
+     * actually answering, and a mismatch means it is not.
+     */
     private ensureLinkSecret;
     /**
      * Mint signed links for the tiles a surface is rendering — and, in the same

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqiMPPs0.js");
+const require_dist = require("../../dist-DiScsb8j.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
@@ -13,9 +13,16 @@ let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 //#region src/builtins/sqlite-storage/path-guard.ts
 /**
-* Allowed-root containment guard for the filesystem-browse cap. Pure +
-* synchronous so it is trivially unit-testable; the provider applies it AFTER
-* resolving the real path (so symlink escapes are also caught upstream).
+* Guards for the filesystem-browse cap. Pure + synchronous so they are
+* trivially unit-testable; the provider applies containment AFTER resolving the
+* real path (so symlink escapes are also caught upstream).
+*
+* The guard is SPLIT (D115): `assertWithinAllowedRoots` contains WRITES
+* (`createDir`) to the operator's allowed roots, while `assertBrowsablePath`
+* lets read-only discovery (`browse`) see the whole filesystem. Confining
+* discovery to the same roots meant the admin UI could not list `/`, so the
+* path picker could not offer — or even reach — the mounts this node's own
+* storage locations live on.
 */
 /** True iff `candidate` is one of, or nested under, an allowed root. */
 function isWithinAllowedRoots(candidate, allowedRoots) {
@@ -25,17 +32,30 @@ function isWithinAllowedRoots(candidate, allowedRoots) {
 		return norm === r || norm.startsWith(r.endsWith(node_path.sep) ? r : r + node_path.sep);
 	});
 }
-/** Throws unless `candidate` is within an allowed root. */
+/** Throws unless `candidate` is within an allowed root. WRITES only. */
 function assertWithinAllowedRoots(candidate, allowedRoots) {
 	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
 }
+/**
+* Throws unless `candidate` is a browsable path. Read-only discovery is
+* deliberately unconfined — the only requirement is an absolute path, so a
+* relative one can never be resolved against whatever the runner's cwd
+* happens to be.
+*/
+function assertBrowsablePath(candidate) {
+	if (!(0, node_path.isAbsolute)(candidate)) throw new Error(`browse path "${candidate}" must be absolute`);
+}
 //#endregion
 //#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
 /**
-* Per-node filesystem-browse provider. Lists/creates directories under
-* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
-* `filesystem-browse` cap so the admin UI can pick a node + path for a
-* node-local storage location.
+* Per-node filesystem-browse provider. Backs the `filesystem-browse` cap so the
+* admin UI can pick a node + path for a node-local storage location.
+*
+* The two halves are guarded differently (D115): `browse` is read-only
+* discovery and sees the whole filesystem from `/` down, while `createDir`
+* stays contained to the operator's allowed roots. Containing discovery too
+* meant the picker could not list `/`, and therefore could not show the mounts
+* this node's own storage locations already live on.
 */
 var FilesystemBrowseProvider = class {
 	allowedRoots;
@@ -47,8 +67,8 @@ var FilesystemBrowseProvider = class {
 		return [...this.allowedRoots()];
 	}
 	async browse({ path }) {
+		assertBrowsablePath(path);
 		const real = await (0, node_fs_promises.realpath)(path).catch(() => path);
-		assertWithinAllowedRoots(real, await this.resolvedRoots());
 		const entries = (await (0, node_fs_promises.readdir)(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
 			name: d.name,
 			path: (0, node_path.join)(real, d.name)

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,15 +1,22 @@
-import { gt as BaseAddon, ut as storageProviderCapability, z as filesystemBrowseCapability } from "../../dist-EAvNJD24.mjs";
+import { gt as BaseAddon, ut as storageProviderCapability, z as filesystemBrowseCapability } from "../../dist-DWuNENzg.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import * as fs from "node:fs";
 //#region src/builtins/sqlite-storage/path-guard.ts
 /**
-* Allowed-root containment guard for the filesystem-browse cap. Pure +
-* synchronous so it is trivially unit-testable; the provider applies it AFTER
-* resolving the real path (so symlink escapes are also caught upstream).
+* Guards for the filesystem-browse cap. Pure + synchronous so they are
+* trivially unit-testable; the provider applies containment AFTER resolving the
+* real path (so symlink escapes are also caught upstream).
+*
+* The guard is SPLIT (D115): `assertWithinAllowedRoots` contains WRITES
+* (`createDir`) to the operator's allowed roots, while `assertBrowsablePath`
+* lets read-only discovery (`browse`) see the whole filesystem. Confining
+* discovery to the same roots meant the admin UI could not list `/`, so the
+* path picker could not offer — or even reach — the mounts this node's own
+* storage locations live on.
 */
 /** True iff `candidate` is one of, or nested under, an allowed root. */
 function isWithinAllowedRoots(candidate, allowedRoots) {
@@ -19,17 +26,30 @@ function isWithinAllowedRoots(candidate, allowedRoots) {
 		return norm === r || norm.startsWith(r.endsWith(sep) ? r : r + sep);
 	});
 }
-/** Throws unless `candidate` is within an allowed root. */
+/** Throws unless `candidate` is within an allowed root. WRITES only. */
 function assertWithinAllowedRoots(candidate, allowedRoots) {
 	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
 }
+/**
+* Throws unless `candidate` is a browsable path. Read-only discovery is
+* deliberately unconfined — the only requirement is an absolute path, so a
+* relative one can never be resolved against whatever the runner's cwd
+* happens to be.
+*/
+function assertBrowsablePath(candidate) {
+	if (!isAbsolute(candidate)) throw new Error(`browse path "${candidate}" must be absolute`);
+}
 //#endregion
 //#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
 /**
-* Per-node filesystem-browse provider. Lists/creates directories under
-* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
-* `filesystem-browse` cap so the admin UI can pick a node + path for a
-* node-local storage location.
+* Per-node filesystem-browse provider. Backs the `filesystem-browse` cap so the
+* admin UI can pick a node + path for a node-local storage location.
+*
+* The two halves are guarded differently (D115): `browse` is read-only
+* discovery and sees the whole filesystem from `/` down, while `createDir`
+* stays contained to the operator's allowed roots. Containing discovery too
+* meant the picker could not list `/`, and therefore could not show the mounts
+* this node's own storage locations already live on.
 */
 var FilesystemBrowseProvider = class {
 	allowedRoots;
@@ -41,8 +61,8 @@ var FilesystemBrowseProvider = class {
 		return [...this.allowedRoots()];
 	}
 	async browse({ path }) {
+		assertBrowsablePath(path);
 		const real = await realpath(path).catch(() => path);
-		assertWithinAllowedRoots(real, await this.resolvedRoots());
 		const entries = (await readdir(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
 			name: d.name,
 			path: join(real, d.name)

package/dist/builtins/sqlite-storage/path-guard.d.ts

@@ -1,4 +1,11 @@
 /** True iff `candidate` is one of, or nested under, an allowed root. */
 export declare function isWithinAllowedRoots(candidate: string, allowedRoots: readonly string[]): boolean;
-/** Throws unless `candidate` is within an allowed root. */
+/** Throws unless `candidate` is within an allowed root. WRITES only. */
 export declare function assertWithinAllowedRoots(candidate: string, allowedRoots: readonly string[]): void;
+/**
+ * Throws unless `candidate` is a browsable path. Read-only discovery is
+ * deliberately unconfined — the only requirement is an absolute path, so a
+ * relative one can never be resolved against whatever the runner's cwd
+ * happens to be.
+ */
+export declare function assertBrowsablePath(candidate: string): void;

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CqiMPPs0.js");
+const require_dist = require("../../dist-DiScsb8j.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { A as decodeVectorBase64, Et as asJsonObject, Lt as parseJsonUnknown, f as RUNTIME_DEFAULTS, gt as BaseAddon, ht as errMsg, k as dataStoreProviderCapability, mt as vectorStoreCapability, pt as vectorDimFromBase64, w as bareAddonId } from "../../dist-EAvNJD24.mjs";
+import { A as decodeVectorBase64, Et as asJsonObject, Lt as parseJsonUnknown, f as RUNTIME_DEFAULTS, gt as BaseAddon, ht as errMsg, k as dataStoreProviderCapability, mt as vectorStoreCapability, pt as vectorDimFromBase64, w as bareAddonId } from "../../dist-DWuNENzg.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/index.d.ts

@@ -1,8 +1,7 @@
-export { StorageOrchestratorAddon } from './storage-orchestrator.addon.js';
-export { StorageOrchestratorAddon as default } from './storage-orchestrator.addon.js';
-export { StorageOrchestratorService } from './storage-orchestrator.service.js';
-export { StorageMigrationCoordinator } from './storage-migration-coordinator.js';
+export type { ILocationStore } from './location-store.js';
+export { SqliteLocationStore } from './location-store.js';
 export type { FootageMigrationParticipant, LeaseParticipant, MediaMigrationParticipant, MigrationState, StorageMigrationCoordinatorDeps, StorageMigrationParticipants, } from './storage-migration-coordinator.js';
+export { StorageMigrationCoordinator } from './storage-migration-coordinator.js';
+export { StorageOrchestratorAddon, StorageOrchestratorAddon as default, } from './storage-orchestrator.addon.js';
 export type { ListLocationsFilter, StorageProviderLookup } from './storage-orchestrator.service.js';
-export { SqliteLocationStore } from './location-store.js';
-export type { ILocationStore } from './location-store.js';
+export { StorageOrchestratorService } from './storage-orchestrator.service.js';

package/dist/builtins/storage-orchestrator/index.mjs

@@ -1,2 +1,2 @@
-import { StorageOrchestratorAddon, n as SqliteLocationStore, r as StorageOrchestratorService, t as StorageMigrationCoordinator } from "./storage-orchestrator.addon.mjs";
+import { StorageOrchestratorAddon, n as StorageMigrationCoordinator, r as SqliteLocationStore, t as StorageOrchestratorService } from "./storage-orchestrator.addon.mjs";
 export { SqliteLocationStore, StorageMigrationCoordinator, StorageOrchestratorAddon, StorageOrchestratorAddon as default, StorageOrchestratorService };

package/dist/builtins/storage-orchestrator/provider-discovery.d.ts

@@ -1,4 +1,4 @@
-import { IStorageProviderImpl, IStorageCapProvider } from '@camstack/types';
+import { IStorageCapProvider, IStorageProviderImpl } from '@camstack/types';
 /** One entry of the `storage.listProviders` output array. */
 export type StorageProviderListEntry = Awaited<ReturnType<IStorageCapProvider['listProviders']>>[number];
 /**

package/dist/builtins/storage-orchestrator/storage-migration-coordinator.d.ts

@@ -1,4 +1,4 @@
-import { RelocateJob, StorageMigrationFootageMoveInput, StorageMigrationMediaMoveInput, StorageMigrationInput, StorageMigrationJob, StorageMigrationPlan } from '@camstack/types';
+import { RelocateJob, StorageMigrationFootageMoveInput, StorageMigrationInput, StorageMigrationJob, StorageMigrationMediaMoveInput, StorageMigrationPlan } from '@camstack/types';
 import { StorageOrchestratorService } from './storage-orchestrator.service.js';
 export interface MigrationState {
     get(): Promise<StorageMigrationJob | null>;

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.d.ts

@@ -1,4 +1,4 @@
-import { BaseAddon, ProviderRegistration } from '@camstack/types';
+import { ProviderRegistration, BaseAddon } from '@camstack/types';
 interface StorageOrchestratorConfig extends Record<string, unknown> {
 }
 export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestratorConfig> {