camstack 1.2.33 → 1.2.35

package/dist/cli.js

@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-LXP37XH2.js");
+  await import("./launcher-IU5FZCJX.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-LXP37XH2.js");
+  await import("./launcher-IU5FZCJX.js");
 }
 
 // src/commands/setup.ts

package/dist/{launcher-LXP37XH2.js → launcher-IU5FZCJX.js}

@@ -60548,7 +60548,7 @@ var require_device_manager_addon = __commonJS({
     }
     async function listPersistedByAddon(pctx, input) {
       const { addonId } = input;
-      const [index, meta] = await Promise.all([pctx.metaStore.readIndex(), pctx.metaStore.readMeta()]);
+      const { index, meta } = await pctx.metaStore.readAll();
       const stableIds = index[addonId] ?? [];
       const byStableId = /* @__PURE__ */ new Map();
       for (const m of Object.values(meta)) if (m.addonId === addonId) byStableId.set(m.stableId, m);
@@ -60573,8 +60573,7 @@ var require_device_manager_addon = __commonJS({
       const camerasOnly = input.isCamera === true;
       const results = [];
       const seen = /* @__PURE__ */ new Set();
-      const meta = await pctx.metaStore.readMeta();
-      const metadataMap = await pctx.metaStore.readMetadataMap();
+      const { meta, metadata: metadataMap, index } = await pctx.metaStore.readAll();
       if (pctx.registry) {
         const liveEntries = addonId ? pctx.registry.getAllForAddon(addonId).map((device) => ({
           addonId,
@@ -60592,7 +60591,6 @@ var require_device_manager_addon = __commonJS({
           } : info);
         }
       }
-      const index = await pctx.metaStore.readIndex();
       const metaByAddonStable = /* @__PURE__ */ new Map();
       for (const m of Object.values(meta)) metaByAddonStable.set(`${m.addonId}\0${m.stableId}`, m);
       const targetAddons = addonId ? [addonId] : Object.keys(index);
@@ -60690,11 +60688,7 @@ var require_device_manager_addon = __commonJS({
       }
       const results = [];
       const seen = /* @__PURE__ */ new Set();
-      const [index, meta, metadataMap] = await Promise.all([
-        pctx.metaStore.readIndex(),
-        pctx.metaStore.readMeta(),
-        pctx.metaStore.readMetadataMap()
-      ]);
+      const { index, meta, metadata: metadataMap } = await pctx.metaStore.readAll();
       if (pctx.registry) {
         const liveChildren = pctx.registry.getChildren(parentDeviceId);
         for (const device of liveChildren) {
@@ -62863,8 +62857,61 @@ var require_device_manager_addon = __commonJS({
         this.settings = settings;
         this.registry = registry;
       }
+      /** The read currently in flight, or null. Never a settled value — see
+      *  {@link readStore}. */
+      inFlightRead = null;
+      /**
+      * The whole persisted addon store.
+      *
+      * **Concurrent callers join the read already in flight.** This is not a
+      * cache and nothing survives settlement: a caller that awaited the running
+      * promise could not have observed anything older than its result, so the
+      * only thing that changes is cost. What that cost was, measured on the
+      * 2026-08-19 boot: `readAddonStore` lands in `SqliteSettingsBackend
+      * .getAllAddon`, which reads and `JSON.parse`s this addon's rows —
+      * 625 KB on the live hub (`deviceMeta` 467 KB + `deviceMetadata` 87 KB +
+      * `deviceIndex` 70 KB) — synchronously, on the hub's event loop. A V8
+      * profile of that boot had hub-main's JS thread 99.9% busy with 64% of it
+      * inside `getAllAddon`, ~89% of that entered here, and every runner's first
+      * store read queued behind it (the notification centre's six parallel reads
+      * all resolved together at t+44.7 s).
+      *
+      * A rejection is NOT latched: the slot is cleared before the promise
+      * settles either way, so a failed read costs the joiners that one failure
+      * and the next caller reaches the store again.
+      */
       readStore = async () => {
-        return await this.settings.readAddonStore();
+        const existing = this.inFlightRead;
+        if (existing !== null) return existing;
+        const read = (async () => {
+          try {
+            return await this.settings.readAddonStore();
+          } finally {
+            this.inFlightRead = null;
+          }
+        })();
+        this.inFlightRead = read;
+        return read;
+      };
+      /**
+      * The three fleet projections from ONE read.
+      *
+      * `listAll` asked for `deviceMeta`, then `deviceMetadata`, then
+      * `deviceIndex` — three SEQUENTIAL awaits, which {@link readStore}'s
+      * in-flight join cannot collapse because each starts after the previous one
+      * settled. Three full 625 KB parses per call, on a call made once per device
+      * lifecycle event during a 974-device boot: 23% of hub-main's CPU.
+      *
+      * It is also ONE snapshot. Three separate reads could straddle a write and
+      * hand back an index that names a device the meta map no longer has.
+      */
+      readAll = async () => {
+        const store = await this.readStore();
+        return {
+          index: store.deviceIndex ?? {},
+          meta: store.deviceMeta ?? {},
+          metadata: store.deviceMetadata ?? {}
+        };
       };
       readIndex = async () => {
         return (await this.readStore()).deviceIndex ?? {};
@@ -74542,6 +74589,20 @@ var require_sqlite_settings_addon = __commonJS({
         params
       };
     }
+    var MAX_ASCII = 127;
+    function prefixRange(prefix) {
+      if (prefix.length === 0) return null;
+      for (let i = 0; i < prefix.length; i++) {
+        const code = prefix.charCodeAt(i);
+        if (code === 0 || code > MAX_ASCII) return null;
+      }
+      const last = prefix.charCodeAt(prefix.length - 1);
+      if (last >= MAX_ASCII) return null;
+      return {
+        lo: prefix,
+        hi: prefix.slice(0, -1) + String.fromCharCode(last + 1)
+      };
+    }
     var SETTINGS_QUERY_DEFAULT_ROW_CAP = 2e3;
     var SETTINGS_QUERY_HARD_ROW_CAP = 2e4;
     function resolveRowBound(requested) {
@@ -74562,20 +74623,6 @@ var require_sqlite_settings_addon = __commonJS({
     function isImposedBound(source) {
       return source !== "caller";
     }
-    var MAX_ASCII = 127;
-    function prefixRange(prefix) {
-      if (prefix.length === 0) return null;
-      for (let i = 0; i < prefix.length; i++) {
-        const code = prefix.charCodeAt(i);
-        if (code === 0 || code > MAX_ASCII) return null;
-      }
-      const last = prefix.charCodeAt(prefix.length - 1);
-      if (last >= MAX_ASCII) return null;
-      return {
-        lo: prefix,
-        hi: prefix.slice(0, -1) + String.fromCharCode(last + 1)
-      };
-    }
     function parseRowData(raw) {
       return require_dist10.asJsonObject(require_dist10.parseJsonUnknown(raw)) ?? {};
     }
@@ -74958,10 +75005,33 @@ var require_sqlite_settings_addon = __commonJS({
         const rows = this.getDb().prepare('SELECT id, data FROM "system-settings"').all();
         return Object.fromEntries(rows.map((r) => [r.id, JSON.parse(r.data)]));
       }
-      /** Get all settings for an addon */
+      /**
+      * Get all settings for an addon.
+      *
+      * Selected by the SAME key range {@link setAllAddon} deletes and re-inserts
+      * — `prefixWhere("<addonId>.")` — and for the same reason `getAllScoped`
+      * uses it: `"<addonId>.<key>"` is the PRIMARY KEY, so the range is a
+      * `SEARCH … USING INDEX` while anything else is a full `SCAN`.
+      *
+      * It used to select on `json_extract(data, '$.addonId')`, which is a second
+      * authority for "this addon's rows" and disagreed with the writer in both
+      * directions: a row inside the JSON's idea of the addon but outside the key
+      * range was READ and never DELETED (a config key that could not be cleared),
+      * and `json_extract` was evaluated on EVERY row — so a four-key addon paid
+      * for the whole table and one unparseable neighbour aborted the statement,
+      * taking out every addon's config read at once.
+      *
+      * The cost was not theoretical. On the live hub `addon-settings` is 627 KB
+      * in 24 rows, 625 KB of it device-manager's three fleet blobs; a V8 profile
+      * of a boot (2026-08-19) had hub-main's JS thread 99.9% busy with **64% of
+      * it inside this method**, which is what put a ~45 s queue in front of every
+      * runner's first store read. Measured on that table: 0.947 ms → ~0.02 ms for
+      * a four-key addon, 2.90 ms → 2.13 ms for device-manager's own.
+      */
       getAllAddon(addonId) {
         this.requireDeclared("addon-settings");
-        const rows = this.getDb().prepare(`SELECT id, data FROM "addon-settings" WHERE json_extract(data, '$.addonId') = ?`).all(addonId);
+        const where = this.prefixWhere(`${addonId}.`);
+        const rows = this.getDb().prepare(`SELECT id, data FROM "addon-settings" WHERE ${where.sql}`).all(...where.params);
         if (rows.length === 0) return {};
         const result = {};
         for (const row of rows) {
@@ -396909,7 +396979,7 @@ var require_trpc_context = __commonJS({
       }
       return null;
     }
-    async function resolveUser(token2, authService, addonRegistry, shareTokens = null) {
+    async function resolveUser(token2, authService, addonRegistry, shareTokens = null, logger = null) {
       if (!token2)
         return null;
       if (token2.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
@@ -396971,8 +397041,14 @@ var require_trpc_context = __commonJS({
         if (typeof payload.isAdmin !== "boolean") {
           return null;
         }
-        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
         const principal = (0, types_1.classifyBearerPrincipal)(payload);
+        if (principal.kind === "not-a-credential") {
+          logger?.warn("trpc: refused a bearer that is not an API credential", {
+            meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? "unknown" }
+          });
+          return null;
+        }
+        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
         return {
           id: payload.userId ?? payload.keyId ?? "unknown",
           username: payload.username ?? "unknown",
@@ -397035,19 +397111,19 @@ var require_trpc_context = __commonJS({
       };
       return { user };
     }
-    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null) {
+    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
       const token2 = extractTokenFromRequest(req);
       return {
-        user: await resolveUser(token2, authService, addonRegistry, shareTokens),
+        user: await resolveUser(token2, authService, addonRegistry, shareTokens, logger),
         req,
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
         deviceFleet: () => addonRegistry.getPersistedDeviceList()
       };
     }
-    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null) {
+    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
       const paramToken = opts.info.connectionParams?.["token"];
       const token2 = (typeof paramToken === "string" ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-      const user = await resolveUser(token2, authService, addonRegistry, shareTokens);
+      const user = await resolveUser(token2, authService, addonRegistry, shareTokens, logger);
       return {
         user,
         req: opts.req,
@@ -401902,6 +401978,58 @@ var require_runner_spawn_fanout = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/addon/single-flight-refresh.js
+var require_single_flight_refresh = __commonJS({
+  "../../server/backend/dist/core/addon/single-flight-refresh.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.createSingleFlightRefresh = createSingleFlightRefresh;
+    function createSingleFlightRefresh(run) {
+      let inFlight = null;
+      let pending = false;
+      let pendingPromise = null;
+      let releasePending = () => {
+      };
+      const start = () => {
+        const active = (async () => {
+          try {
+            await run();
+          } finally {
+            inFlight = null;
+            if (pending) {
+              pending = false;
+              const release = releasePending;
+              releasePending = () => {
+              };
+              pendingPromise = null;
+              void start().finally(release);
+            }
+          }
+        })();
+        inFlight = active;
+        return active;
+      };
+      return {
+        request: async () => {
+          if (inFlight === null) {
+            await start();
+            return;
+          }
+          if (!pending) {
+            pending = true;
+            pendingPromise = new Promise((resolve) => {
+              releasePending = resolve;
+            });
+          }
+          const wait = pendingPromise;
+          if (wait !== null)
+            await wait;
+        }
+      };
+    }
+  }
+});
+
 // ../../server/backend/dist/core/addon/addon-registry.service.js
 var require_addon_registry_service = __commonJS({
   "../../server/backend/dist/core/addon/addon-registry.service.js"(exports) {
@@ -401964,6 +402092,7 @@ var require_addon_registry_service = __commonJS({
     var require_cache_js_1 = require_require_cache();
     var runner_convergence_1 = require_runner_convergence();
     var runner_spawn_fanout_js_1 = require_runner_spawn_fanout();
+    var single_flight_refresh_js_1 = require_single_flight_refresh();
     function shouldEvictMissingOnDisk(entry, id, onDiskIds) {
       return entry.source === "installed" && entry.packageName !== "@camstack/system" && !onDiskIds.has(id);
     }
@@ -402759,11 +402888,18 @@ var require_addon_registry_service = __commonJS({
         }
         return out;
       };
+      /** One full-fleet rebuild in flight, at most one queued behind it. Every
+       *  event below asks for the SAME total rebuild, so running it once per event
+       *  was ~1 000 rebuilds of a 974-row mirror on a boot — each one a 625 KB read
+       *  and parse on hub-main's event loop. No timer: the first event still
+       *  refreshes immediately, because this mirror backs scope enforcement.
+       *  See `single-flight-refresh.ts`. */
+      deviceMirrorGate = (0, single_flight_refresh_js_1.createSingleFlightRefresh)(() => this.refreshDeviceParentMirror());
       /** Subscribe the mirror to every device-meta lifecycle event, and warm it once
        *  the addon set (device-manager included) is up. */
       wireDeviceParentMirror() {
         const refresh = () => {
-          void this.refreshDeviceParentMirror();
+          void this.deviceMirrorGate.request();
         };
         for (const category of [
           types_1.EventCategory.DeviceMetaChanged,
@@ -408917,7 +409053,16 @@ var require_main4 = __commonJS({
           prefix: "/trpc",
           trpcOptions: {
             router: appRouter,
-            createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService),
+            createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(
+              req,
+              authService,
+              addonRegistry,
+              shareTokenService,
+              // A bearer refused for NOT being an API credential never reaches a
+              // procedure, so `onError` below never sees it — the refusal would
+              // be silent without this. Same reason `gateAddonJwt` logs (D103).
+              app.get(logging_service_1.LoggingService).createLogger("tRPC")
+            ),
             onError: ({ path: trpcPath, error, ctx }) => {
               const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC");
               trpcLogger.warn("tRPC error", {
@@ -409311,7 +409456,7 @@ var require_main4 = __commonJS({
         (0, ws_1.applyWSSHandler)({
           wss,
           router: appRouter,
-          createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService),
+          createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws")),
           onError: ({ path: trpcPath, error, ctx }) => {
             const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC:ws");
             trpcLogger.warn("tRPC error", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.33",
+  "version": "1.2.35",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",