0.49.0

Breaking

• The server section names its listeners. server.bind replaces server.host,
  server.https (port, certificate, min-version) replaces server.ssl,
  and server.http (port, redirect) serves plain HTTP. server.host, server.port, and
  server.ssl are rejected, so rewrite them before upgrading. server.port: 8080 becomes
  server.http.port: 8080, or server.https.port: 8080 beside a former server.ssl. Its
  cert, key, and key-password move under certificate as path, key, and
  key-password, its version gives way to min-version, "1.2" by default or "1.3", and
  its ca-certs has no counterpart, so drop it.
• The engine no longer creates a local/ directory in the project. A SQLite database still
  creates the directories leading to its file, and ceres service creates the directories of
  its log files.
• The CLI finds a running engine through .ceres/server.json in the project instead of a file
  under /tmp, so restart a running engine after upgrading.
• Serialized data objects name their fields as the YAML does, so API responses carry class
  rather than cls and an entity filter carries or and and rather than or__ and and__.
  Both spellings are still read.

Engine

• A procedure's docstring is parsed, Google sections and Sphinx fields alike. Its arguments' text
  becomes their fields' descriptions in the arguments schema, the schema's description keeps only
  the prose, and procedures in the components listing carry returns and raises.
• The server offers HTTP/2 over a server.https listener. Browsers then multiplex every
  console request over one connection, which lifts the six-connection limit that stalled a
  dashboard with more than a few live video widgets.
• server.http.redirect turns the HTTP listener into one that temporarily redirects every
  request to the same path and query on the HTTPS listener, so http:// bookmarks keep
  working after a move to HTTPS.
• An empty server.https section listens on port 443 with the certificate and key at
  .ceres/tls/server.crt and .ceres/tls/server.key. ceres check and startup fail when the
  certificate or key cannot be loaded, and name ceres generate certificate and
  certificate: auto when either file is missing.
• server.https.certificate: auto has Ceres issue and renew the HTTPS certificate itself,
  signed by a certificate authority it creates once in .ceres/tls, or by the one auto.ca
  names, which has to exist, be allowed to sign certificates, and fit its key. Startup and a
  daily check issue a new certificate when it has less than 30 days left, or less than a third
  of its lifetime for one valid under 90 days, lacks a configured or detected name, or another
  authority signed it, and the running listener presents it without a restart. From 30 days
  before the authority itself expires, they warn that it needs replacing, since Ceres never
  renews it. auto takes ip, dns, and days, 365
  by default and at most 825.
• Every listener serves a managed certificate's authority at /ca.crt, the redirecting one
  included, and the console's login page links to a page with the download, the authority's
  fingerprint, and steps for trusting it on each operating system.
• Ceres keeps machine-local state in a .ceres directory next to ceres.yaml, which carries
  its own .gitignore.
• rtsp() streams of one source share one connection to it when they use the same copy,
  transport, and stall_timeout, so a source allowing few sessions serves any number of
  viewers. A viewer joining starts from the latest keyframe, a viewer reading too slowly skips
  to the next keyframe and holds up no one else, and the connection stays open three
  seconds after its last viewer leaves so a reloaded page finds it open. A stream without
  reconnect ends on a lost source while the others reconnect.
• rtsp() streams report what happens to the source as events: StreamLostEvent once per
  outage, StreamReconnectScheduledEvent for its first reconnect attempt,
  StreamReconnectedEvent with the attempts and length of the outage, and StreamEndedEvent
  when the stream ends on its own. A stream returned from a procedure reports on that
  procedure's component. Code reading rtsp() itself passes component= to get them.
• Live video plays over WebRTC when the new server.webrtc section is present: port (UDP
  8189 at server.bind), hosts to advertise, max-sessions (32), and no-ice-timeout
  (10 s). A browser posts its offer to /api/components/{id}/procedures/{name}/whep for a
  procedure returning an rtsp() stream, and H.264 and H.265 are sent as the source sends them.
  Open the UDP port in the firewall, or every video plays over HTTP.
• WebRTC refuses a source whose frames arrive out of display order, as B-frames make them, with
  409 reordered, since a browser would play them back and forth. ?reordered=drop drops the
  frames nothing references and sends the rest at a lower frame rate.
• Moving a workspace to another component, or to the engine root, needs view on the destination
  for a private workspace and manage for a shared one. Widget addresses relative to the old
  component are rewritten so they keep pointing at the same components.

CLI

• New ceres generate certificate issues the HTTPS certificate and key, an ECDSA P-256 pair
  signed by the certificate authority, naming localhost, the loopback addresses, the hostname,
  and the machine's interface addresses, or the auto names, plus any --ip and --dns
  names. Under certificate: auto it runs the issuance startup runs and only writes a
  certificate that is due, otherwise it refuses to replace existing files. --force replaces
  them either way and --days sets the lifetime, 365 days by default. It prints the authority
  to trust, the names, the expiry, and the SHA-256 fingerprint.
• ceres check and engine startup warn when an HTTPS certificate Ceres does not manage expires
  within 30 days. Under certificate: auto, ceres check reports what startup is about to
  issue, and warns when the certificate authority expires within 30 days.
• ceres run --development-source serves the engine over plain HTTP alone, leaving any
  server.https listener out, so the console dev server can proxy to it and a project
  without a certificate still runs.

Web Console

• Video widgets reconnect on their own when the stream drops, ends, stands still for ten
  seconds, or never answers, at once and then every five seconds. The last frame stays up
  meanwhile, with a small countdown in the corner. A new "Reconnect" setting, on by default,
  brings back the error box instead.
• Descriptions render as Markdown and are cut to three lines with a "Show more" when longer.
• A procedure's docstring is split into its prose, its arguments' text, shown under each
  argument's field, and what it returns and raises, shown beside the result. Google sections and
  Sphinx fields are both read.
• Control buttons can call queries as well as actions, under a "Procedure" field. A query's
  result shows under the arguments form when the button asks for arguments, or otherwise in a
  popup that can run the query again. A new query button runs without asking first. Queries
  returning a file or a stream are not offered.
• The workspaces section says "No workspaces yet." with a create button for each kind of
  workspace on one line when it is empty, and an empty group shrinks to one line naming what
  it lacks. Create buttons sit beside their group's label.
• A workspace's "Move" picks its location, the engine root or any component, and dragging a
  workspace onto a component in the sidebar moves it there.
• A "Section" widget groups widgets under a collapsible header, beside tabs and carousel.
• Live video plays over WebRTC where the server and browser allow, for the lowest latency, and
  otherwise over HTTP. A "Transport" setting picks "Automatic", "WebRTC", or "HTTP". The
  header names the transport, and clicking it cycles the setting. On "Automatic" the settings
  say why HTTP was chosen.
• Live video over HTTP stays within seconds of its source. It plays faster, up to 3x, when
  behind, and jumps forward when more than five seconds behind.
• Video widgets have their own controls: play, mute, a seek bar over the buffered video, a
  "Live" button that returns to the newest frame, and fullscreen. Space toggles play.
• A video in a codec the browser cannot decode says which codec and what to try.
• Cmd/Ctrl+S commits a workspace. A private workspace's commit can skip its confirmation, from
  the dialog or Preferences.
• A widget with no component set uses its workspace's component, shown as "(Default)", and
  follows the workspace when it moves.

Fixes

• Report every workspace commit. The console shows a toast while the commit runs, a success toast
  when it lands, and an error toast naming the cause when it fails. A commit or draft save the
  browser cannot send within 15 seconds, which happens when video widgets hold every connection
  the browser allows to the server, now fails with that message instead of hanging silently.
• Dismissing the "Commit Changes" dialog with Escape no longer commits.
• A procedure returning a stream or a file now reports how its call ended. A returned file
  completes the call. A returned stream ends it when it closes, with ProcedureCompletedEvent
  when it ran out, ProcedureExceptionEvent when reading it raised, and
  ProcedureCancelledEvent when it closed early, such as a client leaving a live video view.
  Before, such a call reported ProcedureCalledEvent and nothing after it.
• Pressing a locked control button no longer opens its arguments popup as well as running it.