@camstack/server 1.2.104 → 1.2.105

package/dist/api/core/addon-settings.router.js

@@ -77,7 +77,7 @@ function createAddonSettingsRouter(cfg) {
          * Read the addon-global settings record for the given addon.
          * Returns the raw stored values (no defaults, no device overrides).
          */
-        getGlobal: trpc_middleware_js_1.protectedProcedure
+        getGlobal: trpc_middleware_js_1.adminProcedure
             .input(AddonIdInputSchema)
             .output(AddonSettingsRecordSchema)
             .query(({ input }) => cfg.getAddonConfig(input.addonId)),
@@ -86,7 +86,7 @@ function createAddonSettingsRouter(cfg) {
          * Returns the raw stored values (schema filtering happens on the
          * consumer side at merge time).
          */
-        getDeviceOverrides: trpc_middleware_js_1.protectedProcedure
+        getDeviceOverrides: trpc_middleware_js_1.adminProcedure
             .input(AddonDeviceInputSchema)
             .output(AddonSettingsRecordSchema)
             .query(({ input }) => cfg.getAddonDevice(input.addonId, input.deviceId)),
@@ -97,7 +97,7 @@ function createAddonSettingsRouter(cfg) {
          * writes from addon code; bulk updates should use a dedicated admin
          * endpoint (not exposed here).
          */
-        updateGlobal: trpc_middleware_js_1.protectedProcedure
+        updateGlobal: trpc_middleware_js_1.adminProcedure
             .input(UpdateGlobalInputSchema)
             .output(SuccessSchema)
             .mutation(({ input }) => {
@@ -113,7 +113,7 @@ function createAddonSettingsRouter(cfg) {
          * responsibility — we preserve the raw shape at this layer so the
          * resolver contract remains symmetric with `getDeviceOverrides`.
          */
-        updateDevice: trpc_middleware_js_1.protectedProcedure
+        updateDevice: trpc_middleware_js_1.adminProcedure
             .input(UpdateDeviceInputSchema)
             .output(SuccessSchema)
             .mutation(({ input }) => {
@@ -130,7 +130,7 @@ function createAddonSettingsRouter(cfg) {
          * `updateGlobal` (single-field merge), this overwrites the full record.
          * Admin-level write: only workers with valid hub tokens can call this.
          */
-        replaceGlobal: trpc_middleware_js_1.protectedProcedure
+        replaceGlobal: trpc_middleware_js_1.adminProcedure
             .input(ReplaceGlobalInputSchema)
             .output(SuccessSchema)
             .mutation(({ input }) => {

package/dist/api/core/auth.router.js

@@ -24,6 +24,7 @@ const share_token_service_js_1 = require("../../core/auth/share-token.service.js
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 // ── Public-auth rate limiting ────────────────────────────────────────
 // The public surface below (credential validation, passkey ceremonies,
@@ -881,9 +882,30 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
+            // SECURITY (F0.4): a share token is a PRIVILEGE HANDOFF — it authorises
+            // whoever holds the link to view its devices with no further auth. A
+            // scoped (non-admin) minter must therefore not be able to mint for a
+            // device it cannot itself see: without this, a `device:[5]` token could
+            // mint a `csv_*` grid link for cameras 5..99. Admins mint anything;
+            // every other caller's requested deviceIds are INTERSECTED with what
+            // they can view (device:[parent] covers child accessories via the
+            // ancestor walk). An empty intersection is a refusal, not a silent
+            // "share nothing".
+            const scope = ctx.user.isAdmin
+                ? input.scope
+                : {
+                    ...input.scope,
+                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.getDeviceAncestors),
+                };
+            if (scope.deviceIds.length === 0) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
+                });
+            }
             const { token, record } = await service.create({
                 userId: ctx.user.id,
-                scope: input.scope,
+                scope,
                 ...(input.ttlSec !== undefined ? { ttlSec: input.ttlSec } : {}),
             });
             return { id: record.id, token, expiresAt: record.expiresAt };

package/dist/api/core/event-bus-proxy.router.js

@@ -89,7 +89,7 @@ function serializeRecentEvent(e) {
 }
 function createEventBusProxyRouter(eventBus) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        emit: trpc_middleware_js_1.protectedProcedure
+        emit: trpc_middleware_js_1.adminProcedure
             .input(SystemEventInputSchema)
             .output(zod_1.z.object({ ok: zod_1.z.literal(true) }))
             .mutation(({ input }) => {

package/dist/api/core/live-events.router.js

@@ -10,6 +10,7 @@ exports.createLiveEventsRouter = createLiveEventsRouter;
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const share_view_access_js_1 = require("../trpc/share-view-access.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 // The pushed wire shape is `SystemEvent` from @camstack/types — the exact
 // type `EventBusService.subscribe` hands its handlers. It MUST be a type
 // exported from @camstack/types (not a local interface): the AppRouter
@@ -25,26 +26,46 @@ function createLiveEventsRouter(eb, ar) {
             limit: zod_1.z.number().optional(),
         })
             .optional())
-            .query(({ input }) => eb.getRecent(input ?? {}, input?.limit ?? 50)),
+            .query(({ input, ctx }) => {
+            const recent = eb.getRecent(input ?? {}, input?.limit ?? 50);
+            // SECURITY (F0.5): a device-restricted scoped token must not read the
+            // whole deployment's event history. `scopedEventVisibility` returns null
+            // for admins and broad category-view operators (no filtering), or a
+            // per-event predicate that keeps only events for devices the caller may
+            // view. (Share-view tokens cannot reach this method — not allowlisted.)
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
+            return keep ? recent.filter((evt) => keep(evt)) : recent;
+        }),
         onEvent: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ category: zod_1.z.string().optional() }))
             .subscription(({ input, ctx }) => {
             // Share-view principals get a device-filtered stream: only events
             // attributable to an in-scope device are pushed (fail closed —
-            // unattributable events are dropped). Everyone else gets the
-            // unfiltered stream, exactly as before.
+            // unattributable events are dropped).
             const shareScope = ctx.user.shareView?.scope ?? null;
+            // Non-share scoped tokens get the SAME projection keyed to what they may
+            // view (F0.5); admins and broad category-view operators are unfiltered.
+            const scopedKeep = shareScope
+                ? null
+                : (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 const filter = {};
                 if (input.category)
                     filter.category = input.category;
-                if (!shareScope)
-                    return eb.subscribe(filter, push);
-                const allowedDeviceIds = new Set(shareScope.deviceIds);
-                return eb.subscribe(filter, (evt) => {
-                    if ((0, share_view_access_js_1.liveEventInShareScope)(evt, allowedDeviceIds))
-                        push(evt);
-                });
+                if (shareScope) {
+                    const allowedDeviceIds = new Set(shareScope.deviceIds);
+                    return eb.subscribe(filter, (evt) => {
+                        if ((0, share_view_access_js_1.liveEventInShareScope)(evt, allowedDeviceIds))
+                            push(evt);
+                    });
+                }
+                if (scopedKeep) {
+                    return eb.subscribe(filter, (evt) => {
+                        if (scopedKeep(evt))
+                            push(evt);
+                    });
+                }
+                return eb.subscribe(filter, push);
             });
         }),
         onDeviceEvent: trpc_middleware_js_1.protectedProcedure

package/dist/api/core/logs.router.js

@@ -139,7 +139,13 @@ function createLogsRouter(logging) {
             const removed = logging.clear(filter);
             return { removed };
         }),
-        subscribe: trpc_middleware_js_1.protectedProcedure
+        // SECURITY (F0.5): the log stream is a system-wide firehose — it carries
+        // error context, file paths, config fragments and per-device diagnostics
+        // with no reliable per-caller projection. `query` and `clear` are already
+        // `adminProcedure`; `subscribe` was the one non-admin door onto the same
+        // data, so it is gated to match. (A scoped, device-projected log view is a
+        // later, larger change — not a security hotfix.)
+        subscribe: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({
             level: LogLevelSchema.optional(),
             tags: LogTagsSchema.optional(),

package/dist/api/core/system-events.router.js

@@ -11,6 +11,7 @@ exports.createSystemEventsRouter = createSystemEventsRouter;
  */
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 function serialize(e) {
     return {
         id: e.id,
@@ -80,18 +81,23 @@ const SubscribeInputSchema = ScopeFieldsSchema.extend({
 });
 function createSystemEventsRouter(eb) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        getRecent: trpc_middleware_js_1.protectedProcedure.input(GetRecentInputSchema).query(({ input }) => {
-            return eb
-                .getRecent({
+        getRecent: trpc_middleware_js_1.protectedProcedure.input(GetRecentInputSchema).query(({ input, ctx }) => {
+            const recent = eb.getRecent({
                 ...(input.source ? { source: input.source } : {}),
                 ...(input.agentId ? { agentId: input.agentId } : {}),
                 ...(input.addonId ? { addonId: input.addonId } : {}),
                 ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                 ...(input.category ? { category: input.category } : {}),
-            }, input.limit)
-                .map(serialize);
+            }, input.limit);
+            // SECURITY (F0.5): filter the history to what a device-restricted scoped
+            // token may view. null ⇒ admin / broad category-view operator ⇒ unfiltered.
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
+            return (keep ? recent.filter((evt) => keep(evt)) : recent).map(serialize);
         }),
-        subscribe: trpc_middleware_js_1.protectedProcedure.input(SubscribeInputSchema).subscription(({ input }) => {
+        subscribe: trpc_middleware_js_1.protectedProcedure.input(SubscribeInputSchema).subscription(({ input, ctx }) => {
+            // SECURITY (F0.5): a device-restricted scoped token must not receive every
+            // camera's live events. Same projection as `getRecent`.
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.getDeviceAncestors);
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 return eb.subscribe({
                     ...(input.source ? { source: input.source } : {}),
@@ -99,7 +105,10 @@ function createSystemEventsRouter(eb) {
                     ...(input.addonId ? { addonId: input.addonId } : {}),
                     ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                     ...(input.category ? { category: input.category } : {}),
-                }, (event) => push(serialize(event)));
+                }, (event) => {
+                    if (!keep || keep(event))
+                        push(serialize(event));
+                });
             });
         }),
     });

package/dist/api/trpc/device-config-secret-redaction.js

@@ -46,9 +46,11 @@ exports.redactDeviceInfoSecrets = redactDeviceInfoSecrets;
 exports.redactSettingsSections = redactSettingsSections;
 exports.redactSettingsAggregate = redactSettingsAggregate;
 exports.redactConfigEntries = redactConfigEntries;
+exports.redactStreamUrlSecrets = redactStreamUrlSecrets;
 /** What a non-admin sees instead of the value. Matches the `***` convention
  *  `maskUrlCredentials` already uses for credentials in log output, so one
  *  redaction marker means one thing across the system. */
+const types_1 = require("@camstack/types");
 exports.REDACTED_SECRET = '***';
 /**
  * Config keys whose VALUE is a credential.
@@ -163,6 +165,42 @@ function redactConfigEntries(data) {
         return data;
     return data.map(redactField);
 }
+/**
+ * URL fields whose VALUE is an RTSP/RTMP restream address and can embed
+ * `user:password@host` userinfo — the camera's own credentials.
+ *
+ * The stream surfaces (`cameraStreams.getRtspEntries`,
+ * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
+ * non-admin caller `rtsp://admin:hunter2@192.168.1.139/…` verbatim: a
+ * read-only token can open every camera by copy-pasting the string. These
+ * are NOT config blobs, so {@link redactRecord} never sees them — the leak
+ * lives in a plain `url` / `mutedUrl` string field.
+ */
+const URL_FIELD_KEYS = ['url', 'mutedUrl'];
+/**
+ * Mask the userinfo of every URL-valued field on a stream entry (or array of
+ * them), reusing {@link maskUrlCredentials} so ONE masker governs both logs
+ * and the wire. A URL with no `user:pass@` (a broker restream whose token is
+ * in the path) is returned unchanged, so this is safe to apply broadly.
+ *
+ * Only the enumerated {@link URL_FIELD_KEYS} are touched; a non-URL string
+ * (`codec`, `label`) and a non-string value pass through. Non-row payloads
+ * pass through untouched — an upstream error must not be rewritten.
+ */
+function redactStreamUrlSecrets(data) {
+    if (Array.isArray(data))
+        return data.map((row) => redactStreamUrlSecrets(row));
+    if (!isRecord(data))
+        return data;
+    const out = {};
+    for (const [key, value] of Object.entries(data)) {
+        out[key] =
+            URL_FIELD_KEYS.includes(key) && typeof value === 'string' && value.length > 0
+                ? (0, types_1.maskUrlCredentials)(value)
+                : value;
+    }
+    return out;
+}
 /**
  * Every device-manager read whose response carries a device `config` blob, and
  * the projection that cuts it.
@@ -188,4 +226,14 @@ exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
     ['deviceManager.getSettingsSchema', redactSettingsSections],
     ['deviceManager.getDeviceAggregate', redactSettingsAggregate],
     ['deviceManager.getConfigSchema', redactConfigEntries],
+    // ── RTSP/RTMP restream URLs (userinfo) — not a config blob, a `url` field ──
+    // Every method whose output can carry `rtsp://user:pass@host`. A read-only
+    // token reaching these got the camera's own credentials verbatim.
+    ['cameraStreams.getCameraStreams', redactStreamUrlSecrets],
+    ['cameraStreams.getRtspEntries', redactStreamUrlSecrets],
+    ['cameraStreams.getProfileRtspEntries', redactStreamUrlSecrets],
+    ['deviceOps.getStreamSources', redactStreamUrlSecrets],
+    ['deviceManager.getStreamSources', redactStreamUrlSecrets],
+    ['streamBroker.getRtspEntry', redactStreamUrlSecrets],
+    ['streamBroker.getAllRtspEntries', redactStreamUrlSecrets],
 ]);

package/dist/api/trpc/principal-visibility.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callerCanViewDevice = callerCanViewDevice;
+exports.isBroadEventViewer = isBroadEventViewer;
+exports.filterViewableDeviceIds = filterViewableDeviceIds;
+exports.scopedEventVisibility = scopedEventVisibility;
+/**
+ * Non-admin principal device visibility — the shared answer to "which cameras
+ * may this scoped caller see?", reused by two hotfixes:
+ *
+ *   - F0.4 `auth.createShareToken` — a scoped user must not mint a `csv_*`
+ *     share token for a device it cannot see. The requested deviceIds are
+ *     INTERSECTED with what the caller can view.
+ *   - F0.5 the event firehose (`live.onEvent`, `systemEvents.subscribe`, …) —
+ *     a device-restricted scoped token must not receive every camera's motion /
+ *     detection events. Its stream is filtered to the devices it can view.
+ *
+ * The single source of truth for "can this principal VIEW device D" is the
+ * existing scope matcher ({@link checkScopeAccess}) run against a canonical
+ * device-scope VIEW method. Reusing the matcher means share minting and event
+ * filtering agree with the middleware that gates the per-camera surfaces
+ * themselves — including `device:[parent]` → child-accessory inheritance via
+ * the ancestor walk.
+ *
+ * Pure module — no tRPC machinery — so the spec exercises it directly (same
+ * pattern as `scope-access.ts` / `share-view-access.ts`).
+ */
+const system_1 = require("@camstack/system");
+const scope_access_js_1 = require("./scope-access.js");
+/**
+ * Canonical "view this camera" probe. `snapshot.getSnapshot` is a device-scope,
+ * `view`-access method every viewer surface needs (the grid-embed cold-start
+ * tile), so a caller who can pass its scope check is a caller who can see the
+ * camera. A rename is caught at import time by {@link assertProbeExists} — a
+ * loud boot failure, never a silent "deny everyone".
+ */
+const DEVICE_VIEW_PROBE = 'snapshot.getSnapshot';
+function assertProbeExists() {
+    const meta = system_1.METHOD_ACCESS_MAP[DEVICE_VIEW_PROBE];
+    if (!meta || meta.capScope !== 'device' || meta.access !== 'view') {
+        throw new Error(`principal-visibility: probe '${DEVICE_VIEW_PROBE}' is not a device-scope view method ` +
+            `(codegen drift). Pick another canonical camera-view method.`);
+    }
+}
+assertProbeExists();
+/**
+ * True when the scoped principal may VIEW device `deviceId`. Handles
+ * `device:[parent]` → child inheritance through the ancestor walk, exactly as
+ * the per-camera middleware does.
+ */
+function callerCanViewDevice(scopes, deviceId, getDeviceAncestors) {
+    return (0, scope_access_js_1.checkScopeAccess)(scopes, DEVICE_VIEW_PROBE, { deviceId }, getDeviceAncestors).ok;
+}
+/**
+ * A scoped principal sees the WHOLE event/telemetry firehose when it holds any
+ * `category`-scope view grant — the operator / family-viewer tiers, whose whole
+ * purpose is a broad read. A token scoped only to specific `device:[…]` (or a
+ * single `capability`/`addon`) is NOT broad: its event stream is filtered to the
+ * devices it can view, and unattributable events are dropped (fail closed).
+ *
+ * Kept deliberately separate from {@link callerCanViewDevice}: a
+ * `category:system` operator legitimately monitors the system dashboard, so
+ * gating their event stream to a device-scope probe (which `category:system`
+ * does not satisfy) would blank a surface they are entitled to. Availability and
+ * security both point the same way here — broad grant, broad stream.
+ */
+function isBroadEventViewer(scopes) {
+    return scopes.some((s) => s.type === 'category' && s.access.includes('view'));
+}
+/**
+ * Filter a requested deviceId list down to those the caller may view. Used by
+ * share minting: an admin passes `isAdmin` and skips this; a non-admin gets the
+ * intersection, and the router refuses when it is empty.
+ */
+function filterViewableDeviceIds(scopes, requested, getDeviceAncestors) {
+    return requested.filter((id) => callerCanViewDevice(scopes, id, getDeviceAncestors));
+}
+/** The device identity an event is attributable to, or null when it carries
+ *  none. Mirrors `liveEventInShareScope`'s matching (source.id, source.deviceId,
+ *  data.deviceId) so scoped filtering and share filtering agree. */
+function eventDeviceId(evt) {
+    const sourceId = evt.source?.id;
+    if (typeof sourceId === 'number' && Number.isFinite(sourceId))
+        return sourceId;
+    if (typeof sourceId === 'string' && sourceId !== '') {
+        const n = Number(sourceId);
+        if (Number.isInteger(n))
+            return n;
+    }
+    const src = evt.source;
+    if (typeof src?.deviceId === 'number' && Number.isFinite(src.deviceId))
+        return src.deviceId;
+    const dataDeviceId = evt.data?.['deviceId'];
+    if (typeof dataDeviceId === 'number' && Number.isFinite(dataDeviceId))
+        return dataDeviceId;
+    return null;
+}
+/**
+ * Build the event-stream predicate for a NON-share principal (F0.5).
+ *
+ * Returns `null` when the principal sees the whole firehose — an admin, or a
+ * broad `category`-view operator (see {@link isBroadEventViewer}). Otherwise a
+ * predicate that keeps only events attributable to a device the principal may
+ * view; an event with NO device identity is DROPPED (fail closed — "probably in
+ * scope" is not a security argument).
+ *
+ * Share-view (`csv_*`) principals are NOT handled here — they keep their own,
+ * stricter `liveEventInShareScope` filter, applied by the routers first.
+ */
+function scopedEventVisibility(user, getDeviceAncestors) {
+    if (user.isAdmin)
+        return null;
+    const scopes = user.scopes ?? [];
+    if (isBroadEventViewer(scopes))
+        return null;
+    return (evt) => {
+        const id = eventDeviceId(evt);
+        if (id === null)
+            return false;
+        return callerCanViewDevice(scopes, id, getDeviceAncestors);
+    };
+}

package/dist/api/trpc/trpc.context.js

@@ -155,25 +155,19 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
     }
 }
 /**
- * Build the parent-chain walker for the scope-access matcher. Returns
- * every ancestor deviceId of `deviceId` (parent, grandparent, …) so a
- * grant on a Reolink camera covers its accessory children without
- * re-enumerating them.
+ * Build the parent-chain walker for the scope-access matcher. Returns every
+ * ancestor deviceId of `deviceId` (parent, grandparent, …) so a grant on a
+ * Reolink camera covers its accessory children without re-enumerating them.
  *
- * Bounded by hop count (defence-in-depth — the device tree should
- * never exceed 2-3 levels but a corrupt registry shouldn't loop forever).
+ * Reads `AddonRegistryService.getPersistedAncestors` — the hub-process mirror of
+ * the device-manager's PERSISTED parentage (F0.6). It MUST NOT walk the hub
+ * `DeviceRegistry` directly: that registry only holds hub-local devices, so it
+ * is empty for every forked provider and the inheritance this function exists to
+ * provide silently did nothing (0/6 providers inherited). The mirror is warmed
+ * off the event path and read synchronously here.
  */
 function makeAncestorLookup(addonRegistry) {
-    return (deviceId) => {
-        const out = [];
-        const registry = addonRegistry.getDeviceRegistry();
-        let current = registry.getById(deviceId);
-        for (let hop = 0; hop < 8 && current?.parentDeviceId != null; hop++) {
-            out.push(current.parentDeviceId);
-            current = registry.getById(current.parentDeviceId);
-        }
-        return out;
-    };
+    return (deviceId) => addonRegistry.getPersistedAncestors(deviceId);
 }
 /**
  * Context factory for hub-internal calls originating from the trusted

package/dist/core/addon/addon-package.service.js

@@ -311,6 +311,9 @@ class AddonPackageService {
         if (!this.isAllowedPackage(name)) {
             throw new Error(`Package "${name}" is not an allowed @camstack/* package`);
         }
+        if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name)) {
+            throw new Error(`"${name}" is a framework package — roll it back via serverManagement, not the addon-package path`);
+        }
         const previousVersion = this.getInstalledPackageVersion(name);
         const rolledBackTo = await this.installer.rollbackAddon(name);
         if (rolledBackTo == null) {
@@ -659,6 +662,11 @@ class AddonPackageService {
         await Promise.all([...seen].map(async ([name, version]) => {
             if (!this.isAllowedPackage(name))
                 return;
+            // Never OFFER a framework package as an addon update: clicking it would
+            // route to `updatePackage`, which now refuses it anyway. Filtering here
+            // keeps the UI honest (no dead "Update" button for @camstack/server).
+            if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name))
+                return;
             const latestVersion = await this.fetchLatestVersion(name);
             if (latestVersion === null || !isVersionNewer(latestVersion, version))
                 return;
@@ -897,6 +905,9 @@ class AddonPackageService {
                 error: `Package "${name}" is not an allowed @camstack/* package`,
             };
         }
+        const frameworkRefusal = this.refuseExcludedFramework(name);
+        if (frameworkRefusal)
+            return frameworkRefusal;
         // Dev-mode npm-install gate REMOVED (2026-05-12). The legacy
         // workspace-link flow assumed addons in dev came from `packages/*`
         // and a stray "Update" click would clobber the source. With the
@@ -990,6 +1001,9 @@ class AddonPackageService {
                 error: `Package "${name}" is not an allowed @camstack/* package`,
             };
         }
+        const frameworkRefusal = this.refuseExcludedFramework(name);
+        if (frameworkRefusal)
+            return frameworkRefusal;
         const category = this.categorize(name);
         this.logger.info('Applying staged addon update', { meta: { name, version, category } });
         try {
@@ -1620,6 +1634,26 @@ class AddonPackageService {
     isAllowedPackage(name) {
         return name.startsWith('@camstack/');
     }
+    /**
+     * A framework/system-tier package (`@camstack/server`, `system`, `types`,
+     * `sdk`, `kernel`, `core`, `ui-library`) must NEVER be installed by the
+     * addon-package path: it ships exclusively through `applyServerUpdate`
+     * (single-copy collapse). The auto-updater already skips these; the MANUAL
+     * entry points (`updatePackage`, `applyStagedAddonUpdate`, `rollbackPackage`)
+     * resolved them to `'core'` and ran a raw `npm install @camstack/server@X`,
+     * which bypasses the single-copy engine and — on 2026-08-13 — saturated the
+     * host mid-`applyServerUpdate` publish. A refusal, not a silent no-op.
+     */
+    refuseExcludedFramework(name) {
+        if (!exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name))
+            return null;
+        return {
+            success: false,
+            version: '',
+            requiresRestart: false,
+            error: `"${name}" is a framework package — install it via serverManagement.applyServerUpdate, not the addon-package path`,
+        };
+    }
     /** Categorize a package as 'addon' or 'core' */
     categorize(name) {
         if (CORE_MANAGED_PACKAGES.includes(name)) {

package/dist/core/addon/addon-registry.service.js

@@ -436,6 +436,10 @@ class AddonRegistryService {
         this.capabilityRegistry.registerProvider('addon-settings', '$hub', settingsProvider);
         // Wire capability consumer actions via EventBus
         this.wireCapabilityConsumers();
+        // Wire the persisted device-parent mirror (F0.6) so the scope matcher's
+        // parent→child accessory inheritance works for FORKED provider devices,
+        // which never appear in the hub-local DeviceRegistry.
+        this.wireDeviceParentMirror();
         // Subscribe to capability.binding-changed so hub-side capability
         // overrides take effect on the fly. The orchestrator addon emits
         // these when the operator swaps the addon implementing a cap on a
@@ -1060,6 +1064,92 @@ class AddonRegistryService {
     getDeviceRegistry() {
         return this.deviceRegistry;
     }
+    // ── Persisted device-parent mirror (F0.6) ─────────────────────────────────
+    //
+    // The scope matcher's parent→child accessory inheritance (`getDeviceAncestors`
+    // in `trpc.context.ts`) needs a deviceId's ancestor chain on EVERY scoped
+    // request. The hub `DeviceRegistry` only knows devices registered IN the hub
+    // process, so it is EMPTY for every forked provider (reolink, hikvision, …):
+    // a grant on a forked camera never reached its siren/floodlight/PIR children
+    // (measured 0/6 providers inherited). The authoritative parentage lives in the
+    // device-manager's PERSISTED meta, which `listAll` projects for the whole
+    // fleet — forked devices included. This is a hub-process, SYNCHRONOUSLY
+    // readable mirror of that parentage, refreshed OFF the request path on every
+    // device-meta lifecycle event — never a per-call DB query.
+    deviceParentMirror = new Map();
+    /** Parent of a device: the persisted mirror first (covers forked devices),
+     *  falling back to the live hub registry (covers a hub-local device before the
+     *  first mirror warm). null when top-level or unknown. */
+    parentOfDevice(deviceId) {
+        const mirrored = this.deviceParentMirror.get(deviceId);
+        if (mirrored !== undefined)
+            return mirrored;
+        return this.deviceRegistry.getById(deviceId)?.parentDeviceId ?? null;
+    }
+    /**
+     * Ancestor chain (parent, grandparent, …) of a device, bounded to 8 hops
+     * (defence-in-depth against a corrupt registry cycle). Synchronous — it is
+     * read on every scoped request. Backed by the persisted mirror so a grant on
+     * a FORKED camera covers its accessory children. Empty for a top-level device
+     * or one the hub has never heard of.
+     */
+    getPersistedAncestors = (deviceId) => {
+        const out = [];
+        let current = deviceId;
+        for (let hop = 0; hop < 8; hop++) {
+            const parent = this.parentOfDevice(current);
+            if (parent == null || parent === current)
+                break;
+            out.push(parent);
+            current = parent;
+        }
+        return out;
+    };
+    /** Subscribe the mirror to every device-meta lifecycle event, and warm it once
+     *  the addon set (device-manager included) is up. */
+    wireDeviceParentMirror() {
+        const refresh = () => {
+            void this.refreshDeviceParentMirror();
+        };
+        for (const category of [
+            types_1.EventCategory.DeviceMetaChanged,
+            types_1.EventCategory.DeviceRegistered,
+            types_1.EventCategory.DeviceUnregistered,
+            types_1.EventCategory.DeviceProvisioned,
+            types_1.EventCategory.SystemAddonsReady,
+        ]) {
+            this.eventBusService.subscribe({ category }, refresh);
+        }
+    }
+    /** Rebuild the parent mirror from the device-manager's persisted fleet
+     *  (`listAll`, slim projection — no config blob). Off the request path; a
+     *  failed read KEEPS the previous mirror (D49 — a read that fails changes
+     *  nothing, and must never look like an unbind that destroys inheritance). */
+    async refreshDeviceParentMirror() {
+        try {
+            const api = this.getBrokerApi();
+            const rows = await api.deviceManager.listAll.query({ projection: 'slim' });
+            if (!Array.isArray(rows))
+                return;
+            const next = new Map();
+            for (const row of rows) {
+                if (row === null || typeof row !== 'object')
+                    continue;
+                const id = Reflect.get(row, 'id');
+                const parent = Reflect.get(row, 'parentDeviceId');
+                if (typeof id === 'number' && typeof parent === 'number')
+                    next.set(id, parent);
+            }
+            this.deviceParentMirror.clear();
+            for (const [k, v] of next)
+                this.deviceParentMirror.set(k, v);
+        }
+        catch (err) {
+            this.logger.debug('device-parent mirror refresh failed — keeping previous', {
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+        }
+    }
     /** Load persisted collection disabled-lists from settings-store into the registry */
     loadCollectionPreferences() {
         // TODO: implement CapabilityRegistry.loadDisabledProviders() to restore persisted preferences

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.104",
+  "version": "1.2.105",
   "private": false,
   "files": [
     "dist",
@@ -38,13 +38,13 @@
     "@camstack/addon-auth": "1.2.18",
     "@camstack/addon-decoder-nodeav": "1.2.16",
     "@camstack/addon-notifiers": "1.2.21",
-    "@camstack/addon-pipeline": "1.2.73",
+    "@camstack/addon-pipeline": "1.2.74",
     "@camstack/addon-pipeline-orchestrator": "1.2.53",
-    "@camstack/addon-post-analysis": "1.2.70",
+    "@camstack/addon-post-analysis": "1.2.71",
     "@camstack/sdk": "1.2.18",
     "@camstack/shm-ring": "1.1.16",
     "@camstack/system": "1.2.88",
-    "@camstack/types": "1.2.67",
+    "@camstack/types": "1.2.68",
     "@camstack/ui-library": "1.2.46",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",