@camstack/server 1.2.104 → 1.2.106

package/dist/api/core/addon-settings.router.js

@@ -77,7 +77,7 @@ function createAddonSettingsRouter(cfg) {
          * Read the addon-global settings record for the given addon.
          * Returns the raw stored values (no defaults, no device overrides).
          */
-        getGlobal: trpc_middleware_js_1.protectedProcedure
+        getGlobal: trpc_middleware_js_1.adminProcedure
             .input(AddonIdInputSchema)
             .output(AddonSettingsRecordSchema)
             .query(({ input }) => cfg.getAddonConfig(input.addonId)),
@@ -86,7 +86,7 @@ function createAddonSettingsRouter(cfg) {
          * Returns the raw stored values (schema filtering happens on the
          * consumer side at merge time).
          */
-        getDeviceOverrides: trpc_middleware_js_1.protectedProcedure
+        getDeviceOverrides: trpc_middleware_js_1.adminProcedure
             .input(AddonDeviceInputSchema)
             .output(AddonSettingsRecordSchema)
             .query(({ input }) => cfg.getAddonDevice(input.addonId, input.deviceId)),
@@ -97,7 +97,7 @@ function createAddonSettingsRouter(cfg) {
          * writes from addon code; bulk updates should use a dedicated admin
          * endpoint (not exposed here).
          */
-        updateGlobal: trpc_middleware_js_1.protectedProcedure
+        updateGlobal: trpc_middleware_js_1.adminProcedure
             .input(UpdateGlobalInputSchema)
             .output(SuccessSchema)
             .mutation(({ input }) => {
@@ -113,7 +113,7 @@ function createAddonSettingsRouter(cfg) {
          * responsibility — we preserve the raw shape at this layer so the
          * resolver contract remains symmetric with `getDeviceOverrides`.
          */
-        updateDevice: trpc_middleware_js_1.protectedProcedure
+        updateDevice: trpc_middleware_js_1.adminProcedure
             .input(UpdateDeviceInputSchema)
             .output(SuccessSchema)
             .mutation(({ input }) => {
@@ -130,7 +130,7 @@ function createAddonSettingsRouter(cfg) {
          * `updateGlobal` (single-field merge), this overwrites the full record.
          * Admin-level write: only workers with valid hub tokens can call this.
          */
-        replaceGlobal: trpc_middleware_js_1.protectedProcedure
+        replaceGlobal: trpc_middleware_js_1.adminProcedure
             .input(ReplaceGlobalInputSchema)
             .output(SuccessSchema)
             .mutation(({ input }) => {

package/dist/api/core/auth.router.js

@@ -1,7 +1,4 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXCHANGE_SESSION_HEADER = void 0;
-exports.createAuthRouter = createAuthRouter;
 /**
  * Auth router — core API for login/logout/me.
  *
@@ -17,14 +14,18 @@ exports.createAuthRouter = createAuthRouter;
  * collection — the single, generic mechanism every auth addon contributes
  * to (superseding the removed `auth.listProviders`).
  */
-const zod_1 = require("zod");
-const server_1 = require("@trpc/server");
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXCHANGE_SESSION_HEADER = void 0;
+exports.createAuthRouter = createAuthRouter;
 const types_1 = require("@camstack/types");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
-const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
+const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 // ── Public-auth rate limiting ────────────────────────────────────────
 // The public surface below (credential validation, passkey ceremonies,
 // one-time-code redemption) had NO throttling — unlimited online
@@ -273,6 +274,35 @@ function readRequestHeader(req, name) {
         return value[0] ?? null;
     return null;
 }
+/** Per-access device reach summary (counts, never id lists). */
+const DeviceReachSummarySchema = zod_1.z.object({
+    all: zod_1.z.boolean(),
+    deviceCount: zod_1.z.number().int(),
+});
+/** One capability/addon grant flattened for the UI. */
+const ScopeGrantSummarySchema = zod_1.z.object({
+    name: zod_1.z.string(),
+    access: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
+});
+/**
+ * The caller's RESOLVED effective scope (scope model v3). Selectors are
+ * expanded against the live fleet to counts/flags — never raw id lists — so
+ * the viewer (F3/F4) can HIDE out-of-scope surfaces from a single probe. A
+ * non-admin with zero grants reports zero everything (born with no access).
+ */
+const EffectiveScopeSchema = zod_1.z.object({
+    isAdmin: zod_1.z.boolean(),
+    allDevicesViewable: zod_1.z.boolean(),
+    viewableDeviceCount: zod_1.z.number().int(),
+    device: zod_1.z.object({
+        view: DeviceReachSummarySchema,
+        create: DeviceReachSummarySchema,
+        delete: DeviceReachSummarySchema,
+    }),
+    system: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
+    capabilities: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
+    addons: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
+});
 /** Wire shape of the authenticated user returned by `auth.me`. */
 const MeSchema = zod_1.z
     .object({
@@ -286,6 +316,11 @@ const MeSchema = zod_1.z
     }),
     isApiKey: zod_1.z.boolean(),
     agentId: zod_1.z.string().optional(),
+    /**
+     * The caller's resolved effective scope. Absent only on the (unreachable
+     * here — `me` is `protected`) null-principal branch.
+     */
+    scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
 function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService()) {
@@ -692,7 +727,44 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         me: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
             .output(MeSchema)
-            .query(({ ctx }) => ctx.user),
+            .query(({ ctx }) => {
+            if (!ctx.user)
+                return null;
+            // Resolve the effective scope against the live fleet so the viewer can
+            // hide surfaces from a single probe (F1 #5). Admins summarise to
+            // "everything"; a scoped principal's selectors expand to counts.
+            const fleet = ctx.deviceFleet?.() ?? [];
+            const scope = (0, types_1.summarizeEffectiveScope)(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
+            return { ...ctx.user, scope };
+        }),
+        /**
+         * Resolve a PROPOSED grant set the same way `me` resolves the caller's
+         * own — so the Users page can show "12 devices viewable, 2 actionable"
+         * BEFORE saving, and the number it shows is the number the matcher will
+         * enforce.
+         *
+         * Deliberately the same two lines as `me` (`summarizeEffectiveScope`
+         * over `ctx.deviceFleet()`) rather than a second derivation in the admin
+         * UI. A preview computed client-side from the same selectors would be a
+         * hand-copied scope check, and those drift (D103) — a preview that
+         * disagrees with enforcement is worse than none, because it is trusted.
+         *
+         * Admin-gated: only an admin edits another user's scopes
+         * (`user-management.setUserScopes` is `auth: 'admin'`), and the fleet
+         * size / room labels this leaks are admin-visible already. It reads
+         * nothing off the caller, so it is not a self-scope oracle.
+         *
+         * `isAdmin` previews the admin BYPASS — with it set, grants are ignored
+         * and the answer is "everything", which is what the panel must show
+         * when the operator ticks the Admin box.
+         */
+        previewScope: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({
+            scopes: zod_1.z.array(types_1.TokenScopeSchema),
+            isAdmin: zod_1.z.boolean().default(false),
+        }))
+            .output(EffectiveScopeSchema)
+            .query(({ ctx, input }) => (0, types_1.summarizeEffectiveScope)(input.scopes, ctx.deviceFleet?.() ?? [], input.isAdmin)),
         // ── Self-service profile operations ───────────────────────────────
         //
         // These route through the `user-management` capability provider but
@@ -881,9 +953,30 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
+            // SECURITY (F0.4): a share token is a PRIVILEGE HANDOFF — it authorises
+            // whoever holds the link to view its devices with no further auth. A
+            // scoped (non-admin) minter must therefore not be able to mint for a
+            // device it cannot itself see: without this, a `device:[5]` token could
+            // mint a `csv_*` grid link for cameras 5..99. Admins mint anything;
+            // every other caller's requested deviceIds are INTERSECTED with what
+            // they can view (device:[parent] covers child accessories via the
+            // ancestor walk). An empty intersection is a refusal, not a silent
+            // "share nothing".
+            const scope = ctx.user.isAdmin
+                ? input.scope
+                : {
+                    ...input.scope,
+                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
+                };
+            if (scope.deviceIds.length === 0) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
+                });
+            }
             const { token, record } = await service.create({
                 userId: ctx.user.id,
-                scope: input.scope,
+                scope,
                 ...(input.ttlSec !== undefined ? { ttlSec: input.ttlSec } : {}),
             });
             return { id: record.id, token, expiresAt: record.expiresAt };

package/dist/api/core/event-bus-proxy.router.js

@@ -89,7 +89,7 @@ function serializeRecentEvent(e) {
 }
 function createEventBusProxyRouter(eventBus) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        emit: trpc_middleware_js_1.protectedProcedure
+        emit: trpc_middleware_js_1.adminProcedure
             .input(SystemEventInputSchema)
             .output(zod_1.z.object({ ok: zod_1.z.literal(true) }))
             .mutation(({ input }) => {

package/dist/api/core/live-events.router.js

@@ -10,6 +10,7 @@ exports.createLiveEventsRouter = createLiveEventsRouter;
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const share_view_access_js_1 = require("../trpc/share-view-access.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 // The pushed wire shape is `SystemEvent` from @camstack/types — the exact
 // type `EventBusService.subscribe` hands its handlers. It MUST be a type
 // exported from @camstack/types (not a local interface): the AppRouter
@@ -25,26 +26,46 @@ function createLiveEventsRouter(eb, ar) {
             limit: zod_1.z.number().optional(),
         })
             .optional())
-            .query(({ input }) => eb.getRecent(input ?? {}, input?.limit ?? 50)),
+            .query(({ input, ctx }) => {
+            const recent = eb.getRecent(input ?? {}, input?.limit ?? 50);
+            // SECURITY (F0.5): a device-restricted scoped token must not read the
+            // whole deployment's event history. `scopedEventVisibility` returns null
+            // for admins and broad category-view operators (no filtering), or a
+            // per-event predicate that keeps only events for devices the caller may
+            // view. (Share-view tokens cannot reach this method — not allowlisted.)
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
+            return keep ? recent.filter((evt) => keep(evt)) : recent;
+        }),
         onEvent: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.object({ category: zod_1.z.string().optional() }))
             .subscription(({ input, ctx }) => {
             // Share-view principals get a device-filtered stream: only events
             // attributable to an in-scope device are pushed (fail closed —
-            // unattributable events are dropped). Everyone else gets the
-            // unfiltered stream, exactly as before.
+            // unattributable events are dropped).
             const shareScope = ctx.user.shareView?.scope ?? null;
+            // Non-share scoped tokens get the SAME projection keyed to what they may
+            // view (F0.5); admins and broad category-view operators are unfiltered.
+            const scopedKeep = shareScope
+                ? null
+                : (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 const filter = {};
                 if (input.category)
                     filter.category = input.category;
-                if (!shareScope)
-                    return eb.subscribe(filter, push);
-                const allowedDeviceIds = new Set(shareScope.deviceIds);
-                return eb.subscribe(filter, (evt) => {
-                    if ((0, share_view_access_js_1.liveEventInShareScope)(evt, allowedDeviceIds))
-                        push(evt);
-                });
+                if (shareScope) {
+                    const allowedDeviceIds = new Set(shareScope.deviceIds);
+                    return eb.subscribe(filter, (evt) => {
+                        if ((0, share_view_access_js_1.liveEventInShareScope)(evt, allowedDeviceIds))
+                            push(evt);
+                    });
+                }
+                if (scopedKeep) {
+                    return eb.subscribe(filter, (evt) => {
+                        if (scopedKeep(evt))
+                            push(evt);
+                    });
+                }
+                return eb.subscribe(filter, push);
             });
         }),
         onDeviceEvent: trpc_middleware_js_1.protectedProcedure

package/dist/api/core/logs.router.js

@@ -139,7 +139,13 @@ function createLogsRouter(logging) {
             const removed = logging.clear(filter);
             return { removed };
         }),
-        subscribe: trpc_middleware_js_1.protectedProcedure
+        // SECURITY (F0.5): the log stream is a system-wide firehose — it carries
+        // error context, file paths, config fragments and per-device diagnostics
+        // with no reliable per-caller projection. `query` and `clear` are already
+        // `adminProcedure`; `subscribe` was the one non-admin door onto the same
+        // data, so it is gated to match. (A scoped, device-projected log view is a
+        // later, larger change — not a security hotfix.)
+        subscribe: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({
             level: LogLevelSchema.optional(),
             tags: LogTagsSchema.optional(),

package/dist/api/core/system-events.router.js

@@ -11,6 +11,7 @@ exports.createSystemEventsRouter = createSystemEventsRouter;
  */
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 function serialize(e) {
     return {
         id: e.id,
@@ -80,18 +81,23 @@ const SubscribeInputSchema = ScopeFieldsSchema.extend({
 });
 function createSystemEventsRouter(eb) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        getRecent: trpc_middleware_js_1.protectedProcedure.input(GetRecentInputSchema).query(({ input }) => {
-            return eb
-                .getRecent({
+        getRecent: trpc_middleware_js_1.protectedProcedure.input(GetRecentInputSchema).query(({ input, ctx }) => {
+            const recent = eb.getRecent({
                 ...(input.source ? { source: input.source } : {}),
                 ...(input.agentId ? { agentId: input.agentId } : {}),
                 ...(input.addonId ? { addonId: input.addonId } : {}),
                 ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                 ...(input.category ? { category: input.category } : {}),
-            }, input.limit)
-                .map(serialize);
+            }, input.limit);
+            // SECURITY (F0.5): filter the history to what a device-restricted scoped
+            // token may view. null ⇒ admin / broad category-view operator ⇒ unfiltered.
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
+            return (keep ? recent.filter((evt) => keep(evt)) : recent).map(serialize);
         }),
-        subscribe: trpc_middleware_js_1.protectedProcedure.input(SubscribeInputSchema).subscription(({ input }) => {
+        subscribe: trpc_middleware_js_1.protectedProcedure.input(SubscribeInputSchema).subscription(({ input, ctx }) => {
+            // SECURITY (F0.5): a device-restricted scoped token must not receive every
+            // camera's live events. Same projection as `getRecent`.
+            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 return eb.subscribe({
                     ...(input.source ? { source: input.source } : {}),
@@ -99,7 +105,10 @@ function createSystemEventsRouter(eb) {
                     ...(input.addonId ? { addonId: input.addonId } : {}),
                     ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                     ...(input.category ? { category: input.category } : {}),
-                }, (event) => push(serialize(event)));
+                }, (event) => {
+                    if (!keep || keep(event))
+                        push(serialize(event));
+                });
             });
         }),
     });

package/dist/api/trpc/device-config-secret-redaction.js

@@ -46,9 +46,11 @@ exports.redactDeviceInfoSecrets = redactDeviceInfoSecrets;
 exports.redactSettingsSections = redactSettingsSections;
 exports.redactSettingsAggregate = redactSettingsAggregate;
 exports.redactConfigEntries = redactConfigEntries;
+exports.redactStreamUrlSecrets = redactStreamUrlSecrets;
 /** What a non-admin sees instead of the value. Matches the `***` convention
  *  `maskUrlCredentials` already uses for credentials in log output, so one
  *  redaction marker means one thing across the system. */
+const types_1 = require("@camstack/types");
 exports.REDACTED_SECRET = '***';
 /**
  * Config keys whose VALUE is a credential.
@@ -163,6 +165,42 @@ function redactConfigEntries(data) {
         return data;
     return data.map(redactField);
 }
+/**
+ * URL fields whose VALUE is an RTSP/RTMP restream address and can embed
+ * `user:password@host` userinfo — the camera's own credentials.
+ *
+ * The stream surfaces (`cameraStreams.getRtspEntries`,
+ * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
+ * non-admin caller `rtsp://admin:hunter2@192.168.1.139/…` verbatim: a
+ * read-only token can open every camera by copy-pasting the string. These
+ * are NOT config blobs, so {@link redactRecord} never sees them — the leak
+ * lives in a plain `url` / `mutedUrl` string field.
+ */
+const URL_FIELD_KEYS = ['url', 'mutedUrl'];
+/**
+ * Mask the userinfo of every URL-valued field on a stream entry (or array of
+ * them), reusing {@link maskUrlCredentials} so ONE masker governs both logs
+ * and the wire. A URL with no `user:pass@` (a broker restream whose token is
+ * in the path) is returned unchanged, so this is safe to apply broadly.
+ *
+ * Only the enumerated {@link URL_FIELD_KEYS} are touched; a non-URL string
+ * (`codec`, `label`) and a non-string value pass through. Non-row payloads
+ * pass through untouched — an upstream error must not be rewritten.
+ */
+function redactStreamUrlSecrets(data) {
+    if (Array.isArray(data))
+        return data.map((row) => redactStreamUrlSecrets(row));
+    if (!isRecord(data))
+        return data;
+    const out = {};
+    for (const [key, value] of Object.entries(data)) {
+        out[key] =
+            URL_FIELD_KEYS.includes(key) && typeof value === 'string' && value.length > 0
+                ? (0, types_1.maskUrlCredentials)(value)
+                : value;
+    }
+    return out;
+}
 /**
  * Every device-manager read whose response carries a device `config` blob, and
  * the projection that cuts it.
@@ -188,4 +226,14 @@ exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
     ['deviceManager.getSettingsSchema', redactSettingsSections],
     ['deviceManager.getDeviceAggregate', redactSettingsAggregate],
     ['deviceManager.getConfigSchema', redactConfigEntries],
+    // ── RTSP/RTMP restream URLs (userinfo) — not a config blob, a `url` field ──
+    // Every method whose output can carry `rtsp://user:pass@host`. A read-only
+    // token reaching these got the camera's own credentials verbatim.
+    ['cameraStreams.getCameraStreams', redactStreamUrlSecrets],
+    ['cameraStreams.getRtspEntries', redactStreamUrlSecrets],
+    ['cameraStreams.getProfileRtspEntries', redactStreamUrlSecrets],
+    ['deviceOps.getStreamSources', redactStreamUrlSecrets],
+    ['deviceManager.getStreamSources', redactStreamUrlSecrets],
+    ['streamBroker.getRtspEntry', redactStreamUrlSecrets],
+    ['streamBroker.getAllRtspEntries', redactStreamUrlSecrets],
 ]);

package/dist/api/trpc/generated-cap-routers.js

@@ -7310,7 +7310,7 @@ function createCapRouter_recording(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.applyDeviceSettingsPatch(methodInput);
         }),
-        getAvailability: trpc_middleware_js_1.adminProcedure
+        getAvailability: trpc_middleware_js_1.protectedProcedure
             .input(types_92.recordingCapability.methods.getAvailability.input.loose())
             .output(types_92.recordingCapability.methods.getAvailability.output)
             .query(async ({ input, ctx }) => {
@@ -7319,7 +7319,7 @@ function createCapRouter_recording(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getAvailability(methodInput);
         }),
-        getDaysWithRecordings: trpc_middleware_js_1.adminProcedure
+        getDaysWithRecordings: trpc_middleware_js_1.protectedProcedure
             .input(types_92.recordingCapability.methods.getDaysWithRecordings.input.loose())
             .output(types_92.recordingCapability.methods.getDaysWithRecordings.output)
             .query(async ({ input, ctx }) => {
@@ -7328,7 +7328,7 @@ function createCapRouter_recording(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.getDaysWithRecordings(methodInput);
         }),
-        getPlaybackManifest: trpc_middleware_js_1.adminProcedure
+        getPlaybackManifest: trpc_middleware_js_1.protectedProcedure
             .input(types_92.recordingCapability.methods.getPlaybackManifest.input.loose())
             .output(types_92.recordingCapability.methods.getPlaybackManifest.output)
             .query(async ({ input, ctx }) => {

package/dist/api/trpc/principal-visibility.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callerCanViewDevice = callerCanViewDevice;
+exports.isBroadEventViewer = isBroadEventViewer;
+exports.filterViewableDeviceIds = filterViewableDeviceIds;
+exports.hasUnrestrictedDeviceView = hasUnrestrictedDeviceView;
+exports.projectListAllForPrincipal = projectListAllForPrincipal;
+exports.scopedEventVisibility = scopedEventVisibility;
+/**
+ * Non-admin principal device visibility — the shared answer to "which cameras
+ * may this scoped caller see?", reused by two hotfixes:
+ *
+ *   - F0.4 `auth.createShareToken` — a scoped user must not mint a `csv_*`
+ *     share token for a device it cannot see. The requested deviceIds are
+ *     INTERSECTED with what the caller can view.
+ *   - F0.5 the event firehose (`live.onEvent`, `systemEvents.subscribe`, …) —
+ *     a device-restricted scoped token must not receive every camera's motion /
+ *     detection events. Its stream is filtered to the devices it can view.
+ *
+ * The single source of truth for "can this principal VIEW device D" is the
+ * existing scope matcher ({@link checkScopeAccess}) run against a canonical
+ * device-scope VIEW method. Reusing the matcher means share minting and event
+ * filtering agree with the middleware that gates the per-camera surfaces
+ * themselves — including `device:[parent]` → child-accessory inheritance via
+ * the ancestor walk.
+ *
+ * Pure module — no tRPC machinery — so the spec exercises it directly (same
+ * pattern as `scope-access.ts` / `share-view-access.ts`).
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const scope_access_js_1 = require("./scope-access.js");
+const share_view_access_js_1 = require("./share-view-access.js");
+/**
+ * Canonical "view this camera" probe. `snapshot.getSnapshot` is a device-scope,
+ * `view`-access method every viewer surface needs (the grid-embed cold-start
+ * tile), so a caller who can pass its scope check is a caller who can see the
+ * camera. A rename is caught at import time by {@link assertProbeExists} — a
+ * loud boot failure, never a silent "deny everyone".
+ */
+const DEVICE_VIEW_PROBE = 'snapshot.getSnapshot';
+function assertProbeExists() {
+    const meta = system_1.METHOD_ACCESS_MAP[DEVICE_VIEW_PROBE];
+    if (!meta || meta.capScope !== 'device' || meta.access !== 'view') {
+        throw new Error(`principal-visibility: probe '${DEVICE_VIEW_PROBE}' is not a device-scope view method ` +
+            `(codegen drift). Pick another canonical camera-view method.`);
+    }
+}
+assertProbeExists();
+/**
+ * True when the scoped principal may VIEW device `deviceId`. Handles
+ * `device:[parent]` → child inheritance through the ancestor walk, exactly as
+ * the per-camera middleware does.
+ */
+function callerCanViewDevice(scopes, deviceId, lookup) {
+    return (0, scope_access_js_1.checkScopeAccess)(scopes, DEVICE_VIEW_PROBE, { deviceId }, lookup).ok;
+}
+/**
+ * A scoped principal sees the WHOLE event/telemetry firehose when it holds any
+ * `category`-scope view grant — the operator / family-viewer tiers, whose whole
+ * purpose is a broad read. A token scoped only to specific `device:[…]` (or a
+ * single `capability`/`addon`) is NOT broad: its event stream is filtered to the
+ * devices it can view, and unattributable events are dropped (fail closed).
+ *
+ * Kept deliberately separate from {@link callerCanViewDevice}: a
+ * `category:system` operator legitimately monitors the system dashboard, so
+ * gating their event stream to a device-scope probe (which `category:system`
+ * does not satisfy) would blank a surface they are entitled to. Availability and
+ * security both point the same way here — broad grant, broad stream.
+ */
+function isBroadEventViewer(scopes) {
+    return scopes.some((s) => s.type === 'category' && s.access.includes('view'));
+}
+/**
+ * Filter a requested deviceId list down to those the caller may view. Used by
+ * share minting: an admin passes `isAdmin` and skips this; a non-admin gets the
+ * intersection, and the router refuses when it is empty.
+ */
+function filterViewableDeviceIds(scopes, requested, lookup) {
+    return requested.filter((id) => callerCanViewDevice(scopes, id, lookup));
+}
+/** The device identity an event is attributable to, or null when it carries
+ *  none. Mirrors `liveEventInShareScope`'s matching (source.id, source.deviceId,
+ *  data.deviceId) so scoped filtering and share filtering agree. */
+function eventDeviceId(evt) {
+    const sourceId = evt.source?.id;
+    if (typeof sourceId === 'number' && Number.isFinite(sourceId))
+        return sourceId;
+    if (typeof sourceId === 'string' && sourceId !== '') {
+        const n = Number(sourceId);
+        if (Number.isInteger(n))
+            return n;
+    }
+    const src = evt.source;
+    if (typeof src?.deviceId === 'number' && Number.isFinite(src.deviceId))
+        return src.deviceId;
+    const dataDeviceId = evt.data?.['deviceId'];
+    if (typeof dataDeviceId === 'number' && Number.isFinite(dataDeviceId))
+        return dataDeviceId;
+    return null;
+}
+/**
+ * True when the principal's device reach is UNRESTRICTED at view — admin, a
+ * `category:device[view]` grant, or a device grant with an `all` selector.
+ * Such a caller enumerates the fleet unprojected, exactly as before.
+ */
+function hasUnrestrictedDeviceView(isAdmin, scopes) {
+    if (isAdmin)
+        return true;
+    return scopes.some((s) => s.access.includes('view') &&
+        ((s.type === 'category' && s.target === 'device') ||
+            (s.type === 'device' && s.selector.kind === 'all')));
+}
+/**
+ * Cut a `deviceManager.listAll` payload to the devices this principal may VIEW
+ * (F1 #4 — "enumerate only mine").
+ *
+ * A device outside the scope is INVISIBLE in enumerations (operator decision),
+ * not merely un-openable: returning it would leak the deployment's camera
+ * names, locations and online state to a token granted one camera.
+ *
+ * Reuses `resolveViewableDeviceIds` (the same selector engine the matcher
+ * uses, so enumeration and by-id access can never disagree) and
+ * `projectListAllForDeviceIds` (the same row whitelist the share path uses, so
+ * neither surface can forget that `config` carries credentials).
+ *
+ * A caller with unrestricted reach is returned the payload untouched.
+ */
+function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
+    if (hasUnrestrictedDeviceView(isAdmin, scopes))
+        return data;
+    const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
+    return (0, share_view_access_js_1.projectListAllForDeviceIds)(data, viewable);
+}
+/**
+ * Build the event-stream predicate for a NON-share principal (F0.5).
+ *
+ * Returns `null` when the principal sees the whole firehose — an admin, or a
+ * broad `category`-view operator (see {@link isBroadEventViewer}). Otherwise a
+ * predicate that keeps only events attributable to a device the principal may
+ * view; an event with NO device identity is DROPPED (fail closed — "probably in
+ * scope" is not a security argument).
+ *
+ * Share-view (`csv_*`) principals are NOT handled here — they keep their own,
+ * stricter `liveEventInShareScope` filter, applied by the routers first.
+ */
+function scopedEventVisibility(user, lookup) {
+    if (user.isAdmin)
+        return null;
+    const scopes = user.scopes ?? [];
+    if (isBroadEventViewer(scopes))
+        return null;
+    return (evt) => {
+        const id = eventDeviceId(evt);
+        if (id === null)
+            return false;
+        return callerCanViewDevice(scopes, id, lookup);
+    };
+}

package/dist/api/trpc/scope-access.js

@@ -1,30 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_ENUMERATION_METHODS = void 0;
 exports.checkScopeAccess = checkScopeAccess;
 /**
  * Pure scope-access matcher.
  *
  * Extracted from `trpc.middleware.ts` so the spec can exercise it
  * without spinning up the tRPC initTRPC machinery. The function is
- * stateless aside from an optional device-ancestor lookup callback.
+ * stateless aside from an optional {@link DeviceScopeLookup}.
  *
- * Algorithm (v2 — four scope types):
+ * Algorithm (v3 — four scope types):
  *   1. Look the tRPC `path` up in `METHOD_ACCESS_MAP`. Unknown =
  *      FORBIDDEN (codegen drift; fail closed).
  *   2. For each scope on the caller, check if it matches:
  *      - `category`   — scope.target matches meta.capScope ('device'|'system')
  *      - `capability` — scope.target matches meta.capName exactly
  *      - `addon`      — scope.target matches meta.addonId (when set)
- *      - `device`     — input.deviceId (OR any of its ancestor deviceIds
- *                       via `getDeviceAncestors`) is in scope.targets.
- *                       Auto-inheritance means granting a Reolink camera
- *                       implicitly grants its siren / floodlight / PIR
- *                       child accessories without re-listing them.
+ *      - `device`     — the request's `input.deviceId` is covered by the
+ *                       grant's v3 `selector` (all / ids / types / locations),
+ *                       resolved against the device's persisted type/location
+ *                       via {@link DeviceScopeLookup}. When the grant inherits
+ *                       (view by default, or `includeLinked`), an ANCESTOR
+ *                       match also covers the device — granting a Reolink
+ *                       camera implicitly grants its siren / floodlight / PIR
+ *                       children without re-listing them.
  *   3. On a target match, accept iff `scope.access` includes the
  *      method's required `access` flavour.
  *   4. No matching scope → FORBIDDEN with a human-readable reason.
  */
 const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
 /**
  * Pull `deviceId` off a tRPC request input. Device-scope cap methods
  * uniformly take `{deviceId: number, ...}` per the DeviceProxy contract,
@@ -38,25 +43,145 @@ function extractDeviceId(input) {
     return typeof candidate === 'number' ? candidate : null;
 }
 /**
- * Build the set of deviceIds that count as "this request" for the
- * device-scope match: the deviceId itself plus every ancestor (so a
- * scope on the parent camera covers accessory children).
+ * The device candidates a request is matched against: the deviceId itself
+ * plus (when the grant inherits) its ancestors, each carrying the metadata a
+ * v3 selector needs. A parent camera whose grant inherits therefore covers an
+ * accessory child, because the child's request tests the grant against the
+ * PARENT's metadata too.
  */
-function effectiveDeviceIds(deviceId, getAncestors) {
-    if (!getAncestors)
-        return [String(deviceId)];
-    const out = new Set([String(deviceId)]);
-    for (const ancestor of getAncestors(deviceId))
-        out.add(String(ancestor));
-    return [...out];
+function candidateMetas(deviceId, lookup) {
+    const toMeta = (id) => ({
+        id,
+        type: lookup?.getType(id) ?? '',
+        location: lookup?.getLocation(id) ?? null,
+        parentDeviceId: null,
+    });
+    if (!lookup)
+        return [toMeta(deviceId)];
+    const out = [toMeta(deviceId)];
+    for (const ancestor of lookup.getAncestors(deviceId))
+        out.push(toMeta(ancestor));
+    return out;
 }
-function checkScopeAccess(scopes, path, input, getDeviceAncestors) {
+/** Whether a v3 `device` grant covers this request. Direct selector match on
+ *  the device, or — when the grant inherits at this access — a match on an
+ *  ancestor. */
+function deviceScopeCovers(scope, access, candidates) {
+    const inherit = (0, types_1.scopeInherits)(scope, access);
+    return candidates.some((cand, index) => {
+        // index 0 is the device itself (always eligible); ancestors only when the
+        // grant inherits.
+        if (index > 0 && !inherit)
+            return false;
+        return (0, types_1.deviceSelectorMatches)(scope.selector, cand);
+    });
+}
+/** Render a device selector for the human-readable denial reason. */
+function describeSelector(scope) {
+    const sel = scope.selector;
+    switch (sel.kind) {
+        case 'all':
+            return 'all';
+        case 'ids':
+            return `ids:${sel.ids.join(',')}`;
+        case 'types':
+            return `types:${sel.types.join(',')}`;
+        case 'locations':
+            return `locations:${sel.locations.join(',')}`;
+    }
+}
+/**
+ * Methods that ENUMERATE devices rather than naming one — "which devices are
+ * mine". A `device`-selector grant may reach these, and it is safe ONLY
+ * because every one of them has its response cut to the caller's viewable set
+ * before it leaves the server (`projectListAllForPrincipal`, applied in
+ * `trpc.middleware.ts`).
+ *
+ * Adding a path here WITHOUT adding its projection hands the whole fleet to a
+ * one-camera token. The pairing is asserted by
+ * `scoped-list-projection.spec.ts`.
+ */
+exports.DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
+/**
+ * Every deviceId a request NAMES, per the codegen'd
+ * {@link METHOD_DEVICE_SELECTORS}. Absent / null / malformed values are
+ * skipped: an optional `deviceId` that was not sent references no device, and
+ * `linkDeviceId: null` means "clear the link".
+ */
+function referencedDeviceIds(path, input) {
+    const fields = types_1.METHOD_DEVICE_SELECTORS[path];
+    if (!fields || input === null || typeof input !== 'object')
+        return [];
+    const out = [];
+    for (const field of fields) {
+        const raw = Reflect.get(input, field.name);
+        if (raw === undefined || raw === null)
+            continue;
+        if (field.form === 'single') {
+            if (typeof raw === 'number' && Number.isFinite(raw))
+                out.push(raw);
+            continue;
+        }
+        if (!Array.isArray(raw))
+            continue;
+        for (const item of raw) {
+            if (typeof item === 'number' && Number.isFinite(item))
+                out.push(item);
+        }
+    }
+    return out;
+}
+/**
+ * True when the caller's device reach at `access` is UNRESTRICTED — admin-like
+ * breadth expressed as `category:device[access]` or a `device` grant whose
+ * selector is `all`. Such a caller is unaffected by the device-reference gate.
+ */
+function hasUnrestrictedDeviceReach(scopes, access) {
+    return scopes.some((s) => s.access.includes(access) &&
+        ((s.type === 'category' && s.target === 'device') ||
+            (s.type === 'device' && s.selector.kind === 'all')));
+}
+/**
+ * The device-reference gate for SYSTEM-scope cap methods (F1 #3).
+ *
+ * ~124 system-scope methods take a deviceId (`recording.getPlaybackManifest`,
+ * `faceGallery.*`, `pipelineOrchestrator.*`, …) and were never device-filtered:
+ * the matcher only extracted a deviceId when the CAP was `scope: 'device'`. So
+ * a non-admin holding `category:system[view]` could read ANY camera's
+ * recordings or faces regardless of the cameras they were granted. This closes
+ * that.
+ *
+ * Applied ONLY to system-scope caps, and only ON TOP of an already-passing
+ * cap-level grant — it never grants anything, it only subtracts. Device-scope
+ * caps are deliberately untouched: there the `device` scope branch IS the
+ * device check, and `capability:<name>` grants over device caps are
+ * cross-device by documented design (the `events` cap, which the
+ * `event-listener` preset depends on, is one). Making capability grants
+ * device-restricted on device caps too is a separate, operator-visible
+ * decision — not smuggled in here.
+ */
+function deviceRefsSatisfied(scopes, path, input, access, lookup) {
+    const refs = referencedDeviceIds(path, input);
+    if (refs.length === 0)
+        return { ok: true };
+    if (hasUnrestrictedDeviceReach(scopes, access))
+        return { ok: true };
+    const grants = scopes.filter((s) => s.type === 'device' && s.access.includes(access));
+    for (const deviceId of refs) {
+        const candidates = candidateMetas(deviceId, lookup);
+        const covered = grants.some((g) => deviceScopeCovers(g, access, candidates));
+        if (!covered)
+            return { ok: false, deviceId };
+    }
+    return { ok: true };
+}
+function checkScopeAccess(scopes, path, input, lookup) {
     const meta = system_1.METHOD_ACCESS_MAP[path];
     if (!meta) {
         return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
     }
     const deviceId = meta.capScope === 'device' ? extractDeviceId(input) : null;
-    const deviceChain = deviceId !== null ? effectiveDeviceIds(deviceId, getDeviceAncestors) : [];
+    const candidates = deviceId !== null ? candidateMetas(deviceId, lookup) : [];
     for (const s of scopes) {
         let targetMatches = false;
         switch (s.type) {
@@ -70,22 +195,43 @@ function checkScopeAccess(scopes, path, input, getDeviceAncestors) {
                 targetMatches = meta.addonId !== null && s.target === meta.addonId;
                 break;
             case 'device':
-                // Match if the request's device — or any of its ancestors — is
-                // in the grant's target list. Accessory children inherit the
-                // parent's scope without re-enumeration.
-                targetMatches = deviceChain.some((id) => s.targets.includes(id));
+                // A device grant matches either:
+                //  • a request naming a device, when the v3 selector covers it (or an
+                //    ancestor — accessory inheritance, gated by `includeLinked`); or
+                //  • a DEVICE ENUMERATION method, which names no device precisely
+                //    because it asks "which are mine". Those are safe to reach ONLY
+                //    because the RESPONSE is cut to the caller's set (see
+                //    `DEVICE_ENUMERATION_METHODS`); without that projection this
+                //    branch would hand the whole fleet to a one-camera token.
+                targetMatches =
+                    deviceId !== null
+                        ? deviceScopeCovers(s, meta.access, candidates)
+                        : exports.DEVICE_ENUMERATION_METHODS.has(path);
                 break;
         }
         if (!targetMatches)
             continue;
-        if (s.access.includes(meta.access))
-            return { ok: true, access: meta.access };
+        if (!s.access.includes(meta.access))
+            continue;
+        // Cap-level grant passes. A SYSTEM-scope method that NAMES devices must
+        // additionally be covered on each of them — otherwise `category:system`
+        // reads every camera's recordings (F1 #3).
+        if (meta.capScope === 'system') {
+            const refs = deviceRefsSatisfied(scopes, path, input, meta.access, lookup);
+            if (!refs.ok) {
+                return {
+                    ok: false,
+                    reason: `Device ${refs.deviceId} is outside your device scope (referenced by '${path}')`,
+                };
+            }
+        }
+        return { ok: true, access: meta.access };
     }
     return {
         ok: false,
         reason: `No scope grants ${meta.access} on '${meta.capName}' (${meta.capScope}-scope cap${deviceId !== null ? `, device=${deviceId}` : ''}). Have: ${scopes
             .map((s) => {
-            const target = s.type === 'device' ? `[${s.targets.join(',')}]` : s.target;
+            const target = s.type === 'device' ? `[${describeSelector(s)}]` : s.target;
             return `${s.type}:${target}[${s.access.join(',')}]`;
         })
             .join(', ') || '(none)'}`,

package/dist/api/trpc/share-view-access.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SHARE_SCOPE_PROJECTED_METHODS = void 0;
 exports.checkShareViewAccess = checkShareViewAccess;
 exports.projectListAllForShareScope = projectListAllForShareScope;
+exports.projectListAllForDeviceIds = projectListAllForDeviceIds;
 exports.projectShareScopeRows = projectShareScopeRows;
 exports.liveEventInShareScope = liveEventInShareScope;
 /**
@@ -156,9 +157,21 @@ function checkShareViewAccess(scope, path, input) {
  * Non-array payloads pass through untouched (the route errored upstream).
  */
 function projectListAllForShareScope(data, scope) {
+    return projectListAllForDeviceIds(data, new Set(scope.deviceIds));
+}
+/**
+ * The projection ENGINE: drop every `listAll` row whose id is not in
+ * `allowed`, and project the survivors onto the whitelisted row.
+ *
+ * Shared by the `csv_*` share path ({@link projectListAllForShareScope}) and
+ * the scoped-principal path (`projectListAllForPrincipal` in
+ * `principal-visibility.ts`) so enumeration is cut ONE way. Two projectors
+ * would be two chances to forget `config` — which carries the camera
+ * credentials in plaintext.
+ */
+function projectListAllForDeviceIds(data, allowed) {
     if (!Array.isArray(data))
         return data;
-    const allowed = new Set(scope.deviceIds);
     const rows = [];
     for (const entry of data) {
         if (entry === null || typeof entry !== 'object')

package/dist/api/trpc/trpc.context.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMeshTrpcContext = createMeshTrpcContext;
 exports.createTrpcContext = createTrpcContext;
 exports.createWsTrpcContext = createWsTrpcContext;
+const types_1 = require("@camstack/types");
 const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
 const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
@@ -109,7 +110,9 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
                 },
                 isApiKey: true,
                 isScoped: true,
-                scopes: record.scopes,
+                // Migrate any v2 `device:targets` grant to a v3 selector at the
+                // boundary so the enforcement matcher only ever sees v3.
+                scopes: (0, types_1.normalizeTokenScopes)(record.scopes),
             };
         }
         catch {
@@ -144,8 +147,10 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
             isApiKey: payload.type === 'api_key',
             agentId: payload.agentId,
             // Scopes are baked into the JWT at login; the middleware uses
-            // them to gate every call until the user re-logs.
-            ...(payload.scopes !== undefined ? { scopes: payload.scopes } : {}),
+            // them to gate every call until the user re-logs. Normalised at the
+            // boundary — a v2 `device:targets` JWT (issued before the v3 model)
+            // migrates to a selector here, so a pre-v3 token keeps working.
+            ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
             ...(credential.credential !== undefined ? { credential: credential.credential } : {}),
             ...(credential.sessionId !== undefined ? { oauthSessionId: credential.sessionId } : {}),
         };
@@ -155,24 +160,22 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
     }
 }
 /**
- * Build the parent-chain walker for the scope-access matcher. Returns
- * every ancestor deviceId of `deviceId` (parent, grandparent, …) so a
- * grant on a Reolink camera covers its accessory children without
- * re-enumerating them.
+ * Build the parent-chain walker for the scope-access matcher. Returns every
+ * ancestor deviceId of `deviceId` (parent, grandparent, …) so a grant on a
+ * Reolink camera covers its accessory children without re-enumerating them.
  *
- * Bounded by hop count (defence-in-depth — the device tree should
- * never exceed 2-3 levels but a corrupt registry shouldn't loop forever).
+ * Reads `AddonRegistryService.getPersistedAncestors` — the hub-process mirror of
+ * the device-manager's PERSISTED parentage (F0.6). It MUST NOT walk the hub
+ * `DeviceRegistry` directly: that registry only holds hub-local devices, so it
+ * is empty for every forked provider and the inheritance this function exists to
+ * provide silently did nothing (0/6 providers inherited). The mirror is warmed
+ * off the event path and read synchronously here.
  */
-function makeAncestorLookup(addonRegistry) {
-    return (deviceId) => {
-        const out = [];
-        const registry = addonRegistry.getDeviceRegistry();
-        let current = registry.getById(deviceId);
-        for (let hop = 0; hop < 8 && current?.parentDeviceId != null; hop++) {
-            out.push(current.parentDeviceId);
-            current = registry.getById(current.parentDeviceId);
-        }
-        return out;
+function makeDeviceScopeLookup(addonRegistry) {
+    return {
+        getAncestors: (deviceId) => addonRegistry.getPersistedAncestors(deviceId),
+        getType: (deviceId) => addonRegistry.getPersistedType(deviceId),
+        getLocation: (deviceId) => addonRegistry.getPersistedLocation(deviceId),
     };
 }
 /**
@@ -201,7 +204,8 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
     return {
         user: await resolveUser(token, authService, addonRegistry, shareTokens),
         req,
-        getDeviceAncestors: makeAncestorLookup(addonRegistry),
+        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }
 /**
@@ -217,6 +221,7 @@ async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens
     return {
         user,
         req: opts.req,
-        getDeviceAncestors: makeAncestorLookup(addonRegistry),
+        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }

package/dist/api/trpc/trpc.middleware.js

@@ -11,6 +11,7 @@ const server_1 = require("@trpc/server");
 const superjson_1 = __importDefault(require("superjson"));
 const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
 const device_config_secret_redaction_js_1 = require("./device-config-secret-redaction.js");
+const principal_visibility_js_1 = require("./principal-visibility.js");
 const scope_access_js_1 = require("./scope-access.js");
 const share_view_access_js_1 = require("./share-view-access.js");
 const t = server_1.initTRPC.context().create({
@@ -150,7 +151,7 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
         // The `getDeviceAncestors` hook lets the matcher walk parent → child
         // accessory inheritance (grant on Reolink also covers its siren / PIR).
         const rawInput = await getRawInput();
-        const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.getDeviceAncestors);
+        const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.deviceScopeLookup);
         if (!result.ok) {
             throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
         }
@@ -164,7 +165,20 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
     // orchestrator, the drivers that must actually connect) are unaffected.
     const redactConfigSecrets = device_config_secret_redaction_js_1.NON_ADMIN_CONFIG_REDACTED_METHODS.get(path);
     const out = await next({ ctx: { ...ctx, user: ctx.user } });
-    if (redactConfigSecrets && out.ok) {
+    if (!out.ok)
+        return out;
+    // A device-scoped principal ENUMERATES only its own devices (F1 #4). The
+    // matcher lets a `device`-selector grant reach `deviceManager.listAll`
+    // precisely because the answer is cut here; without this the grant would
+    // hand back the whole fleet — names, locations, online state.
+    if (scope_access_js_1.DEVICE_ENUMERATION_METHODS.has(path)) {
+        const projected = (0, principal_visibility_js_1.projectListAllForPrincipal)(out.data, ctx.user.isAdmin, ctx.user.scopes ?? [], ctx.deviceFleet?.() ?? []);
+        return {
+            ...out,
+            data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
+        };
+    }
+    if (redactConfigSecrets) {
         return { ...out, data: redactConfigSecrets(out.data) };
     }
     return out;

package/dist/core/addon/addon-package.service.js

@@ -311,6 +311,9 @@ class AddonPackageService {
         if (!this.isAllowedPackage(name)) {
             throw new Error(`Package "${name}" is not an allowed @camstack/* package`);
         }
+        if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name)) {
+            throw new Error(`"${name}" is a framework package — roll it back via serverManagement, not the addon-package path`);
+        }
         const previousVersion = this.getInstalledPackageVersion(name);
         const rolledBackTo = await this.installer.rollbackAddon(name);
         if (rolledBackTo == null) {
@@ -659,6 +662,11 @@ class AddonPackageService {
         await Promise.all([...seen].map(async ([name, version]) => {
             if (!this.isAllowedPackage(name))
                 return;
+            // Never OFFER a framework package as an addon update: clicking it would
+            // route to `updatePackage`, which now refuses it anyway. Filtering here
+            // keeps the UI honest (no dead "Update" button for @camstack/server).
+            if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name))
+                return;
             const latestVersion = await this.fetchLatestVersion(name);
             if (latestVersion === null || !isVersionNewer(latestVersion, version))
                 return;
@@ -897,6 +905,9 @@ class AddonPackageService {
                 error: `Package "${name}" is not an allowed @camstack/* package`,
             };
         }
+        const frameworkRefusal = this.refuseExcludedFramework(name);
+        if (frameworkRefusal)
+            return frameworkRefusal;
         // Dev-mode npm-install gate REMOVED (2026-05-12). The legacy
         // workspace-link flow assumed addons in dev came from `packages/*`
         // and a stray "Update" click would clobber the source. With the
@@ -990,6 +1001,9 @@ class AddonPackageService {
                 error: `Package "${name}" is not an allowed @camstack/* package`,
             };
         }
+        const frameworkRefusal = this.refuseExcludedFramework(name);
+        if (frameworkRefusal)
+            return frameworkRefusal;
         const category = this.categorize(name);
         this.logger.info('Applying staged addon update', { meta: { name, version, category } });
         try {
@@ -1620,6 +1634,26 @@ class AddonPackageService {
     isAllowedPackage(name) {
         return name.startsWith('@camstack/');
     }
+    /**
+     * A framework/system-tier package (`@camstack/server`, `system`, `types`,
+     * `sdk`, `kernel`, `core`, `ui-library`) must NEVER be installed by the
+     * addon-package path: it ships exclusively through `applyServerUpdate`
+     * (single-copy collapse). The auto-updater already skips these; the MANUAL
+     * entry points (`updatePackage`, `applyStagedAddonUpdate`, `rollbackPackage`)
+     * resolved them to `'core'` and ran a raw `npm install @camstack/server@X`,
+     * which bypasses the single-copy engine and — on 2026-08-13 — saturated the
+     * host mid-`applyServerUpdate` publish. A refusal, not a silent no-op.
+     */
+    refuseExcludedFramework(name) {
+        if (!exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name))
+            return null;
+        return {
+            success: false,
+            version: '',
+            requiresRestart: false,
+            error: `"${name}" is a framework package — install it via serverManagement.applyServerUpdate, not the addon-package path`,
+        };
+    }
     /** Categorize a package as 'addon' or 'core' */
     categorize(name) {
         if (CORE_MANAGED_PACKAGES.includes(name)) {

package/dist/core/addon/addon-registry.service.js

@@ -436,6 +436,10 @@ class AddonRegistryService {
         this.capabilityRegistry.registerProvider('addon-settings', '$hub', settingsProvider);
         // Wire capability consumer actions via EventBus
         this.wireCapabilityConsumers();
+        // Wire the persisted device-parent mirror (F0.6) so the scope matcher's
+        // parent→child accessory inheritance works for FORKED provider devices,
+        // which never appear in the hub-local DeviceRegistry.
+        this.wireDeviceParentMirror();
         // Subscribe to capability.binding-changed so hub-side capability
         // overrides take effect on the fly. The orchestrator addon emits
         // these when the operator swaps the addon implementing a cap on a
@@ -1060,6 +1064,144 @@ class AddonRegistryService {
     getDeviceRegistry() {
         return this.deviceRegistry;
     }
+    // ── Persisted device-parent mirror (F0.6) ─────────────────────────────────
+    //
+    // The scope matcher's parent→child accessory inheritance (`getDeviceAncestors`
+    // in `trpc.context.ts`) needs a deviceId's ancestor chain on EVERY scoped
+    // request. The hub `DeviceRegistry` only knows devices registered IN the hub
+    // process, so it is EMPTY for every forked provider (reolink, hikvision, …):
+    // a grant on a forked camera never reached its siren/floodlight/PIR children
+    // (measured 0/6 providers inherited). The authoritative parentage lives in the
+    // device-manager's PERSISTED meta, which `listAll` projects for the whole
+    // fleet — forked devices included. This is a hub-process, SYNCHRONOUSLY
+    // readable mirror of that parentage, refreshed OFF the request path on every
+    // device-meta lifecycle event — never a per-call DB query.
+    deviceParentMirror = new Map();
+    /**
+     * Hub-process mirror of each device's persisted `type` + `location`, warmed
+     * from the same `listAll({projection:'slim'})` sweep as the parent mirror.
+     * Backs the v3 scope-model `types` / `locations` selectors: the enforcement
+     * matcher resolves a selector against a device's type/location synchronously,
+     * off the request path (D49). Empty for a device the hub has never heard of.
+     */
+    deviceMetaMirror = new Map();
+    /** Parent of a device: the persisted mirror first (covers forked devices),
+     *  falling back to the live hub registry (covers a hub-local device before the
+     *  first mirror warm). null when top-level or unknown. */
+    parentOfDevice(deviceId) {
+        const mirrored = this.deviceParentMirror.get(deviceId);
+        if (mirrored !== undefined)
+            return mirrored;
+        return this.deviceRegistry.getById(deviceId)?.parentDeviceId ?? null;
+    }
+    /** Persisted `DeviceType` string of a device, or null when unknown. Mirror
+     *  first (covers forked devices), then the live hub registry. */
+    getPersistedType = (deviceId) => {
+        const mirrored = this.deviceMetaMirror.get(deviceId);
+        if (mirrored !== undefined)
+            return mirrored.type;
+        return this.deviceRegistry.getById(deviceId)?.type ?? null;
+    };
+    /** Persisted operator `location` label of a device, or null when unset/unknown. */
+    getPersistedLocation = (deviceId) => {
+        const mirrored = this.deviceMetaMirror.get(deviceId);
+        if (mirrored !== undefined)
+            return mirrored.location;
+        return this.deviceRegistry.getById(deviceId)?.location ?? null;
+    };
+    /**
+     * The whole persisted fleet, slim — id + type + location + parentDeviceId.
+     * Fuels the FLEET-wide selector expansion (response projection + `auth.me`
+     * counts). Read synchronously off the mirror, never a per-call DB query.
+     */
+    getPersistedDeviceList = () => {
+        const out = [];
+        for (const [id, m] of this.deviceMetaMirror) {
+            out.push({
+                id,
+                type: m.type,
+                location: m.location,
+                parentDeviceId: this.deviceParentMirror.get(id) ?? null,
+            });
+        }
+        return out;
+    };
+    /**
+     * Ancestor chain (parent, grandparent, …) of a device, bounded to 8 hops
+     * (defence-in-depth against a corrupt registry cycle). Synchronous — it is
+     * read on every scoped request. Backed by the persisted mirror so a grant on
+     * a FORKED camera covers its accessory children. Empty for a top-level device
+     * or one the hub has never heard of.
+     */
+    getPersistedAncestors = (deviceId) => {
+        const out = [];
+        let current = deviceId;
+        for (let hop = 0; hop < 8; hop++) {
+            const parent = this.parentOfDevice(current);
+            if (parent == null || parent === current)
+                break;
+            out.push(parent);
+            current = parent;
+        }
+        return out;
+    };
+    /** Subscribe the mirror to every device-meta lifecycle event, and warm it once
+     *  the addon set (device-manager included) is up. */
+    wireDeviceParentMirror() {
+        const refresh = () => {
+            void this.refreshDeviceParentMirror();
+        };
+        for (const category of [
+            types_1.EventCategory.DeviceMetaChanged,
+            types_1.EventCategory.DeviceRegistered,
+            types_1.EventCategory.DeviceUnregistered,
+            types_1.EventCategory.DeviceProvisioned,
+            types_1.EventCategory.SystemAddonsReady,
+        ]) {
+            this.eventBusService.subscribe({ category }, refresh);
+        }
+    }
+    /** Rebuild the parent mirror from the device-manager's persisted fleet
+     *  (`listAll`, slim projection — no config blob). Off the request path; a
+     *  failed read KEEPS the previous mirror (D49 — a read that fails changes
+     *  nothing, and must never look like an unbind that destroys inheritance). */
+    async refreshDeviceParentMirror() {
+        try {
+            const api = this.getBrokerApi();
+            const rows = await api.deviceManager.listAll.query({ projection: 'slim' });
+            if (!Array.isArray(rows))
+                return;
+            const nextParents = new Map();
+            const nextMeta = new Map();
+            for (const row of rows) {
+                if (row === null || typeof row !== 'object')
+                    continue;
+                const id = Reflect.get(row, 'id');
+                if (typeof id !== 'number')
+                    continue;
+                const parent = Reflect.get(row, 'parentDeviceId');
+                if (typeof parent === 'number')
+                    nextParents.set(id, parent);
+                const type = Reflect.get(row, 'type');
+                const location = Reflect.get(row, 'location');
+                nextMeta.set(id, {
+                    type: typeof type === 'string' ? type : '',
+                    location: typeof location === 'string' ? location : null,
+                });
+            }
+            this.deviceParentMirror.clear();
+            for (const [k, v] of nextParents)
+                this.deviceParentMirror.set(k, v);
+            this.deviceMetaMirror.clear();
+            for (const [k, v] of nextMeta)
+                this.deviceMetaMirror.set(k, v);
+        }
+        catch (err) {
+            this.logger.debug('device-parent mirror refresh failed — keeping previous', {
+                meta: { error: (0, types_1.errMsg)(err) },
+            });
+        }
+    }
     /** Load persisted collection disabled-lists from settings-store into the registry */
     loadCollectionPreferences() {
         // TODO: implement CapabilityRegistry.loadDisabledProviders() to restore persisted preferences

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.104",
+  "version": "1.2.106",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.54",
+    "@camstack/addon-admin-ui": "1.2.55",
     "@camstack/addon-agent-ui": "1.2.17",
     "@camstack/addon-auth": "1.2.18",
     "@camstack/addon-decoder-nodeav": "1.2.16",
     "@camstack/addon-notifiers": "1.2.21",
-    "@camstack/addon-pipeline": "1.2.73",
-    "@camstack/addon-pipeline-orchestrator": "1.2.53",
-    "@camstack/addon-post-analysis": "1.2.70",
+    "@camstack/addon-pipeline": "1.2.74",
+    "@camstack/addon-pipeline-orchestrator": "1.2.54",
+    "@camstack/addon-post-analysis": "1.2.72",
     "@camstack/sdk": "1.2.18",
     "@camstack/shm-ring": "1.1.16",
     "@camstack/system": "1.2.88",
-    "@camstack/types": "1.2.67",
-    "@camstack/ui-library": "1.2.46",
+    "@camstack/types": "1.2.69",
+    "@camstack/ui-library": "1.2.47",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",