@camstack/server 1.2.604 → 1.2.606

package/dist/main.js

@@ -71,6 +71,8 @@ const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
 const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
+const embed_auth_route_js_1 = require("./auth/embed-auth-route.js");
+const live_user_js_1 = require("./auth/live-user.js");
 const server_upload_1 = require("./api/server-upload");
 const server_upload_propagate_1 = require("./api/server-upload-propagate");
 const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
@@ -88,7 +90,7 @@ const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
 const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
 const ws_request_census_1 = require("./api/trpc/ws-request-census");
 const ws_slow_consumer_guard_js_1 = require("./api/trpc/ws-slow-consumer-guard.js");
-const addon_route_jwt_gate_js_1 = require("./auth/addon-route-jwt-gate.js");
+const addon_route_auth_js_1 = require("./auth/addon-route-auth.js");
 const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
 const auth_network_policy_js_1 = require("./auth/auth-network-policy.js");
 const hub_sessions_js_1 = require("./auth/hub-sessions.js");
@@ -121,7 +123,7 @@ const agent_registry_service_1 = require("./core/agent/agent-registry.service");
 const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const auth_service_1 = require("./core/auth/auth.service");
 const handoff_code_service_1 = require("./core/auth/handoff-code.service");
-const share_token_service_1 = require("./core/auth/share-token.service");
+const credential_token_service_js_1 = require("./core/auth/credential-token.service.js");
 const config_service_1 = require("./core/config/config.service");
 const event_bus_service_1 = require("./core/events/event-bus.service");
 const feature_service_1 = require("./core/feature/feature.service");
@@ -437,8 +439,8 @@ async function bootstrap() {
     const sessionLifetimes = () => (0, session_lifetimes_js_1.readSessionLifetimes)((key) => config.get(key));
     // Register addon upload route (multipart — must be registered before tRPC).
     // We pass AddonRegistryService so the handler can resolve the
-    // `user-management` cap singleton at request time (the only working
-    // path to validate `cst_*` scoped tokens — see addon-upload.ts).
+    // `user-management` cap singleton at request time (the credential
+    // verifier reads users and admin bits there — see upload-auth.ts).
     try {
         const uploadAuthService = app.get(auth_service_1.AuthService);
         const uploadAddonBridge = app.get(addon_bridge_service_1.AddonBridgeService);
@@ -472,8 +474,8 @@ async function bootstrap() {
                 .getSingleton('local-network')),
         });
         console.log('[bootstrap] Server upload propagate route registered at POST /api/server-upload/propagate');
-        // Companion endpoint: /api/auth/whoami — validates JWT or cst_*
-        // scoped tokens, returns the resolved identity + scope summary.
+        // Companion endpoint: /api/auth/whoami — verifies any hub credential
+        // through the one verifier, returns the resolved identity + scopes.
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
@@ -595,11 +597,13 @@ async function bootstrap() {
     // and the distributed metrics-provider capability — no manual wiring needed.
     let trpcRegistered = false;
     let appRouter = null;
-    // Share-view (`csv_*`) tokens — hub-resident mint/verify/revoke over the
-    // settings backend (lazy getter: the backend lands after the sqlite-storage
-    // builtin registers; the service resolves it per call).
-    const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
-    addonRegistry.setShareTokenService(shareTokenService);
+    // The one token store (D892, D895): rows in the `core-auth` records — admin
+    // tokens, scoped tokens and share links alike; the JWT is signed with the
+    // session signing key.
+    const credentialTokenService = new credential_token_service_js_1.CredentialTokenService(app.get(auth_service_1.AuthService), loggingService.createLogger('tokens'));
+    addonRegistry.setCredentialTokenService(credentialTokenService);
+    // Every surface that verifies a bearer reads the same stores (D892).
+    (0, trpc_context_1.bindHubCredentialStores)({ tokenRows: credentialTokenService });
     // One-time native-app login handoff codes (in-memory, 60s TTL, single-use) —
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.
@@ -631,7 +635,7 @@ async function bootstrap() {
     });
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
-        shareTokenService,
+        credentialTokenService,
         handoffCodeService,
         externalLinkIntents,
         nativeLink: {
@@ -800,10 +804,10 @@ async function bootstrap() {
             trpcOptions: {
                 router: appRouter,
                 createContext: async ({ req }) => {
-                    const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
+                    const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, 
                     // A bearer refused for NOT being an API credential never reaches a
                     // procedure, so `onError` below never sees it — the refusal would
-                    // be silent without this. Same reason `gateAddonJwt` logs (D103).
+                    // be silent without this. Same reason the addon gate logs (D103).
                     app.get(logging_service_1.LoggingService).createLogger('tRPC'));
                     // WHO called, counted here because this is the first point at which
                     // a principal exists AND the only one tRPC runs exactly once per
@@ -1039,42 +1043,21 @@ async function bootstrap() {
             reply.setCookie(c.name, c.value, c.options);
             return reply.send({ ok: true });
         });
-        // GET /api/embed-auth?next=<embed-path> — establish the browser session
-        // cookie from a Bearer token, then 302 to the embed. A native WebView can
-        // pass `Authorization` only on the INITIAL navigation, not on the page's
-        // asset sub-requests; the data-plane `authenticated` gate reads the cookie,
-        // so we mint it here (mirroring POST /api/auth/session) and bounce to the
-        // embed — page + assets then authenticate via the cookie. `next` is
-        // restricted to the stream-broker embed prefix (no open redirect).
-        fastify.get('/api/embed-auth', async (request, reply) => {
-            const authHeader = request.headers.authorization;
-            const token = authHeader?.startsWith('Bearer ')
-                ? authHeader.slice('Bearer '.length)
-                : undefined;
-            if (!token)
-                return reply.status(401).send({ error: 'Bearer token required' });
-            const next = request.query?.next ?? '';
-            if (!(0, session_cookie_js_1.isEmbedRedirectTarget)(next))
-                return reply.status(400).send({ error: 'invalid next' });
-            let ttlSec;
-            try {
-                const payload = authService.verifyToken(token);
-                const expSec = typeof payload.exp === 'number' ? payload.exp : 0;
-                ttlSec = Math.max(0, expSec - Math.floor(Date.now() / 1000));
-            }
-            catch {
-                return reply.status(401).send({ error: 'invalid token' });
-            }
-            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
-                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
-            });
-            reply.setCookie(c.name, c.value, c.options);
-            return reply.redirect(next);
+        // GET /api/embed-auth — a person's login session becomes the embed's
+        // cookie (`auth/embed-auth-route.ts`); nothing else this hub signed does.
+        (0, embed_auth_route_js_1.registerEmbedAuthRoute)(fastify, {
+            verifyToken: (token) => authService.verifyToken(token),
+            isLiveUser: (0, live_user_js_1.liveUserCheck)(capabilityRegistry),
         });
         // Every refusal on the addon gate is a request an operator will be asking
         // about ("why did Home Assistant stop actuating?"). Its own scope so the
         // reason is greppable rather than buried in the bootstrap logger.
         const addonGateLogger = app.get(logging_service_1.LoggingService).createLogger('addon-route-auth');
+        const addonVerifier = (0, trpc_context_1.hubCredentialVerifier)({
+            authService,
+            addonRegistry,
+            logger: addonGateLogger,
+        });
         // Addon HTTP API route catch-all: /addon/:addonId/*
         // Only handles non-GET or routes that actually exist in the addon route registry.
         // GET requests that don't match an addon route are SPA pages — handled by the /* fallback.
@@ -1113,40 +1096,20 @@ async function bootstrap() {
                         return reply.status(401).send({ error: 'Unauthorized' });
                     }
                     const token = authHeader ? authHeader.replace('Bearer ', '') : cookieToken;
-                    if (token.startsWith('csv_')) {
-                        // A share link (`csv_*`): admitted only by a plane that opted in
-                        // to its scope kind, and the scope's devices travel in headers the
-                        // HUB sets — whatever the client sent under those names is dropped
-                        // (see `addon-route-share-gate.ts`).
-                        const record = await shareTokenService.validate(token);
-                        const gate = (0, addon_route_share_gate_js_1.gateAddonShareToken)({ record, endpoint: dpMatch.endpoint });
-                        if (!gate.ok)
-                            return reply.status(gate.status).send({ error: gate.error });
-                        shareHeaders = gate.headers;
-                    }
-                    else if (token.startsWith('cst_')) {
-                        const userMgmt = capabilityRegistry?.getSingleton('user-management');
-                        if (!userMgmt)
-                            return reply.status(503).send({ error: 'User management not available' });
-                        const scopedToken = await userMgmt.validateScopedToken({ token });
-                        const scopeOk = scopedToken?.scopes.some((scope) => scope.type === 'addon' && scope.target === addonId);
-                        if (!scopedToken || !scopeOk) {
-                            return reply.status(403).send({ error: 'Token scope mismatch' });
-                        }
-                    }
-                    else {
-                        let payload;
-                        try {
-                            payload = authService.verifyToken(token);
-                        }
-                        catch {
-                            return reply.status(401).send({ error: 'Invalid token' });
-                        }
-                        const gate = (0, addon_route_jwt_gate_js_1.gateAddonJwt)({ payload, addonId, method, access }, addonGateLogger);
-                        if (!gate.ok) {
-                            return reply.status(gate.status).send({ error: gate.error });
-                        }
-                    }
+                    // The ONE verifier and the ONE scope matcher, as on tRPC (D892). A
+                    // share principal is admitted only by a plane that opted in to its
+                    // kind, and its devices travel in headers the HUB sets — whatever
+                    // the client sent under those names is dropped below.
+                    const auth = await (0, addon_route_auth_js_1.authorizeAddonBearer)({
+                        bearer: token,
+                        verifier: addonVerifier,
+                        target: { addonId, method, access, share: dpMatch.endpoint.share ?? [] },
+                        facts: (0, trpc_context_1.requestFacts)(request),
+                        logger: addonGateLogger,
+                    });
+                    if (!auth.ok)
+                        return reply.status(auth.status).send({ error: auth.error });
+                    shareHeaders = auth.shareHeaders;
                 }
                 const qIdx = request.url.indexOf('?');
                 const queryString = qIdx >= 0 ? request.url.slice(qIdx) : '';
@@ -1221,67 +1184,27 @@ async function bootstrap() {
                     return reply.status(401).send({ error: 'Unauthorized' });
                 }
                 const token = authHeader ? authHeader.replace('Bearer ', '') : cookieToken;
-                if (token.startsWith('cst_')) {
-                    const userMgmt = capabilityRegistry?.getSingleton('user-management');
-                    if (!userMgmt)
-                        return reply.status(503).send({ error: 'User management not available' });
-                    const scopedToken = await userMgmt.validateScopedToken({ token });
-                    if (!scopedToken) {
-                        return reply.status(401).send({ error: 'Invalid token' });
-                    }
-                    // v2 model: scoped tokens grant by cap-category/cap-name/addon.
-                    // For addon-route REST endpoints we match the `addon` scope
-                    // type only — generic route-prefix scopes were dropped with
-                    // the caps-only refactor.
-                    const scopeMatch = scopedToken.scopes.some((scope) => {
-                        return scope.type === 'addon' && scope.target === addonId;
-                    });
-                    if (!scopeMatch) {
-                        return reply.status(403).send({ error: 'Token scope mismatch' });
-                    }
-                    // Build addon request with scoped token context
-                    const addonRequest = {
-                        params: match.params,
-                        query,
-                        body: request.body,
-                        headers,
-                        scopedToken: {
-                            id: scopedToken.id,
-                            userId: scopedToken.userId,
-                            scopes: scopedToken.scopes,
-                        },
-                    };
-                    const addonReply = buildAddonReply(reply);
-                    return match.route.handler(addonRequest, addonReply);
-                }
-                else {
-                    let payload;
-                    try {
-                        payload = authService.verifyToken(token);
-                    }
-                    catch {
-                        return reply.status(401).send({ error: 'Invalid token' });
-                    }
-                    // NOTE: the handler call used to sit INSIDE this try, so a throw from
-                    // an addon's own route handler was reported as `401 Invalid token`.
-                    const gate = (0, addon_route_jwt_gate_js_1.gateAddonJwt)({ payload, addonId, method, access: match.route.access }, addonGateLogger);
-                    if (!gate.ok) {
-                        return reply.status(gate.status).send({ error: gate.error });
-                    }
-                    const addonRequest = {
-                        params: match.params,
-                        query,
-                        body: request.body,
-                        headers,
-                        user: {
-                            id: payload.userId ?? 'unknown',
-                            username: payload.username ?? 'unknown',
-                            isAdmin: payload.isAdmin,
-                        },
-                    };
-                    const addonReply = buildAddonReply(reply);
-                    return match.route.handler(addonRequest, addonReply);
-                }
+                // The ONE verifier and the ONE scope matcher, as on tRPC (D892).
+                const auth = await (0, addon_route_auth_js_1.authorizeAddonBearer)({
+                    bearer: token,
+                    verifier: addonVerifier,
+                    target: { addonId, method, access: match.route.access },
+                    facts: (0, trpc_context_1.requestFacts)(request),
+                    logger: addonGateLogger,
+                });
+                if (!auth.ok)
+                    return reply.status(auth.status).send({ error: auth.error });
+                // NOTE: the handler call used to sit INSIDE the JWT try, so a throw
+                // from an addon's own route handler was reported as `401 Invalid token`.
+                const addonRequest = {
+                    params: match.params,
+                    query,
+                    body: request.body,
+                    headers,
+                    ...(0, addon_route_auth_js_1.addonRouteCaller)(auth.principal),
+                };
+                const addonReply = buildAddonReply(reply);
+                return match.route.handler(addonRequest, addonReply);
             }
             // Public route — no auth required
             const addonRequest = {
@@ -1301,6 +1224,7 @@ async function bootstrap() {
         (0, oauth2_routes_js_1.registerOauth2Routes)(fastify, {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
+            isLiveUser: (0, live_user_js_1.liveUserCheck)(capabilityRegistry),
             // The hub's public endpoint from the `local-network` cap (the flagged
             // address, else tunnel, then mesh, then LAN). `localhost` only when the
             // palette names nothing — the dev case, where it is the truth.
@@ -1387,7 +1311,7 @@ async function bootstrap() {
             // A termination here closes with 1006; the guard's close line names it.
             keepAlive: { enabled: true, pingMs: 30_000, pongWaitMs: 10_000 },
             createContext: async (opts) => {
-                const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
+                const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
                 // The connection's identity, derived ONCE and reused for every
                 // operation on this socket. Frames that arrived while the bearer was
                 // still resolving are held by the session and released here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.604",
+  "version": "1.2.606",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.440",
-    "@camstack/addon-agent-ui": "1.2.246",
-    "@camstack/addon-auth": "1.2.151",
-    "@camstack/addon-decoder-nodeav": "1.2.125",
-    "@camstack/addon-notifiers": "1.2.603",
-    "@camstack/addon-pipeline": "1.2.603",
-    "@camstack/addon-pipeline-orchestrator": "1.2.604",
-    "@camstack/addon-post-analysis": "1.2.609",
-    "@camstack/develop": "0.1.15",
-    "@camstack/sdk": "1.2.135",
-    "@camstack/system": "1.2.454",
-    "@camstack/types": "1.2.385",
-    "@camstack/ui-library": "1.2.302",
+    "@camstack/addon-admin-ui": "1.2.442",
+    "@camstack/addon-agent-ui": "1.2.248",
+    "@camstack/addon-auth": "1.2.153",
+    "@camstack/addon-decoder-nodeav": "1.2.127",
+    "@camstack/addon-notifiers": "1.2.605",
+    "@camstack/addon-pipeline": "1.2.605",
+    "@camstack/addon-pipeline-orchestrator": "1.2.606",
+    "@camstack/addon-post-analysis": "1.2.611",
+    "@camstack/develop": "0.1.17",
+    "@camstack/sdk": "1.2.137",
+    "@camstack/system": "1.2.456",
+    "@camstack/types": "1.2.387",
+    "@camstack/ui-library": "1.2.304",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/api/core/auth-admin-tokens.procedures.js

@@ -1,138 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthAuditRecordSchema = exports.AdminTokenSchema = exports.ADMIN_TOKEN_MAX_DAYS = exports.ADMIN_TOKEN_DEFAULT_DAYS = void 0;
-exports.createAdminTokenProcedures = createAdminTokenProcedures;
-/**
- * Admin tokens (`csa_`) and the auth audit trail, as the `auth` router serves
- * them. The token store and its rules are local-auth's
- * (`admin-token-manager.ts`); this layer adds who may mint one: an ADMIN, in a
- * real signed-in session (never a token minting a token), right after
- * re-authenticating. Every create / use / revoke is audited.
- */
-const system_1 = require("@camstack/system");
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
-const DAY_MS = 86_400_000;
-exports.ADMIN_TOKEN_DEFAULT_DAYS = 7;
-exports.ADMIN_TOKEN_MAX_DAYS = system_1.ADMIN_TOKEN_MAX_LIFETIME_MS / DAY_MS;
-exports.AdminTokenSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    createdBy: zod_1.z.string(),
-    name: zod_1.z.string(),
-    tokenPrefix: zod_1.z.string(),
-    createdAt: zod_1.z.number(),
-    expiresAt: zod_1.z.number(),
-    lastUsedAt: zod_1.z.number().nullable(),
-    revokedAt: zod_1.z.number().nullable(),
-});
-exports.AuthAuditRecordSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    at: zod_1.z.number(),
-    action: zod_1.z.string(),
-    userId: zod_1.z.string().optional(),
-    ip: zod_1.z.string().optional(),
-    detail: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
-});
-function requireInternal(registry) {
-    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
-    if (internal === null) {
-        throw new server_1.TRPCError({
-            code: 'PRECONDITION_FAILED',
-            message: 'User management is not available',
-        });
-    }
-    return internal;
-}
-function createAdminTokenProcedures(deps) {
-    return {
-        /**
-         * ADMIN — mint an admin token for an ops script. Requires a real
-         * signed-in session (an admin token cannot mint another) and a fresh
-         * re-authentication. Expiry mandatory: 1–90 days, default 7. The token
-         * is in this answer only.
-         */
-        createAdminToken: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            name: zod_1.z.string().trim().min(1).max(80),
-            expiresInDays: zod_1.z
-                .number()
-                .int()
-                .min(1)
-                .max(exports.ADMIN_TOKEN_MAX_DAYS)
-                .default(exports.ADMIN_TOKEN_DEFAULT_DAYS),
-            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
-        }))
-            .output(zod_1.z.object({ token: zod_1.z.string(), record: exports.AdminTokenSchema }))
-            .mutation(async ({ ctx, input }) => {
-            if (ctx.user.isScoped === true ||
-                ctx.user.shareView !== undefined ||
-                ctx.user.credential !== undefined) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: 'An admin token can only be created from a signed-in admin session',
-                });
-            }
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, ctx.user, input.reauthToken);
-            const internal = requireInternal(deps.registry);
-            const created = await internal.adminTokens.create({
-                createdBy: ctx.user.id,
-                name: input.name,
-                expiresAt: Date.now() + input.expiresInDays * DAY_MS,
-            });
-            const ip = deps.network.clientAddress(ctx.req).ip;
-            await internal.audit.record({
-                action: 'admin-token-created',
-                userId: ctx.user.id,
-                ...(ip !== null ? { ip } : {}),
-                detail: {
-                    tokenId: created.record.id,
-                    name: created.record.name,
-                    prefix: created.record.tokenPrefix,
-                    expiresAt: created.record.expiresAt,
-                },
-            });
-            return created;
-        }),
-        /** ADMIN — every admin token not yet reaped (no secrets). */
-        listAdminTokens: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(exports.AdminTokenSchema))
-            .query(async () => [...(await requireInternal(deps.registry).adminTokens.list())]),
-        /** ADMIN — revoke one admin token; it stops working at once. */
-        revokeAdminToken: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
-            .mutation(async ({ ctx, input }) => {
-            const internal = requireInternal(deps.registry);
-            const success = await internal.adminTokens.revoke(input.id);
-            if (success) {
-                const ip = deps.network.clientAddress(ctx.req).ip;
-                await internal.audit.record({
-                    action: 'admin-token-revoked',
-                    userId: ctx.user.id,
-                    ...(ip !== null ? { ip } : {}),
-                    detail: { tokenId: input.id },
-                });
-            }
-            return { success };
-        }),
-        /** ADMIN — the authentication audit trail, newest first. */
-        listAuthAudit: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z
-            .object({
-            limit: zod_1.z.number().int().min(1).max(500).optional(),
-            userId: zod_1.z.string().min(1).optional(),
-        })
-            .optional())
-            .output(zod_1.z.array(exports.AuthAuditRecordSchema))
-            .query(async ({ input }) => [
-            ...(await requireInternal(deps.registry).audit.list({
-                ...(input?.limit !== undefined ? { limit: input.limit } : {}),
-                ...(input?.userId !== undefined ? { userId: input.userId } : {}),
-            })),
-        ]),
-    };
-}

package/dist/auth/addon-route-jwt-gate.js

@@ -1,59 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.gateAddonJwt = gateAddonJwt;
-/**
- * The JWT half of the `/addon/:addonId/*` gate — shared by the HTTP data-plane
- * branch and the addon-route branch so there is exactly ONE answer to "may this
- * bearer reach this addon".
- *
- * Before this existed the two branches disagreed with themselves and with the
- * `cst_` branch: a scoped token needed an `addon:<id>` grant, while ANY valid
- * hub JWT passed on nothing but a signature check. Measured on the live hub
- * 2026-08-09, that let an `oauth-access` token minted for the `export-alexa`
- * account link drive `POST /addon/homeassistant-export/command` — PTZ, reboot,
- * the per-camera switches and notification snooze. A 60-second authorization
- * CODE and a 30-day refresh token passed the same way. See D103.
- */
-const types_1 = require("@camstack/types");
-function readScopes(raw) {
-    return Array.isArray(raw) ? raw : [];
-}
-/**
- * Decide, and REPORT. A refusal always returns its reason to the log — a branch
- * that drops a request silently reads as "never happened", and this one drops
- * requests an operator will be trying to explain.
- *
- * Order is deliberate. `Admin required` is answered before the scope check so
- * an admin-only route keeps the response it already had; nothing that is not a
- * session or an `oauth-access` token gets that far at all.
- */
-function gateAddonJwt(input, logger) {
-    const principal = (0, types_1.classifyBearerPrincipal)(input.payload);
-    const isAdmin = input.payload.isAdmin === true;
-    if (principal.kind === 'not-a-credential') {
-        logger.warn('addon route: refused a bearer that is not an API credential', {
-            meta: { addonId: input.addonId, method: input.method, reason: principal.reason },
-        });
-        return { ok: false, status: 401, error: 'Invalid token' };
-    }
-    if (input.access === 'admin' && !isAdmin) {
-        logger.warn('addon route: refused a non-admin bearer on an admin route', {
-            meta: { addonId: input.addonId, method: input.method, principal: principal.kind },
-        });
-        return { ok: false, status: 403, error: 'Admin required' };
-    }
-    const verdict = (0, types_1.principalMayReachAddon)({
-        principal,
-        scopes: readScopes(input.payload.scopes),
-        isAdmin,
-        addonId: input.addonId,
-        method: input.method,
-    });
-    if (!verdict.allowed) {
-        logger.warn('addon route: refused an integration token outside its declared grant', {
-            meta: { addonId: input.addonId, method: input.method, reason: verdict.reason },
-        });
-        return { ok: false, status: 403, error: 'Token scope mismatch' };
-    }
-    return { ok: true };
-}