@camstack/server 1.2.605 → 1.2.606

package/dist/api/core/auth.router.js

@@ -32,11 +32,9 @@ const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const session_mint_js_1 = require("../../auth/session-mint.js");
 const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
-const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const auth_limits_js_1 = require("./auth-limits.js");
-const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
+const auth_audit_procedures_js_1 = require("./auth-audit.procedures.js");
 const auth_tokens_procedures_js_1 = require("./auth-tokens.procedures.js");
 const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
@@ -170,59 +168,14 @@ const OwnExternalIdentitySchema = zod_1.z.object({
     /** Whether the provider instance is configured and enabled right now. */
     available: zod_1.z.boolean(),
 });
-// ── Share tokens (grid-view standalone share links) ──────────────────
-//
-// Wire schemas for the `csv_*` share-token surface. The summary shape
-// deliberately omits `tokenHash` — the raw token is returned exactly
-// once (at mint); afterwards only prefix + scope + timestamps are
-// visible.
-//
-// TTL: a bounded number of seconds, or the EXPLICIT literal `'never'`
-// for a permanently-shared grid (revocation is the kill switch).
-// Omitted → 7-day default; infinite is never a silent default.
-const CreateShareTokenInputSchema = zod_1.z.object({
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    ttlSec: zod_1.z
-        .union([
-        zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
-        zod_1.z.literal('never'),
-    ])
-        .optional(),
-});
-const ShareTokenSummarySchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    userId: zod_1.z.string(),
-    tokenPrefix: zod_1.z.string(),
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    createdAt: zod_1.z.number(),
-    /** Epoch ms, or `null` for never-expiring tokens. */
-    expiresAt: zod_1.z.number().nullable(),
-    /** Derived convenience flag so listings surface infinite tokens clearly. */
-    neverExpires: zod_1.z.boolean(),
-    lastUsedAt: zod_1.z.number().optional(),
-    /** A pre-D892 `csv_` link: valid until it expires, never minted again. */
-    legacy: zod_1.z.boolean().optional(),
-});
-function toShareTokenSummary(record) {
-    return {
-        id: record.id,
-        userId: record.userId,
-        tokenPrefix: record.tokenPrefix,
-        scope: record.scope,
-        createdAt: record.createdAt,
-        expiresAt: record.expiresAt,
-        neverExpires: record.expiresAt === null,
-        ...(record.lastUsedAt !== undefined ? { lastUsedAt: record.lastUsedAt } : {}),
-    };
-}
 /**
  * Token minting/management surfaces are for REAL user sessions only.
- * Scoped API tokens (`cst_*`) and share-view principals (`csv_*`) must
- * never mint, list, or revoke share links — nor mint handoff codes —
- * a leaked restricted token would otherwise widen its own reach.
+ * A minted token — whatever its scopes — must never mint handoff codes or
+ * link sign-in accounts: a leaked restricted token would otherwise widen its
+ * own reach.
  */
-function assertRealUserSession(user, what = 'Share-token management') {
-    // A minted token (admin, scoped, share — legacy or unified) is a script's
+function assertRealUserSession(user, what) {
+    // A minted token (admin, scoped or share-view) is a script's
     // credential, never a person's: it must not turn itself into a session
     // (handoff codes) or mint links. Provenance, not permission (D892).
     if (user.userDelegated !== true) {
@@ -301,7 +254,7 @@ const MeSchema = zod_1.z
     scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
+function createAuthRouter(auth, registry, moleculer = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
     const network = options.network ?? auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY;
     const limiters = options.limiters ?? auth_limits_js_1.PROCESS_AUTH_LIMITERS;
     /** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
@@ -309,20 +262,6 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
     /** Challenge-minting begin-legs — looser, they verify nothing. */
     const ceremonyProcedure = makeRateLimitedProcedure(limiters.ceremony, network);
     const credentialTokens = options.credentialTokens ?? null;
-    const tokenDeps = { auth, registry, network, credentialTokens, shareTokens };
-    /** The unified share link behind `id`, or `null` (a legacy `csv_`, or none). */
-    const unifiedShare = async (id) => {
-        if (credentialTokens === null)
-            return null;
-        const record = await credentialTokens.get(id);
-        return record !== null && (0, types_2.shareViewGrantOf)(record.scopes) !== null ? record : null;
-    };
-    const requireShareTokens = () => {
-        if (!shareTokens) {
-            throw new Error('Share tokens unavailable — service not wired on this node');
-        }
-        return shareTokens;
-    };
     /**
      * THE session mint (`auth/session-mint.ts`, D712) — the single shared tail
      * of every successful login leg, including `/api/auth/sso/finish`. It
@@ -800,8 +739,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     semantics (see `buildSessionCookie` — Lax already withholds
          *     the cookie from cross-site POSTs).
          *   • Only REAL session JWTs qualify: bridge tokens (`kind:
-         *     'totp-challenge'` / `'sso-bridge'`) and `cst_`/`csv_` opaque
-         *     tokens are rejected — the cookie must carry a v2 session.
+         *     'totp-challenge'` / `'sso-bridge'`) and minted tokens are
+         *     rejected — the cookie must carry a v2 session.
          *   • The returned bearer is minted FRESH through the shared
          *     `mintSessionForUserId` tail (re-fetched user → up-to-date
          *     scopes), equivalent to what `auth.login` hands out.
@@ -851,8 +790,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // for a real session. TTL 60s, single-use, bound to the minting
         // user — see `HandoffCodeService`.
         /** Mint a one-time handoff code for the CALLING user. Real user
-         *  sessions only — scoped (`cst_`) and share-view (`csv_`) callers
-         *  must never convert themselves into a full session. */
+         *  sessions only — a minted token (scoped, admin or share-view)
+         *  must never convert itself into a full session. */
         createHandoffCode: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z
             .object({
@@ -1191,211 +1130,6 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 enabled: input.enabled,
             });
         }),
-        // ── Share tokens — scoped, TTL'd view tokens for standalone share
-        //    links (grid rework R6). Minted by any REAL user session (admin
-        //    or regular); the resulting `csv_*` token authenticates as a
-        //    restricted `share-view` principal limited to the embed surface
-        //    + its in-scope devices (see `share-view-access.ts`). ──────────
-        createShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(CreateShareTokenInputSchema)
-            .output(zod_1.z.object({ id: zod_1.z.string(), token: zod_1.z.string(), expiresAt: zod_1.z.number().nullable() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            // SECURITY (F0.4): a share token is a PRIVILEGE HANDOFF — it authorises
-            // whoever holds the link to view its devices with no further auth. A
-            // scoped (non-admin) minter must therefore not be able to mint for a
-            // device it cannot itself see: without this, a `device:[5]` token could
-            // mint a `csv_*` grid link for cameras 5..99. Admins mint anything;
-            // every other caller's requested deviceIds are INTERSECTED with what
-            // they can view (device:[parent] covers child accessories via the
-            // ancestor walk). An empty intersection is a refusal, not a silent
-            // "share nothing".
-            const scope = ctx.user.isAdmin
-                ? input.scope
-                : {
-                    ...input.scope,
-                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)((0, types_2.capabilityScopesOf)(ctx.user.scopes ?? []), input.scope.deviceIds, ctx.deviceScopeLookup),
-                };
-            if (scope.deviceIds.length === 0) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
-                });
-            }
-            // A thin wrapper for one release (D892): the link is a unified token
-            // whose only scope is the share-view grant. Without the store (a
-            // node that cannot mint) it is still a legacy `csv_`.
-            if (credentialTokens !== null) {
-                const ttl = input.ttlSec ?? share_token_service_js_1.SHARE_TOKEN_TTL_DEFAULT_SEC;
-                const minted = await (0, auth_tokens_procedures_js_1.mintFor)(tokenDeps, ctx, {
-                    scopes: [{ type: 'share-view', grant: scope }],
-                    expiresIn: ttl,
-                    label: `share ${scope.kind}`,
-                    allowAccountLink: true,
-                });
-                return { id: minted.record.id, token: minted.token, expiresAt: minted.record.expiresAt };
-            }
-            const { token, record } = await requireShareTokens().create({
-                userId: ctx.user.id,
-                scope,
-                ...(input.ttlSec !== undefined ? { ttlSec: input.ttlSec } : {}),
-            });
-            return { id: record.id, token, expiresAt: record.expiresAt };
-        }),
-        /**
-         * Slide expiry on a still-valid share token (same `csv_*`). Used by the
-         * Home Assistant embed cache so a long-lived dashboard does not mint a
-         * new row every hour. Expired / missing → NOT_FOUND (caller must create).
-         */
-        extendShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            id: zod_1.z.string().min(1),
-            ttlSec: zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
-        }))
-            .output(zod_1.z.object({ id: zod_1.z.string(), expiresAt: zod_1.z.number() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            const unified = await unifiedShare(input.id);
-            if (unified !== null && credentialTokens !== null) {
-                if (!ctx.user.isAdmin && unified.subjectId !== ctx.user.id) {
-                    throw new server_1.TRPCError({
-                        code: 'FORBIDDEN',
-                        message: 'Only the token owner or an admin can extend a share token',
-                    });
-                }
-                if (unified.expiresAt === null) {
-                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
-                }
-                const moved = await credentialTokens.setExpiry(input.id, Date.now() + input.ttlSec * 1000);
-                if (moved === null || moved.expiresAt === null) {
-                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Share token expired: ${input.id}` });
-                }
-                return { id: moved.id, expiresAt: moved.expiresAt };
-            }
-            const service = requireShareTokens();
-            try {
-                const record = await service.extend({
-                    id: input.id,
-                    ttlSec: input.ttlSec,
-                    callerUserId: ctx.user.id,
-                    callerIsAdmin: ctx.user.isAdmin,
-                });
-                if (record.expiresAt === null) {
-                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
-                }
-                return { id: record.id, expiresAt: record.expiresAt };
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : 'Share token extend failed';
-                if (/not found|expired/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message });
-                }
-                if (/owner or an admin|never-expiring/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'FORBIDDEN', message });
-                }
-                throw new server_1.TRPCError({ code: 'BAD_REQUEST', message });
-            }
-        }),
-        revokeShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
-            .mutation(async ({ input, ctx }) => {
-            assertRealUserSession(ctx.user);
-            const unified = await unifiedShare(input.id);
-            if (unified !== null && credentialTokens !== null) {
-                if (!ctx.user.isAdmin && unified.subjectId !== ctx.user.id) {
-                    throw new server_1.TRPCError({
-                        code: 'FORBIDDEN',
-                        message: 'Only the token owner or an admin can revoke a share token',
-                    });
-                }
-                return { success: await credentialTokens.revoke(input.id) };
-            }
-            const service = requireShareTokens();
-            try {
-                const removed = await service.revoke({
-                    id: input.id,
-                    callerUserId: ctx.user.id,
-                    callerIsAdmin: ctx.user.isAdmin,
-                });
-                if (removed) {
-                    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
-                    if (internal !== null) {
-                        const ip = network.clientAddress(ctx.req).ip;
-                        await internal.audit.record({
-                            action: 'credentials-revoked',
-                            userId: ctx.user.id,
-                            ...(ip !== null ? { ip } : {}),
-                            detail: {
-                                kind: 'share-link',
-                                requested: 1,
-                                revoked: 1,
-                                skipped: 0,
-                                ids: input.id,
-                            },
-                        });
-                    }
-                }
-                return { success: removed };
-            }
-            catch (error) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: error instanceof Error ? error.message : 'Share token revoke failed',
-                });
-            }
-        }),
-        /**
-         * Share links. `owner: 'self'` — the caller's own (My access);
-         * `owner: 'all'` — every user's, admin only. Omitted keeps the original
-         * answer (own for a user, all for an admin) for clients that predate it.
-         */
-        listShareTokens: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ owner: zod_1.z.enum(['self', 'all']).optional() }).optional())
-            .output(zod_1.z.array(ShareTokenSummarySchema))
-            .query(async ({ ctx, input }) => {
-            assertRealUserSession(ctx.user);
-            // The legacy `csv_` store, or — on a node with only the unified store —
-            // none; with neither, the clear refusal below.
-            const service = credentialTokens === null ? requireShareTokens() : shareTokens;
-            const owner = input?.owner ?? (ctx.user.isAdmin ? 'all' : 'self');
-            if (owner === 'all' && !ctx.user.isAdmin) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: "Listing every user's share links requires an admin",
-                });
-            }
-            const records = service === null
-                ? []
-                : owner === 'all'
-                    ? await service.listAll()
-                    : await service.listForUser(ctx.user.id);
-            const unified = credentialTokens === null
-                ? []
-                : await credentialTokens.list(owner === 'all' ? undefined : ctx.user.id);
-            const unifiedRows = unified.flatMap((record) => {
-                const grant = (0, types_2.shareViewGrantOf)(record.scopes);
-                if (grant === null || record.revokedAt !== null)
-                    return [];
-                return [
-                    {
-                        id: record.id,
-                        userId: record.subjectId,
-                        tokenPrefix: `token:${record.id.slice(0, 8)}`,
-                        scope: grant,
-                        createdAt: record.createdAt,
-                        expiresAt: record.expiresAt,
-                        neverExpires: record.expiresAt === null,
-                        ...(record.lastUsedAt !== null ? { lastUsedAt: record.lastUsedAt } : {}),
-                        legacy: false,
-                    },
-                ];
-            });
-            return [
-                ...unifiedRows,
-                ...records.map((record) => ({ ...toShareTokenSummary(record), legacy: true })),
-            ];
-        }),
         ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
         ...(0, auth_device_cert_procedures_js_1.createDeviceCertProcedures)({
             registry,
@@ -1413,9 +1147,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             issueFor,
         }),
         ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
-        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network, credentialTokens, shareTokens }),
-        ...(0, auth_tokens_procedures_js_1.createTokenProcedures)({ auth, registry, network, credentialTokens, shareTokens }),
-        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network, credentialTokens }),
+        ...(0, auth_audit_procedures_js_1.createAuthAuditProcedures)({ registry }),
+        ...(0, auth_tokens_procedures_js_1.createTokenProcedures)({ auth, registry, network, credentialTokens }),
+        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, network, credentialTokens }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The

package/dist/api/core/preferences.router.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preferencesFromRegistry = preferencesFromRegistry;
+exports.preferencesOwnerOf = preferencesOwnerOf;
+exports.createPreferencesRouter = createPreferencesRouter;
+/**
+ * Account preferences — fixed core API (D894), not a capability.
+ *
+ *   get           the caller's rows (all, or the namespaces asked)
+ *   put           write one namespace; `baseRevision` turns it into a
+ *                 compare-and-set that answers `conflict` with the current row
+ *   delete        remove one namespace
+ *   changedSince  the cheap poll: only rows the client does not hold yet
+ *
+ * There is no `userId` input anywhere: every call acts on the PRINCIPAL's own
+ * rows, admin included — an admin cannot read another user's preferences
+ * through this router, and nothing else serves them. The principal must hold
+ * `preferences-self` (every person's session does; a unified token only when
+ * minted with it), so a share link, a legacy token, an account link and the
+ * hub's own mesh principal are refused.
+ *
+ * Sync is by polling `changedSince`: there is no per-user push channel to a
+ * user's sessions, and the event bus is fleet-wide telemetry (D8).
+ *
+ * The rows live in `local-auth` (it owns the users, and a user's delete wipes
+ * them), reached through the hub-internal half of `user-management`.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const user_error_js_1 = require("../trpc/user-error.js");
+/** The store behind the hub's in-process `user-management` provider. */
+function preferencesFromRegistry(registry) {
+    return () => registry === null
+        ? null
+        : ((0, system_1.getUserManagementInternal)(registry.getSingleton('user-management'))?.preferences ?? null);
+}
+/** The user whose rows this call may touch: the principal itself, or a refusal. */
+function preferencesOwnerOf(principal) {
+    if (!(0, types_1.scopesAllowOwnPreferences)(principal.scopes ?? [])) {
+        throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'preferences.forbidden', undefined, 'This credential cannot reach account preferences');
+    }
+    return principal.id;
+}
+function storeOf(deps) {
+    const store = deps.preferences();
+    if (store === null) {
+        throw (0, user_error_js_1.trpcUserError)('PRECONDITION_FAILED', 'preferences.unavailable', undefined, 'Account preferences are not available');
+    }
+    return store;
+}
+function limitRefusal(error) {
+    const reason = (0, system_1.preferencesLimitReasonOf)(error);
+    if (reason === 'value-too-large') {
+        throw (0, user_error_js_1.trpcUserError)('PAYLOAD_TOO_LARGE', 'preferences.value-too-large', undefined, 'This preference value is too large');
+    }
+    if (reason === 'too-many-namespaces') {
+        throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'preferences.too-many-namespaces', undefined, 'Too many preference namespaces for this account');
+    }
+    throw error;
+}
+function createPreferencesRouter(deps) {
+    return (0, trpc_middleware_js_1.trpcRouter)({
+        get: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesGetInputSchema)
+            .output(types_1.PreferencesGetOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return { rows: [...(await storeOf(deps).get(owner, input.namespaces))] };
+        }),
+        put: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesPutInputSchema)
+            .output(types_1.PreferencesPutOutputSchema)
+            .mutation(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            try {
+                return await storeOf(deps).put(owner, input);
+            }
+            catch (error) {
+                return limitRefusal(error);
+            }
+        }),
+        delete: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesDeleteInputSchema)
+            .output(types_1.PreferencesDeleteOutputSchema)
+            .mutation(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return { deleted: await storeOf(deps).delete(owner, input.namespace) };
+        }),
+        changedSince: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesChangedSinceInputSchema)
+            .output(types_1.PreferencesChangedSinceOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return storeOf(deps).changedSince(owner, input.revisionByNamespace);
+        }),
+    });
+}

package/dist/api/oauth2/oauth2-routes.js

@@ -269,6 +269,35 @@ function answerRefusal(request, reply, status, body, reason, integration) {
     }
     return reply.status(status).send(body);
 }
+/**
+ * Who consents. ONLY a person's login session: a session-grade JWT (no
+ * `kind` — not a bridge, a challenge or a minted token) naming a user that
+ * still exists. Anything else this hub signed — a share link, a script's
+ * token, an account link — is refused, because a consent mints an account
+ * link with the integration's whole grant (security review 2026-10-21: a
+ * share link set as the cookie reached `consent=allow` and came back with a
+ * fleet-wide device grant for `userId: ''`).
+ */
+async function consentingUserOf(deps, cookie) {
+    let payload;
+    try {
+        payload = deps.verifyToken(cookie);
+    }
+    catch {
+        return { ok: false, reason: 'session-invalid' };
+    }
+    if (typeof payload !== 'object' || payload === null || !(0, session_cookie_js_1.isSessionGradeJwtPayload)(payload)) {
+        return { ok: false, reason: 'not-a-login-session' };
+    }
+    const userId = Reflect.get(payload, 'userId');
+    const username = Reflect.get(payload, 'username');
+    if (typeof userId !== 'string' || userId === '') {
+        return { ok: false, reason: 'not-a-login-session' };
+    }
+    if (!(await deps.isLiveUser(userId)))
+        return { ok: false, reason: 'user-gone' };
+    return { ok: true, user: { userId, username: typeof username === 'string' ? username : '' } };
+}
 /**
  * An authorize call turned away for want of a usable session.
  *
@@ -330,13 +359,11 @@ function registerOauth2Routes(fastify, deps) {
         if (!cookie) {
             return refuseUnauthenticated(request, reply, deps.logger, call, 'no-session-cookie');
         }
-        let tokenInfo;
-        try {
-            tokenInfo = deps.verifyToken(cookie);
-        }
-        catch {
-            return refuseUnauthenticated(request, reply, deps.logger, call, 'session-invalid');
+        const consenting = await consentingUserOf(deps, cookie);
+        if (!consenting.ok) {
+            return refuseUnauthenticated(request, reply, deps.logger, call, consenting.reason);
         }
+        const tokenInfo = consenting.user;
         const registry = deps.getRegistry();
         if (!registry) {
             return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
@@ -367,7 +394,7 @@ function registerOauth2Routes(fastify, deps) {
                 acceptLanguage: request.headers['accept-language'],
             }),
             displayName: descriptor.displayName,
-            username: tokenInfo.username ?? '',
+            username: tokenInfo.username,
             scopeSummary: summariseScopes(descriptor.requestedScopes),
             // Shown, not merely validated. A `redirect_uri` on a private host is
             // admitted by pattern rather than by registration, so the operator is
@@ -428,13 +455,11 @@ function registerOauth2Routes(fastify, deps) {
         if (!cookie) {
             return refuseUnauthenticated(request, reply, deps.logger, call, 'no-session-cookie');
         }
-        let tokenInfo;
-        try {
-            tokenInfo = deps.verifyToken(cookie);
-        }
-        catch {
-            return refuseUnauthenticated(request, reply, deps.logger, call, 'session-invalid');
+        const consenting = await consentingUserOf(deps, cookie);
+        if (!consenting.ok) {
+            return refuseUnauthenticated(request, reply, deps.logger, call, consenting.reason);
         }
+        const tokenInfo = consenting.user;
         const registry = deps.getRegistry();
         if (!registry) {
             return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
@@ -478,8 +503,8 @@ function registerOauth2Routes(fastify, deps) {
         }
         const { code } = await userMgmt.oauthIssueCode({
             integrationId: v.integration,
-            userId: tokenInfo.userId ?? '',
-            username: tokenInfo.username ?? '',
+            userId: tokenInfo.userId,
+            username: tokenInfo.username,
             scopes: descriptor.requestedScopes,
             redirectUri: v.redirectUri,
             // Prefer the integration's own public origin (e.g. the operator-selected

package/dist/api/trpc/device-config-secret-redaction.js

@@ -10,7 +10,7 @@
  *
  * Those methods are declared `auth: 'protected'` (the default in
  * `capability-definition.ts`), which is NOT admin — it is "authenticated, and
- * scope-matched". Measured against the live hub: a `cst_*` scoped token
+ * scope-matched". Measured against the live hub: a scoped token
  * carrying nothing but `category:system` + `view` — a READ-ONLY grant, the one
  * the deploy runbook mints for CI — read `deviceManager.getDevice` and received
  * `config.password` verbatim, and `deviceManager.listAll` answered with a
@@ -31,7 +31,7 @@
  * write-only for admins too is a bigger, UI-side change; it is not needed to
  * close this hole and would regress the form.
  *
- * Share-view (`csv_*`) principals never reach this code — they are gated
+ * Share-view principals never reach this code — they are gated
  * earlier by the fail-closed allowlist in `share-view-access.ts`, which does
  * not expose `getDevice` at all and projects `listAll` down to seven presentation
  * fields. This module is the gate for the tier BETWEEN a share link and an admin.

package/dist/api/trpc/generated-cap-mounts.js

@@ -314,7 +314,6 @@ function mountAllCaps(services) {
                 ...first,
                 listProfileKinds: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfileKinds'),
                 listProfiles: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfiles'),
-                listModels: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModels'),
                 getDefaults: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getDefaults'),
                 getUsage: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getUsage'),
                 listModelCatalog: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModelCatalog'),

package/dist/api/trpc/generated-cap-routers.js

@@ -5300,10 +5300,10 @@ function createCapRouter_llm(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.testProfile(input);
         }),
-        listModels: trpc_middleware_js_1.protectedProcedure
+        listModels: trpc_middleware_js_1.adminProcedure
             .input(types_69.llmCapability.methods.listModels.input.loose())
             .output(types_69.llmCapability.methods.listModels.output)
-            .query(async ({ input, ctx }) => {
+            .mutation(async ({ input, ctx }) => {
             const p = requireCapProvider('llm', () => getProvider(ctx));
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listModels(input);
@@ -12446,42 +12446,6 @@ function createCapRouter_userManagement(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.revokeApiKey(methodInput);
         }),
-        createScopedToken: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.createScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.createScopedToken.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.createScopedToken(methodInput);
-        }),
-        revokeScopedToken: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.revokeScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.revokeScopedToken.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.revokeScopedToken(methodInput);
-        }),
-        validateScopedToken: trpc_middleware_js_1.protectedProcedure
-            .input(types_142.userManagementCapability.methods.validateScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.validateScopedToken.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.validateScopedToken(methodInput);
-        }),
-        listScopedTokens: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.listScopedTokens.input.loose())
-            .output(types_142.userManagementCapability.methods.listScopedTokens.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.listScopedTokens(methodInput);
-        }),
         setupTotp: trpc_middleware_js_1.adminProcedure
             .input(types_142.userManagementCapability.methods.setupTotp.input.loose())
             .output(types_142.userManagementCapability.methods.setupTotp.output)

package/dist/api/trpc/principal-visibility.js

@@ -10,7 +10,7 @@ exports.scopedEventVisibility = scopedEventVisibility;
  * Non-admin principal device visibility — the shared answer to "which cameras
  * may this scoped caller see?", reused by two hotfixes:
  *
- *   - F0.4 `auth.createShareToken` — a scoped user must not mint a `csv_*`
+ *   - F0.4 `auth.mintToken` (a share-view grant) — a scoped user must not mint a share link
  *     share token for a device it cannot see. The requested deviceIds are
  *     INTERSECTED with what the caller can view.
  *   - F0.5 the event firehose (`live.onEvent`, `systemEvents.subscribe`, …) —
@@ -141,7 +141,7 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
  * view; an event with NO device identity is DROPPED (fail closed — "probably in
  * scope" is not a security argument).
  *
- * Share-view (`csv_*`) principals are NOT handled here — they keep their own,
+ * Share-view principals are NOT handled here — they keep their own,
  * stricter `liveEventInShareScope` filter, applied by the routers first.
  */
 function scopedEventVisibility(user, lookup) {

package/dist/api/trpc/share-view-access.js

@@ -181,7 +181,7 @@ function projectListAllForShareScope(data, scope) {
  * The projection ENGINE: drop every `listAll` row whose id is not in
  * `allowed`, and project the survivors onto the whitelisted row.
  *
- * Shared by the `csv_*` share path ({@link projectListAllForShareScope}) and
+ * Shared by the share-link path ({@link projectListAllForShareScope}) and
  * the scoped-principal path (`projectListAllForPrincipal` in
  * `principal-visibility.ts`) so enumeration is cut ONE way. Two projectors
  * would be two chances to forget `config` — which carries the camera