@camstack/server 1.2.605 → 1.2.606

package/dist/api/trpc/trpc-error-principal.js

@@ -34,9 +34,8 @@ function readCredentialIdentity(claims) {
  *
  *   anonymous
  *   apocaliss92 (admin)
- *   share:ab12cd34 (legacy-share-token)
- *   scoped:1a2b3c4d (legacy-scoped-token)
  *   token:ci (token)
+ *   token:ops (token admin)
  *   apocaliss92 (oauth-access session=910a6179-…)
  *   apocaliss92 (session)
  */

package/dist/api/trpc/trpc.context.js

@@ -24,7 +24,6 @@ function agentFromPrincipal(principal) {
         auditTag: principal.auditTag,
         interactive: principal.interactive,
         userDelegated: principal.userDelegated,
-        legacy: principal.legacy,
         ...(principal.sessionId !== undefined ? { sessionId: principal.sessionId } : {}),
         ...(principal.oauthSessionId !== undefined ? { oauthSessionId: principal.oauthSessionId } : {}),
         ...(principal.credential !== undefined ? { credential: principal.credential } : {}),
@@ -35,29 +34,31 @@ function agentFromPrincipal(principal) {
  * process builds (a request builds one; the memo must outlive it).
  */
 const hubScopeMemo = new Map();
-const hubStores = { shareTokens: null, tokenRows: null };
+/** The user-list memo, shared the same way (every token verify asks "does its subject exist?"). */
+const hubUsersMemo = { entry: null };
+const hubStores = { tokenRows: null };
 function bindHubCredentialStores(stores) {
-    if (stores.shareTokens !== undefined)
-        hubStores.shareTokens = stores.shareTokens;
     if (stores.tokenRows !== undefined)
         hubStores.tokenRows = stores.tokenRows;
 }
 /**
  * The hub's verifier over its own stores — the same one for tRPC and the
  * addon routes. Documented type boundary: the registry hands the
- * `user-management` provider back untyped; the two methods the adapters read
- * (`validateScopedToken`, `listUsers`) are asserted here.
+ * `user-management` provider back untyped; the one method the verifier reads
+ * (`listUsers`) is asserted here.
  */
 function hubCredentialVerifier(deps) {
     const provider = () => deps.addonRegistry.getCapabilityRegistry().getSingleton('user-management');
     return (0, credential_verifier_js_1.createCredentialVerifier)({
         verifyJwt: (token) => deps.authService.verifyToken(token),
+        verifyCredentialJwt: (token) => deps.authService.verifyCredentialToken(token),
         users: () => provider() ?? null,
         internal: () => (0, system_1.getUserManagementInternal)(provider()),
-        shareTokens: () => deps.shareTokens ?? hubStores.shareTokens,
         tokenRows: () => deps.tokenRows ?? hubStores.tokenRows,
         logger: deps.logger ?? null,
         scopeMemo: hubScopeMemo,
+        usersMemo: hubUsersMemo,
+        ...(deps.deviceScopeLookup !== undefined ? { deviceScopeLookup: deps.deviceScopeLookup } : {}),
     });
 }
 /** Read `req.query` if present (Fastify-only) without losing type safety. */
@@ -155,19 +156,20 @@ function createMeshTrpcContext(principal = 'mesh') {
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null, tokenRows = null) {
+async function createTrpcContext(req, authService, addonRegistry, logger = null, tokenRows = null) {
+    const deviceScopeLookup = makeDeviceScopeLookup(addonRegistry);
     const verifier = hubCredentialVerifier({
         authService,
         addonRegistry,
-        shareTokens,
         tokenRows,
         logger,
+        deviceScopeLookup,
     });
     return {
         user: await resolveUser(extractTokenFromRequest(req), verifier, requestFacts(req)),
         req,
         lang: (0, request_lang_js_1.resolveRequestLang)((0, request_lang_js_1.requestLangInputFrom)(req.headers, readQuery(req))),
-        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceScopeLookup,
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }
@@ -176,16 +178,17 @@ async function createTrpcContext(req, authService, addonRegistry, shareTokens =
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null, tokenRows = null) {
+async function createWsTrpcContext(opts, authService, addonRegistry, logger = null, tokenRows = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
+    const deviceScopeLookup = makeDeviceScopeLookup(addonRegistry);
     const verifier = hubCredentialVerifier({
         authService,
         addonRegistry,
-        shareTokens,
         tokenRows,
         logger,
+        deviceScopeLookup,
     });
     const user = await resolveUser(token, verifier, requestFacts(opts.req));
     const sessionId = user?.sessionId;
@@ -205,7 +208,7 @@ async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens
                 }) === null,
             }
             : {}),
-        deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
+        deviceScopeLookup,
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
 }

package/dist/api/trpc/trpc.router.js

@@ -54,6 +54,7 @@ const hwaccel_router_js_1 = require("../core/hwaccel.router.js");
 const live_events_router_js_1 = require("../core/live-events.router.js");
 const logs_router_js_1 = require("../core/logs.router.js");
 const notifications_router_js_1 = require("../core/notifications.router.js");
+const preferences_router_js_1 = require("../core/preferences.router.js");
 const repl_router_js_1 = require("../core/repl.router.js");
 const server_management_provider_js_1 = require("../core/server-management.provider.js");
 const stream_probe_router_js_1 = require("../core/stream-probe.router.js");
@@ -351,13 +352,17 @@ function buildCapabilityRouters(services) {
             hubDataDir: path.resolve(services.configService.get('server.dataPath') ?? 'camstack-data'),
             log: services.loggingService.createLogger('certificates'),
         }),
+        // preferences - the caller's own account preferences, synced across their devices (D894).
+        preferences: (0, preferences_router_js_1.createPreferencesRouter)({
+            preferences: (0, preferences_router_js_1.preferencesFromRegistry)(services.capabilityRegistry),
+        }),
         // agentPairing - hub-initiated pairing of agents, unpairing (D857).
         agentPairing: (0, agent_pairing_router_js_1.createAgentPairingRouter)({
             registry: services.capabilityRegistry,
             nodeClient: (nodeId) => (0, node_certificates_client_js_1.createNodeCertificatesClient)(services.moleculer, nodeId),
             log: services.loggingService.createLogger('agent-pairing'),
         }),
-        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService, services.externalLinkIntents, services.nativeLink ?? null, {
+        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.handoffCodeService, services.externalLinkIntents, services.nativeLink ?? null, {
             ...(services.authNetworkPolicy !== undefined
                 ? { network: services.authNetworkPolicy }
                 : {}),

package/dist/api/upload-auth.js

@@ -1,33 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UPLOAD_TRPC_PATH = void 0;
 exports.authorizeUploadRequest = authorizeUploadRequest;
 /**
  * Shared auth guard for the REST upload routes (`/api/addons/upload` and
  * `/api/server-upload`).
  *
- * Every credential (a session, a unified token, a legacy `csa_` / `cst_`)
- * goes through the hub's one verifier; what may upload is decided by its
- * scopes alone.
- *
- * REST endpoints share the scope-gate of the `addons.installPackage` cap
- * method (semantically equivalent — both install a tarball under the
- * system-scope `addons` cap with `create` access). Reusing the shared scope
- * matcher keeps the gate in sync with the tRPC middleware — no parallel
- * REST-only ACL. (Why not `addons.upload`? There is no `upload` method on
- * the cap definition, so `METHOD_ACCESS_MAP` has no row for it and
- * `checkScopeAccess` would fall through to deny.)
+ * Every credential goes through the hub's one verifier. An upload installs
+ * code that runs on the hub, so it is ADMIN only: the principal's scopes must
+ * hold `'*'`. A grant of `create` on the `addons` capability is NOT enough —
+ * that reach is a capability permission, and an addon tarball or a server
+ * closure is arbitrary code execution (security review 2026-10-21).
  */
 const trpc_context_js_1 = require("./trpc/trpc.context.js");
-const principal_authorization_js_1 = require("./trpc/principal-authorization.js");
-exports.UPLOAD_TRPC_PATH = 'addons.installPackage';
 /**
- * The upload gate: the ONE verifier, then the ONE scope matcher on the
- * `addons.installPackage` path (D892) — `'*'`, or a grant of `create` on
- * `addons`. Answers:
- *   - 401 `Unauthorized` when no Authorization header is present,
- *   - 403 `Forbidden: <reason>` for a bearer that authenticates nobody or
- *     holds no such grant.
+ * The upload gate: the ONE verifier, then `'*'` (D892, D895). Answers:
+ *   - 401 `Unauthorized` when no Authorization header is present, or the
+ *     bearer authenticates nobody (revoked, expired, never issued),
+ *   - 403 `Forbidden: admin only` for a principal that is not an admin.
  */
 async function authorizeUploadRequest(args) {
     const { authHeader, authService, addonRegistry } = args;
@@ -37,10 +26,9 @@ async function authorizeUploadRequest(args) {
     const token = authHeader.replace('Bearer ', '');
     const principal = await (0, trpc_context_js_1.hubCredentialVerifier)({ authService, addonRegistry }).verify(token);
     if (principal === null) {
-        return { ok: false, status: 403, error: 'Forbidden: token not recognised' };
+        return { ok: false, status: 401, error: 'Unauthorized: token not recognised' };
     }
-    const verdict = (0, principal_authorization_js_1.authorizeProcedure)(principal.scopes, exports.UPLOAD_TRPC_PATH, undefined);
-    if (verdict.ok)
-        return { ok: true };
-    return { ok: false, status: 403, error: `Forbidden: ${verdict.reason}` };
+    if (!principal.isAdmin)
+        return { ok: false, status: 403, error: 'Forbidden: admin only' };
+    return { ok: true };
 }

package/dist/auth/addon-route-share-gate.js

@@ -3,13 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SHARE_DEVICES_HEADER = exports.SHARE_KIND_HEADER = void 0;
 exports.stripShareHeaders = stripShareHeaders;
 /**
- * The data-plane gate's answer to a `csv_*` share token.
+ * The data-plane gate's answer to a share-link token.
  *
  * A share link is a bearer credential for ONE view of a FEW devices, not a
  * session: the hub's tRPC layer already confines it to a fail-closed method
  * list per scope kind (`share-view-access.ts`). The data planes are reached
  * outside tRPC, and until this module the gate resolved session JWTs and
- * `cst_*` only — so the events embed under a share link listed its events
+ * scoped tokens only — so the events embed under a share link listed its events
  * and got 401 on every thumbnail (`EVENTS-EMBED.md` §7).
  *
  * Two rules. The first lives in the one scope matcher

package/dist/auth/credential-verifier.js

@@ -1,13 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LEGACY_SHARE_TOKEN_PREFIX = exports.LEGACY_SCOPED_TOKEN_PREFIX = exports.LEGACY_ADMIN_TOKEN_PREFIX = void 0;
 exports.createCredentialVerifier = createCredentialVerifier;
 const types_1 = require("@camstack/types");
 const trpc_error_principal_js_1 = require("../api/trpc/trpc-error-principal.js");
-/** Legacy wire prefixes — only to choose an adapter. */
-exports.LEGACY_ADMIN_TOKEN_PREFIX = 'csa_';
-exports.LEGACY_SCOPED_TOKEN_PREFIX = 'cst_';
-exports.LEGACY_SHARE_TOKEN_PREFIX = 'csv_';
+const scope_escalation_js_1 = require("./scope-escalation.js");
 function stringClaim(value) {
     return typeof value === 'string' ? value : undefined;
 }
@@ -27,15 +23,30 @@ const SESSION_ADDON_ROUTES = {
 const SCOPE_REFRESH_TTL_MS = 30_000;
 const SCOPE_REFRESH_MISS_TTL_MS = 5_000;
 const SCOPE_MEMO_MAX = 512;
+/**
+ * The user list, read at most once per {@link USERS_MEMO_TTL_MS}: every token
+ * and account-link verify asks whether its subject still exists and is still
+ * an admin, and that must not cost a full store read per request. A deletion
+ * or a demotion therefore applies within the window.
+ */
+const USERS_MEMO_TTL_MS = 5_000;
 function createCredentialVerifier(deps) {
     const now = deps.now ?? Date.now;
     const scopeMemo = deps.scopeMemo ?? new Map();
+    const usersMemo = deps.usersMemo ?? { entry: null };
     const listUsersOnce = async () => {
+        const at = now();
         const users = deps.users();
         if (users === null || typeof users.listUsers !== 'function')
             return null;
+        const cached = usersMemo.entry;
+        if (cached !== null && cached.source === users && at - cached.at < USERS_MEMO_TTL_MS) {
+            return cached.users;
+        }
         try {
-            return await users.listUsers();
+            const fresh = await users.listUsers();
+            usersMemo.entry = { at, source: users, users: fresh };
+            return fresh;
         }
         catch {
             return null;
@@ -80,96 +91,26 @@ function createCredentialVerifier(deps) {
             detail: {
                 tokenId: principal.credentialId,
                 name,
-                format: principal.legacy ? 'legacy' : 'token',
                 ...(facts.path !== undefined ? { path: facts.path } : {}),
             },
         })
             .catch(() => { });
     };
-    // ── Legacy adapters ──────────────────────────────────────────────────
-    const legacyAdminToken = async (token, facts) => {
-        const internal = deps.internal();
-        if (internal === null)
-            return null;
-        // Validation (creator still exists and is still an admin, not revoked, not
-        // expired) is local-auth's.
-        const record = await internal.adminTokens.validate(token).catch(() => null);
-        if (record === null)
-            return null;
-        const principal = {
-            subjectId: record.createdBy,
-            username: `admin-token:${record.name}`,
-            scopes: [types_1.ADMIN_SCOPE],
-            isAdmin: true,
-            credentialId: record.id,
-            auditTag: 'legacy-admin-token',
-            interactive: false,
-            userDelegated: false,
-            legacy: true,
-        };
-        auditAdminUse(principal, facts, record.name);
-        return principal;
-    };
-    const legacyScopedToken = async (token) => {
-        const users = deps.users();
-        if (users === null)
-            return null;
-        const record = await users.validateScopedToken({ token }).catch(() => null);
-        if (record === null)
-            return null;
-        return {
-            subjectId: record.userId,
-            username: `scoped:${record.tokenPrefix}`,
-            // A v2 `device:targets` grant migrates to a v3 selector here, so the
-            // matcher only ever sees v3.
-            scopes: (0, types_1.normalizeTokenScopes)(record.scopes),
-            isAdmin: false,
-            credentialId: record.id,
-            auditTag: 'legacy-scoped-token',
-            interactive: false,
-            userDelegated: false,
-            legacy: true,
-        };
-    };
-    const legacyShareToken = async (token) => {
-        const shares = deps.shareTokens();
-        if (shares === null)
-            return null;
-        const record = await shares.validate(token).catch(() => null);
-        if (record === null)
-            return null;
-        return {
-            subjectId: record.userId,
-            username: `share:${record.tokenPrefix}`,
-            scopes: [
-                {
-                    type: 'share-view',
-                    grant: {
-                        kind: record.scope.kind,
-                        deviceIds: [...record.scope.deviceIds],
-                        ...(record.scope.talk !== undefined ? { talk: record.scope.talk } : {}),
-                    },
-                },
-            ],
-            isAdmin: false,
-            credentialId: record.id,
-            auditTag: 'legacy-share-token',
-            interactive: false,
-            userDelegated: false,
-            legacy: true,
-        };
-    };
     // ── The unified token ────────────────────────────────────────────────
-    const unifiedToken = async (payload, facts) => {
-        const claims = types_1.CredentialTokenClaimsSchema.safeParse(payload);
-        if (!claims.success)
+    /** `row`'s scopes cut down to what its (non-admin) subject holds now; `null` when unreadable. */
+    const narrowedToSubject = async (row) => {
+        const live = await liveScopes(row.subjectId);
+        if (live === null)
             return null;
+        return (0, scope_escalation_js_1.intersectScopes)(row.scopes, live, deps.deviceScopeLookup);
+    };
+    const unifiedToken = async (claims, facts) => {
         const rows = deps.tokenRows();
         if (rows === null)
             return null;
         // Revocation and expiry live on the row, looked up by `jti` every time.
-        const row = await rows.lookupLive(claims.data.jti).catch(() => null);
-        if (row === null || row.subjectId !== claims.data.sub)
+        const row = await rows.lookupLive(claims.jti).catch(() => null);
+        if (row === null || row.subjectId !== claims.sub)
             return null;
         // The subject must still exist; an admin token dies with its subject's admin bit.
         const subject = await subjectFacts(row.subjectId);
@@ -177,33 +118,47 @@ function createCredentialVerifier(deps) {
             return null;
         if ((0, types_1.scopesGrantAdmin)(row.scopes) && !subject.isAdmin)
             return null;
+        // The ROW's scopes, never the claim's: the row is what the operator listed.
+        // A non-admin's token never outgrows its subject: an admin who narrows the
+        // user narrows every token the user minted, at the next verify.
+        const scopes = subject.isAdmin ? row.scopes : await narrowedToSubject(row);
+        if (scopes === null || scopes.length === 0)
+            return null;
         const principal = {
             subjectId: row.subjectId,
             username: `token:${row.label}`,
-            // The ROW's scopes, never the claim's: the row is what the operator listed.
-            scopes: row.scopes,
-            isAdmin: (0, types_1.scopesGrantAdmin)(row.scopes),
+            scopes,
+            isAdmin: (0, types_1.scopesGrantAdmin)(scopes),
             credentialId: row.id,
             auditTag: 'token',
             interactive: false,
             userDelegated: false,
-            legacy: false,
         };
         if (principal.isAdmin)
             auditAdminUse(principal, facts, row.label);
         return principal;
     };
     // ── Session and account-link JWTs ────────────────────────────────────
+    /** A minted token's claims, or `null` when `token` is not one (D895: its own audience). */
+    const credentialClaims = (token) => {
+        try {
+            return deps.verifyCredentialJwt(token);
+        }
+        catch {
+            return null;
+        }
+    };
     const hubJwt = async (token, facts) => {
         let payload;
         try {
             payload = deps.verifyJwt(token);
         }
         catch {
-            return null;
+            // Not a session-family JWT. A minted token is refused by `verifyJwt` by
+            // construction (its audience), and verifies only through its own door.
+            const claims = credentialClaims(token);
+            return claims === null ? null : unifiedToken(claims, facts);
         }
-        if (payload.kind === types_1.CREDENTIAL_TOKEN_KIND)
-            return unifiedToken(payload, facts);
         // A pre-v2 JWT (no `isAdmin`) would degrade into "non-admin, no scopes";
         // refuse it so the client signs in again.
         if (typeof payload.isAdmin !== 'boolean')
@@ -223,7 +178,12 @@ function createCredentialVerifier(deps) {
         const username = stringClaim(payload.username) ?? 'unknown';
         if (classified.kind === 'integration') {
             // An account link is governed by the grant the operator consented to,
-            // never by the linking user's record (2026-08-19), and never admin.
+            // never by the linking user's record (2026-08-19), and never admin. Its
+            // subject must still be a user: a link minted for nobody (an empty
+            // `userId`) or for a deleted account authenticates nobody.
+            const subject = userId === 'unknown' || userId === '' ? null : await subjectFacts(userId);
+            if (subject === null || !subject.exists)
+                return null;
             const identity = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
             return {
                 subjectId: userId,
@@ -234,7 +194,6 @@ function createCredentialVerifier(deps) {
                 auditTag: 'integration',
                 interactive: false,
                 userDelegated: true,
-                legacy: false,
                 ...(identity.sessionId !== undefined ? { oauthSessionId: identity.sessionId } : {}),
                 ...(identity.credential !== undefined ? { credential: identity.credential } : {}),
             };
@@ -247,26 +206,26 @@ function createCredentialVerifier(deps) {
             auditTag: 'session',
             interactive: true,
             userDelegated: true,
-            legacy: false,
             ...(sessionId !== undefined ? { sessionId } : {}),
         };
-        if (payload.isAdmin)
-            return { ...base, scopes: [types_1.ADMIN_SCOPE], isAdmin: true };
+        // A person's session always reaches its OWN account preferences (D894);
+        // `'*'` does not imply that grant, so the admin session names it too.
+        if (payload.isAdmin) {
+            return { ...base, scopes: [types_1.ADMIN_SCOPE, types_1.PREFERENCES_SELF_SCOPE], isAdmin: true };
+        }
         const fresh = await liveScopes(userId);
         const capability = fresh ?? (0, types_1.normalizeTokenScopes)(payload.scopes ?? []);
-        return { ...base, scopes: [...capability, SESSION_ADDON_ROUTES], isAdmin: false };
+        return {
+            ...base,
+            scopes: [...capability, SESSION_ADDON_ROUTES, types_1.PREFERENCES_SELF_SCOPE],
+            isAdmin: false,
+        };
     };
     return {
         async verify(bearer, facts = {}) {
             if (bearer === null || bearer === undefined || bearer === '')
                 return null;
             try {
-                if (bearer.startsWith(exports.LEGACY_ADMIN_TOKEN_PREFIX))
-                    return await legacyAdminToken(bearer, facts);
-                if (bearer.startsWith(exports.LEGACY_SHARE_TOKEN_PREFIX))
-                    return await legacyShareToken(bearer);
-                if (bearer.startsWith(exports.LEGACY_SCOPED_TOKEN_PREFIX))
-                    return await legacyScopedToken(bearer);
                 return await hubJwt(bearer, facts);
             }
             catch {

package/dist/auth/embed-auth-route.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerEmbedAuthRoute = registerEmbedAuthRoute;
+const spa_mount_js_1 = require("../api/static/spa-mount.js");
+const session_cookie_js_1 = require("./session-cookie.js");
+/** Seconds the cookie may live for `payload`, or `null` when it is not a live person's session. */
+async function sessionCookieTtl(deps, token) {
+    let payload;
+    try {
+        payload = deps.verifyToken(token);
+    }
+    catch {
+        return null;
+    }
+    if (typeof payload !== 'object' || payload === null || !(0, session_cookie_js_1.isSessionGradeJwtPayload)(payload)) {
+        return null;
+    }
+    const userId = Reflect.get(payload, 'userId');
+    if (typeof userId !== 'string' || !(await deps.isLiveUser(userId)))
+        return null;
+    const exp = Reflect.get(payload, 'exp');
+    const expSec = typeof exp === 'number' ? exp : 0;
+    return Math.max(0, expSec - Math.floor(Date.now() / 1000));
+}
+function registerEmbedAuthRoute(fastify, deps) {
+    fastify.get('/api/embed-auth', async (request, reply) => {
+        const authHeader = request.headers.authorization;
+        const token = authHeader?.startsWith('Bearer ')
+            ? authHeader.slice('Bearer '.length)
+            : undefined;
+        if (!token)
+            return reply.status(401).send({ error: 'Bearer token required' });
+        const next = request.query?.next ?? '';
+        if (!(0, session_cookie_js_1.isEmbedRedirectTarget)(next))
+            return reply.status(400).send({ error: 'invalid next' });
+        const ttlSec = await sessionCookieTtl(deps, token);
+        if (ttlSec === null)
+            return reply.status(401).send({ error: 'invalid token' });
+        const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
+            secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_js_1.FORWARDED_PREFIX_HEADER),
+        });
+        reply.setCookie(c.name, c.value, c.options);
+        return reply.redirect(next);
+    });
+}

package/dist/auth/live-user.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.liveUserCheck = liveUserCheck;
+/** A check bound to `registry`'s `user-management` provider. Unreadable ⇒ `false` (fail closed). */
+function liveUserCheck(registry) {
+    return async (userId) => {
+        if (userId === '')
+            return false;
+        const users = registry.getSingleton('user-management');
+        if (users === null || users === undefined)
+            return false;
+        try {
+            return (await users.listUsers()).some((user) => user.id === userId);
+        }
+        catch {
+            return false;
+        }
+    };
+}

package/dist/auth/scope-escalation.js

@@ -1,8 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scopesWithin = scopesWithin;
+exports.intersectScopes = intersectScopes;
 const types_1 = require("@camstack/types");
 const principal_visibility_js_1 = require("../api/trpc/principal-visibility.js");
+const scope_access_js_1 = require("../api/trpc/scope-access.js");
+/**
+ * The method a share link's talk-back opens first. Holding it on a device is
+ * what lets a caller hand talk-back on that device to whoever holds the link.
+ */
+const TALK_BACK_PATH = 'intercom.startSession';
+/** May the holder of `held` talk back on every device of `grant`? */
+function canTalkOn(held, deviceIds, lookup) {
+    return deviceIds.every((deviceId) => (0, scope_access_js_1.checkScopeAccess)(held, TALK_BACK_PATH, { deviceId }, lookup).ok);
+}
 function accessCovered(asked, held) {
     return asked.every((a) => held.includes(a));
 }
@@ -24,6 +35,8 @@ function describe(scope) {
         return `share-view:${scope.grant.kind}`;
     if (scope.type === 'addon-routes')
         return `addon-routes[${scope.access.join(',')}]`;
+    if (scope.type === 'preferences-self')
+        return 'preferences-self';
     if (scope.type === 'device')
         return `device[${scope.access.join(',')}]`;
     return `${scope.type}:${scope.target}[${scope.access.join(',')}]`;
@@ -41,14 +54,23 @@ function scopesWithin(requested, held, lookup) {
             if (viewable.length !== scope.grant.deviceIds.length) {
                 return { ok: false, reason: 'a share-view grant names a device you cannot view' };
             }
+            if (scope.grant.talk === true && !canTalkOn(heldCapability, scope.grant.deviceIds, lookup)) {
+                return { ok: false, reason: 'a share-view grant asks talk-back on a device you cannot talk on' };
+            }
             continue;
         }
-        if (scope.type === 'addon-routes') {
-            const covered = held.some((h) => h !== types_1.ADMIN_SCOPE && h.type === 'addon-routes' && accessCovered(scope.access, h.access));
+        if (scope.type === 'preferences-self') {
+            const covered = held.some((h) => h !== types_1.ADMIN_SCOPE && h.type === 'preferences-self');
             if (!covered)
                 return { ok: false, reason: `you do not hold ${describe(scope)}` };
             continue;
         }
+        if (scope.type === 'addon-routes') {
+            return {
+                ok: false,
+                reason: `only an admin can mint ${describe(scope)} — name the addon instead (addon:<id>)`,
+            };
+        }
         const key = grantKey(scope);
         const covered = heldCapability.some((h) => grantKey(h) === key && accessCovered(scope.access, h.access));
         if (!covered)
@@ -56,3 +78,56 @@ function scopesWithin(requested, held, lookup) {
     }
     return { ok: true };
 }
+/** A share-view grant cut down to what `held` may still see (and talk on). `null` = nothing left. */
+function narrowShareGrant(grant, held, lookup) {
+    const deviceIds = (0, principal_visibility_js_1.filterViewableDeviceIds)(held, grant.deviceIds, lookup);
+    if (deviceIds.length === 0)
+        return null;
+    const talk = grant.talk === true && canTalkOn(held, deviceIds, lookup);
+    return {
+        kind: grant.kind,
+        deviceIds,
+        ...(grant.talk !== undefined ? { talk } : {}),
+    };
+}
+/**
+ * `token`'s scopes cut down to what `held` — its non-admin subject's scopes
+ * NOW — still covers (security review 2026-10-21): an admin who narrows a user
+ * narrows every token that user minted, at the next verify, rather than
+ * leaving the token the reach the user no longer has.
+ *
+ *   - a capability grant keeps the flavours the subject still holds on the
+ *     SAME grant, and goes when none is left;
+ *   - a share-view grant keeps the devices the subject can still view (and
+ *     talk-back only where it can still talk);
+ *   - `'*'` and `addon-routes` are admin-only and never survive here.
+ *
+ * Never widens: every output scope is covered by an input scope.
+ */
+function intersectScopes(token, held, lookup) {
+    const out = [];
+    for (const scope of token) {
+        if (scope === types_1.ADMIN_SCOPE || scope.type === 'addon-routes')
+            continue;
+        if (scope.type === 'share-view') {
+            const grant = narrowShareGrant(scope.grant, held, lookup);
+            if (grant !== null)
+                out.push({ type: 'share-view', grant });
+            continue;
+        }
+        // The subject's OWN preferences (D894): every person holds it, so a live
+        // subject never loses it — except on a share link. A share-view grant cut
+        // to nothing must not leave a preferences token behind.
+        if (scope.type === 'preferences-self') {
+            if (!token.some((s) => s !== types_1.ADMIN_SCOPE && s.type === 'share-view'))
+                out.push(scope);
+            continue;
+        }
+        const key = grantKey(scope);
+        const heldAccess = new Set(held.filter((h) => grantKey(h) === key).flatMap((h) => [...h.access]));
+        const access = scope.access.filter((a) => heldAccess.has(a));
+        if (access.length > 0)
+            out.push({ ...scope, access });
+    }
+    return out;
+}