@camstack/server 1.2.76 → 1.2.78

package/dist/api/core/cap-providers.js

@@ -1000,6 +1000,41 @@ function ensureCustomActionAuth(ctx, level) {
         return;
     }
 }
+/** How many neighbouring names a NOT_FOUND message is willing to spell out. */
+const UNRESOLVED_HINT_LIMIT = 40;
+/**
+ * Explain a `(addonId, action)` that did not resolve, by NAMING what does.
+ *
+ * `addons.custom` keys on the MANIFEST addon id (`camstack.addons[].id`), which
+ * is routinely not the npm package name — `@camstack/addon-post-analysis` ships
+ * `pipeline-analytics` and `embedding-encoder`, and neither is the package. A
+ * bare "has no custom action X" is then indistinguishable from "the addon is
+ * broken", "the deploy did not land" or "the catalog never registered", and the
+ * caller has no way to tell which. That ambiguity cost a session on 2026-08-08:
+ * a working require-cache fix (d0bf802f1) was investigated as the culprit while
+ * the action was reachable the whole time under its real id.
+ *
+ * So the two failures are separated and each names its neighbourhood — the ids
+ * that have actions, or the actions that addon has.
+ */
+function describeUnresolved(registry, input) {
+    const actions = registry.listActions(input.addonId);
+    if (actions.length > 0) {
+        return `addon '${input.addonId}' has no custom action '${input.action}' — known actions: ${formatNames(actions)}`;
+    }
+    return (`no addon '${input.addonId}' registers custom actions ` +
+        `(expected a manifest addon id, not the npm package name) — ` +
+        `addons with custom actions: ${formatNames(registry.listAddons())}`);
+}
+/** Sorted, comma-joined, bounded — a hint must never become a dump. */
+function formatNames(names) {
+    if (names.length === 0)
+        return '(none)';
+    const sorted = [...names].sort();
+    const shown = sorted.slice(0, UNRESOLVED_HINT_LIMIT);
+    const rest = sorted.length - shown.length;
+    return rest > 0 ? `${shown.join(', ')} (+${rest} more)` : shown.join(', ');
+}
 /**
  * Resolve + dispatch a single addon custom action. This is the LIVE dispatch
  * used by the `addons.custom` cap-provider handler below — factored out so it
@@ -1020,10 +1055,7 @@ function ensureCustomActionAuth(ctx, level) {
 async function dispatchCustomAction(registry, ctx, input) {
     const entry = registry.resolve(input.addonId, input.action);
     if (!entry) {
-        throw new server_1.TRPCError({
-            code: 'NOT_FOUND',
-            message: `addon '${input.addonId}' has no custom action '${input.action}'`,
-        });
+        throw new server_1.TRPCError({ code: 'NOT_FOUND', message: describeUnresolved(registry, input) });
     }
     ensureCustomActionAuth(ctx, entry.spec.auth);
     const parsedInput = entry.spec.input.parse(input.input);

package/dist/api/oauth2/consent-page.js

@@ -23,7 +23,9 @@ function renderConsentPage(input) {
   <div class="card">
     <h1>Authorize ${escapeHtml(input.displayName)}</h1>
     <p class="meta">Signed in as <strong>${escapeHtml(input.username)}</strong></p>
-    <p class="meta">This will grant: ${escapeHtml(input.scopeSummary)}</p>
+    <p class="meta">This will grant: ${escapeHtml(input.scopeSummary)}</p>${input.redirectUri
+        ? `\n    <p class="meta">Sending the authorization to <code>${escapeHtml(input.redirectUri)}</code></p>`
+        : ''}
     <form method="POST">
       ${hidden}
       <button class="allow" name="consent" value="allow" type="submit">Allow</button>

package/dist/api/oauth2/oauth2-routes.js

@@ -4,24 +4,70 @@ exports.validateAuthorizeQuery = validateAuthorizeQuery;
 exports.isRedirectUriAllowed = isRedirectUriAllowed;
 exports.summariseScopes = summariseScopes;
 exports.registerOauth2Routes = registerOauth2Routes;
-const consent_page_js_1 = require("./consent-page.js");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const consent_page_js_1 = require("./consent-page.js");
+const private_host_js_1 = require("./private-host.js");
 /** Validate the inbound authorize query. `client_id` is intentionally
- *  NOT checked — that pair is verified only at the Lambda boundary. */
+ *  NOT checked — that pair is verified only at the Lambda boundary, and a
+ *  PUBLIC client (`requiresPkce`) has no secret to check it against at all;
+ *  the S256 challenge is what binds the code to its requester instead. */
 function validateAuthorizeQuery(q, knownIntegrations) {
     if (q.response_type !== 'code')
         return { ok: false, status: 400, error: 'unsupported_response_type' };
-    if (!q.integration || !knownIntegrations.has(q.integration))
+    const policy = q.integration ? knownIntegrations.get(q.integration) : undefined;
+    if (!q.integration || !policy)
         return { ok: false, status: 400, error: 'invalid_request — unknown integration' };
     if (!q.redirect_uri)
         return { ok: false, status: 400, error: 'invalid_request — redirect_uri required' };
     if (!q.state)
         return { ok: false, status: 400, error: 'invalid_request — state required' };
-    return { ok: true, integration: q.integration, redirectUri: q.redirect_uri, state: q.state };
+    const challenge = q.code_challenge ?? '';
+    if (challenge !== '' && q.code_challenge_method !== 'S256') {
+        // `plain` is accepted by the RFC and is worth nothing: the challenge IS
+        // the verifier, so an intercepted authorize request yields both.
+        return { ok: false, status: 400, error: 'invalid_request — code_challenge_method must be S256' };
+    }
+    if (policy.requiresPkce === true && challenge === '') {
+        return { ok: false, status: 400, error: 'invalid_request — code_challenge required (PKCE)' };
+    }
+    return {
+        ok: true,
+        integration: q.integration,
+        redirectUri: q.redirect_uri,
+        state: q.state,
+        codeChallenge: challenge,
+    };
 }
-/** True if `redirectUri` starts with one of the integration's allowed prefixes. */
-function isRedirectUriAllowed(redirectUri, allowedPrefixes) {
-    return allowedPrefixes.some((p) => redirectUri.startsWith(p));
+/**
+ * True if `redirectUri` is one this integration is allowed to receive a code at.
+ *
+ * Two independent branches:
+ *   - prefix match against `allowedRedirectPrefixes` (Alexa's three fixed
+ *     Amazon origins), and
+ *   - exact-path match against `allowedPrivateHostPaths` when the host is
+ *     private (a self-hosted client whose LAN address the hub cannot know).
+ *
+ * An unparsable URI is refused rather than falling through to the prefix test —
+ * `startsWith` on a string the browser will parse differently is exactly how an
+ * allow-list gets walked around.
+ */
+function isRedirectUriAllowed(redirectUri, allowedPrefixes, allowedPrivateHostPaths = []) {
+    if (allowedPrefixes.some((p) => redirectUri.startsWith(p)))
+        return true;
+    if (allowedPrivateHostPaths.length === 0)
+        return false;
+    let url;
+    try {
+        url = new URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return false;
+    if (!(0, private_host_js_1.isPrivateHost)(url.hostname))
+        return false;
+    return allowedPrivateHostPaths.includes(url.pathname);
 }
 /** One-line human summary of a scope list for the consent screen. */
 function summariseScopes(scopes) {
@@ -38,8 +84,7 @@ async function buildIntegrationMap(registry) {
         const descriptor = await provider.getDescriptor();
         descriptorMap.set(descriptor.integrationId, descriptor);
     }
-    const knownSet = new Set(descriptorMap.keys());
-    return { descriptorMap, knownSet };
+    return descriptorMap;
 }
 /** Parse an application/x-www-form-urlencoded body string into a plain object. */
 function parseFormBody(raw) {
@@ -88,14 +133,14 @@ function registerOauth2Routes(fastify, deps) {
         if (!registry) {
             return reply.status(503).send({ error: 'service_unavailable' });
         }
-        const { descriptorMap, knownSet } = await buildIntegrationMap(registry);
+        const descriptorMap = await buildIntegrationMap(registry);
         const query = request.query;
-        const v = validateAuthorizeQuery(query, knownSet);
+        const v = validateAuthorizeQuery(query, descriptorMap);
         if (!v.ok) {
             return reply.status(v.status).send({ error: v.error });
         }
         const descriptor = descriptorMap.get(v.integration);
-        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes)) {
+        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
@@ -104,15 +149,43 @@ function registerOauth2Routes(fastify, deps) {
             displayName: descriptor.displayName,
             username: tokenInfo.username ?? '',
             scopeSummary: summariseScopes(descriptor.requestedScopes),
+            // Shown, not merely validated. A `redirect_uri` on a private host is
+            // admitted by pattern rather than by registration, so the operator is
+            // the last check on WHERE the code goes — and a consent screen that
+            // hides the destination is theatre.
+            redirectUri: v.redirectUri,
             hidden: {
                 integration: v.integration,
                 redirect_uri: v.redirectUri,
                 state: v.state,
                 response_type: 'code',
+                ...(v.codeChallenge !== ''
+                    ? { code_challenge: v.codeChallenge, code_challenge_method: 'S256' }
+                    : {}),
             },
         });
         return reply.type('text/html').send(html);
     });
+    // ─── GET /api/oauth2/integrations ─────────────────────────────────────────
+    // Discovery. A client that has no token yet needs to know whether THIS hub
+    // knows it at all — a hub predating an integration must be distinguishable
+    // from one that is refusing it, or the client dead-ends on a 400 with no way
+    // to fall back. Unauthenticated (so is /token) and it discloses only which
+    // integrations are installed.
+    fastify.get('/api/oauth2/integrations', async (_request, reply) => {
+        const registry = deps.getRegistry();
+        if (!registry) {
+            return reply.status(503).send({ error: 'service_unavailable' });
+        }
+        const descriptorMap = await buildIntegrationMap(registry);
+        return reply.send({
+            integrations: [...descriptorMap.values()].map((d) => ({
+                integrationId: d.integrationId,
+                displayName: d.displayName,
+                requiresPkce: d.requiresPkce === true,
+            })),
+        });
+    });
     // ─── POST /api/oauth2/authorize ───────────────────────────────────────────
     fastify.post('/api/oauth2/authorize', async (request, reply) => {
         const cookie = request.cookies[session_cookie_js_1.SESSION_COOKIE];
@@ -136,20 +209,24 @@ function registerOauth2Routes(fastify, deps) {
         if (!registry) {
             return reply.status(503).send({ error: 'service_unavailable' });
         }
-        const { descriptorMap, knownSet } = await buildIntegrationMap(registry);
+        const descriptorMap = await buildIntegrationMap(registry);
         const body = request.body;
         const formQuery = {
             response_type: body.response_type,
             integration: body.integration,
             redirect_uri: body.redirect_uri,
             state: body.state,
+            code_challenge: body.code_challenge,
+            code_challenge_method: body.code_challenge_method,
         };
-        const v = validateAuthorizeQuery(formQuery, knownSet);
+        // Re-validated, not trusted: the hidden fields came back from a browser
+        // and every one of them is attacker-editable.
+        const v = validateAuthorizeQuery(formQuery, descriptorMap);
         if (!v.ok) {
             return reply.status(v.status).send({ error: v.error });
         }
         const descriptor = descriptorMap.get(v.integration);
-        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes)) {
+        if (!isRedirectUriAllowed(v.redirectUri, descriptor.allowedRedirectPrefixes, descriptor.allowedPrivateHostPaths ?? [])) {
             return reply
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
@@ -172,6 +249,7 @@ function registerOauth2Routes(fastify, deps) {
             // claim the cloud Lambda routes back on is the reachable public URL, not
             // the hub-global fallback (which defaults to localhost in dev).
             hubUrl: descriptor.hubUrl ?? deps.publicHubUrl(),
+            ...(v.codeChallenge !== '' ? { codeChallenge: v.codeChallenge } : {}),
         });
         return reply.redirect(`${v.redirectUri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(v.state)}`);
     });
@@ -195,6 +273,10 @@ function registerOauth2Routes(fastify, deps) {
             tokenResult = await userMgmt.oauthExchangeCode({
                 code: body.code,
                 redirectUri: body.redirect_uri,
+                // Optional here and mandatory in the grant: the requirement is carried
+                // by the CODE (it embeds the challenge), not by this endpoint, so it
+                // cannot be dropped by a client that simply omits the parameter.
+                ...(body.code_verifier ? { codeVerifier: body.code_verifier } : {}),
             });
         }
         else if (body.grant_type === 'refresh_token') {

package/dist/api/oauth2/private-host.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Is this hostname unreachable from the public internet?
+ *
+ * Used by `/api/oauth2/authorize` to admit a `redirect_uri` whose host the hub
+ * cannot know in advance — a self-hosted Home Assistant at
+ * `http://192.168.1.40:8123/auth/external/callback`. Pairing "private host" with
+ * "exact path" is what keeps that from being a wildcard prefix: a public host
+ * never satisfies it, so the worst an attacker can aim a code at is a machine
+ * they already need LAN presence to read.
+ *
+ * Literal inspection only — deliberately NO DNS resolution. A resolver turns an
+ * authorize request into an outbound lookup an attacker controls (SSRF-shaped,
+ * and a DNS-rebind race on top: the address that answers at validation time is
+ * not the one the browser will use). Names are admitted only by suffix, from a
+ * closed list of suffixes that cannot be registered on the public internet.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateHost = isPrivateHost;
+/** Suffixes that are, by definition, not publicly routable names. */
+const PRIVATE_NAME_SUFFIXES = ['.local', '.internal', '.home.arpa', '.ts.net'];
+/** Names that are exactly the loopback host. */
+const LOOPBACK_NAMES = ['localhost', 'localhost.localdomain'];
+function isPrivateIpv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return false;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return false;
+        const n = Number(part);
+        if (n > 255)
+            return false;
+        octets.push(n);
+    }
+    const [a, b] = octets;
+    if (a === 127)
+        return true; // loopback
+    if (a === 10)
+        return true; // RFC1918
+    if (a === 192 && b === 168)
+        return true; // RFC1918
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // RFC1918
+    if (a === 169 && b === 254)
+        return true; // link-local
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT / Tailscale 100.64/10
+    return false;
+}
+function isPrivateIpv6(host) {
+    // URL.hostname keeps IPv6 literals in brackets.
+    const inner = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    if (!inner.includes(':'))
+        return false;
+    const lower = inner.toLowerCase();
+    if (lower === '::1' || lower === '::')
+        return true; // loopback / unspecified
+    if (/^f[cd][0-9a-f]{2}:/.test(lower))
+        return true; // fc00::/7 ULA
+    if (/^fe[89ab][0-9a-f]:/.test(lower))
+        return true; // fe80::/10 link-local
+    return false;
+}
+/**
+ * True iff `host` (a `URL.hostname`, already lowercased by the URL parser) is
+ * private by literal inspection. Never resolves.
+ */
+function isPrivateHost(host) {
+    if (host === '')
+        return false;
+    if (LOOPBACK_NAMES.includes(host))
+        return true;
+    if (isPrivateIpv4(host))
+        return true;
+    if (isPrivateIpv6(host))
+        return true;
+    return PRIVATE_NAME_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}

package/dist/api/trpc/cap-mount-helpers.js

@@ -61,22 +61,11 @@ function requireDeviceScoped(registry, capName) {
                     provider = registry.getProviderForDevice(capName, deviceId);
                 }
                 if (!provider) {
-                    // No native and no device-bound provider. For `getStatus`, the
-                    // device may still have a SYNTHESIZED status from device-links
-                    // (battery/consumables wired from sibling sensors). Consult the
-                    // resolver with a null base (the synthesize path) before failing —
-                    // it returns null when the device has no links for this cap,
-                    // preserving today's error.
-                    if (prop === 'getStatus') {
-                        const deviceManager = registry.getSingleton('device-manager');
-                        const synthesized = await deviceManager?.resolveLinkedStatus?.({
-                            deviceId,
-                            cap: String(capName),
-                            baseStatus: null,
-                        });
-                        if (synthesized != null)
-                            return synthesized;
-                    }
+                    // No native and no device-bound provider. There used to be one more
+                    // branch here: SYNTHESIZE a `getStatus` out of device-links, so a
+                    // cap with no provider at all still answered. Wiring was deleted on
+                    // 2026-08-08 — a composed device's caps are native to it, so there
+                    // is nothing to conjure and the honest answer is the error.
                     throw new server_1.TRPCError({
                         code: 'PRECONDITION_FAILED',
                         message: `Capability "${String(capName)}" not registered for device ${deviceId}`,
@@ -89,21 +78,11 @@ function requireDeviceScoped(registry, capName) {
                         message: `Capability "${String(capName)}" provider for device ${deviceId} does not implement "${prop}"`,
                     });
                 }
-                const result = await fn.call(provider, input);
-                // Device-property-wiring overlay (read-time): only `getStatus`, and only
-                // when the device has links for this cap (resolveLinkedStatus returns
-                // null otherwise → base result untouched). One in-process singleton hop.
-                if (prop === 'getStatus') {
-                    const deviceManager = registry.getSingleton('device-manager');
-                    const overlaid = await deviceManager?.resolveLinkedStatus?.({
-                        deviceId,
-                        cap: String(capName),
-                        baseStatus: result,
-                    });
-                    if (overlaid != null)
-                        return overlaid;
-                }
-                return result;
+                // The provider's answer, verbatim. `getStatus` used to be run through
+                // a read-time device-link overlay here — a second authority writing a
+                // field the provider owns, which is the field-level form of the sin
+                // D62 bans at feature level. Deleted with wiring on 2026-08-08.
+                return await fn.call(provider, input);
             };
         },
     });

package/dist/api/trpc/generated-cap-routers.js

@@ -1829,6 +1829,15 @@ function createCapRouter_coreBlocks(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setEnabled(methodInput);
         }),
+        restart: trpc_middleware_js_1.adminProcedure
+            .input(types_31.coreBlocksCapability.methods.restart.input.loose())
+            .output(types_31.coreBlocksCapability.methods.restart.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('core-blocks', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.restart(methodInput);
+        }),
         compile: trpc_middleware_js_1.adminProcedure
             .input(types_31.coreBlocksCapability.methods.compile.input.loose())
             .output(types_31.coreBlocksCapability.methods.compile.output)
@@ -2573,15 +2582,6 @@ function createCapRouter_deviceManager(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setChildLayout(methodInput);
         }),
-        setDeviceLinks: trpc_middleware_js_1.adminProcedure
-            .input(types_40.deviceManagerCapability.methods.setDeviceLinks.input.loose())
-            .output(types_40.deviceManagerCapability.methods.setDeviceLinks.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('device-manager', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.setDeviceLinks(methodInput);
-        }),
         setDisplay: trpc_middleware_js_1.adminProcedure
             .input(types_40.deviceManagerCapability.methods.setDisplay.input.loose())
             .output(types_40.deviceManagerCapability.methods.setDisplay.output)

package/dist/api/trpc/share-view-access.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARE_SCOPE_PROJECTED_METHODS = void 0;
 exports.checkShareViewAccess = checkShareViewAccess;
 exports.projectListAllForShareScope = projectListAllForShareScope;
+exports.projectShareScopeRows = projectShareScopeRows;
 exports.liveEventInShareScope = liveEventInShareScope;
 /**
  * Methods callable WITHOUT a per-device check — their input carries no
@@ -37,7 +39,95 @@ function extractDeviceId(input) {
     const candidate = Reflect.get(input, 'deviceId');
     return typeof candidate === 'number' && Number.isFinite(candidate) ? candidate : null;
 }
+/**
+ * The EVENTS embed's real call graph (`events-client.ts` in the embed):
+ *   • `auth.me`                                — SDK boot/auth probe
+ *   • `deviceManager.listAll`                  — camera names + the "all
+ *     cameras" resolution (already projected to the scope)
+ *   • `pipelineAnalytics.listRecentTracks`     — the feed itself
+ *   • `pipelineAnalytics.listEventKindsBatch`  — the class→macro taxonomy
+ *   • `pipelineAnalytics.searchObjectEvents`   — CLIP text search
+ *
+ * Intentionally NOT here: everything the grid link gets (WebRTC signalling,
+ * snapshots, TURN, camera metrics) — a shared events page is not a camera
+ * wall — and every mutating analytics method (`deleteTracks`, `setTrackFlags`,
+ * the retrain surface, the export planes).
+ */
+const EVENTS_VIEW_OPEN_METHODS = new Set(['auth.me', 'deviceManager.listAll']);
+/**
+ * Methods whose input carries a `deviceIds` ARRAY. The rule is INTERSECTION,
+ * and the outcome is FILTER-AND-SERVE: a request that names at least one
+ * in-scope device passes, and the RESPONSE is stripped to the scope by
+ * {@link projectShareScopeRows}.
+ *
+ * Filter rather than reject, because a multi-camera link whose owner later
+ * narrowed the share must keep working for the cameras it still covers —
+ * rejecting the whole page would break the link on a change that only removed
+ * one camera. A FULLY disjoint request is still denied: there is nothing to
+ * serve, and answering `[]` would read as "these cameras had no events" rather
+ * than "you cannot see these cameras".
+ */
+const EVENTS_VIEW_DEVICE_ARRAY_METHODS = new Set([
+    'pipelineAnalytics.listRecentTracks',
+    'pipelineAnalytics.listEventKindsBatch',
+]);
+/**
+ * Methods whose input carries an OPTIONAL single `deviceId`, where omitting it
+ * means EVERY camera in the deployment.
+ *
+ * A present id must be in scope. An ABSENT id is allowed — and that is safe
+ * only because the response is filtered server-side
+ * ({@link projectShareScopeRows}); the caller is never trusted to have scoped
+ * its own query. Rejecting the absent case instead would leave a multi-camera
+ * share link unable to search at all, and would not be one bit safer.
+ */
+const EVENTS_VIEW_OPTIONAL_DEVICE_METHODS = new Set([
+    'pipelineAnalytics.searchObjectEvents',
+]);
+/** Pull a `deviceIds` array off a raw tRPC input. Null when absent/malformed. */
+function extractDeviceIds(input) {
+    if (input === null || typeof input !== 'object')
+        return null;
+    const candidate = Reflect.get(input, 'deviceIds');
+    if (!Array.isArray(candidate))
+        return null;
+    const ids = candidate.filter((x) => typeof x === 'number' && Number.isFinite(x));
+    return ids.length === candidate.length ? ids : null;
+}
+function checkEventsViewAccess(scope, path, input) {
+    if (EVENTS_VIEW_OPEN_METHODS.has(path)) {
+        return { ok: true };
+    }
+    if (EVENTS_VIEW_DEVICE_ARRAY_METHODS.has(path)) {
+        const requested = extractDeviceIds(input);
+        if (requested === null || requested.length === 0) {
+            return { ok: false, reason: `'${path}' requires a deviceIds array for share-view access` };
+        }
+        const allowed = new Set(scope.deviceIds);
+        if (!requested.some((id) => allowed.has(id))) {
+            return {
+                ok: false,
+                reason: `Devices ${requested.join(', ')} are outside this share link's scope`,
+            };
+        }
+        return { ok: true };
+    }
+    if (EVENTS_VIEW_OPTIONAL_DEVICE_METHODS.has(path)) {
+        const deviceId = extractDeviceId(input);
+        // Absent = every camera; the RESPONSE filter is what scopes it.
+        if (deviceId === null)
+            return { ok: true };
+        if (!scope.deviceIds.includes(deviceId)) {
+            return { ok: false, reason: `Device ${deviceId} is outside this share link's scope` };
+        }
+        return { ok: true };
+    }
+    return { ok: false, reason: `'${path}' is not available to share-view tokens` };
+}
 function checkShareViewAccess(scope, path, input) {
+    if (scope.kind === 'events-view') {
+        return checkEventsViewAccess(scope, path, input);
+    }
     if (scope.kind !== 'grid-view') {
         return { ok: false, reason: `Unknown share scope kind '${String(scope.kind)}'` };
     }
@@ -88,6 +178,58 @@ function projectListAllForShareScope(data, scope) {
     }
     return rows;
 }
+/**
+ * Strip every row a share token may not see, by `deviceId`.
+ *
+ * This is the half that makes the events surface safe, and it is not
+ * defence-in-depth — it is the ACTUAL enforcement for two of the three
+ * methods:
+ *
+ *  - `searchObjectEvents` with no `deviceId` searches the whole deployment.
+ *    The call is allowed (see the enumeration) precisely because the answer is
+ *    cut here; trusting the caller to scope its own query would be trusting a
+ *    URL a third party is holding.
+ *  - `listRecentTracks` / `listEventKindsBatch` pass the intersection check, so
+ *    a partially in-scope request reaches the provider — and comes back with
+ *    rows the link may not see. Those are removed here.
+ *
+ * Two payload shapes, because the methods answer differently: a bare array of
+ * rows (`searchObjectEvents`, `listEventKindsBatch`) and a PAGED envelope
+ * (`listRecentTracks` → `{tracks, nextCursor}`). The cursor is preserved —
+ * dropping it would silently end a shared page's infinite scroll at page one.
+ *
+ * A row with NO numeric `deviceId` is DROPPED, never kept: "it probably
+ * belongs to a device in scope" is not a security argument.
+ *
+ * Anything that is not a row payload passes through untouched (the route
+ * errored upstream, and rewriting an error into `[]` would hide it).
+ */
+function projectShareScopeRows(data, scope) {
+    const allowed = new Set(scope.deviceIds);
+    const keep = (row) => {
+        if (row === null || typeof row !== 'object')
+            return false;
+        const id = Reflect.get(row, 'deviceId');
+        return typeof id === 'number' && allowed.has(id);
+    };
+    if (Array.isArray(data))
+        return data.filter(keep);
+    if (data !== null && typeof data === 'object') {
+        const tracks = Reflect.get(data, 'tracks');
+        if (Array.isArray(tracks)) {
+            return { ...data, tracks: tracks.filter(keep) };
+        }
+    }
+    return data;
+}
+/** Paths whose RESPONSE must be cut to the share scope before it leaves the
+ *  server. Kept beside the enumeration so a method added to one and forgotten
+ *  in the other is visible in a single file. */
+exports.SHARE_SCOPE_PROJECTED_METHODS = new Set([
+    'pipelineAnalytics.listRecentTracks',
+    'pipelineAnalytics.listEventKindsBatch',
+    'pipelineAnalytics.searchObjectEvents',
+]);
 /**
  * Whether a live event belongs to a device inside the share scope.
  * Matches the device identity two ways (fail closed — no match, no push):

package/dist/api/trpc/trpc.middleware.js

@@ -6,12 +6,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentProcedure = exports.adminProcedure = exports.protectedProcedure = exports.createCallerFactory = exports.publicProcedure = exports.trpcRouter = void 0;
 exports.iterableSubscription = iterableSubscription;
 exports.iterableInterval = iterableInterval;
+const system_1 = require("@camstack/system");
 const server_1 = require("@trpc/server");
 const superjson_1 = __importDefault(require("superjson"));
-const system_1 = require("@camstack/system");
+const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
 const scope_access_js_1 = require("./scope-access.js");
 const share_view_access_js_1 = require("./share-view-access.js");
-const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
 const t = server_1.initTRPC.context().create({
     transformer: superjson_1.default,
     errorFormatter: cap_route_error_formatter_js_1.formatTrpcError,
@@ -114,6 +114,20 @@ exports.protectedProcedure = t.procedure.use(async ({ ctx, next, path, getRawInp
             }
             return out;
         }
+        // The events surface answers with ROWS carrying a `deviceId`, and two of
+        // its three methods can legitimately reach devices outside the scope: a
+        // partially in-scope `listRecentTracks`, and a `searchObjectEvents` with
+        // no `deviceId` at all (which means EVERY camera). The enumeration lets
+        // those calls through — this is where the answer is cut. Without it the
+        // allowlist would be a doorman who checks the ticket and then hands over
+        // the whole building.
+        if (share_view_access_js_1.SHARE_SCOPE_PROJECTED_METHODS.has(path)) {
+            const out = await next({ ctx: { ...ctx, user: ctx.user } });
+            if (out.ok) {
+                return { ...out, data: (0, share_view_access_js_1.projectShareScopeRows)(out.data, ctx.user.shareView.scope) };
+            }
+            return out;
+        }
         return next({ ctx: { ...ctx, user: ctx.user } });
     }
     // Spread+reassign of `user` narrows downstream ctx from `User | null`

package/dist/core/addon/addon-registry.service.js

@@ -53,6 +53,7 @@ const node_crypto_1 = require("node:crypto");
 const path = __importStar(require("node:path"));
 const fs = __importStar(require("node:fs"));
 const node_url_1 = require("node:url");
+const require_cache_js_1 = require("./require-cache.js");
 const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
 const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
 const system_6 = require("@camstack/system");
@@ -3098,11 +3099,9 @@ class AddonRegistryService {
             // and the action 404'd.
             //
             // Dropping the addon's own modules from the require cache is what
-            // actually re-reads the bundle. Scoped to the addon directory so no other
-            // addon's (or the hub's own) modules are evicted, and best-effort: a
-            // cache that cannot be walked leaves the previous behaviour rather than
-            // failing the registration.
-            purgeRequireCacheUnder(path.dirname(entryPath));
+            // actually re-reads the bundle — see `require-cache.ts` for the scoping
+            // and the real-path match Node's cache keys demand.
+            (0, require_cache_js_1.purgeRequireCacheUnder)(path.dirname(entryPath));
             // Kept for a genuinely ESM addon entry, where it IS the mechanism.
             const cacheBustedUrl = `${(0, node_url_1.pathToFileURL)(entryPath).href}?t=${Date.now()}`;
             // A plain `await import()` here is downleveled by tsc (the backend builds
@@ -3157,32 +3156,3 @@ class AddonRegistryService {
     }
 }
 exports.AddonRegistryService = AddonRegistryService;
-/**
- * Drop every `require`-cached module that lives under `dir`.
- *
- * Node's ESM loader serves a CommonJS module from the require cache, keyed by
- * the resolved filename — the `?t=` query an ESM import uses to force a re-read
- * is stripped before that lookup and therefore does nothing. Since every addon
- * bundle here is CJS, evicting the addon's own entries is what makes a
- * hot-updated bundle actually load.
- *
- * Scoped to one directory on purpose: a blanket cache clear would evict the
- * hub's own modules and every other addon's, turning a catalog refresh into a
- * process-wide reload. Best-effort — a cache that cannot be walked leaves the
- * previous (stale) behaviour rather than failing the caller.
- */
-function purgeRequireCacheUnder(dir) {
-    try {
-        const cache = require.cache;
-        if (cache === undefined)
-            return;
-        const prefix = dir.endsWith(path.sep) ? dir : `${dir}${path.sep}`;
-        for (const key of Object.keys(cache)) {
-            if (key.startsWith(prefix))
-                delete cache[key];
-        }
-    }
-    catch {
-        // Non-CJS host, or a frozen cache. The import below still runs.
-    }
-}

package/dist/core/addon/require-cache.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purgeRequireCacheUnder = purgeRequireCacheUnder;
+/**
+ * require-cache — evicting an addon's own modules so a hot-updated bundle
+ * is actually re-read.
+ *
+ * Lives in its own file because the behaviour it encodes is a Node semantic
+ * that cannot be observed from inside the test runner: the runner transforms
+ * modules itself, so only a real `node` process re-executing a real CommonJS
+ * file proves anything. `require-cache.spec.ts` spawns one.
+ */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Drop every `require`-cached module that lives under `dir`.
+ *
+ * Node's ESM loader serves a CommonJS module from the require cache, keyed by
+ * the resolved filename — the `?t=` query an ESM import uses to force a re-read
+ * is stripped before that lookup and therefore does nothing. Since every addon
+ * bundle here is CJS, evicting the addon's own entries is what makes a
+ * hot-updated bundle actually load.
+ *
+ * Matched against the REAL path as well as the given one. Node keys the cache
+ * by the resolved-and-symlink-followed filename, while an addon directory is
+ * assembled from the configured `dataDir` and never realpath'd — so a single
+ * symlink anywhere above it (a `dataDir` under macOS's `/tmp`, a relocated data
+ * root) makes a prefix match on the given path miss every entry and this
+ * function silently do nothing. Which is precisely the failure it exists to
+ * fix, wearing its clothes: the catalog would look refreshed and be stale.
+ *
+ * Scoped to one directory on purpose: a blanket cache clear would evict the
+ * hub's own modules and every other addon's, turning a catalog refresh into a
+ * process-wide reload. Best-effort — a cache that cannot be walked leaves the
+ * previous (stale) behaviour rather than failing the caller.
+ */
+function purgeRequireCacheUnder(dir) {
+    try {
+        const cache = require.cache;
+        if (cache === undefined)
+            return;
+        const prefixes = candidatePrefixes(dir);
+        for (const key of Object.keys(cache)) {
+            if (prefixes.some((prefix) => key.startsWith(prefix)))
+                delete cache[key];
+        }
+    }
+    catch {
+        // Non-CJS host, or a frozen cache. The caller's import still runs.
+    }
+}
+/** The directory as given and as Node sees it, both as trailing-separator prefixes. */
+function candidatePrefixes(dir) {
+    const withSep = (d) => (d.endsWith(node_path_1.default.sep) ? d : `${d}${node_path_1.default.sep}`);
+    const given = withSep(dir);
+    let real = given;
+    try {
+        real = withSep(node_fs_1.default.realpathSync(dir));
+    }
+    catch {
+        // Directory gone between the caller's existsSync and here — `given` alone
+        // is still a correct (if narrower) match.
+    }
+    return real === given ? [given] : [given, real];
+}

package/dist/core/auth/share-token.service.js

@@ -69,12 +69,25 @@ exports.SHARE_TOKEN_TTL_MAX_SEC = 30 * 24 * 60 * 60; // 30 days
 exports.SHARE_TOKEN_TTL_DEFAULT_SEC = 7 * 24 * 60 * 60; // 7 days
 exports.SHARE_TOKEN_MAX_DEVICES = 64;
 /**
- * What a share token is allowed to see. Discriminated on `kind` so future
- * share surfaces (single-camera view, recording clip, …) extend the union
- * without touching verification plumbing.
+ * What a share token is allowed to see. Keyed on `kind` so future share
+ * surfaces (single-camera view, recording clip, …) extend the set without
+ * touching verification plumbing.
+ */
+/**
+ * `grid-view` — the live camera wall (WebRTC + snapshots).
+ * `events-view` — the events embed (track feed, kind taxonomy, CLIP search).
+ *
+ * They are SEPARATE kinds, not one kind with a bigger surface. Adding the
+ * track methods to `grid-view` would retroactively widen every share link an
+ * operator has already handed out: a link minted to show a camera wall would
+ * silently start serving that camera's event history. A token keeps the
+ * perimeter it was minted with, and a new perimeter needs a new mint.
+ *
+ * Neither kind is a superset of the other — an events link cannot open a
+ * WebRTC session, and a grid link cannot read a track.
  */
 exports.ShareTokenScopeSchema = zod_1.z.object({
-    kind: zod_1.z.literal('grid-view'),
+    kind: zod_1.z.enum(['grid-view', 'events-view']),
     deviceIds: zod_1.z.array(zod_1.z.number().int().nonnegative()).min(1).max(exports.SHARE_TOKEN_MAX_DEVICES),
 });
 /** Persisted record — never leaves the server with `tokenHash` attached. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.76",
+  "version": "1.2.78",
   "private": false,
   "files": [
     "dist",
@@ -33,19 +33,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.36",
+    "@camstack/addon-admin-ui": "1.2.38",
     "@camstack/addon-agent-ui": "1.2.10",
     "@camstack/addon-auth": "1.2.11",
     "@camstack/addon-decoder-nodeav": "1.2.9",
     "@camstack/addon-notifiers": "1.2.13",
-    "@camstack/addon-pipeline": "1.2.47",
-    "@camstack/addon-pipeline-orchestrator": "1.2.30",
-    "@camstack/addon-post-analysis": "1.2.52",
+    "@camstack/addon-pipeline": "1.2.49",
+    "@camstack/addon-pipeline-orchestrator": "1.2.32",
+    "@camstack/addon-post-analysis": "1.2.54",
     "@camstack/sdk": "1.2.10",
     "@camstack/shm-ring": "1.1.9",
-    "@camstack/system": "1.2.62",
-    "@camstack/types": "1.2.46",
-    "@camstack/ui-library": "1.2.34",
+    "@camstack/system": "1.2.64",
+    "@camstack/types": "1.2.48",
+    "@camstack/ui-library": "1.2.35",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",