@camstack/types 1.2.122 → 1.2.123

package/dist/capabilities/intercom.cap.d.ts

@@ -69,6 +69,33 @@ export declare const intercomCapability: {
     readonly deviceNative: true;
     readonly mode: "singleton";
     readonly deviceTypes: readonly [DeviceType.Camera];
+    /**
+     * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+     *
+     * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+     * cap has no configuration surface at all: all six methods open, feed and
+     * close one live audio session against one `deviceId`. That is the same
+     * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+     * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+     * `admin` because they change what the device IS.
+     *
+     * `protected` does not mean ungated: `protectedProcedure` runs the
+     * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+     * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+     * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+     * only) still cannot talk, and a grant on camera 5 cannot talk through
+     * camera 7.
+     *
+     * Every method was `auth: 'admin'` from the initial commit, which made the
+     * cap unreachable by every non-admin principal — `adminProcedure` throws
+     * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+     * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+     * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+     * `camera-operator` scope preset has promised "PTZ control, intercom,
+     * snapshots" since that same commit; the promise could not be kept. Recorded
+     * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+     * preset promises a cap no row of that preset can reach.
+     */
     readonly methods: {
         /**
          * Open a server-side WebRTC audio-only session. Returns an SDP

package/dist/index.js

@@ -26657,6 +26657,33 @@ var intercomCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [require_sleep.DeviceType.Camera],
+	/**
+	* **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+	*
+	* Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+	* cap has no configuration surface at all: all six methods open, feed and
+	* close one live audio session against one `deviceId`. That is the same
+	* authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+	* the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+	* `admin` because they change what the device IS.
+	*
+	* `protected` does not mean ungated: `protectedProcedure` runs the
+	* `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+	* with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+	* grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+	* only) still cannot talk, and a grant on camera 5 cannot talk through
+	* camera 7.
+	*
+	* Every method was `auth: 'admin'` from the initial commit, which made the
+	* cap unreachable by every non-admin principal — `adminProcedure` throws
+	* `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+	* machinery generated for this cap (`METHOD_ACCESS_MAP`,
+	* `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+	* `camera-operator` scope preset has promised "PTZ control, intercom,
+	* snapshots" since that same commit; the promise could not be kept. Recorded
+	* as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+	* preset promises a cap no row of that preset can reach.
+	*/
 	methods: {
 		/**
 		* Open a server-side WebRTC audio-only session. Returns an SDP
@@ -26669,7 +26696,7 @@ var intercomCapability = {
 			sdpOffer: zod.z.string()
 		}), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		handleAnswer: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
@@ -26677,7 +26704,7 @@ var intercomCapability = {
 			sdpAnswer: zod.z.string()
 		}), zod.z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close explicitly. Server also auto-closes on 30s idle. */
 		stopSession: require_sleep.method(zod.z.object({
@@ -26685,7 +26712,7 @@ var intercomCapability = {
 			sessionId: zod.z.string()
 		}), zod.z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -26698,7 +26725,7 @@ var intercomCapability = {
 		*/
 		startTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Push one chunk of talk-back audio onto the active talk session.
@@ -26733,12 +26760,12 @@ var intercomCapability = {
 			sequenceNumber: zod.z.number().int()
 		}), zod.z.object({ accepted: zod.z.boolean() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close the raw-PCM talk session. Idempotent. */
 		endTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		})
 	},
 	events: { onStatusChanged: { data: zod.z.object({
@@ -45954,7 +45981,7 @@ var SCOPE_PRESETS = [
 	{
 		id: "camera-operator",
 		label: "Camera operator",
-		description: "Everything `camera-viewer` does plus PTZ control, intercom, snapshots and recording start/stop. Cannot delete devices or recordings.",
+		description: "Everything `camera-viewer` does plus live control of every granted camera — PTZ movement, intercom talk-back and on-demand snapshots. Cannot delete devices, and grants nothing on system-scope caps (recording control, users, addons).",
 		rows: [{
 			type: "category",
 			target: "device",

package/dist/index.mjs

@@ -26656,6 +26656,33 @@ var intercomCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
+	/**
+	* **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+	*
+	* Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+	* cap has no configuration surface at all: all six methods open, feed and
+	* close one live audio session against one `deviceId`. That is the same
+	* authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+	* the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+	* `admin` because they change what the device IS.
+	*
+	* `protected` does not mean ungated: `protectedProcedure` runs the
+	* `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+	* with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+	* grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+	* only) still cannot talk, and a grant on camera 5 cannot talk through
+	* camera 7.
+	*
+	* Every method was `auth: 'admin'` from the initial commit, which made the
+	* cap unreachable by every non-admin principal — `adminProcedure` throws
+	* `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+	* machinery generated for this cap (`METHOD_ACCESS_MAP`,
+	* `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+	* `camera-operator` scope preset has promised "PTZ control, intercom,
+	* snapshots" since that same commit; the promise could not be kept. Recorded
+	* as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+	* preset promises a cap no row of that preset can reach.
+	*/
 	methods: {
 		/**
 		* Open a server-side WebRTC audio-only session. Returns an SDP
@@ -26668,7 +26695,7 @@ var intercomCapability = {
 			sdpOffer: z.string()
 		}), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		handleAnswer: method(z.object({
 			deviceId: z.number(),
@@ -26676,7 +26703,7 @@ var intercomCapability = {
 			sdpAnswer: z.string()
 		}), z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close explicitly. Server also auto-closes on 30s idle. */
 		stopSession: method(z.object({
@@ -26684,7 +26711,7 @@ var intercomCapability = {
 			sessionId: z.string()
 		}), z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -26697,7 +26724,7 @@ var intercomCapability = {
 		*/
 		startTalkSession: method(z.object({ deviceId: z.number() }), z.object({ sessionId: z.string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/**
 		* Push one chunk of talk-back audio onto the active talk session.
@@ -26732,12 +26759,12 @@ var intercomCapability = {
 			sequenceNumber: z.number().int()
 		}), z.object({ accepted: z.boolean() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		}),
 		/** Close the raw-PCM talk session. Idempotent. */
 		endTalkSession: method(z.object({ deviceId: z.number() }), z.void(), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected"
 		})
 	},
 	events: { onStatusChanged: { data: z.object({
@@ -45946,7 +45973,7 @@ var SCOPE_PRESETS = [
 	{
 		id: "camera-operator",
 		label: "Camera operator",
-		description: "Everything `camera-viewer` does plus PTZ control, intercom, snapshots and recording start/stop. Cannot delete devices or recordings.",
+		description: "Everything `camera-viewer` does plus live control of every granted camera — PTZ movement, intercom talk-back and on-demand snapshots. Cannot delete devices, and grants nothing on system-scope caps (recording control, users, addons).",
 		rows: [{
 			type: "category",
 			target: "device",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.122",
+  "version": "1.2.123",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",