camstack 1.2.32 → 1.2.33

package/dist/cli.js

@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-OBXOIIQJ.js");
+  await import("./launcher-LXP37XH2.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-OBXOIIQJ.js");
+  await import("./launcher-LXP37XH2.js");
 }
 
 // src/commands/setup.ts

package/dist/{launcher-OBXOIIQJ.js → launcher-LXP37XH2.js}

@@ -396972,6 +396972,7 @@ var require_trpc_context = __commonJS({
           return null;
         }
         const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
         return {
           id: payload.userId ?? payload.keyId ?? "unknown",
           username: payload.username ?? "unknown",
@@ -396992,12 +396993,21 @@ var require_trpc_context = __commonJS({
           // user's scopes expects the change to APPLY, and the live session
           // kept gating on the old set until re-login (2026-08-15: a user
           // granted the whole fleet kept seeing zero cameras). For non-admin
-          // JWT principals the store's current scopes win when readable
+          // SESSION principals the store's current scopes win when readable
           // (memoized — see above); the JWT's copy is the fallback when the
           // user-management cap is unreachable, so a store hiccup never
           // locks anybody out mid-request.
+          //
+          // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
+          // is governed by the grant the operator consented to, not by the linking
+          // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
+          // → `baseClaims`) and its owner is normally an admin, whose record is
+          // deliberately unscoped — so the refresh replaced a six-scope Home
+          // Assistant grant with `[]` and the hub refused the component's first
+          // call with `Have: (none)` (2026-08-19). The user store knows nothing
+          // about a link and must not get a vote on one.
           ...payload.scopes !== void 0 ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {},
-          ...!payload.isAdmin ? await (async () => {
+          ...!payload.isAdmin && principal.kind === "session" ? await (async () => {
             const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? "unknown", addonRegistry);
             return fresh !== null ? { scopes: fresh } : {};
           })() : {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.32",
+  "version": "1.2.33",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",