camstack 1.2.32 → 1.2.34

package/dist/cli.js

@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-OBXOIIQJ.js");
+  await import("./launcher-CSBOA3IK.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-OBXOIIQJ.js");
+  await import("./launcher-CSBOA3IK.js");
 }
 
 // src/commands/setup.ts

package/dist/{launcher-OBXOIIQJ.js → launcher-CSBOA3IK.js}

@@ -396909,7 +396909,7 @@ var require_trpc_context = __commonJS({
       }
       return null;
     }
-    async function resolveUser(token2, authService, addonRegistry, shareTokens = null) {
+    async function resolveUser(token2, authService, addonRegistry, shareTokens = null, logger = null) {
       if (!token2)
         return null;
       if (token2.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
@@ -396971,6 +396971,13 @@ var require_trpc_context = __commonJS({
         if (typeof payload.isAdmin !== "boolean") {
           return null;
         }
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
+        if (principal.kind === "not-a-credential") {
+          logger?.warn("trpc: refused a bearer that is not an API credential", {
+            meta: { reason: principal.reason, userId: payload.userId ?? payload.keyId ?? "unknown" }
+          });
+          return null;
+        }
         const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
         return {
           id: payload.userId ?? payload.keyId ?? "unknown",
@@ -396992,12 +396999,21 @@ var require_trpc_context = __commonJS({
           // user's scopes expects the change to APPLY, and the live session
           // kept gating on the old set until re-login (2026-08-15: a user
           // granted the whole fleet kept seeing zero cameras). For non-admin
-          // JWT principals the store's current scopes win when readable
+          // SESSION principals the store's current scopes win when readable
           // (memoized — see above); the JWT's copy is the fallback when the
           // user-management cap is unreachable, so a store hiccup never
           // locks anybody out mid-request.
+          //
+          // `session` ONLY, and that word is the whole fix. An ACCOUNT-LINK token
+          // is governed by the grant the operator consented to, not by the linking
+          // user's record: it always carries `isAdmin: false` (`oauth-grants.ts`
+          // → `baseClaims`) and its owner is normally an admin, whose record is
+          // deliberately unscoped — so the refresh replaced a six-scope Home
+          // Assistant grant with `[]` and the hub refused the component's first
+          // call with `Have: (none)` (2026-08-19). The user store knows nothing
+          // about a link and must not get a vote on one.
           ...payload.scopes !== void 0 ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {},
-          ...!payload.isAdmin ? await (async () => {
+          ...!payload.isAdmin && principal.kind === "session" ? await (async () => {
             const fresh = await refreshScopesFromStore(payload.userId ?? payload.keyId ?? "unknown", addonRegistry);
             return fresh !== null ? { scopes: fresh } : {};
           })() : {},
@@ -397025,19 +397041,19 @@ var require_trpc_context = __commonJS({
       };
       return { user };
     }
-    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null) {
+    async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
       const token2 = extractTokenFromRequest(req);
       return {
-        user: await resolveUser(token2, authService, addonRegistry, shareTokens),
+        user: await resolveUser(token2, authService, addonRegistry, shareTokens, logger),
         req,
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
         deviceFleet: () => addonRegistry.getPersistedDeviceList()
       };
     }
-    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null) {
+    async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
       const paramToken = opts.info.connectionParams?.["token"];
       const token2 = (typeof paramToken === "string" ? paramToken : null) ?? extractTokenFromRequest(opts.req);
-      const user = await resolveUser(token2, authService, addonRegistry, shareTokens);
+      const user = await resolveUser(token2, authService, addonRegistry, shareTokens, logger);
       return {
         user,
         req: opts.req,
@@ -408907,7 +408923,16 @@ var require_main4 = __commonJS({
           prefix: "/trpc",
           trpcOptions: {
             router: appRouter,
-            createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService),
+            createContext: ({ req }) => (0, trpc_context_1.createTrpcContext)(
+              req,
+              authService,
+              addonRegistry,
+              shareTokenService,
+              // A bearer refused for NOT being an API credential never reaches a
+              // procedure, so `onError` below never sees it — the refusal would
+              // be silent without this. Same reason `gateAddonJwt` logs (D103).
+              app.get(logging_service_1.LoggingService).createLogger("tRPC")
+            ),
             onError: ({ path: trpcPath, error, ctx }) => {
               const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC");
               trpcLogger.warn("tRPC error", {
@@ -409301,7 +409326,7 @@ var require_main4 = __commonJS({
         (0, ws_1.applyWSSHandler)({
           wss,
           router: appRouter,
-          createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService),
+          createContext: (opts) => (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws")),
           onError: ({ path: trpcPath, error, ctx }) => {
             const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC:ws");
             trpcLogger.warn("tRPC error", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.32",
+  "version": "1.2.34",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",