camstack 1.2.59 → 1.2.60

package/dist/{chunk-UMNISWW6.js → chunk-ARTM5NDU.js}

@@ -33129,6 +33129,33 @@ var intercomCapability = {
   deviceNative: true,
   mode: "singleton",
   deviceTypes: [DeviceType.Camera],
+  /**
+  * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+  *
+  * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+  * cap has no configuration surface at all: all six methods open, feed and
+  * close one live audio session against one `deviceId`. That is the same
+  * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+  * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+  * `admin` because they change what the device IS.
+  *
+  * `protected` does not mean ungated: `protectedProcedure` runs the
+  * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+  * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+  * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+  * only) still cannot talk, and a grant on camera 5 cannot talk through
+  * camera 7.
+  *
+  * Every method was `auth: 'admin'` from the initial commit, which made the
+  * cap unreachable by every non-admin principal — `adminProcedure` throws
+  * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+  * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+  * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+  * `camera-operator` scope preset has promised "PTZ control, intercom,
+  * snapshots" since that same commit; the promise could not be kept. Recorded
+  * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+  * preset promises a cap no row of that preset can reach.
+  */
   methods: {
     /**
     * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -33141,7 +33168,7 @@ var intercomCapability = {
       sdpOffer: external_exports.string()
     }), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     handleAnswer: method(external_exports.object({
       deviceId: external_exports.number(),
@@ -33149,7 +33176,7 @@ var intercomCapability = {
       sdpAnswer: external_exports.string()
     }), external_exports.void(), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /** Close explicitly. Server also auto-closes on 30s idle. */
     stopSession: method(external_exports.object({
@@ -33157,7 +33184,7 @@ var intercomCapability = {
       sessionId: external_exports.string()
     }), external_exports.void(), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /**
     * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -33170,7 +33197,7 @@ var intercomCapability = {
     */
     startTalkSession: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.object({ sessionId: external_exports.string() }), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /**
     * Push one chunk of talk-back audio onto the active talk session.
@@ -33205,12 +33232,12 @@ var intercomCapability = {
       sequenceNumber: external_exports.number().int()
     }), external_exports.object({ accepted: external_exports.boolean() }), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     }),
     /** Close the raw-PCM talk session. Idempotent. */
     endTalkSession: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.void(), {
       kind: "mutation",
-      auth: "admin"
+      auth: "protected"
     })
   },
   events: { onStatusChanged: { data: external_exports.object({

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-UMNISWW6.js";
+} from "./chunk-ARTM5NDU.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-WK4Q3DVU.js");
+  await import("./launcher-CL4LHR6D.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-WK4Q3DVU.js");
+  await import("./launcher-CL4LHR6D.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-NCRIXDCA.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-UFN2BYNO.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-NCRIXDCA.js → discover-UFN2BYNO.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-UMNISWW6.js";
+} from "./chunk-ARTM5NDU.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,

package/dist/{launcher-WK4Q3DVU.js → launcher-CL4LHR6D.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-C7uZ_fOb.js
-var require_dist_C7uZ_fOb = __commonJS({
-  "../system/dist/dist-C7uZ_fOb.js"(exports) {
+// ../system/dist/dist-BPlfW-CG.js
+var require_dist_BPlfW_CG = __commonJS({
+  "../system/dist/dist-BPlfW-CG.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -43645,6 +43645,33 @@ var require_dist_C7uZ_fOb = __commonJS({
       deviceNative: true,
       mode: "singleton",
       deviceTypes: [DeviceType.Camera],
+      /**
+      * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+      *
+      * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+      * cap has no configuration surface at all: all six methods open, feed and
+      * close one live audio session against one `deviceId`. That is the same
+      * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+      * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+      * `admin` because they change what the device IS.
+      *
+      * `protected` does not mean ungated: `protectedProcedure` runs the
+      * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+      * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+      * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+      * only) still cannot talk, and a grant on camera 5 cannot talk through
+      * camera 7.
+      *
+      * Every method was `auth: 'admin'` from the initial commit, which made the
+      * cap unreachable by every non-admin principal — `adminProcedure` throws
+      * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+      * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+      * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+      * `camera-operator` scope preset has promised "PTZ control, intercom,
+      * snapshots" since that same commit; the promise could not be kept. Recorded
+      * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+      * preset promises a cap no row of that preset can reach.
+      */
       methods: {
         /**
         * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -43657,7 +43684,7 @@ var require_dist_C7uZ_fOb = __commonJS({
           sdpOffer: zod.z.string()
         }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         handleAnswer: method(zod.z.object({
           deviceId: zod.z.number(),
@@ -43665,7 +43692,7 @@ var require_dist_C7uZ_fOb = __commonJS({
           sdpAnswer: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close explicitly. Server also auto-closes on 30s idle. */
         stopSession: method(zod.z.object({
@@ -43673,7 +43700,7 @@ var require_dist_C7uZ_fOb = __commonJS({
           sessionId: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -43686,7 +43713,7 @@ var require_dist_C7uZ_fOb = __commonJS({
         */
         startTalkSession: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Push one chunk of talk-back audio onto the active talk session.
@@ -43721,12 +43748,12 @@ var require_dist_C7uZ_fOb = __commonJS({
           sequenceNumber: zod.z.number().int()
         }), zod.z.object({ accepted: zod.z.boolean() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close the raw-PCM talk session. Idempotent. */
         endTalkSession: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         })
       },
       events: { onStatusChanged: { data: zod.z.object({
@@ -58686,7 +58713,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59505,7 +59532,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59599,7 +59626,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60496,11 +60523,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-CBU4-TJO.js
-var require_retired_settings_keys_CBU4_TJO = __commonJS({
-  "../system/dist/retired-settings-keys-CBU4-TJO.js"(exports) {
+// ../system/dist/retired-settings-keys-DBY6ebwV.js
+var require_retired_settings_keys_DBY6ebwV = __commonJS({
+  "../system/dist/retired-settings-keys-DBY6ebwV.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62714,8 +62741,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
-    var require_retired_settings_keys = require_retired_settings_keys_CBU4_TJO();
+    var require_dist10 = require_dist_BPlfW_CG();
+    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67464,7 +67491,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67601,7 +67628,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67791,7 +67818,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75604,7 +75631,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76169,7 +76196,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -78791,7 +78818,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -79907,8 +79934,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
-    var require_retired_settings_keys = require_retired_settings_keys_CBU4_TJO();
+    var require_dist10 = require_dist_BPlfW_CG();
+    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -82187,7 +82214,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -84068,7 +84095,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -102129,7 +102156,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -114617,12 +114644,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-CRTx_j4k.js
-var require_manifest_python_deps_CRTx_j4k = __commonJS({
-  "../system/dist/manifest-python-deps-CRTx_j4k.js"(exports) {
+// ../system/dist/manifest-python-deps-COeSr7el.js
+var require_manifest_python_deps_COeSr7el = __commonJS({
+  "../system/dist/manifest-python-deps-COeSr7el.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_C7uZ_fOb();
+    require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -126068,7 +126095,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7uZ_fOb();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -126094,7 +126121,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_python_deps = require_manifest_python_deps_CRTx_j4k();
+    var require_manifest_python_deps = require_manifest_python_deps_COeSr7el();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -227689,6 +227716,33 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       deviceNative: true,
       mode: "singleton",
       deviceTypes: [require_sleep.DeviceType.Camera],
+      /**
+      * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+      *
+      * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+      * cap has no configuration surface at all: all six methods open, feed and
+      * close one live audio session against one `deviceId`. That is the same
+      * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+      * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+      * `admin` because they change what the device IS.
+      *
+      * `protected` does not mean ungated: `protectedProcedure` runs the
+      * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+      * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+      * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+      * only) still cannot talk, and a grant on camera 5 cannot talk through
+      * camera 7.
+      *
+      * Every method was `auth: 'admin'` from the initial commit, which made the
+      * cap unreachable by every non-admin principal — `adminProcedure` throws
+      * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+      * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+      * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+      * `camera-operator` scope preset has promised "PTZ control, intercom,
+      * snapshots" since that same commit; the promise could not be kept. Recorded
+      * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+      * preset promises a cap no row of that preset can reach.
+      */
       methods: {
         /**
         * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -227701,7 +227755,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sdpOffer: zod.z.string()
         }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         handleAnswer: require_sleep.method(zod.z.object({
           deviceId: zod.z.number(),
@@ -227709,7 +227763,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sdpAnswer: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close explicitly. Server also auto-closes on 30s idle. */
         stopSession: require_sleep.method(zod.z.object({
@@ -227717,7 +227771,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sessionId: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -227730,7 +227784,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         startTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Push one chunk of talk-back audio onto the active talk session.
@@ -227765,12 +227819,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sequenceNumber: zod.z.number().int()
         }), zod.z.object({ accepted: zod.z.boolean() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close the raw-PCM talk session. Idempotent. */
         endTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         })
       },
       events: { onStatusChanged: { data: zod.z.object({
@@ -245028,7 +245082,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       {
         id: "camera-operator",
         label: "Camera operator",
-        description: "Everything `camera-viewer` does plus PTZ control, intercom, snapshots and recording start/stop. Cannot delete devices or recordings.",
+        description: "Everything `camera-viewer` does plus live control of every granted camera \u2014 PTZ movement, intercom talk-back and on-demand snapshots. Cannot delete devices, and grants nothing on system-scope caps (recording control, users, addons).",
         rows: [{
           type: "category",
           target: "device",
@@ -401628,6 +401682,7 @@ var require_scope_access = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.DEVICE_ENUMERATION_METHODS = void 0;
+    exports.referencedDeviceIds = referencedDeviceIds;
     exports.checkScopeAccess = checkScopeAccess;
     var system_1 = require_dist3();
     var types_1 = require_dist4();
@@ -413553,6 +413608,25 @@ var require_trpc_router = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/trpc/trpc-error-device-tags.js
+var require_trpc_error_device_tags = __commonJS({
+  "../../server/backend/dist/api/trpc/trpc-error-device-tags.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.trpcErrorDeviceTags = trpcErrorDeviceTags;
+    var scope_access_js_1 = require_scope_access();
+    function trpcErrorDeviceTags(path, input) {
+      if (path === void 0)
+        return {};
+      const ids = (0, scope_access_js_1.referencedDeviceIds)(path, input);
+      const first = ids[0];
+      if (first === void 0)
+        return {};
+      return ids.length > 1 ? { deviceId: first, deviceCount: ids.length } : { deviceId: first };
+    }
+  }
+});
+
 // ../../server/backend/dist/api/trpc/ws-request-census.js
 var require_ws_request_census = __commonJS({
   "../../server/backend/dist/api/trpc/ws-request-census.js"(exports) {
@@ -421635,6 +421709,7 @@ var require_main4 = __commonJS({
     var trpc_context_1 = require_trpc_context();
     var trpc_router_1 = require_trpc_router();
     var trpc_error_principal_1 = require_trpc_error_principal();
+    var trpc_error_device_tags_1 = require_trpc_error_device_tags();
     var ws_request_census_1 = require_ws_request_census();
     var addon_route_jwt_gate_js_1 = require_addon_route_jwt_gate();
     var session_cookie_js_1 = require_session_cookie();
@@ -421933,9 +422008,13 @@ var require_main4 = __commonJS({
               (0, http_request_census_hook_1.recordTrpcHttpRequest)(httpRequestCensus, req, trpcCtx.user);
               return trpcCtx;
             },
-            onError: ({ path: trpcPath, error, ctx }) => {
+            onError: ({ path: trpcPath, error, ctx, input }) => {
               const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC");
               trpcLogger.warn("tRPC error", {
+                // WHICH camera. A refusal on a device-scoped path that names no
+                // deviceId cannot answer "one camera or all of them?" — the
+                // question always asked first (2026-08-29, `intercom.startSession`).
+                tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
                 meta: {
                   code: error.code,
                   path: trpcPath ?? "?",
@@ -422334,9 +422413,12 @@ var require_main4 = __commonJS({
             (0, ws_request_census_1.identifyWsCensusSession)(opts.res, (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user));
             return wsCtx;
           },
-          onError: ({ path: trpcPath, error, ctx }) => {
+          onError: ({ path: trpcPath, error, ctx, input }) => {
             const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC:ws");
             trpcLogger.warn("tRPC error", {
+              // The socket the viewer uses — this is the transport that logged the
+              // four `intercom.startSession` refusals with no camera on them.
+              tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
               meta: {
                 code: error.code,
                 path: trpcPath ?? "?",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.59",
+  "version": "1.2.60",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",