@camstack/server 1.2.605 → 1.2.607

package/dist/api/core/logs.router.js

@@ -11,7 +11,9 @@ exports.createLogsRouter = createLogsRouter;
  */
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const types_1 = require("@camstack/types");
+const node_crypto_1 = require("node:crypto");
+const system_1 = require("@camstack/system");
+const log_history_js_1 = require("../../core/logging/log-history.js");
 const LogLevelSchema = zod_1.z.enum(['debug', 'info', 'warn', 'error']);
 const LogTagsSchema = zod_1.z.object({
     agentId: zod_1.z.string().optional(),
@@ -39,6 +41,8 @@ const LogTagsSchema = zod_1.z.object({
 });
 /** Wire shape of a log entry — timestamp is serialised to ISO string by tRPC. */
 const LogEntrySchema = zod_1.z.object({
+    /** `<bootId>.<seq>` — identical live and on disk; the client's dedupe key (D898). */
+    id: zod_1.z.string().optional(),
     timestamp: zod_1.z.string(),
     level: zod_1.z.string(),
     scope: zod_1.z.string().optional(),
@@ -53,63 +57,214 @@ const LogEntrySchema = zod_1.z.object({
     meta: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
 });
 const LogEntryArraySchema = zod_1.z.array(LogEntrySchema);
-function createLogsRouter(logging) {
+/** Wire shape of a history page (D898). */
+const LogPageSchema = zod_1.z.object({
+    entries: LogEntryArraySchema,
+    /** Pass back as `before` to load the next OLDER page; null = nothing older. */
+    nextBefore: zod_1.z.string().nullable(),
+    nextAfter: zod_1.z.string().nullable(),
+    /** Bytes the source scanned for this slice — the "N MB scanned" indicator. */
+    scannedBytes: zod_1.z.number().int().nonnegative(),
+    /**
+     * True when the source has nothing older. False with fewer than `limit`
+     * entries = the slice's time budget ran out first; ask again with
+     * `nextBefore` to keep searching.
+     */
+    done: zod_1.z.boolean(),
+    cancelled: zod_1.z.boolean().optional(),
+    /** The source that answered — `ring` when the requested one cannot read. */
+    source: zod_1.z.string(),
+});
+const LogSourceSchema = zod_1.z.object({
+    addonId: zod_1.z.string(),
+    readable: zod_1.z.boolean(),
+    reason: zod_1.z.string().nullable(),
+    isDefault: zod_1.z.boolean(),
+    retentionDays: zod_1.z.number().nullable(),
+    filters: zod_1.z.object({
+        deviceId: zod_1.z.boolean(),
+        addonId: zod_1.z.boolean(),
+        nodeId: zod_1.z.boolean(),
+        tags: zod_1.z.boolean(),
+        level: zod_1.z.boolean(),
+        text: zod_1.z.boolean(),
+        timeRange: zod_1.z.boolean(),
+    }),
+});
+/** `tags` (the LogStream scope) → the read contract's indexed fields + the rest. */
+function readFiltersFromTags(tags) {
+    if (tags === undefined)
+        return {};
+    const rest = {};
+    let deviceId;
+    let addonId;
+    let nodeId;
+    for (const [key, raw] of Object.entries(tags)) {
+        if (raw === undefined)
+            continue;
+        if (key === 'deviceId') {
+            const n = typeof raw === 'number' ? raw : Number(raw);
+            if (Number.isInteger(n))
+                deviceId = n;
+            continue;
+        }
+        if (key === 'addonId' && typeof raw === 'string') {
+            addonId = raw;
+            continue;
+        }
+        if (key === 'agentId' && typeof raw === 'string') {
+            nodeId = raw;
+            continue;
+        }
+        if (key === 'containerDeviceId') {
+            const n = typeof raw === 'number' ? raw : Number(raw);
+            rest[key] = Number.isInteger(n) ? n : String(raw);
+            continue;
+        }
+        rest[key] = raw;
+    }
+    return {
+        ...(deviceId !== undefined ? { deviceId } : {}),
+        ...(addonId !== undefined ? { fromAddonId: addonId } : {}),
+        ...(nodeId !== undefined ? { fromNodeId: nodeId } : {}),
+        ...(Object.keys(rest).length > 0 ? { tags: rest } : {}),
+    };
+}
+function toWire(entry) {
+    return {
+        ...(entry.id !== undefined ? { id: entry.id } : {}),
+        timestamp: new Date(entry.timestamp).toISOString(),
+        level: entry.level,
+        ...(entry.scope !== undefined ? { scope: entry.scope } : {}),
+        message: entry.message,
+        ...(entry.tags !== undefined
+            ? {
+                tags: Object.fromEntries(Object.entries(entry.tags).map(([k, v]) => [k, String(v)])),
+            }
+            : {}),
+        ...(entry.meta !== undefined ? { meta: entry.meta } : {}),
+    };
+}
+/** Hub-local providers only: an agent's own files hold lines the hub already has. */
+function hubLocalDestinations(registry) {
+    if (registry === null)
+        return [];
+    return registry
+        .getCollectionEntries('log-destination')
+        .filter(([addonId]) => !addonId.includes('@'));
+}
+const NOT_READABLE = {
+    readable: false,
+    reason: 'This destination only ships lines',
+    retentionDays: null,
+    filters: {
+        deviceId: false,
+        addonId: false,
+        nodeId: false,
+        tags: false,
+        level: false,
+        text: false,
+        timeRange: false,
+    },
+};
+function createLogsRouter(logging, capabilityRegistry = null) {
     return (0, trpc_middleware_js_1.trpcRouter)({
+        /**
+         * One page of history (D898): newest first, from the source the client
+         * picked (default the hub's rotated files), every filter applied by the
+         * source BEFORE the limit. Page older with `before: nextBefore`. A slice
+         * is time-bounded — `done: false` with a short page means "still
+         * searching", and aborting the request cancels the slice in flight.
+         */
         query: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({
+            /** A read-capable log-destination addonId, or `ring`. Default `winston-logging`. */
+            source: zod_1.z.string().min(1).max(200).optional(),
             level: LogLevelSchema.optional(),
             since: zod_1.z.number().optional(),
             until: zod_1.z.number().optional(),
-            limit: zod_1.z.number().optional(),
+            limit: zod_1.z.number().int().min(1).max(1000).optional(),
             tags: LogTagsSchema.optional(),
+            /** Case-insensitive substring over message, scope, tags and meta. */
+            text: zod_1.z.string().max(200).optional(),
+            before: zod_1.z.string().min(1).max(1024).optional(),
+            after: zod_1.z.string().min(1).max(1024).optional(),
+            budgetMs: zod_1.z.number().int().min(50).max(10_000).optional(),
         }))
-            .output(LogEntryArraySchema)
-            .query(({ input, ctx }) => {
-            const filter = { limit: input.limit ?? 100 };
-            if (input.level)
-                filter.level = input.level;
-            if (input.since !== undefined)
-                filter.since = new Date(input.since);
-            if (input.until !== undefined)
-                filter.until = new Date(input.until);
-            if (input.tags)
-                filter.tags = input.tags;
-            const entries = logging.query(filter);
-            const filtered = (() => {
-                if (!ctx.user.isAdmin) {
-                    const ap = ctx.user.permissions?.allowedProviders;
-                    if (ap && ap !== '*') {
-                        const allowed = ap;
-                        return entries.filter((e) => {
-                            const addonId = e.tags?.addonId;
-                            if (typeof addonId !== 'string')
-                                return false;
-                            return allowed.some((p) => {
-                                const bare = (0, types_1.bareAddonId)(p);
-                                return addonId === bare || addonId.startsWith(bare);
-                            });
-                        });
-                    }
+            .output(LogPageSchema)
+            .query(async ({ input, signal }) => {
+            const sourceId = input.source ?? log_history_js_1.DEFAULT_LOG_SOURCE;
+            const provider = sourceId === log_history_js_1.RING_LOG_SOURCE
+                ? null
+                : (hubLocalDestinations(capabilityRegistry).find(([id]) => id === sourceId)?.[1] ??
+                    null);
+            const requestId = (0, node_crypto_1.randomUUID)();
+            const text = input.text?.trim();
+            const query = {
+                requestId,
+                ...readFiltersFromTags(input.tags),
+                ...(input.level !== undefined ? { level: input.level } : {}),
+                ...(text !== undefined && text.length > 0 ? { text } : {}),
+                ...(input.since !== undefined ? { since: input.since } : {}),
+                ...(input.until !== undefined ? { until: input.until } : {}),
+                ...(input.before !== undefined ? { before: input.before } : {}),
+                ...(input.after !== undefined ? { after: input.after } : {}),
+                ...(input.budgetMs !== undefined ? { budgetMs: input.budgetMs } : {}),
+                limit: input.limit ?? log_history_js_1.DEFAULT_PAGE_LIMIT,
+            };
+            const onAbort = () => {
+                void provider?.cancelRead?.({ requestId }).catch(() => undefined);
+            };
+            signal?.addEventListener('abort', onAbort, { once: true });
+            try {
+                const page = await (0, log_history_js_1.readLogHistory)({
+                    query,
+                    source: sourceId,
+                    tail: logging.query({}),
+                    provider,
+                });
+                return {
+                    entries: page.entries.map(toWire),
+                    nextBefore: page.nextBefore,
+                    nextAfter: page.nextAfter,
+                    scannedBytes: page.scannedBytes,
+                    done: page.done,
+                    ...(page.cancelled !== undefined ? { cancelled: page.cancelled } : {}),
+                    source: page.source,
+                };
+            }
+            finally {
+                signal?.removeEventListener('abort', onAbort);
+            }
+        }),
+        /**
+         * The history sources the Logs page can offer: every hub-local
+         * log-destination with what it can read. A destination without
+         * `describeRead` is listed as not readable, never omitted — "ships only"
+         * is an answer, "not installed" is a different one.
+         */
+        sources: trpc_middleware_js_1.adminProcedure.output(zod_1.z.array(LogSourceSchema)).query(async () => {
+            const out = [];
+            for (const [addonId, dest] of hubLocalDestinations(capabilityRegistry)) {
+                const isDefault = addonId === log_history_js_1.DEFAULT_LOG_SOURCE;
+                if (dest.describeRead === undefined) {
+                    out.push({ addonId, isDefault, ...NOT_READABLE });
+                    continue;
+                }
+                try {
+                    const caps = await dest.describeRead();
+                    out.push({ addonId, isDefault, ...caps });
                 }
-                return entries;
-            })();
-            return filtered.map((e) => ({
-                timestamp: e.timestamp instanceof Date ? e.timestamp.toISOString() : String(e.timestamp),
-                level: e.level,
-                ...(e.scope !== undefined ? { scope: e.scope } : {}),
-                message: e.message,
-                // Tags carry mixed primitive types (numeric deviceId is common —
-                // see kernel/capability-registry.ts logging calls). The wire
-                // schema is Record<string,string>, so stringify here. Mirrors
-                // the same normalisation applied in `subscribe` below.
-                tags: e.tags
-                    ? Object.fromEntries(Object.entries(e.tags).map(([k, v]) => [
-                        k,
-                        v === undefined ? undefined : String(v),
-                    ]))
-                    : undefined,
-                ...(e.meta !== undefined ? { meta: e.meta } : {}),
-            }));
+                catch (error) {
+                    out.push({
+                        addonId,
+                        isDefault,
+                        ...NOT_READABLE,
+                        reason: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+            return out;
         }),
         /**
          * Drop matching entries from the in-memory ring buffer. Powers
@@ -149,13 +304,27 @@ function createLogsRouter(logging) {
             .input(zod_1.z.object({
             level: LogLevelSchema.optional(),
             tags: LogTagsSchema.optional(),
+            /** Same text filter as `query`, applied before the push (D898). */
+            text: zod_1.z.string().max(200).optional(),
         }))
             .subscription(({ input }) => {
+            const needle = input.text?.trim().toLowerCase() ?? '';
             return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
                 return logging.subscribe({
                     level: input.level,
                     tags: input.tags,
                 }, (entry) => {
+                    if (needle.length > 0 &&
+                        !(0, system_1.lineContainsText)({
+                            timestamp: 0,
+                            level: entry.level,
+                            message: entry.message,
+                            scope: entry.scope,
+                            tags: entry.tags,
+                            meta: entry.meta,
+                        }, needle)) {
+                        return;
+                    }
                     const stringifiedTags = entry.tags
                         ? Object.fromEntries(Object.entries(entry.tags).map(([k, v]) => [
                             k,
@@ -163,6 +332,7 @@ function createLogsRouter(logging) {
                         ]))
                         : undefined;
                     push({
+                        ...(entry.id !== undefined ? { id: entry.id } : {}),
                         timestamp: entry.timestamp instanceof Date
                             ? entry.timestamp.toISOString()
                             : String(entry.timestamp),

package/dist/api/core/preferences.router.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preferencesFromRegistry = preferencesFromRegistry;
+exports.preferencesOwnerOf = preferencesOwnerOf;
+exports.createPreferencesRouter = createPreferencesRouter;
+/**
+ * Account preferences — fixed core API (D894), not a capability.
+ *
+ *   get           the caller's rows (all, or the namespaces asked)
+ *   put           write one namespace; `baseRevision` turns it into a
+ *                 compare-and-set that answers `conflict` with the current row
+ *   delete        remove one namespace
+ *   changedSince  the cheap poll: only rows the client does not hold yet
+ *
+ * There is no `userId` input anywhere: every call acts on the PRINCIPAL's own
+ * rows, admin included — an admin cannot read another user's preferences
+ * through this router, and nothing else serves them. The principal must hold
+ * `preferences-self` (every person's session does; a unified token only when
+ * minted with it), so a share link, a legacy token, an account link and the
+ * hub's own mesh principal are refused.
+ *
+ * Sync is by polling `changedSince`: there is no per-user push channel to a
+ * user's sessions, and the event bus is fleet-wide telemetry (D8).
+ *
+ * The rows live in `local-auth` (it owns the users, and a user's delete wipes
+ * them), reached through the hub-internal half of `user-management`.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const user_error_js_1 = require("../trpc/user-error.js");
+/** The store behind the hub's in-process `user-management` provider. */
+function preferencesFromRegistry(registry) {
+    return () => registry === null
+        ? null
+        : ((0, system_1.getUserManagementInternal)(registry.getSingleton('user-management'))?.preferences ?? null);
+}
+/** The user whose rows this call may touch: the principal itself, or a refusal. */
+function preferencesOwnerOf(principal) {
+    if (!(0, types_1.scopesAllowOwnPreferences)(principal.scopes ?? [])) {
+        throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'preferences.forbidden', undefined, 'This credential cannot reach account preferences');
+    }
+    return principal.id;
+}
+function storeOf(deps) {
+    const store = deps.preferences();
+    if (store === null) {
+        throw (0, user_error_js_1.trpcUserError)('PRECONDITION_FAILED', 'preferences.unavailable', undefined, 'Account preferences are not available');
+    }
+    return store;
+}
+function limitRefusal(error) {
+    const reason = (0, system_1.preferencesLimitReasonOf)(error);
+    if (reason === 'value-too-large') {
+        throw (0, user_error_js_1.trpcUserError)('PAYLOAD_TOO_LARGE', 'preferences.value-too-large', undefined, 'This preference value is too large');
+    }
+    if (reason === 'too-many-namespaces') {
+        throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'preferences.too-many-namespaces', undefined, 'Too many preference namespaces for this account');
+    }
+    throw error;
+}
+function createPreferencesRouter(deps) {
+    return (0, trpc_middleware_js_1.trpcRouter)({
+        get: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesGetInputSchema)
+            .output(types_1.PreferencesGetOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return { rows: [...(await storeOf(deps).get(owner, input.namespaces))] };
+        }),
+        put: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesPutInputSchema)
+            .output(types_1.PreferencesPutOutputSchema)
+            .mutation(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            try {
+                return await storeOf(deps).put(owner, input);
+            }
+            catch (error) {
+                return limitRefusal(error);
+            }
+        }),
+        delete: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesDeleteInputSchema)
+            .output(types_1.PreferencesDeleteOutputSchema)
+            .mutation(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return { deleted: await storeOf(deps).delete(owner, input.namespace) };
+        }),
+        changedSince: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.PreferencesChangedSinceInputSchema)
+            .output(types_1.PreferencesChangedSinceOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const owner = preferencesOwnerOf(ctx.user);
+            return storeOf(deps).changedSince(owner, input.revisionByNamespace);
+        }),
+    });
+}

package/dist/api/oauth2/oauth2-routes.js

@@ -269,6 +269,35 @@ function answerRefusal(request, reply, status, body, reason, integration) {
     }
     return reply.status(status).send(body);
 }
+/**
+ * Who consents. ONLY a person's login session: a session-grade JWT (no
+ * `kind` — not a bridge, a challenge or a minted token) naming a user that
+ * still exists. Anything else this hub signed — a share link, a script's
+ * token, an account link — is refused, because a consent mints an account
+ * link with the integration's whole grant (security review 2026-10-21: a
+ * share link set as the cookie reached `consent=allow` and came back with a
+ * fleet-wide device grant for `userId: ''`).
+ */
+async function consentingUserOf(deps, cookie) {
+    let payload;
+    try {
+        payload = deps.verifyToken(cookie);
+    }
+    catch {
+        return { ok: false, reason: 'session-invalid' };
+    }
+    if (typeof payload !== 'object' || payload === null || !(0, session_cookie_js_1.isSessionGradeJwtPayload)(payload)) {
+        return { ok: false, reason: 'not-a-login-session' };
+    }
+    const userId = Reflect.get(payload, 'userId');
+    const username = Reflect.get(payload, 'username');
+    if (typeof userId !== 'string' || userId === '') {
+        return { ok: false, reason: 'not-a-login-session' };
+    }
+    if (!(await deps.isLiveUser(userId)))
+        return { ok: false, reason: 'user-gone' };
+    return { ok: true, user: { userId, username: typeof username === 'string' ? username : '' } };
+}
 /**
  * An authorize call turned away for want of a usable session.
  *
@@ -330,13 +359,11 @@ function registerOauth2Routes(fastify, deps) {
         if (!cookie) {
             return refuseUnauthenticated(request, reply, deps.logger, call, 'no-session-cookie');
         }
-        let tokenInfo;
-        try {
-            tokenInfo = deps.verifyToken(cookie);
-        }
-        catch {
-            return refuseUnauthenticated(request, reply, deps.logger, call, 'session-invalid');
+        const consenting = await consentingUserOf(deps, cookie);
+        if (!consenting.ok) {
+            return refuseUnauthenticated(request, reply, deps.logger, call, consenting.reason);
         }
+        const tokenInfo = consenting.user;
         const registry = deps.getRegistry();
         if (!registry) {
             return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
@@ -367,7 +394,7 @@ function registerOauth2Routes(fastify, deps) {
                 acceptLanguage: request.headers['accept-language'],
             }),
             displayName: descriptor.displayName,
-            username: tokenInfo.username ?? '',
+            username: tokenInfo.username,
             scopeSummary: summariseScopes(descriptor.requestedScopes),
             // Shown, not merely validated. A `redirect_uri` on a private host is
             // admitted by pattern rather than by registration, so the operator is
@@ -428,13 +455,11 @@ function registerOauth2Routes(fastify, deps) {
         if (!cookie) {
             return refuseUnauthenticated(request, reply, deps.logger, call, 'no-session-cookie');
         }
-        let tokenInfo;
-        try {
-            tokenInfo = deps.verifyToken(cookie);
-        }
-        catch {
-            return refuseUnauthenticated(request, reply, deps.logger, call, 'session-invalid');
+        const consenting = await consentingUserOf(deps, cookie);
+        if (!consenting.ok) {
+            return refuseUnauthenticated(request, reply, deps.logger, call, consenting.reason);
         }
+        const tokenInfo = consenting.user;
         const registry = deps.getRegistry();
         if (!registry) {
             return answerRefusal(request, reply, 503, { error: 'service_unavailable' }, 'unavailable');
@@ -478,8 +503,8 @@ function registerOauth2Routes(fastify, deps) {
         }
         const { code } = await userMgmt.oauthIssueCode({
             integrationId: v.integration,
-            userId: tokenInfo.userId ?? '',
-            username: tokenInfo.username ?? '',
+            userId: tokenInfo.userId,
+            username: tokenInfo.username,
             scopes: descriptor.requestedScopes,
             redirectUri: v.redirectUri,
             // Prefer the integration's own public origin (e.g. the operator-selected

package/dist/api/trpc/device-config-secret-redaction.js

@@ -10,7 +10,7 @@
  *
  * Those methods are declared `auth: 'protected'` (the default in
  * `capability-definition.ts`), which is NOT admin — it is "authenticated, and
- * scope-matched". Measured against the live hub: a `cst_*` scoped token
+ * scope-matched". Measured against the live hub: a scoped token
  * carrying nothing but `category:system` + `view` — a READ-ONLY grant, the one
  * the deploy runbook mints for CI — read `deviceManager.getDevice` and received
  * `config.password` verbatim, and `deviceManager.listAll` answered with a
@@ -31,7 +31,7 @@
  * write-only for admins too is a bigger, UI-side change; it is not needed to
  * close this hole and would regress the form.
  *
- * Share-view (`csv_*`) principals never reach this code — they are gated
+ * Share-view principals never reach this code — they are gated
  * earlier by the fail-closed allowlist in `share-view-access.ts`, which does
  * not expose `getDevice` at all and projects `listAll` down to seven presentation
  * fields. This module is the gate for the tier BETWEEN a share link and an admin.

package/dist/api/trpc/generated-cap-mounts.js

@@ -314,7 +314,6 @@ function mountAllCaps(services) {
                 ...first,
                 listProfileKinds: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfileKinds'),
                 listProfiles: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listProfiles'),
-                listModels: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModels'),
                 getDefaults: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getDefaults'),
                 getUsage: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'getUsage'),
                 listModelCatalog: (0, cap_mount_helpers_js_1.concatCollection)(providers, 'listModelCatalog'),

package/dist/api/trpc/generated-cap-routers.js

@@ -2959,6 +2959,16 @@ function createCapRouter_deviceHistory(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.queryNode(methodInput);
         }),
+        queryMany: trpc_middleware_js_1.adminProcedure
+            .input(types_50.deviceHistoryCapability.methods.queryMany.input.loose())
+            .output(types_50.deviceHistoryCapability.methods.queryMany.output)
+            .query(async ({ input, ctx }) => {
+            const parsedInput = ctx.req !== undefined ? (0, types_3.withoutCallerStamp)(input) : input;
+            const { nodeId, ...methodInput } = parsedInput;
+            const p = resolveProvider('device-history', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.queryMany(methodInput);
+        }),
         declareSeries: trpc_middleware_js_1.adminProcedure
             .input(types_50.deviceHistoryCapability.methods.declareSeries.input.loose())
             .output(types_50.deviceHistoryCapability.methods.declareSeries.output)
@@ -5300,10 +5310,10 @@ function createCapRouter_llm(getProvider, _createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.testProfile(input);
         }),
-        listModels: trpc_middleware_js_1.protectedProcedure
+        listModels: trpc_middleware_js_1.adminProcedure
             .input(types_69.llmCapability.methods.listModels.input.loose())
             .output(types_69.llmCapability.methods.listModels.output)
-            .query(async ({ input, ctx }) => {
+            .mutation(async ({ input, ctx }) => {
             const p = requireCapProvider('llm', () => getProvider(ctx));
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listModels(input);
@@ -5760,14 +5770,51 @@ function createCapRouter_logDestination(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.write(methodInput);
         }),
-        query: trpc_middleware_js_1.adminProcedure
-            .input(types_75.logDestinationCapability.methods.query.input.loose())
-            .output(types_75.logDestinationCapability.methods.query.output)
+        describeRead: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().optional(), addonId: zod_1.z.string().optional() }).optional())
+            .output(types_75.logDestinationCapability.methods.describeRead.output)
+            .query(async ({ input, ctx }) => {
+            const p = resolveProvider('log-destination', input?.nodeId, () => getProvider(ctx, input?.addonId), createRemoteProxy);
+            const fn = p.describeRead;
+            if (typeof fn !== 'function') {
+                throw new server_1.TRPCError({
+                    code: 'NOT_IMPLEMENTED',
+                    message: 'Capability "log-destination" provider does not implement "describeRead"',
+                });
+            }
+            return fn.call(p);
+        }),
+        read: trpc_middleware_js_1.adminProcedure
+            .input(types_75.logDestinationCapability.methods.read.input.loose())
+            .output(types_75.logDestinationCapability.methods.read.output)
             .query(async ({ input, ctx }) => {
             const { nodeId, addonId, ...methodInput } = input;
             const p = resolveProvider('log-destination', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            const fn = p.read;
+            if (typeof fn !== 'function') {
+                throw new server_1.TRPCError({
+                    code: 'NOT_IMPLEMENTED',
+                    message: 'Capability "log-destination" provider does not implement "read"',
+                });
+            }
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.query(methodInput);
+            return fn.call(p, methodInput);
+        }),
+        cancelRead: trpc_middleware_js_1.adminProcedure
+            .input(types_75.logDestinationCapability.methods.cancelRead.input.loose())
+            .output(types_75.logDestinationCapability.methods.cancelRead.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, addonId, ...methodInput } = input;
+            const p = resolveProvider('log-destination', nodeId, () => getProvider(ctx, addonId), createRemoteProxy);
+            const fn = p.cancelRead;
+            if (typeof fn !== 'function') {
+                throw new server_1.TRPCError({
+                    code: 'NOT_IMPLEMENTED',
+                    message: 'Capability "log-destination" provider does not implement "cancelRead"',
+                });
+            }
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return fn.call(p, methodInput);
         }),
     });
 }
@@ -12446,42 +12493,6 @@ function createCapRouter_userManagement(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.revokeApiKey(methodInput);
         }),
-        createScopedToken: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.createScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.createScopedToken.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.createScopedToken(methodInput);
-        }),
-        revokeScopedToken: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.revokeScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.revokeScopedToken.output)
-            .mutation(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.revokeScopedToken(methodInput);
-        }),
-        validateScopedToken: trpc_middleware_js_1.protectedProcedure
-            .input(types_142.userManagementCapability.methods.validateScopedToken.input.loose())
-            .output(types_142.userManagementCapability.methods.validateScopedToken.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.validateScopedToken(methodInput);
-        }),
-        listScopedTokens: trpc_middleware_js_1.adminProcedure
-            .input(types_142.userManagementCapability.methods.listScopedTokens.input.loose())
-            .output(types_142.userManagementCapability.methods.listScopedTokens.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('user-management', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.listScopedTokens(methodInput);
-        }),
         setupTotp: trpc_middleware_js_1.adminProcedure
             .input(types_142.userManagementCapability.methods.setupTotp.input.loose())
             .output(types_142.userManagementCapability.methods.setupTotp.output)