@camstack/server 1.2.605 → 1.2.607

package/dist/auth/scope-escalation.js

@@ -1,8 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scopesWithin = scopesWithin;
+exports.intersectScopes = intersectScopes;
 const types_1 = require("@camstack/types");
 const principal_visibility_js_1 = require("../api/trpc/principal-visibility.js");
+const scope_access_js_1 = require("../api/trpc/scope-access.js");
+/**
+ * The method a share link's talk-back opens first. Holding it on a device is
+ * what lets a caller hand talk-back on that device to whoever holds the link.
+ */
+const TALK_BACK_PATH = 'intercom.startSession';
+/** May the holder of `held` talk back on every device of `grant`? */
+function canTalkOn(held, deviceIds, lookup) {
+    return deviceIds.every((deviceId) => (0, scope_access_js_1.checkScopeAccess)(held, TALK_BACK_PATH, { deviceId }, lookup).ok);
+}
 function accessCovered(asked, held) {
     return asked.every((a) => held.includes(a));
 }
@@ -24,6 +35,8 @@ function describe(scope) {
         return `share-view:${scope.grant.kind}`;
     if (scope.type === 'addon-routes')
         return `addon-routes[${scope.access.join(',')}]`;
+    if (scope.type === 'preferences-self')
+        return 'preferences-self';
     if (scope.type === 'device')
         return `device[${scope.access.join(',')}]`;
     return `${scope.type}:${scope.target}[${scope.access.join(',')}]`;
@@ -41,14 +54,23 @@ function scopesWithin(requested, held, lookup) {
             if (viewable.length !== scope.grant.deviceIds.length) {
                 return { ok: false, reason: 'a share-view grant names a device you cannot view' };
             }
+            if (scope.grant.talk === true && !canTalkOn(heldCapability, scope.grant.deviceIds, lookup)) {
+                return { ok: false, reason: 'a share-view grant asks talk-back on a device you cannot talk on' };
+            }
             continue;
         }
-        if (scope.type === 'addon-routes') {
-            const covered = held.some((h) => h !== types_1.ADMIN_SCOPE && h.type === 'addon-routes' && accessCovered(scope.access, h.access));
+        if (scope.type === 'preferences-self') {
+            const covered = held.some((h) => h !== types_1.ADMIN_SCOPE && h.type === 'preferences-self');
             if (!covered)
                 return { ok: false, reason: `you do not hold ${describe(scope)}` };
             continue;
         }
+        if (scope.type === 'addon-routes') {
+            return {
+                ok: false,
+                reason: `only an admin can mint ${describe(scope)} — name the addon instead (addon:<id>)`,
+            };
+        }
         const key = grantKey(scope);
         const covered = heldCapability.some((h) => grantKey(h) === key && accessCovered(scope.access, h.access));
         if (!covered)
@@ -56,3 +78,56 @@ function scopesWithin(requested, held, lookup) {
     }
     return { ok: true };
 }
+/** A share-view grant cut down to what `held` may still see (and talk on). `null` = nothing left. */
+function narrowShareGrant(grant, held, lookup) {
+    const deviceIds = (0, principal_visibility_js_1.filterViewableDeviceIds)(held, grant.deviceIds, lookup);
+    if (deviceIds.length === 0)
+        return null;
+    const talk = grant.talk === true && canTalkOn(held, deviceIds, lookup);
+    return {
+        kind: grant.kind,
+        deviceIds,
+        ...(grant.talk !== undefined ? { talk } : {}),
+    };
+}
+/**
+ * `token`'s scopes cut down to what `held` — its non-admin subject's scopes
+ * NOW — still covers (security review 2026-10-21): an admin who narrows a user
+ * narrows every token that user minted, at the next verify, rather than
+ * leaving the token the reach the user no longer has.
+ *
+ *   - a capability grant keeps the flavours the subject still holds on the
+ *     SAME grant, and goes when none is left;
+ *   - a share-view grant keeps the devices the subject can still view (and
+ *     talk-back only where it can still talk);
+ *   - `'*'` and `addon-routes` are admin-only and never survive here.
+ *
+ * Never widens: every output scope is covered by an input scope.
+ */
+function intersectScopes(token, held, lookup) {
+    const out = [];
+    for (const scope of token) {
+        if (scope === types_1.ADMIN_SCOPE || scope.type === 'addon-routes')
+            continue;
+        if (scope.type === 'share-view') {
+            const grant = narrowShareGrant(scope.grant, held, lookup);
+            if (grant !== null)
+                out.push({ type: 'share-view', grant });
+            continue;
+        }
+        // The subject's OWN preferences (D894): every person holds it, so a live
+        // subject never loses it — except on a share link. A share-view grant cut
+        // to nothing must not leave a preferences token behind.
+        if (scope.type === 'preferences-self') {
+            if (!token.some((s) => s !== types_1.ADMIN_SCOPE && s.type === 'share-view'))
+                out.push(scope);
+            continue;
+        }
+        const key = grantKey(scope);
+        const heldAccess = new Set(held.filter((h) => grantKey(h) === key).flatMap((h) => [...h.access]));
+        const access = scope.access.filter((a) => heldAccess.has(a));
+        if (access.length > 0)
+            out.push({ ...scope, access });
+    }
+    return out;
+}

package/dist/boot/boot-config.js

@@ -43,6 +43,7 @@ exports.retiredSecretSources = retiredSecretSources;
 exports.loadBootstrapConfig = loadBootstrapConfig;
 exports.setupInfra = setupInfra;
 const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const types_1 = require("@camstack/types");
 const yaml = __importStar(require("js-yaml"));
@@ -241,7 +242,13 @@ async function setupInfra(_configPath, bootstrapConfig) {
         // The certificate comes only from the admin UI (D726): the generated
         // local CA → leaf (D227), or an operator upload served verbatim.
         const extraSans = [...core.readExtraSans(dataPath)];
-        const boot = await core.prepareBootTls(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
+        // A local root CREATED at this boot is named after the hub. The stored name (D861)
+        // lives in the settings database, which is not open yet, so this is the name the
+        // hub shows while unnamed: the hostname. An existing root is never renamed.
+        const boot = await core.prepareBootTls(dataPath, {
+            hubName: (0, types_1.shortHostname)(os.hostname()),
+            ...(extraSans.length > 0 ? { extraSans } : {}),
+        });
         if (boot.uploadedMissing) {
             console.warn(`[Phase2c] WARN the uploaded TLS certificate is missing from ${path.join(dataPath, 'tls')} — serving the generated one. Upload it again in Network → Local access.`);
         }

package/dist/core/addon/addon-registry.service.js

@@ -390,7 +390,6 @@ class AddonRegistryService {
     integrationRegistry = null;
     clusterNodeHistoryStore = null;
     clusterAgentRecords = null;
-    shareTokenService = null;
     credentialTokenService = null;
     // Device architecture — in-memory registry of live IDevice instances.
     // Persistence is owned by the `device-manager` capability addon.
@@ -1379,10 +1378,7 @@ class AddonRegistryService {
         const kind = records.kind(system_1.clusterNodeHistoryRecordKind);
         clusterStore.bindRecordsKind(() => kind);
     }
-    setShareTokenService(service) {
-        this.shareTokenService = service;
-    }
-    /** The unified token store (D892), bound to its `core-auth` records with the share links. */
+    /** The unified token store (D892), bound to its `core-auth` records. */
     setCredentialTokenService(service) {
         this.credentialTokenService = service;
     }
@@ -1399,24 +1395,22 @@ class AddonRegistryService {
         await clusterRecords.declare(system_1.clusterAgentRecordKinds);
         this.clusterAgentRecords = clusterRecords;
         this.bindClusterNodeHistoryRecordsKind();
-        const shareTokens = this.shareTokenService;
-        if (shareTokens !== null) {
+        const credentialTokens = this.credentialTokenService;
+        if (credentialTokens !== null) {
             const coreRecords = this.recordsForOwner('core-auth', this.secretsForOwner('core-auth'));
+            // Every core-auth kind is declared, `share-view-tokens` included: its
+            // pre-D895 rows stay on disk for the operator to drop, and nothing reads
+            // them.
             await coreRecords.declare(record_kinds_js_1.coreAuthRecordKinds);
-            const shareKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['share-view-tokens']);
-            shareTokens.bindShareTokensKind(() => shareKind);
-            const credentialTokens = this.credentialTokenService;
-            if (credentialTokens !== null) {
-                const tokenKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['credential-tokens']);
-                credentialTokens.bindKind(() => tokenKind);
-                // Dead rows (expired or revoked > 30 days) go at boot; the verifier
-                // already refuses them, so this is housekeeping, never a gate.
-                void credentialTokens.reap().catch((error) => {
-                    this.logger.warn('Token reap failed', {
-                        meta: { error: error instanceof Error ? error.message : String(error) },
-                    });
+            const tokenKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['credential-tokens']);
+            credentialTokens.bindKind(() => tokenKind);
+            // Dead rows (expired or revoked > 30 days) go at boot; the verifier
+            // already refuses them, so this is housekeeping, never a gate.
+            void credentialTokens.reap().catch((error) => {
+                this.logger.warn('Token reap failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
                 });
-            }
+            });
         }
     }
     /**

package/dist/core/auth/credential-token.service.js

@@ -160,7 +160,10 @@ class CredentialTokenService {
             return null;
         const lastUsedAt = row.data.lastUsedAt ?? null;
         if (lastUsedAt === null || at - lastUsedAt > TOUCH_EVERY_MS) {
-            void this.write(row.id, { ...row.data, lastUsedAt: at }).catch(() => { });
+            // ONLY `lastUsedAt`, merged into the row as it is when the write lands.
+            // Writing back the row read above (un-awaited) could land after a
+            // revoke / an expiry move and undo it (security review 2026-10-21).
+            void kind.patch(row.id, { lastUsedAt: at }).catch(() => { });
         }
         return {
             id: row.id,
@@ -199,11 +202,11 @@ class CredentialTokenService {
         if (row === null || (row.data.revokedAt !== null && row.data.revokedAt !== undefined)) {
             return false;
         }
-        await this.write(id, { ...row.data, revokedAt: this.now() });
+        await this.kind().patch(id, { revokedAt: this.now() });
         this.logger?.info('Token revoked', { meta: { tokenId: id, subjectId: row.data.subjectId } });
         return true;
     }
-    /** Move a live token's expiry (a share link's slide). `null` when not live. */
+    /** Move a live token's expiry (`null`: never). `null` when not live. */
     async setExpiry(id, expiresAt) {
         const row = await this.kind().get(id);
         if (row === null)
@@ -211,11 +214,10 @@ class CredentialTokenService {
         const at = this.now();
         const dead = (row.data.revokedAt !== null && row.data.revokedAt !== undefined) ||
             (row.data.expiresAt !== null && row.data.expiresAt <= at);
-        if (dead || expiresAt <= at)
+        if (dead || (expiresAt !== null && expiresAt <= at))
             return null;
-        const next = { ...row.data, expiresAt };
-        await this.write(id, next);
-        return toRecord(id, next);
+        await this.kind().patch(id, { expiresAt }, { expiresAt });
+        return toRecord(id, { ...row.data, expiresAt });
     }
     /** Revoke every live token of `subjectId` (the user was deleted). */
     async revokeAllFor(subjectId) {
@@ -239,12 +241,5 @@ class CredentialTokenService {
         }
         return deleted;
     }
-    async write(id, body) {
-        await this.kind().put({
-            id,
-            ...(body.expiresAt !== null ? { expiresAt: body.expiresAt } : {}),
-            data: body,
-        });
-    }
 }
 exports.CredentialTokenService = CredentialTokenService;

package/dist/core/auth/handoff-code.service.js

@@ -60,7 +60,7 @@ const types_1 = require("@camstack/types");
  *     prune-on-mint keeps the map from growing.
  */
 const crypto = __importStar(require("node:crypto"));
-/** Wire prefix — `chc_` = CamStack Handoff Code (cf. `cst_`/`csv_`). */
+/** Wire prefix — `chc_` = CamStack Handoff Code (not a credential: it is redeemed once for a session). */
 exports.HANDOFF_CODE_PREFIX = 'chc_';
 exports.HANDOFF_CODE_TTL_MS = 60_000;
 /** Hard bound on concurrently-pending codes (mint is auth-gated, so this

package/dist/core/auth/record-kinds.js

@@ -12,6 +12,11 @@ const ShareTokenScopeSchema = zod_1.z.object({
     talk: zod_1.z.boolean().optional(),
 });
 exports.SHARE_VIEW_TOKENS_LEGACY = 'share_view_tokens';
+/**
+ * The pre-D892 share-link rows. Nothing writes or reads them since D895 (a
+ * share link is a `credential-tokens` row); the kind stays declared so the
+ * storage layout is unchanged and the operator drops the rows by hand.
+ */
 const ShareViewTokenBodySchema = zod_1.z.object({
     userId: zod_1.z.string(),
     tokenHash: zod_1.z.string(),
@@ -41,14 +46,14 @@ exports.coreAuthRecordKinds = (0, types_1.defineRecordKinds)({
     'share-view-tokens': {
         schema: ShareViewTokenBodySchema,
         class: 'config',
-        writeTrigger: 'operator mints a share link; validate touches lastUsedAt',
+        writeTrigger: 'none since D895 — legacy rows kept on disk for the operator to drop',
         device: 'none',
         at: 'none',
         indexes: [
             { name: 'hash', fields: ['tokenHash'], unique: true },
             { name: 'user', fields: ['userId'] },
         ],
-        retention: { none: 'revoke only; expiry enforced at validate' },
+        retention: { none: 'operator drops the legacy rows by hand (D895)' },
         adoptsFrom: exports.SHARE_VIEW_TOKENS_LEGACY,
     },
     'credential-tokens': {

package/dist/core/logging/log-history.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PAGE_LIMIT = exports.RING_LOG_SOURCE = exports.DEFAULT_LOG_SOURCE = void 0;
+exports.readLogHistory = readLogHistory;
+/**
+ * `logs.query` — one page of history from the source the operator picked,
+ * merged with the hub's in-memory tail (D898).
+ *
+ * The tail is short (a couple of thousand lines) and exists for two things:
+ * the boot replay into destinations that register late, and the lines a file
+ * destination has accepted but not yet flushed. Everything older comes from
+ * the source. Both carry the same `id`, so the merge dedupes exactly.
+ */
+const system_1 = require("@camstack/system");
+/** The default history source: the hub's rotated files. */
+exports.DEFAULT_LOG_SOURCE = 'winston-logging';
+/** The in-memory tail, addressed as a source when no destination can read. */
+exports.RING_LOG_SOURCE = 'ring';
+exports.DEFAULT_PAGE_LIMIT = 200;
+function toReadable(entry) {
+    return {
+        timestamp: entryTime(entry),
+        level: entry.level,
+        message: entry.message,
+        scope: entry.scope,
+        tags: entry.tags,
+        meta: entry.meta,
+    };
+}
+function entryTime(entry) {
+    const ts = entry.timestamp;
+    if (ts instanceof Date)
+        return ts.getTime();
+    if (typeof ts === 'number')
+        return ts;
+    if (typeof ts === 'string')
+        return Date.parse(ts);
+    return 0;
+}
+function toReadEntry(entry) {
+    const tags = {};
+    for (const [key, value] of Object.entries(entry.tags ?? {})) {
+        if (typeof value === 'string' || typeof value === 'number')
+            tags[key] = value;
+    }
+    const level = entry.level;
+    return {
+        ...(entry.id !== undefined ? { id: entry.id } : {}),
+        timestamp: entryTime(entry),
+        level,
+        ...(entry.scope !== undefined ? { scope: entry.scope } : {}),
+        message: entry.message,
+        ...(Object.keys(tags).length > 0 ? { tags } : {}),
+        ...(entry.meta !== undefined ? { meta: entry.meta } : {}),
+    };
+}
+function tailMatching(tail, filter, limit) {
+    const out = [];
+    for (const entry of tail) {
+        if (!(0, system_1.lineMatches)(toReadable(entry), filter))
+            continue;
+        out.push(toReadEntry(entry));
+        if (out.length >= limit)
+            break;
+    }
+    return out;
+}
+function entryKey(entry) {
+    return (entry.id ?? `${String(entry.timestamp)}|${entry.level}|${entry.scope ?? ''}|${entry.message}`);
+}
+/**
+ * The first page (no cursor) merges the tail; a cursor page is the source's
+ * alone — the tail only ever holds the NEWEST lines, which the first page
+ * already showed.
+ */
+async function readLogHistory(args) {
+    const { query, tail, provider } = args;
+    const limit = query.limit ?? exports.DEFAULT_PAGE_LIMIT;
+    const filter = (0, system_1.compileLogFilter)(query);
+    const isFirstPage = query.before === undefined && query.after === undefined;
+    if (provider === null || provider.read === undefined) {
+        if (!isFirstPage) {
+            return {
+                entries: [],
+                nextBefore: null,
+                nextAfter: null,
+                scannedBytes: 0,
+                done: true,
+                source: exports.RING_LOG_SOURCE,
+            };
+        }
+        return {
+            entries: tailMatching(tail, filter, limit),
+            nextBefore: null,
+            nextAfter: null,
+            scannedBytes: 0,
+            done: true,
+            source: exports.RING_LOG_SOURCE,
+        };
+    }
+    const page = await provider.read({ ...query, limit });
+    if (!isFirstPage)
+        return { ...page, source: args.source };
+    // Tail lines newer than the oldest line the source returned (or all of them
+    // when the source returned nothing yet): the unflushed lines, and the levels
+    // the file destination does not keep.
+    const oldest = page.entries.at(-1)?.timestamp ?? Number.NEGATIVE_INFINITY;
+    const byKey = new Map();
+    for (const entry of page.entries)
+        byKey.set(entryKey(entry), entry);
+    for (const entry of tailMatching(tail, filter, limit)) {
+        if (entry.timestamp < oldest)
+            continue;
+        if (!byKey.has(entryKey(entry)))
+            byKey.set(entryKey(entry), entry);
+    }
+    const entries = [...byKey.values()].toSorted((a, b) => b.timestamp - a.timestamp);
+    return { ...page, entries, source: args.source };
+}

package/dist/core/logging/logging.service.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoggingService = void 0;
+exports.LoggingService = exports.HUB_LOG_TAIL_ENTRIES = exports.HISTORY_DESTINATION_ADDON_ID = void 0;
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 /** Baseline tags every hub-local logger gets, so console output never
@@ -13,6 +13,19 @@ const types_1 = require("@camstack/types");
  *  forked workers via `$hub.log` carry their own `tags.pid` which
  *  wins over this baseline (right-biased merge in `writeFromWorker`). */
 const HUB_BASELINE_TAGS = { agentId: 'hub', nodeId: 'hub', pid: process.pid };
+/**
+ * The destination whose files ARE the hub's log history (D898). Once it has
+ * registered — and received the boot replay — the in-memory buffer only has
+ * to hold a short tail: the instant first page and the lines the file stream
+ * has accepted but not yet flushed.
+ */
+exports.HISTORY_DESTINATION_ADDON_ID = 'winston-logging';
+/**
+ * The tail, in entries, across every addon. ~2k lines is tens of seconds of a
+ * busy hub — enough for the first page and the unflushed window, ~0.6 MB.
+ * `eventBus.logTailSize` overrides it.
+ */
+exports.HUB_LOG_TAIL_ENTRIES = 2000;
 class LoggingService extends system_1.LogManager {
     /**
      * Device-name cache consulted by the formatter when a log line
@@ -21,6 +34,9 @@ class LoggingService extends system_1.LogManager {
      * updated / removed events. Missing entries fall back to `#<id>`.
      */
     deviceNames = new Map();
+    /** Tail size applied once the history destination registers. */
+    tailEntries;
+    shrunkToTail = false;
     constructor(configService) {
         // The log buffer is now partitioned per addonId (see PartitionedLogBuffer):
         // this value caps EACH addon's bucket, not the total. A chatty addon evicts
@@ -39,12 +55,33 @@ class LoggingService extends system_1.LogManager {
         // Only entries at or below this level are ever discarded to meet the total.
         const pruneLevel = configService.get('eventBus.logBufferPruneLevel') ?? 'debug';
         super(perAddonCapacity, { maxTotalEntries, pruneLevel });
+        this.tailEntries = configService.get('eventBus.logTailSize') ?? exports.HUB_LOG_TAIL_ENTRIES;
         // Enriches every emitted LogEntry with `tags.deviceName` before
         // destinations / subscribers see it — works across bundled copies
         // of `@camstack/system` (addon packages) because the mutation
         // happens upstream of their formatters.
         this.setDeviceNameLookup((id) => this.deviceNames.get(id) ?? null);
     }
+    /**
+     * Adds the destination, and — the first time the HISTORY destination
+     * arrives — shrinks the buffer to the tail AFTER its boot replay, so the
+     * files start with the first boot line however long the boot was.
+     *
+     * The tail prunes `info` and below first (the lines are on disk); a live
+     * addon's `warn`/`error` still outlive them, and whole idle buckets go
+     * last, exactly as the buffer's own policy says.
+     */
+    addDestination(dest, opts = {}) {
+        super.addDestination(dest, opts);
+        if (!this.shrunkToTail && opts.addonId === exports.HISTORY_DESTINATION_ADDON_ID) {
+            this.shrunkToTail = true;
+            this.reconfigureBuffer({
+                perAddonCapacity: this.tailEntries,
+                maxTotalEntries: this.tailEntries,
+                pruneLevel: 'info',
+            });
+        }
+    }
     /** Bulk-refresh from device-manager snapshot. Replaces every entry. */
     setDeviceNames(entries) {
         this.deviceNames.clear();

package/dist/main.js

@@ -71,6 +71,8 @@ const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
 const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
+const embed_auth_route_js_1 = require("./auth/embed-auth-route.js");
+const live_user_js_1 = require("./auth/live-user.js");
 const server_upload_1 = require("./api/server-upload");
 const server_upload_propagate_1 = require("./api/server-upload-propagate");
 const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
@@ -122,7 +124,6 @@ const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const auth_service_1 = require("./core/auth/auth.service");
 const handoff_code_service_1 = require("./core/auth/handoff-code.service");
 const credential_token_service_js_1 = require("./core/auth/credential-token.service.js");
-const share_token_service_1 = require("./core/auth/share-token.service");
 const config_service_1 = require("./core/config/config.service");
 const event_bus_service_1 = require("./core/events/event-bus.service");
 const feature_service_1 = require("./core/feature/feature.service");
@@ -438,8 +439,8 @@ async function bootstrap() {
     const sessionLifetimes = () => (0, session_lifetimes_js_1.readSessionLifetimes)((key) => config.get(key));
     // Register addon upload route (multipart — must be registered before tRPC).
     // We pass AddonRegistryService so the handler can resolve the
-    // `user-management` cap singleton at request time (the only working
-    // path to validate `cst_*` scoped tokens — see addon-upload.ts).
+    // `user-management` cap singleton at request time (the credential
+    // verifier reads users and admin bits there — see upload-auth.ts).
     try {
         const uploadAuthService = app.get(auth_service_1.AuthService);
         const uploadAddonBridge = app.get(addon_bridge_service_1.AddonBridgeService);
@@ -473,8 +474,8 @@ async function bootstrap() {
                 .getSingleton('local-network')),
         });
         console.log('[bootstrap] Server upload propagate route registered at POST /api/server-upload/propagate');
-        // Companion endpoint: /api/auth/whoami — validates JWT or cst_*
-        // scoped tokens, returns the resolved identity + scope summary.
+        // Companion endpoint: /api/auth/whoami — verifies any hub credential
+        // through the one verifier, returns the resolved identity + scopes.
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
@@ -596,17 +597,13 @@ async function bootstrap() {
     // and the distributed metrics-provider capability — no manual wiring needed.
     let trpcRegistered = false;
     let appRouter = null;
-    // Share-view (`csv_*`) tokens — hub-resident mint/verify/revoke over the
-    // settings backend (lazy getter: the backend lands after the sqlite-storage
-    // builtin registers; the service resolves it per call).
-    const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
-    addonRegistry.setShareTokenService(shareTokenService);
-    // The unified token store (D892): rows in the `core-auth` records, bound
-    // with the share links; the JWT is signed with the session signing key.
+    // The one token store (D892, D895): rows in the `core-auth` records — admin
+    // tokens, scoped tokens and share links alike; the JWT is signed with the
+    // session signing key.
     const credentialTokenService = new credential_token_service_js_1.CredentialTokenService(app.get(auth_service_1.AuthService), loggingService.createLogger('tokens'));
     addonRegistry.setCredentialTokenService(credentialTokenService);
     // Every surface that verifies a bearer reads the same stores (D892).
-    (0, trpc_context_1.bindHubCredentialStores)({ shareTokens: shareTokenService, tokenRows: credentialTokenService });
+    (0, trpc_context_1.bindHubCredentialStores)({ tokenRows: credentialTokenService });
     // One-time native-app login handoff codes (in-memory, 60s TTL, single-use) —
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.
@@ -638,7 +635,6 @@ async function bootstrap() {
     });
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
-        shareTokenService,
         credentialTokenService,
         handoffCodeService,
         externalLinkIntents,
@@ -808,7 +804,7 @@ async function bootstrap() {
             trpcOptions: {
                 router: appRouter,
                 createContext: async ({ req }) => {
-                    const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
+                    const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, 
                     // A bearer refused for NOT being an API credential never reaches a
                     // procedure, so `onError` below never sees it — the refusal would
                     // be silent without this. Same reason the addon gate logs (D103).
@@ -1047,37 +1043,11 @@ async function bootstrap() {
             reply.setCookie(c.name, c.value, c.options);
             return reply.send({ ok: true });
         });
-        // GET /api/embed-auth?next=<embed-path> — establish the browser session
-        // cookie from a Bearer token, then 302 to the embed. A native WebView can
-        // pass `Authorization` only on the INITIAL navigation, not on the page's
-        // asset sub-requests; the data-plane `authenticated` gate reads the cookie,
-        // so we mint it here (mirroring POST /api/auth/session) and bounce to the
-        // embed — page + assets then authenticate via the cookie. `next` is
-        // restricted to the stream-broker embed prefix (no open redirect).
-        fastify.get('/api/embed-auth', async (request, reply) => {
-            const authHeader = request.headers.authorization;
-            const token = authHeader?.startsWith('Bearer ')
-                ? authHeader.slice('Bearer '.length)
-                : undefined;
-            if (!token)
-                return reply.status(401).send({ error: 'Bearer token required' });
-            const next = request.query?.next ?? '';
-            if (!(0, session_cookie_js_1.isEmbedRedirectTarget)(next))
-                return reply.status(400).send({ error: 'invalid next' });
-            let ttlSec;
-            try {
-                const payload = authService.verifyToken(token);
-                const expSec = typeof payload.exp === 'number' ? payload.exp : 0;
-                ttlSec = Math.max(0, expSec - Math.floor(Date.now() / 1000));
-            }
-            catch {
-                return reply.status(401).send({ error: 'invalid token' });
-            }
-            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
-                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
-            });
-            reply.setCookie(c.name, c.value, c.options);
-            return reply.redirect(next);
+        // GET /api/embed-auth — a person's login session becomes the embed's
+        // cookie (`auth/embed-auth-route.ts`); nothing else this hub signed does.
+        (0, embed_auth_route_js_1.registerEmbedAuthRoute)(fastify, {
+            verifyToken: (token) => authService.verifyToken(token),
+            isLiveUser: (0, live_user_js_1.liveUserCheck)(capabilityRegistry),
         });
         // Every refusal on the addon gate is a request an operator will be asking
         // about ("why did Home Assistant stop actuating?"). Its own scope so the
@@ -1086,7 +1056,6 @@ async function bootstrap() {
         const addonVerifier = (0, trpc_context_1.hubCredentialVerifier)({
             authService,
             addonRegistry,
-            shareTokens: shareTokenService,
             logger: addonGateLogger,
         });
         // Addon HTTP API route catch-all: /addon/:addonId/*
@@ -1255,6 +1224,7 @@ async function bootstrap() {
         (0, oauth2_routes_js_1.registerOauth2Routes)(fastify, {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
+            isLiveUser: (0, live_user_js_1.liveUserCheck)(capabilityRegistry),
             // The hub's public endpoint from the `local-network` cap (the flagged
             // address, else tunnel, then mesh, then LAN). `localhost` only when the
             // palette names nothing — the dev case, where it is the truth.
@@ -1341,7 +1311,7 @@ async function bootstrap() {
             // A termination here closes with 1006; the guard's close line names it.
             keepAlive: { enabled: true, pingMs: 30_000, pongWaitMs: 10_000 },
             createContext: async (opts) => {
-                const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
+                const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
                 // The connection's identity, derived ONCE and reused for every
                 // operation on this socket. Frames that arrived while the bearer was
                 // still resolving are held by the session and released here.