@camstack/system 1.2.455 → 1.2.456

package/dist/{agent-https-CLWrOO3o.mjs → agent-https-fm4AR8XL.mjs}

@@ -1,6 +1,6 @@
-import { Li as defineRecordKinds } from "./dist-BpSENkRJ.mjs";
+import { Ui as defineRecordKinds } from "./dist-BSF_C8W2.mjs";
 import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
-import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-DOlYt1t1.mjs";
+import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-i5oD_gLB.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -1200,6 +1200,31 @@ function collectCertIdentity(options) {
 cryptoProvider.set(webcrypto);
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 var CA_COMMON_NAME = "CamStack Local CA";
+/** Between {@link CA_COMMON_NAME} and the hub's name in a new root's subject. */
+var CA_HUB_NAME_SEPARATOR = " — ";
+/** X.520 `ub-common-name`: the most characters a CN may carry. */
+var X509_COMMON_NAME_MAX_LENGTH = 64;
+/** C0 controls, DEL and the C1 range. */
+function isControlCodePoint(code) {
+	return code <= 31 || code >= 127 && code <= 159;
+}
+/**
+* The subject CN of a NEW local root: `CamStack Local CA — <hub name>`, so two hubs'
+* roots installed on one phone can be told apart in its settings. The name is
+* sanitised for a CN (controls removed, whitespace collapsed) and cut so the whole
+* CN stays within 64 characters. An absent or unusable name, or one that is just
+* the product's own name, yields the plain {@link CA_COMMON_NAME}.
+*
+* Only a root being CREATED is named: an existing root is never reissued to rename
+* it, since every device that trusts it would have to install it again.
+*/
+function localCaCommonName(hubName) {
+	if (hubName === void 0) return CA_COMMON_NAME;
+	const cleaned = [...hubName].map((char) => isControlCodePoint(char.codePointAt(0) ?? 0) ? " " : char).join("").replace(/\s+/gu, " ").trim();
+	if (cleaned === "" || cleaned.toLowerCase() === "camstack") return CA_COMMON_NAME;
+	const room = X509_COMMON_NAME_MAX_LENGTH - 17 - 3;
+	return `${CA_COMMON_NAME}${CA_HUB_NAME_SEPARATOR}${[...cleaned].slice(0, room).join("").trimEnd()}`;
+}
 var MS_PER_DAY = 864e5;
 /**
 * Expiry of a served leaf. Browsers cap the TOTAL span (notBefore to notAfter) at 397 days, so
@@ -1261,8 +1286,10 @@ function subjectAltNames(identity) {
 * It carries a CRITICAL `nameConstraints` extension (D873): private address
 * ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
 * names at creation). A leaked key therefore cannot vouch for a public site.
+*
+* `commonName` is the subject CN, from {@link localCaCommonName}.
 */
-async function generateCa(now, hostnames = []) {
+async function generateCa(now, hostnames = [], commonName = CA_COMMON_NAME) {
 	const keys = await webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
 	const extensions = [
 		new BasicConstraintsExtension(true, 0, true),
@@ -1272,7 +1299,7 @@ async function generateCa(now, hostnames = []) {
 	];
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
-		name: `CN=${CA_COMMON_NAME}`,
+		name: [{ CN: [commonName] }],
 		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
@@ -1627,4 +1654,4 @@ function pemDigest(pem) {
 	return createHash("sha256").update(pem).digest("hex").slice(0, 16);
 }
 //#endregion
-export { generateMeshKeyPair as $, isConstrainedCa as A, systemConfigRecordKinds as B, MAX_LEAF_VALIDITY_DAYS as C, PERMITTED_DNS_SUFFIXES as D, reasonRequiresNewCa as E, AGENT_HTTPS_NAMES_COLLECTION as F, describeMeshLeaf as G, MESH_NODE_CERTIFICATES_COLUMNS as H, AGENT_HTTPS_NAMES_COLUMNS as I, caFingerprint as J, getProcessMeshCertificateRegistry as K, AgentHttpsNames as L, permitsIdentity as M, permitsName as N, PERMITTED_IP_RANGES as O, readNameConstraints as P, generateMeshCa as Q, getProcessAgentHttpsNames as R, LEAF_RENEWAL_WINDOW_DAYS as S, evaluateExistingCert as T, MeshCertificateRegistry as U, MESH_NODE_CERTIFICATES_COLLECTION as V, RENEWAL_ABANDONED as W, createMeshCsrPem as X, caFingerprintCompact as Y, exportMeshPrivateKeyPem as Z, issueLeaf as _, collectAgentNames as a, systemHostFacts as b, installAgentHttps as c, issueAgentHttpsLeaf as d, isValidAgentNodeId as et, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, subjectCn as it, isLocalOnlyHostname as j, buildNameConstraintSet as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, issueMeshLeafFromCsr as nt, createAgentHttpsRequest as o, pemDigest as p, setProcessMeshCertificateRegistry as q, agentHttpsPaths as r, loadMeshCa as rt, describeHttpsLeaf as s, AgentHttpsInstallError as t, issueMeshLeafForNode as tt, isPrivateAddress as u, loadCa as v, SERVER_AUTH_OID as w, CA_VALIDITY_DAYS as x, collectCertIdentity as y, setProcessAgentHttpsNames as z };
+export { generateMeshCa as $, buildNameConstraintSet as A, setProcessAgentHttpsNames as B, LEAF_RENEWAL_WINDOW_DAYS as C, reasonRequiresNewCa as D, evaluateExistingCert as E, readNameConstraints as F, RENEWAL_ABANDONED as G, MESH_NODE_CERTIFICATES_COLLECTION as H, AGENT_HTTPS_NAMES_COLLECTION as I, setProcessMeshCertificateRegistry as J, describeMeshLeaf as K, AGENT_HTTPS_NAMES_COLUMNS as L, isLocalOnlyHostname as M, permitsIdentity as N, PERMITTED_DNS_SUFFIXES as O, permitsName as P, exportMeshPrivateKeyPem as Q, AgentHttpsNames as R, CA_VALIDITY_DAYS as S, SERVER_AUTH_OID as T, MESH_NODE_CERTIFICATES_COLUMNS as U, systemConfigRecordKinds as V, MeshCertificateRegistry as W, caFingerprintCompact as X, caFingerprint as Y, createMeshCsrPem as Z, issueLeaf as _, collectAgentNames as a, subjectCn as at, collectCertIdentity as b, installAgentHttps as c, issueAgentHttpsLeaf as d, generateMeshKeyPair as et, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, loadMeshCa as it, isConstrainedCa as j, PERMITTED_IP_RANGES as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, issueMeshLeafForNode as nt, createAgentHttpsRequest as o, pemDigest as p, getProcessMeshCertificateRegistry as q, agentHttpsPaths as r, issueMeshLeafFromCsr as rt, describeHttpsLeaf as s, AgentHttpsInstallError as t, isValidAgentNodeId as tt, isPrivateAddress as u, loadCa as v, MAX_LEAF_VALIDITY_DAYS as w, systemHostFacts as x, localCaCommonName as y, getProcessAgentHttpsNames as z };

package/dist/{agent-https-CCvlRQKV.js → agent-https-yjxdfJDA.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-BpqA2CT0.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_constants = require("./constants-DruwCkfp.js");
+const require_constants = require("./constants-CavyKfHZ.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -1202,6 +1202,31 @@ function collectCertIdentity(options) {
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 var CA_COMMON_NAME = "CamStack Local CA";
+/** Between {@link CA_COMMON_NAME} and the hub's name in a new root's subject. */
+var CA_HUB_NAME_SEPARATOR = " — ";
+/** X.520 `ub-common-name`: the most characters a CN may carry. */
+var X509_COMMON_NAME_MAX_LENGTH = 64;
+/** C0 controls, DEL and the C1 range. */
+function isControlCodePoint(code) {
+	return code <= 31 || code >= 127 && code <= 159;
+}
+/**
+* The subject CN of a NEW local root: `CamStack Local CA — <hub name>`, so two hubs'
+* roots installed on one phone can be told apart in its settings. The name is
+* sanitised for a CN (controls removed, whitespace collapsed) and cut so the whole
+* CN stays within 64 characters. An absent or unusable name, or one that is just
+* the product's own name, yields the plain {@link CA_COMMON_NAME}.
+*
+* Only a root being CREATED is named: an existing root is never reissued to rename
+* it, since every device that trusts it would have to install it again.
+*/
+function localCaCommonName(hubName) {
+	if (hubName === void 0) return CA_COMMON_NAME;
+	const cleaned = [...hubName].map((char) => isControlCodePoint(char.codePointAt(0) ?? 0) ? " " : char).join("").replace(/\s+/gu, " ").trim();
+	if (cleaned === "" || cleaned.toLowerCase() === "camstack") return CA_COMMON_NAME;
+	const room = X509_COMMON_NAME_MAX_LENGTH - 17 - 3;
+	return `${CA_COMMON_NAME}${CA_HUB_NAME_SEPARATOR}${[...cleaned].slice(0, room).join("").trimEnd()}`;
+}
 var MS_PER_DAY = 864e5;
 /**
 * Expiry of a served leaf. Browsers cap the TOTAL span (notBefore to notAfter) at 397 days, so
@@ -1263,8 +1288,10 @@ function subjectAltNames(identity) {
 * It carries a CRITICAL `nameConstraints` extension (D873): private address
 * ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
 * names at creation). A leaked key therefore cannot vouch for a public site.
+*
+* `commonName` is the subject CN, from {@link localCaCommonName}.
 */
-async function generateCa(now, hostnames = []) {
+async function generateCa(now, hostnames = [], commonName = CA_COMMON_NAME) {
 	const keys = await node_crypto.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
 	const extensions = [
 		new require_x509_es.BasicConstraintsExtension(true, 0, true),
@@ -1274,7 +1301,7 @@ async function generateCa(now, hostnames = []) {
 	];
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
-		name: `CN=${CA_COMMON_NAME}`,
+		name: [{ CN: [commonName] }],
 		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
@@ -1911,6 +1938,12 @@ Object.defineProperty(exports, "loadMeshCa", {
 		return loadMeshCa;
 	}
 });
+Object.defineProperty(exports, "localCaCommonName", {
+	enumerable: true,
+	get: function() {
+		return localCaCommonName;
+	}
+});
 Object.defineProperty(exports, "pemDigest", {
 	enumerable: true,
 	get: function() {

package/dist/auth/auth-manager.d.ts

@@ -59,7 +59,16 @@ export declare class AuthManager {
 	* before signing, so nothing outside the schema is ever signed.
 	*/
 	signCredentialToken(claims: CredentialTokenClaims): string;
+	/**
+	* Verify a session-family JWT: a login session, an account link, a bridge or
+	* challenge token. A MINTED token is refused here even though it carries a
+	* valid signature (D895): every surface that calls this wants a person's
+	* session, and a share link or a script's token must never pass for one.
+	* Minted tokens verify only through {@link verifyCredentialToken}.
+	*/
 	verifyToken(token: string): TokenPayload;
+	/** Verify a minted token (`auth.mintToken`): its signature AND its audience. Throws when invalid. */
+	verifyCredentialToken(token: string): CredentialTokenClaims;
 	hashPassword(password: string): Promise<string>;
 	comparePassword(password: string, hash: string): Promise<boolean>;
 	/**

package/dist/auth/legacy-token-tables.d.ts

@@ -0,0 +1,16 @@
+/**
+* The pre-D892 admin-token table — its LAYOUT only (D895).
+*
+* Nothing mints, reads or validates an admin token of the old format any more:
+* an admin token is a `core-auth` `credential-tokens` row whose scopes hold
+* `'*'`. The table stays declared so the storage layout is unchanged; its rows
+* stay on disk until the operator drops them by hand.
+*/
+import type { CollectionColumn } from "@camstack/types";
+/**
+* @durable class=config owner=local-auth
+*   write="none since D895 — the pre-D892 rows are kept on disk, read by nothing"
+*   retention="the operator drops the table by hand"
+*/
+export declare const ADMIN_TOKENS_COLLECTION = "admin_tokens";
+export declare const ADMIN_TOKENS_COLUMNS: readonly CollectionColumn[];

package/dist/auth/user-management-internal.d.ts

@@ -13,10 +13,10 @@
 * construction: a remote proxy of the provider simply has no such key, and
 * {@link getUserManagementInternal} answers `null` (the caller fails closed).
 */
-import type { AdminTokenRecord } from "./admin-token-manager.js";
 import type { AuthAuditEvent, AuthAuditRecord } from "./auth-audit-log.js";
 import type { DeviceCredentialManager } from "./device-credential-manager.js";
 import type { LoginSessionManager } from "./login-session-manager.js";
+import type { UserPreferencesStore } from "../builtins/local-auth/user-preferences-store.js";
 /** Process-global, so every bundled copy of this module agrees on the key. */
 export declare const USER_MANAGEMENT_INTERNAL: unique symbol;
 export interface LinkExternalIdentityInput {
@@ -56,13 +56,6 @@ export interface UserManagementInternal {
 	readonly sessions: LoginSessionsInternal;
 	/** Change a password and end the user's other sessions (and pre-session tokens). */
 	setPassword(input: SetPasswordInput): Promise<void>;
-	/** Admin tokens (`csa_`) — the hub router gates creation (admin + re-auth). */
-	readonly adminTokens: AdminTokensInternal;
-	/**
-	* Scoped tokens (`cst_`) — hub bulk revoke (`auth.revokeCredentials`).
-	* `revoke` deletes the row; `false` when the id was already gone.
-	*/
-	readonly scopedTokens: ScopedTokensInternal;
 	/**
 	* OAuth account-link sessions — hub bulk revoke. Active → mark revoked;
 	* already revoked → delete the row (so "Remove revoked" clears the list).
@@ -72,28 +65,16 @@ export interface UserManagementInternal {
 	readonly audit: AuthAuditInternal;
 	/** Device certificates: enrollment legs, challenge, proof, renewal, liveness check. */
 	readonly deviceCredentials: DeviceCredentialsInternal;
-}
-export interface ScopedTokensInternal {
-	revoke(id: string): Promise<boolean>;
-}
-export interface OauthSessionsInternal {
-	revoke(id: string): Promise<boolean>;
-}
-export interface AdminTokensInternal {
-	create(input: {
-		readonly createdBy: string;
-		readonly name: string;
-		readonly expiresAt: number;
-	}): Promise<{
-		readonly token: string;
-		readonly record: AdminTokenRecord;
-	}>;
 	/**
-	* The live token behind `token` — `null` when unknown, revoked, expired, or
-	* when its creator no longer exists or is no longer an admin.
+	* Per-user account preferences (D894). Every method takes the OWNER's id
+	* first; the hub's `preferences.*` router stamps it from the principal.
+	* Absent on a provider that keeps none.
 	*/
-	validate(token: string): Promise<AdminTokenRecord | null>;
-	list(): Promise<readonly AdminTokenRecord[]>;
+	readonly preferences?: UserPreferencesInternal;
+}
+/** The account-preferences store, as the hub router uses it. */
+export type UserPreferencesInternal = Pick<UserPreferencesStore, "get" | "put" | "delete" | "changedSince">;
+export interface OauthSessionsInternal {
 	revoke(id: string): Promise<boolean>;
 }
 export interface AuthAuditInternal {

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Kr as errMsg, dt as addonPagesCapability, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Qr as errMsg, Ta as EventCategory, gt as addonPagesCapability } from "../../dist-BSF_C8W2.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Kr as errMsg, pt as addonWidgetsCapability, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Qr as errMsg, Ta as EventCategory, vt as addonWidgetsCapability } from "../../dist-BSF_C8W2.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-DrmTtz7F.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-n-IZRklX.js");
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**
 * When does an alert open a new EPISODE, and which edge of it is announced?

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,6 +1,6 @@
-import { Kr as errMsg, Li as defineRecordKinds, Ni as createEvent, gt as alertsCapability, ht as alertEpisodePayload, i as AlertSchema, mn as isAlertEpisodeSeverity, mt as alertEpisodeId, pn as isAlertEpisodeOpen, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Qr as errMsg, Ta as EventCategory, Ui as defineRecordKinds, bt as alertEpisodePayload, i as AlertSchema, vn as isAlertEpisodeOpen, xt as alertsCapability, yn as isAlertEpisodeSeverity, yt as alertEpisodeId, zi as createEvent } from "../../dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-JQUqgQgq.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-B4yfsf2n.mjs";
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**
 * When does an alert open a new EPISODE, and which edge of it is announced?

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { F as FIRST_LEVEL_MACRO_CLASSES, Jn as ptzAutotrackCapability, Kr as errMsg, Wi as isEvent, bt as bareAddonId, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, I as FIRST_LEVEL_MACRO_CLASSES, Qr as errMsg, Ta as EventCategory, Tt as bareAddonId, Xi as isEvent, er as ptzAutotrackCapability } from "../../dist-BSF_C8W2.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_restore_archive = require("../../restore-archive-4OP0EYg6.js");
+const require_restore_archive = require("../../restore-archive-B4QG7XmX.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,6 +1,6 @@
-import { Pn as mayWriteToLocation, Qi as nodePin, ma as toNodeId, qr as BaseAddon, ya as EventCategory, yr as storageOccupancyCapability, yt as backupCapability } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Bn as mayWriteToLocation, Ta as EventCategory, Tr as storageOccupancyCapability, ba as toNodeId, ia as nodePin, wt as backupCapability } from "../../dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { _ as parseBackupSecretKey, a as BackupSnapshotRefusedError, c as backupOrchestratorRecordKinds, d as BackupEncryptionKeyStore, g as generateBackupKeyPair, h as ENCRYPTED_BACKUP_SUFFIX, i as BackupCancelledError, l as backupRecordStoresOf, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, u as BackupSeedMarkerStore } from "../../restore-archive-YFSJRtKy.mjs";
+import { _ as parseBackupSecretKey, a as BackupSnapshotRefusedError, c as backupOrchestratorRecordKinds, d as BackupEncryptionKeyStore, g as generateBackupKeyPair, h as ENCRYPTED_BACKUP_SUFFIX, i as BackupCancelledError, l as backupRecordStoresOf, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, u as BackupSeedMarkerStore } from "../../restore-archive-BGUM4FKf.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as calendarsCapability, Li as defineRecordKinds, g as CalendarPreferencesSchema, qr as BaseAddon } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Ui as defineRecordKinds, _ as CalendarPreferencesSchema, jt as calendarsCapability } from "../../dist-BSF_C8W2.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Dt as cameraGridLayoutCapability, Fn as memoizePinnedFfmpeg, Gr as DeviceType, Hi as hydrateSchema, J as MOTION_CLOSE_AFTER_MS, Kr as errMsg, M as DeclaredDevices, Mr as buildFfmpegArgs, Ni as createEvent, Rn as motionCapability, T as DERIVED_CAMERA_SILENCED_CAP_NAMES, Ur as DeviceFeature, Vt as declarationOwnerNodeId, mr as snapshotCapability, o as BaseDevice, qr as BaseAddon, xr as streamCatalogCapability, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Dr as streamCatalogCapability, E as DERIVED_CAMERA_SILENCED_CAP_NAMES, Ji as hydrateSchema, Kt as declarationOwnerNodeId, Mt as cameraGridLayoutCapability, N as DeclaredDevices, Qr as errMsg, Rr as buildFfmpegArgs, Ta as EventCategory, Vn as memoizePinnedFfmpeg, Wn as motionCapability, Y as MOTION_CLOSE_AFTER_MS, Yr as DeviceFeature, Zr as DeviceType, br as snapshotCapability, o as BaseDevice, zi as createEvent } from "../../dist-BSF_C8W2.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
-const require_composition_sources = require("../../composition-sources-BxUkLNSo.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
+const require_composition_sources = require("../../composition-sources-gB4coDJR.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { At as composerCapability, Br as createStatefulExpressionMemory, Fr as composedDeviceStableId, Gn as planComposition, Gr as DeviceType, Hr as toExpressionValue, Ir as compositionFeatureEnabled, Kr as errMsg, Lr as compositionItemFieldPath, M as DeclaredDevices, Ni as createEvent, Nr as cloneStatefulExpressionMemory, Pr as composedDeviceRef, Rr as compositionSliceKey, St as buildCapabilityLookup, Vr as disarmRoseMemory, an as expressionContainsBuiltinCall, f as COMPOSED_ITEM_FIXED_FIELDS, jr as COMPOSER_ADDON_ID, jt as compositionFieldKey, nn as evaluateCompositionField, o as BaseDevice, qr as BaseAddon, r as ALL_CAPABILITY_DEFINITIONS, ya as EventCategory, zr as compositionSourceKey } from "../../dist-BpSENkRJ.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-CSzD5_qX.mjs";
+import { $r as BaseAddon, Br as composedDeviceRef, Dt as buildCapabilityLookup, Ft as composerCapability, Gr as compositionSourceKey, Hr as compositionFeatureEnabled, It as compositionFieldKey, Jr as toExpressionValue, Kr as createStatefulExpressionMemory, Lr as COMPOSER_ADDON_ID, N as DeclaredDevices, Qr as errMsg, Ta as EventCategory, Ur as compositionItemFieldPath, Vr as composedDeviceStableId, Wr as compositionSliceKey, Zn as planComposition, Zr as DeviceType, f as COMPOSED_ITEM_FIXED_FIELDS, o as BaseDevice, qr as disarmRoseMemory, r as ALL_CAPABILITY_DEFINITIONS, sn as evaluateCompositionField, un as expressionContainsBuiltinCall, zi as createEvent, zr as cloneStatefulExpressionMemory } from "../../dist-BSF_C8W2.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-Ds0Vr6eD.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { An as logDestinationCapability, qr as BaseAddon } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-BSF_C8W2.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_composition_sources = require("../../composition-sources-BxUkLNSo.js");
+const require_composition_sources = require("../../composition-sources-gB4coDJR.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 let zod = require("zod");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,6 +1,6 @@
-import { Ft as coreBlockIdFromAddonId, Gn as planComposition, Gt as describeComposableCaps, Hi as hydrateSchema, It as coreBlockSourceKind, Kr as errMsg, Li as defineRecordKinds, Lt as coreBlocksCapability, M as DeclaredDevices, Mt as compositionSourceRefs, Nt as coreBlockAddonId, Pr as composedDeviceRef, Pt as coreBlockComposition, Qn as replacedFieldKeys, St as buildCapabilityLookup, Tr as validateComposition, Yi as isSecretRefOwnedBy, fa as secretTreeFromSchema, ga as transformSecretWrite, h as CORE_BLOCK_ADDON_PREFIX, ji as collectSecretMarkerRefs, la as resolveSecretMarkers, m as CORE_BLOCKS_ADDON_ID, nr as resolveCoreBlockFiles, p as COMPOSER_RUNNER_ID, qi as isSecretMarker, qr as BaseAddon, r as ALL_CAPABILITY_DEFINITIONS, tr as resolveCoreBlockEntry, v as CoreBlockSchema, zn as normalizeCoreBlockWrite, zr as compositionSourceKey } from "../../dist-BpSENkRJ.mjs";
+import { $i as isSecretMarker, $r as BaseAddon, Br as composedDeviceRef, Bt as coreBlockIdFromAddonId, Dt as buildCapabilityLookup, Gn as normalizeCoreBlockWrite, Gr as compositionSourceKey, Ht as coreBlocksCapability, Ji as hydrateSchema, Li as collectSecretMarkerRefs, Lt as compositionSourceRefs, N as DeclaredDevices, Qr as errMsg, Rt as coreBlockAddonId, Sa as transformSecretWrite, Ui as defineRecordKinds, Vt as coreBlockSourceKind, Xt as describeComposableCaps, Zn as planComposition, cr as resolveCoreBlockFiles, h as CORE_BLOCK_ADDON_PREFIX, ha as resolveSecretMarkers, ir as replacedFieldKeys, jr as validateComposition, m as CORE_BLOCKS_ADDON_ID, p as COMPOSER_RUNNER_ID, r as ALL_CAPABILITY_DEFINITIONS, sr as resolveCoreBlockEntry, ta as isSecretRefOwnedBy, va as secretTreeFromSchema, y as CoreBlockSchema, zt as coreBlockComposition } from "../../dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-CSzD5_qX.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-Ds0Vr6eD.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { n as unwrapStoredValue, t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/device-history/device-history.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 //#region src/builtins/device-history/store/series-registry.ts
 function subjectIdOf(subject) {
 	return subject.kind === "device" ? `d:${subject.deviceId}` : `n:${subject.nodeId}`;

package/dist/builtins/device-history/device-history.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as DeviceType, Jt as deviceHistoryCapability, R as HISTORY_CATALOG, Xt as deviceRemovalHookCapability, _t as armRemovalReconcile, ni as HISTORY_DEFAULT_MIN_INTERVAL_MS, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, $t as deviceHistoryCapability, St as armRemovalReconcile, Ta as EventCategory, Zr as DeviceType, ci as HISTORY_DEFAULT_MIN_INTERVAL_MS, tn as deviceRemovalHookCapability, z as HISTORY_CATALOG } from "../../dist-BSF_C8W2.mjs";
 //#region src/builtins/device-history/store/series-registry.ts
 function subjectIdOf(subject) {
 	return subject.kind === "device" ? `d:${subject.deviceId}` : `n:${subject.nodeId}`;

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { Bn as normalizeUnit, Ci as WELL_KNOWN_TAB_MAP, Gi as isKeychainStoredField, Gr as DeviceType, I as FieldClaimModeSchema, Ji as isSecretMarkerLike, Ki as isSecretClear, Kr as errMsg, L as FieldClaimSchema, Li as defineRecordKinds, Mi as collectZodSecretPaths, N as DeviceStatusSchema, Ot as canonicalIconKey, P as DeviceTombstoneSchema, Qt as deviceStatusCapability, Rt as createDeviceExtensionProvider, Tn as legacyAutoLinkIds, Tt as buildStreamParamsConfigSchema, Ui as isDeviceConfigCap, Un as parseStreamParamsFormPatch, Ur as DeviceFeature, Ut as defineExtensionSlotProvider, Wr as DeviceRole, Yt as deviceManagerCapability, Zt as deviceStateCapability, _a as userError, bi as SECRET_CLEAR, c as CAMERA_SWITCH_ORDER, da as secretTreeFromPaths, en as enumerateItemArrayFields, ga as transformSecretWrite, ha as toSecretFieldView, in as expandContainer, kn as locationIconKey, la as resolveSecretMarkers, pa as sleep$1, pr as siteZoneKey, q as MINUTES_PER_DAY, qi as isSecretMarker, qr as BaseAddon, qt as deviceExtensionCapability, r as ALL_CAPABILITY_DEFINITIONS, sr as runtimeStatePolicyFor, tn as enumerateSchemaFields, tt as STREAM_PROFILE_META, u as CAP_NAMES_WITH_STATUS, un as formatMinutes, w as DAY_NAMES, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $i as isSecretMarker, $r as BaseAddon, At as buildStreamParamsConfigSchema, Ca as userError, Ei as SECRET_CLEAR, F as DeviceTombstoneSchema, Fn as locationIconKey, J as MINUTES_PER_DAY, Jt as defineExtensionSlotProvider, Kn as normalizeUnit, L as FieldClaimModeSchema, Nt as canonicalIconKey, P as DeviceStatusSchema, Qi as isSecretClear, Qr as errMsg, Qt as deviceExtensionCapability, R as FieldClaimSchema, Ri as collectZodSecretPaths, Sa as transformSecretWrite, T as DAY_NAMES, Ta as EventCategory, Ui as defineRecordKinds, Ut as createDeviceExtensionProvider, Xr as DeviceRole, Yi as isDeviceConfigCap, Yn as parseStreamParamsFormPatch, Yr as DeviceFeature, Zi as isKeychainStoredField, Zr as DeviceType, _a as secretTreeFromPaths, an as enumerateItemArrayFields, c as CAMERA_SWITCH_ORDER, ea as isSecretMarkerLike, en as deviceManagerCapability, ha as resolveSecretMarkers, hn as formatMinutes, jn as legacyAutoLinkIds, ki as WELL_KNOWN_TAB_MAP, ln as expandContainer, nn as deviceStateCapability, on as enumerateSchemaFields, ot as STREAM_PROFILE_META, pr as runtimeStatePolicyFor, r as ALL_CAPABILITY_DEFINITIONS, rn as deviceStatusCapability, u as CAP_NAMES_WITH_STATUS, xa as toSecretFieldView, ya as sleep$1, yr as siteZoneKey } from "../../dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { An as logDestinationCapability, qr as BaseAddon } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, In as logDestinationCapability } from "../../dist-BSF_C8W2.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_device_ca = require("../../device-ca-QPBgfqVY.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-DrmTtz7F.js");
-const require_constants = require("../../constants-DruwCkfp.js");
+const require_device_ca = require("../../device-ca-bpoEr0zG.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-n-IZRklX.js");
+const require_constants = require("../../constants-CavyKfHZ.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,8 +1,8 @@
-import { Cn as keychainAdminCapability, H as KeychainAuditEntrySchema, Li as defineRecordKinds, U as KeychainResetRecordSchema, V as KEYCHAIN_RESET_TRIGGER_ACTOR, Vi as formatSecretScope, ea as normalizeSecretOwner, qr as BaseAddon, ra as parseSecretRef, wn as keychainCapability, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, An as keychainCapability, H as KEYCHAIN_RESET_TRIGGER_ACTOR, Ta as EventCategory, U as KeychainAuditEntrySchema, Ui as defineRecordKinds, W as KeychainResetRecordSchema, kn as keychainAdminCapability, la as parseSecretRef, oa as normalizeSecretOwner, qi as formatSecretScope } from "../../dist-BSF_C8W2.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-uFbTyY_o.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-JQUqgQgq.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-DOlYt1t1.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-qz1Pmeu1.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-B4yfsf2n.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-i5oD_gLB.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-BpqA2CT0.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Kr as errMsg, Ni as createEvent, X as RECORDING_SOURCE_CAMSTACK_ADDON, Z as RecordingStatusSchema, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $r as BaseAddon, Qr as errMsg, Ta as EventCategory, nt as RecordingStatusSchema, tt as RECORDING_SOURCE_CAMSTACK_ADDON, zi as createEvent } from "../../dist-BSF_C8W2.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/auth-schema.d.ts

@@ -12,7 +12,7 @@
 *   - scoped_tokens
 *   - oauth_sessions
 *   - login_sessions, login_session_cutoffs (`login-session-manager.ts`)
-*   - admin_tokens (`admin-token-manager.ts`), auth_audit (`auth-audit-log.ts`)
+*   - admin_tokens (`legacy-token-tables.ts`, read by nothing since D895), auth_audit (`auth-audit-log.ts`)
 *
 * Schema migration: when the backend receives `declareCollection` for
 * a name that already exists with a legacy `(id, data)` KV shape, the
@@ -44,12 +44,9 @@ export declare const USERS_COLLECTION = "users";
 export declare const API_KEYS_COLLECTION = "api_keys";
 /**
 * @durable class=config owner=local-auth
-*   write="an operator or the CLI mints a scoped token; `validate` fires
-*     `updateLastUsed` on every accepted call"
-*   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
-*     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
-*     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
-*     id or by a user that no longer exists."
+*   write="none since D895 — the pre-D892 scoped-token rows are kept on disk,
+*     read by nothing (a scoped token is a `credential-tokens` row)"
+*   retention="the operator drops the table by hand"
 */
 export declare const SCOPED_TOKENS_COLLECTION = "scoped_tokens";
 /**