@camstack/system 1.2.455 → 1.2.456

package/dist/{dist-DjQ8C-ku.js → dist-BpqA2CT0.js}

@@ -745,7 +745,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BxjU_fJM.mjs
+//#region ../types/dist/sleep-yKL5gfrH.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -3258,9 +3258,9 @@ function normalizeAddonInitResult(result) {
 */
 var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
 /**
-* The share-view scope kinds a `csv_*` share token can carry. The hub mints
-* and validates them (`share-token.service.ts` builds its enum from this
-* list); a data plane names the kinds it ACCEPTS in `share`.
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
 */
 var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
@@ -10420,7 +10420,7 @@ function scopesAllowAddon(scopes, addonId, access) {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are tokens (`auth.mintToken`)
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -10609,24 +10609,117 @@ var AddonRoutesScopeSchema = zod.z.object({
 	type: zod.z.literal("addon-routes"),
 	access: zod.z.array(MethodAccessSchema).min(1)
 });
+var PreferencesSelfScopeSchema = zod.z.object({ type: zod.z.literal("preferences-self") });
 var CredentialScopeSchema = zod.z.union([
 	zod.z.literal("*"),
 	ShareViewScopeSchema,
 	AddonRoutesScopeSchema,
+	PreferencesSelfScopeSchema,
 	TokenScopeSchema
 ]);
 /**
+* The `kind` claim of a unified token. It names the TOKEN FAMILY (so every
+* older gate that classifies a hub JWT refuses it — `classifyBearerPrincipal`
+* treats any `kind` it does not know as not-a-credential), never what the
+* token may do: that is its `scopes`, and only its `scopes`.
+*/
+var CREDENTIAL_TOKEN_KIND = "credential";
+/**
+* The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+* verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+* session — the OAuth consent page, the session cookie, health, backups)
+* refuses a token carrying it, so a minted token — a share link above all —
+* can never be replayed as a person's session. Only the credential verifier's
+* own door (`verifyCredentialToken`) accepts it.
+*/
+var CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+function isCredentialTokenPayload(payload) {
+	if (payload === null || typeof payload !== "object") return false;
+	const kind = Reflect.get(payload, "kind");
+	const aud = Reflect.get(payload, "aud");
+	return kind === "credential" || aud === "camstack:credential" || Array.isArray(aud) && aud.includes("camstack:credential");
+}
+/**
 * The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
 * row (looked up by `jti` on every verify, for revocation) holds the ONE
 * expiry, so a share link can be extended and a JWT clock can never disagree
 * with the row.
 */
 var CredentialTokenClaimsSchema = zod.z.object({
-	kind: zod.z.literal("credential"),
+	kind: zod.z.literal(CREDENTIAL_TOKEN_KIND),
 	sub: zod.z.string().min(1),
 	jti: zod.z.string().min(16),
 	scopes: zod.z.array(CredentialScopeSchema).min(1)
 });
+/**
+* Per-user ACCOUNT preferences (D894): the hub-side half of the viewer's two
+* settings levels.
+*
+*   - DEVICE settings never leave the phone.
+*   - ACCOUNT settings live here: one row per `(user, namespace)`, private to
+*     that user, synced across every device signed in as them, last write wins
+*     unless the writer sends the revision it based its edit on.
+*
+* A setting lives in exactly ONE level; there are no overrides. The caller
+* never names a user: the hub stamps the principal's own id, admin included.
+*
+* The contract the client codes against is the `preferences.*` tRPC router
+* (`server/backend/src/api/core/preferences.router.ts`).
+*/
+/** `viewer.app`, `viewer.cameras`, `viewer.grids` … — lowercase, dot/dash separated. */
+var PREFERENCES_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/;
+/** One row's value, measured as UTF-8 JSON. */
+var PREFERENCES_MAX_VALUE_BYTES = 256 * 1024;
+var PreferenceNamespaceSchema = zod.z.string().regex(PREFERENCES_NAMESPACE_PATTERN);
+/** A namespace's value: a JSON object, opaque to the hub. */
+var PreferenceValueSchema = zod.z.record(zod.z.string(), zod.z.unknown());
+var PreferenceDeviceIdSchema = zod.z.string().min(1).max(64);
+/** A stored row, as the owner reads it. */
+var PreferenceRowSchema = zod.z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+	revision: zod.z.number().int().positive(),
+	updatedAt: zod.z.number().int(),
+	/** The client id the last writer sent; `null` when it sent none. */
+	updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+zod.z.object({ 
+/** Absent: every namespace the caller holds. */
+namespaces: zod.z.array(PreferenceNamespaceSchema).max(32).optional() });
+zod.z.object({ rows: zod.z.array(PreferenceRowSchema) });
+zod.z.object({
+	namespace: PreferenceNamespaceSchema,
+	value: PreferenceValueSchema,
+	/**
+	* The revision the edit was based on. Absent: last write wins. `0`: the
+	* namespace must not exist yet. Any other value that is not the current
+	* revision answers `conflict` and writes nothing.
+	*/
+	baseRevision: zod.z.number().int().nonnegative().optional(),
+	deviceId: PreferenceDeviceIdSchema.optional()
+});
+zod.z.discriminatedUnion("status", [zod.z.object({
+	status: zod.z.literal("saved"),
+	row: PreferenceRowSchema
+}), zod.z.object({
+	status: zod.z.literal("conflict"),
+	current: PreferenceRowSchema.nullable()
+})]);
+zod.z.object({ namespace: PreferenceNamespaceSchema });
+zod.z.object({ 
+/** `false` when the namespace did not exist. */
+deleted: zod.z.boolean() });
+zod.z.object({ 
+/** The revision the client holds per namespace; a namespace it does not list is new to it. */
+revisionByNamespace: zod.z.record(PreferenceNamespaceSchema, zod.z.number().int().nonnegative()).refine((map) => Object.keys(map).length <= 32, { message: `at most 32 namespaces` }) });
+zod.z.object({
+	/** Every row whose revision differs from the client's, and every row it did not list. */
+	rows: zod.z.array(PreferenceRowSchema),
+	/** Namespaces the client listed that no longer exist. */
+	deleted: zod.z.array(PreferenceNamespaceSchema)
+});
 zod.z.enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = zod.z.enum(["en", "it"]);
@@ -42223,38 +42316,37 @@ var llmRuntimeCapability = {
 		})
 	}
 };
+var LlmProfileKindSchema = zod.z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "a kind id is lower-case letters, digits and dashes");
+/** What a model (or, by default, every model of a kind) can do. */
+var LlmModelFeaturesSchema = zod.z.object({
+	vision: zod.z.boolean(),
+	tools: zod.z.boolean(),
+	streaming: zod.z.boolean()
+});
+/** One model a provider offers. `features` overrides the kind's defaults, per field. */
+var LlmModelInfoSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string().optional(),
+	contextLength: zod.z.number().int().positive().optional(),
+	features: LlmModelFeaturesSchema.partial().optional()
+});
 /**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
-*
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
-*/
-var LlmProfileKindSchema = zod.z.enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local",
-	"apple-foundation"
-]);
+* The provider-specific part of a profile, validated by the provider that owns
+* the kind (`upsertProfile` refuses what it does not accept). A field its
+* `connectionSchema` declares `type: 'password'` is a secret: it is held in the
+* keychain, never in the row, and reads back as the redaction marker.
+*/
+var LlmProviderConfigSchema = zod.z.record(zod.z.string(), zod.z.unknown());
 var LlmProfileSchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
+	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
 	kind: LlmProfileKindSchema,
 	/** Stamped by the provider — keeps the fanned catalog routable. */
 	addonId: zod.z.string(),
 	enabled: zod.z.boolean(),
 	/** Vendor model id, or the managed runtime's loaded model. */
 	model: zod.z.string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: zod.z.string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: zod.z.string().optional(),
 	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
 	*  degraded to text — that shipped once and produced a confident answer to a
 	*  question about a picture nobody sent. */
@@ -42262,15 +42354,11 @@ var LlmProfileSchema = zod.z.object({
 	temperature: zod.z.number().min(0).max(2).optional(),
 	/** Nucleus sampling. Every wire we speak has it. */
 	topP: zod.z.number().min(0).max(1).optional(),
-	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-	*  wire does, and the client drops it there (measured: the request body gets
-	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
-	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	/** Top-k sampling. Carried only by the wires that have it — a kind offers the
+	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: zod.z.number().int().positive().optional(),
 	maxTokens: zod.z.number().int().positive().optional(),
-	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
-	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-	*  the model with, so it is the one field that changes a PROCESS. */
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: zod.z.number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
 	*  two system prompts fighting is worse than either alone). */
@@ -42296,16 +42384,37 @@ var LlmProfileSchema = zod.z.object({
 	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
 	*  `true` here buys the wiring, not behaviour, until tools are registered. */
 	toolsEnabled: zod.z.boolean().default(false),
-	extraHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional(),
-	/**
-	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-	* to configure (no key, no URL, no download; `model` is `apple-system`).
-	* `supportsVision` on such a row is stamped by the provider from the node's
-	* reported `imageInput`, never taken from the operator (D62).
-	*/
-	appleFoundation: zod.z.object({ nodeId: zod.z.string() }).optional()
+	/** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+	providerConfig: LlmProviderConfigSchema.default({})
+});
+/**
+* The common profile fields a kind's editor offers. The editor owns how each
+* one is drawn; the provider says which of them mean something on its wire.
+*/
+var LlmProfileFieldSchema = zod.z.enum([
+	"temperature",
+	"topP",
+	"topK",
+	"maxTokens",
+	"contextLength",
+	"systemPrompt",
+	"timeoutMs",
+	"connectTimeoutMs",
+	"firstTokenTimeoutMs",
+	"idleTimeoutMs",
+	"retry",
+	"toolsEnabled"
+]);
+/**
+* A provider-drawn part of the editor, by a generic widget id the admin UI
+* registers (`ai/apple-node`). `placement: 'model'` replaces the generic model
+* picker: that widget owns the model choice.
+*/
+var LlmProviderWidgetSchema = zod.z.object({
+	id: zod.z.string(),
+	placement: zod.z.enum(["connection", "model"]),
+	/** `providerConfig` keys this widget must fill before the profile can be saved. */
+	requires: zod.z.array(zod.z.string()).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -42314,11 +42423,56 @@ var ConfigSchemaPassthrough$3 = zod.z.unknown();
 var LlmProfileKindDescriptorSchema = zod.z.object({
 	kind: LlmProfileKindSchema,
 	label: zod.z.string(),
+	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
 	icon: zod.z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: zod.z.string(),
-	configSchema: ConfigSchemaPassthrough$3
+	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+	connectionSchema: ConfigSchemaPassthrough$3,
+	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	/** The kind's defaults; a model from `listModels` may override any of them. */
+	features: LlmModelFeaturesSchema,
+	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+	visionEditable: zod.z.boolean(),
+	/** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+	modelCatalog: zod.z.enum([
+		"fetch",
+		"static",
+		"none"
+	]),
+	staticModels: zod.z.array(LlmModelInfoSchema).optional(),
+	/** The common fields that mean something on this kind's wire. */
+	profileFields: zod.z.array(LlmProfileFieldSchema),
+	providerWidgets: zod.z.array(LlmProviderWidgetSchema).optional()
+});
+/**
+* `listModels` input. `connection` is an UNSAVED draft of `providerConfig`
+* (the editor's form); with `profileId` too, a secret the draft leaves
+* untouched (absent or the redaction marker) is resolved server-side from the
+* stored profile — the browser never receives it.
+*/
+var LlmListModelsInputSchema = zod.z.object({
+	addonId: zod.z.string(),
+	kind: LlmProfileKindSchema,
+	profileId: zod.z.string().optional(),
+	connection: LlmProviderConfigSchema.optional()
 });
+var LlmListModelsErrorCodeSchema = zod.z.enum([
+	"auth",
+	"network",
+	"unsupported",
+	"invalid"
+]);
+/** A RESULT, never a throw: "wrong key" is an answer the editor renders inline. */
+var LlmListModelsResultSchema = zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	models: zod.z.array(LlmModelInfoSchema)
+}), zod.z.object({
+	ok: zod.z.literal(false),
+	code: LlmListModelsErrorCodeSchema,
+	message: zod.z.string()
+})]);
 var LlmDefaultSelectorSchema = zod.z.union([zod.z.object({ consumer: zod.z.string() }), zod.z.object({ purpose: zod.z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = zod.z.object({
 	selector: LlmDefaultSelectorSchema,
@@ -42449,8 +42603,17 @@ var llmCapability = {
 			auth: "admin",
 			timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
 		}),
-		/** Live vendor enumeration (GET /models etc.). */
-		listModels: method(ProfileRefInputSchema, zod.z.array(zod.z.string())),
+		/**
+		* The models a kind offers, for a SAVED profile or an unsaved draft
+		* (`connection`). A mutation, not a query: a draft may carry a key, and a
+		* query's input travels in the URL. Admin: it dials whatever endpoint the
+		* draft names and may resolve a stored key to do it. The answer never
+		* carries a secret — failures are a typed result, never a throw.
+		*/
+		listModels: method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getDefaults: method(zod.z.object({}), zod.z.array(LlmDefaultSchema)),
 		setDefault: method(zod.z.object({
 			selector: LlmDefaultSelectorSchema,
@@ -71343,26 +71506,6 @@ var ApiKeySummarySchema = zod.z.object({
 	createdAt: zod.z.number(),
 	lastUsedAt: zod.z.number().optional()
 });
-var ScopedTokenSummarySchema = zod.z.object({
-	id: zod.z.string(),
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	tokenPrefix: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().nullish(),
-	lastUsedAt: zod.z.number().nullish(),
-	createdAt: zod.z.number()
-});
-var CreateScopedTokenInputSchema = zod.z.object({
-	userId: zod.z.string(),
-	name: zod.z.string(),
-	scopes: zod.z.array(TokenScopeSchema),
-	expiresAt: zod.z.number().optional()
-});
-var CreateScopedTokenResultSchema = zod.z.object({
-	token: zod.z.string(),
-	record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = zod.z.object({
 	id: zod.z.string(),
 	userId: zod.z.string(),
@@ -71384,11 +71527,11 @@ var TotpStatusSchema = zod.z.object({
 	confirmedAt: zod.z.number().nullable()
 });
 /**
-* user-management — singleton capability for user accounts, API keys,
-* and scoped tokens.
+* user-management — singleton capability for user accounts and the
+* legacy API-key rows.
 *
 * v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
-* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* — the subset check on `setUserScopes` is moot
 * because non-admins never reach these. If/when we open non-admin
 * delegation, structural caller-scope subset check goes inside the
 * provider.
@@ -71459,18 +71602,6 @@ var userManagementCapability = {
 			auth: "admin",
 			access: "delete"
 		}),
-		createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
-		revokeScopedToken: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "delete"
-		}),
-		validateScopedToken: method(zod.z.object({ token: zod.z.string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }),
-		listScopedTokens: method(zod.z.object({ userId: zod.z.string() }), zod.z.array(ScopedTokenSummarySchema), { auth: "admin" }),
 		setupTotp: method(zod.z.object({ userId: zod.z.string() }), TotpSetupResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -77959,7 +78090,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		capName: "llm",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"llm.listNodeModels": {
 		capName: "llm",
@@ -82623,12 +82754,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -82677,12 +82802,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.listScopedTokens": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.listUsers": {
 		capName: "user-management",
 		capScope: "system",
@@ -82737,12 +82856,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"userManagement.revokeScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
 	"userManagement.setupTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -82773,12 +82886,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.validateScopedToken": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.verifyTotp": {
 		capName: "user-management",
 		capScope: "system",
@@ -88477,6 +88584,12 @@ Object.defineProperty(exports, "CORE_BLOCK_ADDON_PREFIX", {
 		return CORE_BLOCK_ADDON_PREFIX;
 	}
 });
+Object.defineProperty(exports, "CREDENTIAL_TOKEN_AUDIENCE", {
+	enumerable: true,
+	get: function() {
+		return CREDENTIAL_TOKEN_AUDIENCE;
+	}
+});
 Object.defineProperty(exports, "CalendarPreferencesSchema", {
 	enumerable: true,
 	get: function() {
@@ -88759,12 +88872,36 @@ Object.defineProperty(exports, "NoCallerError", {
 		return NoCallerError;
 	}
 });
+Object.defineProperty(exports, "PREFERENCES_MAX_VALUE_BYTES", {
+	enumerable: true,
+	get: function() {
+		return PREFERENCES_MAX_VALUE_BYTES;
+	}
+});
 Object.defineProperty(exports, "PlaintextSecretError", {
 	enumerable: true,
 	get: function() {
 		return PlaintextSecretError;
 	}
 });
+Object.defineProperty(exports, "PreferenceDeviceIdSchema", {
+	enumerable: true,
+	get: function() {
+		return PreferenceDeviceIdSchema;
+	}
+});
+Object.defineProperty(exports, "PreferenceNamespaceSchema", {
+	enumerable: true,
+	get: function() {
+		return PreferenceNamespaceSchema;
+	}
+});
+Object.defineProperty(exports, "PreferenceValueSchema", {
+	enumerable: true,
+	get: function() {
+		return PreferenceValueSchema;
+	}
+});
 Object.defineProperty(exports, "RECORDING_SOURCE_CAMSTACK_ADDON", {
 	enumerable: true,
 	get: function() {
@@ -89509,6 +89646,12 @@ Object.defineProperty(exports, "isCollectionArrayMethod", {
 		return isCollectionArrayMethod;
 	}
 });
+Object.defineProperty(exports, "isCredentialTokenPayload", {
+	enumerable: true,
+	get: function() {
+		return isCredentialTokenPayload;
+	}
+});
 Object.defineProperty(exports, "isDefaultAppConnectionEndpoint", {
 	enumerable: true,
 	get: function() {

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-Bl0ZKjVR.js");
+const require_wal_maintenance = require("./wal-maintenance-CNEs_I94.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-TyuOEVy1.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-AerF4XE6.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-DlgkFJVY.mjs → hub-mdns-ciao-CHaGDzyz.mjs}

@@ -1,7 +1,7 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { _a as userError } from "./dist-BpSENkRJ.mjs";
+import { Ca as userError } from "./dist-BSF_C8W2.mjs";
 import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
-import { A as isConstrainedCa, E as reasonRequiresNewCa, M as permitsIdentity, P as readNameConstraints, T as evaluateExistingCert, _ as issueLeaf, g as generateCa, v as loadCa, y as collectCertIdentity } from "./agent-https-CLWrOO3o.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-fm4AR8XL.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -204,7 +204,13 @@ async function ensureTlsCert(dataDir, options) {
 	mkdirSync(tlsDir, { recursive: true });
 	let dropped = [];
 	try {
-		dropped = await regenerate(paths, rawIdentity, commonName, validDays, caRotated, reason);
+		dropped = await regenerate(paths, rawIdentity, {
+			commonName,
+			caCommonName: localCaCommonName(options?.hubName),
+			validDays,
+			newCa: caRotated,
+			reason
+		});
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (!canKeepServing(paths)) throw err;
@@ -234,7 +240,13 @@ async function reissueTlsLeaf(dataDir, options) {
 	});
 	const previousFingerprint = readFingerprint(paths.certPath);
 	mkdirSync(tlsDir, { recursive: true });
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, commonName, validDays, false, null));
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, {
+		commonName,
+		caCommonName: localCaCommonName(options?.hubName),
+		validDays,
+		newCa: false,
+		reason: null
+	}));
 }
 /**
 * Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
@@ -260,7 +272,7 @@ async function replaceUnconstrainedLocalCa(dataDir, options) {
 		extraSans: options?.extraSans ?? [],
 		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
 	});
-	const ca = await generateCa(/* @__PURE__ */ new Date(), identity.dnsNames);
+	const ca = await generateCa(/* @__PURE__ */ new Date(), identity.dnsNames, localCaCommonName(options?.hubName));
 	archivePreviousCa(paths, ca);
 	await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
 	writeOwnerOnlyFileSync(`${paths.caKeyPath}.new`, ca.keyPem);
@@ -297,15 +309,10 @@ function decideRegeneration(paths, identity) {
 		return "unreadable";
 	}
 }
-/**
-* Build every byte in memory, then move the files into place. A crash
-* mid-way leaves the previous material untouched; a crash between the
-* moves leaves a key/certificate mismatch, which the evaluator reports as
-* `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, rawIdentity, commonName, validDays, newCa, reason) {
+async function regenerate(paths, rawIdentity, params) {
+	const { commonName, caCommonName, validDays, newCa, reason } = params;
 	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await generateCa(now, rawIdentity.dnsNames) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
+	const ca = newCa ? await generateCa(now, rawIdentity.dnsNames, caCommonName) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
 	const constraints = readNameConstraints(ca.cert);
 	const { identity, dropped } = constraints === null ? {
 		identity: rawIdentity,