@camstack/system 1.2.455 → 1.2.457

package/dist/addon-runner.js

@@ -5467,6 +5467,67 @@ function createChildrenBatchLoader(opts) {
 	} };
 }
 //#endregion
+//#region src/kernel/moleculer/accessory-prune-gate.ts
+function isSpecList(answer) {
+	return Array.isArray(answer);
+}
+function classifyAccessoryRead(answer, ctx) {
+	if (isSpecList(answer)) {
+		if (!ctx.online) return {
+			kind: "unknown",
+			reason: "parent offline",
+			children: answer
+		};
+		if (ctx.probedAt === 0) return {
+			kind: "unknown",
+			reason: "probe not yet completed",
+			children: answer
+		};
+		return {
+			kind: "successful",
+			children: answer
+		};
+	}
+	if (answer.kind === "unknown") return {
+		kind: "unknown",
+		reason: answer.reason,
+		children: answer.known ?? []
+	};
+	return {
+		kind: "successful",
+		children: answer.children
+	};
+}
+/** One per parent registration; in-memory on purpose (a restart starts over — the safe direction). */
+var AccessoryShrinkGate = class {
+	/** childId → the probe (`lastProbedAt`) of the first successful read that lacked it. */
+	#firstMissing = /* @__PURE__ */ new Map();
+	/**
+	* `missing` = the managed children a SUCCESSFUL read no longer lists. Never
+	* call this for an unknown read.
+	*/
+	decide(missing, probedAt) {
+		const missingSet = new Set(missing);
+		for (const id of [...this.#firstMissing.keys()]) if (!missingSet.has(id)) this.#firstMissing.delete(id);
+		const prune = [];
+		const deferred = [];
+		for (const id of missing) {
+			const first = this.#firstMissing.get(id);
+			if (first !== void 0 && probedAt > first) {
+				prune.push(id);
+				this.#firstMissing.delete(id);
+				continue;
+			}
+			if (first === void 0) this.#firstMissing.set(id, probedAt);
+			deferred.push(id);
+		}
+		return {
+			prune,
+			deferred
+		};
+	}
+};
+//#endregion
 //#region src/kernel/moleculer/runtime-state-load.ts
 /** A device build refused because its runtime state could not be loaded. */
 var RuntimeStateLoadError = class extends Error {
@@ -6200,6 +6261,7 @@ function createBrokerDeviceManagerApi(opts) {
 				throw err;
 			}
 			const lifecycleHost = device;
+			const shrinkGate = new AccessoryShrinkGate();
 			const runReconcile = async () => {
 				try {
 					await callDeviceManager(api, "registerDevice", {
@@ -6223,7 +6285,12 @@ function createBrokerDeviceManagerApi(opts) {
 					});
 				}
 				if (typeof lifecycleHost.getAccessoryChildren !== "function") return;
-				const specs = lifecycleHost.getAccessoryChildren();
+				const probedAt = device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0;
+				const read = classifyAccessoryRead(lifecycleHost.getAccessoryChildren(), {
+					online: device.online,
+					probedAt
+				});
+				const specs = read.children;
 				const expected = new Set(specs.map((s) => `${device.stableId}-${s.stableIdSuffix}`));
 				await runBounded(specs, ACCESSORY_SPAWN_CONCURRENCY, async (spec) => {
 					try {
@@ -6241,24 +6308,42 @@ function createBrokerDeviceManagerApi(opts) {
 						});
 					}
 				});
-				if ((device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0) === 0 && specs.length === 0) {
-					opts.logger.debug("Accessory orphan reconciliation skipped — probe not yet completed", { tags: {
-						parentDeviceId: device.id,
-						parentStableId: device.stableId
-					} });
+				if (read.kind === "unknown") {
+					opts.logger.info("Accessory orphan reconciliation skipped — child list unknown", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							reason: read.reason,
+							probedAt
+						}
+					});
 					return;
 				}
 				try {
-					const currentChildren = await childrenLoader.load(device.id);
-					for (const child of currentChildren) {
-						if (child.linkDeviceId !== device.id) continue;
-						if (expected.has(child.stableId)) continue;
+					const missing = (await childrenLoader.load(device.id)).filter((child) => child.linkDeviceId === device.id && !expected.has(child.stableId));
+					const decision = shrinkGate.decide(missing.map((child) => child.id), probedAt);
+					if (decision.deferred.length > 0) opts.logger.info("Accessory children missing from a complete read — kept until a later probe agrees", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							childDeviceIds: [...decision.deferred],
+							probedAt
+						}
+					});
+					const confirmed = new Set(decision.prune);
+					for (const child of missing) {
+						if (!confirmed.has(child.id)) continue;
 						const live = registry.getById(child.id);
 						try {
 							if (live) await deviceApi.remove(child.id);
 							else await callDeviceManager(api, "removeDevice", { deviceId: child.id });
 							opts.logger.info("Removed orphan accessory child no longer in parent specs", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId
 								},
@@ -6271,6 +6356,7 @@ function createBrokerDeviceManagerApi(opts) {
 						} catch (err) {
 							opts.logger.warn("Failed to remove orphan accessory child", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId,
 									childDeviceId: child.id

package/dist/addon-runner.mjs

@@ -5443,6 +5443,67 @@ function createChildrenBatchLoader(opts) {
 	} };
 }
 //#endregion
+//#region src/kernel/moleculer/accessory-prune-gate.ts
+function isSpecList(answer) {
+	return Array.isArray(answer);
+}
+function classifyAccessoryRead(answer, ctx) {
+	if (isSpecList(answer)) {
+		if (!ctx.online) return {
+			kind: "unknown",
+			reason: "parent offline",
+			children: answer
+		};
+		if (ctx.probedAt === 0) return {
+			kind: "unknown",
+			reason: "probe not yet completed",
+			children: answer
+		};
+		return {
+			kind: "successful",
+			children: answer
+		};
+	}
+	if (answer.kind === "unknown") return {
+		kind: "unknown",
+		reason: answer.reason,
+		children: answer.known ?? []
+	};
+	return {
+		kind: "successful",
+		children: answer.children
+	};
+}
+/** One per parent registration; in-memory on purpose (a restart starts over — the safe direction). */
+var AccessoryShrinkGate = class {
+	/** childId → the probe (`lastProbedAt`) of the first successful read that lacked it. */
+	#firstMissing = /* @__PURE__ */ new Map();
+	/**
+	* `missing` = the managed children a SUCCESSFUL read no longer lists. Never
+	* call this for an unknown read.
+	*/
+	decide(missing, probedAt) {
+		const missingSet = new Set(missing);
+		for (const id of [...this.#firstMissing.keys()]) if (!missingSet.has(id)) this.#firstMissing.delete(id);
+		const prune = [];
+		const deferred = [];
+		for (const id of missing) {
+			const first = this.#firstMissing.get(id);
+			if (first !== void 0 && probedAt > first) {
+				prune.push(id);
+				this.#firstMissing.delete(id);
+				continue;
+			}
+			if (first === void 0) this.#firstMissing.set(id, probedAt);
+			deferred.push(id);
+		}
+		return {
+			prune,
+			deferred
+		};
+	}
+};
+//#endregion
 //#region src/kernel/moleculer/runtime-state-load.ts
 /** A device build refused because its runtime state could not be loaded. */
 var RuntimeStateLoadError = class extends Error {
@@ -6176,6 +6237,7 @@ function createBrokerDeviceManagerApi(opts) {
 				throw err;
 			}
 			const lifecycleHost = device;
+			const shrinkGate = new AccessoryShrinkGate();
 			const runReconcile = async () => {
 				try {
 					await callDeviceManager(api, "registerDevice", {
@@ -6199,7 +6261,12 @@ function createBrokerDeviceManagerApi(opts) {
 					});
 				}
 				if (typeof lifecycleHost.getAccessoryChildren !== "function") return;
-				const specs = lifecycleHost.getAccessoryChildren();
+				const probedAt = device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0;
+				const read = classifyAccessoryRead(lifecycleHost.getAccessoryChildren(), {
+					online: device.online,
+					probedAt
+				});
+				const specs = read.children;
 				const expected = new Set(specs.map((s) => `${device.stableId}-${s.stableIdSuffix}`));
 				await runBounded(specs, ACCESSORY_SPAWN_CONCURRENCY, async (spec) => {
 					try {
@@ -6217,24 +6284,42 @@ function createBrokerDeviceManagerApi(opts) {
 						});
 					}
 				});
-				if ((device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0) === 0 && specs.length === 0) {
-					opts.logger.debug("Accessory orphan reconciliation skipped — probe not yet completed", { tags: {
-						parentDeviceId: device.id,
-						parentStableId: device.stableId
-					} });
+				if (read.kind === "unknown") {
+					opts.logger.info("Accessory orphan reconciliation skipped — child list unknown", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							reason: read.reason,
+							probedAt
+						}
+					});
 					return;
 				}
 				try {
-					const currentChildren = await childrenLoader.load(device.id);
-					for (const child of currentChildren) {
-						if (child.linkDeviceId !== device.id) continue;
-						if (expected.has(child.stableId)) continue;
+					const missing = (await childrenLoader.load(device.id)).filter((child) => child.linkDeviceId === device.id && !expected.has(child.stableId));
+					const decision = shrinkGate.decide(missing.map((child) => child.id), probedAt);
+					if (decision.deferred.length > 0) opts.logger.info("Accessory children missing from a complete read — kept until a later probe agrees", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							childDeviceIds: [...decision.deferred],
+							probedAt
+						}
+					});
+					const confirmed = new Set(decision.prune);
+					for (const child of missing) {
+						if (!confirmed.has(child.id)) continue;
 						const live = registry.getById(child.id);
 						try {
 							if (live) await deviceApi.remove(child.id);
 							else await callDeviceManager(api, "removeDevice", { deviceId: child.id });
 							opts.logger.info("Removed orphan accessory child no longer in parent specs", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId
 								},
@@ -6247,6 +6332,7 @@ function createBrokerDeviceManagerApi(opts) {
 						} catch (err) {
 							opts.logger.warn("Failed to remove orphan accessory child", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId,
 									childDeviceId: child.id

package/dist/{agent-https-CLWrOO3o.mjs → agent-https-CK9Z4sSR.mjs}

@@ -1,6 +1,6 @@
-import { Li as defineRecordKinds } from "./dist-BpSENkRJ.mjs";
+import { Ki as defineRecordKinds } from "./dist-Dhux90yB.mjs";
 import { S as backdatedNotBefore, _ as NameConstraints, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, g as GeneralSubtrees, h as GeneralSubtree, i as Extension, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension, v as GeneralName, x as AsnConvert } from "./x509.es-DK__ETIe.mjs";
-import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-DOlYt1t1.mjs";
+import { c as SERVER_AUTH_OID$1, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "./constants-cxKcZRMi.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -1200,6 +1200,31 @@ function collectCertIdentity(options) {
 cryptoProvider.set(webcrypto);
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 var CA_COMMON_NAME = "CamStack Local CA";
+/** Between {@link CA_COMMON_NAME} and the hub's name in a new root's subject. */
+var CA_HUB_NAME_SEPARATOR = " — ";
+/** X.520 `ub-common-name`: the most characters a CN may carry. */
+var X509_COMMON_NAME_MAX_LENGTH = 64;
+/** C0 controls, DEL and the C1 range. */
+function isControlCodePoint(code) {
+	return code <= 31 || code >= 127 && code <= 159;
+}
+/**
+* The subject CN of a NEW local root: `CamStack Local CA — <hub name>`, so two hubs'
+* roots installed on one phone can be told apart in its settings. The name is
+* sanitised for a CN (controls removed, whitespace collapsed) and cut so the whole
+* CN stays within 64 characters. An absent or unusable name, or one that is just
+* the product's own name, yields the plain {@link CA_COMMON_NAME}.
+*
+* Only a root being CREATED is named: an existing root is never reissued to rename
+* it, since every device that trusts it would have to install it again.
+*/
+function localCaCommonName(hubName) {
+	if (hubName === void 0) return CA_COMMON_NAME;
+	const cleaned = [...hubName].map((char) => isControlCodePoint(char.codePointAt(0) ?? 0) ? " " : char).join("").replace(/\s+/gu, " ").trim();
+	if (cleaned === "" || cleaned.toLowerCase() === "camstack") return CA_COMMON_NAME;
+	const room = X509_COMMON_NAME_MAX_LENGTH - 17 - 3;
+	return `${CA_COMMON_NAME}${CA_HUB_NAME_SEPARATOR}${[...cleaned].slice(0, room).join("").trimEnd()}`;
+}
 var MS_PER_DAY = 864e5;
 /**
 * Expiry of a served leaf. Browsers cap the TOTAL span (notBefore to notAfter) at 397 days, so
@@ -1261,8 +1286,10 @@ function subjectAltNames(identity) {
 * It carries a CRITICAL `nameConstraints` extension (D873): private address
 * ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
 * names at creation). A leaked key therefore cannot vouch for a public site.
+*
+* `commonName` is the subject CN, from {@link localCaCommonName}.
 */
-async function generateCa(now, hostnames = []) {
+async function generateCa(now, hostnames = [], commonName = CA_COMMON_NAME) {
 	const keys = await webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
 	const extensions = [
 		new BasicConstraintsExtension(true, 0, true),
@@ -1272,7 +1299,7 @@ async function generateCa(now, hostnames = []) {
 	];
 	const cert = await X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
-		name: `CN=${CA_COMMON_NAME}`,
+		name: [{ CN: [commonName] }],
 		notBefore: backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
@@ -1627,4 +1654,4 @@ function pemDigest(pem) {
 	return createHash("sha256").update(pem).digest("hex").slice(0, 16);
 }
 //#endregion
-export { generateMeshKeyPair as $, isConstrainedCa as A, systemConfigRecordKinds as B, MAX_LEAF_VALIDITY_DAYS as C, PERMITTED_DNS_SUFFIXES as D, reasonRequiresNewCa as E, AGENT_HTTPS_NAMES_COLLECTION as F, describeMeshLeaf as G, MESH_NODE_CERTIFICATES_COLUMNS as H, AGENT_HTTPS_NAMES_COLUMNS as I, caFingerprint as J, getProcessMeshCertificateRegistry as K, AgentHttpsNames as L, permitsIdentity as M, permitsName as N, PERMITTED_IP_RANGES as O, readNameConstraints as P, generateMeshCa as Q, getProcessAgentHttpsNames as R, LEAF_RENEWAL_WINDOW_DAYS as S, evaluateExistingCert as T, MeshCertificateRegistry as U, MESH_NODE_CERTIFICATES_COLLECTION as V, RENEWAL_ABANDONED as W, createMeshCsrPem as X, caFingerprintCompact as Y, exportMeshPrivateKeyPem as Z, issueLeaf as _, collectAgentNames as a, systemHostFacts as b, installAgentHttps as c, issueAgentHttpsLeaf as d, isValidAgentNodeId as et, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, subjectCn as it, isLocalOnlyHostname as j, buildNameConstraintSet as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, issueMeshLeafFromCsr as nt, createAgentHttpsRequest as o, pemDigest as p, setProcessMeshCertificateRegistry as q, agentHttpsPaths as r, loadMeshCa as rt, describeHttpsLeaf as s, AgentHttpsInstallError as t, issueMeshLeafForNode as tt, isPrivateAddress as u, loadCa as v, SERVER_AUTH_OID as w, CA_VALIDITY_DAYS as x, collectCertIdentity as y, setProcessAgentHttpsNames as z };
+export { generateMeshCa as $, buildNameConstraintSet as A, setProcessAgentHttpsNames as B, LEAF_RENEWAL_WINDOW_DAYS as C, reasonRequiresNewCa as D, evaluateExistingCert as E, readNameConstraints as F, RENEWAL_ABANDONED as G, MESH_NODE_CERTIFICATES_COLLECTION as H, AGENT_HTTPS_NAMES_COLLECTION as I, setProcessMeshCertificateRegistry as J, describeMeshLeaf as K, AGENT_HTTPS_NAMES_COLUMNS as L, isLocalOnlyHostname as M, permitsIdentity as N, PERMITTED_DNS_SUFFIXES as O, permitsName as P, exportMeshPrivateKeyPem as Q, AgentHttpsNames as R, CA_VALIDITY_DAYS as S, SERVER_AUTH_OID as T, MESH_NODE_CERTIFICATES_COLUMNS as U, systemConfigRecordKinds as V, MeshCertificateRegistry as W, caFingerprintCompact as X, caFingerprint as Y, createMeshCsrPem as Z, issueLeaf as _, collectAgentNames as a, subjectCn as at, collectCertIdentity as b, installAgentHttps as c, issueAgentHttpsLeaf as d, generateMeshKeyPair as et, loadAgentHttps as f, generateCa as g, CA_COMMON_NAME as h, certificateNames as i, loadMeshCa as it, isConstrainedCa as j, PERMITTED_IP_RANGES as k, isContainerBridgeAddress as l, pinnedHttpsCaFingerprint as m, acceptAgentSans as n, issueMeshLeafForNode as nt, createAgentHttpsRequest as o, pemDigest as p, getProcessMeshCertificateRegistry as q, agentHttpsPaths as r, issueMeshLeafFromCsr as rt, describeHttpsLeaf as s, AgentHttpsInstallError as t, isValidAgentNodeId as tt, isPrivateAddress as u, loadCa as v, MAX_LEAF_VALIDITY_DAYS as w, systemHostFacts as x, localCaCommonName as y, getProcessAgentHttpsNames as z };

package/dist/{agent-https-CCvlRQKV.js → agent-https-CoyOZ3pC.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-C89nqNnn.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_constants = require("./constants-DruwCkfp.js");
+const require_constants = require("./constants-B_X9cWEK.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -1202,6 +1202,31 @@ function collectCertIdentity(options) {
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 /** Subject of the local root. Distinct from the leaf's CN by construction. */
 var CA_COMMON_NAME = "CamStack Local CA";
+/** Between {@link CA_COMMON_NAME} and the hub's name in a new root's subject. */
+var CA_HUB_NAME_SEPARATOR = " — ";
+/** X.520 `ub-common-name`: the most characters a CN may carry. */
+var X509_COMMON_NAME_MAX_LENGTH = 64;
+/** C0 controls, DEL and the C1 range. */
+function isControlCodePoint(code) {
+	return code <= 31 || code >= 127 && code <= 159;
+}
+/**
+* The subject CN of a NEW local root: `CamStack Local CA — <hub name>`, so two hubs'
+* roots installed on one phone can be told apart in its settings. The name is
+* sanitised for a CN (controls removed, whitespace collapsed) and cut so the whole
+* CN stays within 64 characters. An absent or unusable name, or one that is just
+* the product's own name, yields the plain {@link CA_COMMON_NAME}.
+*
+* Only a root being CREATED is named: an existing root is never reissued to rename
+* it, since every device that trusts it would have to install it again.
+*/
+function localCaCommonName(hubName) {
+	if (hubName === void 0) return CA_COMMON_NAME;
+	const cleaned = [...hubName].map((char) => isControlCodePoint(char.codePointAt(0) ?? 0) ? " " : char).join("").replace(/\s+/gu, " ").trim();
+	if (cleaned === "" || cleaned.toLowerCase() === "camstack") return CA_COMMON_NAME;
+	const room = X509_COMMON_NAME_MAX_LENGTH - 17 - 3;
+	return `${CA_COMMON_NAME}${CA_HUB_NAME_SEPARATOR}${[...cleaned].slice(0, room).join("").trimEnd()}`;
+}
 var MS_PER_DAY = 864e5;
 /**
 * Expiry of a served leaf. Browsers cap the TOTAL span (notBefore to notAfter) at 397 days, so
@@ -1263,8 +1288,10 @@ function subjectAltNames(identity) {
 * It carries a CRITICAL `nameConstraints` extension (D873): private address
 * ranges and local-only DNS names, plus `hostnames` (the hub's own single-label
 * names at creation). A leaked key therefore cannot vouch for a public site.
+*
+* `commonName` is the subject CN, from {@link localCaCommonName}.
 */
-async function generateCa(now, hostnames = []) {
+async function generateCa(now, hostnames = [], commonName = CA_COMMON_NAME) {
 	const keys = await node_crypto.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
 	const extensions = [
 		new require_x509_es.BasicConstraintsExtension(true, 0, true),
@@ -1274,7 +1301,7 @@ async function generateCa(now, hostnames = []) {
 	];
 	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
 		serialNumber: freshSerial(),
-		name: `CN=${CA_COMMON_NAME}`,
+		name: [{ CN: [commonName] }],
 		notBefore: require_x509_es.backdatedNotBefore(now),
 		notAfter: new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY),
 		keys,
@@ -1911,6 +1938,12 @@ Object.defineProperty(exports, "loadMeshCa", {
 		return loadMeshCa;
 	}
 });
+Object.defineProperty(exports, "localCaCommonName", {
+	enumerable: true,
+	get: function() {
+		return localCaCommonName;
+	}
+});
 Object.defineProperty(exports, "pemDigest", {
 	enumerable: true,
 	get: function() {

package/dist/auth/auth-manager.d.ts

@@ -59,7 +59,16 @@ export declare class AuthManager {
 	* before signing, so nothing outside the schema is ever signed.
 	*/
 	signCredentialToken(claims: CredentialTokenClaims): string;
+	/**
+	* Verify a session-family JWT: a login session, an account link, a bridge or
+	* challenge token. A MINTED token is refused here even though it carries a
+	* valid signature (D895): every surface that calls this wants a person's
+	* session, and a share link or a script's token must never pass for one.
+	* Minted tokens verify only through {@link verifyCredentialToken}.
+	*/
 	verifyToken(token: string): TokenPayload;
+	/** Verify a minted token (`auth.mintToken`): its signature AND its audience. Throws when invalid. */
+	verifyCredentialToken(token: string): CredentialTokenClaims;
 	hashPassword(password: string): Promise<string>;
 	comparePassword(password: string, hash: string): Promise<boolean>;
 	/**

package/dist/auth/legacy-token-tables.d.ts

@@ -0,0 +1,16 @@
+/**
+* The pre-D892 admin-token table — its LAYOUT only (D895).
+*
+* Nothing mints, reads or validates an admin token of the old format any more:
+* an admin token is a `core-auth` `credential-tokens` row whose scopes hold
+* `'*'`. The table stays declared so the storage layout is unchanged; its rows
+* stay on disk until the operator drops them by hand.
+*/
+import type { CollectionColumn } from "@camstack/types";
+/**
+* @durable class=config owner=local-auth
+*   write="none since D895 — the pre-D892 rows are kept on disk, read by nothing"
+*   retention="the operator drops the table by hand"
+*/
+export declare const ADMIN_TOKENS_COLLECTION = "admin_tokens";
+export declare const ADMIN_TOKENS_COLUMNS: readonly CollectionColumn[];

package/dist/auth/user-management-internal.d.ts

@@ -13,10 +13,10 @@
 * construction: a remote proxy of the provider simply has no such key, and
 * {@link getUserManagementInternal} answers `null` (the caller fails closed).
 */
-import type { AdminTokenRecord } from "./admin-token-manager.js";
 import type { AuthAuditEvent, AuthAuditRecord } from "./auth-audit-log.js";
 import type { DeviceCredentialManager } from "./device-credential-manager.js";
 import type { LoginSessionManager } from "./login-session-manager.js";
+import type { UserPreferencesStore } from "../builtins/local-auth/user-preferences-store.js";
 /** Process-global, so every bundled copy of this module agrees on the key. */
 export declare const USER_MANAGEMENT_INTERNAL: unique symbol;
 export interface LinkExternalIdentityInput {
@@ -56,13 +56,6 @@ export interface UserManagementInternal {
 	readonly sessions: LoginSessionsInternal;
 	/** Change a password and end the user's other sessions (and pre-session tokens). */
 	setPassword(input: SetPasswordInput): Promise<void>;
-	/** Admin tokens (`csa_`) — the hub router gates creation (admin + re-auth). */
-	readonly adminTokens: AdminTokensInternal;
-	/**
-	* Scoped tokens (`cst_`) — hub bulk revoke (`auth.revokeCredentials`).
-	* `revoke` deletes the row; `false` when the id was already gone.
-	*/
-	readonly scopedTokens: ScopedTokensInternal;
 	/**
 	* OAuth account-link sessions — hub bulk revoke. Active → mark revoked;
 	* already revoked → delete the row (so "Remove revoked" clears the list).
@@ -72,28 +65,16 @@ export interface UserManagementInternal {
 	readonly audit: AuthAuditInternal;
 	/** Device certificates: enrollment legs, challenge, proof, renewal, liveness check. */
 	readonly deviceCredentials: DeviceCredentialsInternal;
-}
-export interface ScopedTokensInternal {
-	revoke(id: string): Promise<boolean>;
-}
-export interface OauthSessionsInternal {
-	revoke(id: string): Promise<boolean>;
-}
-export interface AdminTokensInternal {
-	create(input: {
-		readonly createdBy: string;
-		readonly name: string;
-		readonly expiresAt: number;
-	}): Promise<{
-		readonly token: string;
-		readonly record: AdminTokenRecord;
-	}>;
 	/**
-	* The live token behind `token` — `null` when unknown, revoked, expired, or
-	* when its creator no longer exists or is no longer an admin.
+	* Per-user account preferences (D894). Every method takes the OWNER's id
+	* first; the hub's `preferences.*` router stamps it from the principal.
+	* Absent on a provider that keeps none.
 	*/
-	validate(token: string): Promise<AdminTokenRecord | null>;
-	list(): Promise<readonly AdminTokenRecord[]>;
+	readonly preferences?: UserPreferencesInternal;
+}
+/** The account-preferences store, as the hub router uses it. */
+export type UserPreferencesInternal = Pick<UserPreferencesStore, "get" | "put" | "delete" | "changedSince">;
+export interface OauthSessionsInternal {
 	revoke(id: string): Promise<boolean>;
 }
 export interface AuthAuditInternal {

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-C89nqNnn.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Kr as errMsg, dt as addonPagesCapability, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { Oa as EventCategory, ni as BaseAddon, ti as errMsg, yt as addonPagesCapability } from "../../dist-Dhux90yB.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-C89nqNnn.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Kr as errMsg, pt as addonWidgetsCapability, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { Oa as EventCategory, ni as BaseAddon, ti as errMsg, xt as addonWidgetsCapability } from "../../dist-Dhux90yB.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-C89nqNnn.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_phase6_declare_gate = require("../../phase6-declare-gate-DrmTtz7F.js");
+const require_phase6_declare_gate = require("../../phase6-declare-gate-BO-_jLh_.js");
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**
 * When does an alert open a new EPISODE, and which edge of it is announced?

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,6 +1,6 @@
-import { Kr as errMsg, Li as defineRecordKinds, Ni as createEvent, gt as alertsCapability, ht as alertEpisodePayload, i as AlertSchema, mn as isAlertEpisodeSeverity, mt as alertEpisodeId, pn as isAlertEpisodeOpen, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { Ct as alertEpisodePayload, Hi as createEvent, Ki as defineRecordKinds, Oa as EventCategory, Sn as isAlertEpisodeSeverity, St as alertEpisodeId, i as AlertSchema, ni as BaseAddon, ti as errMsg, wt as alertsCapability, xn as isAlertEpisodeOpen } from "../../dist-Dhux90yB.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-JQUqgQgq.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-x9ZCbQJP.mjs";
 //#region src/builtins/alerts/alert-episode-policy.ts
 /**
 * When does an alert open a new EPISODE, and which edge of it is announced?

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-C89nqNnn.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { F as FIRST_LEVEL_MACRO_CLASSES, Jn as ptzAutotrackCapability, Kr as errMsg, Wi as isEvent, bt as bareAddonId, qr as BaseAddon, ya as EventCategory } from "../../dist-BpSENkRJ.mjs";
+import { $i as isEvent, L as FIRST_LEVEL_MACRO_CLASSES, Oa as EventCategory, Ot as bareAddonId, ni as BaseAddon, rr as ptzAutotrackCapability, ti as errMsg } from "../../dist-Dhux90yB.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DjQ8C-ku.js");
+const require_dist = require("../../dist-C89nqNnn.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_restore_archive = require("../../restore-archive-4OP0EYg6.js");
+const require_restore_archive = require("../../restore-archive-4DOUR5Gu.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,6 +1,6 @@
-import { Pn as mayWriteToLocation, Qi as nodePin, ma as toNodeId, qr as BaseAddon, ya as EventCategory, yr as storageOccupancyCapability, yt as backupCapability } from "../../dist-BpSENkRJ.mjs";
+import { Ca as toNodeId, Dt as backupCapability, Oa as EventCategory, Or as storageOccupancyCapability, Un as mayWriteToLocation, ni as BaseAddon, sa as nodePin } from "../../dist-Dhux90yB.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { _ as parseBackupSecretKey, a as BackupSnapshotRefusedError, c as backupOrchestratorRecordKinds, d as BackupEncryptionKeyStore, g as generateBackupKeyPair, h as ENCRYPTED_BACKUP_SUFFIX, i as BackupCancelledError, l as backupRecordStoresOf, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, u as BackupSeedMarkerStore } from "../../restore-archive-YFSJRtKy.mjs";
+import { _ as parseBackupSecretKey, a as BackupSnapshotRefusedError, c as backupOrchestratorRecordKinds, d as BackupEncryptionKeyStore, g as generateBackupKeyPair, h as ENCRYPTED_BACKUP_SUFFIX, i as BackupCancelledError, l as backupRecordStoresOf, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, u as BackupSeedMarkerStore } from "../../restore-archive-DyOaPeAr.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";