@camstack/types 1.2.385 → 1.2.387

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BE7_6UnC.js");
+const require_sleep = require("./sleep-6sOPE0EV.js");
 const require_event_category = require("./event-category-eSqkye-K.js");
 const require_err_msg = require("./err-msg-BhVbr0NX.js");
 //#region src/generated/cap-input-defaults.ts
@@ -63,7 +63,8 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"enabled": false,
 			"maxAttempts": 1
 		},
-		"toolsEnabled": false
+		"toolsEnabled": false,
+		"providerConfig": {}
 	} } } },
 	"llm-runtime": {
 		"complete": { "runtime": { "__nested__": {
@@ -357,7 +358,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 27 collection caps, 46 array methods.
+* Coverage: 27 collection caps, 45 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -376,7 +377,6 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 		"getDefaults",
 		"getUsage",
 		"listModelCatalog",
-		"listModels",
 		"listNodeModels",
 		"listProfileKinds",
 		"listProfiles",

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $n as PEER_BYTES_CHUNK_BYTES, $t as REMOVE_LEAF, A as HF_REPO, An as RECORD_BATCH_MAX_BYTES, Ar as emitReadiness, B as describeCustomActions, Bn as RECORD_SECRET_COLLECTION_PREFIX, Br as SECRET_CLEAR, Bt as settingsBrokersAdoptsFrom, C as addonSliceHandleApi, Cn as RecordsError, Cr as globalSecretScope, Dn as asRecordsError, En as UnknownRecordKindError, Er as parseSecretRef, F as DEVICE_CHILDREN_BATCH_MAX, Fn as RECORD_ID_MAX_LENGTH, Ft as SETTINGS_ARRAY_ADOPTS_PREFIX, Gn as createSecretsAccess, Gr as isSecretMarkerLike, Gt as RecordFieldPathSchema, H as adminUiCapability, Hn as RECORD_SWEEP_INTERVAL_MS, Hr as isSecretClear, Ht as entryBody, I as CALLER_STAMPED_CAPABILITIES, In as RECORD_MAX_DATA_BYTES, It as parseSettingsArrayAdoptsFrom, Jn as forgetKnownSecret, Jt as RecordKindNameSchema, Kn as MIN_SCRUBBED_LENGTH, Kr as makeSecretMarker, Kt as RecordIndexSchema, L as withoutCallerStamp, Ln as RECORD_MAX_INDEXES, Lt as settingsArrayAdoptsFrom, Mn as RECORD_DATABASES, N as deviceOpsCapability, Nn as RECORD_DEFAULT_MAX_DATA_BYTES, On as recordsErrorFromMessage, P as viewerUiCapability, Pn as RECORD_DELETE_BATCH, Pt as makeInMemoryRecords, Qn as shortSecretRefHash, Qt as defineRecordKinds, Rn as RECORD_MAX_INDEX_FIELDS, Rt as SETTINGS_BROKERS_ADOPTS_PREFIX, Sn as RecordUniqueViolationError, Sr as formatSecretScope, Tn as UnindexedFilterError, Tr as normalizeSecretOwner, Un as resolveSecretViewsIn, Ur as isSecretFieldView, Ut as createRecordsAccess, Vn as RECORD_SETTINGS_MAX_ROWS, Vr as classifySecretWrite, Vt as defineEntryKind, Wn as REVALIDATE_AFTER_MS, Wr as isSecretMarker, Wt as EntryDescriptorSchema, X as expandCapMethods, Xn as registerKnownSecret, Xt as assertValidDeclaration, Yn as knownSecretCount, Yt as RecordRetentionSchema, Zn as scrubKnownSecrets, Zt as declarationsOf, _ as readErrorI18n, _n as PlaintextSecretError, an as recordSecretRef, b as isDeviceScopedCap, bn as RecordSecretUnavailableError, br as arrayItemFieldPath, c as asString, cn as collectZodSecretPaths, ct as ReadinessTimeoutError, d as parseJsonUnknown, dn as BatchTooLargeError, dt as scopeKey, en as collectSecretLeaves, er as PEER_BYTES_MAX_OUTSTANDING, f as hfModelUrl, fn as DeclarationRefusedError, g as ErrorI18nPayloadSchema, gn as NoCallerError, hn as InvalidRecordError, in as recordSecretCollection, ir as DATAPLANE_SECRET_HEADER, it as readNodePin, jn as RECORD_CLASSES, kn as RECORD_BATCH_MAX, kr as createEvent, ln as isZodSecret, lr as normalizeAddonInitResult, mn as ForeignSecretMarkerError, nn as parseSecretPath, nr as PEER_BYTES_TICKET_TTL_MS, o as asJsonObject, on as secretArrayPrefixes, or as DisposerChain, ot as MODEL_FORMATS, p as BOOT_RECOVERY_BACKOFF_MS, pn as FilterRequiredError, qn as clearKnownSecrets, qr as toSecretFieldView, qt as RecordKindDeclarationSchema, r as maskUrlCredentials, rn as recordArrayItemPath, rt as nodePin, sr as BaseAddon, st as ReadinessRegistry, t as sleep, tn as mapSecretLeaves, tr as PEER_BYTES_STALL_MS, un as AdoptionPendingError, vn as RECORDS_ERROR_CODES, w as createEventBusSliceSource, wn as RevConflictError, wr as isSecretRef, x as createDeviceProxy, xn as RecordTooLargeError, xr as buildSecretRef, y as DEVICE_SCOPED_CAPS, yn as RecordNotFoundError, yr as SECRET_REF_SCHEME, zn as RECORD_QUERY_MAX, zt as parseSettingsBrokersAdoptsFrom } from "./sleep-BxjU_fJM.mjs";
+import { $n as PEER_BYTES_CHUNK_BYTES, $t as REMOVE_LEAF, A as HF_REPO, An as RECORD_BATCH_MAX_BYTES, Ar as emitReadiness, B as describeCustomActions, Bn as RECORD_SECRET_COLLECTION_PREFIX, Br as SECRET_CLEAR, Bt as settingsBrokersAdoptsFrom, C as addonSliceHandleApi, Cn as RecordsError, Cr as globalSecretScope, Dn as asRecordsError, En as UnknownRecordKindError, Er as parseSecretRef, F as DEVICE_CHILDREN_BATCH_MAX, Fn as RECORD_ID_MAX_LENGTH, Ft as SETTINGS_ARRAY_ADOPTS_PREFIX, Gn as createSecretsAccess, Gr as isSecretMarkerLike, Gt as RecordFieldPathSchema, H as adminUiCapability, Hn as RECORD_SWEEP_INTERVAL_MS, Hr as isSecretClear, Ht as entryBody, I as CALLER_STAMPED_CAPABILITIES, In as RECORD_MAX_DATA_BYTES, It as parseSettingsArrayAdoptsFrom, Jn as forgetKnownSecret, Jt as RecordKindNameSchema, Kn as MIN_SCRUBBED_LENGTH, Kr as makeSecretMarker, Kt as RecordIndexSchema, L as withoutCallerStamp, Ln as RECORD_MAX_INDEXES, Lt as settingsArrayAdoptsFrom, Mn as RECORD_DATABASES, N as deviceOpsCapability, Nn as RECORD_DEFAULT_MAX_DATA_BYTES, On as recordsErrorFromMessage, P as viewerUiCapability, Pn as RECORD_DELETE_BATCH, Pt as makeInMemoryRecords, Qn as shortSecretRefHash, Qt as defineRecordKinds, Rn as RECORD_MAX_INDEX_FIELDS, Rt as SETTINGS_BROKERS_ADOPTS_PREFIX, Sn as RecordUniqueViolationError, Sr as formatSecretScope, Tn as UnindexedFilterError, Tr as normalizeSecretOwner, Un as resolveSecretViewsIn, Ur as isSecretFieldView, Ut as createRecordsAccess, Vn as RECORD_SETTINGS_MAX_ROWS, Vr as classifySecretWrite, Vt as defineEntryKind, Wn as REVALIDATE_AFTER_MS, Wr as isSecretMarker, Wt as EntryDescriptorSchema, X as expandCapMethods, Xn as registerKnownSecret, Xt as assertValidDeclaration, Yn as knownSecretCount, Yt as RecordRetentionSchema, Zn as scrubKnownSecrets, Zt as declarationsOf, _ as readErrorI18n, _n as PlaintextSecretError, an as recordSecretRef, b as isDeviceScopedCap, bn as RecordSecretUnavailableError, br as arrayItemFieldPath, c as asString, cn as collectZodSecretPaths, ct as ReadinessTimeoutError, d as parseJsonUnknown, dn as BatchTooLargeError, dt as scopeKey, en as collectSecretLeaves, er as PEER_BYTES_MAX_OUTSTANDING, f as hfModelUrl, fn as DeclarationRefusedError, g as ErrorI18nPayloadSchema, gn as NoCallerError, hn as InvalidRecordError, in as recordSecretCollection, ir as DATAPLANE_SECRET_HEADER, it as readNodePin, jn as RECORD_CLASSES, kn as RECORD_BATCH_MAX, kr as createEvent, ln as isZodSecret, lr as normalizeAddonInitResult, mn as ForeignSecretMarkerError, nn as parseSecretPath, nr as PEER_BYTES_TICKET_TTL_MS, o as asJsonObject, on as secretArrayPrefixes, or as DisposerChain, ot as MODEL_FORMATS, p as BOOT_RECOVERY_BACKOFF_MS, pn as FilterRequiredError, qn as clearKnownSecrets, qr as toSecretFieldView, qt as RecordKindDeclarationSchema, r as maskUrlCredentials, rn as recordArrayItemPath, rt as nodePin, sr as BaseAddon, st as ReadinessRegistry, t as sleep, tn as mapSecretLeaves, tr as PEER_BYTES_STALL_MS, un as AdoptionPendingError, vn as RECORDS_ERROR_CODES, w as createEventBusSliceSource, wn as RevConflictError, wr as isSecretRef, x as createDeviceProxy, xn as RecordTooLargeError, xr as buildSecretRef, y as DEVICE_SCOPED_CAPS, yn as RecordNotFoundError, yr as SECRET_REF_SCHEME, zn as RECORD_QUERY_MAX, zt as parseSettingsBrokersAdoptsFrom } from "./sleep-yKL5gfrH.mjs";
 import { t as EventCategory } from "./event-category-DOl51-Ij.mjs";
 import { a as DeviceType, t as errMsg } from "./err-msg-BXKzRBwg.mjs";
 //#region src/generated/cap-input-defaults.ts
@@ -62,7 +62,8 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 			"enabled": false,
 			"maxAttempts": 1
 		},
-		"toolsEnabled": false
+		"toolsEnabled": false,
+		"providerConfig": {}
 	} } } },
 	"llm-runtime": {
 		"complete": { "runtime": { "__nested__": {
@@ -356,7 +357,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 27 collection caps, 46 array methods.
+* Coverage: 27 collection caps, 45 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -375,7 +376,6 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 		"getDefaults",
 		"getUsage",
 		"listModelCatalog",
-		"listModels",
 		"listNodeModels",
 		"listProfileKinds",
 		"listProfiles",

package/dist/auth/credential-scope.d.ts

@@ -0,0 +1,262 @@
+/**
+ * The ONE permission vocabulary every credential is reduced to (D892).
+ *
+ * A credential — a login session, an account-link token, or a token
+ * `auth.mintToken` issues (there is no other format, D895) — is
+ * verified into a principal whose permissions are a `CredentialScope[]`, and
+ * nothing else. What KIND of credential it was never decides what it may do:
+ *
+ *   - `'*'` — everything (the admin bypass). Held by an admin's session and
+ *     a token minted with it.
+ *   - a {@link TokenScope} — the v3 capability grants (`category`,
+ *     `capability`, `addon`, `device`) the tRPC matcher has always applied.
+ *   - `share-view` — one fail-closed embed perimeter (`grid-view` /
+ *     `events-view`) over a few devices. A principal that holds one is
+ *     RESTRICTED to it: the matcher honours nothing else it holds.
+ *   - `addon-routes` — may reach any addon's own `authenticated` HTTP routes
+ *     and data planes (never an `admin` one). A person's session has always
+ *     had this; an integration token never had it and must hold
+ *     `addon:<id>` instead. Only an admin may mint it into a token.
+ *   - `preferences-self` — may read and write the SUBJECT's own account
+ *     preferences (D894), never another user's. Every person's session holds
+ *     it; a unified token holds it only when minted with it. `'*'` does NOT
+ *     imply it: the hub's own mesh principal holds `'*'` and is nobody's
+ *     account.
+ *
+ * Pure: no I/O. It lives in `@camstack/types` so the hub, the kernel and any
+ * addon read the same vocabulary.
+ */
+import { z } from 'zod';
+import { MethodAccessSchema, type TokenScope } from '../schemas/auth-records.js';
+/** The admin scope: every permission. */
+export declare const ADMIN_SCOPE = "*";
+/** At most this many devices in one share-view grant (the share-link bound). */
+export declare const SHARE_VIEW_MAX_DEVICES = 64;
+/** What a share-view grant lets its holder see. */
+export declare const ShareViewGrantSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "events-view": "events-view";
+        "grid-view": "grid-view";
+    }>;
+    deviceIds: z.ZodArray<z.ZodNumber>;
+    talk: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type ShareViewGrant = z.infer<typeof ShareViewGrantSchema>;
+export declare const ShareViewScopeSchema: z.ZodObject<{
+    type: z.ZodLiteral<"share-view">;
+    grant: z.ZodObject<{
+        kind: z.ZodEnum<{
+            "events-view": "events-view";
+            "grid-view": "grid-view";
+        }>;
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        talk: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ShareViewScope = z.infer<typeof ShareViewScopeSchema>;
+export declare const AddonRoutesScopeSchema: z.ZodObject<{
+    type: z.ZodLiteral<"addon-routes">;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>;
+export type AddonRoutesScope = z.infer<typeof AddonRoutesScopeSchema>;
+export declare const PreferencesSelfScopeSchema: z.ZodObject<{
+    type: z.ZodLiteral<"preferences-self">;
+}, z.core.$strip>;
+export type PreferencesSelfScope = z.infer<typeof PreferencesSelfScopeSchema>;
+/** The grant every person's session carries for its own account preferences. */
+export declare const PREFERENCES_SELF_SCOPE: PreferencesSelfScope;
+export declare const CredentialScopeSchema: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodObject<{
+    type: z.ZodLiteral<"share-view">;
+    grant: z.ZodObject<{
+        kind: z.ZodEnum<{
+            "events-view": "events-view";
+            "grid-view": "grid-view";
+        }>;
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        talk: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"addon-routes">;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"preferences-self">;
+}, z.core.$strip>, z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"category">;
+    target: z.ZodEnum<{
+        device: "device";
+        system: "system";
+    }>;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"capability">;
+    target: z.ZodString;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"addon">;
+    target: z.ZodString;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"device">;
+    selector: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"all">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"ids">;
+        ids: z.ZodArray<z.ZodNumber>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"types">;
+        types: z.ZodArray<z.ZodEnum<typeof import("../index.js").DeviceType>>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"locations">;
+        locations: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>], "kind">;
+    access: z.ZodArray<z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        view: "view";
+    }>>;
+    includeLinked: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>], "type">>]>;
+export type CredentialScope = z.infer<typeof CredentialScopeSchema>;
+/** Every access flavour — what a person's session holds on addon routes. */
+export declare const ALL_METHOD_ACCESS: readonly ['view', 'create', 'delete'];
+/** True iff the scope set holds `'*'`. */
+export declare function scopesGrantAdmin(scopes: readonly CredentialScope[]): boolean;
+/**
+ * The share-view grant that RESTRICTS this principal, or `null` when it holds
+ * none. Fail closed: a set that mixes a share-view grant with anything else
+ * is still restricted to its FIRST share-view grant, never widened by the rest.
+ */
+export declare function shareViewGrantOf(scopes: readonly CredentialScope[]): ShareViewGrant | null;
+/** The capability grants the tRPC scope matcher reads. */
+export declare function capabilityScopesOf(scopes: readonly CredentialScope[]): readonly TokenScope[];
+/** True iff the set reaches every addon's own routes at `access`. */
+export declare function scopesAllowAddonRoutes(scopes: readonly CredentialScope[], access: z.infer<typeof MethodAccessSchema>): boolean;
+/**
+ * True iff the set may touch its subject's own account preferences: it holds
+ * `preferences-self` and no share-view grant restricts it. `'*'` alone is not
+ * enough (see the vocabulary above).
+ */
+export declare function scopesAllowOwnPreferences(scopes: readonly CredentialScope[]): boolean;
+/**
+ * Parse a scope array from an untrusted source (a JWT claim, a stored row).
+ * Any element that does not parse makes the WHOLE set unusable — `null` — so
+ * a corrupt grant can never degrade into a partial one.
+ */
+export declare function parseCredentialScopes(raw: unknown): readonly CredentialScope[] | null;
+/**
+ * The `kind` claim of a unified token. It names the TOKEN FAMILY (so every
+ * older gate that classifies a hub JWT refuses it — `classifyBearerPrincipal`
+ * treats any `kind` it does not know as not-a-credential), never what the
+ * token may do: that is its `scopes`, and only its `scopes`.
+ */
+export declare const CREDENTIAL_TOKEN_KIND = "credential";
+/**
+ * The `aud` claim every minted token is signed with (D895). The hub's raw JWT
+ * verify (`AuthManager.verifyToken`, used by every surface that wants a LOGIN
+ * session — the OAuth consent page, the session cookie, health, backups)
+ * refuses a token carrying it, so a minted token — a share link above all —
+ * can never be replayed as a person's session. Only the credential verifier's
+ * own door (`verifyCredentialToken`) accepts it.
+ */
+export declare const CREDENTIAL_TOKEN_AUDIENCE = "camstack:credential";
+/** Does a verified JWT payload belong to the minted-token family? */
+export declare function isCredentialTokenPayload(payload: unknown): boolean;
+/**
+ * The claims of a unified token (`auth.mintToken`). It carries no `exp`: its
+ * row (looked up by `jti` on every verify, for revocation) holds the ONE
+ * expiry, so a share link can be extended and a JWT clock can never disagree
+ * with the row.
+ */
+export declare const CredentialTokenClaimsSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"credential">;
+    sub: z.ZodString;
+    jti: z.ZodString;
+    scopes: z.ZodArray<z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodObject<{
+        type: z.ZodLiteral<"share-view">;
+        grant: z.ZodObject<{
+            kind: z.ZodEnum<{
+                "events-view": "events-view";
+                "grid-view": "grid-view";
+            }>;
+            deviceIds: z.ZodArray<z.ZodNumber>;
+            talk: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"addon-routes">;
+        access: z.ZodArray<z.ZodEnum<{
+            create: "create";
+            delete: "delete";
+            view: "view";
+        }>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"preferences-self">;
+    }, z.core.$strip>, z.ZodPreprocess<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"category">;
+        target: z.ZodEnum<{
+            device: "device";
+            system: "system";
+        }>;
+        access: z.ZodArray<z.ZodEnum<{
+            create: "create";
+            delete: "delete";
+            view: "view";
+        }>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"capability">;
+        target: z.ZodString;
+        access: z.ZodArray<z.ZodEnum<{
+            create: "create";
+            delete: "delete";
+            view: "view";
+        }>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"addon">;
+        target: z.ZodString;
+        access: z.ZodArray<z.ZodEnum<{
+            create: "create";
+            delete: "delete";
+            view: "view";
+        }>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"device">;
+        selector: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"all">;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"ids">;
+            ids: z.ZodArray<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"types">;
+            types: z.ZodArray<z.ZodEnum<typeof import("../index.js").DeviceType>>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"locations">;
+            locations: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>], "kind">;
+        access: z.ZodArray<z.ZodEnum<{
+            create: "create";
+            delete: "delete";
+            view: "view";
+        }>>;
+        includeLinked: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>], "type">>]>>;
+}, z.core.$strip>;
+export type CredentialTokenClaims = z.infer<typeof CredentialTokenClaimsSchema>;

package/dist/auth/principal-scope.d.ts

@@ -114,7 +114,7 @@ export type PrincipalAddonReachVerdict = {
  *    would lock every non-admin viewer out of recorder playback, snapshot media
  *    and the stream-broker embed, which is a worse outcome than the hole.
  *  - **integration** — must hold `addon:<addonId>` at the verb's access. This is
- *    the same rule the `cst_` scoped-token branch has always applied; the JWT
+ *    the same rule the scoped-token branch has always applied; the JWT
  *    branch simply never applied it, and closing that divergence IS the fix.
  *    `isAdmin` is ignored: an integration token is minted `isAdmin: false` and a
  *    token claiming otherwise must not talk its way past the grant.

package/dist/capabilities/index.d.ts

@@ -77,7 +77,7 @@ export { FailureContributionSchema, FailureReasonCountSchema, failureContributio
 export { filesystemBrowseCapability, type IFilesystemBrowseProvider, } from './filesystem-browse.cap.js';
 export { AUTOMATIC_HUB_ADDRESS_FLAGS, checkRoleAddress, HUB_ADDRESS_ROLES, type HubAddressCheck, type HubAddressFlags, type HubAddressRole, type HubAddressRoleResolution, type HubAddressRoles, type HubAddressSource, type HubAppConnectionsResolution, HUB_MDNS_QUERY_NAME, HUB_MDNS_ROLE, HUB_MDNS_SERVICE_TYPE, HUB_MDNS_TXT_KEYS, AGENT_MDNS_QUERY_NAME, AGENT_MDNS_SERVICE_TYPE, AGENT_MDNS_TXT_KEYS, hubAddressHostname, isDefaultAppConnectionEndpoint, isSingleHubAddressRole, PUBLIC_ENDPOINT_HTTP_REASON, resolveAppConnections, resolveHubAddressRoles, resolveInternalAddress, resolveNotificationTapAddress, resolvePublicEndpoint, SINGLE_HUB_ADDRESS_ROLES, type SingleHubAddressRole, selectAppConnectionEndpoints, validateCustomAddress, } from './hub-address.js';
 export { addonCatalogHref } from './addon-catalog-href.js';
-export { type HfModelResolution, HfModelResolutionSchema, type ILlmProvider, type LlmDefault, LlmDefaultSchema, type LlmDefaultSelector, LlmDefaultSelectorSchema, type LlmProfile, type LlmProfileKind, type LlmProfileKindDescriptor, LlmProfileKindDescriptorSchema, LlmProfileKindSchema, LlmProfileSchema, type LlmRuntimeNode, LlmRuntimeNodeSchema, type LlmUsageRollup, LlmUsageRollupSchema, llmCapability, type ManagedModelCatalogEntry, ManagedModelCatalogEntrySchema, } from './llm.cap.js';
+export { type HfModelResolution, HfModelResolutionSchema, type ILlmProvider, type LlmDefault, LlmDefaultSchema, type LlmDefaultSelector, LlmDefaultSelectorSchema, LLM_PROFILE_KIND_PATTERN, type LlmListModelsErrorCode, LlmListModelsErrorCodeSchema, type LlmListModelsInput, LlmListModelsInputSchema, type LlmListModelsResult, LlmListModelsResultSchema, type LlmModelFeatures, LlmModelFeaturesSchema, type LlmModelInfo, LlmModelInfoSchema, type LlmProfile, type LlmProfileField, LlmProfileFieldSchema, type LlmProfileKind, type LlmProfileKindDescriptor, LlmProfileKindDescriptorSchema, LlmProfileKindSchema, LlmProfileSchema, type LlmProviderConfig, LlmProviderConfigSchema, type LlmProviderWidget, LlmProviderWidgetSchema, type LlmRuntimeNode, LlmRuntimeNodeSchema, type LlmUsageRollup, LlmUsageRollupSchema, llmCapability, type ManagedModelCatalogEntry, ManagedModelCatalogEntrySchema, } from './llm.cap.js';
 export { type RawSecretMigrationInput, RawSecretMigrationInputSchema, type RawSecretMigrationReport, RawSecretMigrationReportSchema, } from './raw-secret-migration.js';
 export { type AppleFmAvailability, AppleFmAvailabilitySchema, type AppleFmUnavailableReason, AppleFmUnavailableReasonSchema, type ILlmRuntimeProvider, type LlmDownloadProgress, LlmDownloadProgressSchema, type LlmNodeModel, LlmNodeModelSchema, type LlmRuntimeAppleCompleteInput, LlmRuntimeAppleCompleteInputSchema, type LlmRuntimeCancelInput, LlmRuntimeCancelInputSchema, type LlmRuntimeCompleteInput, LlmRuntimeCompleteInputSchema, type LlmRuntimeDiskUsage, LlmRuntimeDiskUsageSchema, type LlmRuntimeStatus, LlmRuntimeStatusSchema, llmRuntimeCapability, type ManagedModelExtraFile, ManagedModelExtraFileSchema, type ManagedModelRef, ManagedModelRefSchema, type ManagedRuntimeConfig, ManagedRuntimeConfigSchema, } from './llm-runtime.cap.js';
 export { type LlmErrorCode, LlmErrorCodeSchema, type LlmGenerateBaseInput, LlmGenerateBaseInputSchema, type LlmGenerateErr, LlmGenerateErrSchema, type LlmGenerateOk, LlmGenerateOkSchema, type LlmGenerateResult, LlmGenerateResultSchema, type LlmImage, LlmImageSchema, type LlmRefusalSource, LlmRefusalSourceSchema, type LlmRetryPolicy, LlmRetryPolicySchema, LlmTimeoutDefaults, type LlmUsage, LlmUsageSchema, } from './llm-shared.js';
@@ -238,7 +238,7 @@ export { type ITamperProvider, type TamperStatus, TamperStatusSchema, tamperCapa
 export { type ITemperatureSensorProvider, type TemperatureSensorStatus, TemperatureSensorStatusSchema, temperatureSensorCapability, } from './temperature-sensor.cap.js';
 export { type IToastProvider, ToastSchema, toastCapability } from './toast.cap.js';
 export { type IUpdateProvider, type UpdateStatus, UpdateStatusSchema, updateCapability, } from './update.cap.js';
-export { ApiKeySummarySchema, CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, CreateUserInputSchema, ExternalIdentityKeySchema, ExternalIdentitySchema, type IUserManagementProvider, ScopedTokenSummarySchema, UpdateUserInputSchema, UserSummarySchema, userManagementCapability, } from './user-management.cap.js';
+export { ApiKeySummarySchema, CreateUserInputSchema, ExternalIdentityKeySchema, ExternalIdentitySchema, type IUserManagementProvider, UpdateUserInputSchema, UserSummarySchema, userManagementCapability, } from './user-management.cap.js';
 export { type IVacuumControlProvider, type TankStatus, TankStatusSchema, type VacuumControlStatus, VacuumControlStatusSchema, type VacuumState, VacuumStateSchema, vacuumControlCapability, } from './vacuum-control.cap.js';
 export { type IValveProvider, type ValveState, ValveStateSchema, type ValveStatus, ValveStatusSchema, valveCapability, } from './valve.cap.js';
 export { type IVibrationProvider, type VibrationStatus, VibrationStatusSchema, vibrationCapability, } from './vibration.cap.js';