camstack 1.2.189 → 1.2.191

package/dist/cli.js

@@ -37,7 +37,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-LKHQ7I4L.js");
+  await import("./launcher-AZI5I6X5.js");
 }
 
 // src/commands/agent.ts
@@ -82,7 +82,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-LKHQ7I4L.js");
+  await import("./launcher-AZI5I6X5.js");
 }
 
 // src/commands/setup.ts
@@ -91,7 +91,7 @@ import * as path from "path";
 import * as fs from "fs";
 import { parseArgs as parseArgs3 } from "util";
 
-// ../types/dist/event-category-BvOFi6PY.mjs
+// ../types/dist/event-category-DOl51-Ij.mjs
 var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
   EventCategory2["SystemBoot"] = "system.boot";
   EventCategory2["SystemAddonsReady"] = "system.addons-ready";
@@ -111,6 +111,7 @@ var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
   EventCategory2["AddonRunnerRefused"] = "addon.runner-refused";
   EventCategory2["ProcessStateChanged"] = "process.state-changed";
   EventCategory2["SystemRunnerCheck"] = "system.runner-check";
+  EventCategory2["AlertEpisode"] = "alert.episode";
   EventCategory2["AddonError"] = "addon.error";
   EventCategory2["AddonPageReady"] = "addon.page-ready";
   EventCategory2["AddonWidgetReady"] = "addon.widget-ready";
@@ -14772,7 +14773,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-BegKjwUu.mjs
+// ../types/dist/sleep-BxjU_fJM.mjs
 var AUDIO_CHUNK_FORMATS = [
   "f32le",
   "pcmu",
@@ -14967,6 +14968,7 @@ var WELL_KNOWN_TABS = [
 ];
 var WELL_KNOWN_TAB_MAP = Object.fromEntries(WELL_KNOWN_TABS.map((t) => [t.id, t]));
 var SECRET_RETRY_MAX_MS = 5 * 6e4;
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 var PEER_BYTES_CHUNK_BYTES = 256 * 1024;
 var PeerBytesTicketSchema = external_exports.object({
   /** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -18451,6 +18453,150 @@ var ConvertResultSchema = external_exports.object({
   entry: ModelCatalogEntrySchema,
   artifacts: external_exports.array(ConvertArtifactSchema).readonly()
 });
+var MethodAccessSchema = external_exports.enum([
+  "view",
+  "create",
+  "delete"
+]);
+var AllowedProviderSchema = external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]);
+var AllowedDevicesSchema = external_exports.record(external_exports.string(), external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]));
+var CapScopeSchema = external_exports.enum(["device", "system"]);
+var DeviceSelectorSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("all") }),
+  external_exports.object({
+    kind: external_exports.literal("ids"),
+    ids: external_exports.array(external_exports.number().int()).min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("types"),
+    types: external_exports.array(external_exports.enum(DeviceType)).min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("locations"),
+    locations: external_exports.array(external_exports.string().min(1)).min(1)
+  })
+]);
+var DeviceTokenScopeSchema = external_exports.object({
+  type: external_exports.literal("device"),
+  /** The device SET this grant covers — resolved against the live fleet. */
+  selector: DeviceSelectorSchema,
+  access: external_exports.array(MethodAccessSchema).min(1),
+  /**
+  * Whether a grant on a PARENT device transparently covers its accessory
+  * CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+  * Direction is parent → children ONLY.
+  *
+  * Absent → the matcher DERIVES it from the access flavour: `view`
+  * inherits (a camera viewer sees the camera's accessories), `create` /
+  * `delete` do NOT (actuating/removing a child is an explicit act the
+  * operator must grant on the child, not inherit from the parent). Set it
+  * explicitly to override that default per grant.
+  */
+  includeLinked: external_exports.boolean().optional()
+});
+function migrateLegacyTokenScope(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+  if (Reflect.get(raw, "type") !== "device") return raw;
+  if (Reflect.get(raw, "selector") !== void 0) return raw;
+  const targets = Reflect.get(raw, "targets");
+  if (!Array.isArray(targets)) return raw;
+  return {
+    type: "device",
+    selector: {
+      kind: "ids",
+      ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+    },
+    access: Reflect.get(raw, "access")
+  };
+}
+var TokenScopeSchema = external_exports.preprocess(migrateLegacyTokenScope, external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    type: external_exports.literal("category"),
+    target: CapScopeSchema,
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  external_exports.object({
+    type: external_exports.literal("capability"),
+    target: external_exports.string(),
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  external_exports.object({
+    type: external_exports.literal("addon"),
+    target: external_exports.string(),
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  DeviceTokenScopeSchema
+]));
+var UserRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  username: external_exports.string(),
+  passwordHash: external_exports.string(),
+  /**
+  * Admin bypass. When true, the middleware skips the scope-access
+  * check entirely. There is no other axis of privilege; the legacy
+  * role enum collapsed onto this boolean in v2.
+  */
+  isAdmin: external_exports.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  /**
+  * Scopes granted to this user. Admins bypass; their `scopes` is
+  * ignored. Non-admins without scopes are locked out of every
+  * protected call.
+  */
+  scopes: external_exports.array(TokenScopeSchema).default([]),
+  createdAt: external_exports.number(),
+  updatedAt: external_exports.number()
+});
+var ApiKeyRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string(),
+  isAdmin: external_exports.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  tokenHash: external_exports.string(),
+  tokenPrefix: external_exports.string(),
+  createdAt: external_exports.number(),
+  lastUsedAt: external_exports.number().optional()
+});
+var ScopedTokenSchema = external_exports.object({
+  id: external_exports.string(),
+  userId: external_exports.string(),
+  name: external_exports.string(),
+  tokenHash: external_exports.string(),
+  tokenPrefix: external_exports.string(),
+  scopes: external_exports.array(TokenScopeSchema),
+  expiresAt: external_exports.number().nullish(),
+  lastUsedAt: external_exports.number().nullish(),
+  createdAt: external_exports.number()
+});
+var ShareViewGrantSchema = external_exports.object({
+  kind: external_exports.enum(SHARE_VIEW_KINDS),
+  deviceIds: external_exports.array(external_exports.number().int().nonnegative()).min(1).max(64),
+  /** Talk-back, opt-in at mint time; absent means off. */
+  talk: external_exports.boolean().optional()
+});
+var ShareViewScopeSchema = external_exports.object({
+  type: external_exports.literal("share-view"),
+  grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = external_exports.object({
+  type: external_exports.literal("addon-routes"),
+  access: external_exports.array(MethodAccessSchema).min(1)
+});
+var CredentialScopeSchema = external_exports.union([
+  external_exports.literal("*"),
+  ShareViewScopeSchema,
+  AddonRoutesScopeSchema,
+  TokenScopeSchema
+]);
+var CREDENTIAL_TOKEN_KIND = "credential";
+var CredentialTokenClaimsSchema = external_exports.object({
+  kind: external_exports.literal(CREDENTIAL_TOKEN_KIND),
+  sub: external_exports.string().min(1),
+  jti: external_exports.string().min(16),
+  scopes: external_exports.array(CredentialScopeSchema).min(1)
+});
 var AppFlowPurposeSchema = external_exports.enum(["new-session", "step-up"]);
 var AppPageLangSchema = external_exports.enum(["en", "it"]);
 var APP_FLOW_REFUSAL_MESSAGES = {
@@ -19086,7 +19232,14 @@ var AlertSeveritySchema = external_exports.enum([
 ]);
 var AlertActionSchema = external_exports.object({
   label: external_exports.string(),
-  href: external_exports.string().optional()
+  href: external_exports.string().optional(),
+  /**
+  * How `href` is followed. Absent / `app`: an admin-ui route (client-side).
+  * `server`: a route the HUB serves (an addon HTTP route such as an OAuth
+  * start) — the browser must leave the SPA with a full navigation, because
+  * the SPA has no such route and would bounce to the home page.
+  */
+  navigation: external_exports.enum(["app", "server"]).optional()
 });
 var AlertStatusSchema = external_exports.enum([
   "active",
@@ -48535,6 +48688,9 @@ var NcSystemEventKindSchema = external_exports.enum([
   "server-updated",
   "export-completed",
   "backup-completed",
+  "alert-critical",
+  "alert-error",
+  "alert-critical-resolved",
   "camera-online",
   "camera-offline",
   "camera-disabled",
@@ -50253,123 +50409,6 @@ var notificationRulesCapability = {
     getAlarmSensors: method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" })
   }
 };
-var MethodAccessSchema = external_exports.enum([
-  "view",
-  "create",
-  "delete"
-]);
-var AllowedProviderSchema = external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]);
-var AllowedDevicesSchema = external_exports.record(external_exports.string(), external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]));
-var CapScopeSchema = external_exports.enum(["device", "system"]);
-var DeviceSelectorSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({ kind: external_exports.literal("all") }),
-  external_exports.object({
-    kind: external_exports.literal("ids"),
-    ids: external_exports.array(external_exports.number().int()).min(1)
-  }),
-  external_exports.object({
-    kind: external_exports.literal("types"),
-    types: external_exports.array(external_exports.enum(DeviceType)).min(1)
-  }),
-  external_exports.object({
-    kind: external_exports.literal("locations"),
-    locations: external_exports.array(external_exports.string().min(1)).min(1)
-  })
-]);
-var DeviceTokenScopeSchema = external_exports.object({
-  type: external_exports.literal("device"),
-  /** The device SET this grant covers — resolved against the live fleet. */
-  selector: DeviceSelectorSchema,
-  access: external_exports.array(MethodAccessSchema).min(1),
-  /**
-  * Whether a grant on a PARENT device transparently covers its accessory
-  * CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-  * Direction is parent → children ONLY.
-  *
-  * Absent → the matcher DERIVES it from the access flavour: `view`
-  * inherits (a camera viewer sees the camera's accessories), `create` /
-  * `delete` do NOT (actuating/removing a child is an explicit act the
-  * operator must grant on the child, not inherit from the parent). Set it
-  * explicitly to override that default per grant.
-  */
-  includeLinked: external_exports.boolean().optional()
-});
-function migrateLegacyTokenScope(raw) {
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-  if (Reflect.get(raw, "type") !== "device") return raw;
-  if (Reflect.get(raw, "selector") !== void 0) return raw;
-  const targets = Reflect.get(raw, "targets");
-  if (!Array.isArray(targets)) return raw;
-  return {
-    type: "device",
-    selector: {
-      kind: "ids",
-      ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-    },
-    access: Reflect.get(raw, "access")
-  };
-}
-var TokenScopeSchema = external_exports.preprocess(migrateLegacyTokenScope, external_exports.discriminatedUnion("type", [
-  external_exports.object({
-    type: external_exports.literal("category"),
-    target: CapScopeSchema,
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  external_exports.object({
-    type: external_exports.literal("capability"),
-    target: external_exports.string(),
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  external_exports.object({
-    type: external_exports.literal("addon"),
-    target: external_exports.string(),
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  DeviceTokenScopeSchema
-]));
-var UserRecordSchema = external_exports.object({
-  id: external_exports.string(),
-  username: external_exports.string(),
-  passwordHash: external_exports.string(),
-  /**
-  * Admin bypass. When true, the middleware skips the scope-access
-  * check entirely. There is no other axis of privilege; the legacy
-  * role enum collapsed onto this boolean in v2.
-  */
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  /**
-  * Scopes granted to this user. Admins bypass; their `scopes` is
-  * ignored. Non-admins without scopes are locked out of every
-  * protected call.
-  */
-  scopes: external_exports.array(TokenScopeSchema).default([]),
-  createdAt: external_exports.number(),
-  updatedAt: external_exports.number()
-});
-var ApiKeyRecordSchema = external_exports.object({
-  id: external_exports.string(),
-  label: external_exports.string(),
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  tokenHash: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  createdAt: external_exports.number(),
-  lastUsedAt: external_exports.number().optional()
-});
-var ScopedTokenSchema = external_exports.object({
-  id: external_exports.string(),
-  userId: external_exports.string(),
-  name: external_exports.string(),
-  tokenHash: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  scopes: external_exports.array(TokenScopeSchema),
-  expiresAt: external_exports.number().nullish(),
-  lastUsedAt: external_exports.number().nullish(),
-  createdAt: external_exports.number()
-});
 var OauthIntegrationDescriptorSchema = external_exports.object({
   /** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
   integrationId: external_exports.string(),
@@ -57900,6 +57939,18 @@ var storageMigrationCapability = {
     */
     movers: method(external_exports.object({}), external_exports.array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }),
     /**
+    * May a mover that touches these locations run NOW? One claim per physical
+    * root is owned by the storage orchestrator: a single-location repoint holds
+    * it while it carries its subtree, and a mover (`relocateMedia`,
+    * `relocateFootage`, a migration move) asks here AFTER registering its job and
+    * cancels itself on `clear: false`. The repoint, in turn, refuses while a
+    * registered mover touches its root. Asked, never polled (D3).
+    */
+    moverClearance: method(external_exports.object({ locationIds: external_exports.array(external_exports.string()).readonly() }), external_exports.object({
+      clear: external_exports.boolean(),
+      repointLocationId: external_exports.string().optional()
+    }), { auth: "admin" }),
+    /**
     * What each class's SOURCE still holds, from the archive — never from the
     * resident index (D295). Only classes with something left (or something
     * unknown) are listed, so an empty list means there is nothing to drain and
@@ -62115,43 +62166,139 @@ var DishwasherStateSchema = external_exports.enum([
   "error",
   "unavailable"
 ]);
+var DishwasherOperationStateSchema = external_exports.enum([
+  "Inactive",
+  "Ready",
+  "DelayedStart",
+  "Run",
+  "Pause",
+  "ActionRequired",
+  "Finished",
+  "Error",
+  "Aborting"
+]);
+var DishwasherAvailabilitySchema = external_exports.enum([
+  "available",
+  "offline",
+  "description-missing"
+]);
 var DishwasherConsumableLevelSchema = external_exports.enum([
   "ok",
   "low",
   "empty"
 ]);
 var DishwasherStatusSchema = external_exports.object({
+  availability: DishwasherAvailabilitySchema,
+  /** Coarse state for compact surfaces; `unavailable` whenever the appliance state is not known. */
   state: DishwasherStateSchema,
-  /** Active program id/name, or null when none selected / unknown. */
+  /** The appliance's operation state as reported; null when not known. */
+  operationState: DishwasherOperationStateSchema.nullable(),
+  /** Feature key of the ACTIVE (running) program, or null when none runs / not known. */
   program: external_exports.string().nullable(),
-  /** Program tokens the hardware accepts — drives the UI selector. */
+  /** Feature key of the SELECTED program (what Start would run), or null when none / not known. */
+  selectedProgram: external_exports.string().nullable(),
+  /** Feature keys of the programs the appliance currently offers — drives the UI selector. */
   availablePrograms: external_exports.array(external_exports.string()),
-  /** Minutes remaining on the active cycle, or null when not running. */
-  remainingMinutes: external_exports.number().int().nonnegative().nullable(),
+  /** Seconds remaining on the active cycle, or null when not running / not known. */
+  remainingSeconds: external_exports.number().int().nonnegative().nullable(),
+  /** Seconds the delayed start is set to (time until the cycle starts), or null. */
+  delayedStartSeconds: external_exports.number().int().nonnegative().nullable(),
   /** Cycle completion 0..100, or null when not applicable. */
   progressPercent: external_exports.number().min(0).max(100).nullable(),
-  /** True when the door is reported open. */
-  doorOpen: external_exports.boolean(),
-  /** True when remote start is allowed (door closed, power on, etc.). */
-  remoteStartAllowed: external_exports.boolean(),
-  /** Main power / switched-on state. */
-  powerOn: external_exports.boolean(),
+  /** True when the door is reported open; null when the door state is not known. */
+  doorOpen: external_exports.boolean().nullable(),
+  /** True when the door is latched (locked) during a cycle; null when not reported. */
+  doorLocked: external_exports.boolean().nullable(),
+  /** True when remote start is allowed (door closed, power on, etc.); null when not known. */
+  remoteStartAllowed: external_exports.boolean().nullable(),
+  /** True when the appliance accepts remote control now; null when not known. */
+  remoteControlActive: external_exports.boolean().nullable(),
+  /** True while somebody operates the appliance at its panel; null when not reported. */
+  localControlActive: external_exports.boolean().nullable(),
+  /** Main power / switched-on state; null when not known. */
+  powerOn: external_exports.boolean().nullable(),
+  /** The raw power state (`On`, `Off`, `Standby`, …); null when not known. */
+  powerState: external_exports.string().nullable(),
   saltLevel: DishwasherConsumableLevelSchema.nullable(),
   rinseAidLevel: DishwasherConsumableLevelSchema.nullable(),
-  halfLoad: external_exports.boolean(),
-  hygienePlus: external_exports.boolean(),
+  /** Option states: null when the appliance does not expose the option or has not said. */
+  halfLoad: external_exports.boolean().nullable(),
+  hygienePlus: external_exports.boolean().nullable(),
   /** Extra dry option when the appliance exposes it. */
-  extraDry: external_exports.boolean(),
+  extraDry: external_exports.boolean().nullable(),
   /** Intensive zone (lower basket) when the appliance exposes it. */
-  intensiveZone: external_exports.boolean(),
+  intensiveZone: external_exports.boolean().nullable(),
   /** VarioSpeed / VarioSpeed+ when the appliance exposes it. */
-  varioSpeedPlus: external_exports.boolean(),
-  /** Child lock (controls disabled on the appliance). */
-  childLock: external_exports.boolean(),
+  varioSpeedPlus: external_exports.boolean().nullable(),
+  /** Child lock (controls disabled on the appliance); null when not known. */
+  childLock: external_exports.boolean().nullable(),
+  /** Feature keys of the events currently raised (salt low, rinse aid low, program finished, …). */
+  activeEvents: external_exports.array(external_exports.string()),
+  /** Numeric error code when the appliance reports one; null otherwise. */
   errorCode: external_exports.number().nullable(),
+  /** Name of the raised alert-level event while the appliance is in error; null otherwise. */
   errorLabel: external_exports.string().nullable(),
+  /** Ms epoch of the last value received from the appliance; 0 = never. */
   lastFetchedAt: external_exports.number()
 });
+var DeviceIdSchema = external_exports.number().int().nonnegative();
+var DishwasherValueSchema = external_exports.union([
+  external_exports.boolean(),
+  external_exports.string(),
+  external_exports.number()
+]);
+var DishwasherAccessSchema = external_exports.enum([
+  "none",
+  "read",
+  "readWrite",
+  "writeOnly",
+  "readStatic"
+]);
+var DishwasherOptionDescriptorSchema = external_exports.object({
+  /** Feature key (`Dishcare.Dishwasher.Option.ExtraDry`). */
+  key: external_exports.string(),
+  /** Last segment of the key, for display. */
+  name: external_exports.string(),
+  type: external_exports.enum([
+    "boolean",
+    "number",
+    "enum",
+    "string"
+  ]),
+  access: DishwasherAccessSchema,
+  /** The appliance reports this entity as currently available. */
+  available: external_exports.boolean(),
+  /** Unit the description declares for a number; null when it declares none. */
+  unit: external_exports.string().nullable(),
+  min: external_exports.number().nullable(),
+  max: external_exports.number().nullable(),
+  step: external_exports.number().nullable(),
+  /** Allowed members of an enum; null for other types. */
+  enumValues: external_exports.array(external_exports.string()).nullable(),
+  defaultValue: DishwasherValueSchema.nullable()
+});
+var DishwasherProgramSchema = external_exports.object({
+  /** Feature key (`Dishcare.Dishwasher.Program.Eco50`) — what `setProgram` / `start` take. */
+  key: external_exports.string(),
+  name: external_exports.string(),
+  /** The appliance currently offers this program. */
+  available: external_exports.boolean(),
+  /** The options this program lists, with the program-level access / availability / default. */
+  options: external_exports.array(DishwasherOptionDescriptorSchema)
+});
+var DishwasherOptionsSchema = external_exports.object({
+  availability: DishwasherAvailabilitySchema,
+  /** What the appliance can be told to do, from the commands its description declares. */
+  supportsStart: external_exports.boolean(),
+  supportsPause: external_exports.boolean(),
+  supportsResume: external_exports.boolean(),
+  supportsStop: external_exports.boolean(),
+  supportsPower: external_exports.boolean(),
+  /** Every program the description lists, with its options. */
+  programs: external_exports.array(DishwasherProgramSchema),
+  /** Every option and setting entity the description lists (programs reference these by key). */
+  options: external_exports.array(DishwasherOptionDescriptorSchema)
+});
 var dishwasherCapability = {
   name: "dishwasher",
   scope: "device",
@@ -62159,86 +62306,102 @@ var dishwasherCapability = {
   mode: "singleton",
   deviceTypes: [DeviceType.Dishwasher],
   methods: {
-    start: method(external_exports.object({ deviceId: external_exports.number().int().nonnegative() }), external_exports.void(), {
+    /**
+    * Start a program. Without `program` the selected one starts. `options` are
+    * option feature keys; each is checked against the program's constraints.
+    */
+    start: method(external_exports.object({
+      deviceId: DeviceIdSchema,
+      program: external_exports.string().min(1).optional(),
+      options: external_exports.record(external_exports.string(), DishwasherValueSchema).optional()
+    }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
-    pause: method(external_exports.object({ deviceId: external_exports.number().int().nonnegative() }), external_exports.void(), {
+    pause: method(external_exports.object({ deviceId: DeviceIdSchema }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
-    stop: method(external_exports.object({ deviceId: external_exports.number().int().nonnegative() }), external_exports.void(), {
+    resume: method(external_exports.object({ deviceId: DeviceIdSchema }), external_exports.void(), {
+      kind: "mutation",
+      auth: "protected"
+    }),
+    stop: method(external_exports.object({ deviceId: DeviceIdSchema }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
+    /** Select (not start) a program; refused when the appliance does not offer it. */
     setProgram: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       program: external_exports.string().min(1)
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
     setPower: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       on: external_exports.boolean()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
     setHalfLoad: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       on: external_exports.boolean()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
     setHygienePlus: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       on: external_exports.boolean()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
     setExtraDry: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       on: external_exports.boolean()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
     setIntensiveZone: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       on: external_exports.boolean()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
     setVarioSpeedPlus: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       on: external_exports.boolean()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
     setChildLock: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       on: external_exports.boolean()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
     }),
+    /**
+    * Write any option or setting by feature key. Refused when the description does
+    * not list it, it is not writable or not available now, or the value is outside
+    * its declared range / members.
+    */
     setOption: method(external_exports.object({
-      deviceId: external_exports.number().int().nonnegative(),
+      deviceId: DeviceIdSchema,
       key: external_exports.string().min(1),
-      value: external_exports.union([
-        external_exports.boolean(),
-        external_exports.string(),
-        external_exports.number()
-      ])
+      value: DishwasherValueSchema
     }), external_exports.void(), {
       kind: "mutation",
       auth: "protected"
-    })
+    }),
+    /** What this appliance can do, from its own description — the UI is derived from it. */
+    getOptions: method(external_exports.object({ deviceId: DeviceIdSchema }), DishwasherOptionsSchema, { auth: "protected" })
   },
   status: {
     schema: DishwasherStatusSchema,
@@ -74012,6 +74175,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "dishwasher.getOptions": {
+    capName: "dishwasher",
+    capScope: "device",
+    addonId: null,
+    access: "view"
+  },
   "dishwasher.getStatus": {
     capName: "dishwasher",
     capScope: "device",
@@ -74024,6 +74193,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "dishwasher.resume": {
+    capName: "dishwasher",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "dishwasher.setChildLock": {
     capName: "dishwasher",
     capScope: "device",
@@ -78524,6 +78699,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "storageMigration.moverClearance": {
+    capName: "storage-migration",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "storageMigration.movers": {
     capName: "storage-migration",
     capScope: "system",
@@ -80767,6 +80948,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "dishwasher.getOptions": [{
+    name: "deviceId",
+    form: "single",
+    optional: false
+  }],
   "dishwasher.getStatus": [{
     name: "deviceId",
     form: "single",
@@ -80777,6 +80963,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "dishwasher.resume": [{
+    name: "deviceId",
+    form: "single",
+    optional: false
+  }],
   "dishwasher.setChildLock": [{
     name: "deviceId",
     form: "single",
@@ -83062,6 +83253,9 @@ var NC_SYSTEM_EVENT_FAMILY = {
   "wrapper-update-available": "system",
   "backup-completed": "system",
   "export-completed": "system",
+  "alert-critical": "system",
+  "alert-error": "system",
+  "alert-critical-resolved": "system",
   "storage-location-low": "system",
   "storage-location-critical": "system",
   "storage-location-ok": "system",
@@ -83187,6 +83381,16 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
       "storage-location-ok"
     ]
   },
+  {
+    id: "alerts",
+    family: "system",
+    label: "Alerts",
+    kinds: [
+      "alert-critical",
+      "alert-error",
+      "alert-critical-resolved"
+    ]
+  },
   {
     id: "alarm",
     family: "alarm",
@@ -83208,6 +83412,21 @@ var NC_SENSOR_RAISED_FIELD_BY_KIND = Object.freeze(Object.fromEntries(Object.ent
   return [[descriptor.kind, field]];
 })));
 var NC_SENSOR_TRANSITION_KINDS = Object.freeze(Object.keys(NC_SENSOR_RAISED_FIELD_BY_KIND));
+var AlertEpisodePayloadSchema = external_exports.object({
+  phase: external_exports.enum(["raised", "resolved"]),
+  episodeId: external_exports.string().min(1),
+  alertId: external_exports.string().min(1),
+  severity: AlertSeveritySchema,
+  category: external_exports.string(),
+  title: external_exports.string(),
+  message: external_exports.string(),
+  sourceType: external_exports.string().optional(),
+  sourceId: external_exports.string().optional(),
+  nodeId: external_exports.string().optional(),
+  /** The alert's own action link (where the operator acts on it), when it has one. */
+  actionUrl: external_exports.string().optional(),
+  at: external_exports.number()
+});
 var RULE_BODY_ONLY = ["body"];
 var RULE_TEXT = ["title", "body"];
 var BATTERY = ["device-battery-low", "device-battery-normal"];
@@ -83217,6 +83436,11 @@ var TANK = [
   "device-tank-full",
   "device-tank-normal"
 ];
+var ALERT_EPISODE = [
+  "alert-critical",
+  "alert-error",
+  "alert-critical-resolved"
+];
 var UPDATES = [
   "addon-update-available",
   "server-update-available",
@@ -83738,7 +83962,8 @@ var NC_TEMPLATE_VARS = [
       "server-updated",
       "storage-location-low",
       "storage-location-critical",
-      "storage-location-ok"
+      "storage-location-ok",
+      ...ALERT_EPISODE
     ]
   },
   {
@@ -83760,7 +83985,8 @@ var NC_TEMPLATE_VARS = [
       "server-updated",
       "storage-location-low",
       "storage-location-critical",
-      "storage-location-ok"
+      "storage-location-ok",
+      ...ALERT_EPISODE
     ]
   },
   {
@@ -83827,7 +84053,7 @@ var NC_TEMPLATE_VARS = [
     families: ["rule"],
     fields: [...RULE_TEXT],
     kinds: ["system"],
-    systemEventKinds: ["recording-degraded"]
+    systemEventKinds: ["recording-degraded", ...ALERT_EPISODE]
   },
   {
     name: "locationName",
@@ -84024,13 +84250,53 @@ var NC_TEMPLATE_VARS = [
   },
   {
     name: "title",
-    label: "Export title",
+    label: "Export or alert title",
     example: "Ingresso 08:00",
     group: "system",
     families: ["rule"],
     fields: [...RULE_TEXT],
     kinds: ["system"],
-    systemEventKinds: ["export-completed"]
+    systemEventKinds: ["export-completed", ...ALERT_EPISODE]
+  },
+  {
+    name: "severity",
+    label: "Alert severity",
+    example: "critical",
+    group: "system",
+    families: ["rule"],
+    fields: [...RULE_TEXT],
+    kinds: ["system"],
+    systemEventKinds: [...ALERT_EPISODE]
+  },
+  {
+    name: "category",
+    label: "Alert category",
+    example: "addon.runner-failed",
+    group: "system",
+    families: ["rule"],
+    fields: [...RULE_TEXT],
+    kinds: ["system"],
+    systemEventKinds: [...ALERT_EPISODE]
+  },
+  {
+    name: "source",
+    label: "Alert source (addon, node or runner)",
+    example: "recorder",
+    group: "system",
+    families: ["rule"],
+    fields: [...RULE_TEXT],
+    kinds: ["system"],
+    systemEventKinds: [...ALERT_EPISODE]
+  },
+  {
+    name: "actionUrl",
+    label: "Alert action link",
+    example: "/system/addons",
+    group: "system",
+    families: ["rule"],
+    fields: [...RULE_TEXT],
+    kinds: ["system"],
+    systemEventKinds: [...ALERT_EPISODE]
   },
   {
     name: "exportId",
@@ -85715,6 +85981,7 @@ import * as clack from "@clack/prompts";
 import {
   clearSession,
   defaultSession,
+  jwtClaims,
   listSessions,
   loadSession,
   saveSession
@@ -85730,20 +85997,11 @@ import {
   validateHubAddress
 } from "@camstack/develop";
 import {
-  discoverHubs,
-  normalizeHubUrl
+  discoverHubs
 } from "@camstack/develop/hub-discovery";
-var ADMIN_TOKEN_SUFFIX = ".admin-token";
 function validateManualHubUrl(value) {
   return validateHubAddress(value);
 }
-function hubUrlFromAdminTokenFile(fileName) {
-  if (!fileName.endsWith(ADMIN_TOKEN_SUFFIX)) return null;
-  const slug = fileName.slice(0, -ADMIN_TOKEN_SUFFIX.length);
-  const match = /^(.+?)_(\d{1,5})$/.exec(slug);
-  const candidate = match ? `https://${match[1]}:${match[2]}` : `https://${slug}`;
-  return normalizeHubUrl(candidate)?.url ?? null;
-}
 function knownHubCandidates(deps) {
   const dir = deps.sessionDir ?? defaultSessionDir();
   const env = deps.env ?? process.env;
@@ -85766,9 +86024,6 @@ function knownHubCandidates(deps) {
         }
       } catch {
       }
-    } else {
-      const url2 = hubUrlFromAdminTokenFile(file2);
-      if (url2 !== null) out.push({ url: url2, source: "saved admin token" });
     }
   }
   const fromEnv = resolveHubUrl({ env, session: null });
@@ -85896,30 +86151,32 @@ function isLoginPayload(value) {
   const u = v.user;
   return typeof u.id === "string" && typeof u.username === "string";
 }
-function isLogoutPayload(value) {
-  if (value === null || typeof value !== "object") return false;
-  return Reflect.get(value, "success") === true && typeof Reflect.get(value, "revoked") === "number";
-}
-var SCOPED_TOKEN_PREFIX = "cst_";
-var ADMIN_TOKEN_PREFIX = "csa_";
-async function revokePriorSession(server, prior, authJwt) {
-  if (prior.token.startsWith(SCOPED_TOKEN_PREFIX) && prior.tokenId) {
-    await callTrpcMutation(
-      `${server}/trpc/userManagement.revokeScopedToken?batch=1`,
-      `Bearer ${authJwt}`,
-      { id: prior.tokenId },
-      isUnknown
-    );
-    return;
+function revocationFor(session) {
+  if (session.tokenId) {
+    return {
+      procedure: "userManagement.revokeScopedToken",
+      input: { id: session.tokenId },
+      bearer: "fresh"
+    };
   }
-  if (!prior.token.startsWith(SCOPED_TOKEN_PREFIX) && !prior.token.startsWith(ADMIN_TOKEN_PREFIX)) {
-    await callTrpcMutation(
-      `${server}/trpc/auth.logout?batch=1`,
-      `Bearer ${prior.token}`,
-      {},
-      isLogoutPayload
-    );
+  if (jwtClaims(session.token) !== null) {
+    return { procedure: "auth.logout", input: {}, bearer: "self" };
   }
+  return null;
+}
+async function performRevocation(server, session, freshJwt) {
+  const r = revocationFor(session);
+  if (!r) return;
+  const bearer = r.bearer === "fresh" && freshJwt ? freshJwt : session.token;
+  await callTrpcMutation(
+    `${server}/trpc/${r.procedure}?batch=1`,
+    `Bearer ${bearer}`,
+    r.input,
+    isUnknown
+  );
+}
+async function revokePriorSession(server, prior, authJwt) {
+  await performRevocation(server, prior, authJwt);
 }
 async function completeSecondFactor(server, login) {
   const factors = login.secondFactors ?? [];
@@ -85936,7 +86193,7 @@ async function completeSecondFactor(server, login) {
       return await callTrpcMutation(
         `${server}/trpc/auth.loginVerifyTotp?batch=1`,
         void 0,
-        { challengeToken: login.token, code },
+        { challengeToken: login.token, code, refreshable: true },
         isLoginPayload
       );
     } catch (err) {
@@ -86029,6 +86286,8 @@ async function loginCommand(opts) {
   let displayName;
   let userId;
   let isAdmin = false;
+  let refreshToken;
+  let expiresAt;
   while (true) {
     const authSpinner = clack.spinner();
     authSpinner.start(
@@ -86038,7 +86297,7 @@ async function loginCommand(opts) {
       const first = await callTrpcMutation(
         `${server}/trpc/auth.login?batch=1`,
         void 0,
-        { username, password: password2 },
+        { username, password: password2, refreshable: true },
         isLoginPayload
       );
       const owesSecondFactor = (first.secondFactors ?? []).length > 0;
@@ -86048,6 +86307,8 @@ async function loginCommand(opts) {
       displayName = login.user.username;
       userId = login.user.id;
       isAdmin = login.user.isAdmin === true;
+      refreshToken = login.refreshToken;
+      expiresAt = login.expiresAt;
       if (!owesSecondFactor) authSpinner.stop(`Authenticated as ${displayName}`);
       break;
     } catch (err) {
@@ -86079,14 +86340,14 @@ async function loginCommand(opts) {
     token: jwt2,
     scopes: [],
     createdAt: Date.now(),
-    ...isAdmin ? { isAdmin: true } : {}
+    ...isAdmin ? { isAdmin: true } : {},
+    ...refreshToken ? { refreshToken } : {},
+    ...expiresAt !== void 0 ? { expiresAt } : {}
   };
   const file2 = saveSession(session);
   const role = isAdmin ? "administrator" : "user";
-  clack.outro(
-    `\u2713 Logged in as ${displayName} (${role}) \u2192 ${server}
-  Cached at ${file2}`
-  );
+  clack.outro(`\u2713 Logged in as ${displayName} (${role}) \u2192 ${server}
+  Cached at ${file2}`);
 }
 async function logoutCommand(opts) {
   const session = loadSession(opts.server);
@@ -86098,21 +86359,7 @@ async function logoutCommand(opts) {
   const spinner3 = clack.spinner();
   spinner3.start(`Revoking token on ${session.server}`);
   try {
-    if (session.token.startsWith(SCOPED_TOKEN_PREFIX) && session.tokenId) {
-      await callTrpcMutation(
-        `${session.server}/trpc/userManagement.revokeScopedToken?batch=1`,
-        `Bearer ${session.token}`,
-        { id: session.tokenId },
-        isUnknown
-      );
-    } else if (!session.token.startsWith(SCOPED_TOKEN_PREFIX) && !session.token.startsWith(ADMIN_TOKEN_PREFIX)) {
-      await callTrpcMutation(
-        `${session.server}/trpc/auth.logout?batch=1`,
-        `Bearer ${session.token}`,
-        {},
-        isLogoutPayload
-      );
-    }
+    await performRevocation(session.server, session, void 0);
     spinner3.stop("Session revoked server-side.");
   } catch (err) {
     spinner3.stop(
@@ -86158,7 +86405,15 @@ async function whoamiCommand(opts) {
   if (session.tokenId) console.log(`  tokenId:   ${session.tokenId}`);
   const scopeLine = session.scopes.length > 0 ? session.scopes.map((s) => `${s.type}:${s.target}`).join(", ") : "(login JWT)";
   console.log(`  scopes:    ${scopeLine}`);
-  console.log(`  admin:     ${session.isAdmin === true ? "yes" : "no"}`);
+  const claims = jwtClaims(session.token);
+  const admin = session.isAdmin === true || claims?.["isAdmin"] === true;
+  console.log(`  admin:     ${admin ? "yes" : "no"}`);
+  const expiresAt = session.expiresAt ?? (typeof claims?.["exp"] === "number" ? claims["exp"] * 1e3 : void 0);
+  if (expiresAt !== void 0) {
+    console.log(
+      `  expires:   ${new Date(expiresAt).toISOString()}${session.refreshToken ? " (renewed automatically)" : ""}`
+    );
+  }
   console.log(`  createdAt: ${new Date(session.createdAt).toISOString()}`);
   console.log("");
   console.log(`[camstack] Pinging ${session.server}/api/auth/whoami\u2026`);
@@ -86203,7 +86458,7 @@ import {
   MissingCredentialsError,
   normalizeHubAddress as normalizeHubAddress3,
   touchSession as touchSession3,
-  resolveCredentials as resolveCredentials3
+  resolveFreshCredentials as resolveFreshCredentials3
 } from "@camstack/develop";
 
 // src/commands/discover.ts
@@ -86450,7 +86705,20 @@ import * as fs7 from "fs";
 import * as path7 from "path";
 import { parseArgs as parseArgs6 } from "util";
 import * as clack3 from "@clack/prompts";
-import { loadSession as loadSession2, resolveCredentials, touchSession } from "@camstack/develop";
+import { loadSession as loadSession2, resolveFreshCredentials, touchSession } from "@camstack/develop";
+
+// src/http/hub-transport.ts
+var cliHubTransport = async (req) => {
+  const res = await hubRequest(req.url, {
+    method: req.method,
+    headers: req.headers,
+    ...req.body !== void 0 ? { body: req.body } : {},
+    timeoutMs: req.timeoutMs
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+// src/commands/dev.ts
 var DEFAULT_DEBOUNCE_MS = 500;
 var DEFAULT_WATCH_SUBDIR = "src";
 function resolveAddonDir(arg) {
@@ -86482,12 +86750,12 @@ function watchRecursive(target, onEvent) {
     return { close: () => w.close(), recursive: false };
   }
 }
-async function pushOnce(addonPath, opts, label) {
+async function pushOnce(addonPath, getOpts, label) {
   const start = Date.now();
   console.log(`
 [camstack dev] \u2192 ${label}\u2026`);
   try {
-    await deployAddon(addonPath, opts);
+    await deployAddon(addonPath, await getOpts());
     const took = ((Date.now() - start) / 1e3).toFixed(1);
     console.log(`[camstack dev] \u2713 Synced in ${took}s`);
   } catch (err) {
@@ -86516,12 +86784,14 @@ async function runDev(args) {
   });
   const addonArg = positionals[0] ?? ".";
   const addonDir = resolveAddonDir(addonArg);
-  const creds = resolveCredentials({
+  const credentialInputs = {
     ...typeof values.server === "string" ? { server: values.server } : {},
     ...typeof values.token === "string" ? { token: values.token } : {},
     ...typeof values["token-file"] === "string" ? { tokenFile: values["token-file"] } : {},
-    loadSession: loadSession2
-  });
+    loadSession: loadSession2,
+    transport: cliHubTransport
+  };
+  const creds = await resolveFreshCredentials(credentialInputs);
   if (creds.warning) console.error(`[camstack dev] Warning: ${creds.warning}`);
   if (creds.source === "session" && creds.server) touchSession(creds.server);
   const serverUrl = creds.server;
@@ -86540,6 +86810,10 @@ async function runDev(args) {
     buildMode: values["no-build"] === true ? "skip" : "auto",
     ...typeof values["build-script"] === "string" ? { buildScript: values["build-script"] } : {}
   };
+  const freshOpts = async () => ({
+    ...deployOpts,
+    token: (await resolveFreshCredentials(credentialInputs)).token
+  });
   const watchOverride = typeof values["watch-path"] === "string" ? values["watch-path"] : void 0;
   const watchTarget = watchOverride ? path7.resolve(addonDir, watchOverride) : fs7.existsSync(path7.join(addonDir, DEFAULT_WATCH_SUBDIR)) ? path7.join(addonDir, DEFAULT_WATCH_SUBDIR) : addonDir;
   if (!fs7.existsSync(watchTarget)) {
@@ -86553,7 +86827,7 @@ async function runDev(args) {
   );
   clack3.log.info(`Debounce: ${debounceMs}ms`);
   if (values["no-initial-push"] !== true) {
-    await pushOnce(addonDir, deployOpts, "Initial sync");
+    await pushOnce(addonDir, freshOpts, "Initial sync");
   } else {
     console.log("[camstack dev] Skipping initial push (--no-initial-push). Waiting for changes\u2026");
   }
@@ -86569,7 +86843,7 @@ async function runDev(args) {
       }
       pushing = true;
       try {
-        await pushOnce(addonDir, deployOpts, "File change detected \u2014 rebuilding");
+        await pushOnce(addonDir, freshOpts, "File change detected \u2014 rebuilding");
       } finally {
         pushing = false;
         if (pending) {
@@ -86605,7 +86879,7 @@ import * as clack4 from "@clack/prompts";
 import {
   loadSession as loadSession3,
   touchSession as touchSession2,
-  resolveCredentials as resolveCredentials2,
+  resolveFreshCredentials as resolveFreshCredentials2,
   withAuthHint as withAuthHint3
 } from "@camstack/develop";
 var POLL_INTERVAL_MS2 = 2e3;
@@ -86669,12 +86943,14 @@ async function runWatch(args) {
     allowPositionals: true
   });
   const addonArg = positionals[0] ?? ".";
-  const creds = resolveCredentials2({
+  const credentialInputs = {
     ...typeof values.server === "string" ? { server: values.server } : {},
     ...typeof values.token === "string" ? { token: values.token } : {},
     ...typeof values["token-file"] === "string" ? { tokenFile: values["token-file"] } : {},
-    loadSession: loadSession3
-  });
+    loadSession: loadSession3,
+    transport: cliHubTransport
+  };
+  const creds = await resolveFreshCredentials2(credentialInputs);
   if (creds.warning) console.error(`[camstack watch] Warning: ${creds.warning}`);
   if (creds.source === "session" && creds.server) touchSession2(creds.server);
   const serverUrl = creds.server;
@@ -86713,7 +86989,14 @@ async function runWatch(args) {
   process.on("SIGTERM", shutdown);
   while (!stop) {
     try {
-      const entries2 = await fetchLogs(serverUrl, token, addonId, LOG_BATCH_LIMIT, creds.source);
+      const fresh = await resolveFreshCredentials2(credentialInputs);
+      const entries2 = await fetchLogs(
+        serverUrl,
+        fresh.token,
+        addonId,
+        LOG_BATCH_LIMIT,
+        creds.source
+      );
       const sorted = [...entries2].toSorted((a, b) => {
         const ta = typeof a.timestamp === "number" ? a.timestamp : new Date(a.timestamp).getTime();
         const tb = typeof b.timestamp === "number" ? b.timestamp : new Date(b.timestamp).getTime();
@@ -87185,7 +87468,7 @@ function buildCommands() {
         "  -p, --password <pwd>   Password (skips prompt \u2014 prefer letting the CLI prompt)",
         `  --token-name <name>    Ignored (kept for scripts); login uses your hub session JWT`,
         "      --admin             Ignored (kept for muscle memory); admin follows your account role",
-        "      --admin-days <n>    Ignored (kept for muscle memory); no separate admin-token mint"
+        "      --admin-days <n>    Ignored (kept for muscle memory); one login, one token format"
       ].join("\n")
     },
     {
@@ -87196,7 +87479,7 @@ function buildCommands() {
         "Usage: camstack discover [options]",
         "",
         "Lists the hubs `camstack login` would offer: those announcing _camstack._tcp over",
-        "  mDNS plus saved sessions, admin-token files, $CAMSTACK_HUB_URL and scratchpad/.hub-url,",
+        "  mDNS plus saved sessions, $CAMSTACK_HUB_URL and scratchpad/.hub-url,",
         "  reachable ones only, each with its source. Agents never announce this service.",
         "",
         "Options:",
@@ -87473,7 +87756,7 @@ async function runWhoami(args) {
   const server = stringOpt(parsed.values, "server");
   await whoamiCommand(server ? { server: normalizeHubAddress3(server) } : {});
 }
-function resolveClosureDeployOpts(values) {
+async function resolveClosureDeployOpts(values) {
   const nodeId = stringOpt(values, "node");
   const cluster = boolOpt(values, "cluster") || boolOpt(values, "all");
   if (cluster && nodeId) {
@@ -87481,7 +87764,7 @@ function resolveClosureDeployOpts(values) {
     process.exit(1);
   }
   const version2 = stringOpt(values, "version");
-  const creds = resolveCommandCredentials(values);
+  const creds = await resolveCommandCredentials(values);
   return {
     serverUrl: creds.server ?? DEFAULT_SERVER_URL,
     token: creds.token,
@@ -87519,7 +87802,7 @@ async function runDeploy(args) {
       console.error("[camstack] Error: --closure does not take addon --build / --no-build flags.");
       process.exit(1);
     }
-    await deployServer(resolveClosureDeployOpts(parsed.values));
+    await deployServer(await resolveClosureDeployOpts(parsed.values));
     return;
   }
   if (stringOpt(parsed.values, "version")) {
@@ -87527,7 +87810,7 @@ async function runDeploy(args) {
     process.exit(1);
   }
   const addonPath = parsed.positionals[0] ?? ".";
-  const creds = resolveCommandCredentials(parsed.values);
+  const creds = await resolveCommandCredentials(parsed.values);
   const server = creds.server ?? DEFAULT_SERVER_URL;
   const token = creds.token;
   const nodeId = stringOpt(parsed.values, "node");
@@ -87579,19 +87862,20 @@ async function runDeployServer(args) {
     return;
   }
   console.log("[camstack] note: `deploy-server` is an alias of `deploy --closure`");
-  await deployServer(resolveClosureDeployOpts(parsed.values));
+  await deployServer(await resolveClosureDeployOpts(parsed.values));
 }
 var DEFAULT_SERVER_URL = "https://localhost:4443";
-function resolveCommandCredentials(values) {
+async function resolveCommandCredentials(values) {
   const server = stringOpt(values, "server");
   const token = stringOpt(values, "token");
   const tokenFile = stringOpt(values, "token-file");
   try {
-    const creds = resolveCredentials3({
+    const creds = await resolveFreshCredentials3({
       ...server ? { server } : {},
       ...token ? { token } : {},
       ...tokenFile ? { tokenFile } : {},
-      loadSession: loadSession4
+      loadSession: loadSession4,
+      transport: cliHubTransport
     });
     if (creds.warning) console.error(`[camstack] Warning: ${creds.warning}`);
     if (creds.source === "session" && creds.server) touchSession3(creds.server);