camstack 1.2.190 → 1.2.191

package/dist/cli.js

@@ -37,7 +37,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-ILGFB3AQ.js");
+  await import("./launcher-AZI5I6X5.js");
 }
 
 // src/commands/agent.ts
@@ -82,7 +82,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-ILGFB3AQ.js");
+  await import("./launcher-AZI5I6X5.js");
 }
 
 // src/commands/setup.ts
@@ -14968,6 +14968,7 @@ var WELL_KNOWN_TABS = [
 ];
 var WELL_KNOWN_TAB_MAP = Object.fromEntries(WELL_KNOWN_TABS.map((t) => [t.id, t]));
 var SECRET_RETRY_MAX_MS = 5 * 6e4;
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 var PEER_BYTES_CHUNK_BYTES = 256 * 1024;
 var PeerBytesTicketSchema = external_exports.object({
   /** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -18452,6 +18453,150 @@ var ConvertResultSchema = external_exports.object({
   entry: ModelCatalogEntrySchema,
   artifacts: external_exports.array(ConvertArtifactSchema).readonly()
 });
+var MethodAccessSchema = external_exports.enum([
+  "view",
+  "create",
+  "delete"
+]);
+var AllowedProviderSchema = external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]);
+var AllowedDevicesSchema = external_exports.record(external_exports.string(), external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]));
+var CapScopeSchema = external_exports.enum(["device", "system"]);
+var DeviceSelectorSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("all") }),
+  external_exports.object({
+    kind: external_exports.literal("ids"),
+    ids: external_exports.array(external_exports.number().int()).min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("types"),
+    types: external_exports.array(external_exports.enum(DeviceType)).min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("locations"),
+    locations: external_exports.array(external_exports.string().min(1)).min(1)
+  })
+]);
+var DeviceTokenScopeSchema = external_exports.object({
+  type: external_exports.literal("device"),
+  /** The device SET this grant covers — resolved against the live fleet. */
+  selector: DeviceSelectorSchema,
+  access: external_exports.array(MethodAccessSchema).min(1),
+  /**
+  * Whether a grant on a PARENT device transparently covers its accessory
+  * CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+  * Direction is parent → children ONLY.
+  *
+  * Absent → the matcher DERIVES it from the access flavour: `view`
+  * inherits (a camera viewer sees the camera's accessories), `create` /
+  * `delete` do NOT (actuating/removing a child is an explicit act the
+  * operator must grant on the child, not inherit from the parent). Set it
+  * explicitly to override that default per grant.
+  */
+  includeLinked: external_exports.boolean().optional()
+});
+function migrateLegacyTokenScope(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+  if (Reflect.get(raw, "type") !== "device") return raw;
+  if (Reflect.get(raw, "selector") !== void 0) return raw;
+  const targets = Reflect.get(raw, "targets");
+  if (!Array.isArray(targets)) return raw;
+  return {
+    type: "device",
+    selector: {
+      kind: "ids",
+      ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+    },
+    access: Reflect.get(raw, "access")
+  };
+}
+var TokenScopeSchema = external_exports.preprocess(migrateLegacyTokenScope, external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    type: external_exports.literal("category"),
+    target: CapScopeSchema,
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  external_exports.object({
+    type: external_exports.literal("capability"),
+    target: external_exports.string(),
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  external_exports.object({
+    type: external_exports.literal("addon"),
+    target: external_exports.string(),
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  DeviceTokenScopeSchema
+]));
+var UserRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  username: external_exports.string(),
+  passwordHash: external_exports.string(),
+  /**
+  * Admin bypass. When true, the middleware skips the scope-access
+  * check entirely. There is no other axis of privilege; the legacy
+  * role enum collapsed onto this boolean in v2.
+  */
+  isAdmin: external_exports.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  /**
+  * Scopes granted to this user. Admins bypass; their `scopes` is
+  * ignored. Non-admins without scopes are locked out of every
+  * protected call.
+  */
+  scopes: external_exports.array(TokenScopeSchema).default([]),
+  createdAt: external_exports.number(),
+  updatedAt: external_exports.number()
+});
+var ApiKeyRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string(),
+  isAdmin: external_exports.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  tokenHash: external_exports.string(),
+  tokenPrefix: external_exports.string(),
+  createdAt: external_exports.number(),
+  lastUsedAt: external_exports.number().optional()
+});
+var ScopedTokenSchema = external_exports.object({
+  id: external_exports.string(),
+  userId: external_exports.string(),
+  name: external_exports.string(),
+  tokenHash: external_exports.string(),
+  tokenPrefix: external_exports.string(),
+  scopes: external_exports.array(TokenScopeSchema),
+  expiresAt: external_exports.number().nullish(),
+  lastUsedAt: external_exports.number().nullish(),
+  createdAt: external_exports.number()
+});
+var ShareViewGrantSchema = external_exports.object({
+  kind: external_exports.enum(SHARE_VIEW_KINDS),
+  deviceIds: external_exports.array(external_exports.number().int().nonnegative()).min(1).max(64),
+  /** Talk-back, opt-in at mint time; absent means off. */
+  talk: external_exports.boolean().optional()
+});
+var ShareViewScopeSchema = external_exports.object({
+  type: external_exports.literal("share-view"),
+  grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = external_exports.object({
+  type: external_exports.literal("addon-routes"),
+  access: external_exports.array(MethodAccessSchema).min(1)
+});
+var CredentialScopeSchema = external_exports.union([
+  external_exports.literal("*"),
+  ShareViewScopeSchema,
+  AddonRoutesScopeSchema,
+  TokenScopeSchema
+]);
+var CREDENTIAL_TOKEN_KIND = "credential";
+var CredentialTokenClaimsSchema = external_exports.object({
+  kind: external_exports.literal(CREDENTIAL_TOKEN_KIND),
+  sub: external_exports.string().min(1),
+  jti: external_exports.string().min(16),
+  scopes: external_exports.array(CredentialScopeSchema).min(1)
+});
 var AppFlowPurposeSchema = external_exports.enum(["new-session", "step-up"]);
 var AppPageLangSchema = external_exports.enum(["en", "it"]);
 var APP_FLOW_REFUSAL_MESSAGES = {
@@ -50264,123 +50409,6 @@ var notificationRulesCapability = {
     getAlarmSensors: method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" })
   }
 };
-var MethodAccessSchema = external_exports.enum([
-  "view",
-  "create",
-  "delete"
-]);
-var AllowedProviderSchema = external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]);
-var AllowedDevicesSchema = external_exports.record(external_exports.string(), external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]));
-var CapScopeSchema = external_exports.enum(["device", "system"]);
-var DeviceSelectorSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({ kind: external_exports.literal("all") }),
-  external_exports.object({
-    kind: external_exports.literal("ids"),
-    ids: external_exports.array(external_exports.number().int()).min(1)
-  }),
-  external_exports.object({
-    kind: external_exports.literal("types"),
-    types: external_exports.array(external_exports.enum(DeviceType)).min(1)
-  }),
-  external_exports.object({
-    kind: external_exports.literal("locations"),
-    locations: external_exports.array(external_exports.string().min(1)).min(1)
-  })
-]);
-var DeviceTokenScopeSchema = external_exports.object({
-  type: external_exports.literal("device"),
-  /** The device SET this grant covers — resolved against the live fleet. */
-  selector: DeviceSelectorSchema,
-  access: external_exports.array(MethodAccessSchema).min(1),
-  /**
-  * Whether a grant on a PARENT device transparently covers its accessory
-  * CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-  * Direction is parent → children ONLY.
-  *
-  * Absent → the matcher DERIVES it from the access flavour: `view`
-  * inherits (a camera viewer sees the camera's accessories), `create` /
-  * `delete` do NOT (actuating/removing a child is an explicit act the
-  * operator must grant on the child, not inherit from the parent). Set it
-  * explicitly to override that default per grant.
-  */
-  includeLinked: external_exports.boolean().optional()
-});
-function migrateLegacyTokenScope(raw) {
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-  if (Reflect.get(raw, "type") !== "device") return raw;
-  if (Reflect.get(raw, "selector") !== void 0) return raw;
-  const targets = Reflect.get(raw, "targets");
-  if (!Array.isArray(targets)) return raw;
-  return {
-    type: "device",
-    selector: {
-      kind: "ids",
-      ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-    },
-    access: Reflect.get(raw, "access")
-  };
-}
-var TokenScopeSchema = external_exports.preprocess(migrateLegacyTokenScope, external_exports.discriminatedUnion("type", [
-  external_exports.object({
-    type: external_exports.literal("category"),
-    target: CapScopeSchema,
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  external_exports.object({
-    type: external_exports.literal("capability"),
-    target: external_exports.string(),
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  external_exports.object({
-    type: external_exports.literal("addon"),
-    target: external_exports.string(),
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  DeviceTokenScopeSchema
-]));
-var UserRecordSchema = external_exports.object({
-  id: external_exports.string(),
-  username: external_exports.string(),
-  passwordHash: external_exports.string(),
-  /**
-  * Admin bypass. When true, the middleware skips the scope-access
-  * check entirely. There is no other axis of privilege; the legacy
-  * role enum collapsed onto this boolean in v2.
-  */
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  /**
-  * Scopes granted to this user. Admins bypass; their `scopes` is
-  * ignored. Non-admins without scopes are locked out of every
-  * protected call.
-  */
-  scopes: external_exports.array(TokenScopeSchema).default([]),
-  createdAt: external_exports.number(),
-  updatedAt: external_exports.number()
-});
-var ApiKeyRecordSchema = external_exports.object({
-  id: external_exports.string(),
-  label: external_exports.string(),
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  tokenHash: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  createdAt: external_exports.number(),
-  lastUsedAt: external_exports.number().optional()
-});
-var ScopedTokenSchema = external_exports.object({
-  id: external_exports.string(),
-  userId: external_exports.string(),
-  name: external_exports.string(),
-  tokenHash: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  scopes: external_exports.array(TokenScopeSchema),
-  expiresAt: external_exports.number().nullish(),
-  lastUsedAt: external_exports.number().nullish(),
-  createdAt: external_exports.number()
-});
 var OauthIntegrationDescriptorSchema = external_exports.object({
   /** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
   integrationId: external_exports.string(),
@@ -85953,6 +85981,7 @@ import * as clack from "@clack/prompts";
 import {
   clearSession,
   defaultSession,
+  jwtClaims,
   listSessions,
   loadSession,
   saveSession
@@ -85968,20 +85997,11 @@ import {
   validateHubAddress
 } from "@camstack/develop";
 import {
-  discoverHubs,
-  normalizeHubUrl
+  discoverHubs
 } from "@camstack/develop/hub-discovery";
-var ADMIN_TOKEN_SUFFIX = ".admin-token";
 function validateManualHubUrl(value) {
   return validateHubAddress(value);
 }
-function hubUrlFromAdminTokenFile(fileName) {
-  if (!fileName.endsWith(ADMIN_TOKEN_SUFFIX)) return null;
-  const slug = fileName.slice(0, -ADMIN_TOKEN_SUFFIX.length);
-  const match = /^(.+?)_(\d{1,5})$/.exec(slug);
-  const candidate = match ? `https://${match[1]}:${match[2]}` : `https://${slug}`;
-  return normalizeHubUrl(candidate)?.url ?? null;
-}
 function knownHubCandidates(deps) {
   const dir = deps.sessionDir ?? defaultSessionDir();
   const env = deps.env ?? process.env;
@@ -86004,9 +86024,6 @@ function knownHubCandidates(deps) {
         }
       } catch {
       }
-    } else {
-      const url2 = hubUrlFromAdminTokenFile(file2);
-      if (url2 !== null) out.push({ url: url2, source: "saved admin token" });
     }
   }
   const fromEnv = resolveHubUrl({ env, session: null });
@@ -86134,30 +86151,32 @@ function isLoginPayload(value) {
   const u = v.user;
   return typeof u.id === "string" && typeof u.username === "string";
 }
-function isLogoutPayload(value) {
-  if (value === null || typeof value !== "object") return false;
-  return Reflect.get(value, "success") === true && typeof Reflect.get(value, "revoked") === "number";
-}
-var SCOPED_TOKEN_PREFIX = "cst_";
-var ADMIN_TOKEN_PREFIX = "csa_";
-async function revokePriorSession(server, prior, authJwt) {
-  if (prior.token.startsWith(SCOPED_TOKEN_PREFIX) && prior.tokenId) {
-    await callTrpcMutation(
-      `${server}/trpc/userManagement.revokeScopedToken?batch=1`,
-      `Bearer ${authJwt}`,
-      { id: prior.tokenId },
-      isUnknown
-    );
-    return;
+function revocationFor(session) {
+  if (session.tokenId) {
+    return {
+      procedure: "userManagement.revokeScopedToken",
+      input: { id: session.tokenId },
+      bearer: "fresh"
+    };
   }
-  if (!prior.token.startsWith(SCOPED_TOKEN_PREFIX) && !prior.token.startsWith(ADMIN_TOKEN_PREFIX)) {
-    await callTrpcMutation(
-      `${server}/trpc/auth.logout?batch=1`,
-      `Bearer ${prior.token}`,
-      {},
-      isLogoutPayload
-    );
+  if (jwtClaims(session.token) !== null) {
+    return { procedure: "auth.logout", input: {}, bearer: "self" };
   }
+  return null;
+}
+async function performRevocation(server, session, freshJwt) {
+  const r = revocationFor(session);
+  if (!r) return;
+  const bearer = r.bearer === "fresh" && freshJwt ? freshJwt : session.token;
+  await callTrpcMutation(
+    `${server}/trpc/${r.procedure}?batch=1`,
+    `Bearer ${bearer}`,
+    r.input,
+    isUnknown
+  );
+}
+async function revokePriorSession(server, prior, authJwt) {
+  await performRevocation(server, prior, authJwt);
 }
 async function completeSecondFactor(server, login) {
   const factors = login.secondFactors ?? [];
@@ -86174,7 +86193,7 @@ async function completeSecondFactor(server, login) {
       return await callTrpcMutation(
         `${server}/trpc/auth.loginVerifyTotp?batch=1`,
         void 0,
-        { challengeToken: login.token, code },
+        { challengeToken: login.token, code, refreshable: true },
         isLoginPayload
       );
     } catch (err) {
@@ -86267,6 +86286,8 @@ async function loginCommand(opts) {
   let displayName;
   let userId;
   let isAdmin = false;
+  let refreshToken;
+  let expiresAt;
   while (true) {
     const authSpinner = clack.spinner();
     authSpinner.start(
@@ -86276,7 +86297,7 @@ async function loginCommand(opts) {
       const first = await callTrpcMutation(
         `${server}/trpc/auth.login?batch=1`,
         void 0,
-        { username, password: password2 },
+        { username, password: password2, refreshable: true },
         isLoginPayload
       );
       const owesSecondFactor = (first.secondFactors ?? []).length > 0;
@@ -86286,6 +86307,8 @@ async function loginCommand(opts) {
       displayName = login.user.username;
       userId = login.user.id;
       isAdmin = login.user.isAdmin === true;
+      refreshToken = login.refreshToken;
+      expiresAt = login.expiresAt;
       if (!owesSecondFactor) authSpinner.stop(`Authenticated as ${displayName}`);
       break;
     } catch (err) {
@@ -86317,14 +86340,14 @@ async function loginCommand(opts) {
     token: jwt2,
     scopes: [],
     createdAt: Date.now(),
-    ...isAdmin ? { isAdmin: true } : {}
+    ...isAdmin ? { isAdmin: true } : {},
+    ...refreshToken ? { refreshToken } : {},
+    ...expiresAt !== void 0 ? { expiresAt } : {}
   };
   const file2 = saveSession(session);
   const role = isAdmin ? "administrator" : "user";
-  clack.outro(
-    `\u2713 Logged in as ${displayName} (${role}) \u2192 ${server}
-  Cached at ${file2}`
-  );
+  clack.outro(`\u2713 Logged in as ${displayName} (${role}) \u2192 ${server}
+  Cached at ${file2}`);
 }
 async function logoutCommand(opts) {
   const session = loadSession(opts.server);
@@ -86336,21 +86359,7 @@ async function logoutCommand(opts) {
   const spinner3 = clack.spinner();
   spinner3.start(`Revoking token on ${session.server}`);
   try {
-    if (session.token.startsWith(SCOPED_TOKEN_PREFIX) && session.tokenId) {
-      await callTrpcMutation(
-        `${session.server}/trpc/userManagement.revokeScopedToken?batch=1`,
-        `Bearer ${session.token}`,
-        { id: session.tokenId },
-        isUnknown
-      );
-    } else if (!session.token.startsWith(SCOPED_TOKEN_PREFIX) && !session.token.startsWith(ADMIN_TOKEN_PREFIX)) {
-      await callTrpcMutation(
-        `${session.server}/trpc/auth.logout?batch=1`,
-        `Bearer ${session.token}`,
-        {},
-        isLogoutPayload
-      );
-    }
+    await performRevocation(session.server, session, void 0);
     spinner3.stop("Session revoked server-side.");
   } catch (err) {
     spinner3.stop(
@@ -86396,7 +86405,15 @@ async function whoamiCommand(opts) {
   if (session.tokenId) console.log(`  tokenId:   ${session.tokenId}`);
   const scopeLine = session.scopes.length > 0 ? session.scopes.map((s) => `${s.type}:${s.target}`).join(", ") : "(login JWT)";
   console.log(`  scopes:    ${scopeLine}`);
-  console.log(`  admin:     ${session.isAdmin === true ? "yes" : "no"}`);
+  const claims = jwtClaims(session.token);
+  const admin = session.isAdmin === true || claims?.["isAdmin"] === true;
+  console.log(`  admin:     ${admin ? "yes" : "no"}`);
+  const expiresAt = session.expiresAt ?? (typeof claims?.["exp"] === "number" ? claims["exp"] * 1e3 : void 0);
+  if (expiresAt !== void 0) {
+    console.log(
+      `  expires:   ${new Date(expiresAt).toISOString()}${session.refreshToken ? " (renewed automatically)" : ""}`
+    );
+  }
   console.log(`  createdAt: ${new Date(session.createdAt).toISOString()}`);
   console.log("");
   console.log(`[camstack] Pinging ${session.server}/api/auth/whoami\u2026`);
@@ -86441,7 +86458,7 @@ import {
   MissingCredentialsError,
   normalizeHubAddress as normalizeHubAddress3,
   touchSession as touchSession3,
-  resolveCredentials as resolveCredentials3
+  resolveFreshCredentials as resolveFreshCredentials3
 } from "@camstack/develop";
 
 // src/commands/discover.ts
@@ -86688,7 +86705,20 @@ import * as fs7 from "fs";
 import * as path7 from "path";
 import { parseArgs as parseArgs6 } from "util";
 import * as clack3 from "@clack/prompts";
-import { loadSession as loadSession2, resolveCredentials, touchSession } from "@camstack/develop";
+import { loadSession as loadSession2, resolveFreshCredentials, touchSession } from "@camstack/develop";
+
+// src/http/hub-transport.ts
+var cliHubTransport = async (req) => {
+  const res = await hubRequest(req.url, {
+    method: req.method,
+    headers: req.headers,
+    ...req.body !== void 0 ? { body: req.body } : {},
+    timeoutMs: req.timeoutMs
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+// src/commands/dev.ts
 var DEFAULT_DEBOUNCE_MS = 500;
 var DEFAULT_WATCH_SUBDIR = "src";
 function resolveAddonDir(arg) {
@@ -86720,12 +86750,12 @@ function watchRecursive(target, onEvent) {
     return { close: () => w.close(), recursive: false };
   }
 }
-async function pushOnce(addonPath, opts, label) {
+async function pushOnce(addonPath, getOpts, label) {
   const start = Date.now();
   console.log(`
 [camstack dev] \u2192 ${label}\u2026`);
   try {
-    await deployAddon(addonPath, opts);
+    await deployAddon(addonPath, await getOpts());
     const took = ((Date.now() - start) / 1e3).toFixed(1);
     console.log(`[camstack dev] \u2713 Synced in ${took}s`);
   } catch (err) {
@@ -86754,12 +86784,14 @@ async function runDev(args) {
   });
   const addonArg = positionals[0] ?? ".";
   const addonDir = resolveAddonDir(addonArg);
-  const creds = resolveCredentials({
+  const credentialInputs = {
     ...typeof values.server === "string" ? { server: values.server } : {},
     ...typeof values.token === "string" ? { token: values.token } : {},
     ...typeof values["token-file"] === "string" ? { tokenFile: values["token-file"] } : {},
-    loadSession: loadSession2
-  });
+    loadSession: loadSession2,
+    transport: cliHubTransport
+  };
+  const creds = await resolveFreshCredentials(credentialInputs);
   if (creds.warning) console.error(`[camstack dev] Warning: ${creds.warning}`);
   if (creds.source === "session" && creds.server) touchSession(creds.server);
   const serverUrl = creds.server;
@@ -86778,6 +86810,10 @@ async function runDev(args) {
     buildMode: values["no-build"] === true ? "skip" : "auto",
     ...typeof values["build-script"] === "string" ? { buildScript: values["build-script"] } : {}
   };
+  const freshOpts = async () => ({
+    ...deployOpts,
+    token: (await resolveFreshCredentials(credentialInputs)).token
+  });
   const watchOverride = typeof values["watch-path"] === "string" ? values["watch-path"] : void 0;
   const watchTarget = watchOverride ? path7.resolve(addonDir, watchOverride) : fs7.existsSync(path7.join(addonDir, DEFAULT_WATCH_SUBDIR)) ? path7.join(addonDir, DEFAULT_WATCH_SUBDIR) : addonDir;
   if (!fs7.existsSync(watchTarget)) {
@@ -86791,7 +86827,7 @@ async function runDev(args) {
   );
   clack3.log.info(`Debounce: ${debounceMs}ms`);
   if (values["no-initial-push"] !== true) {
-    await pushOnce(addonDir, deployOpts, "Initial sync");
+    await pushOnce(addonDir, freshOpts, "Initial sync");
   } else {
     console.log("[camstack dev] Skipping initial push (--no-initial-push). Waiting for changes\u2026");
   }
@@ -86807,7 +86843,7 @@ async function runDev(args) {
       }
       pushing = true;
       try {
-        await pushOnce(addonDir, deployOpts, "File change detected \u2014 rebuilding");
+        await pushOnce(addonDir, freshOpts, "File change detected \u2014 rebuilding");
       } finally {
         pushing = false;
         if (pending) {
@@ -86843,7 +86879,7 @@ import * as clack4 from "@clack/prompts";
 import {
   loadSession as loadSession3,
   touchSession as touchSession2,
-  resolveCredentials as resolveCredentials2,
+  resolveFreshCredentials as resolveFreshCredentials2,
   withAuthHint as withAuthHint3
 } from "@camstack/develop";
 var POLL_INTERVAL_MS2 = 2e3;
@@ -86907,12 +86943,14 @@ async function runWatch(args) {
     allowPositionals: true
   });
   const addonArg = positionals[0] ?? ".";
-  const creds = resolveCredentials2({
+  const credentialInputs = {
     ...typeof values.server === "string" ? { server: values.server } : {},
     ...typeof values.token === "string" ? { token: values.token } : {},
     ...typeof values["token-file"] === "string" ? { tokenFile: values["token-file"] } : {},
-    loadSession: loadSession3
-  });
+    loadSession: loadSession3,
+    transport: cliHubTransport
+  };
+  const creds = await resolveFreshCredentials2(credentialInputs);
   if (creds.warning) console.error(`[camstack watch] Warning: ${creds.warning}`);
   if (creds.source === "session" && creds.server) touchSession2(creds.server);
   const serverUrl = creds.server;
@@ -86951,7 +86989,14 @@ async function runWatch(args) {
   process.on("SIGTERM", shutdown);
   while (!stop) {
     try {
-      const entries2 = await fetchLogs(serverUrl, token, addonId, LOG_BATCH_LIMIT, creds.source);
+      const fresh = await resolveFreshCredentials2(credentialInputs);
+      const entries2 = await fetchLogs(
+        serverUrl,
+        fresh.token,
+        addonId,
+        LOG_BATCH_LIMIT,
+        creds.source
+      );
       const sorted = [...entries2].toSorted((a, b) => {
         const ta = typeof a.timestamp === "number" ? a.timestamp : new Date(a.timestamp).getTime();
         const tb = typeof b.timestamp === "number" ? b.timestamp : new Date(b.timestamp).getTime();
@@ -87423,7 +87468,7 @@ function buildCommands() {
         "  -p, --password <pwd>   Password (skips prompt \u2014 prefer letting the CLI prompt)",
         `  --token-name <name>    Ignored (kept for scripts); login uses your hub session JWT`,
         "      --admin             Ignored (kept for muscle memory); admin follows your account role",
-        "      --admin-days <n>    Ignored (kept for muscle memory); no separate admin-token mint"
+        "      --admin-days <n>    Ignored (kept for muscle memory); one login, one token format"
       ].join("\n")
     },
     {
@@ -87434,7 +87479,7 @@ function buildCommands() {
         "Usage: camstack discover [options]",
         "",
         "Lists the hubs `camstack login` would offer: those announcing _camstack._tcp over",
-        "  mDNS plus saved sessions, admin-token files, $CAMSTACK_HUB_URL and scratchpad/.hub-url,",
+        "  mDNS plus saved sessions, $CAMSTACK_HUB_URL and scratchpad/.hub-url,",
         "  reachable ones only, each with its source. Agents never announce this service.",
         "",
         "Options:",
@@ -87711,7 +87756,7 @@ async function runWhoami(args) {
   const server = stringOpt(parsed.values, "server");
   await whoamiCommand(server ? { server: normalizeHubAddress3(server) } : {});
 }
-function resolveClosureDeployOpts(values) {
+async function resolveClosureDeployOpts(values) {
   const nodeId = stringOpt(values, "node");
   const cluster = boolOpt(values, "cluster") || boolOpt(values, "all");
   if (cluster && nodeId) {
@@ -87719,7 +87764,7 @@ function resolveClosureDeployOpts(values) {
     process.exit(1);
   }
   const version2 = stringOpt(values, "version");
-  const creds = resolveCommandCredentials(values);
+  const creds = await resolveCommandCredentials(values);
   return {
     serverUrl: creds.server ?? DEFAULT_SERVER_URL,
     token: creds.token,
@@ -87757,7 +87802,7 @@ async function runDeploy(args) {
       console.error("[camstack] Error: --closure does not take addon --build / --no-build flags.");
       process.exit(1);
     }
-    await deployServer(resolveClosureDeployOpts(parsed.values));
+    await deployServer(await resolveClosureDeployOpts(parsed.values));
     return;
   }
   if (stringOpt(parsed.values, "version")) {
@@ -87765,7 +87810,7 @@ async function runDeploy(args) {
     process.exit(1);
   }
   const addonPath = parsed.positionals[0] ?? ".";
-  const creds = resolveCommandCredentials(parsed.values);
+  const creds = await resolveCommandCredentials(parsed.values);
   const server = creds.server ?? DEFAULT_SERVER_URL;
   const token = creds.token;
   const nodeId = stringOpt(parsed.values, "node");
@@ -87817,19 +87862,20 @@ async function runDeployServer(args) {
     return;
   }
   console.log("[camstack] note: `deploy-server` is an alias of `deploy --closure`");
-  await deployServer(resolveClosureDeployOpts(parsed.values));
+  await deployServer(await resolveClosureDeployOpts(parsed.values));
 }
 var DEFAULT_SERVER_URL = "https://localhost:4443";
-function resolveCommandCredentials(values) {
+async function resolveCommandCredentials(values) {
   const server = stringOpt(values, "server");
   const token = stringOpt(values, "token");
   const tokenFile = stringOpt(values, "token-file");
   try {
-    const creds = resolveCredentials3({
+    const creds = await resolveFreshCredentials3({
       ...server ? { server } : {},
       ...token ? { token } : {},
       ...tokenFile ? { tokenFile } : {},
-      loadSession: loadSession4
+      loadSession: loadSession4,
+      transport: cliHubTransport
     });
     if (creds.warning) console.error(`[camstack] Warning: ${creds.warning}`);
     if (creds.source === "session" && creds.server) touchSession3(creds.server);