camstack 1.2.190 → 1.2.192

package/dist/cli.js

@@ -37,7 +37,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-ILGFB3AQ.js");
+  await import("./launcher-PJJ7PTWL.js");
 }
 
 // src/commands/agent.ts
@@ -82,7 +82,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-ILGFB3AQ.js");
+  await import("./launcher-PJJ7PTWL.js");
 }
 
 // src/commands/setup.ts
@@ -14773,7 +14773,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-BxjU_fJM.mjs
+// ../types/dist/sleep-yKL5gfrH.mjs
 var AUDIO_CHUNK_FORMATS = [
   "f32le",
   "pcmu",
@@ -14968,6 +14968,7 @@ var WELL_KNOWN_TABS = [
 ];
 var WELL_KNOWN_TAB_MAP = Object.fromEntries(WELL_KNOWN_TABS.map((t) => [t.id, t]));
 var SECRET_RETRY_MAX_MS = 5 * 6e4;
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 var PEER_BYTES_CHUNK_BYTES = 256 * 1024;
 var PeerBytesTicketSchema = external_exports.object({
   /** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -18452,6 +18453,204 @@ var ConvertResultSchema = external_exports.object({
   entry: ModelCatalogEntrySchema,
   artifacts: external_exports.array(ConvertArtifactSchema).readonly()
 });
+var MethodAccessSchema = external_exports.enum([
+  "view",
+  "create",
+  "delete"
+]);
+var AllowedProviderSchema = external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]);
+var AllowedDevicesSchema = external_exports.record(external_exports.string(), external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]));
+var CapScopeSchema = external_exports.enum(["device", "system"]);
+var DeviceSelectorSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("all") }),
+  external_exports.object({
+    kind: external_exports.literal("ids"),
+    ids: external_exports.array(external_exports.number().int()).min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("types"),
+    types: external_exports.array(external_exports.enum(DeviceType)).min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("locations"),
+    locations: external_exports.array(external_exports.string().min(1)).min(1)
+  })
+]);
+var DeviceTokenScopeSchema = external_exports.object({
+  type: external_exports.literal("device"),
+  /** The device SET this grant covers — resolved against the live fleet. */
+  selector: DeviceSelectorSchema,
+  access: external_exports.array(MethodAccessSchema).min(1),
+  /**
+  * Whether a grant on a PARENT device transparently covers its accessory
+  * CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+  * Direction is parent → children ONLY.
+  *
+  * Absent → the matcher DERIVES it from the access flavour: `view`
+  * inherits (a camera viewer sees the camera's accessories), `create` /
+  * `delete` do NOT (actuating/removing a child is an explicit act the
+  * operator must grant on the child, not inherit from the parent). Set it
+  * explicitly to override that default per grant.
+  */
+  includeLinked: external_exports.boolean().optional()
+});
+function migrateLegacyTokenScope(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+  if (Reflect.get(raw, "type") !== "device") return raw;
+  if (Reflect.get(raw, "selector") !== void 0) return raw;
+  const targets = Reflect.get(raw, "targets");
+  if (!Array.isArray(targets)) return raw;
+  return {
+    type: "device",
+    selector: {
+      kind: "ids",
+      ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+    },
+    access: Reflect.get(raw, "access")
+  };
+}
+var TokenScopeSchema = external_exports.preprocess(migrateLegacyTokenScope, external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    type: external_exports.literal("category"),
+    target: CapScopeSchema,
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  external_exports.object({
+    type: external_exports.literal("capability"),
+    target: external_exports.string(),
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  external_exports.object({
+    type: external_exports.literal("addon"),
+    target: external_exports.string(),
+    access: external_exports.array(MethodAccessSchema).min(1)
+  }),
+  DeviceTokenScopeSchema
+]));
+var UserRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  username: external_exports.string(),
+  passwordHash: external_exports.string(),
+  /**
+  * Admin bypass. When true, the middleware skips the scope-access
+  * check entirely. There is no other axis of privilege; the legacy
+  * role enum collapsed onto this boolean in v2.
+  */
+  isAdmin: external_exports.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  /**
+  * Scopes granted to this user. Admins bypass; their `scopes` is
+  * ignored. Non-admins without scopes are locked out of every
+  * protected call.
+  */
+  scopes: external_exports.array(TokenScopeSchema).default([]),
+  createdAt: external_exports.number(),
+  updatedAt: external_exports.number()
+});
+var ApiKeyRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string(),
+  isAdmin: external_exports.boolean().default(false),
+  allowedProviders: AllowedProviderSchema,
+  allowedDevices: AllowedDevicesSchema,
+  tokenHash: external_exports.string(),
+  tokenPrefix: external_exports.string(),
+  createdAt: external_exports.number(),
+  lastUsedAt: external_exports.number().optional()
+});
+var ScopedTokenSchema = external_exports.object({
+  id: external_exports.string(),
+  userId: external_exports.string(),
+  name: external_exports.string(),
+  tokenHash: external_exports.string(),
+  tokenPrefix: external_exports.string(),
+  scopes: external_exports.array(TokenScopeSchema),
+  expiresAt: external_exports.number().nullish(),
+  lastUsedAt: external_exports.number().nullish(),
+  createdAt: external_exports.number()
+});
+var ShareViewGrantSchema = external_exports.object({
+  kind: external_exports.enum(SHARE_VIEW_KINDS),
+  deviceIds: external_exports.array(external_exports.number().int().nonnegative()).min(1).max(64),
+  /** Talk-back, opt-in at mint time; absent means off. */
+  talk: external_exports.boolean().optional()
+});
+var ShareViewScopeSchema = external_exports.object({
+  type: external_exports.literal("share-view"),
+  grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = external_exports.object({
+  type: external_exports.literal("addon-routes"),
+  access: external_exports.array(MethodAccessSchema).min(1)
+});
+var PreferencesSelfScopeSchema = external_exports.object({ type: external_exports.literal("preferences-self") });
+var CredentialScopeSchema = external_exports.union([
+  external_exports.literal("*"),
+  ShareViewScopeSchema,
+  AddonRoutesScopeSchema,
+  PreferencesSelfScopeSchema,
+  TokenScopeSchema
+]);
+var CREDENTIAL_TOKEN_KIND = "credential";
+var CredentialTokenClaimsSchema = external_exports.object({
+  kind: external_exports.literal(CREDENTIAL_TOKEN_KIND),
+  sub: external_exports.string().min(1),
+  jti: external_exports.string().min(16),
+  scopes: external_exports.array(CredentialScopeSchema).min(1)
+});
+var PREFERENCES_NAMESPACE_PATTERN = /^[a-z][a-z0-9.-]{0,63}$/;
+var PREFERENCES_MAX_VALUE_BYTES = 256 * 1024;
+var PreferenceNamespaceSchema = external_exports.string().regex(PREFERENCES_NAMESPACE_PATTERN);
+var PreferenceValueSchema = external_exports.record(external_exports.string(), external_exports.unknown());
+var PreferenceDeviceIdSchema = external_exports.string().min(1).max(64);
+var PreferenceRowSchema = external_exports.object({
+  namespace: PreferenceNamespaceSchema,
+  value: PreferenceValueSchema,
+  /** Starts at 1, +1 on every write of this namespace. A delete ends the row and its count. */
+  revision: external_exports.number().int().positive(),
+  updatedAt: external_exports.number().int(),
+  /** The client id the last writer sent; `null` when it sent none. */
+  updatedByDevice: PreferenceDeviceIdSchema.nullable()
+});
+var PreferencesGetInputSchema = external_exports.object({
+  /** Absent: every namespace the caller holds. */
+  namespaces: external_exports.array(PreferenceNamespaceSchema).max(32).optional()
+});
+var PreferencesGetOutputSchema = external_exports.object({ rows: external_exports.array(PreferenceRowSchema) });
+var PreferencesPutInputSchema = external_exports.object({
+  namespace: PreferenceNamespaceSchema,
+  value: PreferenceValueSchema,
+  /**
+  * The revision the edit was based on. Absent: last write wins. `0`: the
+  * namespace must not exist yet. Any other value that is not the current
+  * revision answers `conflict` and writes nothing.
+  */
+  baseRevision: external_exports.number().int().nonnegative().optional(),
+  deviceId: PreferenceDeviceIdSchema.optional()
+});
+var PreferencesPutOutputSchema = external_exports.discriminatedUnion("status", [external_exports.object({
+  status: external_exports.literal("saved"),
+  row: PreferenceRowSchema
+}), external_exports.object({
+  status: external_exports.literal("conflict"),
+  current: PreferenceRowSchema.nullable()
+})]);
+var PreferencesDeleteInputSchema = external_exports.object({ namespace: PreferenceNamespaceSchema });
+var PreferencesDeleteOutputSchema = external_exports.object({
+  /** `false` when the namespace did not exist. */
+  deleted: external_exports.boolean()
+});
+var PreferencesChangedSinceInputSchema = external_exports.object({
+  /** The revision the client holds per namespace; a namespace it does not list is new to it. */
+  revisionByNamespace: external_exports.record(PreferenceNamespaceSchema, external_exports.number().int().nonnegative()).refine((map2) => Object.keys(map2).length <= 32, { message: `at most 32 namespaces` })
+});
+var PreferencesChangedSinceOutputSchema = external_exports.object({
+  /** Every row whose revision differs from the client's, and every row it did not list. */
+  rows: external_exports.array(PreferenceRowSchema),
+  /** Namespaces the client listed that no longer exist. */
+  deleted: external_exports.array(PreferenceNamespaceSchema)
+});
 var AppFlowPurposeSchema = external_exports.enum(["new-session", "step-up"]);
 var AppPageLangSchema = external_exports.enum(["en", "it"]);
 var APP_FLOW_REFUSAL_MESSAGES = {
@@ -46431,27 +46630,30 @@ var llmRuntimeCapability = {
     })
   }
 };
-var LlmProfileKindSchema = external_exports.enum([
-  "openai-compatible",
-  "openai",
-  "anthropic",
-  "google",
-  "managed-local",
-  "apple-foundation"
-]);
+var LLM_PROFILE_KIND_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var LlmProfileKindSchema = external_exports.string().regex(LLM_PROFILE_KIND_PATTERN, "a kind id is lower-case letters, digits and dashes");
+var LlmModelFeaturesSchema = external_exports.object({
+  vision: external_exports.boolean(),
+  tools: external_exports.boolean(),
+  streaming: external_exports.boolean()
+});
+var LlmModelInfoSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string().optional(),
+  contextLength: external_exports.number().int().positive().optional(),
+  features: LlmModelFeaturesSchema.partial().optional()
+});
+var LlmProviderConfigSchema = external_exports.record(external_exports.string(), external_exports.unknown());
 var LlmProfileSchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
+  /** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
   kind: LlmProfileKindSchema,
   /** Stamped by the provider — keeps the fanned catalog routable. */
   addonId: external_exports.string(),
   enabled: external_exports.boolean(),
   /** Vendor model id, or the managed runtime's loaded model. */
   model: external_exports.string(),
-  /** Required for openai-compatible; override for cloud kinds. */
-  baseUrl: external_exports.string().optional(),
-  /** ConfigUISchema type:'password' — never round-trips (spec §5). */
-  apiKey: external_exports.string().optional(),
   /** Vision on/off. A vision call against a `false` profile is REFUSED, never
   *  degraded to text — that shipped once and produced a confident answer to a
   *  question about a picture nobody sent. */
@@ -46459,15 +46661,11 @@ var LlmProfileSchema = external_exports.object({
   temperature: external_exports.number().min(0).max(2).optional(),
   /** Nucleus sampling. Every wire we speak has it. */
   topP: external_exports.number().min(0).max(1).optional(),
-  /** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
-  *  wire does, and the client drops it there (measured: the request body gets
-  *  `top_p` and no `top_k`). The profile editor hides the field wherever it
-  *  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+  /** Top-k sampling. Carried only by the wires that have it — a kind offers the
+  *  field in its editor only when its descriptor lists it in `profileFields`. */
   topK: external_exports.number().int().positive().optional(),
   maxTokens: external_exports.number().int().positive().optional(),
-  /** Prompt context window. Advisory for cloud kinds (they enforce their own);
-  *  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
-  *  the model with, so it is the one field that changes a PROCESS. */
+  /** Prompt context window. Advisory for cloud kinds (they enforce their own). */
   contextLength: external_exports.number().int().positive().optional(),
   /** Default system prompt. A caller's `system` REPLACES it (never appends —
   *  two system prompts fighting is worse than either alone). */
@@ -46493,26 +46691,76 @@ var LlmProfileSchema = external_exports.object({
   *  library; the REGISTRY of callable tools is ours and is empty in v1, so a
   *  `true` here buys the wiring, not behaviour, until tools are registered. */
   toolsEnabled: external_exports.boolean().default(false),
-  extraHeaders: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  /** kind === 'managed-local' only (spec §4). */
-  runtime: ManagedRuntimeConfigSchema.optional(),
-  /**
-  * kind === 'apple-foundation' only: WHERE it runs — the only thing there is
-  * to configure (no key, no URL, no download; `model` is `apple-system`).
-  * `supportsVision` on such a row is stamped by the provider from the node's
-  * reported `imageInput`, never taken from the operator (D62).
-  */
-  appleFoundation: external_exports.object({ nodeId: external_exports.string() }).optional()
+  /** Everything the kind's provider owns (endpoint, key, node, runtime…). */
+  providerConfig: LlmProviderConfigSchema.default({})
+});
+var LlmProfileFieldSchema = external_exports.enum([
+  "temperature",
+  "topP",
+  "topK",
+  "maxTokens",
+  "contextLength",
+  "systemPrompt",
+  "timeoutMs",
+  "connectTimeoutMs",
+  "firstTokenTimeoutMs",
+  "idleTimeoutMs",
+  "retry",
+  "toolsEnabled"
+]);
+var LlmProviderWidgetSchema = external_exports.object({
+  id: external_exports.string(),
+  placement: external_exports.enum(["connection", "model"]),
+  /** `providerConfig` keys this widget must fill before the profile can be saved. */
+  requires: external_exports.array(external_exports.string()).optional()
 });
 var ConfigSchemaPassthrough$3 = external_exports.unknown();
 var LlmProfileKindDescriptorSchema = external_exports.object({
   kind: LlmProfileKindSchema,
   label: external_exports.string(),
+  /** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
   icon: external_exports.string(),
   /** Stamped by each provider so the concat-fanned catalog stays routable. */
   addonId: external_exports.string(),
-  configSchema: ConfigSchemaPassthrough$3
+  /** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
+  connectionSchema: ConfigSchemaPassthrough$3,
+  /** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
+  advancedSchema: ConfigSchemaPassthrough$3.optional(),
+  /** The kind's defaults; a model from `listModels` may override any of them. */
+  features: LlmModelFeaturesSchema,
+  /** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
+  visionEditable: external_exports.boolean(),
+  /** Where the model list comes from: `listModels`, `staticModels`, or nowhere. */
+  modelCatalog: external_exports.enum([
+    "fetch",
+    "static",
+    "none"
+  ]),
+  staticModels: external_exports.array(LlmModelInfoSchema).optional(),
+  /** The common fields that mean something on this kind's wire. */
+  profileFields: external_exports.array(LlmProfileFieldSchema),
+  providerWidgets: external_exports.array(LlmProviderWidgetSchema).optional()
+});
+var LlmListModelsInputSchema = external_exports.object({
+  addonId: external_exports.string(),
+  kind: LlmProfileKindSchema,
+  profileId: external_exports.string().optional(),
+  connection: LlmProviderConfigSchema.optional()
 });
+var LlmListModelsErrorCodeSchema = external_exports.enum([
+  "auth",
+  "network",
+  "unsupported",
+  "invalid"
+]);
+var LlmListModelsResultSchema = external_exports.discriminatedUnion("ok", [external_exports.object({
+  ok: external_exports.literal(true),
+  models: external_exports.array(LlmModelInfoSchema)
+}), external_exports.object({
+  ok: external_exports.literal(false),
+  code: LlmListModelsErrorCodeSchema,
+  message: external_exports.string()
+})]);
 var LlmDefaultSelectorSchema = external_exports.union([external_exports.object({ consumer: external_exports.string() }), external_exports.object({ purpose: external_exports.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = external_exports.object({
   selector: LlmDefaultSelectorSchema,
@@ -46632,8 +46880,17 @@ var llmCapability = {
       auth: "admin",
       timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
     }),
-    /** Live vendor enumeration (GET /models etc.). */
-    listModels: method(ProfileRefInputSchema, external_exports.array(external_exports.string())),
+    /**
+    * The models a kind offers, for a SAVED profile or an unsaved draft
+    * (`connection`). A mutation, not a query: a draft may carry a key, and a
+    * query's input travels in the URL. Admin: it dials whatever endpoint the
+    * draft names and may resolve a stored key to do it. The answer never
+    * carries a secret — failures are a typed result, never a throw.
+    */
+    listModels: method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
     getDefaults: method(external_exports.object({}), external_exports.array(LlmDefaultSchema)),
     setDefault: method(external_exports.object({
       selector: LlmDefaultSelectorSchema,
@@ -50264,123 +50521,6 @@ var notificationRulesCapability = {
     getAlarmSensors: method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" })
   }
 };
-var MethodAccessSchema = external_exports.enum([
-  "view",
-  "create",
-  "delete"
-]);
-var AllowedProviderSchema = external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]);
-var AllowedDevicesSchema = external_exports.record(external_exports.string(), external_exports.union([external_exports.literal("*"), external_exports.array(external_exports.string())]));
-var CapScopeSchema = external_exports.enum(["device", "system"]);
-var DeviceSelectorSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({ kind: external_exports.literal("all") }),
-  external_exports.object({
-    kind: external_exports.literal("ids"),
-    ids: external_exports.array(external_exports.number().int()).min(1)
-  }),
-  external_exports.object({
-    kind: external_exports.literal("types"),
-    types: external_exports.array(external_exports.enum(DeviceType)).min(1)
-  }),
-  external_exports.object({
-    kind: external_exports.literal("locations"),
-    locations: external_exports.array(external_exports.string().min(1)).min(1)
-  })
-]);
-var DeviceTokenScopeSchema = external_exports.object({
-  type: external_exports.literal("device"),
-  /** The device SET this grant covers — resolved against the live fleet. */
-  selector: DeviceSelectorSchema,
-  access: external_exports.array(MethodAccessSchema).min(1),
-  /**
-  * Whether a grant on a PARENT device transparently covers its accessory
-  * CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-  * Direction is parent → children ONLY.
-  *
-  * Absent → the matcher DERIVES it from the access flavour: `view`
-  * inherits (a camera viewer sees the camera's accessories), `create` /
-  * `delete` do NOT (actuating/removing a child is an explicit act the
-  * operator must grant on the child, not inherit from the parent). Set it
-  * explicitly to override that default per grant.
-  */
-  includeLinked: external_exports.boolean().optional()
-});
-function migrateLegacyTokenScope(raw) {
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-  if (Reflect.get(raw, "type") !== "device") return raw;
-  if (Reflect.get(raw, "selector") !== void 0) return raw;
-  const targets = Reflect.get(raw, "targets");
-  if (!Array.isArray(targets)) return raw;
-  return {
-    type: "device",
-    selector: {
-      kind: "ids",
-      ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-    },
-    access: Reflect.get(raw, "access")
-  };
-}
-var TokenScopeSchema = external_exports.preprocess(migrateLegacyTokenScope, external_exports.discriminatedUnion("type", [
-  external_exports.object({
-    type: external_exports.literal("category"),
-    target: CapScopeSchema,
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  external_exports.object({
-    type: external_exports.literal("capability"),
-    target: external_exports.string(),
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  external_exports.object({
-    type: external_exports.literal("addon"),
-    target: external_exports.string(),
-    access: external_exports.array(MethodAccessSchema).min(1)
-  }),
-  DeviceTokenScopeSchema
-]));
-var UserRecordSchema = external_exports.object({
-  id: external_exports.string(),
-  username: external_exports.string(),
-  passwordHash: external_exports.string(),
-  /**
-  * Admin bypass. When true, the middleware skips the scope-access
-  * check entirely. There is no other axis of privilege; the legacy
-  * role enum collapsed onto this boolean in v2.
-  */
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  /**
-  * Scopes granted to this user. Admins bypass; their `scopes` is
-  * ignored. Non-admins without scopes are locked out of every
-  * protected call.
-  */
-  scopes: external_exports.array(TokenScopeSchema).default([]),
-  createdAt: external_exports.number(),
-  updatedAt: external_exports.number()
-});
-var ApiKeyRecordSchema = external_exports.object({
-  id: external_exports.string(),
-  label: external_exports.string(),
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: AllowedProviderSchema,
-  allowedDevices: AllowedDevicesSchema,
-  tokenHash: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  createdAt: external_exports.number(),
-  lastUsedAt: external_exports.number().optional()
-});
-var ScopedTokenSchema = external_exports.object({
-  id: external_exports.string(),
-  userId: external_exports.string(),
-  name: external_exports.string(),
-  tokenHash: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  scopes: external_exports.array(TokenScopeSchema),
-  expiresAt: external_exports.number().nullish(),
-  lastUsedAt: external_exports.number().nullish(),
-  createdAt: external_exports.number()
-});
 var OauthIntegrationDescriptorSchema = external_exports.object({
   /** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
   integrationId: external_exports.string(),
@@ -70016,26 +70156,6 @@ var ApiKeySummarySchema = external_exports.object({
   createdAt: external_exports.number(),
   lastUsedAt: external_exports.number().optional()
 });
-var ScopedTokenSummarySchema = external_exports.object({
-  id: external_exports.string(),
-  userId: external_exports.string(),
-  name: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  scopes: external_exports.array(TokenScopeSchema),
-  expiresAt: external_exports.number().nullish(),
-  lastUsedAt: external_exports.number().nullish(),
-  createdAt: external_exports.number()
-});
-var CreateScopedTokenInputSchema = external_exports.object({
-  userId: external_exports.string(),
-  name: external_exports.string(),
-  scopes: external_exports.array(TokenScopeSchema),
-  expiresAt: external_exports.number().optional()
-});
-var CreateScopedTokenResultSchema = external_exports.object({
-  token: external_exports.string(),
-  record: ScopedTokenSummarySchema
-});
 var OauthSessionSummarySchema = external_exports.object({
   id: external_exports.string(),
   userId: external_exports.string(),
@@ -70122,18 +70242,6 @@ var userManagementCapability = {
       auth: "admin",
       access: "delete"
     }),
-    createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
-      kind: "mutation",
-      auth: "admin",
-      access: "create"
-    }),
-    revokeScopedToken: method(external_exports.object({ id: external_exports.string() }), external_exports.object({ success: external_exports.literal(true) }), {
-      kind: "mutation",
-      auth: "admin",
-      access: "delete"
-    }),
-    validateScopedToken: method(external_exports.object({ token: external_exports.string() }), ScopedTokenSummarySchema.nullable(), { access: "view" }),
-    listScopedTokens: method(external_exports.object({ userId: external_exports.string() }), external_exports.array(ScopedTokenSummarySchema), { auth: "admin" }),
     setupTotp: method(external_exports.object({ userId: external_exports.string() }), TotpSetupResultSchema, {
       kind: "mutation",
       auth: "admin",
@@ -74811,7 +74919,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
     capName: "llm",
     capScope: "system",
     addonId: null,
-    access: "view"
+    access: "create"
   },
   "llm.listNodeModels": {
     capName: "llm",
@@ -79475,12 +79583,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "userManagement.createScopedToken": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "create"
-  },
   "userManagement.createUser": {
     capName: "user-management",
     capScope: "system",
@@ -79529,12 +79631,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "userManagement.listScopedTokens": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "view"
-  },
   "userManagement.listUsers": {
     capName: "user-management",
     capScope: "system",
@@ -79589,12 +79685,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
-  "userManagement.revokeScopedToken": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "delete"
-  },
   "userManagement.setupTotp": {
     capName: "user-management",
     capScope: "system",
@@ -79625,12 +79715,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "userManagement.validateScopedToken": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "view"
-  },
   "userManagement.verifyTotp": {
     capName: "user-management",
     capScope: "system",
@@ -85953,6 +86037,7 @@ import * as clack from "@clack/prompts";
 import {
   clearSession,
   defaultSession,
+  jwtClaims,
   listSessions,
   loadSession,
   saveSession
@@ -85968,20 +86053,11 @@ import {
   validateHubAddress
 } from "@camstack/develop";
 import {
-  discoverHubs,
-  normalizeHubUrl
+  discoverHubs
 } from "@camstack/develop/hub-discovery";
-var ADMIN_TOKEN_SUFFIX = ".admin-token";
 function validateManualHubUrl(value) {
   return validateHubAddress(value);
 }
-function hubUrlFromAdminTokenFile(fileName) {
-  if (!fileName.endsWith(ADMIN_TOKEN_SUFFIX)) return null;
-  const slug = fileName.slice(0, -ADMIN_TOKEN_SUFFIX.length);
-  const match = /^(.+?)_(\d{1,5})$/.exec(slug);
-  const candidate = match ? `https://${match[1]}:${match[2]}` : `https://${slug}`;
-  return normalizeHubUrl(candidate)?.url ?? null;
-}
 function knownHubCandidates(deps) {
   const dir = deps.sessionDir ?? defaultSessionDir();
   const env = deps.env ?? process.env;
@@ -86004,9 +86080,6 @@ function knownHubCandidates(deps) {
         }
       } catch {
       }
-    } else {
-      const url2 = hubUrlFromAdminTokenFile(file2);
-      if (url2 !== null) out.push({ url: url2, source: "saved admin token" });
     }
   }
   const fromEnv = resolveHubUrl({ env, session: null });
@@ -86134,30 +86207,32 @@ function isLoginPayload(value) {
   const u = v.user;
   return typeof u.id === "string" && typeof u.username === "string";
 }
-function isLogoutPayload(value) {
-  if (value === null || typeof value !== "object") return false;
-  return Reflect.get(value, "success") === true && typeof Reflect.get(value, "revoked") === "number";
-}
-var SCOPED_TOKEN_PREFIX = "cst_";
-var ADMIN_TOKEN_PREFIX = "csa_";
-async function revokePriorSession(server, prior, authJwt) {
-  if (prior.token.startsWith(SCOPED_TOKEN_PREFIX) && prior.tokenId) {
-    await callTrpcMutation(
-      `${server}/trpc/userManagement.revokeScopedToken?batch=1`,
-      `Bearer ${authJwt}`,
-      { id: prior.tokenId },
-      isUnknown
-    );
-    return;
+function revocationFor(session) {
+  if (session.tokenId) {
+    return {
+      procedure: "auth.revokeToken",
+      input: { id: session.tokenId },
+      bearer: "fresh"
+    };
   }
-  if (!prior.token.startsWith(SCOPED_TOKEN_PREFIX) && !prior.token.startsWith(ADMIN_TOKEN_PREFIX)) {
-    await callTrpcMutation(
-      `${server}/trpc/auth.logout?batch=1`,
-      `Bearer ${prior.token}`,
-      {},
-      isLogoutPayload
-    );
+  if (jwtClaims(session.token) !== null) {
+    return { procedure: "auth.logout", input: {}, bearer: "self" };
   }
+  return null;
+}
+async function performRevocation(server, session, freshJwt) {
+  const r = revocationFor(session);
+  if (!r) return;
+  const bearer = r.bearer === "fresh" && freshJwt ? freshJwt : session.token;
+  await callTrpcMutation(
+    `${server}/trpc/${r.procedure}?batch=1`,
+    `Bearer ${bearer}`,
+    r.input,
+    isUnknown
+  );
+}
+async function revokePriorSession(server, prior, authJwt) {
+  await performRevocation(server, prior, authJwt);
 }
 async function completeSecondFactor(server, login) {
   const factors = login.secondFactors ?? [];
@@ -86174,7 +86249,7 @@ async function completeSecondFactor(server, login) {
       return await callTrpcMutation(
         `${server}/trpc/auth.loginVerifyTotp?batch=1`,
         void 0,
-        { challengeToken: login.token, code },
+        { challengeToken: login.token, code, refreshable: true },
         isLoginPayload
       );
     } catch (err) {
@@ -86267,6 +86342,8 @@ async function loginCommand(opts) {
   let displayName;
   let userId;
   let isAdmin = false;
+  let refreshToken;
+  let expiresAt;
   while (true) {
     const authSpinner = clack.spinner();
     authSpinner.start(
@@ -86276,7 +86353,7 @@ async function loginCommand(opts) {
       const first = await callTrpcMutation(
         `${server}/trpc/auth.login?batch=1`,
         void 0,
-        { username, password: password2 },
+        { username, password: password2, refreshable: true },
         isLoginPayload
       );
       const owesSecondFactor = (first.secondFactors ?? []).length > 0;
@@ -86286,6 +86363,8 @@ async function loginCommand(opts) {
       displayName = login.user.username;
       userId = login.user.id;
       isAdmin = login.user.isAdmin === true;
+      refreshToken = login.refreshToken;
+      expiresAt = login.expiresAt;
       if (!owesSecondFactor) authSpinner.stop(`Authenticated as ${displayName}`);
       break;
     } catch (err) {
@@ -86317,14 +86396,14 @@ async function loginCommand(opts) {
     token: jwt2,
     scopes: [],
     createdAt: Date.now(),
-    ...isAdmin ? { isAdmin: true } : {}
+    ...isAdmin ? { isAdmin: true } : {},
+    ...refreshToken ? { refreshToken } : {},
+    ...expiresAt !== void 0 ? { expiresAt } : {}
   };
   const file2 = saveSession(session);
   const role = isAdmin ? "administrator" : "user";
-  clack.outro(
-    `\u2713 Logged in as ${displayName} (${role}) \u2192 ${server}
-  Cached at ${file2}`
-  );
+  clack.outro(`\u2713 Logged in as ${displayName} (${role}) \u2192 ${server}
+  Cached at ${file2}`);
 }
 async function logoutCommand(opts) {
   const session = loadSession(opts.server);
@@ -86336,21 +86415,7 @@ async function logoutCommand(opts) {
   const spinner3 = clack.spinner();
   spinner3.start(`Revoking token on ${session.server}`);
   try {
-    if (session.token.startsWith(SCOPED_TOKEN_PREFIX) && session.tokenId) {
-      await callTrpcMutation(
-        `${session.server}/trpc/userManagement.revokeScopedToken?batch=1`,
-        `Bearer ${session.token}`,
-        { id: session.tokenId },
-        isUnknown
-      );
-    } else if (!session.token.startsWith(SCOPED_TOKEN_PREFIX) && !session.token.startsWith(ADMIN_TOKEN_PREFIX)) {
-      await callTrpcMutation(
-        `${session.server}/trpc/auth.logout?batch=1`,
-        `Bearer ${session.token}`,
-        {},
-        isLogoutPayload
-      );
-    }
+    await performRevocation(session.server, session, void 0);
     spinner3.stop("Session revoked server-side.");
   } catch (err) {
     spinner3.stop(
@@ -86396,7 +86461,15 @@ async function whoamiCommand(opts) {
   if (session.tokenId) console.log(`  tokenId:   ${session.tokenId}`);
   const scopeLine = session.scopes.length > 0 ? session.scopes.map((s) => `${s.type}:${s.target}`).join(", ") : "(login JWT)";
   console.log(`  scopes:    ${scopeLine}`);
-  console.log(`  admin:     ${session.isAdmin === true ? "yes" : "no"}`);
+  const claims = jwtClaims(session.token);
+  const admin = session.isAdmin === true || claims?.["isAdmin"] === true;
+  console.log(`  admin:     ${admin ? "yes" : "no"}`);
+  const expiresAt = session.expiresAt ?? (typeof claims?.["exp"] === "number" ? claims["exp"] * 1e3 : void 0);
+  if (expiresAt !== void 0) {
+    console.log(
+      `  expires:   ${new Date(expiresAt).toISOString()}${session.refreshToken ? " (renewed automatically)" : ""}`
+    );
+  }
   console.log(`  createdAt: ${new Date(session.createdAt).toISOString()}`);
   console.log("");
   console.log(`[camstack] Pinging ${session.server}/api/auth/whoami\u2026`);
@@ -86441,7 +86514,7 @@ import {
   MissingCredentialsError,
   normalizeHubAddress as normalizeHubAddress3,
   touchSession as touchSession3,
-  resolveCredentials as resolveCredentials3
+  resolveFreshCredentials as resolveFreshCredentials3
 } from "@camstack/develop";
 
 // src/commands/discover.ts
@@ -86688,7 +86761,20 @@ import * as fs7 from "fs";
 import * as path7 from "path";
 import { parseArgs as parseArgs6 } from "util";
 import * as clack3 from "@clack/prompts";
-import { loadSession as loadSession2, resolveCredentials, touchSession } from "@camstack/develop";
+import { loadSession as loadSession2, resolveFreshCredentials, touchSession } from "@camstack/develop";
+
+// src/http/hub-transport.ts
+var cliHubTransport = async (req) => {
+  const res = await hubRequest(req.url, {
+    method: req.method,
+    headers: req.headers,
+    ...req.body !== void 0 ? { body: req.body } : {},
+    timeoutMs: req.timeoutMs
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+// src/commands/dev.ts
 var DEFAULT_DEBOUNCE_MS = 500;
 var DEFAULT_WATCH_SUBDIR = "src";
 function resolveAddonDir(arg) {
@@ -86720,12 +86806,12 @@ function watchRecursive(target, onEvent) {
     return { close: () => w.close(), recursive: false };
   }
 }
-async function pushOnce(addonPath, opts, label) {
+async function pushOnce(addonPath, getOpts, label) {
   const start = Date.now();
   console.log(`
 [camstack dev] \u2192 ${label}\u2026`);
   try {
-    await deployAddon(addonPath, opts);
+    await deployAddon(addonPath, await getOpts());
     const took = ((Date.now() - start) / 1e3).toFixed(1);
     console.log(`[camstack dev] \u2713 Synced in ${took}s`);
   } catch (err) {
@@ -86754,12 +86840,14 @@ async function runDev(args) {
   });
   const addonArg = positionals[0] ?? ".";
   const addonDir = resolveAddonDir(addonArg);
-  const creds = resolveCredentials({
+  const credentialInputs = {
     ...typeof values.server === "string" ? { server: values.server } : {},
     ...typeof values.token === "string" ? { token: values.token } : {},
     ...typeof values["token-file"] === "string" ? { tokenFile: values["token-file"] } : {},
-    loadSession: loadSession2
-  });
+    loadSession: loadSession2,
+    transport: cliHubTransport
+  };
+  const creds = await resolveFreshCredentials(credentialInputs);
   if (creds.warning) console.error(`[camstack dev] Warning: ${creds.warning}`);
   if (creds.source === "session" && creds.server) touchSession(creds.server);
   const serverUrl = creds.server;
@@ -86778,6 +86866,10 @@ async function runDev(args) {
     buildMode: values["no-build"] === true ? "skip" : "auto",
     ...typeof values["build-script"] === "string" ? { buildScript: values["build-script"] } : {}
   };
+  const freshOpts = async () => ({
+    ...deployOpts,
+    token: (await resolveFreshCredentials(credentialInputs)).token
+  });
   const watchOverride = typeof values["watch-path"] === "string" ? values["watch-path"] : void 0;
   const watchTarget = watchOverride ? path7.resolve(addonDir, watchOverride) : fs7.existsSync(path7.join(addonDir, DEFAULT_WATCH_SUBDIR)) ? path7.join(addonDir, DEFAULT_WATCH_SUBDIR) : addonDir;
   if (!fs7.existsSync(watchTarget)) {
@@ -86791,7 +86883,7 @@ async function runDev(args) {
   );
   clack3.log.info(`Debounce: ${debounceMs}ms`);
   if (values["no-initial-push"] !== true) {
-    await pushOnce(addonDir, deployOpts, "Initial sync");
+    await pushOnce(addonDir, freshOpts, "Initial sync");
   } else {
     console.log("[camstack dev] Skipping initial push (--no-initial-push). Waiting for changes\u2026");
   }
@@ -86807,7 +86899,7 @@ async function runDev(args) {
       }
       pushing = true;
       try {
-        await pushOnce(addonDir, deployOpts, "File change detected \u2014 rebuilding");
+        await pushOnce(addonDir, freshOpts, "File change detected \u2014 rebuilding");
       } finally {
         pushing = false;
         if (pending) {
@@ -86843,7 +86935,7 @@ import * as clack4 from "@clack/prompts";
 import {
   loadSession as loadSession3,
   touchSession as touchSession2,
-  resolveCredentials as resolveCredentials2,
+  resolveFreshCredentials as resolveFreshCredentials2,
   withAuthHint as withAuthHint3
 } from "@camstack/develop";
 var POLL_INTERVAL_MS2 = 2e3;
@@ -86907,12 +86999,14 @@ async function runWatch(args) {
     allowPositionals: true
   });
   const addonArg = positionals[0] ?? ".";
-  const creds = resolveCredentials2({
+  const credentialInputs = {
     ...typeof values.server === "string" ? { server: values.server } : {},
     ...typeof values.token === "string" ? { token: values.token } : {},
     ...typeof values["token-file"] === "string" ? { tokenFile: values["token-file"] } : {},
-    loadSession: loadSession3
-  });
+    loadSession: loadSession3,
+    transport: cliHubTransport
+  };
+  const creds = await resolveFreshCredentials2(credentialInputs);
   if (creds.warning) console.error(`[camstack watch] Warning: ${creds.warning}`);
   if (creds.source === "session" && creds.server) touchSession2(creds.server);
   const serverUrl = creds.server;
@@ -86951,7 +87045,14 @@ async function runWatch(args) {
   process.on("SIGTERM", shutdown);
   while (!stop) {
     try {
-      const entries2 = await fetchLogs(serverUrl, token, addonId, LOG_BATCH_LIMIT, creds.source);
+      const fresh = await resolveFreshCredentials2(credentialInputs);
+      const entries2 = await fetchLogs(
+        serverUrl,
+        fresh.token,
+        addonId,
+        LOG_BATCH_LIMIT,
+        creds.source
+      );
       const sorted = [...entries2].toSorted((a, b) => {
         const ta = typeof a.timestamp === "number" ? a.timestamp : new Date(a.timestamp).getTime();
         const tb = typeof b.timestamp === "number" ? b.timestamp : new Date(b.timestamp).getTime();
@@ -87423,7 +87524,7 @@ function buildCommands() {
         "  -p, --password <pwd>   Password (skips prompt \u2014 prefer letting the CLI prompt)",
         `  --token-name <name>    Ignored (kept for scripts); login uses your hub session JWT`,
         "      --admin             Ignored (kept for muscle memory); admin follows your account role",
-        "      --admin-days <n>    Ignored (kept for muscle memory); no separate admin-token mint"
+        "      --admin-days <n>    Ignored (kept for muscle memory); one login, one token format"
       ].join("\n")
     },
     {
@@ -87434,7 +87535,7 @@ function buildCommands() {
         "Usage: camstack discover [options]",
         "",
         "Lists the hubs `camstack login` would offer: those announcing _camstack._tcp over",
-        "  mDNS plus saved sessions, admin-token files, $CAMSTACK_HUB_URL and scratchpad/.hub-url,",
+        "  mDNS plus saved sessions, $CAMSTACK_HUB_URL and scratchpad/.hub-url,",
         "  reachable ones only, each with its source. Agents never announce this service.",
         "",
         "Options:",
@@ -87711,7 +87812,7 @@ async function runWhoami(args) {
   const server = stringOpt(parsed.values, "server");
   await whoamiCommand(server ? { server: normalizeHubAddress3(server) } : {});
 }
-function resolveClosureDeployOpts(values) {
+async function resolveClosureDeployOpts(values) {
   const nodeId = stringOpt(values, "node");
   const cluster = boolOpt(values, "cluster") || boolOpt(values, "all");
   if (cluster && nodeId) {
@@ -87719,7 +87820,7 @@ function resolveClosureDeployOpts(values) {
     process.exit(1);
   }
   const version2 = stringOpt(values, "version");
-  const creds = resolveCommandCredentials(values);
+  const creds = await resolveCommandCredentials(values);
   return {
     serverUrl: creds.server ?? DEFAULT_SERVER_URL,
     token: creds.token,
@@ -87757,7 +87858,7 @@ async function runDeploy(args) {
       console.error("[camstack] Error: --closure does not take addon --build / --no-build flags.");
       process.exit(1);
     }
-    await deployServer(resolveClosureDeployOpts(parsed.values));
+    await deployServer(await resolveClosureDeployOpts(parsed.values));
     return;
   }
   if (stringOpt(parsed.values, "version")) {
@@ -87765,7 +87866,7 @@ async function runDeploy(args) {
     process.exit(1);
   }
   const addonPath = parsed.positionals[0] ?? ".";
-  const creds = resolveCommandCredentials(parsed.values);
+  const creds = await resolveCommandCredentials(parsed.values);
   const server = creds.server ?? DEFAULT_SERVER_URL;
   const token = creds.token;
   const nodeId = stringOpt(parsed.values, "node");
@@ -87817,19 +87918,20 @@ async function runDeployServer(args) {
     return;
   }
   console.log("[camstack] note: `deploy-server` is an alias of `deploy --closure`");
-  await deployServer(resolveClosureDeployOpts(parsed.values));
+  await deployServer(await resolveClosureDeployOpts(parsed.values));
 }
 var DEFAULT_SERVER_URL = "https://localhost:4443";
-function resolveCommandCredentials(values) {
+async function resolveCommandCredentials(values) {
   const server = stringOpt(values, "server");
   const token = stringOpt(values, "token");
   const tokenFile = stringOpt(values, "token-file");
   try {
-    const creds = resolveCredentials3({
+    const creds = await resolveFreshCredentials3({
       ...server ? { server } : {},
       ...token ? { token } : {},
       ...tokenFile ? { tokenFile } : {},
-      loadSession: loadSession4
+      loadSession: loadSession4,
+      transport: cliHubTransport
     });
     if (creds.warning) console.error(`[camstack] Warning: ${creds.warning}`);
     if (creds.source === "session" && creds.server) touchSession3(creds.server);