@camstack/system 1.2.32 → 1.2.34

package/dist/auth/scoped-token-manager.d.ts

@@ -21,6 +21,31 @@ export declare class ScopedTokenManager {
     revoke(tokenId: string): Promise<void>;
     listForUser(userId: string): Promise<ScopedToken[]>;
     updateLastUsed(tokenId: string): Promise<void>;
+    /**
+     * Delete tokens whose expiry has passed.
+     *
+     * These were never usable — {@link validate} already rejects an expired
+     * token — so this is hygiene rather than a hole being closed, and it is
+     * worth being precise about what it actually buys:
+     *
+     *  - `listForUser` returns rows with no expiry filter, so the operator's
+     *    token list showed dead tokens as if they were live. There was no way to
+     *    tell from the UI which ones still worked.
+     *  - a database that outlives its tokens keeps their hashes indefinitely.
+     *    27 rows on the live hub had been unusable for months.
+     *
+     * A token with NO expiry (`expiresAt` null/absent) is a deliberate
+     * never-expires token and MUST survive: `BETWEEN` never matches NULL in
+     * SQL, which is the property this depends on and the spec pins against a
+     * real SQLite.
+     *
+     * The bound is `nowMs - 1` because {@link validate} treats `now ===
+     * expiresAt` as still valid; reaping at exactly the expiry instant would
+     * delete a token that the same millisecond still accepts.
+     *
+     * Returns how many rows went.
+     */
+    reapExpired(nowMs?: number): Promise<number>;
     /**
      * One-shot migration: drop tokens whose owner can't be resolved.
      *

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, ot as BaseAddon, p as addonPagesCapability } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, at as errMsg, ot as BaseAddon, p as addonPagesCapability } from "../../dist-BjUYsgkj.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, h as addonWidgetsCapability, ot as BaseAddon } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, at as errMsg, h as addonWidgetsCapability, ot as BaseAddon } from "../../dist-BjUYsgkj.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, g as alertsCapability, n as AlertSchema, ot as BaseAddon, yt as createEvent } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, at as errMsg, g as alertsCapability, n as AlertSchema, ot as BaseAddon, yt as createEvent } from "../../dist-BjUYsgkj.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, ot as BaseAddon, y as backupCapability } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, ot as BaseAddon, y as backupCapability } from "../../dist-BjUYsgkj.mjs";
 import * as fs from "node:fs";
 import Kt from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-BL_FHWPP.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-BjUYsgkj.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { C as deviceStateCapability, D as enumerateItemArrayFields, K as parseStreamParamsFormPatch, M as getByPath, Mt as EventCategory, O as enumerateSchemaFields, S as deviceManagerCapability, W as normalizeUnit, X as setByPath, _ as applyTransform, a as CAP_NAMES_WITH_STATUS, at as errMsg, b as buildStreamParamsConfigSchema, dt as DeviceRole, ft as DeviceType, ht as WELL_KNOWN_TAB_MAP, it as validateExpressionSource, jt as sleep, k as evaluateLinkExpression, l as STREAM_PROFILE_META, nt as toExpressionValue, o as DeviceStatusSchema, ot as BaseAddon, t as ALL_CAPABILITY_DEFINITIONS, ut as DeviceFeature, w as deviceStatusCapability, wt as isDeviceConfigCap } from "../../dist-BL_FHWPP.mjs";
+import { C as deviceStateCapability, D as enumerateItemArrayFields, K as parseStreamParamsFormPatch, M as getByPath, Mt as EventCategory, O as enumerateSchemaFields, S as deviceManagerCapability, W as normalizeUnit, X as setByPath, _ as applyTransform, a as CAP_NAMES_WITH_STATUS, at as errMsg, b as buildStreamParamsConfigSchema, dt as DeviceRole, ft as DeviceType, ht as WELL_KNOWN_TAB_MAP, it as validateExpressionSource, jt as sleep, k as evaluateLinkExpression, l as STREAM_PROFILE_META, nt as toExpressionValue, o as DeviceStatusSchema, ot as BaseAddon, t as ALL_CAPABILITY_DEFINITIONS, ut as DeviceFeature, w as deviceStatusCapability, wt as isDeviceConfigCap } from "../../dist-BjUYsgkj.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, T as doorbellCapability, at as errMsg, ft as DeviceType, ot as BaseAddon, yt as createEvent } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, T as doorbellCapability, at as errMsg, ft as DeviceType, ot as BaseAddon, yt as createEvent } from "../../dist-BjUYsgkj.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-BL_FHWPP.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-BjUYsgkj.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, ot as BaseAddon, yt as createEvent } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, at as errMsg, ot as BaseAddon, yt as createEvent } from "../../dist-BjUYsgkj.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -10,9 +10,21 @@ export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
     private apiKeyManager;
     private scopedTokenManager;
     private oauthSessionManager;
+    private reapTimer;
     private totpManager;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    /**
+     * Drop auth rows that are dead but were never removed: scoped tokens past
+     * their expiry, and OAuth sessions revoked longer ago than
+     * {@link OAUTH_REVOKED_RETENTION_MS}.
+     *
+     * Neither row could authorise anything — `validate` rejects an expired
+     * token, and every consumer treats a missing session exactly like a revoked
+     * one. So this is hygiene, and it is best-effort: a failed sweep is logged
+     * and the next tick tries again. It must never be able to fail boot.
+     */
+    private reapAuthRows;
     protected onShutdown(): Promise<void>;
 }
 export default LocalAuthAddon;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6434,6 +6434,37 @@ var ScopedTokenManager = class {
 		});
 	}
 	/**
+	* Delete tokens whose expiry has passed.
+	*
+	* These were never usable — {@link validate} already rejects an expired
+	* token — so this is hygiene rather than a hole being closed, and it is
+	* worth being precise about what it actually buys:
+	*
+	*  - `listForUser` returns rows with no expiry filter, so the operator's
+	*    token list showed dead tokens as if they were live. There was no way to
+	*    tell from the UI which ones still worked.
+	*  - a database that outlives its tokens keeps their hashes indefinitely.
+	*    27 rows on the live hub had been unusable for months.
+	*
+	* A token with NO expiry (`expiresAt` null/absent) is a deliberate
+	* never-expires token and MUST survive: `BETWEEN` never matches NULL in
+	* SQL, which is the property this depends on and the spec pins against a
+	* real SQLite.
+	*
+	* The bound is `nowMs - 1` because {@link validate} treats `now ===
+	* expiresAt` as still valid; reaping at exactly the expiry instant would
+	* delete a token that the same millisecond still accepts.
+	*
+	* Returns how many rows went.
+	*/
+	async reapExpired(nowMs = Date.now()) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: TOKENS_COLLECTION,
+			filter: { whereBetween: { expiresAt: [1, nowMs - 1] } }
+		});
+		return deleted;
+	}
+	/**
 	* One-shot migration: drop tokens whose owner can't be resolved.
 	*
 	* Two ways a token can end up orphan:
@@ -6582,6 +6613,31 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete sessions revoked longer ago than `horizonMs`.
+	*
+	* Safe because an ABSENT session already fails closed exactly like a revoked
+	* one: every consumer in `oauth-grants.ts` reads
+	* `if (!session || session.revokedAt != null) return null`. Deleting the row
+	* therefore cannot re-enable a link that was cut — it removes a record whose
+	* only remaining job was to say "no", which the absence says too.
+	*
+	* A retention window rather than an immediate delete: a revoked account link
+	* is the kind of thing an operator looks up AFTER the fact ("when did I
+	* unlink that?"), and the row is tiny. Active sessions are never touched —
+	* the filter matches only rows with a `revokedAt` timestamp in range, and
+	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+	* matches.
+	*
+	* Returns how many rows went.
+	*/
+	async reapRevoked(horizonMs) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: SESSIONS_COLLECTION,
+			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
+		});
+		return deleted;
+	}
+	/**
 	* Update `lastUsedAt` to now. No-op (does not throw) when the session
 	* id is not found — the caller (token-use hot path) should not fail
 	* for a missing session that may have been concurrently revoked.
@@ -9277,6 +9333,17 @@ function createOauthGrants(ssoBridge, sessionManager) {
 }
 //#endregion
 //#region src/builtins/local-auth/local-auth.addon.ts
+/** How often the auth tables are swept for dead rows. */
+var AUTH_REAP_INTERVAL_MS = 24 * 36e5;
+/**
+* How long a REVOKED OAuth session is kept before deletion.
+*
+* A revoked link authorises nothing the moment it is revoked (every consumer
+* fails closed on a missing session exactly as on a revoked one), so this
+* window buys only the operator's ability to answer "when did I unlink that?".
+* 30 days, matching the ops-log retention.
+*/
+var OAUTH_REVOKED_RETENTION_MS = 720 * 36e5;
 function toAuthResult(user) {
 	return {
 		userId: user.id,
@@ -9291,6 +9358,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 	apiKeyManager = null;
 	scopedTokenManager = null;
 	oauthSessionManager = null;
+	reapTimer = null;
 	totpManager = null;
 	constructor() {
 		super({
@@ -9332,6 +9400,11 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				const liveIds = new Set(liveUsers.map((u) => u.id));
 				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
 				if (removed > 0) this.ctx.logger.warn(`cleaned up ${removed} orphan scoped-token(s) on boot`);
+				await this.reapAuthRows();
+				this.reapTimer = setInterval(() => {
+					this.reapAuthRows();
+				}, AUTH_REAP_INTERVAL_MS);
+				this.reapTimer.unref?.();
 			} catch (err) {
 				const detail = err instanceof Error ? err.message : String(err);
 				throw new Error(`local-auth bootstrap failed: ensureAdminExists threw before \`user-management\` could be registered. Most likely a \`users\` collection schema mismatch in the settings-store. Underlying: ${detail}`, { cause: err });
@@ -9539,7 +9612,33 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			provider: userMgmt
 		}];
 	}
+	/**
+	* Drop auth rows that are dead but were never removed: scoped tokens past
+	* their expiry, and OAuth sessions revoked longer ago than
+	* {@link OAUTH_REVOKED_RETENTION_MS}.
+	*
+	* Neither row could authorise anything — `validate` rejects an expired
+	* token, and every consumer treats a missing session exactly like a revoked
+	* one. So this is hygiene, and it is best-effort: a failed sweep is logged
+	* and the next tick tries again. It must never be able to fail boot.
+	*/
+	async reapAuthRows() {
+		try {
+			const tokens = await this.scopedTokenManager?.reapExpired() ?? 0;
+			const sessions = await this.oauthSessionManager?.reapRevoked(Date.now() - OAUTH_REVOKED_RETENTION_MS) ?? 0;
+			if (tokens > 0 || sessions > 0) this.ctx.logger.info("auth retention swept", { meta: {
+				expiredTokens: tokens,
+				revokedSessions: sessions
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("auth retention sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
 	async onShutdown() {
+		if (this.reapTimer !== null) {
+			clearInterval(this.reapTimer);
+			this.reapTimer = null;
+		}
 		this.authManager = null;
 		this.userManager = null;
 		this.apiKeyManager = null;

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { f as UserRecordSchema, ot as BaseAddon, r as ApiKeyRecordSchema, rt as userManagementCapability, u as ScopedTokenSchema, v as authProviderCapability } from "../../dist-BL_FHWPP.mjs";
+import { f as UserRecordSchema, ot as BaseAddon, r as ApiKeyRecordSchema, rt as userManagementCapability, u as ScopedTokenSchema, v as authProviderCapability } from "../../dist-BjUYsgkj.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6426,6 +6426,37 @@ var ScopedTokenManager = class {
 		});
 	}
 	/**
+	* Delete tokens whose expiry has passed.
+	*
+	* These were never usable — {@link validate} already rejects an expired
+	* token — so this is hygiene rather than a hole being closed, and it is
+	* worth being precise about what it actually buys:
+	*
+	*  - `listForUser` returns rows with no expiry filter, so the operator's
+	*    token list showed dead tokens as if they were live. There was no way to
+	*    tell from the UI which ones still worked.
+	*  - a database that outlives its tokens keeps their hashes indefinitely.
+	*    27 rows on the live hub had been unusable for months.
+	*
+	* A token with NO expiry (`expiresAt` null/absent) is a deliberate
+	* never-expires token and MUST survive: `BETWEEN` never matches NULL in
+	* SQL, which is the property this depends on and the spec pins against a
+	* real SQLite.
+	*
+	* The bound is `nowMs - 1` because {@link validate} treats `now ===
+	* expiresAt` as still valid; reaping at exactly the expiry instant would
+	* delete a token that the same millisecond still accepts.
+	*
+	* Returns how many rows went.
+	*/
+	async reapExpired(nowMs = Date.now()) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: TOKENS_COLLECTION,
+			filter: { whereBetween: { expiresAt: [1, nowMs - 1] } }
+		});
+		return deleted;
+	}
+	/**
 	* One-shot migration: drop tokens whose owner can't be resolved.
 	*
 	* Two ways a token can end up orphan:
@@ -6574,6 +6605,31 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete sessions revoked longer ago than `horizonMs`.
+	*
+	* Safe because an ABSENT session already fails closed exactly like a revoked
+	* one: every consumer in `oauth-grants.ts` reads
+	* `if (!session || session.revokedAt != null) return null`. Deleting the row
+	* therefore cannot re-enable a link that was cut — it removes a record whose
+	* only remaining job was to say "no", which the absence says too.
+	*
+	* A retention window rather than an immediate delete: a revoked account link
+	* is the kind of thing an operator looks up AFTER the fact ("when did I
+	* unlink that?"), and the row is tiny. Active sessions are never touched —
+	* the filter matches only rows with a `revokedAt` timestamp in range, and
+	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+	* matches.
+	*
+	* Returns how many rows went.
+	*/
+	async reapRevoked(horizonMs) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: SESSIONS_COLLECTION,
+			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
+		});
+		return deleted;
+	}
+	/**
 	* Update `lastUsedAt` to now. No-op (does not throw) when the session
 	* id is not found — the caller (token-use hot path) should not fail
 	* for a missing session that may have been concurrently revoked.
@@ -9269,6 +9325,17 @@ function createOauthGrants(ssoBridge, sessionManager) {
 }
 //#endregion
 //#region src/builtins/local-auth/local-auth.addon.ts
+/** How often the auth tables are swept for dead rows. */
+var AUTH_REAP_INTERVAL_MS = 24 * 36e5;
+/**
+* How long a REVOKED OAuth session is kept before deletion.
+*
+* A revoked link authorises nothing the moment it is revoked (every consumer
+* fails closed on a missing session exactly as on a revoked one), so this
+* window buys only the operator's ability to answer "when did I unlink that?".
+* 30 days, matching the ops-log retention.
+*/
+var OAUTH_REVOKED_RETENTION_MS = 720 * 36e5;
 function toAuthResult(user) {
 	return {
 		userId: user.id,
@@ -9283,6 +9350,7 @@ var LocalAuthAddon = class extends BaseAddon {
 	apiKeyManager = null;
 	scopedTokenManager = null;
 	oauthSessionManager = null;
+	reapTimer = null;
 	totpManager = null;
 	constructor() {
 		super({
@@ -9324,6 +9392,11 @@ var LocalAuthAddon = class extends BaseAddon {
 				const liveIds = new Set(liveUsers.map((u) => u.id));
 				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
 				if (removed > 0) this.ctx.logger.warn(`cleaned up ${removed} orphan scoped-token(s) on boot`);
+				await this.reapAuthRows();
+				this.reapTimer = setInterval(() => {
+					this.reapAuthRows();
+				}, AUTH_REAP_INTERVAL_MS);
+				this.reapTimer.unref?.();
 			} catch (err) {
 				const detail = err instanceof Error ? err.message : String(err);
 				throw new Error(`local-auth bootstrap failed: ensureAdminExists threw before \`user-management\` could be registered. Most likely a \`users\` collection schema mismatch in the settings-store. Underlying: ${detail}`, { cause: err });
@@ -9531,7 +9604,33 @@ var LocalAuthAddon = class extends BaseAddon {
 			provider: userMgmt
 		}];
 	}
+	/**
+	* Drop auth rows that are dead but were never removed: scoped tokens past
+	* their expiry, and OAuth sessions revoked longer ago than
+	* {@link OAUTH_REVOKED_RETENTION_MS}.
+	*
+	* Neither row could authorise anything — `validate` rejects an expired
+	* token, and every consumer treats a missing session exactly like a revoked
+	* one. So this is hygiene, and it is best-effort: a failed sweep is logged
+	* and the next tick tries again. It must never be able to fail boot.
+	*/
+	async reapAuthRows() {
+		try {
+			const tokens = await this.scopedTokenManager?.reapExpired() ?? 0;
+			const sessions = await this.oauthSessionManager?.reapRevoked(Date.now() - OAUTH_REVOKED_RETENTION_MS) ?? 0;
+			if (tokens > 0 || sessions > 0) this.ctx.logger.info("auth retention swept", { meta: {
+				expiredTokens: tokens,
+				revokedSessions: sessions
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("auth retention sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
 	async onShutdown() {
+		if (this.reapTimer !== null) {
+			clearInterval(this.reapTimer);
+			this.reapTimer = null;
+		}
 		this.authManager = null;
 		this.userManager = null;
 		this.apiKeyManager = null;

package/dist/builtins/local-auth/oauth-session-manager.d.ts

@@ -40,6 +40,25 @@ export declare class OauthSessionManager {
      * - Returns `false` when the session id is not found.
      */
     markRevoked(id: string): Promise<boolean>;
+    /**
+     * Delete sessions revoked longer ago than `horizonMs`.
+     *
+     * Safe because an ABSENT session already fails closed exactly like a revoked
+     * one: every consumer in `oauth-grants.ts` reads
+     * `if (!session || session.revokedAt != null) return null`. Deleting the row
+     * therefore cannot re-enable a link that was cut — it removes a record whose
+     * only remaining job was to say "no", which the absence says too.
+     *
+     * A retention window rather than an immediate delete: a revoked account link
+     * is the kind of thing an operator looks up AFTER the fact ("when did I
+     * unlink that?"), and the row is tiny. Active sessions are never touched —
+     * the filter matches only rows with a `revokedAt` timestamp in range, and
+     * `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+     * matches.
+     *
+     * Returns how many rows went.
+     */
+    reapRevoked(horizonMs: number): Promise<number>;
     /**
      * Update `lastUsedAt` to now. No-op (does not throw) when the session
      * id is not found — the caller (token-use hot path) should not fail

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, ot as BaseAddon, z as localNetworkCapability } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, ot as BaseAddon, z as localNetworkCapability } from "../../dist-BjUYsgkj.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-BL_FHWPP.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-BjUYsgkj.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, U as metricsProviderCapability, ot as BaseAddon, yt as createEvent } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, U as metricsProviderCapability, ot as BaseAddon, yt as createEvent } from "../../dist-BjUYsgkj.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { E as enumerateInferenceDevices, Mt as EventCategory, Y as scoreRuntimes, at as errMsg, ot as BaseAddon, q as platformProbeCapability, xt as emitReadiness } from "../../dist-BL_FHWPP.mjs";
+import { E as enumerateInferenceDevices, Mt as EventCategory, Y as scoreRuntimes, at as errMsg, ot as BaseAddon, q as platformProbeCapability, xt as emitReadiness } from "../../dist-BjUYsgkj.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, ot as BaseAddon } from "../../dist-BL_FHWPP.mjs";
+import { Mt as EventCategory, ot as BaseAddon } from "../../dist-BjUYsgkj.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CSs1A90r.js");
+const require_dist = require("../../dist-Bqyu3d1X.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Q as snapshotCapability, Tt as nodePin, at as errMsg, ft as DeviceType, i as BatteryStatusSchema, ot as BaseAddon, tt as streamQualityLabel, ut as DeviceFeature } from "../../dist-BL_FHWPP.mjs";
+import { Q as snapshotCapability, Tt as nodePin, at as errMsg, ft as DeviceType, i as BatteryStatusSchema, ot as BaseAddon, tt as streamQualityLabel, ut as DeviceFeature } from "../../dist-BjUYsgkj.mjs";
 import { execFile } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**