@camstack/system 1.2.33 → 1.2.35

package/dist/auth/scoped-token-manager.d.ts

@@ -21,6 +21,31 @@ export declare class ScopedTokenManager {
     revoke(tokenId: string): Promise<void>;
     listForUser(userId: string): Promise<ScopedToken[]>;
     updateLastUsed(tokenId: string): Promise<void>;
+    /**
+     * Delete tokens whose expiry has passed.
+     *
+     * These were never usable — {@link validate} already rejects an expired
+     * token — so this is hygiene rather than a hole being closed, and it is
+     * worth being precise about what it actually buys:
+     *
+     *  - `listForUser` returns rows with no expiry filter, so the operator's
+     *    token list showed dead tokens as if they were live. There was no way to
+     *    tell from the UI which ones still worked.
+     *  - a database that outlives its tokens keeps their hashes indefinitely.
+     *    27 rows on the live hub had been unusable for months.
+     *
+     * A token with NO expiry (`expiresAt` null/absent) is a deliberate
+     * never-expires token and MUST survive: `BETWEEN` never matches NULL in
+     * SQL, which is the property this depends on and the spec pins against a
+     * real SQLite.
+     *
+     * The bound is `nowMs - 1` because {@link validate} treats `now ===
+     * expiresAt` as still valid; reaping at exactly the expiry instant would
+     * delete a token that the same millisecond still accepts.
+     *
+     * Returns how many rows went.
+     */
+    reapExpired(nowMs?: number): Promise<number>;
     /**
      * One-shot migration: drop tokens whose owner can't be resolved.
      *

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, ot as BaseAddon, p as addonPagesCapability } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, at as errMsg, ot as BaseAddon, p as addonPagesCapability } from "../../dist-DkwTH1dP.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, h as addonWidgetsCapability, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, at as errMsg, h as addonWidgetsCapability, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, g as alertsCapability, n as AlertSchema, ot as BaseAddon, yt as createEvent } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, at as errMsg, g as alertsCapability, n as AlertSchema, ot as BaseAddon, yt as createEvent } from "../../dist-DkwTH1dP.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, ot as BaseAddon, y as backupCapability } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, ot as BaseAddon, y as backupCapability } from "../../dist-DkwTH1dP.mjs";
 import * as fs from "node:fs";
 import Kt from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { C as deviceStateCapability, D as enumerateItemArrayFields, K as parseStreamParamsFormPatch, M as getByPath, Mt as EventCategory, O as enumerateSchemaFields, S as deviceManagerCapability, W as normalizeUnit, X as setByPath, _ as applyTransform, a as CAP_NAMES_WITH_STATUS, at as errMsg, b as buildStreamParamsConfigSchema, dt as DeviceRole, ft as DeviceType, ht as WELL_KNOWN_TAB_MAP, it as validateExpressionSource, jt as sleep, k as evaluateLinkExpression, l as STREAM_PROFILE_META, nt as toExpressionValue, o as DeviceStatusSchema, ot as BaseAddon, t as ALL_CAPABILITY_DEFINITIONS, ut as DeviceFeature, w as deviceStatusCapability, wt as isDeviceConfigCap } from "../../dist-Q3N47mdR.mjs";
+import { C as deviceStateCapability, D as enumerateItemArrayFields, K as parseStreamParamsFormPatch, M as getByPath, Mt as EventCategory, O as enumerateSchemaFields, S as deviceManagerCapability, W as normalizeUnit, X as setByPath, _ as applyTransform, a as CAP_NAMES_WITH_STATUS, at as errMsg, b as buildStreamParamsConfigSchema, dt as DeviceRole, ft as DeviceType, ht as WELL_KNOWN_TAB_MAP, it as validateExpressionSource, jt as sleep, k as evaluateLinkExpression, l as STREAM_PROFILE_META, nt as toExpressionValue, o as DeviceStatusSchema, ot as BaseAddon, t as ALL_CAPABILITY_DEFINITIONS, ut as DeviceFeature, w as deviceStatusCapability, wt as isDeviceConfigCap } from "../../dist-DkwTH1dP.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, T as doorbellCapability, at as errMsg, ft as DeviceType, ot as BaseAddon, yt as createEvent } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, T as doorbellCapability, at as errMsg, ft as DeviceType, ot as BaseAddon, yt as createEvent } from "../../dist-DkwTH1dP.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, at as errMsg, ot as BaseAddon, yt as createEvent } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, at as errMsg, ot as BaseAddon, yt as createEvent } from "../../dist-DkwTH1dP.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -10,9 +10,21 @@ export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
     private apiKeyManager;
     private scopedTokenManager;
     private oauthSessionManager;
+    private reapTimer;
     private totpManager;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    /**
+     * Drop auth rows that are dead but were never removed: scoped tokens past
+     * their expiry, and OAuth sessions revoked longer ago than
+     * {@link OAUTH_REVOKED_RETENTION_MS}.
+     *
+     * Neither row could authorise anything — `validate` rejects an expired
+     * token, and every consumer treats a missing session exactly like a revoked
+     * one. So this is hygiene, and it is best-effort: a failed sweep is logged
+     * and the next tick tries again. It must never be able to fail boot.
+     */
+    private reapAuthRows;
     protected onShutdown(): Promise<void>;
 }
 export default LocalAuthAddon;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6434,6 +6434,37 @@ var ScopedTokenManager = class {
 		});
 	}
 	/**
+	* Delete tokens whose expiry has passed.
+	*
+	* These were never usable — {@link validate} already rejects an expired
+	* token — so this is hygiene rather than a hole being closed, and it is
+	* worth being precise about what it actually buys:
+	*
+	*  - `listForUser` returns rows with no expiry filter, so the operator's
+	*    token list showed dead tokens as if they were live. There was no way to
+	*    tell from the UI which ones still worked.
+	*  - a database that outlives its tokens keeps their hashes indefinitely.
+	*    27 rows on the live hub had been unusable for months.
+	*
+	* A token with NO expiry (`expiresAt` null/absent) is a deliberate
+	* never-expires token and MUST survive: `BETWEEN` never matches NULL in
+	* SQL, which is the property this depends on and the spec pins against a
+	* real SQLite.
+	*
+	* The bound is `nowMs - 1` because {@link validate} treats `now ===
+	* expiresAt` as still valid; reaping at exactly the expiry instant would
+	* delete a token that the same millisecond still accepts.
+	*
+	* Returns how many rows went.
+	*/
+	async reapExpired(nowMs = Date.now()) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: TOKENS_COLLECTION,
+			filter: { whereBetween: { expiresAt: [1, nowMs - 1] } }
+		});
+		return deleted;
+	}
+	/**
 	* One-shot migration: drop tokens whose owner can't be resolved.
 	*
 	* Two ways a token can end up orphan:
@@ -6582,6 +6613,31 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete sessions revoked longer ago than `horizonMs`.
+	*
+	* Safe because an ABSENT session already fails closed exactly like a revoked
+	* one: every consumer in `oauth-grants.ts` reads
+	* `if (!session || session.revokedAt != null) return null`. Deleting the row
+	* therefore cannot re-enable a link that was cut — it removes a record whose
+	* only remaining job was to say "no", which the absence says too.
+	*
+	* A retention window rather than an immediate delete: a revoked account link
+	* is the kind of thing an operator looks up AFTER the fact ("when did I
+	* unlink that?"), and the row is tiny. Active sessions are never touched —
+	* the filter matches only rows with a `revokedAt` timestamp in range, and
+	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+	* matches.
+	*
+	* Returns how many rows went.
+	*/
+	async reapRevoked(horizonMs) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: SESSIONS_COLLECTION,
+			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
+		});
+		return deleted;
+	}
+	/**
 	* Update `lastUsedAt` to now. No-op (does not throw) when the session
 	* id is not found — the caller (token-use hot path) should not fail
 	* for a missing session that may have been concurrently revoked.
@@ -9277,6 +9333,17 @@ function createOauthGrants(ssoBridge, sessionManager) {
 }
 //#endregion
 //#region src/builtins/local-auth/local-auth.addon.ts
+/** How often the auth tables are swept for dead rows. */
+var AUTH_REAP_INTERVAL_MS = 24 * 36e5;
+/**
+* How long a REVOKED OAuth session is kept before deletion.
+*
+* A revoked link authorises nothing the moment it is revoked (every consumer
+* fails closed on a missing session exactly as on a revoked one), so this
+* window buys only the operator's ability to answer "when did I unlink that?".
+* 30 days, matching the ops-log retention.
+*/
+var OAUTH_REVOKED_RETENTION_MS = 720 * 36e5;
 function toAuthResult(user) {
 	return {
 		userId: user.id,
@@ -9291,6 +9358,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 	apiKeyManager = null;
 	scopedTokenManager = null;
 	oauthSessionManager = null;
+	reapTimer = null;
 	totpManager = null;
 	constructor() {
 		super({
@@ -9332,6 +9400,11 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				const liveIds = new Set(liveUsers.map((u) => u.id));
 				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
 				if (removed > 0) this.ctx.logger.warn(`cleaned up ${removed} orphan scoped-token(s) on boot`);
+				await this.reapAuthRows();
+				this.reapTimer = setInterval(() => {
+					this.reapAuthRows();
+				}, AUTH_REAP_INTERVAL_MS);
+				this.reapTimer.unref?.();
 			} catch (err) {
 				const detail = err instanceof Error ? err.message : String(err);
 				throw new Error(`local-auth bootstrap failed: ensureAdminExists threw before \`user-management\` could be registered. Most likely a \`users\` collection schema mismatch in the settings-store. Underlying: ${detail}`, { cause: err });
@@ -9539,7 +9612,33 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			provider: userMgmt
 		}];
 	}
+	/**
+	* Drop auth rows that are dead but were never removed: scoped tokens past
+	* their expiry, and OAuth sessions revoked longer ago than
+	* {@link OAUTH_REVOKED_RETENTION_MS}.
+	*
+	* Neither row could authorise anything — `validate` rejects an expired
+	* token, and every consumer treats a missing session exactly like a revoked
+	* one. So this is hygiene, and it is best-effort: a failed sweep is logged
+	* and the next tick tries again. It must never be able to fail boot.
+	*/
+	async reapAuthRows() {
+		try {
+			const tokens = await this.scopedTokenManager?.reapExpired() ?? 0;
+			const sessions = await this.oauthSessionManager?.reapRevoked(Date.now() - OAUTH_REVOKED_RETENTION_MS) ?? 0;
+			if (tokens > 0 || sessions > 0) this.ctx.logger.info("auth retention swept", { meta: {
+				expiredTokens: tokens,
+				revokedSessions: sessions
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("auth retention sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
 	async onShutdown() {
+		if (this.reapTimer !== null) {
+			clearInterval(this.reapTimer);
+			this.reapTimer = null;
+		}
 		this.authManager = null;
 		this.userManager = null;
 		this.apiKeyManager = null;

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { f as UserRecordSchema, ot as BaseAddon, r as ApiKeyRecordSchema, rt as userManagementCapability, u as ScopedTokenSchema, v as authProviderCapability } from "../../dist-Q3N47mdR.mjs";
+import { f as UserRecordSchema, ot as BaseAddon, r as ApiKeyRecordSchema, rt as userManagementCapability, u as ScopedTokenSchema, v as authProviderCapability } from "../../dist-DkwTH1dP.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6426,6 +6426,37 @@ var ScopedTokenManager = class {
 		});
 	}
 	/**
+	* Delete tokens whose expiry has passed.
+	*
+	* These were never usable — {@link validate} already rejects an expired
+	* token — so this is hygiene rather than a hole being closed, and it is
+	* worth being precise about what it actually buys:
+	*
+	*  - `listForUser` returns rows with no expiry filter, so the operator's
+	*    token list showed dead tokens as if they were live. There was no way to
+	*    tell from the UI which ones still worked.
+	*  - a database that outlives its tokens keeps their hashes indefinitely.
+	*    27 rows on the live hub had been unusable for months.
+	*
+	* A token with NO expiry (`expiresAt` null/absent) is a deliberate
+	* never-expires token and MUST survive: `BETWEEN` never matches NULL in
+	* SQL, which is the property this depends on and the spec pins against a
+	* real SQLite.
+	*
+	* The bound is `nowMs - 1` because {@link validate} treats `now ===
+	* expiresAt` as still valid; reaping at exactly the expiry instant would
+	* delete a token that the same millisecond still accepts.
+	*
+	* Returns how many rows went.
+	*/
+	async reapExpired(nowMs = Date.now()) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: TOKENS_COLLECTION,
+			filter: { whereBetween: { expiresAt: [1, nowMs - 1] } }
+		});
+		return deleted;
+	}
+	/**
 	* One-shot migration: drop tokens whose owner can't be resolved.
 	*
 	* Two ways a token can end up orphan:
@@ -6574,6 +6605,31 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete sessions revoked longer ago than `horizonMs`.
+	*
+	* Safe because an ABSENT session already fails closed exactly like a revoked
+	* one: every consumer in `oauth-grants.ts` reads
+	* `if (!session || session.revokedAt != null) return null`. Deleting the row
+	* therefore cannot re-enable a link that was cut — it removes a record whose
+	* only remaining job was to say "no", which the absence says too.
+	*
+	* A retention window rather than an immediate delete: a revoked account link
+	* is the kind of thing an operator looks up AFTER the fact ("when did I
+	* unlink that?"), and the row is tiny. Active sessions are never touched —
+	* the filter matches only rows with a `revokedAt` timestamp in range, and
+	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+	* matches.
+	*
+	* Returns how many rows went.
+	*/
+	async reapRevoked(horizonMs) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: SESSIONS_COLLECTION,
+			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
+		});
+		return deleted;
+	}
+	/**
 	* Update `lastUsedAt` to now. No-op (does not throw) when the session
 	* id is not found — the caller (token-use hot path) should not fail
 	* for a missing session that may have been concurrently revoked.
@@ -9269,6 +9325,17 @@ function createOauthGrants(ssoBridge, sessionManager) {
 }
 //#endregion
 //#region src/builtins/local-auth/local-auth.addon.ts
+/** How often the auth tables are swept for dead rows. */
+var AUTH_REAP_INTERVAL_MS = 24 * 36e5;
+/**
+* How long a REVOKED OAuth session is kept before deletion.
+*
+* A revoked link authorises nothing the moment it is revoked (every consumer
+* fails closed on a missing session exactly as on a revoked one), so this
+* window buys only the operator's ability to answer "when did I unlink that?".
+* 30 days, matching the ops-log retention.
+*/
+var OAUTH_REVOKED_RETENTION_MS = 720 * 36e5;
 function toAuthResult(user) {
 	return {
 		userId: user.id,
@@ -9283,6 +9350,7 @@ var LocalAuthAddon = class extends BaseAddon {
 	apiKeyManager = null;
 	scopedTokenManager = null;
 	oauthSessionManager = null;
+	reapTimer = null;
 	totpManager = null;
 	constructor() {
 		super({
@@ -9324,6 +9392,11 @@ var LocalAuthAddon = class extends BaseAddon {
 				const liveIds = new Set(liveUsers.map((u) => u.id));
 				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
 				if (removed > 0) this.ctx.logger.warn(`cleaned up ${removed} orphan scoped-token(s) on boot`);
+				await this.reapAuthRows();
+				this.reapTimer = setInterval(() => {
+					this.reapAuthRows();
+				}, AUTH_REAP_INTERVAL_MS);
+				this.reapTimer.unref?.();
 			} catch (err) {
 				const detail = err instanceof Error ? err.message : String(err);
 				throw new Error(`local-auth bootstrap failed: ensureAdminExists threw before \`user-management\` could be registered. Most likely a \`users\` collection schema mismatch in the settings-store. Underlying: ${detail}`, { cause: err });
@@ -9531,7 +9604,33 @@ var LocalAuthAddon = class extends BaseAddon {
 			provider: userMgmt
 		}];
 	}
+	/**
+	* Drop auth rows that are dead but were never removed: scoped tokens past
+	* their expiry, and OAuth sessions revoked longer ago than
+	* {@link OAUTH_REVOKED_RETENTION_MS}.
+	*
+	* Neither row could authorise anything — `validate` rejects an expired
+	* token, and every consumer treats a missing session exactly like a revoked
+	* one. So this is hygiene, and it is best-effort: a failed sweep is logged
+	* and the next tick tries again. It must never be able to fail boot.
+	*/
+	async reapAuthRows() {
+		try {
+			const tokens = await this.scopedTokenManager?.reapExpired() ?? 0;
+			const sessions = await this.oauthSessionManager?.reapRevoked(Date.now() - OAUTH_REVOKED_RETENTION_MS) ?? 0;
+			if (tokens > 0 || sessions > 0) this.ctx.logger.info("auth retention swept", { meta: {
+				expiredTokens: tokens,
+				revokedSessions: sessions
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("auth retention sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
 	async onShutdown() {
+		if (this.reapTimer !== null) {
+			clearInterval(this.reapTimer);
+			this.reapTimer = null;
+		}
 		this.authManager = null;
 		this.userManager = null;
 		this.apiKeyManager = null;

package/dist/builtins/local-auth/oauth-session-manager.d.ts

@@ -40,6 +40,25 @@ export declare class OauthSessionManager {
      * - Returns `false` when the session id is not found.
      */
     markRevoked(id: string): Promise<boolean>;
+    /**
+     * Delete sessions revoked longer ago than `horizonMs`.
+     *
+     * Safe because an ABSENT session already fails closed exactly like a revoked
+     * one: every consumer in `oauth-grants.ts` reads
+     * `if (!session || session.revokedAt != null) return null`. Deleting the row
+     * therefore cannot re-enable a link that was cut — it removes a record whose
+     * only remaining job was to say "no", which the absence says too.
+     *
+     * A retention window rather than an immediate delete: a revoked account link
+     * is the kind of thing an operator looks up AFTER the fact ("when did I
+     * unlink that?"), and the row is tiny. Active sessions are never touched —
+     * the filter matches only rows with a `revokedAt` timestamp in range, and
+     * `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+     * matches.
+     *
+     * Returns how many rows went.
+     */
+    reapRevoked(horizonMs: number): Promise<number>;
     /**
      * Update `lastUsedAt` to now. No-op (does not throw) when the session
      * id is not found — the caller (token-use hot path) should not fail

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, ot as BaseAddon, z as localNetworkCapability } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, ot as BaseAddon, z as localNetworkCapability } from "../../dist-DkwTH1dP.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, U as metricsProviderCapability, ot as BaseAddon, yt as createEvent } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, U as metricsProviderCapability, ot as BaseAddon, yt as createEvent } from "../../dist-DkwTH1dP.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { E as enumerateInferenceDevices, Mt as EventCategory, Y as scoreRuntimes, at as errMsg, ot as BaseAddon, q as platformProbeCapability, xt as emitReadiness } from "../../dist-Q3N47mdR.mjs";
+import { E as enumerateInferenceDevices, Mt as EventCategory, Y as scoreRuntimes, at as errMsg, ot as BaseAddon, q as platformProbeCapability, xt as emitReadiness } from "../../dist-DkwTH1dP.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as EventCategory, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { Mt as EventCategory, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Q as snapshotCapability, Tt as nodePin, at as errMsg, ft as DeviceType, i as BatteryStatusSchema, ot as BaseAddon, tt as streamQualityLabel, ut as DeviceFeature } from "../../dist-Q3N47mdR.mjs";
+import { Q as snapshotCapability, Tt as nodePin, at as errMsg, ft as DeviceType, i as BatteryStatusSchema, ot as BaseAddon, tt as streamQualityLabel, ut as DeviceFeature } from "../../dist-DkwTH1dP.mjs";
 import { execFile } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { et as storageProviderCapability, j as filesystemBrowseCapability, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { et as storageProviderCapability, j as filesystemBrowseCapability, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_crypto = require("node:crypto");
 let better_sqlite3 = require("better-sqlite3");
 better_sqlite3 = require_chunk.__toESM(better_sqlite3);

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { Dt as parseJsonUnknown, at as errMsg, c as RUNTIME_DEFAULTS, gt as asJsonObject, ot as BaseAddon, x as dataStoreProviderCapability } from "../../dist-Q3N47mdR.mjs";
+import { Dt as parseJsonUnknown, at as errMsg, c as RUNTIME_DEFAULTS, gt as asJsonObject, ot as BaseAddon, x as dataStoreProviderCapability } from "../../dist-DkwTH1dP.mjs";
 import { randomUUID } from "node:crypto";
 import Database from "better-sqlite3";
 //#region src/builtins/sqlite-storage/filter-compiler.ts

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as storageCapability, Et as parseJsonObject, Z as settingsStoreCapability, d as StorageLocationTypeSchema, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { $ as storageCapability, Et as parseJsonObject, Z as settingsStoreCapability, d as StorageLocationTypeSchema, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
 import { buildStorageLocationRegistry } from "@camstack/system";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as hydrateSchema, at as errMsg, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { Ct as hydrateSchema, at as errMsg, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CvmFWwEo.js");
+const require_dist = require("../../dist-DyxtdHgI.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-Q3N47mdR.mjs";
+import { B as logDestinationCapability, ot as BaseAddon } from "../../dist-DkwTH1dP.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-Q3N47mdR.mjs → dist-DkwTH1dP.mjs}

@@ -5412,7 +5412,87 @@ var NcZoneConditionSchema = z.object({
 * The P1 condition set — a flat AND of groups; absent group = pass;
 * membership lists are OR within the list (spec §2.3).
 */
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("wait"),
+	seconds: z.number().min(0).max(300)
+}), z.object({
+	kind: z.literal("cap"),
+	deviceId: z.number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: z.string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: z.string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: z.record(z.string(), z.unknown()).optional()
+})]);
+/**
+* A named, ordered run of steps with its own throttle.
+*
+* `minDelaySec` exists because a noisy rule otherwise hammers a physical
+* actuator — the rule's own cooldown governs NOTIFICATIONS, which is a
+* different budget from "how often may this gate actually open".
+*/
+var NcRuleActionSequenceSchema = z.object({
+	name: z.string().min(1).max(120),
+	enabled: z.boolean(),
+	minDelaySec: z.number().int().min(0).max(86400).optional(),
+	actions: z.array(NcRuleActionSchema).min(1)
+});
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = z.object({ 
+/** Runs when the rule MATCHES. */
+onTrigger: z.array(NcRuleActionSequenceSchema).optional() });
+/**
+* "This rule applies only while `deviceId` is in one of `states`."
+*
+* The states are the DEVICE's own vocabulary — `AlarmState` for a panel,
+* `on`/`off` for a switch — not a normalised set, because normalising would
+* make the condition lie about devices whose states have no equivalent.
+*
+* An unreadable state does NOT match: see the engine's fail-closed gate. A
+* condition that fired on "I could not read it" would be worse than no gate.
+*/
+var NcDeviceStateConditionSchema = z.object({
+	deviceId: z.number().int(),
+	/** Any of these matches. */
+	states: z.array(z.string().min(1)).min(1)
+});
 var NcConditionsSchema = z.object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: NcDeviceStateConditionSchema.optional(),
 	/** Device scope — absent = all devices. */
 	devices: z.array(z.number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -5706,7 +5786,16 @@ var NcRuleInputSchema = z.object({
 	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
 	* by this flag — see the scope rules on that function.
 	*/
-	snoozeAllowGlobal: z.boolean().optional()
+	snoozeAllowGlobal: z.boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -5777,7 +5866,8 @@ var NcConditionDescriptorSchema = z.object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: z.enum([
 		"in",

package/dist/{dist-CvmFWwEo.js → dist-DyxtdHgI.js}

@@ -5412,7 +5412,87 @@ var NcZoneConditionSchema = zod.z.object({
 * The P1 condition set — a flat AND of groups; absent group = pass;
 * membership lists are OR within the list (spec §2.3).
 */
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("wait"),
+	seconds: zod.z.number().min(0).max(300)
+}), zod.z.object({
+	kind: zod.z.literal("cap"),
+	deviceId: zod.z.number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: zod.z.string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: zod.z.string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+})]);
+/**
+* A named, ordered run of steps with its own throttle.
+*
+* `minDelaySec` exists because a noisy rule otherwise hammers a physical
+* actuator — the rule's own cooldown governs NOTIFICATIONS, which is a
+* different budget from "how often may this gate actually open".
+*/
+var NcRuleActionSequenceSchema = zod.z.object({
+	name: zod.z.string().min(1).max(120),
+	enabled: zod.z.boolean(),
+	minDelaySec: zod.z.number().int().min(0).max(86400).optional(),
+	actions: zod.z.array(NcRuleActionSchema).min(1)
+});
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = zod.z.object({ 
+/** Runs when the rule MATCHES. */
+onTrigger: zod.z.array(NcRuleActionSequenceSchema).optional() });
+/**
+* "This rule applies only while `deviceId` is in one of `states`."
+*
+* The states are the DEVICE's own vocabulary — `AlarmState` for a panel,
+* `on`/`off` for a switch — not a normalised set, because normalising would
+* make the condition lie about devices whose states have no equivalent.
+*
+* An unreadable state does NOT match: see the engine's fail-closed gate. A
+* condition that fired on "I could not read it" would be worse than no gate.
+*/
+var NcDeviceStateConditionSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	/** Any of these matches. */
+	states: zod.z.array(zod.z.string().min(1)).min(1)
+});
 var NcConditionsSchema = zod.z.object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: NcDeviceStateConditionSchema.optional(),
 	/** Device scope — absent = all devices. */
 	devices: zod.z.array(zod.z.number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -5706,7 +5786,16 @@ var NcRuleInputSchema = zod.z.object({
 	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
 	* by this flag — see the scope rules on that function.
 	*/
-	snoozeAllowGlobal: zod.z.boolean().optional()
+	snoozeAllowGlobal: zod.z.boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -5777,7 +5866,8 @@ var NcConditionDescriptorSchema = zod.z.object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: zod.z.enum([
 		"in",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CvmFWwEo.js");
+const require_dist = require("./dist-DyxtdHgI.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
 const require_manifest_python_deps = require("./manifest-python-deps-BqE5j0-O.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { A as extractNestedAddonId, At as scopeKey, Dt as parseJsonUnknown$1, Et as parseJsonObject, F as isObjectInput, G as objectInputDeclaresAddonId, H as looseSchema, I as isVoidInput, J as procedureAuthKey, L as kebabToCamel, Mt as EventCategory$1, N as isArrayOutputSchema, Ot as readinessKey, P as isCollectionArrayMethod, R as lifecycleJobSchema, St as expandCapMethods, V as logLevelAtMost, _t as asNumber, at as errMsg$1, bt as emitDownForOwnedCaps, c as RUNTIME_DEFAULTS, ct as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gt as asJsonObject$1, kt as resolveCapMount, lt as DEVICE_STATUS_METHOD, m as addonSettingsCapability, mt as ReadinessTimeoutError, pt as ReadinessRegistry, s as METHOD_ACCESS_MAP, st as DATAPLANE_SECRET_HEADER$1, t as ALL_CAPABILITY_DEFINITIONS, vt as asString$1, yt as createEvent } from "./dist-Q3N47mdR.mjs";
+import { A as extractNestedAddonId, At as scopeKey, Dt as parseJsonUnknown$1, Et as parseJsonObject, F as isObjectInput, G as objectInputDeclaresAddonId, H as looseSchema, I as isVoidInput, J as procedureAuthKey, L as kebabToCamel, Mt as EventCategory$1, N as isArrayOutputSchema, Ot as readinessKey, P as isCollectionArrayMethod, R as lifecycleJobSchema, St as expandCapMethods, V as logLevelAtMost, _t as asNumber, at as errMsg$1, bt as emitDownForOwnedCaps, c as RUNTIME_DEFAULTS, ct as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gt as asJsonObject$1, kt as resolveCapMount, lt as DEVICE_STATUS_METHOD, m as addonSettingsCapability, mt as ReadinessTimeoutError, pt as ReadinessRegistry, s as METHOD_ACCESS_MAP, st as DATAPLANE_SECRET_HEADER$1, t as ALL_CAPABILITY_DEFINITIONS, vt as asString$1, yt as createEvent } from "./dist-DkwTH1dP.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
 import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Ck4-9K9m.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.33",
+  "version": "1.2.35",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",