@camstack/system 1.2.380 → 1.2.382

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-CZeRUgYF.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-BrMdKHfp.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -25,11 +25,13 @@ function toSerializableRoute(route) {
 	if (typeof method !== "string" || typeof path !== "string") throw new Error("child-addon-call: route descriptor missing method/path");
 	const access = route["access"];
 	const description = route["description"];
+	const rateLimit = route["rateLimit"];
 	return {
 		method,
 		path,
 		...typeof access === "string" ? { access } : {},
-		...typeof description === "string" ? { description } : {}
+		...typeof description === "string" ? { description } : {},
+		...typeof rateLimit === "string" ? { rateLimit } : {}
 	};
 }
 /**

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-CpjohToR.mjs";
+import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-WsYPNvnK.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";
@@ -22,11 +22,13 @@ function toSerializableRoute(route) {
 	if (typeof method !== "string" || typeof path !== "string") throw new Error("child-addon-call: route descriptor missing method/path");
 	const access = route["access"];
 	const description = route["description"];
+	const rateLimit = route["rateLimit"];
 	return {
 		method,
 		path,
 		...typeof access === "string" ? { access } : {},
-		...typeof description === "string" ? { description } : {}
+		...typeof description === "string" ? { description } : {},
+		...typeof rateLimit === "string" ? { rateLimit } : {}
 	};
 }
 /**

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-mk6WGxir.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-9kR0sAPS.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;

package/dist/addon-utils.mjs

@@ -1,4 +1,4 @@
-import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-anUH2IE1.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-WkssIXjq.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/auth/admin-token-manager.d.ts

@@ -0,0 +1,75 @@
+import { SettingsStoreClient } from '@camstack/types';
+/**
+ * @durable class=config owner=local-auth
+ *   write="an admin creates a token (after re-authentication); `lastUsedAt` is
+ *     rewritten at most once a minute while it is used; `revoke` stamps revokedAt"
+ *   retention="the daily reap deletes rows expired or revoked more than 30 days ago"
+ */
+export declare const ADMIN_TOKENS_COLLECTION = "admin_tokens";
+export declare const ADMIN_TOKENS_COLUMNS: ({
+    name: string;
+    type: "TEXT";
+    primaryKey: boolean;
+    notNull: boolean;
+    unique?: undefined;
+} | {
+    name: string;
+    type: "TEXT";
+    notNull: boolean;
+    primaryKey?: undefined;
+    unique?: undefined;
+} | {
+    name: string;
+    type: "TEXT";
+    notNull: boolean;
+    unique: boolean;
+    primaryKey?: undefined;
+} | {
+    name: string;
+    type: "INTEGER";
+    notNull: boolean;
+    primaryKey?: undefined;
+    unique?: undefined;
+} | {
+    name: string;
+    type: "INTEGER";
+    primaryKey?: undefined;
+    notNull?: undefined;
+    unique?: undefined;
+})[];
+export declare const ADMIN_TOKEN_PREFIX = "csa_";
+export declare const ADMIN_TOKEN_MAX_LIFETIME_MS: number;
+export interface AdminTokenRecord {
+    readonly id: string;
+    readonly createdBy: string;
+    readonly name: string;
+    readonly tokenPrefix: string;
+    readonly createdAt: number;
+    readonly expiresAt: number;
+    readonly lastUsedAt: number | null;
+    readonly revokedAt: number | null;
+}
+export declare class AdminTokenManager {
+    private readonly store;
+    private readonly now;
+    constructor(store: SettingsStoreClient, now?: () => number);
+    /** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
+    create(input: {
+        readonly createdBy: string;
+        readonly name: string;
+        readonly expiresAt: number;
+    }): Promise<{
+        readonly token: string;
+        readonly record: AdminTokenRecord;
+    }>;
+    /** The live record behind `token`, or `null` (unknown, revoked, expired, not a `csa_`). */
+    validate(token: string): Promise<AdminTokenRecord | null>;
+    /** Every token not yet reaped, newest first (no hashes). */
+    list(): Promise<readonly AdminTokenRecord[]>;
+    /** Revoke one token. `false` when unknown or already revoked. */
+    revoke(id: string): Promise<boolean>;
+    /** Revoke every live token `userId` created (the user was deleted). */
+    revokeAllCreatedBy(userId: string): Promise<number>;
+    /** Delete rows expired or revoked more than 30 days ago. */
+    reap(): Promise<number>;
+}

package/dist/auth/api-key-manager.d.ts

@@ -1,25 +1,12 @@
-import { AuthManager } from './auth-manager.js';
 import { ApiKeyRecord, SettingsStoreClient } from '@camstack/types';
 export type { ApiKeyRecord };
-interface CreateApiKeyInput {
-    label: string;
-    isAdmin?: boolean;
-    allowedProviders?: string[] | '*';
-    allowedDevices?: Record<string, string[] | '*'>;
-}
 export interface ApiKeyStorageAccess {
     getStore(): SettingsStoreClient;
 }
 export declare class ApiKeyManager {
     private readonly storageAccess;
-    private readonly auth;
-    constructor(storageAccess: ApiKeyStorageAccess, auth: AuthManager);
+    constructor(storageAccess: ApiKeyStorageAccess);
     private get store();
-    create(input: CreateApiKeyInput): Promise<{
-        record: ApiKeyRecord;
-        token: string;
-    }>;
-    validateToken(token: string): Promise<ApiKeyRecord | null>;
     listAll(): Promise<Omit<ApiKeyRecord, 'tokenHash'>[]>;
     revoke(id: string): Promise<void>;
     findById(id: string): Promise<ApiKeyRecord | null>;

package/dist/auth/auth-audit-log.d.ts

@@ -0,0 +1,59 @@
+import { IScopedLogger, SettingsStoreClient } from '@camstack/types';
+/**
+ * @durable class=ledger owner=local-auth
+ *   write="one row per audited auth event: a second factor skipped from a trusted
+ *     network, an admin token created / used / revoked"
+ *   retention="the daily reap deletes rows older than 90 days"
+ */
+export declare const AUTH_AUDIT_COLLECTION = "auth_audit";
+export declare const AUTH_AUDIT_COLUMNS: ({
+    name: string;
+    type: "TEXT";
+    primaryKey: boolean;
+    notNull: boolean;
+} | {
+    name: string;
+    type: "INTEGER";
+    notNull: boolean;
+    primaryKey?: undefined;
+} | {
+    name: string;
+    type: "TEXT";
+    notNull: boolean;
+    primaryKey?: undefined;
+} | {
+    name: string;
+    type: "TEXT";
+    primaryKey?: undefined;
+    notNull?: undefined;
+})[];
+export declare const AUTH_AUDIT_ACTIONS: readonly ["second-factor-skipped", "admin-token-created", "admin-token-used", "admin-token-revoked"];
+export type AuthAuditAction = (typeof AUTH_AUDIT_ACTIONS)[number];
+export interface AuthAuditEvent {
+    readonly action: AuthAuditAction;
+    /** The user the event is about (the one signing in; the token's owner). */
+    readonly userId?: string;
+    /** The real client address, when there was a request. */
+    readonly ip?: string;
+    /** Short, non-secret context: the method, the token's name and prefix, the path. */
+    readonly detail?: Readonly<Record<string, string | number | boolean>>;
+}
+export interface AuthAuditRecord extends AuthAuditEvent {
+    readonly id: string;
+    readonly at: number;
+}
+export declare class AuthAuditLog {
+    private readonly store;
+    private readonly logger;
+    private readonly now;
+    constructor(store: SettingsStoreClient, logger?: IScopedLogger | null, now?: () => number);
+    /** Record `event`. Never throws. */
+    record(event: AuthAuditEvent): Promise<void>;
+    /** Newest first, at most `limit` (≤ 500), optionally one user's. */
+    list(input?: {
+        readonly limit?: number;
+        readonly userId?: string;
+    }): Promise<readonly AuthAuditRecord[]>;
+    /** Delete rows older than 90 days. Returns how many. */
+    reap(): Promise<number>;
+}

package/dist/auth/auth-manager.d.ts

@@ -34,7 +34,13 @@ export declare class AuthManager {
     constructor(config: AuthConfigReader, logger?: IScopedLogger, signingKey?: JwtSigningKeySource);
     /** The current signing key; throws `JwtSigningKeyUnavailableError` while there is none. */
     private get jwtSecret();
-    signToken(payload: Omit<TokenPayload, 'iat' | 'exp'>): string;
+    /**
+     * @param options.expiresInSec an explicit lifetime (a session's access
+     *   token): wins over `auth.tokenExpiry`, bounded to at least one minute.
+     */
+    signToken(payload: Omit<TokenPayload, 'iat' | 'exp'>, options?: {
+        readonly expiresInSec?: number;
+    }): string;
     /**
      * The operator's `auth.tokenExpiry`, or `undefined` → DEFAULT_TOKEN_EXPIRY.
      *
@@ -49,23 +55,9 @@ export declare class AuthManager {
     verifyToken(token: string): TokenPayload;
     hashPassword(password: string): Promise<string>;
     comparePassword(password: string, hash: string): Promise<boolean>;
-    generateApiKey(): {
-        token: string;
-        hash: string;
-        prefix: string;
-    };
-    validateApiKey(token: string, storedHash: string): boolean;
-    /**
-     * Create a service token for agent/worker authentication.
-     * Used when forking workers or when agents register.
-     */
-    createServiceToken(opts: {
-        readonly agentId: string;
-        readonly expiresIn?: string;
-    }): string;
     /**
      * Mint a short-lived HMAC-signed bridge token used by SSO-style auth
-     * providers (OIDC, SAML, magic-link, …) to hand the post-callback
+     * providers (OIDC, SAML, …) to hand the post-callback
      * claims to `/api/auth/sso/finish` without trusting unsigned query
      * parameters. The endpoint verifies the token signature with the same
      * `jwtSecret` and only then mints the user session JWT. This closes
@@ -102,6 +94,15 @@ export declare class AuthManager {
      * short enough that an abandoned login can't be picked up later.
      */
     signTotpChallengeToken(payload: TotpChallengeClaims, ttlSec?: number): string;
+    /**
+     * A short-lived proof that the signed-in user just re-entered their password
+     * or used a passkey. Sensitive self-service actions (linking a sign-in
+     * account, disabling 2FA, removing a passkey, minting an admin token)
+     * require one. `kind: 'reauth'` keeps it from ever being a bearer.
+     */
+    signReauthToken(claims: ReauthClaims, ttlSec?: number): string;
+    /** Decode a re-authentication proof, or `null` (forged, expired, another kind). */
+    verifyReauthToken(token: string): ReauthClaims | null;
     /**
      * Verify + decode a TOTP challenge token. Returns `null` for any
      * failure (invalid signature, expired, wrong `kind`, missing
@@ -111,6 +112,15 @@ export declare class AuthManager {
      */
     verifyTotpChallengeToken(token: string): TotpChallengeClaims | null;
 }
+/** Seconds a re-authentication proof lasts (`signReauthToken`). */
+export declare const REAUTH_TTL_SEC = 300;
+/** What a re-authentication proof says: who proved it, from which session, how. */
+export interface ReauthClaims {
+    readonly userId: string;
+    /** The login session it was proved in — a proof is spent only there. */
+    readonly sessionId?: string;
+    readonly method: 'password' | 'passkey';
+}
 /**
  * Derived from the cap schema rather than restated.
  *
@@ -125,4 +135,6 @@ export interface TotpChallengeClaims {
     readonly userId: string;
     readonly username: string;
     readonly isAdmin: boolean;
+    /** The primary factor the user already proved — recorded on the session it leads to. */
+    readonly method?: 'password' | 'passkey' | 'sso';
 }

package/dist/auth/cidr.d.ts

@@ -0,0 +1,22 @@
+/** Strip an IPv4-mapped IPv6 prefix and a zone id, so ranges see a clean address. */
+export declare function normalizeIp(ip: string): string;
+export interface ParsedCidr {
+    readonly network: string;
+    readonly prefix: number;
+    readonly family: 'ipv4' | 'ipv6';
+}
+export interface ParsedCidrList {
+    readonly valid: readonly ParsedCidr[];
+    readonly invalid: readonly string[];
+}
+/** Parse a list of CIDR strings; blanks are skipped, unparseable entries returned. */
+export declare function parseCidrList(entries: readonly string[]): ParsedCidrList;
+/** A stored setting as a string list — accepts a list, or one comma/space separated string. */
+export declare function readCidrSetting(value: unknown): readonly string[];
+export interface CidrMatcher {
+    contains(ip: string): boolean;
+    /** How many valid ranges the matcher holds (0 = matches nothing). */
+    readonly size: number;
+}
+/** A matcher over the VALID entries of `entries`; invalid ones match nothing. */
+export declare function createCidrMatcher(entries: readonly string[]): CidrMatcher;

package/dist/auth/login-session-manager.d.ts

@@ -0,0 +1,158 @@
+import { IScopedLogger, SettingsStoreClient } from '@camstack/types';
+/**
+ * @durable class=ledger owner=local-auth
+ *   write="one row per login (password, passkey, SSO, handoff, session exchange);
+ *     rewritten on every refresh / renewal (expiry slides, refresh hash rotates)
+ *     and on revocation"
+ *   retention="the daily reap deletes rows expired more than 7 days ago and rows
+ *     revoked more than 30 days ago. A session the user keeps refreshing lives as
+ *     long as it is used."
+ */
+export declare const LOGIN_SESSIONS_COLLECTION = "login_sessions";
+/**
+ * @durable class=config owner=local-auth
+ *   write="revoking all of a user's sessions (logout everywhere, password change or
+ *     reset, user deletion) sets that user's cutoff to now"
+ *   retention="none — one row per user who ever had all sessions revoked; it only
+ *     ever matters for tokens minted before sessions existed, and is harmless after."
+ */
+export declare const LOGIN_SESSION_CUTOFFS_COLLECTION = "login_session_cutoffs";
+export declare const LOGIN_SESSIONS_COLUMNS: ({
+    name: string;
+    type: "TEXT";
+    primaryKey: boolean;
+    notNull: boolean;
+} | {
+    name: string;
+    type: "TEXT";
+    notNull: boolean;
+    primaryKey?: undefined;
+} | {
+    name: string;
+    type: "BOOLEAN";
+    notNull: boolean;
+    primaryKey?: undefined;
+} | {
+    name: string;
+    type: "INTEGER";
+    notNull: boolean;
+    primaryKey?: undefined;
+} | {
+    name: string;
+    type: "INTEGER";
+    primaryKey?: undefined;
+    notNull?: undefined;
+} | {
+    name: string;
+    type: "TEXT";
+    primaryKey?: undefined;
+    notNull?: undefined;
+})[];
+export declare const LOGIN_SESSION_CUTOFFS_COLUMNS: ({
+    name: string;
+    type: "TEXT";
+    primaryKey: boolean;
+    notNull: boolean;
+} | {
+    name: string;
+    type: "INTEGER";
+    notNull: boolean;
+    primaryKey?: undefined;
+})[];
+/** How a session began — shown on the sessions list. */
+export type LoginSessionMethod = 'password' | 'passkey' | 'sso' | 'handoff' | 'exchange';
+/** Why a session ended. */
+export type LoginSessionRevocation = 'logout' | 'logout-everywhere' | 'password-changed' | 'password-reset' | 'user-deleted' | 'refresh-reuse' | 'revoked-by-user' | 'revoked-by-admin';
+export interface LoginSessionRecord {
+    readonly id: string;
+    readonly userId: string;
+    readonly method: LoginSessionMethod;
+    readonly refreshable: boolean;
+    readonly createdAt: number;
+    readonly lastUsedAt: number;
+    readonly expiresAt: number;
+    readonly revokedAt: number | null;
+    readonly revokedReason: string | null;
+    readonly refreshHash: string | null;
+    readonly previousRefreshHash: string | null;
+    readonly rotatedAt: number | null;
+    readonly client: string | null;
+    readonly ip: string | null;
+}
+/** A session as the UI sees it — no refresh hashes. */
+export type LoginSessionSummary = Omit<LoginSessionRecord, 'refreshHash' | 'previousRefreshHash' | 'rotatedAt'>;
+export interface CreateLoginSessionInput {
+    readonly userId: string;
+    readonly lifetimeMs: number;
+    readonly refreshable: boolean;
+    readonly method: LoginSessionMethod;
+    readonly client?: string;
+    readonly ip?: string;
+}
+export type LoginSessionCheck = {
+    readonly state: 'active';
+    readonly session: LoginSessionRecord;
+} | {
+    readonly state: 'unknown' | 'revoked' | 'expired';
+};
+export type LoginSessionRefresh = {
+    readonly ok: true;
+    readonly session: LoginSessionRecord;
+    readonly refreshToken: string;
+} | {
+    readonly ok: false;
+    readonly reason: 'unknown' | 'expired' | 'revoked' | 'reused';
+};
+export declare const REFRESH_TOKEN_PREFIX = "csr_";
+export declare function toLoginSessionSummary(record: LoginSessionRecord): LoginSessionSummary;
+export interface LoginSessionManagerOptions {
+    readonly now?: () => number;
+    readonly logger?: IScopedLogger;
+}
+export declare class LoginSessionManager {
+    private readonly store;
+    private readonly sessions;
+    /** refresh hash (current or previous) → session id */
+    private readonly byRefreshHash;
+    private readonly cutoffs;
+    private readonly now;
+    private readonly logger;
+    constructor(store: SettingsStoreClient, options?: LoginSessionManagerOptions);
+    /** Load every row into the mirror. Call once at init, before serving. */
+    load(): Promise<void>;
+    create(input: CreateLoginSessionInput): Promise<{
+        readonly session: LoginSessionRecord;
+        readonly refreshToken: string | null;
+    }>;
+    /** Is `sessionId` a live session right now? Synchronous: the hub asks on every request. */
+    check(sessionId: string): LoginSessionCheck;
+    /** Epoch ms before which a pre-session (no `sid`) token of `userId` is refused; 0 = none. */
+    legacyCutoff(userId: string): number;
+    /** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
+    refresh(refreshToken: string, lifetimeMs: number): Promise<LoginSessionRefresh>;
+    /** Renew an active session (legacy client): slide its expiry. `null` when it is not active. */
+    extend(sessionId: string, lifetimeMs: number): Promise<LoginSessionRecord | null>;
+    /** End one session. `false` when it was unknown or already ended. */
+    revoke(sessionId: string, reason: LoginSessionRevocation): Promise<boolean>;
+    /**
+     * End every live session of `userId` except `exceptSessionId`, and move the
+     * user's legacy cutoff to now (pre-session tokens die too). Returns how many
+     * sessions ended.
+     */
+    revokeAllForUser(userId: string, options: {
+        readonly exceptSessionId?: string;
+        readonly reason: LoginSessionRevocation;
+    }): Promise<number>;
+    /** `userId`'s live sessions, newest first. */
+    listForUser(userId: string): readonly LoginSessionSummary[];
+    /** Every live session, newest first. */
+    listActive(): readonly LoginSessionSummary[];
+    /** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
+    reap(): Promise<number>;
+    private newRefreshToken;
+    private remember;
+    private forget;
+    private replace;
+    private persist;
+    private persistCutoff;
+}

package/dist/auth/user-management-internal.d.ts

@@ -0,0 +1,69 @@
+import { AdminTokenRecord } from './admin-token-manager.js';
+import { AuthAuditEvent, AuthAuditRecord } from './auth-audit-log.js';
+import { LoginSessionManager } from './login-session-manager.js';
+/** Process-global, so every bundled copy of this module agrees on the key. */
+export declare const USER_MANAGEMENT_INTERNAL: unique symbol;
+export interface LinkExternalIdentityInput {
+    readonly userId: string;
+    readonly provider: string;
+    readonly subject: string;
+    readonly issuer: string;
+    readonly label?: string;
+}
+/** The login-session table, as the hub uses it (`login-session-manager.ts`). */
+export type LoginSessionsInternal = Pick<LoginSessionManager, 'create' | 'refresh' | 'extend' | 'check' | 'legacyCutoff' | 'revoke' | 'revokeAllForUser' | 'listForUser' | 'listActive'>;
+export interface SetPasswordInput {
+    readonly userId: string;
+    readonly newPassword: string;
+    /**
+     * The session the change was made from: it stays signed in, every other
+     * session of the user ends. Absent — every session ends.
+     */
+    readonly keepSessionId?: string;
+}
+export interface UserManagementInternal {
+    /**
+     * Link `(provider, subject)` to `userId`. Idempotent for the same user;
+     * throws for an identity linked to another user and for a user that does
+     * not exist.
+     */
+    linkExternalIdentity(input: LinkExternalIdentityInput): Promise<{
+        readonly success: true;
+    }>;
+    /** Server-side login sessions: create, refresh, check, revoke, list. */
+    readonly sessions: LoginSessionsInternal;
+    /** Change a password and end the user's other sessions (and pre-session tokens). */
+    setPassword(input: SetPasswordInput): Promise<void>;
+    /** Admin tokens (`csa_`) — the hub router gates creation (admin + re-auth). */
+    readonly adminTokens: AdminTokensInternal;
+    /** The authentication audit trail. */
+    readonly audit: AuthAuditInternal;
+}
+export interface AdminTokensInternal {
+    create(input: {
+        readonly createdBy: string;
+        readonly name: string;
+        readonly expiresAt: number;
+    }): Promise<{
+        readonly token: string;
+        readonly record: AdminTokenRecord;
+    }>;
+    /**
+     * The live token behind `token` — `null` when unknown, revoked, expired, or
+     * when its creator no longer exists or is no longer an admin.
+     */
+    validate(token: string): Promise<AdminTokenRecord | null>;
+    list(): Promise<readonly AdminTokenRecord[]>;
+    revoke(id: string): Promise<boolean>;
+}
+export interface AuthAuditInternal {
+    record(event: AuthAuditEvent): Promise<void>;
+    list(input?: {
+        readonly limit?: number;
+        readonly userId?: string;
+    }): Promise<readonly AuthAuditRecord[]>;
+}
+/** Attach `internal` to `provider` (returns the same object, now carrying it). */
+export declare function attachUserManagementInternal<T extends object>(provider: T, internal: UserManagementInternal): T;
+/** The hub-internal surface of a `user-management` provider, or `null` when it carries none. */
+export declare function getUserManagementInternal(provider: unknown): UserManagementInternal | null;

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { W as addonPagesCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { G as addonPagesCapability, ei as EventCategory, lr as errMsg, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { ei as EventCategory, lr as errMsg, q as addonWidgetsCapability, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { J as alertsCapability, Tr as createEvent, ei as EventCategory, lr as errMsg, n as AlertSchema, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Ar as isEvent, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { Mr as isEvent, S as FIRST_LEVEL_MACRO_CLASSES, Z as bareAddonId, _n as ptzAutotrackCapability, ei as EventCategory, lr as errMsg, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.d.ts

@@ -3,6 +3,9 @@ export declare class BackupOrchestratorAddon extends BaseAddon<Record<string, ne
     private systemBackup;
     private policies;
     private schedules;
+    /** Backup encryption keys — PUBLIC keys only (see encryption-key-store.ts). */
+    private encryptionKeys;
+    private warnedNoEncryptionStore;
     private dataDir;
     /**
      * Transient build buffer for archive fan-out. The tar is built here
@@ -194,6 +197,17 @@ export declare class BackupOrchestratorAddon extends BaseAddon<Record<string, ne
      * whitelist — only those top-level locations get extracted.
      */
     private scheduleRestore;
+    private requireEncryptionKeys;
+    /**
+     * The key a run encrypts to; `null` = encryption off. THROWS when the
+     * setting cannot be read — a run must fail rather than ship a plain archive
+     * an operator asked to be encrypted.
+     */
+    private activeEncryptionKey;
+    private getEncryption;
+    private setupEncryption;
+    private disableEncryption;
+    private checkBackupKey;
     /**
      * Resolve a target destination set — see {@link selectBackupTargets} for the
      * rule. Caller-provided list wins over the per-destination policy flag;