@camstack/system 1.2.381 → 1.2.382

package/dist/builtins/keychain/keychain-reset-trigger.d.ts

@@ -0,0 +1,25 @@
+import { KeychainResetRecord } from '@camstack/types';
+import { KeychainLogger, KeychainService } from './keychain-service.js';
+/** The trigger's name, inside `<dataDir>/.keychain/`. */
+export declare const KEYCHAIN_RESET_TRIGGER = "RESET_KEYCHAIN";
+export declare function keychainResetTriggerPath(dataDir: string): string;
+export type KeychainResetTriggerOutcome = {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'ignored-unlocked';
+} | {
+    readonly kind: 'deferred';
+    readonly reason: string;
+} | {
+    readonly kind: 'refused';
+    readonly error: string;
+} | {
+    readonly kind: 'reset';
+    readonly record: KeychainResetRecord;
+};
+export interface KeychainResetTriggerInput {
+    readonly service: Pick<KeychainService, 'getState' | 'resetAs' | 'resetReport'>;
+    readonly dataDir: string;
+    readonly logger: KeychainLogger;
+}
+export declare function applyKeychainResetTrigger(input: KeychainResetTriggerInput): Promise<KeychainResetTriggerOutcome>;

package/dist/builtins/keychain/keychain-service.d.ts

@@ -1,12 +1,16 @@
-import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason, SystemHeldSecretName } from '@camstack/types';
-import { KeychainRepository, KeychainSecretRow } from './keychain-store.js';
+import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResetRecord, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason, SystemHeldSecretName } from '@camstack/types';
 import { KeySourceCandidate } from './key-sources.js';
+import { KeychainRepository, KeychainSecretRow } from './keychain-store.js';
 /** `lastReadAt` is written at most this often per ref (hub I/O is the bottleneck). */
 export declare const LAST_READ_GRANULARITY_MS: number;
 export declare class KeychainLockedError extends Error {
     readonly reason: KeychainUnavailableReason;
     constructor(reason: KeychainUnavailableReason);
 }
+/** A reset that would archive the values and still end locked — refused before it starts. */
+export declare class KeychainResetRefusedError extends Error {
+    constructor(reason: string);
+}
 export declare class KeychainForbiddenError extends Error {
     readonly ref: string;
     constructor(ref: string, caller: string | null);
@@ -102,11 +106,40 @@ export declare class KeychainService {
     }>;
     /** Delete retired wraps, and the default file's previous copies with them. */
     purgeRetiredKeys(userId: string): Promise<number>;
-    /** Lost-key recovery — see `keychain-admin.resetKeychain`. */
+    /** Lost-key recovery from System → Secrets — see `keychain-admin.resetKeychain`. */
     resetKeychain(userId: string): Promise<{
         archivedCollection: string | null;
         archived: number;
     }>;
+    /**
+     * Start over with a new master key and a new data key.
+     *
+     * 1. Refuse BEFORE touching anything when the configured primary source
+     *    cannot give a key (a configured file that is missing or unreadable, a
+     *    desktop key that did not arrive): archiving the values and then staying
+     *    locked would lose them for nothing. The default file is always usable —
+     *    the reset writes a new one (the old one is kept as `master.key.prev-*`).
+     * 2. Archive every value AND every wrapped data key — the archive stays
+     *    openable if the lost master key turns up.
+     * 3. New data key under the new master key ({@link firstBoot}).
+     * 4. Clear the system-held markers (the cluster secret's): a marker pointing
+     *    at an archived value would refuse every agent forever (D797). The
+     *    session signing key has no marker; it now resolves `missing`, and
+     *    `local-auth` generates a new one (everyone signs in again).
+     * 5. One `delete` event per archived ref, so every keeper reloads.
+     * 6. A reset record for the Secrets page, and an audit row.
+     */
+    resetAs(actor: string): Promise<KeychainResetRecord>;
+    /** Throws {@link KeychainResetRefusedError} when no new master key could be had. */
+    private assertResettable;
+    /** What the last reset left to re-enter (see `keychain-admin.resetReport`). */
+    resetReport(): Promise<{
+        reset: KeychainResetRecord | null;
+        pendingReentry: readonly KeychainSecretMeta[];
+    }>;
+    acknowledgeReset(userId: string): Promise<{
+        acknowledged: boolean;
+    }>;
     private audit;
     /** Daily ring prune, driven by the addon's timer. */
     pruneAudit(): Promise<void>;

package/dist/builtins/keychain/keychain-store.d.ts

@@ -1,4 +1,4 @@
-import { ISettingsStoreProvider, KeychainAuditAction } from '@camstack/types';
+import { ISettingsStoreProvider, KeychainAuditAction, KeychainResetRecord } from '@camstack/types';
 /**
  * @durable class=config owner=keychain
  *   write="`keychain.put` upserts one row per ref; `delete` removes it"
@@ -21,6 +21,14 @@ export declare const KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
  *   retention="90 days and at most 20 000 rows, pruned at boot and daily"
  */
 export declare const KEYCHAIN_AUDIT_COLLECTION = "keychain:audit";
+/**
+ * @durable class=config owner=keychain
+ *   write="one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN
+ *     trigger file); `acknowledgeReset` stamps `acknowledgedAt`"
+ *   retention="none — a handful of rows over a hub's life; they name the
+ *     archive tables a reset left behind"
+ */
+export declare const KEYCHAIN_RESETS_COLLECTION = "keychain:resets";
 export declare const AUDIT_RETENTION_MS: number;
 export declare const AUDIT_MAX_ROWS = 20000;
 export interface KeychainSecretRow {
@@ -79,4 +87,19 @@ export declare class KeychainRepository {
      * so a key that turns up later can still recover it.
      */
     archiveAllSecrets(archive: string): Promise<number>;
+    /**
+     * Copy every wrapped data key into `archive` (the companion of
+     * {@link archiveAllSecrets}): without the wrap, an archived value could
+     * never be opened again even if the lost master key turned up.
+     */
+    archiveAllKeys(archive: string): Promise<number>;
+    /** Every secret row of an archive table (ciphertext — never decrypted here). */
+    listArchivedSecrets(archive: string): Promise<readonly KeychainSecretRow[]>;
+    /**
+     * Delete the `system-settings` rows among `keys` that exist; returns the
+     * keys it deleted. A read that fails throws — never "nothing was there".
+     */
+    clearSystemSettingsKeys(keys: readonly string[]): Promise<readonly string[]>;
+    putReset(record: KeychainResetRecord): Promise<void>;
+    latestReset(): Promise<KeychainResetRecord | null>;
 }

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BugrtARh.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, Qr as EventCategory, cr as errMsg, lr as BaseAddon, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
+import { I as RecordingStatusSchema, P as RECORDING_SOURCE_CAMSTACK_ADDON, Tr as createEvent, ei as EventCategory, lr as errMsg, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -9,8 +9,24 @@ export declare class LocalAuthAddon extends BaseAddon {
     private totpManager;
     private externalIdentities;
     private signingKeyKeeper;
+    private loginSessions;
+    private adminTokens;
+    private auditLog;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    /**
+     * The hub-internal surface (`user-management-internal.ts`): operations no
+     * wire may reach. Called only by hub code holding this provider object.
+     */
+    private buildInternal;
+    /**
+     * End every way `userId` could still get in: login sessions (and the
+     * pre-session tokens, via the cutoff), scoped tokens, OAuth account links,
+     * the TOTP row and the external sign-in links. Each step is attempted even
+     * if an earlier one fails, and a failure is logged — a half-cleaned user is
+     * worse than a loud one.
+     */
+    private endAllAccess;
     /**
      * Drop auth rows that are dead but were never removed: scoped tokens past
      * their expiry, and OAuth sessions revoked longer ago than