@camstack/system 1.2.428 → 1.2.429

package/dist/agent-https-names-CpUSuP4w.js

@@ -0,0 +1,120 @@
+//#region src/tls/agent-https-names.ts
+/**
+* @durable class=config owner=system-config
+*   write="the hub records the names it signed into an agent's HTTPS leaf, replacing that
+*     node's previous row"
+*   retention="one row per node, replaced on every issue; a forgotten node's row stays until
+*     the node is issued again or an operator clears it (it only blocks reuse of its names)"
+*/
+var AGENT_HTTPS_NAMES_COLLECTION = "agent_https_names";
+var AGENT_HTTPS_NAMES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "names",
+		type: "JSON",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var AgentHttpsNames = class {
+	store;
+	byNode = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.store = store;
+	}
+	async load() {
+		const rows = await this.store.query.query({ collection: AGENT_HTTPS_NAMES_COLLECTION });
+		for (const row of rows) {
+			const names = row.data["names"];
+			if (Array.isArray(names)) this.byNode.set(row.id, names.filter((n) => typeof n === "string").map((n) => n.toLowerCase()));
+		}
+	}
+	/** Every name certified to a node other than `nodeId`. */
+	takenByOthers(nodeId) {
+		const out = /* @__PURE__ */ new Set();
+		for (const [id, names] of this.byNode) {
+			if (id === nodeId) continue;
+			for (const n of names) out.add(n);
+		}
+		return out;
+	}
+	/** Free every name certified to a node that was forgotten. */
+	async release(nodeId) {
+		if (!this.byNode.delete(nodeId)) return false;
+		await this.store.delete.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			key: nodeId
+		});
+		return true;
+	}
+	async record(nodeId, names) {
+		const lowered = names.map((n) => n.toLowerCase());
+		const existed = this.byNode.has(nodeId);
+		this.byNode.set(nodeId, lowered);
+		const data = {
+			names: lowered,
+			issuedAt: Date.now()
+		};
+		if (existed) await this.store.update.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			id: nodeId,
+			data
+		});
+		else await this.store.insert.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			record: {
+				id: nodeId,
+				data
+			}
+		});
+	}
+};
+var SLOT = Symbol.for("camstack.agent-https.names");
+function setProcessAgentHttpsNames(names) {
+	if (names === null) Reflect.deleteProperty(globalThis, SLOT);
+	else Reflect.set(globalThis, SLOT, names);
+}
+function getProcessAgentHttpsNames() {
+	const value = Reflect.get(globalThis, SLOT);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "takenByOthers") === "function" ? value : null;
+}
+//#endregion
+Object.defineProperty(exports, "AGENT_HTTPS_NAMES_COLLECTION", {
+	enumerable: true,
+	get: function() {
+		return AGENT_HTTPS_NAMES_COLLECTION;
+	}
+});
+Object.defineProperty(exports, "AGENT_HTTPS_NAMES_COLUMNS", {
+	enumerable: true,
+	get: function() {
+		return AGENT_HTTPS_NAMES_COLUMNS;
+	}
+});
+Object.defineProperty(exports, "AgentHttpsNames", {
+	enumerable: true,
+	get: function() {
+		return AgentHttpsNames;
+	}
+});
+Object.defineProperty(exports, "getProcessAgentHttpsNames", {
+	enumerable: true,
+	get: function() {
+		return getProcessAgentHttpsNames;
+	}
+});
+Object.defineProperty(exports, "setProcessAgentHttpsNames", {
+	enumerable: true,
+	get: function() {
+		return setProcessAgentHttpsNames;
+	}
+});

package/dist/agent-https-names-uetr4OQl.mjs

@@ -0,0 +1,91 @@
+//#region src/tls/agent-https-names.ts
+/**
+* @durable class=config owner=system-config
+*   write="the hub records the names it signed into an agent's HTTPS leaf, replacing that
+*     node's previous row"
+*   retention="one row per node, replaced on every issue; a forgotten node's row stays until
+*     the node is issued again or an operator clears it (it only blocks reuse of its names)"
+*/
+var AGENT_HTTPS_NAMES_COLLECTION = "agent_https_names";
+var AGENT_HTTPS_NAMES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "names",
+		type: "JSON",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var AgentHttpsNames = class {
+	store;
+	byNode = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.store = store;
+	}
+	async load() {
+		const rows = await this.store.query.query({ collection: AGENT_HTTPS_NAMES_COLLECTION });
+		for (const row of rows) {
+			const names = row.data["names"];
+			if (Array.isArray(names)) this.byNode.set(row.id, names.filter((n) => typeof n === "string").map((n) => n.toLowerCase()));
+		}
+	}
+	/** Every name certified to a node other than `nodeId`. */
+	takenByOthers(nodeId) {
+		const out = /* @__PURE__ */ new Set();
+		for (const [id, names] of this.byNode) {
+			if (id === nodeId) continue;
+			for (const n of names) out.add(n);
+		}
+		return out;
+	}
+	/** Free every name certified to a node that was forgotten. */
+	async release(nodeId) {
+		if (!this.byNode.delete(nodeId)) return false;
+		await this.store.delete.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			key: nodeId
+		});
+		return true;
+	}
+	async record(nodeId, names) {
+		const lowered = names.map((n) => n.toLowerCase());
+		const existed = this.byNode.has(nodeId);
+		this.byNode.set(nodeId, lowered);
+		const data = {
+			names: lowered,
+			issuedAt: Date.now()
+		};
+		if (existed) await this.store.update.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			id: nodeId,
+			data
+		});
+		else await this.store.insert.mutate({
+			collection: AGENT_HTTPS_NAMES_COLLECTION,
+			record: {
+				id: nodeId,
+				data
+			}
+		});
+	}
+};
+var SLOT = Symbol.for("camstack.agent-https.names");
+function setProcessAgentHttpsNames(names) {
+	if (names === null) Reflect.deleteProperty(globalThis, SLOT);
+	else Reflect.set(globalThis, SLOT, names);
+}
+function getProcessAgentHttpsNames() {
+	const value = Reflect.get(globalThis, SLOT);
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "takenByOthers") === "function" ? value : null;
+}
+//#endregion
+export { setProcessAgentHttpsNames as a, getProcessAgentHttpsNames as i, AGENT_HTTPS_NAMES_COLUMNS as n, AgentHttpsNames as r, AGENT_HTTPS_NAMES_COLLECTION as t };

package/dist/auth/auth-audit-log.d.ts

@@ -7,7 +7,7 @@ import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@cams
 */
 export declare const AUTH_AUDIT_COLLECTION = "auth_audit";
 export declare const AUTH_AUDIT_COLUMNS: readonly CollectionColumn[];
-export declare const AUTH_AUDIT_ACTIONS: readonly ["second-factor-skipped", "admin-token-created", "admin-token-used", "admin-token-revoked", "credentials-revoked", "agent-addon-update", "agent-addon-update-refused"];
+export declare const AUTH_AUDIT_ACTIONS: readonly ["second-factor-skipped", "admin-token-created", "admin-token-used", "admin-token-revoked", "credentials-revoked", "agent-addon-update", "agent-addon-update-refused", "device-credential-enrolled", "device-credential-revoked", "device-credential-login", "device-credential-login-refused"];
 export type AuthAuditAction = (typeof AUTH_AUDIT_ACTIONS)[number];
 export interface AuthAuditEvent {
 	readonly action: AuthAuditAction;

package/dist/auth/device-ca-store.d.ts

@@ -0,0 +1,57 @@
+/**
+* Loads the device CA from the keychain + settings, and creates it LAZILY on
+* the first enrollment (D855). Never rotated on boot, never silently replaced.
+*
+* The two halves of the CA and what each combination means:
+*
+*   key  cert   state
+*   ---- ----   -----------------------------------------------------------
+*   no   no     `absent`       - no device was ever enrolled: `ensure()` creates it
+*   yes  yes    `ready`
+*   yes  no     recovered      - a creation that died between its two writes:
+*                                the certificate is rebuilt from the SAME key
+*                                (same subject, same public key, so every leaf
+*                                already issued still verifies) and written
+*   no   yes    `unavailable`  - the key is GONE (keychain reset, restore). A
+*                                new CA would orphan every enrolled device
+*                                without a word, so this is an explicit error:
+*                                logged, shown by `getDeviceCaStatus`, and
+*                                `ensure()` refuses. The operator restores the
+*                                key (or knowingly removes `cluster.deviceCa`).
+*
+* Creation order is KEY first, then certificate. If the certificate write
+* fails after the key was stored, the next `lookup()` finds (yes, no) and
+* completes the creation deterministically - there is no half-state that needs
+* a human.
+*/
+import type { IScopedLogger, SecretsAccess } from "@camstack/types";
+import { type DeviceCaSigner } from "./device-ca.js";
+export interface DeviceCaStoreDeps {
+	/** Keychain handle for owner `system`; `null` when this process has no keychain door. */
+	readonly secrets: SecretsAccess | null;
+	readonly readSection: (section: string) => Promise<Record<string, unknown>>;
+	readonly writeSection: (section: string, patch: Record<string, unknown>) => Promise<void>;
+	readonly logger?: IScopedLogger;
+}
+export type DeviceCaLookup = {
+	readonly state: "ready";
+	readonly ca: DeviceCaSigner;
+} | {
+	readonly state: "absent";
+} | {
+	readonly state: "unavailable";
+	readonly reason: string;
+};
+export declare class DeviceCaStore {
+	private readonly deps;
+	private loaded;
+	private creating;
+	private lastReported;
+	constructor(deps: DeviceCaStoreDeps);
+	/** The CA when one exists (completing an interrupted creation). Never creates a NEW one. */
+	lookup(): Promise<DeviceCaLookup>;
+	/** The CA, created now if neither half exists. Throws on any inconsistent or unreadable state. */
+	ensure(): Promise<DeviceCaSigner>;
+	private report;
+	private create;
+}

package/dist/auth/device-ca.d.ts

@@ -0,0 +1,75 @@
+/**
+* Device CA (D855) — the THIRD certificate authority, distinct from the HTTPS
+* local CA (`tls/cert-issue.ts`, RSA) and the mesh CA
+* (`kernel/moleculer/mesh-mtls/mesh-ca.ts`). EC P-256, key in the keychain
+* (owner `system`), certificate persisted like `cluster.meshCa`.
+*
+* It signs ONE kind of leaf: a device credential. The device generated the key
+* pair; the hub only ever sees the public half (an SPKI). Same library and
+* WebCrypto path as the other two CAs, same pinned `@peculiar/x509`.
+*/
+import type { webcrypto as WebCrypto } from "node:crypto";
+import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
+/** `secret://system/global/deviceCaKey` — EC P-256 PKCS#8 PEM of the device CA. */
+export declare const DEVICE_CA_KEY_REF: string;
+/** Settings section / field holding the public CA certificate PEM (beside `cluster.meshCa`). */
+export declare const DEVICE_CA_SETTINGS_SECTION = "cluster";
+export declare const DEVICE_CA_FIELD = "deviceCa";
+export declare const DEVICE_CA_COMMON_NAME = "CamStack Device CA";
+export declare const DEVICE_CA_VALIDITY_DAYS = 3650;
+export interface DeviceCaSigner {
+	readonly certPem: string;
+	readonly keyPem: string;
+	readonly cert: PeculiarCertificate;
+	readonly privateKey: WebCrypto.CryptoKey;
+}
+export interface DeviceLeafMaterial {
+	readonly certPem: string;
+	readonly serialNumber: string;
+	readonly notBefore: Date;
+	readonly notAfter: Date;
+	/** SHA-256 of the DER, colon-hex uppercase. */
+	readonly fingerprint: string;
+}
+export declare function generateDeviceCa(now?: Date): Promise<DeviceCaSigner>;
+export declare function loadDeviceCa(certPem: string, keyPem: string): Promise<DeviceCaSigner>;
+/**
+* A new self-signed certificate for the SAME key pair as `keyPem` (same
+* subject, so leaves already issued still verify): completes a CA creation that
+* died between its key write and its certificate write.
+*/
+export declare function rebuildDeviceCaCertificate(keyPem: string): Promise<DeviceCaSigner>;
+/** Import (and thereby validate) a device public key: SPKI DER, ECDSA P-256. */
+export declare function importDevicePublicKey(spki: Uint8Array): Promise<WebCrypto.CryptoKey>;
+export interface IssueDeviceLeafInput {
+	readonly credentialId: string;
+	readonly userId: string;
+	readonly publicKeySpki: Uint8Array;
+	readonly now?: Date;
+	readonly validDays?: number;
+}
+/**
+* Sign a device leaf: CN = credential id; SAN URIs `camstack:credential:<id>`
+* and `camstack:user:<userId>`; EKU clientAuth; 365 days by default.
+*/
+export declare function issueDeviceLeaf(ca: DeviceCaSigner, input: IssueDeviceLeafInput): Promise<DeviceLeafMaterial>;
+export type DeviceLeafRefusal = "malformed-certificate" | "not-issued-by-device-ca" | "not-yet-valid" | "expired" | "missing-credential-san" | "missing-client-auth";
+export type DeviceLeafVerdict = {
+	readonly ok: true;
+	readonly credentialId: string;
+	readonly userId: string | null;
+	readonly publicKeySpki: Buffer;
+	readonly serialNumber: string;
+	readonly fingerprint: string;
+	readonly notAfter: Date;
+} | {
+	readonly ok: false;
+	readonly reason: DeviceLeafRefusal;
+};
+/** Chain (signature by the device CA), validity window, EKU and identity of a presented leaf. */
+export declare function verifyDeviceLeaf(caCertPem: string, leafPem: string, now?: Date): Promise<DeviceLeafVerdict>;
+/**
+* ECDSA P-256 / SHA-256 over `message`. Accepts the raw `r||s` form WebCrypto
+* and Android emit (64 bytes) and the DER form the Secure Enclave emits.
+*/
+export declare function verifyDeviceSignature(publicKeySpki: Uint8Array, message: string, signatureBase64Url: string): boolean;

package/dist/auth/device-credential-manager.d.ts

@@ -0,0 +1,154 @@
+import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@camstack/types";
+import { type DeviceCredential, type DevicePlatform, type DeviceSignaturePurpose } from "@camstack/types";
+import type { DeviceCaStore } from "./device-ca-store.js";
+/**
+* @durable class=config owner=local-auth
+*   write="an enrollment completes (QR or self) inserts a row; a renewal rewrites
+*     fingerprint/expiry; every accepted certificate login rewrites lastUsedAt/From;
+*     an admin revokes or renames"
+*   retention="a revoked or long-expired row is kept 90 days for the audit question
+*     'which device was that', then the daily reap deletes it; an active row is
+*     never deleted"
+*/
+export declare const DEVICE_CREDENTIALS_COLLECTION = "device_credentials";
+export declare const DEVICE_CREDENTIALS_COLUMNS: readonly CollectionColumn[];
+export type EnrolledVia = "qr" | "self";
+export interface DeviceCredentialRecord {
+	readonly id: string;
+	readonly userId: string;
+	readonly deviceName: string;
+	readonly platform: DevicePlatform;
+	readonly enrolledVia: EnrolledVia;
+	readonly fingerprint: string;
+	readonly serial: string;
+	/** The fingerprint the leaf had before the last renewal, accepted until {@link PREVIOUS_LEAF_GRACE_MS} after `renewedAt`. */
+	readonly previousFingerprint: string | null;
+	readonly renewedAt: number | null;
+	/** SPKI DER, base64url. */
+	readonly publicKey: string;
+	readonly issuedAt: number;
+	readonly expiresAt: number;
+	readonly lastUsedAt: number | null;
+	readonly lastUsedFrom: string | null;
+	readonly revokedAt: number | null;
+	readonly revokedBy: string | null;
+}
+export type DeviceCredentialState = "active" | "expired" | "revoked" | "unknown";
+export type DeviceCheckRefusal = "unknown-or-used-code" | "expired-code" | "user-gone" | "ca-unavailable" | "bad-public-key" | "self-enrollment-disabled" | "unknown-nonce" | "expired-nonce" | "no-device-ca" | "malformed-certificate" | "not-issued-by-device-ca" | "not-yet-valid" | "expired" | "missing-credential-san" | "missing-client-auth" | "unknown-credential" | "revoked" | "key-mismatch" | "bad-signature" | "user-mismatch" | "superseded";
+export type Refused = {
+	readonly ok: false;
+	readonly reason: DeviceCheckRefusal;
+};
+export interface IssuedDeviceCertificate {
+	readonly ok: true;
+	readonly credentialId: string;
+	readonly userId: string;
+	readonly certPem: string;
+	readonly chainPem: string;
+	readonly notAfter: number;
+}
+export interface AuthenticatedDevice {
+	readonly ok: true;
+	readonly credential: DeviceCredentialRecord;
+}
+export interface DeviceNonce {
+	readonly nonce: string;
+	readonly expiresAt: number;
+}
+/**
+* After a renewal the PREVIOUS leaf still logs in for this long, so a device
+* that crashed between the hub's answer and its own write is not locked out;
+* after it, the old leaf is `superseded` (not definitive: the app holds the
+* newest certificate, so seeing it means the device lost the new one).
+*/
+export declare const PREVIOUS_LEAF_GRACE_MS: number;
+export interface DeviceCredentialManagerDeps {
+	readonly ca: Pick<DeviceCaStore, "lookup" | "ensure">;
+	/** The user a credential names; `null` when gone. */
+	readonly findUser: (userId: string) => Promise<{
+		readonly username: string;
+	} | null>;
+	/** Hub-wide switch for `enrollSelf`; absent = allowed. */
+	readonly selfEnrollmentAllowed: () => Promise<boolean>;
+	readonly now?: () => number;
+	readonly logger?: IScopedLogger;
+}
+export declare class DeviceCredentialManager {
+	private readonly store;
+	private readonly deps;
+	private readonly records;
+	private readonly pendingEnrollments;
+	private readonly usedCodes;
+	private readonly nonces;
+	private readonly now;
+	constructor(store: SettingsStoreClient, deps: DeviceCredentialManagerDeps);
+	load(): Promise<void>;
+	/** A one-shot code for `userId` (admin path). Returned once; only its hash is kept. */
+	startEnrollment(input: {
+		readonly userId: string;
+		readonly deviceName: string;
+		readonly createdBy: string;
+	}): {
+		readonly code: string;
+		readonly expiresAt: number;
+	};
+	/** Redeem a code with the device's public key (public procedure). */
+	completeEnrollment(input: {
+		readonly code: string;
+		readonly publicKeySpki: string;
+		readonly deviceName?: string;
+		readonly platform: DevicePlatform;
+	}): Promise<(IssuedDeviceCertificate & {
+		readonly username: string;
+	}) | Refused>;
+	/** A signed-in user's own device (the caller has already proved a step-up). */
+	enrollSelf(input: {
+		readonly userId: string;
+		readonly publicKeySpki: string;
+		readonly deviceName: string;
+		readonly platform: DevicePlatform;
+	}): Promise<(IssuedDeviceCertificate & {
+		readonly username: string;
+	}) | Refused>;
+	private issueNew;
+	private issued;
+	/** A single-use nonce bound to `origin`. */
+	issueNonce(origin: string, partition?: string): DeviceNonce;
+	/**
+	* Check a presented certificate + signature. Consumes the nonce on the first
+	* attempt. On success the credential's lastUsed is stamped.
+	*/
+	authenticate(input: {
+		readonly certPem: string;
+		readonly nonce: string;
+		readonly signature: string;
+		readonly purpose: DeviceSignaturePurpose;
+		readonly from?: string;
+	}): Promise<AuthenticatedDevice | Refused>;
+	/** A new leaf for the SAME public key, after {@link authenticate} accepted a `renew` proof. */
+	renew(credential: DeviceCredentialRecord): Promise<IssuedDeviceCertificate | Refused>;
+	/** Synchronous: the hub asks on every refresh of a credential-bound session. */
+	check(credentialId: string): DeviceCredentialState;
+	get(credentialId: string): DeviceCredentialRecord | undefined;
+	list(input: {
+		readonly userId?: string;
+		readonly includeRevoked: boolean;
+	}): readonly DeviceCredentialRecord[];
+	/**
+	* Delete a REVOKED row (admin clean-up). `live` refuses a credential that is
+	* not revoked — a live credential is revoked first, so a delete can never be
+	* the way a device silently stops working.
+	*/
+	delete(credentialId: string): Promise<"deleted" | "live" | "unknown">;
+	/** Revoke; `false` when unknown or already revoked. `revokedBy`: see `formatDeviceRevoker`. */
+	revoke(credentialId: string, revokedBy: string): Promise<boolean>;
+	rename(credentialId: string, deviceName: string): Promise<boolean>;
+	/** Revoke every credential of a user (account deleted). Returns their ids. */
+	revokeAllForUser(userId: string, revokedBy: string): Promise<readonly string[]>;
+	toSummary(record: DeviceCredentialRecord, username: string | null): DeviceCredential;
+	/** Delete rows revoked or expired more than 90 days ago. */
+	reap(): Promise<number>;
+	private save;
+	private refuse;
+	private prune;
+}

package/dist/auth/login-session-manager.d.ts

@@ -20,9 +20,9 @@ export declare const LOGIN_SESSION_CUTOFFS_COLLECTION = "login_session_cutoffs";
 export declare const LOGIN_SESSIONS_COLUMNS: readonly CollectionColumn[];
 export declare const LOGIN_SESSION_CUTOFFS_COLUMNS: readonly CollectionColumn[];
 /** How a session began — shown on the sessions list. */
-export type LoginSessionMethod = "password" | "passkey" | "sso" | "handoff" | "exchange";
+export type LoginSessionMethod = "password" | "passkey" | "sso" | "handoff" | "exchange" | "device-certificate";
 /** Why a session ended. */
-export type LoginSessionRevocation = "logout" | "logout-everywhere" | "password-changed" | "password-reset" | "user-deleted" | "refresh-reuse" | "revoked-by-user" | "revoked-by-admin";
+export type LoginSessionRevocation = "logout" | "logout-everywhere" | "password-changed" | "password-reset" | "user-deleted" | "refresh-reuse" | "revoked-by-user" | "revoked-by-admin" | "credential-revoked" | "credential-expired";
 export interface LoginSessionRecord {
 	readonly id: string;
 	readonly userId: string;
@@ -38,6 +38,8 @@ export interface LoginSessionRecord {
 	readonly rotatedAt: number | null;
 	readonly client: string | null;
 	readonly ip: string | null;
+	/** The device credential (D855) that opened this session; `null` for every other login. */
+	readonly credentialId: string | null;
 }
 /** A session as the UI sees it — no refresh hashes. */
 export type LoginSessionSummary = Omit<LoginSessionRecord, "refreshHash" | "previousRefreshHash" | "rotatedAt">;
@@ -48,6 +50,8 @@ export interface CreateLoginSessionInput {
 	readonly method: LoginSessionMethod;
 	readonly client?: string;
 	readonly ip?: string;
+	/** Set by a device-certificate login; the refresh path re-checks it. */
+	readonly credentialId?: string;
 }
 export type LoginSessionCheck = {
 	readonly state: "active";
@@ -88,6 +92,12 @@ export declare class LoginSessionManager {
 	check(sessionId: string): LoginSessionCheck;
 	/** Epoch ms before which a pre-session (no `sid`) token of `userId` is refused; 0 = none. */
 	legacyCutoff(userId: string): number;
+	/**
+	* The session a refresh token belongs to, WITHOUT rotating it - so the
+	* refresh path can judge the session (its device credential) before it
+	* spends the token. `null` when the token names no session.
+	*/
+	peekByRefreshToken(refreshToken: string): LoginSessionRecord | null;
 	/** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
 	refresh(refreshToken: string, lifetimeMs: number): Promise<LoginSessionRefresh>;
 	/** Renew an active session (legacy client): slide its expiry. `null` when it is not active. */
@@ -103,6 +113,8 @@ export declare class LoginSessionManager {
 		readonly exceptSessionId?: string;
 		readonly reason: LoginSessionRevocation;
 	}): Promise<number>;
+	/** End every live session opened by device credential `credentialId`. Returns how many. */
+	revokeByCredential(credentialId: string, reason?: LoginSessionRevocation): Promise<number>;
 	/** `userId`'s live sessions, newest first. */
 	listForUser(userId: string): readonly LoginSessionSummary[];
 	/** Every live session, newest first. */

package/dist/auth/user-management-internal.d.ts

@@ -15,6 +15,7 @@
 */
 import type { AdminTokenRecord } from "./admin-token-manager.js";
 import type { AuthAuditEvent, AuthAuditRecord } from "./auth-audit-log.js";
+import type { DeviceCredentialManager } from "./device-credential-manager.js";
 import type { LoginSessionManager } from "./login-session-manager.js";
 /** Process-global, so every bundled copy of this module agrees on the key. */
 export declare const USER_MANAGEMENT_INTERNAL: unique symbol;
@@ -26,7 +27,13 @@ export interface LinkExternalIdentityInput {
 	readonly label?: string;
 }
 /** The login-session table, as the hub uses it (`login-session-manager.ts`). */
-export type LoginSessionsInternal = Pick<LoginSessionManager, "create" | "refresh" | "extend" | "check" | "legacyCutoff" | "revoke" | "revokeAllForUser" | "listForUser" | "listActive">;
+export type LoginSessionsInternal = Pick<LoginSessionManager, "create" | "refresh" | "extend" | "check" | "legacyCutoff" | "revoke" | "revokeAllForUser" | "revokeByCredential" | "peekByRefreshToken" | "listForUser" | "listActive">;
+/**
+* Device credentials (D855), as the hub's public `auth` procedures use them.
+* Hub-internal for the same reason as the rest: completing an enrollment or
+* proving a certificate are proofs of possession, never cap calls.
+*/
+export type DeviceCredentialsInternal = Pick<DeviceCredentialManager, "completeEnrollment" | "enrollSelf" | "issueNonce" | "authenticate" | "renew" | "check" | "get" | "revoke" | "list">;
 export interface SetPasswordInput {
 	readonly userId: string;
 	readonly newPassword: string;
@@ -63,6 +70,8 @@ export interface UserManagementInternal {
 	readonly oauthSessions: OauthSessionsInternal;
 	/** The authentication audit trail. */
 	readonly audit: AuthAuditInternal;
+	/** Device certificates: enrollment legs, challenge, proof, renewal, liveness check. */
+	readonly deviceCredentials: DeviceCredentialsInternal;
 }
 export interface ScopedTokensInternal {
 	revoke(id: string): Promise<boolean>;

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { W as addonPagesCapability, cr as errMsg, lr as BaseAddon, ti as EventCategory } from "../../dist-DHSJV4Qc.mjs";
+import { J as addonPagesCapability, _r as BaseAddon, gr as errMsg, li as EventCategory } from "../../dist-CSSfTM18.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon, ti as EventCategory } from "../../dist-DHSJV4Qc.mjs";
+import { X as addonWidgetsCapability, _r as BaseAddon, gr as errMsg, li as EventCategory } from "../../dist-CSSfTM18.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Tr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability, ti as EventCategory } from "../../dist-DHSJV4Qc.mjs";
+import { Nr as createEvent, Z as alertsCapability, _r as BaseAddon, gr as errMsg, li as EventCategory, n as AlertSchema } from "../../dist-CSSfTM18.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { C as FIRST_LEVEL_MACRO_CLASSES, Pr as isEvent, X as bareAddonId, cr as errMsg, hn as ptzAutotrackCapability, lr as BaseAddon, ti as EventCategory } from "../../dist-DHSJV4Qc.mjs";
+import { Cn as ptzAutotrackCapability, D as FIRST_LEVEL_MACRO_CLASSES, Hr as isEvent, _r as BaseAddon, et as bareAddonId, gr as errMsg, li as EventCategory } from "../../dist-CSSfTM18.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,