@camstack/system 1.2.428 → 1.2.430

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-DxJdci75.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-BZm055IP.js");
+const require_device_ca = require("../../device-ca-CKiqh2Iu.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -16,7 +16,7 @@ node_path = require_chunk.__toESM(node_path);
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 //#region src/auth/parse-record.ts
-function parseRecord$1(kind, schema, data) {
+function parseRecord$2(kind, schema, data) {
 	try {
 		return schema.parse(data);
 	} catch (err) {
@@ -38,7 +38,7 @@ function parseRecord$1(kind, schema, data) {
 */
 var API_KEYS_COLLECTION$1 = "api_keys";
 function parseApiKey(data) {
-	return parseRecord$1("api-key", require_dist.ApiKeyRecordSchema, data);
+	return parseRecord$2("api-key", require_dist.ApiKeyRecordSchema, data);
 }
 var ApiKeyManager = class {
 	storageAccess;
@@ -160,7 +160,7 @@ function genSalt(rounds, seed_length, callback) {
 * @returns {!Promise} If `callback` has been omitted
 * @throws {Error} If `callback` is present but not a function
 */
-function hash$1(password, salt, callback, progressCallback) {
+function hash$2(password, salt, callback, progressCallback) {
 	function _async(callback) {
 		if (typeof password === "string" && typeof salt === "number") genSalt(salt, function(err, salt) {
 			_hash(password, salt, callback, progressCallback);
@@ -213,7 +213,7 @@ function compare(password, hashValue, callback, progressCallback) {
 			nextTick(callback.bind(this, null, false));
 			return;
 		}
-		hash$1(password, hashValue.substring(0, 29), function(err, comp) {
+		hash$2(password, hashValue.substring(0, 29), function(err, comp) {
 			if (err) callback(err);
 			else callback(null, safeStringCompare(comp, hashValue));
 		}, progressCallback);
@@ -6028,7 +6028,7 @@ var AuthManager = class {
 	*   slot `local-auth` fills from the keychain (D797). Never config, never
 	*   env; read on every mint and verify, and it THROWS while unavailable.
 	*/
-	constructor(config, logger = noopLogger, signingKey = require_jwt_signing_key.processJwtSigningKey) {
+	constructor(config, logger = noopLogger, signingKey = require_device_ca.processJwtSigningKey) {
 		this.config = config;
 		this.signingKey = signingKey;
 		this.logger = logger;
@@ -6087,7 +6087,7 @@ var AuthManager = class {
 		return import_jsonwebtoken.verify(token, this.jwtSecret);
 	}
 	async hashPassword(password) {
-		return hash$1(password, 10);
+		return hash$2(password, 10);
 	}
 	async comparePassword(password, hash) {
 		return compare(password, hash);
@@ -6282,7 +6282,7 @@ var AuthManager = class {
 var TOKENS_COLLECTION = "scoped_tokens";
 var TOKEN_PREFIX = "cst_";
 function parseToken(data) {
-	return parseRecord$1("scoped-token", require_dist.ScopedTokenSchema, data);
+	return parseRecord$2("scoped-token", require_dist.ScopedTokenSchema, data);
 }
 /**
 * Manages scoped API tokens with restricted addon/route/capability access.
@@ -6565,6 +6565,10 @@ var LOGIN_SESSIONS_COLUMNS = [
 	{
 		name: "ip",
 		type: "TEXT"
+	},
+	{
+		name: "credentialId",
+		type: "TEXT"
 	}
 ];
 var LOGIN_SESSION_CUTOFFS_COLUMNS = [{
@@ -6582,7 +6586,8 @@ var METHODS = [
 	"passkey",
 	"sso",
 	"handoff",
-	"exchange"
+	"exchange",
+	"device-certificate"
 ];
 var REFRESH_TOKEN_PREFIX = "csr_";
 /**
@@ -6598,20 +6603,20 @@ var MAX_CLIENT_LABEL = 200;
 function hashToken(token) {
 	return node_crypto.createHash("sha256").update(token).digest("hex");
 }
-function str(data, key) {
+function str$1(data, key) {
 	const value = data[key];
 	return typeof value === "string" && value.length > 0 ? value : null;
 }
-function num(data, key) {
+function num$1(data, key) {
 	const value = data[key];
 	return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 function parseSession$1(data) {
-	const id = str(data, "id");
-	const userId = str(data, "userId");
-	const createdAt = num(data, "createdAt");
-	const lastUsedAt = num(data, "lastUsedAt");
-	const expiresAt = num(data, "expiresAt");
+	const id = str$1(data, "id");
+	const userId = str$1(data, "userId");
+	const createdAt = num$1(data, "createdAt");
+	const lastUsedAt = num$1(data, "lastUsedAt");
+	const expiresAt = num$1(data, "expiresAt");
 	const method = METHODS.find((m) => m === data["method"]);
 	if (id === null || userId === null || createdAt === null || expiresAt === null) return null;
 	return {
@@ -6622,13 +6627,14 @@ function parseSession$1(data) {
 		createdAt,
 		lastUsedAt: lastUsedAt ?? createdAt,
 		expiresAt,
-		revokedAt: num(data, "revokedAt"),
-		revokedReason: str(data, "revokedReason"),
-		refreshHash: str(data, "refreshHash"),
-		previousRefreshHash: str(data, "previousRefreshHash"),
-		rotatedAt: num(data, "rotatedAt"),
-		client: str(data, "client"),
-		ip: str(data, "ip")
+		revokedAt: num$1(data, "revokedAt"),
+		revokedReason: str$1(data, "revokedReason"),
+		refreshHash: str$1(data, "refreshHash"),
+		previousRefreshHash: str$1(data, "previousRefreshHash"),
+		rotatedAt: num$1(data, "rotatedAt"),
+		client: str$1(data, "client"),
+		ip: str$1(data, "ip"),
+		credentialId: str$1(data, "credentialId")
 	};
 }
 function toLoginSessionSummary(record) {
@@ -6657,8 +6663,8 @@ var LoginSessionManager = class {
 		}
 		const cutoffs = await this.store.query.query({ collection: LOGIN_SESSION_CUTOFFS_COLLECTION });
 		for (const row of cutoffs) {
-			const userId = str(row.data, "userId");
-			const notBefore = num(row.data, "notBefore");
+			const userId = str$1(row.data, "userId");
+			const notBefore = num$1(row.data, "notBefore");
 			if (userId !== null && notBefore !== null) this.cutoffs.set(userId, notBefore);
 		}
 	}
@@ -6679,7 +6685,8 @@ var LoginSessionManager = class {
 			previousRefreshHash: null,
 			rotatedAt: null,
 			client: input.client === void 0 ? null : input.client.slice(0, MAX_CLIENT_LABEL),
-			ip: input.ip ?? null
+			ip: input.ip ?? null,
+			credentialId: input.credentialId ?? null
 		};
 		await this.store.insert.mutate({
 			collection: LOGIN_SESSIONS_COLLECTION,
@@ -6709,6 +6716,16 @@ var LoginSessionManager = class {
 	legacyCutoff(userId) {
 		return this.cutoffs.get(userId) ?? 0;
 	}
+	/**
+	* The session a refresh token belongs to, WITHOUT rotating it - so the
+	* refresh path can judge the session (its device credential) before it
+	* spends the token. `null` when the token names no session.
+	*/
+	peekByRefreshToken(refreshToken) {
+		if (!refreshToken.startsWith("csr_")) return null;
+		const sessionId = this.byRefreshHash.get(hashToken(refreshToken));
+		return sessionId === void 0 ? null : this.sessions.get(sessionId) ?? null;
+	}
 	/** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
 	async refresh(refreshToken, lifetimeMs) {
 		if (!refreshToken.startsWith("csr_")) return {
@@ -6812,6 +6829,23 @@ var LoginSessionManager = class {
 		for (const session of ended) await this.persist(session);
 		return ended.length;
 	}
+	/** End every live session opened by device credential `credentialId`. Returns how many. */
+	async revokeByCredential(credentialId, reason = "credential-revoked") {
+		const at = this.now();
+		const ended = [];
+		for (const session of this.sessions.values()) {
+			if (session.credentialId !== credentialId || session.revokedAt !== null) continue;
+			const updated = {
+				...session,
+				revokedAt: at,
+				revokedReason: reason
+			};
+			this.replace(session, updated);
+			ended.push(updated);
+		}
+		for (const session of ended) await this.persist(session);
+		return ended.length;
+	}
 	/** `userId`'s live sessions, newest first. */
 	listForUser(userId) {
 		return this.listActive().filter((s) => s.userId === userId);
@@ -6965,7 +6999,7 @@ var ADMIN_TOKEN_PREFIX = "csa_";
 var ADMIN_TOKEN_MAX_LIFETIME_MS = 90 * 864e5;
 var DEAD_RETENTION_MS = 30 * 864e5;
 var TOUCH_EVERY_MS = 6e4;
-function hash(token) {
+function hash$1(token) {
 	return node_crypto.createHash("sha256").update(token).digest("hex");
 }
 function parse(data) {
@@ -7005,7 +7039,7 @@ var AdminTokenManager = class {
 			id: node_crypto.randomUUID(),
 			createdBy: input.createdBy,
 			name,
-			tokenHash: hash(token),
+			tokenHash: hash$1(token),
 			tokenPrefix: token.slice(0, 12),
 			createdAt: at,
 			expiresAt: input.expiresAt,
@@ -7029,7 +7063,7 @@ var AdminTokenManager = class {
 		if (!token.startsWith("csa_")) return null;
 		const first = (await this.store.query.query({
 			collection: ADMIN_TOKENS_COLLECTION,
-			filter: { where: { tokenHash: hash(token) } }
+			filter: { where: { tokenHash: hash$1(token) } }
 		}))[0];
 		const stored = first === void 0 ? null : parse(first.data);
 		if (stored === null || stored.revokedAt !== null) return null;
@@ -7090,6 +7124,678 @@ var AdminTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/device-ca-store.ts
+function hasCertificate(value) {
+	return typeof value === "string" && value.includes("BEGIN CERTIFICATE");
+}
+var DeviceCaStore = class {
+	deps;
+	loaded = null;
+	creating = null;
+	lastReported = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** The CA when one exists (completing an interrupted creation). Never creates a NEW one. */
+	async lookup() {
+		if (this.loaded !== null) return {
+			state: "ready",
+			ca: this.loaded
+		};
+		const secrets = this.deps.secrets;
+		if (secrets === null) return {
+			state: "unavailable",
+			reason: "no keychain door in this process"
+		};
+		let entry;
+		try {
+			entry = (await secrets.resolve([require_device_ca.DEVICE_CA_KEY_REF]))[require_device_ca.DEVICE_CA_KEY_REF];
+		} catch (err) {
+			return {
+				state: "unavailable",
+				reason: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (entry === void 0) return {
+			state: "unavailable",
+			reason: "no-answer"
+		};
+		if (entry.kind === "unavailable") return {
+			state: "unavailable",
+			reason: entry.reason
+		};
+		if (entry.kind === "forbidden") return {
+			state: "unavailable",
+			reason: "forbidden"
+		};
+		let section;
+		try {
+			section = await this.deps.readSection(require_device_ca.DEVICE_CA_SETTINGS_SECTION);
+		} catch (err) {
+			return {
+				state: "unavailable",
+				reason: `settings unreadable: ${err instanceof Error ? err.message : String(err)}`
+			};
+		}
+		const certPem = section[require_device_ca.DEVICE_CA_FIELD];
+		if (entry.kind === "missing") {
+			if (!hasCertificate(certPem)) return { state: "absent" };
+			return this.report("the device CA key is missing from the keychain but cluster.deviceCa is present - not creating a new CA (it would orphan every enrolled device); restore the key (secret://system/global/deviceCaKey) or remove cluster.deviceCa knowingly");
+		}
+		try {
+			if (!hasCertificate(certPem)) {
+				const rebuilt = await require_device_ca.rebuildDeviceCaCertificate(entry.value);
+				await this.deps.writeSection(require_device_ca.DEVICE_CA_SETTINGS_SECTION, { [require_device_ca.DEVICE_CA_FIELD]: rebuilt.certPem });
+				this.deps.logger?.warn("Device CA certificate rebuilt from the stored key", { meta: { reason: "cluster.deviceCa was missing next to the key" } });
+				this.loaded = rebuilt;
+				return {
+					state: "ready",
+					ca: rebuilt
+				};
+			}
+			this.loaded = await require_device_ca.loadDeviceCa(certPem, entry.value);
+			return {
+				state: "ready",
+				ca: this.loaded
+			};
+		} catch (err) {
+			return {
+				state: "unavailable",
+				reason: err instanceof Error ? err.message : String(err)
+			};
+		}
+	}
+	/** The CA, created now if neither half exists. Throws on any inconsistent or unreadable state. */
+	async ensure() {
+		const found = await this.lookup();
+		if (found.state === "ready") return found.ca;
+		if (found.state === "unavailable") throw new Error(`device CA unavailable: ${found.reason}`);
+		if (this.creating === null) this.creating = this.create().finally(() => {
+			this.creating = null;
+		});
+		return this.creating;
+	}
+	report(reason) {
+		if (this.lastReported !== reason) {
+			this.lastReported = reason;
+			this.deps.logger?.error(`Device CA is inconsistent: ${reason}`);
+		}
+		return {
+			state: "unavailable",
+			reason
+		};
+	}
+	async create() {
+		const secrets = this.deps.secrets;
+		if (secrets === null) throw new Error("device CA unavailable: no keychain door");
+		const generated = await require_device_ca.generateDeviceCa();
+		await secrets.put(require_device_ca.DEVICE_CA_KEY_REF, generated.keyPem);
+		await this.deps.writeSection(require_device_ca.DEVICE_CA_SETTINGS_SECTION, { [require_device_ca.DEVICE_CA_FIELD]: generated.certPem });
+		this.loaded = await require_device_ca.loadDeviceCa(generated.certPem, generated.keyPem);
+		return this.loaded;
+	}
+};
+//#endregion
+//#region src/auth/device-credential-manager.ts
+/**
+* Device credentials (D855): the registry of enrolled devices, the one-shot
+* enrollment codes, the login nonces and the certificate checks.
+*
+* Hub-owned and persisted in `device_credentials` (the settings store);
+* agents persist nothing. Enrollment codes and nonces live in memory only —
+* both die in minutes and a hub restart simply asks the user to start again.
+*
+* Every refusal is logged with its reason and the credential/user it concerns
+* (`tags: { credentialId | userId }`) — never the code, the nonce or a
+* signature.
+*/
+/**
+* @durable class=config owner=local-auth
+*   write="an enrollment completes (QR or self) inserts a row; a renewal rewrites
+*     fingerprint/expiry; every accepted certificate login rewrites lastUsedAt/From;
+*     an admin revokes or renames"
+*   retention="a revoked or long-expired row is kept 90 days for the audit question
+*     'which device was that', then the daily reap deletes it; an active row is
+*     never deleted"
+*/
+var DEVICE_CREDENTIALS_COLLECTION = "device_credentials";
+var DEVICE_CREDENTIALS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "deviceName",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "platform",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "enrolledVia",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "serial",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "previousFingerprint",
+		type: "TEXT"
+	},
+	{
+		name: "renewedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "publicKey",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "issuedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "lastUsedFrom",
+		type: "TEXT"
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedBy",
+		type: "TEXT"
+	}
+];
+var MAX_PENDING = 2e3;
+/**
+* Outstanding login nonces are bounded PER CLIENT (a partition = the client
+* address): one flooder evicts only its own oldest nonces, never another
+* client's. {@link MAX_NONCES_TOTAL} is a memory ceiling that only a flood from
+* hundreds of distinct addresses can reach.
+*/
+var MAX_NONCES_PER_PARTITION = 50;
+var MAX_NONCES_TOTAL = 2e4;
+/**
+* After a renewal the PREVIOUS leaf still logs in for this long, so a device
+* that crashed between the hub's answer and its own write is not locked out;
+* after it, the old leaf is `superseded` (not definitive: the app holds the
+* newest certificate, so seeing it means the device lost the new one).
+*/
+var PREVIOUS_LEAF_GRACE_MS = 24 * 36e5;
+var REAP_RETENTION_MS = 90 * 864e5;
+function hash(value) {
+	return node_crypto.createHash("sha256").update(value).digest("hex");
+}
+function str(data, key) {
+	const v = data[key];
+	return typeof v === "string" && v.length > 0 ? v : null;
+}
+function num(data, key) {
+	const v = data[key];
+	return typeof v === "number" && Number.isFinite(v) ? v : null;
+}
+var PLATFORMS = [
+	"ios",
+	"android",
+	"web",
+	"other"
+];
+function parseRecord$1(data) {
+	const id = str(data, "id");
+	const userId = str(data, "userId");
+	const deviceName = str(data, "deviceName");
+	const fingerprint = str(data, "fingerprint");
+	const serial = str(data, "serial");
+	const publicKey = str(data, "publicKey");
+	const issuedAt = num(data, "issuedAt");
+	const expiresAt = num(data, "expiresAt");
+	if (id === null || userId === null || deviceName === null || fingerprint === null || serial === null || publicKey === null || issuedAt === null || expiresAt === null) return null;
+	return {
+		id,
+		userId,
+		deviceName,
+		platform: PLATFORMS.find((p) => p === data["platform"]) ?? "other",
+		enrolledVia: data["enrolledVia"] === "self" ? "self" : "qr",
+		fingerprint,
+		serial,
+		previousFingerprint: str(data, "previousFingerprint"),
+		renewedAt: num(data, "renewedAt"),
+		publicKey,
+		issuedAt,
+		expiresAt,
+		lastUsedAt: num(data, "lastUsedAt"),
+		lastUsedFrom: str(data, "lastUsedFrom"),
+		revokedAt: num(data, "revokedAt"),
+		revokedBy: str(data, "revokedBy")
+	};
+}
+var DeviceCredentialManager = class {
+	store;
+	deps;
+	records = /* @__PURE__ */ new Map();
+	pendingEnrollments = /* @__PURE__ */ new Map();
+	usedCodes = /* @__PURE__ */ new Map();
+	nonces = /* @__PURE__ */ new Map();
+	now;
+	constructor(store, deps) {
+		this.store = store;
+		this.deps = deps;
+		this.now = deps.now ?? Date.now;
+	}
+	async load() {
+		const rows = await this.store.query.query({ collection: DEVICE_CREDENTIALS_COLLECTION });
+		for (const row of rows) {
+			const record = parseRecord$1(row.data);
+			if (record !== null) this.records.set(record.id, record);
+		}
+	}
+	/** A one-shot code for `userId` (admin path). Returned once; only its hash is kept. */
+	startEnrollment(input) {
+		this.prune();
+		if (this.pendingEnrollments.size >= MAX_PENDING) throw new Error("Too many pending device enrollments — try again shortly");
+		const code = node_crypto.randomBytes(24).toString("base64url");
+		const expiresAt = this.now() + require_dist.DEVICE_ENROLLMENT_TTL_MS;
+		this.pendingEnrollments.set(hash(code), {
+			userId: input.userId,
+			deviceName: input.deviceName,
+			createdBy: input.createdBy,
+			expiresAt
+		});
+		return {
+			code,
+			expiresAt
+		};
+	}
+	/** Redeem a code with the device's public key (public procedure). */
+	async completeEnrollment(input) {
+		const key = hash(input.code);
+		const pending = this.pendingEnrollments.get(key);
+		if (pending === void 0) {
+			const wasUsed = this.usedCodes.has(key);
+			return this.refuse("enroll", "unknown-or-used-code", { detail: wasUsed ? "code already redeemed" : "code unknown" });
+		}
+		this.pendingEnrollments.delete(key);
+		this.usedCodes.set(key, pending.expiresAt);
+		if (this.now() > pending.expiresAt) return this.refuse("enroll", "expired-code", { userId: pending.userId });
+		return this.issueNew({
+			userId: pending.userId,
+			deviceName: input.deviceName ?? pending.deviceName,
+			platform: input.platform,
+			publicKeySpki: input.publicKeySpki,
+			enrolledVia: "qr"
+		});
+	}
+	/** A signed-in user's own device (the caller has already proved a step-up). */
+	async enrollSelf(input) {
+		if (!await this.deps.selfEnrollmentAllowed()) return this.refuse("enroll-self", "self-enrollment-disabled", { userId: input.userId });
+		return this.issueNew({
+			...input,
+			enrolledVia: "self"
+		});
+	}
+	async issueNew(input) {
+		const user = await this.deps.findUser(input.userId);
+		if (user === null) return this.refuse("enroll", "user-gone", { userId: input.userId });
+		const spki = Buffer.from(input.publicKeySpki, "base64url");
+		try {
+			await require_device_ca.importDevicePublicKey(spki);
+		} catch {
+			return this.refuse("enroll", "bad-public-key", { userId: input.userId });
+		}
+		let ca;
+		try {
+			ca = await this.deps.ca.ensure();
+		} catch (error) {
+			this.deps.logger?.error("Device enrollment refused: the device CA is unavailable", {
+				tags: { userId: input.userId },
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+			return {
+				ok: false,
+				reason: "ca-unavailable"
+			};
+		}
+		const id = node_crypto.randomUUID();
+		const leaf = await require_device_ca.issueDeviceLeaf(ca, {
+			credentialId: id,
+			userId: input.userId,
+			publicKeySpki: spki,
+			now: new Date(this.now())
+		});
+		const record = {
+			id,
+			userId: input.userId,
+			deviceName: input.deviceName,
+			platform: input.platform,
+			enrolledVia: input.enrolledVia,
+			fingerprint: leaf.fingerprint,
+			serial: leaf.serialNumber,
+			previousFingerprint: null,
+			renewedAt: null,
+			publicKey: input.publicKeySpki,
+			issuedAt: leaf.notBefore.getTime(),
+			expiresAt: leaf.notAfter.getTime(),
+			lastUsedAt: null,
+			lastUsedFrom: null,
+			revokedAt: null,
+			revokedBy: null
+		};
+		await this.store.insert.mutate({
+			collection: DEVICE_CREDENTIALS_COLLECTION,
+			record: {
+				id,
+				data: { ...record }
+			}
+		});
+		this.records.set(id, record);
+		this.deps.logger?.info("Device credential enrolled", {
+			tags: {
+				credentialId: id,
+				userId: input.userId
+			},
+			meta: {
+				via: input.enrolledVia,
+				platform: input.platform
+			}
+		});
+		return this.issued(record, leaf, ca, user.username);
+	}
+	issued(record, leaf, ca, username) {
+		return {
+			ok: true,
+			credentialId: record.id,
+			userId: record.userId,
+			username,
+			certPem: leaf.certPem,
+			chainPem: ca.certPem,
+			notAfter: leaf.notAfter.getTime()
+		};
+	}
+	/** A single-use nonce bound to `origin`. */
+	issueNonce(origin, partition = "unknown") {
+		this.prune();
+		const own = [...this.nonces.entries()].filter(([, v]) => v.partition === partition);
+		for (const [key] of own.slice(0, Math.max(0, own.length - MAX_NONCES_PER_PARTITION + 1))) this.nonces.delete(key);
+		if (this.nonces.size >= MAX_NONCES_TOTAL) {
+			const oldest = this.nonces.keys().next();
+			if (oldest.done !== true) this.nonces.delete(oldest.value);
+		}
+		const nonce = node_crypto.randomBytes(32).toString("base64url");
+		const expiresAt = this.now() + require_dist.DEVICE_NONCE_TTL_MS;
+		this.nonces.set(nonce, {
+			origin,
+			expiresAt,
+			partition
+		});
+		return {
+			nonce,
+			expiresAt
+		};
+	}
+	/**
+	* Check a presented certificate + signature. Consumes the nonce on the first
+	* attempt. On success the credential's lastUsed is stamped.
+	*/
+	async authenticate(input) {
+		const bound = this.nonces.get(input.nonce);
+		if (bound === void 0) return this.refuse(input.purpose, "unknown-nonce", {});
+		this.nonces.delete(input.nonce);
+		if (this.now() > bound.expiresAt) return this.refuse(input.purpose, "expired-nonce", {});
+		const caState = await this.deps.ca.lookup();
+		if (caState.state !== "ready") return this.refuse(input.purpose, "no-device-ca", {});
+		const verdict = await require_device_ca.verifyDeviceLeaf(caState.ca.certPem, input.certPem, new Date(this.now()));
+		if (!verdict.ok) return this.refuse(input.purpose, verdict.reason, {});
+		const message = require_dist.buildDeviceSignatureMessage({
+			purpose: input.purpose,
+			origin: bound.origin,
+			nonce: input.nonce
+		});
+		if (!require_device_ca.verifyDeviceSignature(verdict.publicKeySpki, message, input.signature)) return this.refuse(input.purpose, "bad-signature", { credentialId: verdict.credentialId });
+		const record = this.records.get(verdict.credentialId);
+		if (record === void 0) return this.refuse(input.purpose, "unknown-credential", { credentialId: verdict.credentialId });
+		const tags = {
+			credentialId: record.id,
+			userId: record.userId
+		};
+		if (record.revokedAt !== null) return this.refuse(input.purpose, "revoked", tags);
+		if (verdict.userId !== null && verdict.userId !== record.userId) return this.refuse(input.purpose, "user-mismatch", tags);
+		if (!verdict.publicKeySpki.equals(Buffer.from(record.publicKey, "base64url"))) return this.refuse(input.purpose, "key-mismatch", tags);
+		if (verdict.fingerprint !== record.fingerprint) {
+			if (!(record.previousFingerprint !== null && verdict.fingerprint === record.previousFingerprint && record.renewedAt !== null && this.now() - record.renewedAt <= 864e5)) return this.refuse(input.purpose, "superseded", tags);
+		}
+		const used = {
+			...record,
+			lastUsedAt: this.now(),
+			lastUsedFrom: input.from ?? record.lastUsedFrom
+		};
+		await this.save(used);
+		return {
+			ok: true,
+			credential: used
+		};
+	}
+	/** A new leaf for the SAME public key, after {@link authenticate} accepted a `renew` proof. */
+	async renew(credential) {
+		const current = this.records.get(credential.id);
+		if (current === void 0) return this.refuse("renew", "unknown-credential", {});
+		if (current.revokedAt !== null) return this.refuse("renew", "revoked", {
+			credentialId: current.id,
+			userId: current.userId
+		});
+		let ca;
+		try {
+			ca = await this.deps.ca.ensure();
+		} catch {
+			return {
+				ok: false,
+				reason: "ca-unavailable"
+			};
+		}
+		const leaf = await require_device_ca.issueDeviceLeaf(ca, {
+			credentialId: current.id,
+			userId: current.userId,
+			publicKeySpki: Buffer.from(current.publicKey, "base64url"),
+			now: new Date(this.now())
+		});
+		const updated = {
+			...current,
+			fingerprint: leaf.fingerprint,
+			serial: leaf.serialNumber,
+			previousFingerprint: current.fingerprint,
+			renewedAt: this.now(),
+			issuedAt: leaf.notBefore.getTime(),
+			expiresAt: leaf.notAfter.getTime()
+		};
+		await this.save(updated);
+		this.deps.logger?.info("Device certificate renewed", { tags: {
+			credentialId: updated.id,
+			userId: updated.userId
+		} });
+		return {
+			ok: true,
+			credentialId: updated.id,
+			userId: updated.userId,
+			certPem: leaf.certPem,
+			chainPem: ca.certPem,
+			notAfter: leaf.notAfter.getTime()
+		};
+	}
+	/** Synchronous: the hub asks on every refresh of a credential-bound session. */
+	check(credentialId) {
+		const record = this.records.get(credentialId);
+		if (record === void 0) return "unknown";
+		if (record.revokedAt !== null) return "revoked";
+		return record.expiresAt <= this.now() ? "expired" : "active";
+	}
+	get(credentialId) {
+		return this.records.get(credentialId);
+	}
+	list(input) {
+		return [...this.records.values()].filter((r) => input.userId === void 0 || r.userId === input.userId).filter((r) => input.includeRevoked || r.revokedAt === null).toSorted((a, b) => b.issuedAt - a.issuedAt);
+	}
+	/**
+	* Delete a REVOKED row (admin clean-up). `live` refuses a credential that is
+	* not revoked — a live credential is revoked first, so a delete can never be
+	* the way a device silently stops working.
+	*/
+	async delete(credentialId) {
+		const record = this.records.get(credentialId);
+		if (record === void 0) return "unknown";
+		if (record.revokedAt === null) {
+			this.deps.logger?.warn("Device credential delete refused: still live", { tags: {
+				credentialId,
+				userId: record.userId
+			} });
+			return "live";
+		}
+		this.records.delete(credentialId);
+		await this.store.delete.mutate({
+			collection: DEVICE_CREDENTIALS_COLLECTION,
+			key: credentialId
+		});
+		this.deps.logger?.info("Device credential row deleted", { tags: {
+			credentialId,
+			userId: record.userId
+		} });
+		return "deleted";
+	}
+	/** Revoke; `false` when unknown or already revoked. `revokedBy`: see `formatDeviceRevoker`. */
+	async revoke(credentialId, revokedBy) {
+		const record = this.records.get(credentialId);
+		if (record === void 0 || record.revokedAt !== null) return false;
+		await this.save({
+			...record,
+			revokedAt: this.now(),
+			revokedBy
+		});
+		this.deps.logger?.warn("Device credential revoked", {
+			tags: {
+				credentialId,
+				userId: record.userId
+			},
+			meta: { revokedBy }
+		});
+		return true;
+	}
+	async rename(credentialId, deviceName) {
+		const record = this.records.get(credentialId);
+		if (record === void 0) return false;
+		await this.save({
+			...record,
+			deviceName
+		});
+		return true;
+	}
+	/** Revoke every credential of a user (account deleted). Returns their ids. */
+	async revokeAllForUser(userId, revokedBy) {
+		const ids = [...this.records.values()].filter((r) => r.userId === userId && r.revokedAt === null).map((r) => r.id);
+		for (const id of ids) await this.revoke(id, revokedBy);
+		return ids;
+	}
+	toSummary(record, username) {
+		return {
+			id: record.id,
+			userId: record.userId,
+			username,
+			deviceName: record.deviceName,
+			platform: record.platform,
+			enrolledVia: record.enrolledVia,
+			fingerprint: record.fingerprint,
+			issuedAt: record.issuedAt,
+			expiresAt: record.expiresAt,
+			lastUsedAt: record.lastUsedAt,
+			lastUsedFrom: record.lastUsedFrom,
+			revokedAt: record.revokedAt,
+			revokedBy: record.revokedBy,
+			status: record.revokedAt !== null ? "revoked" : record.expiresAt <= this.now() ? "expired" : "active"
+		};
+	}
+	/** Delete rows revoked or expired more than 90 days ago. */
+	async reap() {
+		const cutoff = this.now() - REAP_RETENTION_MS;
+		const dead = [...this.records.values()].filter((r) => (r.revokedAt ?? r.expiresAt) < cutoff);
+		for (const r of dead) {
+			this.records.delete(r.id);
+			await this.store.delete.mutate({
+				collection: DEVICE_CREDENTIALS_COLLECTION,
+				key: r.id
+			});
+		}
+		return dead.length;
+	}
+	async save(record) {
+		this.records.set(record.id, record);
+		try {
+			await this.store.update.mutate({
+				collection: DEVICE_CREDENTIALS_COLLECTION,
+				id: record.id,
+				data: { ...record }
+			});
+		} catch (error) {
+			this.deps.logger?.error("Device credential write failed — the change holds until restart", {
+				tags: {
+					credentialId: record.id,
+					userId: record.userId
+				},
+				meta: { error: error instanceof Error ? error.message : String(error) }
+			});
+		}
+	}
+	refuse(leg, reason, context) {
+		this.deps.logger?.warn(`Device credential ${leg} refused: ${reason}`, {
+			tags: {
+				...context.credentialId !== void 0 ? { credentialId: context.credentialId } : {},
+				...context.userId !== void 0 ? { userId: context.userId } : {}
+			},
+			meta: {
+				leg,
+				reason,
+				...context.detail !== void 0 ? { detail: context.detail } : {}
+			}
+		});
+		return {
+			ok: false,
+			reason
+		};
+	}
+	prune() {
+		const at = this.now();
+		for (const [k, v] of this.pendingEnrollments) if (at > v.expiresAt) this.pendingEnrollments.delete(k);
+		for (const [k, exp] of this.usedCodes) if (at > exp + 6e5) this.usedCodes.delete(k);
+		for (const [k, v] of this.nonces) if (at > v.expiresAt) this.nonces.delete(k);
+	}
+};
+//#endregion
 //#region src/auth/auth-audit-log.ts
 /**
 * The authentication audit trail: what an operator must be able to answer
@@ -7144,7 +7850,11 @@ var AUTH_AUDIT_ACTIONS = [
 	"admin-token-revoked",
 	"credentials-revoked",
 	"agent-addon-update",
-	"agent-addon-update-refused"
+	"agent-addon-update-refused",
+	"device-credential-enrolled",
+	"device-credential-revoked",
+	"device-credential-login",
+	"device-credential-login-refused"
 ];
 var RETENTION_MS = 90 * 864e5;
 var MAX_LIST = 500;
@@ -7270,7 +7980,7 @@ var USERS_COLLECTION$1 = "users";
 var FIRST_BOOT_ADMIN_USERNAME = "admin";
 var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 function parseUser(data) {
-	return parseRecord$1("user", require_dist.UserRecordSchema, data);
+	return parseRecord$2("user", require_dist.UserRecordSchema, data);
 }
 var UserManager = class {
 	storageAccess;
@@ -7441,7 +8151,7 @@ var JwtSigningKeyKeeper = class {
 			return;
 		}
 		this.unsubscribe = secrets.onChange((ref) => {
-			if (ref === require_jwt_signing_key.JWT_SIGNING_KEY_REF) this.load(secrets);
+			if (ref === require_device_ca.JWT_SIGNING_KEY_REF) this.load(secrets);
 		});
 		await this.load(secrets);
 	}
@@ -7454,23 +8164,23 @@ var JwtSigningKeyKeeper = class {
 	}
 	async load(secrets) {
 		if (this.stopped) return;
-		const next = await require_jwt_signing_key.loadJwtSigningKey({ secrets });
+		const next = await require_device_ca.loadJwtSigningKey({ secrets });
 		if (this.stopped) return;
 		this.apply(next);
-		if (next.state === "unavailable" && require_jwt_signing_key.getProcessJwtSigningKeyState().state !== "ready") this.scheduleRetry(secrets);
+		if (next.state === "unavailable" && require_device_ca.getProcessJwtSigningKeyState().state !== "ready") this.scheduleRetry(secrets);
 	}
 	apply(next) {
-		const previous = require_jwt_signing_key.getProcessJwtSigningKeyState();
+		const previous = require_device_ca.getProcessJwtSigningKeyState();
 		if (next.state === "ready") {
 			if (previous.state !== "ready") this.deps.logger.info("Session signing key loaded from the keychain");
-			require_jwt_signing_key.setProcessJwtSigningKey(next);
+			require_device_ca.setProcessJwtSigningKey(next);
 			return;
 		}
 		if (previous.state === "ready") return;
-		require_jwt_signing_key.setProcessJwtSigningKey(next);
+		require_device_ca.setProcessJwtSigningKey(next);
 		this.deps.logger.error("Sessions are UNAVAILABLE: the session signing key cannot be read from the keychain. No one can sign in and no session token verifies until the keychain unlocks (System → Secrets; or fix keychain.keyFile in config.yaml and restart). No fallback key is used.", { meta: {
 			reason: next.reason,
-			ref: require_jwt_signing_key.JWT_SIGNING_KEY_REF
+			ref: require_device_ca.JWT_SIGNING_KEY_REF
 		} });
 	}
 	scheduleRetry(secrets) {
@@ -7864,6 +8574,14 @@ async function declareAuthSchema(store) {
 			columns: ["createdBy"]
 		}]
 	});
+	await store.declareCollection.mutate({
+		collection: DEVICE_CREDENTIALS_COLLECTION,
+		columns: DEVICE_CREDENTIALS_COLUMNS,
+		indexes: [{
+			name: "idx_device_credentials_user_id",
+			columns: ["userId"]
+		}]
+	});
 	await store.declareCollection.mutate({
 		collection: AUTH_AUDIT_COLLECTION,
 		columns: AUTH_AUDIT_COLUMNS,
@@ -10761,6 +11479,8 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 	loginSessions = null;
 	adminTokens = null;
 	auditLog = null;
+	deviceCredentials = null;
+	deviceCa = null;
 	constructor() {
 		super({});
 	}
@@ -10790,6 +11510,25 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			await this.loginSessions.load();
 			this.adminTokens = new AdminTokenManager(store);
 			this.auditLog = new AuthAuditLog(store, this.ctx.logger);
+			const deviceUsers = this.userManager;
+			this.deviceCa = new DeviceCaStore({
+				secrets: forOwner === null ? null : forOwner("system"),
+				readSection: async (section) => await this.ctx.settings?.getSection(section) ?? {},
+				writeSection: async (section, patch) => {
+					await this.ctx.settings?.setSection(section, patch);
+				},
+				logger: this.ctx.logger
+			});
+			this.deviceCredentials = new DeviceCredentialManager(store, {
+				ca: this.deviceCa,
+				findUser: async (userId) => {
+					const user = await deviceUsers.findById(userId);
+					return user === null ? null : { username: user.username };
+				},
+				selfEnrollmentAllowed: async () => (await this.readDeviceCertificateSettings()).selfEnrollment === "allowed",
+				logger: this.ctx.logger
+			});
+			await this.deviceCredentials.load();
 			try {
 				await reconcileAdminAccountAtBoot({
 					users: this.userManager,
@@ -10889,6 +11628,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				if (!this.userManager) throw new Error("User management not available");
 				await this.userManager.resetPassword(input.id, input.newPassword);
 				await this.loginSessions?.revokeAllForUser(input.id, { reason: "password-reset" });
+				await this.revokeDeviceCredentialsForReset(input.id);
 				return { success: true };
 			},
 			setUserScopes: async (input) => {
@@ -11013,13 +11753,154 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 		};
 		this.ctx.logger.info("registered auth-provider + user-management capabilities");
 		attachUserManagementInternal(userMgmt, this.buildInternal());
-		return [{
-			capability: require_dist.authProviderCapability,
-			provider: authProvider
-		}, {
-			capability: require_dist.userManagementCapability,
-			provider: userMgmt
-		}];
+		return [
+			{
+				capability: require_dist.authProviderCapability,
+				provider: authProvider
+			},
+			{
+				capability: require_dist.userManagementCapability,
+				provider: userMgmt
+			},
+			{
+				capability: require_dist.deviceCredentialsCapability,
+				provider: this.buildDeviceCredentialsProvider()
+			}
+		];
+	}
+	async readDeviceCertificateSettings() {
+		return { selfEnrollment: (await this.ctx.settings?.getSection("deviceCertificates") ?? {})["selfEnrollment"] === "disabled" ? "disabled" : "allowed" };
+	}
+	async revokeDeviceCredentialsForReset(userId, by = "password-reset") {
+		const ids = await this.deviceCredentials?.revokeAllForUser(userId, by) ?? [];
+		for (const id of ids) {
+			const ended = await this.loginSessions?.revokeByCredential(id) ?? 0;
+			await this.auditLog?.record({
+				action: "device-credential-revoked",
+				userId,
+				detail: {
+					credentialId: id,
+					by,
+					sessionsEnded: ended
+				}
+			});
+		}
+	}
+	/** The admin cap (`device-credentials`): list, enroll-by-QR, revoke, rename, settings. */
+	buildDeviceCredentialsProvider() {
+		const manager = () => {
+			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			return this.deviceCredentials;
+		};
+		const hubOrigins = async () => {
+			try {
+				const book = await this.ctx.api?.localNetwork?.getAddresses?.query({});
+				if (!book) return [];
+				const ordered = [book.roles.publicEndpoint.resolved, ...book.roles.appConnections.resolved];
+				return [...new Set(ordered.filter((o) => typeof o === "string"))].filter((o) => !/^https?:\/\/(127\.|localhost|\[::1\])/i.test(o));
+			} catch (err) {
+				this.ctx.logger.warn("Enrollment link: the hub address could not be resolved", { meta: { error: err instanceof Error ? err.message : String(err) } });
+				return [];
+			}
+		};
+		return {
+			listDeviceCredentials: async (input) => {
+				const users = new Map((await this.userManager?.listAll() ?? []).map((u) => [u.id, u.username]));
+				return manager().list({
+					...input.userId !== void 0 ? { userId: input.userId } : {},
+					includeRevoked: input.includeRevoked
+				}).map((r) => manager().toSummary(r, users.get(r.userId) ?? null));
+			},
+			startEnrollment: async (input) => {
+				if (await this.userManager?.findById(input.userId) == null) throw new Error(`User not found: ${input.userId}`);
+				const started = manager().startEnrollment({
+					userId: input.userId,
+					deviceName: input.deviceName,
+					createdBy: input.caller.userId
+				});
+				const origins = await hubOrigins();
+				const hub = origins[0];
+				await this.auditLog?.record({
+					action: "device-credential-enrolled",
+					userId: input.userId,
+					detail: {
+						stage: "code-issued",
+						by: input.caller.userId
+					}
+				});
+				return {
+					code: started.code,
+					expiresAt: started.expiresAt,
+					enrollUrl: require_dist.buildDeviceEnrollmentLink({
+						...hub !== void 0 ? { hub } : {},
+						code: started.code
+					}),
+					hubOrigin: hub ?? null,
+					hubOrigins: [...origins]
+				};
+			},
+			revokeDeviceCredential: async (input) => {
+				const record = manager().get(input.id);
+				if (record === void 0) throw new Error(`Device credential not found: ${input.id}`);
+				const revoked = await manager().revoke(input.id, require_dist.formatDeviceRevoker({
+					kind: "admin",
+					userId: input.caller.userId
+				}));
+				const sessionsEnded = await this.loginSessions?.revokeByCredential(input.id) ?? 0;
+				if (revoked) await this.auditLog?.record({
+					action: "device-credential-revoked",
+					userId: record.userId,
+					detail: {
+						credentialId: input.id,
+						by: input.caller.userId,
+						sessionsEnded
+					}
+				});
+				return {
+					revoked,
+					sessionsEnded,
+					status: "revoked"
+				};
+			},
+			deleteDeviceCredential: async (input) => {
+				const record = manager().get(input.id);
+				const result = await manager().delete(input.id);
+				if (result === "deleted" && record !== void 0) await this.auditLog?.record({
+					action: "device-credential-revoked",
+					userId: record.userId,
+					detail: {
+						credentialId: input.id,
+						stage: "row-deleted",
+						by: input.caller.userId
+					}
+				});
+				return { result };
+			},
+			renameDeviceCredential: async (input) => ({ renamed: await manager().rename(input.id, input.deviceName) }),
+			getDeviceCaStatus: async () => {
+				if (this.deviceCa === null) return {
+					state: "unavailable",
+					reason: "not initialised"
+				};
+				const found = await this.deviceCa.lookup();
+				if (found.state !== "ready") return found.state === "absent" ? { state: "absent" } : {
+					state: "unavailable",
+					reason: found.reason
+				};
+				const x509 = new node_crypto.X509Certificate(found.ca.certPem);
+				return {
+					state: "ready",
+					subject: x509.subject,
+					fingerprintSha256: x509.fingerprint256,
+					validTo: x509.validTo
+				};
+			},
+			getDeviceCertificateSettings: async () => this.readDeviceCertificateSettings(),
+			setDeviceCertificateSettings: async (input) => {
+				await this.ctx.settings?.setSection("deviceCertificates", { selfEnrollment: input.selfEnrollment });
+				return this.readDeviceCertificateSettings();
+			}
+		};
 	}
 	/**
 	* The hub-internal surface (`user-management-internal.ts`): operations no
@@ -11030,6 +11911,10 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			if (this.loginSessions === null) throw new Error("Login sessions not available");
 			return this.loginSessions;
 		};
+		const devices = () => {
+			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			return this.deviceCredentials;
+		};
 		return {
 			sessions: {
 				create: (input) => sessions().create(input),
@@ -11040,7 +11925,20 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				revoke: (id, reason) => sessions().revoke(id, reason),
 				revokeAllForUser: (userId, options) => sessions().revokeAllForUser(userId, options),
 				listForUser: (userId) => sessions().listForUser(userId),
-				listActive: () => sessions().listActive()
+				listActive: () => sessions().listActive(),
+				revokeByCredential: (credentialId, reason) => sessions().revokeByCredential(credentialId, reason),
+				peekByRefreshToken: (token) => sessions().peekByRefreshToken(token)
+			},
+			deviceCredentials: {
+				completeEnrollment: (input) => devices().completeEnrollment(input),
+				enrollSelf: (input) => devices().enrollSelf(input),
+				issueNonce: (origin) => devices().issueNonce(origin),
+				authenticate: (input) => devices().authenticate(input),
+				renew: (credential) => devices().renew(credential),
+				check: (id) => devices().check(id),
+				get: (id) => devices().get(id),
+				revoke: (id, by) => devices().revoke(id, by),
+				list: (input) => devices().list(input)
 			},
 			adminTokens: {
 				create: async (input) => {
@@ -11078,6 +11976,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 					...input.keepSessionId !== void 0 ? { exceptSessionId: input.keepSessionId } : {},
 					reason: "password-changed"
 				});
+				await this.revokeDeviceCredentialsForReset(input.userId, "password-changed");
 			},
 			linkExternalIdentity: async (input) => {
 				if (!this.externalIdentities || !this.userManager) throw new Error("External sign-in linking not available");
@@ -11104,6 +12003,9 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				for (const session of await this.oauthSessionManager?.list() ?? []) if (session.userId === userId && session.revokedAt === null) await this.oauthSessionManager?.markRevoked(session.id);
 			}],
 			["admin tokens", async () => this.adminTokens?.revokeAllCreatedBy(userId)],
+			["device credentials", async () => {
+				for (const id of await this.deviceCredentials?.revokeAllForUser(userId, "user-deleted") ?? []) await this.loginSessions?.revokeByCredential(id);
+			}],
 			["totp", async () => this.totpManager?.disable(userId)],
 			["sign-in links", async () => this.externalIdentities?.removeAllForUser(userId)]
 		];
@@ -11133,6 +12035,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			const logins = await this.loginSessions?.reap() ?? 0;
 			await this.adminTokens?.reap();
 			await this.auditLog?.reap();
+			await this.deviceCredentials?.reap();
 			if (tokens > 0 || sessions > 0 || logins > 0) this.ctx.logger.info("auth retention swept", { meta: {
 				expiredTokens: tokens,
 				revokedSessions: sessions,
@@ -11158,6 +12061,8 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 		this.loginSessions = null;
 		this.adminTokens = null;
 		this.auditLog = null;
+		this.deviceCredentials = null;
+		this.deviceCa = null;
 	}
 };
 //#endregion
@@ -11167,11 +12072,14 @@ exports.AdminTokenManager = AdminTokenManager;
 exports.ApiKeyManager = ApiKeyManager;
 exports.AuthAuditLog = AuthAuditLog;
 exports.AuthManager = AuthManager;
+exports.DeviceCaStore = DeviceCaStore;
+exports.DeviceCredentialManager = DeviceCredentialManager;
 exports.FIRST_BOOT_ADMIN_PASSWORD = FIRST_BOOT_ADMIN_PASSWORD;
 exports.FIRST_BOOT_ADMIN_USERNAME = FIRST_BOOT_ADMIN_USERNAME;
 exports.LocalAuthAddon = LocalAuthAddon;
 exports.default = LocalAuthAddon;
 exports.LoginSessionManager = LoginSessionManager;
+exports.PREVIOUS_LEAF_GRACE_MS = PREVIOUS_LEAF_GRACE_MS;
 exports.REFRESH_TOKEN_PREFIX = REFRESH_TOKEN_PREFIX;
 exports.ScopedTokenManager = ScopedTokenManager;
 exports.SettingsReadUnavailableError = SettingsReadUnavailableError;