@camstack/system 1.2.435 → 1.2.437

package/dist/{agent-https-B8lKYVtU.mjs → agent-https-BPfHrI4c.mjs}

@@ -3,7 +3,7 @@ import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto }
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
 import { join } from "node:path";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 //#region src/tls/agent-https-names.ts
 /**
@@ -189,8 +189,8 @@ function evaluateExistingCert(input) {
 /** The real machine. The only place in `tls/` that touches `os`. */
 function systemHostFacts() {
 	return {
-		hostname: os.hostname(),
-		networkInterfaces: os.networkInterfaces()
+		hostname: os$1.hostname(),
+		networkInterfaces: os$1.networkInterfaces()
 	};
 }
 /**

package/dist/auth/login-session-manager.d.ts

@@ -121,6 +121,8 @@ export declare class LoginSessionManager {
 	listActive(): readonly LoginSessionSummary[];
 	/** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
 	reap(): Promise<number>;
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	private announce;
 	private newRefreshToken;
 	private remember;
 	private forget;

package/dist/auth/session-revocation-bus.d.ts

@@ -0,0 +1,32 @@
+/**
+* "These login sessions just ended" — the one announcement every revoke path
+* of the login-session table makes, so the hub can end what those sessions
+* still HOLD (open WebSockets, live media). A revoked `sid` is refused on the
+* next call; without this the socket stays open and the client keeps polling
+* as an anonymous principal.
+*
+* Process-global (`Symbol.for`), like the hub-internal user-management surface:
+* the table lives in `local-auth` and the listener in the hub, and neither may
+* import the other. Listeners are synchronous; one that throws never reaches
+* the revoke (reported to `onListenerError`).
+*/
+import type { LoginSessionRevocation } from "./login-session-manager.js";
+export interface SessionsRevokedEvent {
+	/** The sessions that ended just now (never one that was already ended). */
+	readonly sessionIds: readonly string[];
+	/** The user they belong to, when the revoke named one. */
+	readonly userId: string | null;
+	/**
+	* The revoke was "everything of this user" (logout everywhere, password
+	* change or reset, deletion): a connection of `userId` that carries NO
+	* session id (a pre-session token) ends too, except `exceptSessionId`.
+	*/
+	readonly allOfUser: boolean;
+	readonly exceptSessionId: string | null;
+	readonly reason: LoginSessionRevocation;
+}
+export type SessionsRevokedListener = (event: SessionsRevokedEvent) => void;
+/** Subscribe; returns the unsubscribe. */
+export declare function onSessionsRevoked(listener: SessionsRevokedListener): () => void;
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+export declare function announceSessionsRevoked(event: SessionsRevokedEvent, onListenerError?: (error: unknown) => void): void;

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Q as addonPagesCapability, br as errMsg, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { $ as addonPagesCapability, Cr as BaseAddon, Sr as errMsg, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { br as errMsg, et as addonWidgetsCapability, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, Sr as errMsg, pi as EventCategory, tt as addonWidgetsCapability } from "../../dist-m5JkT8UN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Lr as createEvent, br as errMsg, i as AlertSchema, pi as EventCategory, tt as alertsCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, Sr as errMsg, i as AlertSchema, nt as alertsCapability, pi as EventCategory, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Dn as ptzAutotrackCapability, Kr as isEvent, br as errMsg, it as bareAddonId, k as FIRST_LEVEL_MACRO_CLASSES, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, Jr as isEvent, On as ptzAutotrackCapability, Sr as errMsg, at as bareAddonId, k as FIRST_LEVEL_MACRO_CLASSES, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
-const require_restore_archive = require("../../restore-archive-BNoFLAg8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_restore_archive = require("../../restore-archive-C75srVbG.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { Qr as nodePin, pi as EventCategory, pn as mayWriteToLocation, qn as storageOccupancyCapability, rt as backupCapability, ui as toNodeId, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
-import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-DJYuznWP.mjs";
+import { $r as nodePin, Cr as BaseAddon, Yn as storageOccupancyCapability, it as backupCapability, mn as mayWriteToLocation, pi as EventCategory, ui as toNodeId } from "../../dist-m5JkT8UN.mjs";
+import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-DNxAStrJ.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { h as CalendarPreferencesSchema, ut as calendarsCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, dt as calendarsCapability, h as CalendarPreferencesSchema } from "../../dist-m5JkT8UN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { D as DeclaredDevices, Lr as createEvent, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Tt as declarationOwnerNodeId, Wn as snapshotCapability, Wr as hydrateSchema, Yn as streamCatalogCapability, _n as motionCapability, _r as DeviceFeature, br as errMsg, dt as cameraGridLayoutCapability, mn as memoizePinnedFfmpeg, o as BaseDevice, or as buildFfmpegArgs, pi as EventCategory, xr as BaseAddon, yr as DeviceType, z as MOTION_CLOSE_AFTER_MS } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, D as DeclaredDevices, Et as declarationOwnerNodeId, Kn as snapshotCapability, Kr as hydrateSchema, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Sr as errMsg, Zn as streamCatalogCapability, cr as buildFfmpegArgs, ft as cameraGridLayoutCapability, hn as memoizePinnedFfmpeg, o as BaseDevice, pi as EventCategory, vn as motionCapability, xr as DeviceType, yr as DeviceFeature, z as MOTION_CLOSE_AFTER_MS, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
-const require_composition_sources = require("../../composition-sources-Cm42mgbv.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_composition_sources = require("../../composition-sources-BIT8IUKm.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { D as DeclaredDevices, Lr as createEvent, Rt as evaluateCompositionField, Vt as expressionContainsBuiltinCall, ar as COMPOSER_ADDON_ID, br as errMsg, cr as composedDeviceRef, d as COMPOSED_ITEM_FIXED_FIELDS, dr as compositionItemFieldPath, fr as compositionSliceKey, gr as toExpressionValue, hr as disarmRoseMemory, ht as compositionFieldKey, lr as composedDeviceStableId, mr as createStatefulExpressionMemory, mt as composerCapability, o as BaseDevice, ot as buildCapabilityLookup, pi as EventCategory, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, sr as cloneStatefulExpressionMemory, ur as compositionFeatureEnabled, wn as planComposition, xr as BaseAddon, yr as DeviceType } from "../../dist-Bz4_y8Xy.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-_7W2Ly9s.mjs";
+import { Cr as BaseAddon, D as DeclaredDevices, Ht as expressionContainsBuiltinCall, Sr as errMsg, Tn as planComposition, _r as disarmRoseMemory, d as COMPOSED_ITEM_FIXED_FIELDS, dr as composedDeviceStableId, fr as compositionFeatureEnabled, gr as createStatefulExpressionMemory, gt as compositionFieldKey, hr as compositionSourceKey, ht as composerCapability, lr as cloneStatefulExpressionMemory, mr as compositionSliceKey, o as BaseDevice, pi as EventCategory, pr as compositionItemFieldPath, r as ALL_CAPABILITY_DEFINITIONS, sr as COMPOSER_ADDON_ID, st as buildCapabilityLookup, ur as composedDeviceRef, vr as toExpressionValue, xr as DeviceType, zr as createEvent, zt as evaluateCompositionField } from "../../dist-m5JkT8UN.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-tpYR0f1x.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
-const require_composition_sources = require("../../composition-sources-Cm42mgbv.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_composition_sources = require("../../composition-sources-BIT8IUKm.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,11 +1,11 @@
-import { $n as validateComposition, D as DeclaredDevices, Mn as resolveCoreBlockEntry, Nn as resolveCoreBlockFiles, Wr as hydrateSchema, _t as coreBlockAddonId, br as errMsg, bt as coreBlockSourceKind, cr as composedDeviceRef, f as COMPOSER_RUNNER_ID, g as CoreBlockSchema, gt as compositionSourceRefs, kn as replacedFieldKeys, kt as describeComposableCaps, m as CORE_BLOCK_ADDON_PREFIX, ot as buildCapabilityLookup, p as CORE_BLOCKS_ADDON_ID, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, vn as normalizeCoreBlockWrite, vt as coreBlockComposition, wn as planComposition, xr as BaseAddon, xt as coreBlocksCapability, yt as coreBlockIdFromAddonId } from "../../dist-Bz4_y8Xy.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-_7W2Ly9s.mjs";
+import { An as replacedFieldKeys, At as describeComposableCaps, Cr as BaseAddon, D as DeclaredDevices, Kr as hydrateSchema, Nn as resolveCoreBlockEntry, Pn as resolveCoreBlockFiles, Sr as errMsg, St as coreBlocksCapability, Tn as planComposition, _t as compositionSourceRefs, bt as coreBlockIdFromAddonId, f as COMPOSER_RUNNER_ID, g as CoreBlockSchema, hr as compositionSourceKey, m as CORE_BLOCK_ADDON_PREFIX, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, st as buildCapabilityLookup, tr as validateComposition, ur as composedDeviceRef, vt as coreBlockAddonId, xt as coreBlockSourceKind, yn as normalizeCoreBlockWrite, yt as coreBlockComposition } from "../../dist-m5JkT8UN.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-tpYR0f1x.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { pathToFileURL } from "node:url";
 //#region src/builtins/core-blocks/block-package.ts
 /**
@@ -864,7 +864,7 @@ async function compileFiles(transpiler, files, entryPath) {
 		ok: false,
 		error: "the multi-file bundler is unavailable on this node"
 	};
-	const work = await fs.mkdtemp(path$1.join(os.tmpdir(), "core-block-compile-"));
+	const work = await fs.mkdtemp(path$1.join(os$1.tmpdir(), "core-block-compile-"));
 	try {
 		for (const [rel, content] of Object.entries(files)) {
 			const abs = path$1.resolve(work, rel);
@@ -1810,7 +1810,7 @@ function looksLikeSchema(value) {
 * Never throws.
 */
 async function extractSettingsSchema(js) {
-	const dir = await fs.mkdtemp(path$1.join(os.tmpdir(), "core-block-schema-"));
+	const dir = await fs.mkdtemp(path$1.join(os$1.tmpdir(), "core-block-schema-"));
 	const file = path$1.join(dir, "block.mjs");
 	try {
 		await fs.writeFile(file, js, "utf-8");

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CO3RqsDw.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DNfV28R_.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as FieldClaimModeSchema, Ar as WELL_KNOWN_TAB_MAP, Bt as expandContainer, Dt as defineExtensionSlotProvider, Gr as isDeviceConfigCap, Ir as collectZodSecretPaths, It as enumerateItemArrayFields, Jr as isSecretClear, Kt as formatMinutes, Lt as enumerateSchemaFields, Mt as deviceManagerCapability, Nt as deviceStateCapability, O as DeviceStatusSchema, Pt as deviceStatusCapability, R as MINUTES_PER_DAY, Rn as runtimeStatePolicyFor, Sn as parseStreamParamsFormPatch, St as createDeviceExtensionProvider, Un as siteZoneKey, W as STREAM_PROFILE_META, Xr as isSecretMarkerLike, Yr as isSecretMarker, _r as DeviceFeature, ai as resolveSecretMarkers, br as errMsg, c as CAMERA_SWITCH_ORDER, cn as locationIconKey, di as toSecretFieldView, fi as transformSecretWrite, ft as canonicalIconKey, in as legacyAutoLinkIds, j as FieldClaimSchema, jt as deviceExtensionCapability, kr as SECRET_CLEAR, li as sleep$1, lt as buildStreamParamsConfigSchema, pi as EventCategory, qr as isKeychainStoredField, r as ALL_CAPABILITY_DEFINITIONS, si as secretTreeFromPaths, u as CAP_NAMES_WITH_STATUS, vr as DeviceRole, x as DAY_NAMES, xr as BaseAddon, yn as normalizeUnit, yr as DeviceType } from "../../dist-Bz4_y8Xy.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-9nA85bwT.mjs";
+import { A as FieldClaimModeSchema, Cn as parseStreamParamsFormPatch, Cr as BaseAddon, Ct as createDeviceExtensionProvider, Ft as deviceStatusCapability, Gn as siteZoneKey, Lt as enumerateItemArrayFields, Mr as WELL_KNOWN_TAB_MAP, Mt as deviceExtensionCapability, Nt as deviceManagerCapability, O as DeviceStatusSchema, Ot as defineExtensionSlotProvider, Pt as deviceStateCapability, Qr as isSecretMarkerLike, R as MINUTES_PER_DAY, Rr as collectZodSecretPaths, Rt as enumerateSchemaFields, Sr as errMsg, Vt as expandContainer, W as STREAM_PROFILE_META, Xr as isSecretClear, Yr as isKeychainStoredField, Zr as isSecretMarker, an as legacyAutoLinkIds, bn as normalizeUnit, br as DeviceRole, c as CAMERA_SWITCH_ORDER, ci as secretTreeFromPaths, di as toSecretFieldView, fi as transformSecretWrite, j as FieldClaimSchema, jr as SECRET_CLEAR, li as sleep$1, ln as locationIconKey, oi as resolveSecretMarkers, pi as EventCategory, pt as canonicalIconKey, qr as isDeviceConfigCap, qt as formatMinutes, r as ALL_CAPABILITY_DEFINITIONS, u as CAP_NAMES_WITH_STATUS, ut as buildStreamParamsConfigSchema, x as DAY_NAMES, xr as DeviceType, yr as DeviceFeature, zn as runtimeStatePolicyFor } from "../../dist-m5JkT8UN.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-C5qP9QIf.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
-const require_device_ca = require("../../device-ca-WXuKc8AX.js");
-const require_constants = require("../../constants-DL87WgeN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_device_ca = require("../../device-ca-DImD8IzR.js");
+const require_constants = require("../../constants-CwRY32Nx.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -336,7 +336,7 @@ async function applyKeychainResetTrigger(input) {
 	}
 	await consume(file, logger);
 	const toReenter = ((await service.resetReport().catch(() => null))?.pendingReentry ?? []).map((m) => `${m.owner}:${m.scope}:${m.fieldPath}`);
-	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again. The cluster secret was cleared: set it again in System → Cluster if agents used one.", {
+	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again.", {
 		lockedReason: state.reason,
 		archived: record.archived,
 		archivedCollection: record.archivedCollection,
@@ -360,7 +360,7 @@ var PROCESS_HELD_SECRET_REFS = new Set([
 	require_device_ca.DEVICE_CA_KEY_REF
 ]);
 /** `system-settings` keys that may hold a system-owned secret's marker. */
-var SYSTEM_SECRET_SETTINGS_KEYS = [require_constants.CLUSTER_SECRET_SETTINGS_KEY];
+var SYSTEM_SECRET_SETTINGS_KEYS = [];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -899,8 +899,7 @@ var KeychainService = class {
 	* 2. Archive every value AND every wrapped data key — the archive stays
 	*    openable if the lost master key turns up.
 	* 3. New data key under the new master key ({@link firstBoot}).
-	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
-	*    at an archived value would refuse every agent forever (D797). The
+	* 4. Clear the system-held markers (none remain since D857). The
 	*    session signing key has no marker; it now resolves `missing`, and
 	*    `local-auth` generates a new one (everyone signs in again).
 	* 5. One `delete` event per archived ref, so every keeper reloads.

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { $r as normalizeSecretOwner, P as KEYCHAIN_RESET_TRIGGER_ACTOR, Ur as formatSecretScope, ni as parseSecretRef, nn as keychainAdminCapability, pi as EventCategory, rn as keychainCapability, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-B6YJZus6.mjs";
-import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-DoiTA134.mjs";
+import { Cr as BaseAddon, Gr as formatSecretScope, P as KEYCHAIN_RESET_TRIGGER_ACTOR, ei as normalizeSecretOwner, in as keychainCapability, pi as EventCategory, ri as parseSecretRef, rn as keychainAdminCapability } from "../../dist-m5JkT8UN.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BhdBByGD.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-Bc6trhoW.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -330,7 +330,7 @@ async function applyKeychainResetTrigger(input) {
 	}
 	await consume(file, logger);
 	const toReenter = ((await service.resetReport().catch(() => null))?.pendingReentry ?? []).map((m) => `${m.owner}:${m.scope}:${m.fieldPath}`);
-	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again. The cluster secret was cleared: set it again in System → Cluster if agents used one.", {
+	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again.", {
 		lockedReason: state.reason,
 		archived: record.archived,
 		archivedCollection: record.archivedCollection,
@@ -354,7 +354,7 @@ var PROCESS_HELD_SECRET_REFS = new Set([
 	DEVICE_CA_KEY_REF
 ]);
 /** `system-settings` keys that may hold a system-owned secret's marker. */
-var SYSTEM_SECRET_SETTINGS_KEYS = [CLUSTER_SECRET_SETTINGS_KEY];
+var SYSTEM_SECRET_SETTINGS_KEYS = [];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -893,8 +893,7 @@ var KeychainService = class {
 	* 2. Archive every value AND every wrapped data key — the archive stays
 	*    openable if the lost master key turns up.
 	* 3. New data key under the new master key ({@link firstBoot}).
-	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
-	*    at an archived value would refuse every agent forever (D797). The
+	* 4. Clear the system-held markers (none remain since D857). The
 	*    session signing key has no marker; it now resolves `missing`, and
 	*    `local-auth` generates a new one (everyone signs in again).
 	* 5. One `delete` event per archived ref, so every keeper reloads.

package/dist/builtins/keychain/keychain-service.d.ts

@@ -122,8 +122,7 @@ export declare class KeychainService {
 	* 2. Archive every value AND every wrapped data key — the archive stays
 	*    openable if the lost master key turns up.
 	* 3. New data key under the new master key ({@link firstBoot}).
-	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
-	*    at an archived value would refuse every agent forever (D797). The
+	* 4. Clear the system-held markers (none remain since D857). The
 	*    session signing key has no marker; it now resolves `missing`, and
 	*    `local-auth` generates a new one (everyone signs in again).
 	* 5. One `delete` event per archived ref, so every keeper reloads.

package/dist/builtins/keychain/system-held-secrets.d.ts

@@ -7,13 +7,13 @@
 *    offered for deletion as an orphan.
 *  - The mesh CA key is HELD the same way (mesh mTLS issuance); the public
 *    certificate lives in `system-settings` `cluster.meshCa`.
-*  - The cluster secret is a `password` field of `system-config` (System →
-*    Cluster): its marker lives in the `system-settings` row
-*    `cluster.clusterSecret`, like any other form-owned secret.
+*  - No form-owned system secret remains: the cluster secret was removed (D857) and the
+*    mesh certificate is the node identity. A `system/global/clusterSecret` entry left in
+*    the keychain by an older hub is NOT recognised here, so it reads as an orphan the
+*    operator deletes by hand; nothing reads or writes it any more.
 */
 import type { SystemHeldSecretName } from "@camstack/types";
 import { SYSTEM_SECRET_OWNER } from "../../auth/jwt-signing-key.js";
-import { CLUSTER_SECRET_REF } from "../../kernel/moleculer/cluster-secret.js";
 import { MESH_CA_KEY_REF } from "../../kernel/moleculer/mesh-mtls/constants.js";
 export { SYSTEM_SECRET_OWNER };
 /** The refs `keychain-admin.setSystemSecret` may write, by name. */
@@ -22,4 +22,4 @@ export declare const SYSTEM_HELD_SECRET_REFS: Readonly<Record<SystemHeldSecretNa
 export declare const PROCESS_HELD_SECRET_REFS: ReadonlySet<string>;
 /** `system-settings` keys that may hold a system-owned secret's marker. */
 export declare const SYSTEM_SECRET_SETTINGS_KEYS: readonly string[];
-export { CLUSTER_SECRET_REF, MESH_CA_KEY_REF };
+export { MESH_CA_KEY_REF };

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { H as RecordingStatusSchema, Lr as createEvent, V as RECORDING_SOURCE_CAMSTACK_ADDON, br as errMsg, pi as EventCategory, xr as BaseAddon } from "../../dist-Bz4_y8Xy.mjs";
+import { Cr as BaseAddon, H as RecordingStatusSchema, Sr as errMsg, V as RECORDING_SOURCE_CAMSTACK_ADDON, pi as EventCategory, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-WXuKc8AX.js");
+const require_device_ca = require("../../device-ca-DImD8IzR.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6458,6 +6458,33 @@ var ScopedTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/session-revocation-bus.ts
+var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
+function listeners() {
+	const existing = Reflect.get(globalThis, BUS_KEY);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, BUS_KEY, created);
+	return created;
+}
+/** Subscribe; returns the unsubscribe. */
+function onSessionsRevoked(listener) {
+	const set = listeners();
+	set.add(listener);
+	return () => {
+		set.delete(listener);
+	};
+}
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+function announceSessionsRevoked(event, onListenerError) {
+	if (event.sessionIds.length === 0 && !event.allOfUser) return;
+	for (const listener of [...listeners()]) try {
+		listener(event);
+	} catch (error) {
+		onListenerError?.(error);
+	}
+}
+//#endregion
 //#region src/auth/login-session-manager.ts
 /**
 * Login sessions — the server-side record behind every session token.
@@ -6807,6 +6834,7 @@ var LoginSessionManager = class {
 			revokedReason: reason
 		};
 		this.replace(session, updated);
+		this.announce([updated.id], session.userId, false, null, reason);
 		await this.persist(updated);
 		return true;
 	}
@@ -6830,6 +6858,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
 		await this.persistCutoff(userId, at);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
@@ -6848,6 +6877,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), null, false, null, reason);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
 	}
@@ -6873,6 +6903,16 @@ var LoginSessionManager = class {
 		}
 		return dead.length;
 	}
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
+		announceSessionsRevoked({
+			sessionIds,
+			userId,
+			allOfUser,
+			exceptSessionId,
+			reason
+		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
+	}
 	newRefreshToken() {
 		return `${REFRESH_TOKEN_PREFIX}${node_crypto.randomBytes(32).toString("base64url")}`;
 	}
@@ -12093,4 +12133,5 @@ exports.UserManager = UserManager;
 exports.attachUserManagementInternal = attachUserManagementInternal;
 exports.getUserManagementInternal = getUserManagementInternal;
 exports.isSettingsReadUnavailable = isSettingsReadUnavailable;
+exports.onSessionsRevoked = onSessionsRevoked;
 exports.parseTokenExpiry = parseTokenExpiry;