@camstack/system 1.2.436 → 1.2.437

package/dist/{agent-https-B8lKYVtU.mjs → agent-https-BPfHrI4c.mjs}

@@ -3,7 +3,7 @@ import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto }
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
 import { join } from "node:path";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 //#region src/tls/agent-https-names.ts
 /**
@@ -189,8 +189,8 @@ function evaluateExistingCert(input) {
 /** The real machine. The only place in `tls/` that touches `os`. */
 function systemHostFacts() {
 	return {
-		hostname: os.hostname(),
-		networkInterfaces: os.networkInterfaces()
+		hostname: os$1.hostname(),
+		networkInterfaces: os$1.networkInterfaces()
 	};
 }
 /**

package/dist/auth/login-session-manager.d.ts

@@ -121,6 +121,8 @@ export declare class LoginSessionManager {
 	listActive(): readonly LoginSessionSummary[];
 	/** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
 	reap(): Promise<number>;
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	private announce;
 	private newRefreshToken;
 	private remember;
 	private forget;

package/dist/auth/session-revocation-bus.d.ts

@@ -0,0 +1,32 @@
+/**
+* "These login sessions just ended" — the one announcement every revoke path
+* of the login-session table makes, so the hub can end what those sessions
+* still HOLD (open WebSockets, live media). A revoked `sid` is refused on the
+* next call; without this the socket stays open and the client keeps polling
+* as an anonymous principal.
+*
+* Process-global (`Symbol.for`), like the hub-internal user-management surface:
+* the table lives in `local-auth` and the listener in the hub, and neither may
+* import the other. Listeners are synchronous; one that throws never reaches
+* the revoke (reported to `onListenerError`).
+*/
+import type { LoginSessionRevocation } from "./login-session-manager.js";
+export interface SessionsRevokedEvent {
+	/** The sessions that ended just now (never one that was already ended). */
+	readonly sessionIds: readonly string[];
+	/** The user they belong to, when the revoke named one. */
+	readonly userId: string | null;
+	/**
+	* The revoke was "everything of this user" (logout everywhere, password
+	* change or reset, deletion): a connection of `userId` that carries NO
+	* session id (a pre-session token) ends too, except `exceptSessionId`.
+	*/
+	readonly allOfUser: boolean;
+	readonly exceptSessionId: string | null;
+	readonly reason: LoginSessionRevocation;
+}
+export type SessionsRevokedListener = (event: SessionsRevokedEvent) => void;
+/** Subscribe; returns the unsubscribe. */
+export declare function onSessionsRevoked(listener: SessionsRevokedListener): () => void;
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+export declare function announceSessionsRevoked(event: SessionsRevokedEvent, onListenerError?: (error: unknown) => void): void;

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Q as addonPagesCapability, br as errMsg, di as EventCategory, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { $ as addonPagesCapability, Cr as BaseAddon, Sr as errMsg, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { br as errMsg, di as EventCategory, et as addonWidgetsCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, Sr as errMsg, pi as EventCategory, tt as addonWidgetsCapability } from "../../dist-m5JkT8UN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Lr as createEvent, br as errMsg, di as EventCategory, i as AlertSchema, tt as alertsCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, Sr as errMsg, i as AlertSchema, nt as alertsCapability, pi as EventCategory, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Dn as ptzAutotrackCapability, Kr as isEvent, br as errMsg, di as EventCategory, it as bareAddonId, k as FIRST_LEVEL_MACRO_CLASSES, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, Jr as isEvent, On as ptzAutotrackCapability, Sr as errMsg, at as bareAddonId, k as FIRST_LEVEL_MACRO_CLASSES, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
-const require_restore_archive = require("../../restore-archive-D4h904rb.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_restore_archive = require("../../restore-archive-C75srVbG.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { Zr as nodePin, ci as toNodeId, di as EventCategory, pn as mayWriteToLocation, qn as storageOccupancyCapability, rt as backupCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
-import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-BxmP1ChO.mjs";
+import { $r as nodePin, Cr as BaseAddon, Yn as storageOccupancyCapability, it as backupCapability, mn as mayWriteToLocation, pi as EventCategory, ui as toNodeId } from "../../dist-m5JkT8UN.mjs";
+import { a as BackupSnapshotRefusedError, d as ENCRYPTED_BACKUP_SUFFIX, f as generateBackupKeyPair, i as BackupCancelledError, l as BackupKeyFormatError, m as parseBackupSecretKey, n as precheckRestoreKey, o as DEFAULT_BACKUP_DATABASES, p as parseBackupPublicKey, r as prepareRestoreArchive, s as SystemBackupService } from "../../restore-archive-DNxAStrJ.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { h as CalendarPreferencesSchema, ut as calendarsCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, dt as calendarsCapability, h as CalendarPreferencesSchema } from "../../dist-m5JkT8UN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { D as DeclaredDevices, Lr as createEvent, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Tt as declarationOwnerNodeId, Wn as snapshotCapability, Wr as hydrateSchema, Yn as streamCatalogCapability, _n as motionCapability, _r as DeviceFeature, br as errMsg, di as EventCategory, dt as cameraGridLayoutCapability, mn as memoizePinnedFfmpeg, o as BaseDevice, or as buildFfmpegArgs, xr as BaseAddon, yr as DeviceType, z as MOTION_CLOSE_AFTER_MS } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, D as DeclaredDevices, Et as declarationOwnerNodeId, Kn as snapshotCapability, Kr as hydrateSchema, S as DERIVED_CAMERA_SILENCED_CAP_NAMES, Sr as errMsg, Zn as streamCatalogCapability, cr as buildFfmpegArgs, ft as cameraGridLayoutCapability, hn as memoizePinnedFfmpeg, o as BaseDevice, pi as EventCategory, vn as motionCapability, xr as DeviceType, yr as DeviceFeature, z as MOTION_CLOSE_AFTER_MS, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
-const require_composition_sources = require("../../composition-sources-BAOlCu4j.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_composition_sources = require("../../composition-sources-BIT8IUKm.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { D as DeclaredDevices, Lr as createEvent, Rt as evaluateCompositionField, Vt as expressionContainsBuiltinCall, ar as COMPOSER_ADDON_ID, br as errMsg, cr as composedDeviceRef, d as COMPOSED_ITEM_FIXED_FIELDS, di as EventCategory, dr as compositionItemFieldPath, fr as compositionSliceKey, gr as toExpressionValue, hr as disarmRoseMemory, ht as compositionFieldKey, lr as composedDeviceStableId, mr as createStatefulExpressionMemory, mt as composerCapability, o as BaseDevice, ot as buildCapabilityLookup, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, sr as cloneStatefulExpressionMemory, ur as compositionFeatureEnabled, wn as planComposition, xr as BaseAddon, yr as DeviceType } from "../../dist-DjD2M79P.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-gN_BWUKp.mjs";
+import { Cr as BaseAddon, D as DeclaredDevices, Ht as expressionContainsBuiltinCall, Sr as errMsg, Tn as planComposition, _r as disarmRoseMemory, d as COMPOSED_ITEM_FIXED_FIELDS, dr as composedDeviceStableId, fr as compositionFeatureEnabled, gr as createStatefulExpressionMemory, gt as compositionFieldKey, hr as compositionSourceKey, ht as composerCapability, lr as cloneStatefulExpressionMemory, mr as compositionSliceKey, o as BaseDevice, pi as EventCategory, pr as compositionItemFieldPath, r as ALL_CAPABILITY_DEFINITIONS, sr as COMPOSER_ADDON_ID, st as buildCapabilityLookup, ur as composedDeviceRef, vr as toExpressionValue, xr as DeviceType, zr as createEvent, zt as evaluateCompositionField } from "../../dist-m5JkT8UN.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-tpYR0f1x.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
-const require_composition_sources = require("../../composition-sources-BAOlCu4j.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_composition_sources = require("../../composition-sources-BIT8IUKm.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,11 +1,11 @@
-import { $n as validateComposition, D as DeclaredDevices, Mn as resolveCoreBlockEntry, Nn as resolveCoreBlockFiles, Wr as hydrateSchema, _t as coreBlockAddonId, br as errMsg, bt as coreBlockSourceKind, cr as composedDeviceRef, f as COMPOSER_RUNNER_ID, g as CoreBlockSchema, gt as compositionSourceRefs, kn as replacedFieldKeys, kt as describeComposableCaps, m as CORE_BLOCK_ADDON_PREFIX, ot as buildCapabilityLookup, p as CORE_BLOCKS_ADDON_ID, pr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, vn as normalizeCoreBlockWrite, vt as coreBlockComposition, wn as planComposition, xr as BaseAddon, xt as coreBlocksCapability, yt as coreBlockIdFromAddonId } from "../../dist-DjD2M79P.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-gN_BWUKp.mjs";
+import { An as replacedFieldKeys, At as describeComposableCaps, Cr as BaseAddon, D as DeclaredDevices, Kr as hydrateSchema, Nn as resolveCoreBlockEntry, Pn as resolveCoreBlockFiles, Sr as errMsg, St as coreBlocksCapability, Tn as planComposition, _t as compositionSourceRefs, bt as coreBlockIdFromAddonId, f as COMPOSER_RUNNER_ID, g as CoreBlockSchema, hr as compositionSourceKey, m as CORE_BLOCK_ADDON_PREFIX, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, st as buildCapabilityLookup, tr as validateComposition, ur as composedDeviceRef, vt as coreBlockAddonId, xt as coreBlockSourceKind, yn as normalizeCoreBlockWrite, yt as coreBlockComposition } from "../../dist-m5JkT8UN.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-tpYR0f1x.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { pathToFileURL } from "node:url";
 //#region src/builtins/core-blocks/block-package.ts
 /**
@@ -864,7 +864,7 @@ async function compileFiles(transpiler, files, entryPath) {
 		ok: false,
 		error: "the multi-file bundler is unavailable on this node"
 	};
-	const work = await fs.mkdtemp(path$1.join(os.tmpdir(), "core-block-compile-"));
+	const work = await fs.mkdtemp(path$1.join(os$1.tmpdir(), "core-block-compile-"));
 	try {
 		for (const [rel, content] of Object.entries(files)) {
 			const abs = path$1.resolve(work, rel);
@@ -1810,7 +1810,7 @@ function looksLikeSchema(value) {
 * Never throws.
 */
 async function extractSettingsSchema(js) {
-	const dir = await fs.mkdtemp(path$1.join(os.tmpdir(), "core-block-schema-"));
+	const dir = await fs.mkdtemp(path$1.join(os$1.tmpdir(), "core-block-schema-"));
 	const file = path$1.join(dir, "block.mjs");
 	try {
 		await fs.writeFile(file, js, "utf-8");

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CYP5IZJ5.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DNfV28R_.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as FieldClaimModeSchema, Ar as WELL_KNOWN_TAB_MAP, Bt as expandContainer, Dt as defineExtensionSlotProvider, Gr as isDeviceConfigCap, Ir as collectZodSecretPaths, It as enumerateItemArrayFields, Jr as isSecretClear, Kt as formatMinutes, Lt as enumerateSchemaFields, Mt as deviceManagerCapability, Nt as deviceStateCapability, O as DeviceStatusSchema, Pt as deviceStatusCapability, R as MINUTES_PER_DAY, Rn as runtimeStatePolicyFor, Sn as parseStreamParamsFormPatch, St as createDeviceExtensionProvider, Un as siteZoneKey, W as STREAM_PROFILE_META, Xr as isSecretMarkerLike, Yr as isSecretMarker, _r as DeviceFeature, br as errMsg, c as CAMERA_SWITCH_ORDER, cn as locationIconKey, di as EventCategory, ft as canonicalIconKey, ii as resolveSecretMarkers, in as legacyAutoLinkIds, j as FieldClaimSchema, jt as deviceExtensionCapability, kr as SECRET_CLEAR, li as toSecretFieldView, lt as buildStreamParamsConfigSchema, oi as secretTreeFromPaths, qr as isKeychainStoredField, r as ALL_CAPABILITY_DEFINITIONS, si as sleep$1, u as CAP_NAMES_WITH_STATUS, ui as transformSecretWrite, vr as DeviceRole, x as DAY_NAMES, xr as BaseAddon, yn as normalizeUnit, yr as DeviceType } from "../../dist-DjD2M79P.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CQaknvx1.mjs";
+import { A as FieldClaimModeSchema, Cn as parseStreamParamsFormPatch, Cr as BaseAddon, Ct as createDeviceExtensionProvider, Ft as deviceStatusCapability, Gn as siteZoneKey, Lt as enumerateItemArrayFields, Mr as WELL_KNOWN_TAB_MAP, Mt as deviceExtensionCapability, Nt as deviceManagerCapability, O as DeviceStatusSchema, Ot as defineExtensionSlotProvider, Pt as deviceStateCapability, Qr as isSecretMarkerLike, R as MINUTES_PER_DAY, Rr as collectZodSecretPaths, Rt as enumerateSchemaFields, Sr as errMsg, Vt as expandContainer, W as STREAM_PROFILE_META, Xr as isSecretClear, Yr as isKeychainStoredField, Zr as isSecretMarker, an as legacyAutoLinkIds, bn as normalizeUnit, br as DeviceRole, c as CAMERA_SWITCH_ORDER, ci as secretTreeFromPaths, di as toSecretFieldView, fi as transformSecretWrite, j as FieldClaimSchema, jr as SECRET_CLEAR, li as sleep$1, ln as locationIconKey, oi as resolveSecretMarkers, pi as EventCategory, pt as canonicalIconKey, qr as isDeviceConfigCap, qt as formatMinutes, r as ALL_CAPABILITY_DEFINITIONS, u as CAP_NAMES_WITH_STATUS, ut as buildStreamParamsConfigSchema, x as DAY_NAMES, xr as DeviceType, yr as DeviceFeature, zn as runtimeStatePolicyFor } from "../../dist-m5JkT8UN.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-C5qP9QIf.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
-const require_device_ca = require("../../device-ca-CuWuRW9N.js");
-const require_constants = require("../../constants-GENKqk9k.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_device_ca = require("../../device-ca-DImD8IzR.js");
+const require_constants = require("../../constants-CwRY32Nx.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { P as KEYCHAIN_RESET_TRIGGER_ACTOR, Qr as normalizeSecretOwner, Ur as formatSecretScope, di as EventCategory, nn as keychainAdminCapability, rn as keychainCapability, ti as parseSecretRef, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BNM5ai4t.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-BFpowodq.mjs";
+import { Cr as BaseAddon, Gr as formatSecretScope, P as KEYCHAIN_RESET_TRIGGER_ACTOR, ei as normalizeSecretOwner, in as keychainCapability, pi as EventCategory, ri as parseSecretRef, rn as keychainAdminCapability } from "../../dist-m5JkT8UN.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BhdBByGD.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-Bc6trhoW.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { H as RecordingStatusSchema, Lr as createEvent, V as RECORDING_SOURCE_CAMSTACK_ADDON, br as errMsg, di as EventCategory, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, H as RecordingStatusSchema, Sr as errMsg, V as RECORDING_SOURCE_CAMSTACK_ADDON, pi as EventCategory, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CuWuRW9N.js");
+const require_device_ca = require("../../device-ca-DImD8IzR.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6458,6 +6458,33 @@ var ScopedTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/session-revocation-bus.ts
+var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
+function listeners() {
+	const existing = Reflect.get(globalThis, BUS_KEY);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, BUS_KEY, created);
+	return created;
+}
+/** Subscribe; returns the unsubscribe. */
+function onSessionsRevoked(listener) {
+	const set = listeners();
+	set.add(listener);
+	return () => {
+		set.delete(listener);
+	};
+}
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+function announceSessionsRevoked(event, onListenerError) {
+	if (event.sessionIds.length === 0 && !event.allOfUser) return;
+	for (const listener of [...listeners()]) try {
+		listener(event);
+	} catch (error) {
+		onListenerError?.(error);
+	}
+}
+//#endregion
 //#region src/auth/login-session-manager.ts
 /**
 * Login sessions — the server-side record behind every session token.
@@ -6807,6 +6834,7 @@ var LoginSessionManager = class {
 			revokedReason: reason
 		};
 		this.replace(session, updated);
+		this.announce([updated.id], session.userId, false, null, reason);
 		await this.persist(updated);
 		return true;
 	}
@@ -6830,6 +6858,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
 		await this.persistCutoff(userId, at);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
@@ -6848,6 +6877,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), null, false, null, reason);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
 	}
@@ -6873,6 +6903,16 @@ var LoginSessionManager = class {
 		}
 		return dead.length;
 	}
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
+		announceSessionsRevoked({
+			sessionIds,
+			userId,
+			allOfUser,
+			exceptSessionId,
+			reason
+		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
+	}
 	newRefreshToken() {
 		return `${REFRESH_TOKEN_PREFIX}${node_crypto.randomBytes(32).toString("base64url")}`;
 	}
@@ -12093,4 +12133,5 @@ exports.UserManager = UserManager;
 exports.attachUserManagementInternal = attachUserManagementInternal;
 exports.getUserManagementInternal = getUserManagementInternal;
 exports.isSettingsReadUnavailable = isSettingsReadUnavailable;
+exports.onSessionsRevoked = onSessionsRevoked;
 exports.parseTokenExpiry = parseTokenExpiry;

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { At as deviceCredentialsCapability, C as DEVICE_ENROLLMENT_TTL_MS, G as ScopedTokenSchema, Gt as formatDeviceRevoker, K as SsoBridgeClaimsSchema, Qn as userManagementCapability, Z as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceSignatureMessage, nt as authProviderCapability, st as buildDeviceEnrollmentLink, w as DEVICE_NONCE_TTL_MS, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { C as DEVICE_ENROLLMENT_TTL_MS, Cr as BaseAddon, G as ScopedTokenSchema, Kt as formatDeviceRevoker, Q as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceEnrollmentLink, er as userManagementCapability, jt as deviceCredentialsCapability, lt as buildDeviceSignatureMessage, q as SsoBridgeClaimsSchema, rt as authProviderCapability, w as DEVICE_NONCE_TTL_MS } from "../../dist-m5JkT8UN.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BNM5ai4t.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BhdBByGD.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6448,6 +6448,33 @@ var ScopedTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/session-revocation-bus.ts
+var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
+function listeners() {
+	const existing = Reflect.get(globalThis, BUS_KEY);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, BUS_KEY, created);
+	return created;
+}
+/** Subscribe; returns the unsubscribe. */
+function onSessionsRevoked(listener) {
+	const set = listeners();
+	set.add(listener);
+	return () => {
+		set.delete(listener);
+	};
+}
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+function announceSessionsRevoked(event, onListenerError) {
+	if (event.sessionIds.length === 0 && !event.allOfUser) return;
+	for (const listener of [...listeners()]) try {
+		listener(event);
+	} catch (error) {
+		onListenerError?.(error);
+	}
+}
+//#endregion
 //#region src/auth/login-session-manager.ts
 /**
 * Login sessions — the server-side record behind every session token.
@@ -6797,6 +6824,7 @@ var LoginSessionManager = class {
 			revokedReason: reason
 		};
 		this.replace(session, updated);
+		this.announce([updated.id], session.userId, false, null, reason);
 		await this.persist(updated);
 		return true;
 	}
@@ -6820,6 +6848,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
 		await this.persistCutoff(userId, at);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
@@ -6838,6 +6867,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), null, false, null, reason);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
 	}
@@ -6863,6 +6893,16 @@ var LoginSessionManager = class {
 		}
 		return dead.length;
 	}
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
+		announceSessionsRevoked({
+			sessionIds,
+			userId,
+			allOfUser,
+			exceptSessionId,
+			reason
+		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
+	}
 	newRefreshToken() {
 		return `${REFRESH_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
 	}
@@ -12061,4 +12101,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as _, attachUserManagementInternal as a, isSettingsReadUnavailable as b, DeviceCredentialManager as c, ADMIN_TOKEN_MAX_LIFETIME_MS as d, ADMIN_TOKEN_PREFIX as f, ScopedTokenManager as g, REFRESH_TOKEN_PREFIX as h, USER_MANAGEMENT_INTERNAL as i, PREVIOUS_LEAF_GRACE_MS as l, LoginSessionManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, AdminTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, DeviceCaStore as u, parseTokenExpiry as v, ApiKeyManager as x, SettingsReadUnavailableError as y };
+export { LocalAuthAddon, LocalAuthAddon as default, ApiKeyManager as S, ScopedTokenManager as _, attachUserManagementInternal as a, SettingsReadUnavailableError as b, DeviceCredentialManager as c, ADMIN_TOKEN_MAX_LIFETIME_MS as d, ADMIN_TOKEN_PREFIX as f, onSessionsRevoked as g, REFRESH_TOKEN_PREFIX as h, USER_MANAGEMENT_INTERNAL as i, PREVIOUS_LEAF_GRACE_MS as l, LoginSessionManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, AdminTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, DeviceCaStore as u, AuthManager as v, isSettingsReadUnavailable as x, parseTokenExpiry as y };

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
 let zod = require("zod");
 let node_net = require("node:net");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,8 +1,8 @@
-import { An as resolveAppConnections, B as NetworkTunnelStartedDataSchema, Cn as pickAppLinkHub, Jt as isAppLinkBase, Ln as resolveNotificationTapAddress, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Pn as resolveHubAddressRoles, Zt as isDefaultAppConnectionEndpoint, di as EventCategory, er as validateCustomAddress, l as CAMSTACK_APP_LINK_ORIGIN, pt as checkRoleAddress, sn as localNetworkCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DJRwtlA8.mjs";
+import { B as NetworkTunnelStartedDataSchema, Cr as BaseAddon, Fn as resolveHubAddressRoles, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Qt as isDefaultAppConnectionEndpoint, Rn as resolveNotificationTapAddress, Yt as isAppLinkBase, cn as localNetworkCapability, jn as resolveAppConnections, l as CAMSTACK_APP_LINK_ORIGIN, mt as checkRoleAddress, nr as validateCustomAddress, pi as EventCategory, wn as pickAppLinkHub } from "../../dist-m5JkT8UN.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DMlQTdPU.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { readFileSync } from "node:fs";
 //#region src/builtins/local-network/address-book.ts
 /**
@@ -1186,7 +1186,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(os.networkInterfaces(), readLinuxIpv6Flags());
+		return enumerateOsInterfaces(os$1.networkInterfaces(), readLinuxIpv6Flags());
 	}
 	/**
 	* Replace rotated IPv6 and drop addresses that no longer exist, without

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-CEAyXW3Q.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label