@camstack/system 1.2.436 → 1.2.438

package/dist/builtins/device-manager/device-meta-types.d.ts

@@ -25,7 +25,11 @@ export interface ContributionShape {
 	sections: Array<{
 		id: string;
 		title: string;
+		/** `"<namespace>:<key>"` of the translated `title` (D863). */
+		titleKey?: string;
 		description?: string;
+		/** `"<namespace>:<key>"` of the translated `description` (D863). */
+		descriptionKey?: string;
 		style?: "card" | "accordion";
 		defaultCollapsed?: boolean;
 		columns?: 1 | 2 | 3 | 4;

package/dist/builtins/device-manager/device-provider-context.d.ts

@@ -20,6 +20,9 @@ import type { DeviceManagerSettings, DeviceMetaStore } from "./device-meta-store
 import type { FieldClaimsIndex } from "./field-claims-index.js";
 import type { OwnedCaps } from "./field-ownership.js";
 import type { MigrationGuard } from "./migrate-guard.js";
+import type { DeviceTombstoneStore } from "./device-tombstone-store.js";
+import type { RemovalHookDeps } from "./device-removal-hooks.js";
+import type { RemovalCleanup } from "./removal-cleanup.js";
 import type { RemovalFence } from "./removal-fence.js";
 import type { SecretConfigPathRegistry } from "./secret-config-paths.js";
 import type { SeedMode } from "./device-state-mirror.js";
@@ -101,6 +104,12 @@ export interface ProviderContext {
 	*  tears down, which is how a deleted camera came back as a config-less
 	*  shell (D376). */
 	readonly removalFence: RemovalFence;
+	/** Cleans a removed device's data store by store, bounded retry on failure (D864). */
+	readonly removalCleanup: RemovalCleanup;
+	/** The tombstone of every deleted device — the reliable record other addons reconcile from (D865). */
+	readonly tombstones: DeviceTombstoneStore;
+	/** Tells every `device-removal-hook` implementer a device was deleted (D865). */
+	readonly removalHooks: RemovalHookDeps;
 	/** The secret config paths each device declared at `registerDevice` (D783). */
 	readonly secretConfigPaths: SecretConfigPathRegistry;
 	/** Resolve the per-device `device-ops` native provider (throws when absent). */

package/dist/builtins/device-manager/device-removal-hooks.d.ts

@@ -0,0 +1,103 @@
+/**
+* device-manager's side of `device-removal-hook` (D865): tell every implementer
+* a device was deleted, and answer the admin question "which stored data belongs
+* to devices that no longer exist?".
+*
+* Two entry points, one rule: **an implementer is told to delete only on a
+* recorded delete (a tombstone), or on an explicit operator confirm.** Nothing
+* here infers a deletion from a device being absent from a single read.
+*/
+import { type CleanupDeletedDevicesResult, type DeviceDataEntry, type DeviceRemovedInput, type DeviceRemovedResult, type IScopedLogger, type OrphanDeviceData, type SettingsStoreClient } from "@camstack/types";
+import type { RemovalCleanup, RemovalStep } from "./removal-cleanup.js";
+/** The capability name implementers register under. */
+export declare const DEVICE_REMOVAL_HOOK_CAP = "device-removal-hook";
+/** The slice of `ctx.api` this module uses — a pin is the `addonId` selector. */
+export interface RemovalHookApi {
+	readonly addons: {
+		readonly listCapabilityProviders: {
+			query(input: {
+				capName: string;
+			}): Promise<readonly {
+				readonly addonId: string;
+			}[]>;
+		};
+	};
+	readonly deviceRemovalHook: {
+		readonly onDeviceRemoved: {
+			mutate(input: DeviceRemovedInput & {
+				addonId: string;
+			}): Promise<DeviceRemovedResult>;
+		};
+		readonly listDeviceData: {
+			query(input: {
+				addonId: string;
+			}): Promise<readonly DeviceDataEntry[]>;
+		};
+	};
+}
+export interface RemovalHookDeps {
+	readonly api: RemovalHookApi | undefined;
+	readonly logger: IScopedLogger;
+	readonly cleanup: RemovalCleanup;
+}
+/**
+* The removal step that calls every implementer. Each implementer is its own
+* nested step, so a failing one is retried by the bounded reconcile without
+* re-calling the others. Failing to ENUMERATE the implementers throws, and the
+* outer cleanup retries the whole step.
+*/
+export declare function removalHookStep(deps: RemovalHookDeps, input: DeviceRemovedInput): RemovalStep;
+/** Why a cleanup refuses to list or delete anything. */
+export type AbsenceCheck = {
+	readonly ok: true;
+	readonly known: ReadonlySet<number>;
+} | {
+	readonly ok: false;
+	readonly reason: string;
+};
+export interface AbsenceReads {
+	/** One read of the device ledger: its ids and the row count the engine reports. */
+	readonly readFleet: () => Promise<{
+		readonly ids: readonly number[];
+		readonly rowCount: number;
+	}>;
+}
+/**
+* The ids device-manager knows, from TWO consistent reads (D49). Refuses when a
+* read throws, answers empty (an empty fleet and a failed read look the same),
+* or returns fewer ids than the ledger has rows (a malformed row is skipped by
+* the decoder, and a device skipped is a device whose data would be deleted).
+* The known set is the UNION of both reads: an id is absent only when BOTH
+* reads lack it.
+*/
+export declare function checkFleetTwice(reads: AbsenceReads): Promise<AbsenceCheck>;
+/** Stores holding data for devices that are not in `known`, grouped per device. */
+export declare function orphanDevices(held: readonly (readonly [string, DeviceDataEntry])[], known: ReadonlySet<number>): {
+	readonly devices: readonly OrphanDeviceData[];
+	readonly idSpaceMismatch: boolean;
+};
+/** Every addon's per-device settings scopes, read and cleared centrally (D865). */
+export interface SettingsScopeAccess {
+	/** One entry per (device, addon) holding settings; throws on a failed or truncated read. */
+	list(): Promise<readonly {
+		readonly deviceId: number;
+		readonly addonId: string;
+	}[]>;
+	/** Delete every addon's scope of one device; resolves to the rows deleted. */
+	clear(deviceId: number): Promise<number>;
+}
+export interface CleanupDeps {
+	readonly api: RemovalHookApi | undefined;
+	readonly settings: SettingsScopeAccess | undefined;
+	readonly logger: IScopedLogger;
+	readonly reads: AbsenceReads;
+	readonly now?: () => number;
+}
+/** The admin "Clean data of deleted devices" action: dry run unless `confirm`. */
+export declare function cleanupDeletedDevicesData(deps: CleanupDeps, input: {
+	readonly confirm: boolean;
+}): Promise<CleanupDeletedDevicesResult>;
+/** The settings-store collection every addon's per-device settings share. */
+export declare const ADDON_DEVICE_SETTINGS_COLLECTION = "addon-device-settings";
+/** Scope access over the settings store; undefined when the store is unavailable. */
+export declare function settingsScopes(store: Pick<SettingsStoreClient, "query" | "deleteWhere"> | undefined): SettingsScopeAccess | undefined;

package/dist/builtins/device-manager/device-row-store.d.ts

@@ -238,6 +238,7 @@ export interface DeviceRow {
 	/** Has `registerDevice` ever run for this device? (former `deviceIndex` membership) */
 	readonly registered: boolean;
 }
+export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
 /**
 * Decode one stored row.
 *

package/dist/builtins/device-manager/device-tombstone-store.d.ts

@@ -0,0 +1,58 @@
+/**
+* The tombstones of deleted devices (D865).
+*
+* A device DELETE is a fact other addons must be able to learn reliably, long
+* after the `DeviceUnregistered` event (telemetry, droppable — D8/D11) is gone.
+* device-manager is the only authority on whether a device exists, so the record
+* of a deletion lives here, in its own collection, beside the device ledger.
+*
+* ## What a tombstone is NOT
+*
+* It is not "the device is unregistered / offline / its provider is restarting".
+* Those are states of a device that still exists; only {@link record}'s one
+* caller — `removeDevice`, the single door every delete converges on — writes a
+* tombstone. Anything that reconciles from tombstones therefore can never
+* destroy data of a device that merely went quiet.
+*
+* ## Expiry
+*
+* {@link DEVICE_TOMBSTONE_RETENTION_MS} (90 days). A tombstone older than that
+* is deleted the next time one is written or read. Ninety days is generous on
+* purpose: an addon that stayed disabled for a quarter still learns of the
+* deletions on its return. Data of a device deleted longer ago than that is
+* reachable only by the admin "clean data of deleted devices" action.
+*/
+import { type CollectionColumn, type CollectionIndex, type DeviceTombstone, type IScopedLogger } from "@camstack/types";
+import { type DeviceRowBackend } from "./device-row-store.js";
+/**
+* @durable class=ledger owner=device-manager
+*   write="`removeDevice` records one row per deleted device (key = device id) after the
+*     device row is gone"
+*   retention="90 days (`DEVICE_TOMBSTONE_RETENTION_MS`), pruned whenever a tombstone is
+*     written or the list is read. Bounded by the deletions an operator makes in a quarter."
+*/
+export declare const DEVICE_TOMBSTONES_COLLECTION = "device-manager:tombstones";
+export declare const DEVICE_TOMBSTONE_COLUMNS: readonly CollectionColumn[];
+export declare const DEVICE_TOMBSTONE_INDEXES: readonly CollectionIndex[];
+export interface DeviceTombstoneStoreOptions {
+	readonly backend: DeviceRowBackend;
+	readonly logger: IScopedLogger;
+	readonly now?: () => number;
+	readonly retentionMs?: number;
+}
+export declare class DeviceTombstoneStore {
+	private readonly backend;
+	private readonly logger;
+	private readonly now;
+	private readonly retentionMs;
+	private declared;
+	constructor(opts: DeviceTombstoneStoreOptions);
+	/** Lazy, idempotent declaration; a rejection is not latched. */
+	private declare;
+	/** Record a deletion. Re-recording the same id keeps the EARLIER `deletedAt`. */
+	record(tombstone: DeviceTombstone): Promise<void>;
+	/** Tombstones with `deletedAt >= sinceMs`, oldest first. Expired ones are pruned first. */
+	listSince(sinceMs: number): Promise<readonly DeviceTombstone[]>;
+	/** Delete tombstones older than the retention window. Best-effort: a failure is logged. */
+	pruneExpired(): Promise<number>;
+}

package/dist/builtins/device-manager/removal-cleanup.d.ts

@@ -0,0 +1,50 @@
+/**
+* What a device removal leaves behind is cleaned AT REMOVAL, by steps that
+* cannot block one another (D864).
+*
+* `removeDevice` used to run its clean-up as one straight line: the first step
+* that threw skipped every later one, and the keychain was not in the line at
+* all — a device-scoped secret (`secret://provider-dreame/device/4483/…`)
+* outlived its device for good. Each store is a {@link RemovalStep} now: run
+* independently, counted, logged ONCE per device with `tags: { deviceId }`,
+* and a step that failed is retried by a BOUNDED in-memory reconcile
+* (a few attempts, growing delays, then it gives up loudly).
+*
+* There is deliberately no boot-time sweep (the operator forbids purges on
+* boot): a retry that dies with the process is picked up by the keychain
+* admin's orphan listing (System -> Secrets), which names a device-scoped
+* secret whose device no longer points at it.
+*/
+import { type IScopedLogger } from "@camstack/types";
+/** One store that holds data of a removed device. `run` returns what it deleted. */
+export interface RemovalStep {
+	/** The store, named for the log (`keychain-secrets`, `device-config`, …). */
+	readonly store: string;
+	/** Delete this device's data from the store; resolves to the number of rows/refs removed. */
+	readonly run: () => Promise<number>;
+}
+/** The outcome of one {@link RemovalCleanup.run}. */
+export interface RemovalCleanupReport {
+	readonly deviceId: number;
+	/** Rows/refs removed per store, for the steps that succeeded. */
+	readonly counts: Readonly<Record<string, number>>;
+	/** The stores whose step threw — scheduled for a bounded retry. */
+	readonly failed: readonly string[];
+}
+/** Retry delays after a failed step; the list length bounds the attempts. */
+export declare const REMOVAL_RETRY_DELAYS_MS: readonly number[];
+export interface RemovalCleanupOptions {
+	readonly logger: IScopedLogger;
+	/** The log message stem; the hook fan-out (D865) runs its own instance under another one. */
+	readonly label?: string;
+	readonly retryDelaysMs?: readonly number[];
+	readonly setTimer?: (fn: () => void, ms: number) => ReturnType<typeof setTimeout>;
+	readonly clearTimer?: (handle: ReturnType<typeof setTimeout>) => void;
+}
+export interface RemovalCleanup {
+	/** Run every step independently; log once; schedule a bounded retry for the failures. */
+	run(deviceId: number, steps: readonly RemovalStep[]): Promise<RemovalCleanupReport>;
+	/** Cancel every pending retry (addon shutdown). */
+	dispose(): void;
+}
+export declare function createRemovalCleanup(opts: RemovalCleanupOptions): RemovalCleanup;

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-Dc8GKC5H.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
-const require_device_ca = require("../../device-ca-CuWuRW9N.js");
-const require_constants = require("../../constants-GENKqk9k.js");
+const require_dist = require("../../dist-GgG-7amw.js");
+const require_device_ca = require("../../device-ca-BSvkXqyI.js");
+const require_constants = require("../../constants-wkcn5Ij3.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -709,6 +709,38 @@ var KeychainService = class {
 		}
 		return deleted;
 	}
+	/**
+	* Delete EVERY value whose scope is `device/<deviceId>`, whatever its owner
+	* (D864). A device-scoped secret is owned by the driver that declared it, so
+	* the device manager — which knows only that the device is gone — cannot name
+	* the owner; this is the one owner-spanning delete, and it is reserved to
+	* the device manager (a removal is the only moment a whole device scope
+	* stops being anybody's). Works while locked: it removes ciphertext, it
+	* never reads it.
+	*
+	* @returns the refs removed (never values), for the caller's one log line.
+	*/
+	async deleteDeviceScope(caller, deviceId) {
+		if (caller === null || require_dist.normalizeSecretOwner(caller) !== "device-manager") throw new KeychainForbiddenError(`device/${deviceId}`, caller);
+		const scope = require_dist.formatSecretScope({
+			kind: "device",
+			deviceId
+		});
+		const rows = (await this.deps.repo.listSecrets()).filter((row) => row.scope === scope);
+		if (rows.length === 0) return [];
+		const refs = rows.map((row) => row.ref);
+		await this.deps.repo.deleteSecrets(refs);
+		for (const row of rows) {
+			await this.audit("delete", actorOfAddon(caller), row.ref, "device-removed");
+			this.deps.events.emit({
+				ref: row.ref,
+				owner: row.owner,
+				version: null,
+				change: "delete"
+			});
+		}
+		return refs;
+	}
 	async listMeta(caller) {
 		return (await this.deps.repo.listSecrets()).filter((row) => this.owns(caller, row.owner)).map(toMeta);
 	}
@@ -1040,7 +1072,7 @@ var KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
 */
 var KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
 /**
-* @durable class=ring owner=keychain
+* @durable class=audit owner=keychain
 *   write="one row per write / delete / rotation / reveal / recovery download"
 *   retention="90 days and at most 20 000 rows, pruned at boot and daily"
 */
@@ -1817,6 +1849,7 @@ var KeychainAddon = class extends require_dist.BaseAddon {
 				put: (input) => service.put(callerOf(input), input.ref, input.value),
 				resolve: (input) => service.resolve(callerOf(input), input.refs),
 				delete: async (input) => ({ deleted: await service.delete(callerOf(input), input.refs) }),
+				deleteDeviceScope: async (input) => ({ refs: await service.deleteDeviceScope(callerOf(input), input.deviceId) }),
 				listMeta: (input) => service.listMeta(callerOf(input)),
 				getState: async () => service.getState()
 			}

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { P as KEYCHAIN_RESET_TRIGGER_ACTOR, Qr as normalizeSecretOwner, Ur as formatSecretScope, di as EventCategory, nn as keychainAdminCapability, rn as keychainCapability, ti as parseSecretRef, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BNM5ai4t.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-BFpowodq.mjs";
+import { L as KEYCHAIN_RESET_TRIGGER_ACTOR, Or as BaseAddon, Xr as formatSecretScope, ai as normalizeSecretOwner, ci as parseSecretRef, cn as keychainCapability, sn as keychainAdminCapability, yi as EventCategory } from "../../dist-Dc8GKC5H.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-DvIZjXIl.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-DQK705Sb.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -703,6 +703,38 @@ var KeychainService = class {
 		}
 		return deleted;
 	}
+	/**
+	* Delete EVERY value whose scope is `device/<deviceId>`, whatever its owner
+	* (D864). A device-scoped secret is owned by the driver that declared it, so
+	* the device manager — which knows only that the device is gone — cannot name
+	* the owner; this is the one owner-spanning delete, and it is reserved to
+	* the device manager (a removal is the only moment a whole device scope
+	* stops being anybody's). Works while locked: it removes ciphertext, it
+	* never reads it.
+	*
+	* @returns the refs removed (never values), for the caller's one log line.
+	*/
+	async deleteDeviceScope(caller, deviceId) {
+		if (caller === null || normalizeSecretOwner(caller) !== "device-manager") throw new KeychainForbiddenError(`device/${deviceId}`, caller);
+		const scope = formatSecretScope({
+			kind: "device",
+			deviceId
+		});
+		const rows = (await this.deps.repo.listSecrets()).filter((row) => row.scope === scope);
+		if (rows.length === 0) return [];
+		const refs = rows.map((row) => row.ref);
+		await this.deps.repo.deleteSecrets(refs);
+		for (const row of rows) {
+			await this.audit("delete", actorOfAddon(caller), row.ref, "device-removed");
+			this.deps.events.emit({
+				ref: row.ref,
+				owner: row.owner,
+				version: null,
+				change: "delete"
+			});
+		}
+		return refs;
+	}
 	async listMeta(caller) {
 		return (await this.deps.repo.listSecrets()).filter((row) => this.owns(caller, row.owner)).map(toMeta);
 	}
@@ -1034,7 +1066,7 @@ var KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
 */
 var KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
 /**
-* @durable class=ring owner=keychain
+* @durable class=audit owner=keychain
 *   write="one row per write / delete / rotation / reveal / recovery download"
 *   retention="90 days and at most 20 000 rows, pruned at boot and daily"
 */
@@ -1811,6 +1843,7 @@ var KeychainAddon = class extends BaseAddon {
 				put: (input) => service.put(callerOf(input), input.ref, input.value),
 				resolve: (input) => service.resolve(callerOf(input), input.refs),
 				delete: async (input) => ({ deleted: await service.delete(callerOf(input), input.refs) }),
+				deleteDeviceScope: async (input) => ({ refs: await service.deleteDeviceScope(callerOf(input), input.deviceId) }),
 				listMeta: (input) => service.listMeta(callerOf(input)),
 				getState: async () => service.getState()
 			}

package/dist/builtins/keychain/keychain-service.d.ts

@@ -1,6 +1,8 @@
 import { type KeychainAuditEntry, type KeychainKeySource, type KeychainResetRecord, type KeychainResolveResult, type KeychainSecretMeta, type KeychainSecretUsage, type KeychainState, type KeychainStatus, type KeychainUnavailableReason, type KnownEventCategory, type SystemHeldSecretName } from "@camstack/types";
 import { type KeySourceCandidate } from "./key-sources.js";
 import type { KeychainRepository, KeychainSecretRow } from "./keychain-store.js";
+/** The one caller that may purge a whole device scope across owners (D864). */
+export declare const DEVICE_SCOPE_PURGER = "device-manager";
 /** `lastReadAt` is written at most this often per ref (hub I/O is the bottleneck). */
 export declare const LAST_READ_GRANULARITY_MS: number;
 export declare class KeychainLockedError extends Error {
@@ -69,6 +71,18 @@ export declare class KeychainService {
 	resolve(caller: string | null, refs: readonly string[]): Promise<KeychainResolveResult>;
 	private touchLastRead;
 	delete(caller: string | null, refs: readonly string[]): Promise<number>;
+	/**
+	* Delete EVERY value whose scope is `device/<deviceId>`, whatever its owner
+	* (D864). A device-scoped secret is owned by the driver that declared it, so
+	* the device manager — which knows only that the device is gone — cannot name
+	* the owner; this is the one owner-spanning delete, and it is reserved to
+	* the device manager (a removal is the only moment a whole device scope
+	* stops being anybody's). Works while locked: it removes ciphertext, it
+	* never reads it.
+	*
+	* @returns the refs removed (never values), for the caller's one log line.
+	*/
+	deleteDeviceScope(caller: string | null, deviceId: number): Promise<readonly string[]>;
 	listMeta(caller: string | null): Promise<readonly KeychainSecretMeta[]>;
 	status(): Promise<KeychainStatus>;
 	listSecrets(): Promise<readonly (KeychainSecretMeta & {

package/dist/builtins/keychain/keychain-store.d.ts

@@ -25,7 +25,7 @@ export declare const KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
 */
 export declare const KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
 /**
-* @durable class=ring owner=keychain
+* @durable class=audit owner=keychain
 *   write="one row per write / delete / rotation / reveal / recovery download"
 *   retention="90 days and at most 20 000 rows, pruned at boot and daily"
 */

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { H as RecordingStatusSchema, Lr as createEvent, V as RECORDING_SOURCE_CAMSTACK_ADDON, br as errMsg, di as EventCategory, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Dr as errMsg, G as RecordingStatusSchema, Or as BaseAddon, W as RECORDING_SOURCE_CAMSTACK_ADDON, Wr as createEvent, yi as EventCategory } from "../../dist-Dc8GKC5H.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-CuWuRW9N.js");
+const require_device_ca = require("../../device-ca-BSvkXqyI.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6458,6 +6458,33 @@ var ScopedTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/session-revocation-bus.ts
+var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
+function listeners() {
+	const existing = Reflect.get(globalThis, BUS_KEY);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, BUS_KEY, created);
+	return created;
+}
+/** Subscribe; returns the unsubscribe. */
+function onSessionsRevoked(listener) {
+	const set = listeners();
+	set.add(listener);
+	return () => {
+		set.delete(listener);
+	};
+}
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+function announceSessionsRevoked(event, onListenerError) {
+	if (event.sessionIds.length === 0 && !event.allOfUser) return;
+	for (const listener of [...listeners()]) try {
+		listener(event);
+	} catch (error) {
+		onListenerError?.(error);
+	}
+}
+//#endregion
 //#region src/auth/login-session-manager.ts
 /**
 * Login sessions — the server-side record behind every session token.
@@ -6807,6 +6834,7 @@ var LoginSessionManager = class {
 			revokedReason: reason
 		};
 		this.replace(session, updated);
+		this.announce([updated.id], session.userId, false, null, reason);
 		await this.persist(updated);
 		return true;
 	}
@@ -6830,6 +6858,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
 		await this.persistCutoff(userId, at);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
@@ -6848,6 +6877,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), null, false, null, reason);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
 	}
@@ -6873,6 +6903,16 @@ var LoginSessionManager = class {
 		}
 		return dead.length;
 	}
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
+		announceSessionsRevoked({
+			sessionIds,
+			userId,
+			allOfUser,
+			exceptSessionId,
+			reason
+		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
+	}
 	newRefreshToken() {
 		return `${REFRESH_TOKEN_PREFIX}${node_crypto.randomBytes(32).toString("base64url")}`;
 	}
@@ -7036,9 +7076,9 @@ var AdminTokenManager = class {
 	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
 	async create(input) {
 		const at = this.now();
-		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw new Error("An admin token must expire within 90 days");
+		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw require_dist.userError("system.admin-token-expiry-too-long", void 0, "An admin token must expire within 90 days");
 		const name = input.name.trim().slice(0, 80);
-		if (name.length === 0) throw new Error("An admin token needs a name");
+		if (name.length === 0) throw require_dist.userError("system.admin-token-name-required", void 0, "An admin token needs a name");
 		const token = `${ADMIN_TOKEN_PREFIX}${node_crypto.randomBytes(32).toString("base64url")}`;
 		const stored = {
 			id: node_crypto.randomUUID(),
@@ -7427,7 +7467,7 @@ var DeviceCredentialManager = class {
 	/** A one-shot code for `userId` (admin path). Returned once; only its hash is kept. */
 	startEnrollment(input) {
 		this.prune();
-		if (this.pendingEnrollments.size >= MAX_PENDING) throw new Error("Too many pending device enrollments — try again shortly");
+		if (this.pendingEnrollments.size >= MAX_PENDING) throw require_dist.userError("system.device-enrollment-busy", void 0, "Too many pending device enrollments — try again shortly");
 		const code = node_crypto.randomBytes(24).toString("base64url");
 		const expiresAt = this.now() + require_dist.DEVICE_ENROLLMENT_TTL_MS;
 		this.pendingEnrollments.set(hash(code), {
@@ -7998,7 +8038,7 @@ var UserManager = class {
 		return this.storageAccess.getStore();
 	}
 	async create(input) {
-		if (await this.findByUsername(input.username)) throw new Error(`User with username "${input.username}" already exists`);
+		if (await this.findByUsername(input.username)) throw require_dist.userError("system.user-exists", { username: String(input.username) }, `User with username "${input.username}" already exists`);
 		const passwordHash = await this.auth.hashPassword(input.password);
 		const now = Date.now();
 		const record = {
@@ -8050,7 +8090,7 @@ var UserManager = class {
 	}
 	async update(id, data) {
 		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
+		if (!existing) throw require_dist.userError("system.user-not-found", { id: String(id) }, `User with id "${id}" not found`);
 		await this.store.update.mutate({
 			collection: USERS_COLLECTION$1,
 			id,
@@ -8069,7 +8109,7 @@ var UserManager = class {
 	}
 	async resetPassword(id, newPassword) {
 		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
+		if (!existing) throw require_dist.userError("system.user-not-found", { id: String(id) }, `User with id "${id}" not found`);
 		const passwordHash = await this.auth.hashPassword(newPassword);
 		await this.store.update.mutate({
 			collection: USERS_COLLECTION$1,
@@ -11736,7 +11776,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			},
 			confirmTotp: async (input) => {
 				if (!this.totpManager) throw new Error("TOTP management not available");
-				if (!await this.totpManager.confirm(input.userId, input.code)) throw new Error("TOTP confirmation failed — code did not match");
+				if (!await this.totpManager.confirm(input.userId, input.code)) throw require_dist.userError("auth.totp-confirm-failed", void 0, "TOTP confirmation failed — code did not match");
 				return { success: true };
 			},
 			disableTotp: async (input) => {
@@ -11794,7 +11834,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 	/** The admin cap (`device-credentials`): list, enroll-by-QR, revoke, rename, settings. */
 	buildDeviceCredentialsProvider() {
 		const manager = () => {
-			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			if (this.deviceCredentials === null) throw require_dist.userError("device.credentials-unavailable", void 0, "Device credentials not available");
 			return this.deviceCredentials;
 		};
 		const hubOrigins = async () => {
@@ -11846,7 +11886,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			},
 			revokeDeviceCredential: async (input) => {
 				const record = manager().get(input.id);
-				if (record === void 0) throw new Error(`Device credential not found: ${input.id}`);
+				if (record === void 0) throw require_dist.userError("device.credential-not-found", { id: input.id }, `Device credential not found: ${input.id}`);
 				const revoked = await manager().revoke(input.id, require_dist.formatDeviceRevoker({
 					kind: "admin",
 					userId: input.caller.userId
@@ -11917,7 +11957,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			return this.loginSessions;
 		};
 		const devices = () => {
-			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			if (this.deviceCredentials === null) throw require_dist.userError("device.credentials-unavailable", void 0, "Device credentials not available");
 			return this.deviceCredentials;
 		};
 		return {
@@ -12093,4 +12133,5 @@ exports.UserManager = UserManager;
 exports.attachUserManagementInternal = attachUserManagementInternal;
 exports.getUserManagementInternal = getUserManagementInternal;
 exports.isSettingsReadUnavailable = isSettingsReadUnavailable;
+exports.onSessionsRevoked = onSessionsRevoked;
 exports.parseTokenExpiry = parseTokenExpiry;