@camstack/system 1.2.437 → 1.2.439

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DNfV28R_.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CyQ7uvta.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -969,7 +969,9 @@ function toWireShape(input) {
 	const out = { sections: input.sections.map((s) => ({
 		id: s.id,
 		title: s.title,
+		...s.titleKey !== void 0 ? { titleKey: s.titleKey } : {},
 		...s.description !== void 0 ? { description: s.description } : {},
+		...s.descriptionKey !== void 0 ? { descriptionKey: s.descriptionKey } : {},
 		...s.style !== void 0 ? { style: s.style } : {},
 		...s.defaultCollapsed !== void 0 ? { defaultCollapsed: s.defaultCollapsed } : {},
 		...s.columns !== void 0 ? { columns: s.columns } : {},
@@ -1780,6 +1782,7 @@ function buildDayNightConfigSchema(options, status) {
 		type: "select",
 		key: "dayNight_mode",
 		label: "Mode",
+		labelKey: "server:dayNightConfig.dayNight_mode.label",
 		options: options.modes.map((m) => ({
 			value: m,
 			label: MODE_LABELS[m]
@@ -1790,6 +1793,7 @@ function buildDayNightConfigSchema(options, status) {
 		type: "slider",
 		key: "dayNight_sensitivity",
 		label: "IR-cut sensitivity",
+		labelKey: "server:dayNightConfig.dayNight_sensitivity.label",
 		min: options.sensitivity.min,
 		max: options.sensitivity.max,
 		step: options.sensitivity.step,
@@ -1800,6 +1804,7 @@ function buildDayNightConfigSchema(options, status) {
 		type: "number",
 		key: "dayNight_switchDelaySec",
 		label: "Switch delay",
+		labelKey: "server:dayNightConfig.dayNight_switchDelaySec.label",
 		unit: "s",
 		min: options.switchDelaySec.min,
 		max: options.switchDelaySec.max,
@@ -1811,7 +1816,9 @@ function buildDayNightConfigSchema(options, status) {
 		id: "day-night",
 		tab: "image",
 		title: "Day / Night",
+		titleKey: "server:section.s_day-night.title",
 		description: "IR-cut switching mode and the photocell knobs that gate it.",
+		descriptionKey: "server:section.s_day-night.description",
 		columns: 2,
 		fields
 	}] };
@@ -1904,6 +1911,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "slider",
 		key: "imageSettings_brightness",
 		label: "Brightness",
+		labelKey: "server:imageSettingsConfig.imageSettings_brightness.label",
 		min: options.brightness.min,
 		max: options.brightness.max,
 		step: options.brightness.step,
@@ -1914,6 +1922,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "slider",
 		key: "imageSettings_contrast",
 		label: "Contrast",
+		labelKey: "server:imageSettingsConfig.imageSettings_contrast.label",
 		min: options.contrast.min,
 		max: options.contrast.max,
 		step: options.contrast.step,
@@ -1924,6 +1933,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "slider",
 		key: "imageSettings_saturation",
 		label: "Saturation",
+		labelKey: "server:imageSettingsConfig.imageSettings_saturation.label",
 		min: options.saturation.min,
 		max: options.saturation.max,
 		step: options.saturation.step,
@@ -1934,6 +1944,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "slider",
 		key: "imageSettings_sharpness",
 		label: "Sharpness",
+		labelKey: "server:imageSettingsConfig.imageSettings_sharpness.label",
 		min: options.sharpness.min,
 		max: options.sharpness.max,
 		step: options.sharpness.step,
@@ -1944,6 +1955,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "boolean",
 		key: "imageSettings_mirror",
 		label: "Mirror",
+		labelKey: "server:imageSettingsConfig.imageSettings_mirror.label",
 		style: "switch",
 		default: status?.mirror ?? false
 	});
@@ -1951,6 +1963,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "boolean",
 		key: "imageSettings_flip",
 		label: "Flip",
+		labelKey: "server:imageSettingsConfig.imageSettings_flip.label",
 		style: "switch",
 		default: status?.flip ?? false
 	});
@@ -1958,6 +1971,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "select",
 		key: "imageSettings_rotate",
 		label: "Rotation",
+		labelKey: "server:imageSettingsConfig.imageSettings_rotate.label",
 		options: options.rotateOptions.map((r) => ({
 			value: r,
 			label: ROTATE_LABELS[r]
@@ -1968,6 +1982,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "select",
 		key: "imageSettings_whiteBalance",
 		label: "White balance",
+		labelKey: "server:imageSettingsConfig.imageSettings_whiteBalance.label",
 		options: options.whiteBalanceModes.map((m) => ({
 			value: m,
 			label: WHITE_BALANCE_LABELS[m]
@@ -1978,6 +1993,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "slider",
 		key: "imageSettings_warmth",
 		label: "Warmth",
+		labelKey: "server:imageSettingsConfig.imageSettings_warmth.label",
 		min: options.warmth.min,
 		max: options.warmth.max,
 		step: options.warmth.step,
@@ -1992,6 +2008,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "select",
 		key: "imageSettings_exposureMode",
 		label: "Exposure mode",
+		labelKey: "server:imageSettingsConfig.imageSettings_exposureMode.label",
 		options: options.exposureModes.map((m) => ({
 			value: m,
 			label: EXPOSURE_LABELS[m]
@@ -2002,6 +2019,7 @@ function buildImageSettingsConfigSchema(options, status) {
 		type: "select",
 		key: "imageSettings_backlightMode",
 		label: "Backlight compensation",
+		labelKey: "server:imageSettingsConfig.imageSettings_backlightMode.label",
 		options: options.backlightModes.map((m) => ({
 			value: m,
 			label: BACKLIGHT_LABELS[m]
@@ -2013,7 +2031,9 @@ function buildImageSettingsConfigSchema(options, status) {
 		id: "image-settings",
 		tab: "image",
 		title: "Image adjustment",
+		titleKey: "server:section.s_image-settings.title",
 		description: "Picture sliders, orientation and exposure. Option lists are read live from the camera — fields the firmware doesn't expose are hidden.",
+		descriptionKey: "server:section.s_image-settings.description",
 		columns: 2,
 		fields
 	}] };
@@ -2147,26 +2167,31 @@ function volumesField(status) {
 			{
 				key: "id",
 				label: "Id",
+				labelKey: "server:volumesField.id.label",
 				kind: "monospace",
 				width: "70px"
 			},
 			{
 				key: "label",
 				label: "Name",
+				labelKey: "server:volumesField.label.label",
 				kind: "monospace"
 			},
 			{
 				key: "status",
 				label: "Status",
+				labelKey: "server:volumesField.status.label",
 				kind: "status"
 			},
 			{
 				key: "capacity",
-				label: "Capacity"
+				label: "Capacity",
+				labelKey: "server:volumesField.capacity.label"
 			},
 			{
 				key: "free",
-				label: "Free"
+				label: "Free",
+				labelKey: "server:volumesField.free.label"
 			}
 		],
 		value: rows,
@@ -2190,27 +2215,32 @@ function tracksField(status) {
 			{
 				key: "id",
 				label: "Track",
+				labelKey: "server:tracksField.id.label",
 				kind: "monospace",
 				width: "80px"
 			},
 			{
 				key: "primary",
 				label: "Primary",
+				labelKey: "server:tracksField.primary.label",
 				width: "80px"
 			},
 			{
 				key: "enabled",
 				label: "Enabled",
+				labelKey: "server:tracksField.enabled.label",
 				kind: "status",
 				width: "90px"
 			},
 			{
 				key: "codec",
-				label: "Codec"
+				label: "Codec",
+				labelKey: "server:tracksField.codec.label"
 			},
 			{
 				key: "resolution",
-				label: "Resolution"
+				label: "Resolution",
+				labelKey: "server:tracksField.resolution.label"
 			}
 		],
 		value: rows,
@@ -2412,7 +2442,9 @@ function buildRecordingOnboardConfigSchema(options, status) {
 		id: "recording-onboard-storage",
 		tab: "recording",
 		title: "Camera storage",
+		titleKey: "server:storageSection.s_recording-onboard-storage.title",
 		description: "The card in the camera, as the camera itself describes it.",
+		descriptionKey: "server:storageSection.s_recording-onboard-storage.description",
 		columns: 1,
 		fields: [
 			storageBanner(status),
@@ -2423,7 +2455,9 @@ function buildRecordingOnboardConfigSchema(options, status) {
 		id: "recording-onboard-recording",
 		tab: "recording",
 		title: "Camera recording",
+		titleKey: "server:recordingSection.s_recording-onboard-recording.title",
 		description: "What the camera records to its own card. This writes the camera, not CamStack's recorder.",
+		descriptionKey: "server:recordingSection.s_recording-onboard-recording.description",
 		columns: 2,
 		fields: [
 			booleanField(RECORDING_ONBOARD_KEYS.enabled, "Record to card", "The camera-side master switch.", options.enabled, status?.enabled ?? null),
@@ -3032,7 +3066,7 @@ async function getStreamSources(pctx, input) {
 			}));
 		}
 	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw require_dist.userError("device.not-found", { id: deviceId }, `[device-manager] Device with id ${deviceId} not found`);
 	return (await pctx.requireDeviceOps(deviceId).getStreamSources({ deviceId })).map((s) => ({ ...s }));
 }
 async function getConfigSchema(pctx, input) {
@@ -3045,7 +3079,7 @@ async function getConfigSchema(pctx, input) {
 			...entry.description !== void 0 ? { description: entry.description } : {}
 		}));
 	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw require_dist.userError("device.not-found", { id: deviceId }, `[device-manager] Device with id ${deviceId} not found`);
 	return (await pctx.requireDeviceOps(deviceId).getConfigEntries({ deviceId })).map((e) => ({ ...e }));
 }
 async function getSettingsSchema(pctx, input) {
@@ -3066,7 +3100,7 @@ async function updateConfig(pctx, input) {
 			return { success: true };
 		}
 	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw require_dist.userError("device.not-found", { id: deviceId }, `[device-manager] Device with id ${deviceId} not found`);
 	await pctx.requireDeviceOps(deviceId).setConfig({
 		deviceId,
 		values: input.values
@@ -3166,7 +3200,7 @@ async function setStreamProfileMap(pctx, input) {
 			return { success: true };
 		}
 	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw require_dist.userError("device.not-found", { id: deviceId }, `[device-manager] Device with id ${deviceId} not found`);
 	await pctx.requireDeviceOps(deviceId).setConfig({
 		deviceId,
 		values: { _profileMap: input.profileMap }
@@ -3203,7 +3237,7 @@ async function probeStreams(pctx, input) {
 }
 async function discoverDevices(pctx, input) {
 	const dp = await pctx.host.requireDeviceProvider(input.addonId);
-	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device discovery`);
+	if (!await dp.supportsDiscovery({})) throw require_dist.userError("system.addon-no-discovery", { addonId: String(input.addonId) }, `Addon "${input.addonId}" does not support device discovery`);
 	return (await dp.discoverDevices({})).map((d) => ({
 		stableId: d.stableId,
 		type: d.type,
@@ -3216,7 +3250,7 @@ async function discoverDevices(pctx, input) {
 }
 async function adoptDevice(pctx, input) {
 	const dp = await pctx.host.requireDeviceProvider(input.addonId);
-	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device adoption`);
+	if (!await dp.supportsDiscovery({})) throw require_dist.userError("system.addon-no-adoption", { addonId: String(input.addonId) }, `Addon "${input.addonId}" does not support device adoption`);
 	const summary = await pctx.removalFence.runUnfenced(() => dp.adoptDiscoveredDevice({ candidate: input.candidate }));
 	if (input.integrationId !== void 0) try {
 		await pctx.stampIntegrationId(summary.id, input.integrationId);
@@ -3238,7 +3272,7 @@ async function getCreationSchema(pctx, input) {
 }
 async function createDevice(pctx, input) {
 	const dp = await pctx.host.requireDeviceProvider(input.addonId);
-	if (!await dp.supportsManualCreation({})) throw new Error(`Addon "${input.addonId}" does not support manual device creation`);
+	if (!await dp.supportsManualCreation({})) throw require_dist.userError("system.addon-no-manual-create", { addonId: String(input.addonId) }, `Addon "${input.addonId}" does not support manual device creation`);
 	const summary = await pctx.removalFence.runUnfenced(() => dp.createDevice({
 		type: input.type,
 		config: input.config
@@ -3331,7 +3365,7 @@ async function testField(pctx, input) {
 	let owningAddonId = null;
 	if (pctx.registry) owningAddonId = pctx.registry.getAddonId(deviceId);
 	if (!owningAddonId) owningAddonId = (await pctx.metaStore.resolvePersistedById(deviceId))?.addonId ?? null;
-	if (!owningAddonId) throw new Error(`Device with id ${deviceId} not found`);
+	if (!owningAddonId) throw require_dist.userError("device.not-found", { id: deviceId }, `Device with id ${deviceId} not found`);
 	const dp = await pctx.host.waitDeviceProvider(owningAddonId);
 	if (!dp) return {
 		status: "ok",
@@ -3840,12 +3874,14 @@ async function buildBaseDeviceSection(deps, deviceId) {
 	} else if (driverResult.status === "unavailable") sections.push({
 		id: "driver-settings-unavailable",
 		title: "Driver Settings",
+		titleKey: "server:baseDeviceSection.s_driver-settings-unavailable.title",
 		tab: "general",
 		order: 1,
 		fields: [{
 			type: "info",
 			key: "driver-settings-unavailable-notice",
 			label: "Temporarily unavailable",
+			labelKey: "server:baseDeviceSection.s_driver-settings-unavailable.driver-settings-unavailable-notice.label",
 			content: "Driver settings are temporarily unavailable — the addon may be restarting. Refresh the page in a moment.",
 			variant: "warning"
 		}]
@@ -5546,6 +5582,250 @@ async function runLocationBackfillAtBoot(pctx, bootRows) {
 	});
 }
 //#endregion
+//#region src/builtins/device-manager/device-removal-hooks.ts
+/**
+* device-manager's side of `device-removal-hook` (D865): tell every implementer
+* a device was deleted, and answer the admin question "which stored data belongs
+* to devices that no longer exist?".
+*
+* Two entry points, one rule: **an implementer is told to delete only on a
+* recorded delete (a tombstone), or on an explicit operator confirm.** Nothing
+* here infers a deletion from a device being absent from a single read.
+*/
+/** The capability name implementers register under. */
+var DEVICE_REMOVAL_HOOK_CAP = "device-removal-hook";
+async function hookProviders(api) {
+	return (await api.addons.listCapabilityProviders.query({ capName: DEVICE_REMOVAL_HOOK_CAP })).map((p) => p.addonId);
+}
+/**
+* The removal step that calls every implementer. Each implementer is its own
+* nested step, so a failing one is retried by the bounded reconcile without
+* re-calling the others. Failing to ENUMERATE the implementers throws, and the
+* outer cleanup retries the whole step.
+*/
+function removalHookStep(deps, input) {
+	return {
+		store: "removal-hooks",
+		run: async () => {
+			const api = deps.api;
+			if (api === void 0) {
+				deps.logger.warn("removal hooks not called — no api on this context", { tags: { deviceId: input.deviceId } });
+				return 0;
+			}
+			const addonIds = await hookProviders(api);
+			if (addonIds.length === 0) return 0;
+			const steps = addonIds.map((addonId) => ({
+				store: `hook:${addonId}`,
+				run: async () => {
+					const result = await api.deviceRemovalHook.onDeviceRemoved.mutate({
+						...input,
+						addonId
+					});
+					return Object.values(result.counts).reduce((sum, n) => sum + n, 0);
+				}
+			}));
+			const report = await deps.cleanup.run(input.deviceId, steps);
+			return Object.values(report.counts).reduce((sum, n) => sum + n, 0);
+		}
+	};
+}
+/**
+* The ids device-manager knows, from TWO consistent reads (D49). Refuses when a
+* read throws, answers empty (an empty fleet and a failed read look the same),
+* or returns fewer ids than the ledger has rows (a malformed row is skipped by
+* the decoder, and a device skipped is a device whose data would be deleted).
+* The known set is the UNION of both reads: an id is absent only when BOTH
+* reads lack it.
+*/
+async function checkFleetTwice(reads) {
+	const known = /* @__PURE__ */ new Set();
+	for (const attempt of [1, 2]) {
+		let read;
+		try {
+			read = await reads.readFleet();
+		} catch (err) {
+			return {
+				ok: false,
+				reason: `device list read ${attempt} failed: ${require_dist.errMsg(err)}`
+			};
+		}
+		if (read.ids.length === 0) return {
+			ok: false,
+			reason: `device list read ${attempt} answered empty`
+		};
+		if (read.ids.length !== read.rowCount) return {
+			ok: false,
+			reason: `device list read ${attempt} returned ${read.ids.length} of ${read.rowCount} rows`
+		};
+		for (const id of read.ids) known.add(id);
+	}
+	return {
+		ok: true,
+		known
+	};
+}
+/** Stores holding data for devices that are not in `known`, grouped per device. */
+function orphanDevices(held, known) {
+	const byDevice = /* @__PURE__ */ new Map();
+	const holders = /* @__PURE__ */ new Set();
+	let overlap = 0;
+	for (const [, entry] of held) if (!holders.has(entry.deviceId)) {
+		holders.add(entry.deviceId);
+		if (known.has(entry.deviceId)) overlap += 1;
+	}
+	for (const [addonId, entry] of held) {
+		if (known.has(entry.deviceId) || entry.count === 0) continue;
+		const stores = byDevice.get(entry.deviceId) ?? {};
+		stores[`${addonId}:${entry.store}`] = (stores[`${addonId}:${entry.store}`] ?? 0) + entry.count;
+		byDevice.set(entry.deviceId, stores);
+	}
+	const idSpaceMismatch = holders.size >= 5 && overlap === 0;
+	return {
+		devices: [...byDevice.entries()].toSorted(([a], [b]) => a - b).map(([deviceId, stores]) => ({
+			deviceId,
+			stores
+		})),
+		idSpaceMismatch
+	};
+}
+/** The admin "Clean data of deleted devices" action: dry run unless `confirm`. */
+async function cleanupDeletedDevicesData(deps, input) {
+	const skipped = (reason, unreachable = []) => {
+		deps.logger.warn("cleanup of deleted devices data skipped — nothing listed or deleted", { meta: { reason } });
+		return {
+			status: "skipped",
+			reason,
+			devices: [],
+			unreachable: [...unreachable]
+		};
+	};
+	const api = deps.api;
+	if (api === void 0) return skipped("no api on this context");
+	const fleet = await checkFleetTwice(deps.reads);
+	if (!fleet.ok) return skipped(fleet.reason);
+	let addonIds;
+	try {
+		addonIds = await hookProviders(api);
+	} catch (err) {
+		return skipped(`implementers could not be listed: ${require_dist.errMsg(err)}`);
+	}
+	const unreachable = /* @__PURE__ */ new Set();
+	const held = [];
+	for (const addonId of addonIds) try {
+		for (const entry of await api.deviceRemovalHook.listDeviceData.query({ addonId })) held.push([addonId, entry]);
+	} catch (err) {
+		unreachable.add(addonId);
+		deps.logger.warn("cleanup of deleted devices data: an implementer did not answer", { meta: {
+			addonId,
+			error: require_dist.errMsg(err)
+		} });
+	}
+	if (deps.settings !== void 0) try {
+		for (const scope of await deps.settings.list()) held.push(["settings", {
+			store: scope.addonId,
+			deviceId: scope.deviceId,
+			count: 1
+		}]);
+	} catch (err) {
+		return skipped(`device settings could not be listed: ${require_dist.errMsg(err)}`, [...unreachable]);
+	}
+	const { devices, idSpaceMismatch } = orphanDevices(held, fleet.known);
+	if (idSpaceMismatch) return skipped("none of the device ids holding data is a known device — the id space looks wrong, refusing", [...unreachable]);
+	if (!input.confirm) {
+		deps.logger.info("cleanup of deleted devices data: dry run", { meta: {
+			devices: devices.length,
+			unreachable: [...unreachable]
+		} });
+		return {
+			status: "dry-run",
+			reason: null,
+			devices: [...devices],
+			unreachable: [...unreachable]
+		};
+	}
+	const now = (deps.now ?? (() => Date.now()))();
+	const cleaned = [];
+	for (const device of devices) {
+		const deleted = {};
+		for (const addonId of addonIds) try {
+			const result = await api.deviceRemovalHook.onDeviceRemoved.mutate({
+				addonId,
+				deviceId: device.deviceId,
+				deletedAt: now,
+				providerAddonId: "unknown"
+			});
+			for (const [store, count] of Object.entries(result.counts)) deleted[`${addonId}:${store}`] = count;
+		} catch (err) {
+			deps.logger.warn("cleanup of deleted devices data: an implementer failed", {
+				tags: { deviceId: device.deviceId },
+				meta: {
+					addonId,
+					error: require_dist.errMsg(err)
+				}
+			});
+		}
+		if (deps.settings !== void 0 && Object.keys(device.stores).some((k) => k.startsWith("settings:"))) try {
+			deleted["settings"] = await deps.settings.clear(device.deviceId);
+		} catch (err) {
+			deps.logger.warn("cleanup of deleted devices data: settings not cleared", {
+				tags: { deviceId: device.deviceId },
+				meta: { error: require_dist.errMsg(err) }
+			});
+		}
+		deps.logger.info("cleaned data of a device deleted before tombstones", {
+			tags: { deviceId: device.deviceId },
+			meta: { counts: deleted }
+		});
+		cleaned.push({
+			deviceId: device.deviceId,
+			stores: deleted
+		});
+	}
+	return {
+		status: "cleaned",
+		reason: null,
+		devices: cleaned,
+		unreachable: [...unreachable]
+	};
+}
+/** The settings-store collection every addon's per-device settings share. */
+var ADDON_DEVICE_SETTINGS_COLLECTION = "addon-device-settings";
+/** The engine's hard ceiling on one read; a result this long may be a truncated one. */
+var SCOPE_READ_LIMIT = 2e4;
+/** Scope access over the settings store; undefined when the store is unavailable. */
+function settingsScopes(store) {
+	if (store === void 0) return void 0;
+	return {
+		list: async () => {
+			const rows = await store.query.query({
+				collection: ADDON_DEVICE_SETTINGS_COLLECTION,
+				filter: { limit: SCOPE_READ_LIMIT }
+			});
+			if (rows.length >= SCOPE_READ_LIMIT) throw new Error(`the settings read returned ${rows.length} rows — possibly truncated`);
+			const seen = /* @__PURE__ */ new Map();
+			for (const row of rows) {
+				const addonId = row.data["addonId"];
+				const raw = row.data["deviceId"];
+				if (typeof addonId !== "string" || typeof raw !== "string") continue;
+				const deviceId = Number(raw);
+				if (!Number.isInteger(deviceId) || deviceId <= 0) continue;
+				seen.set(`${addonId}:${deviceId}`, {
+					deviceId,
+					addonId
+				});
+			}
+			return [...seen.values()];
+		},
+		clear: async (deviceId) => {
+			const { deleted } = await store.deleteWhere.mutate({
+				collection: ADDON_DEVICE_SETTINGS_COLLECTION,
+				filter: { where: { deviceId: String(deviceId) } }
+			});
+			return deleted;
+		}
+	};
+}
+//#endregion
 //#region src/builtins/device-manager/device-meta-actions.ts
 /**
 * Device meta-mutation + persistence actions for the device-manager addon —
@@ -5944,6 +6224,91 @@ async function registerDevice(pctx, input) {
 		}
 	});
 }
+/**
+* The stores device-manager (or the keychain, for secrets) keeps for a device.
+* Another addon's own per-device data is cleaned by that addon, off
+* `DeviceUnregistered` — the kernel never reaches into its tables (D864).
+*/
+function removalSteps(pctx, deviceId, providerAddonId, deletedAt) {
+	const secrets = pctx.host.ctx.secrets;
+	return [
+		{
+			store: "tombstone",
+			run: async () => {
+				await pctx.tombstones.record({
+					deviceId,
+					deletedAt,
+					providerAddonId
+				});
+				return 1;
+			}
+		},
+		{
+			store: "keychain-secrets",
+			run: async () => {
+				const purge = secrets?.deleteDeviceScope;
+				if (purge === void 0) {
+					pctx.host.ctx.logger.warn("device secrets not purged — no keychain door", { tags: { deviceId } });
+					return 0;
+				}
+				return (await purge(deviceId)).length;
+			}
+		},
+		{
+			store: "device-config",
+			run: async () => {
+				const stored = await pctx.settings.readDeviceStore(deviceId);
+				await pctx.settings.clearDeviceStore(deviceId);
+				return Object.keys(stored).length;
+			}
+		},
+		{
+			store: "addon-device-settings",
+			run: async () => {
+				const api = pctx.host.ctx.api?.settingsStore;
+				if (api === void 0) throw new Error("settings-store api not available");
+				const { deleted } = await api.deleteWhere.mutate({
+					collection: "addon-device-settings",
+					filter: { where: { deviceId: String(deviceId) } }
+				});
+				return deleted;
+			}
+		},
+		{
+			store: "runtime-state",
+			run: async () => {
+				await pctx.host.forgetMirrorDevice(deviceId);
+				const stored = await pctx.settings.readDeviceRuntimeState(deviceId);
+				await pctx.settings.clearDeviceRuntimeState(deviceId);
+				return Object.keys(stored).length;
+			}
+		},
+		{
+			store: "field-claims",
+			run: async () => {
+				await pctx.host.fieldClaims.pruneDevice(deviceId, pctx.settings);
+				return 0;
+			}
+		},
+		{
+			store: "bindings",
+			run: () => pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+				const key = String(deviceId);
+				const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
+				const slice = bindingsStore.deviceBindings[key];
+				if (!slice) return 0;
+				const { [key]: _removed, ...rest } = bindingsStore.deviceBindings;
+				await writeBindingsStore(pctx.bindingsDeps, { deviceBindings: rest });
+				return Object.keys(slice).length;
+			})
+		},
+		removalHookStep(pctx.removalHooks, {
+			deviceId,
+			deletedAt,
+			providerAddonId
+		})
+	];
+}
 async function removeDevice(pctx, input) {
 	const { deviceId } = input;
 	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
@@ -5959,17 +6324,7 @@ async function removeDevice(pctx, input) {
 		});
 	});
 	pctx.secretConfigPaths.delete(deviceId);
-	await pctx.settings.clearDeviceStore(deviceId);
-	await pctx.host.forgetMirrorDevice(deviceId);
-	await pctx.settings.clearDeviceRuntimeState(deviceId);
-	await pctx.host.fieldClaims.pruneDevice(deviceId, pctx.settings);
-	const bindingKey = String(deviceId);
-	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
-		const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
-		if (!bindingsStore.deviceBindings[bindingKey]) return;
-		const { [bindingKey]: _removedBindings, ...restBindings } = bindingsStore.deviceBindings;
-		await writeBindingsStore(pctx.bindingsDeps, { deviceBindings: restBindings });
-	});
+	await pctx.removalCleanup.run(deviceId, removalSteps(pctx, deviceId, addonId, Date.now()));
 	pctx.host.remoteNativeCaps.delete(deviceId);
 	pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(deviceId);
 	pctx.metaStore.idToAddonId.delete(deviceId);
@@ -6666,7 +7021,7 @@ async function listLocations(pctx) {
 */
 async function addLocation(pctx, input) {
 	const trimmed = input.name.trim();
-	if (trimmed.length === 0) throw new Error("[device-manager] addLocation: name must be non-empty");
+	if (trimmed.length === 0) throw require_dist.userError("system.location-name-required", void 0, "[device-manager] addLocation: name must be non-empty");
 	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
 		const current = (await pctx.metaStore.readStore()).locations ?? [];
 		if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
@@ -6712,7 +7067,7 @@ async function listLocationIcons(pctx) {
 */
 async function setLocationIcon(pctx, input) {
 	const trimmed = input.location.trim();
-	if (trimmed.length === 0) throw new Error("[device-manager] setLocationIcon: location must be non-empty");
+	if (trimmed.length === 0) throw require_dist.userError("system.location-required", void 0, "[device-manager] setLocationIcon: location must be non-empty");
 	const key = require_dist.locationIconKey(trimmed);
 	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
 		const icons = (await pctx.metaStore.readStore()).locationIcons ?? {};
@@ -6812,7 +7167,7 @@ async function listSiteZones(pctx) {
 */
 async function setSiteZone(pctx, input) {
 	const label = input.name.trim();
-	if (label.length === 0) throw new Error("[device-manager] setSiteZone: name must be non-empty");
+	if (label.length === 0) throw require_dist.userError("system.site-zone-name-required", void 0, "[device-manager] setSiteZone: name must be non-empty");
 	const key = require_dist.siteZoneKey(label);
 	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
 		const zones = (await pctx.metaStore.readStore()).siteZones ?? {};
@@ -8299,6 +8654,181 @@ var DeviceRowStore = class {
 	}
 };
 //#endregion
+//#region src/builtins/device-manager/device-tombstone-store.ts
+/**
+* The tombstones of deleted devices (D865).
+*
+* A device DELETE is a fact other addons must be able to learn reliably, long
+* after the `DeviceUnregistered` event (telemetry, droppable — D8/D11) is gone.
+* device-manager is the only authority on whether a device exists, so the record
+* of a deletion lives here, in its own collection, beside the device ledger.
+*
+* ## What a tombstone is NOT
+*
+* It is not "the device is unregistered / offline / its provider is restarting".
+* Those are states of a device that still exists; only {@link record}'s one
+* caller — `removeDevice`, the single door every delete converges on — writes a
+* tombstone. Anything that reconciles from tombstones therefore can never
+* destroy data of a device that merely went quiet.
+*
+* ## Expiry
+*
+* {@link DEVICE_TOMBSTONE_RETENTION_MS} (90 days). A tombstone older than that
+* is deleted the next time one is written or read. Ninety days is generous on
+* purpose: an addon that stayed disabled for a quarter still learns of the
+* deletions on its return. Data of a device deleted longer ago than that is
+* reachable only by the admin "clean data of deleted devices" action.
+*/
+/**
+* @durable class=ledger owner=device-manager
+*   write="`removeDevice` records one row per deleted device (key = device id) after the
+*     device row is gone"
+*   retention="90 days (`DEVICE_TOMBSTONE_RETENTION_MS`), pruned whenever a tombstone is
+*     written or the list is read. Bounded by the deletions an operator makes in a quarter."
+*/
+var DEVICE_TOMBSTONES_COLLECTION = "device-manager:tombstones";
+var DEVICE_TOMBSTONE_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "deletedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "providerAddonId",
+		type: "TEXT",
+		notNull: true
+	}
+];
+var DEVICE_TOMBSTONE_INDEXES = [{
+	name: "idx_dm_tombstones_deleted_at",
+	columns: ["deletedAt"]
+}];
+/** More than the engine's default row cap, so a read is never silently truncated. */
+var TOMBSTONE_READ_LIMIT = 2e4;
+function decodeTombstone(raw) {
+	const deviceId = raw["deviceId"];
+	const deletedAt = raw["deletedAt"];
+	const providerAddonId = raw["providerAddonId"];
+	if (typeof deviceId !== "number" || !Number.isInteger(deviceId) || deviceId <= 0) return null;
+	if (typeof deletedAt !== "number" || typeof providerAddonId !== "string") return null;
+	return {
+		deviceId,
+		deletedAt,
+		providerAddonId
+	};
+}
+var DeviceTombstoneStore = class {
+	backend;
+	logger;
+	now;
+	retentionMs;
+	declared = null;
+	constructor(opts) {
+		this.backend = opts.backend;
+		this.logger = opts.logger;
+		this.now = opts.now ?? (() => Date.now());
+		this.retentionMs = opts.retentionMs ?? 7776e6;
+	}
+	/**
+	* Declare the collection now. Idempotent; a rejection is not latched.
+	*
+	* Called at device-manager init (D871) so the table exists on a hub that has
+	* not deleted a device yet. It used to be declared only by the first
+	* `record` / `listSince`, i.e. by the first delete or by an implementer's
+	* reconcile — so a hub whose implementers had not been redeployed, and where
+	* nothing was deleted, never had the table, and the census read that as
+	* "D865 is not running". A DECLARATION only: nothing is read, written or
+	* purged here.
+	*/
+	declare() {
+		if (this.declared !== null) return this.declared;
+		const run = this.backend.declareCollection({
+			collection: DEVICE_TOMBSTONES_COLLECTION,
+			columns: DEVICE_TOMBSTONE_COLUMNS,
+			indexes: DEVICE_TOMBSTONE_INDEXES
+		}).catch((err) => {
+			this.declared = null;
+			throw err;
+		});
+		this.declared = run;
+		return run;
+	}
+	/** Record a deletion. Re-recording the same id keeps the EARLIER `deletedAt`. */
+	async record(tombstone) {
+		await this.declare();
+		const key = String(tombstone.deviceId);
+		const existing = await this.backend.get({
+			collection: DEVICE_TOMBSTONES_COLLECTION,
+			key
+		});
+		if ((isPlainObject(existing) ? decodeTombstone(existing) : null) === null) await this.backend.set({
+			collection: DEVICE_TOMBSTONES_COLLECTION,
+			key,
+			value: {
+				deviceId: tombstone.deviceId,
+				deletedAt: tombstone.deletedAt,
+				providerAddonId: tombstone.providerAddonId
+			}
+		});
+		await this.pruneExpired();
+	}
+	/** Tombstones with `deletedAt >= sinceMs`, oldest first. Expired ones are pruned first. */
+	async listSince(sinceMs) {
+		await this.declare();
+		await this.pruneExpired();
+		const floor = Math.max(sinceMs, this.now() - this.retentionMs);
+		const rows = await this.backend.query({
+			collection: DEVICE_TOMBSTONES_COLLECTION,
+			filter: {
+				whereBetween: { deletedAt: [floor, Number.MAX_SAFE_INTEGER] },
+				orderBy: {
+					field: "deletedAt",
+					direction: "asc"
+				},
+				limit: TOMBSTONE_READ_LIMIT
+			}
+		});
+		const out = [];
+		for (const row of rows) {
+			const decoded = decodeTombstone(row.data);
+			if (decoded !== null) out.push(decoded);
+		}
+		return out;
+	}
+	/** Delete tombstones older than the retention window. Best-effort: a failure is logged. */
+	async pruneExpired() {
+		try {
+			const cutoff = this.now() - this.retentionMs;
+			const stale = await this.backend.query({
+				collection: DEVICE_TOMBSTONES_COLLECTION,
+				filter: {
+					whereBetween: { deletedAt: [0, cutoff - 1] },
+					limit: TOMBSTONE_READ_LIMIT
+				}
+			});
+			for (const row of stale) await this.backend.delete({
+				collection: DEVICE_TOMBSTONES_COLLECTION,
+				key: row.id
+			});
+			return stale.length;
+		} catch (err) {
+			this.logger.warn("device tombstone prune failed — retried on the next write", { meta: { error: require_dist.errMsg(err) } });
+			return 0;
+		}
+	}
+};
+//#endregion
 //#region src/builtins/device-manager/device-state-claims.ts
 function createDeviceStateClaimMethods(deps) {
 	const { mirror, index, settings, logger } = deps;
@@ -9765,6 +10295,119 @@ function createMigrationGuard(now = Date.now) {
 		}
 	};
 }
+//#endregion
+//#region src/builtins/device-manager/removal-cleanup.ts
+/**
+* What a device removal leaves behind is cleaned AT REMOVAL, by steps that
+* cannot block one another (D864).
+*
+* `removeDevice` used to run its clean-up as one straight line: the first step
+* that threw skipped every later one, and the keychain was not in the line at
+* all — a device-scoped secret (`secret://provider-dreame/device/4483/…`)
+* outlived its device for good. Each store is a {@link RemovalStep} now: run
+* independently, counted, logged ONCE per device with `tags: { deviceId }`,
+* and a step that failed is retried by a BOUNDED in-memory reconcile
+* (a few attempts, growing delays, then it gives up loudly).
+*
+* There is deliberately no boot-time sweep (the operator forbids purges on
+* boot): a retry that dies with the process is picked up by the keychain
+* admin's orphan listing (System -> Secrets), which names a device-scoped
+* secret whose device no longer points at it.
+*/
+/** Retry delays after a failed step; the list length bounds the attempts. */
+var REMOVAL_RETRY_DELAYS_MS = [
+	3e4,
+	12e4,
+	6e5
+];
+async function attempt(steps) {
+	const counts = {};
+	const failed = [];
+	const errors = {};
+	for (const step of steps) try {
+		counts[step.store] = await step.run();
+	} catch (err) {
+		failed.push(step);
+		errors[step.store] = require_dist.errMsg(err);
+	}
+	return {
+		counts,
+		failed,
+		errors
+	};
+}
+function createRemovalCleanup(opts) {
+	const label = opts.label ?? "device removal cleanup";
+	const delays = opts.retryDelaysMs ?? REMOVAL_RETRY_DELAYS_MS;
+	const setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+	const clearTimer = opts.clearTimer ?? ((handle) => clearTimeout(handle));
+	const pending = /* @__PURE__ */ new Set();
+	let disposed = false;
+	const schedule = (deviceId, steps, retryIndex, first) => {
+		if (disposed) return;
+		const delay = delays[retryIndex];
+		if (delay === void 0) {
+			opts.logger.error(`${label} gave up — the data stays until cleaned by hand`, {
+				tags: { deviceId },
+				meta: {
+					stores: steps.map((s) => s.store),
+					attempts: retryIndex + (first ? 1 : 0)
+				}
+			});
+			return;
+		}
+		const handle = setTimer(() => {
+			pending.delete(handle);
+			retry(deviceId, steps, retryIndex);
+		}, delay);
+		handle.unref?.();
+		pending.add(handle);
+	};
+	const retry = async (deviceId, steps, retryIndex) => {
+		const result = await attempt(steps);
+		opts.logger.info(`${label} retried`, {
+			tags: { deviceId },
+			meta: {
+				counts: result.counts,
+				failed: result.failed.map((s) => s.store),
+				retryIndex
+			}
+		});
+		if (result.failed.length > 0) schedule(deviceId, result.failed, retryIndex + 1, false);
+	};
+	return {
+		async run(deviceId, steps) {
+			const result = await attempt(steps);
+			const failedStores = result.failed.map((s) => s.store);
+			const meta = {
+				counts: result.counts,
+				failed: failedStores,
+				errors: result.errors
+			};
+			if (failedStores.length === 0) opts.logger.info(label, {
+				tags: { deviceId },
+				meta
+			});
+			else {
+				opts.logger.warn(`${label} incomplete — failed steps are retried`, {
+					tags: { deviceId },
+					meta
+				});
+				schedule(deviceId, result.failed, 0, true);
+			}
+			return {
+				deviceId,
+				counts: result.counts,
+				failed: failedStores
+			};
+		},
+		dispose() {
+			disposed = true;
+			for (const handle of pending) clearTimer(handle);
+			pending.clear();
+		}
+	};
+}
 function pairKey(addonId, stableId) {
 	return `${addonId}${stableId}`;
 }
@@ -9887,6 +10530,9 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 	* `allocateDeviceId` never consults.
 	*/
 	removalFence = createRemovalFence();
+	/** Store-by-store clean-up of a removed device, with a bounded retry (D864). */
+	removalCleanupImpl = null;
+	removalHooksCleanupImpl = null;
 	/** Declared secret config paths per device, as last registered (D783). */
 	secretConfigPaths = createSecretConfigPathRegistry();
 	/** The keychain side of driver device forms (D789), wired in onInitialize. */
@@ -10098,6 +10744,15 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 		const deviceRows = new DeviceRowStore(deviceRowBackendOf(settingsStoreApi), this.ctx.logger.child("rows"));
 		await deviceRows.declare();
 		this.deviceRows = deviceRows;
+		const tombstones = new DeviceTombstoneStore({
+			backend: deviceRowBackendOf(settingsStoreApi),
+			logger: this.ctx.logger.child("tombstones")
+		});
+		try {
+			await tombstones.declare();
+		} catch (err) {
+			this.ctx.logger.warn("device tombstones collection not declared at init — retried on first use", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
 		this.staleWrapperActivations.checkOnce(() => readBindingsStore(this.bindingsDeps));
 		try {
 			await require_retired_settings_keys.purgeRetiredSettingsRows(deviceRows.retiredRowStore(), this.ctx.logger.child("RetiredRows"));
@@ -10133,6 +10788,13 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			bindingsDeps: this.bindingsDeps,
 			migrationGuard: createMigrationGuard(),
 			removalFence: this.removalFence,
+			removalCleanup: this.removalCleanup,
+			tombstones,
+			removalHooks: {
+				api: this.ctx.api,
+				logger: this.ctx.logger,
+				cleanup: this.removalHooksCleanup
+			},
 			secretConfigPaths: this.secretConfigPaths,
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
@@ -10166,6 +10828,18 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			migrateDevice: (input) => migrateDevice(pctx, input),
 			registerDevice: (input) => registerDevice(pctx, input),
 			removeDevice: (input) => removeDevice(pctx, input),
+			listDeletedSince: ({ sinceMs }) => tombstones.listSince(sinceMs),
+			cleanupDeletedDevicesData: (input) => cleanupDeletedDevicesData({
+				api: this.ctx.api,
+				logger: this.ctx.logger,
+				settings: settingsScopes(this.ctx.api?.settingsStore),
+				reads: { readFleet: async () => {
+					return {
+						ids: (await deviceRows.listAll()).map((r) => r.meta.id),
+						rowCount: await deviceRows.count()
+					};
+				} }
+			}, input),
 			persistConfig: (input) => persistConfig(pctx, input),
 			loadConfig: (input) => loadConfig(pctx, input),
 			loadMeta: (input) => loadMeta(pctx, input),
@@ -10389,7 +11063,22 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			}
 		];
 	}
+	get removalCleanup() {
+		if (this.removalCleanupImpl === null) this.removalCleanupImpl = createRemovalCleanup({ logger: this.ctx.logger });
+		return this.removalCleanupImpl;
+	}
+	get removalHooksCleanup() {
+		if (this.removalHooksCleanupImpl === null) this.removalHooksCleanupImpl = createRemovalCleanup({
+			logger: this.ctx.logger,
+			label: "device removal hooks"
+		});
+		return this.removalHooksCleanupImpl;
+	}
 	async onShutdown() {
+		this.removalCleanupImpl?.dispose();
+		this.removalCleanupImpl = null;
+		this.removalHooksCleanupImpl?.dispose();
+		this.removalHooksCleanupImpl = null;
 		this.propagator?.stop();
 		this.propagator = null;
 		this.uninstallStatusOverlay?.();