@camstack/system 1.2.455 → 1.2.456

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -4,17 +4,16 @@ export declare class LocalAuthAddon extends BaseAddon {
 	private authManager;
 	private userManager;
 	private apiKeyManager;
-	private scopedTokenManager;
 	private oauthSessionManager;
 	private reapTimer;
 	private totpManager;
 	private externalIdentities;
 	private signingKeyKeeper;
 	private loginSessions;
-	private adminTokens;
 	private auditLog;
 	private deviceCredentials;
 	private deviceCa;
+	private preferences;
 	constructor();
 	protected onInitialize(): Promise<ProviderRegistration[]>;
 	private readDeviceCertificateSettings;
@@ -35,13 +34,13 @@ export declare class LocalAuthAddon extends BaseAddon {
 	*/
 	private endAllAccess;
 	/**
-	* Drop auth rows that are dead but were never removed: scoped tokens past
-	* their expiry, and OAuth sessions revoked longer ago than
-	* {@link OAUTH_REVOKED_RETENTION_MS}.
+	* Drop auth rows that are dead but were never removed: OAuth sessions
+	* revoked longer ago than {@link OAUTH_REVOKED_RETENTION_MS}, dead login
+	* sessions, old audit rows, dead device credentials. (Tokens are the hub's
+	* `credential-tokens` rows, reaped there.)
 	*
-	* Neither row could authorise anything — `validate` rejects an expired
-	* token, and every consumer treats a missing session exactly like a revoked
-	* one. So this is hygiene, and it is best-effort: a failed sweep is logged
+	* No such row could authorise anything — every consumer treats a missing
+	* session exactly like a revoked one. So this is hygiene, and it is best-effort: a failed sweep is logged
 	* and the next tick tries again. It must never be able to fail boot.
 	*/
 	private reapAuthRows;