@camstack/types 1.2.450 → 1.2.452

package/dist/interfaces/addon.d.ts

@@ -895,6 +895,22 @@ export interface ICamstackAddon {
      * stays the one bare key. See `addon-settings.cap.ts`.
      */
     getIntegrationSettings?(nodeId?: string): Promise<ConfigUISchemaWithValues | null>;
+    /**
+     * Stale-data audit: the global-settings keys this addon still declares,
+     * answered in its own process. See `BaseAddon.getDeclaredSettingsKeys`.
+     */
+    getDeclaredSettingsKeys?(): Promise<{
+        readonly keys: readonly string[];
+    }>;
+    /** Stale-data audit: remove stored keys the addon no longer declares. */
+    unsetStoredSettingsKeys?(keys: readonly string[]): Promise<{
+        readonly removed: readonly string[];
+        readonly refused: ReadonlyArray<{
+            readonly key: string;
+            readonly reason: string;
+        }>;
+        readonly secretsCleared: number;
+    }>;
     /** Level 2 — per-device settings (schema + values). Appears in
      *  Device Overrides. */
     getDeviceSettings?(deviceId: number): Promise<ConfigUISchemaWithValues>;

package/dist/interfaces/config-ui-secrets.d.ts

@@ -45,14 +45,16 @@ export declare function isKeychainStoredField(field: ConfigField): boolean;
  * inside `group` / `sub-tabs` containers.
  */
 export declare function collectSecretConfigKeys(schema: unknown): ReadonlySet<string>;
+/** Drop fields marked `omitFromSettings` before an integration settings write. */
+export declare function omitTransientConfig(schema: unknown, config: Record<string, unknown>): Record<string, unknown>;
 /**
- * Every top-level config key whose value the KEYCHAIN stores (D787) —
+ * Every config key whose value the KEYCHAIN stores (D787) —
  * {@link collectSecretConfigKeys} minus `storage: 'inline'` and minus JSON
  * blobs (see {@link isKeychainStoredField}). What a form sends as
  * `secretKeys` so the owner's door knows which values to keep out of the blob.
+ * A secret inside an `editable-array` row is named by its id-addressed path
+ * (`boards[id].encryptionKey`).
  */
-/** Drop fields marked `omitFromSettings` before an integration settings write. */
-export declare function omitTransientConfig(schema: unknown, config: Record<string, unknown>): Record<string, unknown>;
 export declare function collectKeychainStoredKeys(schema: unknown): ReadonlySet<string>;
 /**
  * True when the value is a readable schema declaring at least one field of any

package/dist/node.js

@@ -21,8 +21,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_composition = require("./composition-CO6Sak-s.js");
-const require_err_msg = require("./err-msg-EJhsFHqa.js");
+const require_composition = require("./composition-tP-vAKqU.js");
+const require_err_msg = require("./err-msg-DkPZXb-g.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = __toESM(node_fs);

package/dist/node.mjs

@@ -1,5 +1,5 @@
-import { Bn as getFfmpegDownloadUrl, Fn as FFMPEG_PATH_ENV, Hn as Fmp4BoxSplitter, In as chooseFfmpegBinary, L as compositionSourceKey, Ln as ffmpegBinaryName, Rn as FFMPEG_RELEASE, Vn as canonicalHash, Zn as isSoftwareDecode, a as CUSTOMIZATION_BLOCK_NAME_PREFIX, qn as buildFfmpegArgs, zn as getFfmpegArtifact } from "./composition-kSuOifuG.mjs";
-import { t as errMsg } from "./err-msg-DWXWc0Di.mjs";
+import { Bn as getFfmpegDownloadUrl, Fn as FFMPEG_PATH_ENV, Hn as Fmp4BoxSplitter, In as chooseFfmpegBinary, L as compositionSourceKey, Ln as ffmpegBinaryName, Rn as FFMPEG_RELEASE, Vn as canonicalHash, Zn as isSoftwareDecode, a as CUSTOMIZATION_BLOCK_NAME_PREFIX, qn as buildFfmpegArgs, zn as getFfmpegArtifact } from "./composition-C7WdThmP.mjs";
+import { t as errMsg } from "./err-msg-BD5buxvT.mjs";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs from "node:fs";
 import { chmodSync, copyFileSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";

package/dist/{sleep-BSPhInRm.js → sleep-CewR0zRz.js}

@@ -150,12 +150,6 @@ function collectSecretConfigKeys(schema) {
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
 	return keys;
 }
-/**
-* Every top-level config key whose value the KEYCHAIN stores (D787) —
-* {@link collectSecretConfigKeys} minus `storage: 'inline'` and minus JSON
-* blobs (see {@link isKeychainStoredField}). What a form sends as
-* `secretKeys` so the owner's door knows which values to keep out of the blob.
-*/
 /** Drop fields marked `omitFromSettings` before an integration settings write. */
 function omitTransientConfig(schema, config) {
 	const omit = /* @__PURE__ */ new Set();
@@ -180,6 +174,14 @@ function collectOmitted(field, out) {
 		for (const tab of tabs) for (const child of fieldsOf(tab)) collectOmitted(child, out);
 	}
 }
+/**
+* Every config key whose value the KEYCHAIN stores (D787) —
+* {@link collectSecretConfigKeys} minus `storage: 'inline'` and minus JSON
+* blobs (see {@link isKeychainStoredField}). What a form sends as
+* `secretKeys` so the owner's door knows which values to keep out of the blob.
+* A secret inside an `editable-array` row is named by its id-addressed path
+* (`boards[id].encryptionKey`).
+*/
 function collectKeychainStoredKeys(schema) {
 	const keys = /* @__PURE__ */ new Set();
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkKeychainField(field, keys);
@@ -192,6 +194,17 @@ function walkKeychainField(field, out) {
 	const isSecret = type === "password" || field["secret"] === true;
 	const isJsonBlob = type === "textarea" && field["isJson"] === true;
 	if (isSecret && !isJsonBlob && field["storage"] !== "inline" && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "editable-array" && typeof key === "string" && key.length > 0) {
+		const idKey = typeof field["itemIdKey"] === "string" ? field["itemIdKey"] : "id";
+		const itemFields = field["itemFields"];
+		if (!Array.isArray(itemFields)) return;
+		for (const item of itemFields) {
+			const members = /* @__PURE__ */ new Set();
+			walkKeychainField(item, members);
+			for (const member of members) out.add(`${key}[${idKey}].${member}`);
+		}
+		return;
+	}
 	if (type === "group") {
 		for (const child of fieldsOf(field)) walkKeychainField(child, out);
 		return;
@@ -2414,6 +2427,7 @@ var BaseAddon = class {
 	* a warning and falls back rather than crashing boot.
 	*/
 	state(key, schema, fallback) {
+		this._declaredStateKeys.add(key);
 		return createDurableState({
 			key,
 			schema,
@@ -2429,6 +2443,96 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** Durable-state keys this process registered through {@link state}. */
+	_declaredStateKeys = /* @__PURE__ */ new Set();
+	/**
+	* Stale-data audit: every global-settings key this addon still declares —
+	* constructor defaults, settings-schema fields (layout containers included),
+	* durable-state keys and the root of each `secretStatePaths` entry. Answered
+	* here, in the addon's own process, so the hub keeps no copy of it.
+	*/
+	async getDeclaredSettingsKeys() {
+		return { keys: [...this.declaredKeySet()].toSorted() };
+	}
+	declaredKeySet() {
+		const keys = new Set(Object.keys(this.defaults));
+		const schema = this.globalSettingsSchema();
+		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
+		for (const key of this._declaredStateKeys) keys.add(key);
+		for (const path of this.secretStatePaths) {
+			const root = path.split(/[.[]/, 1)[0];
+			if (root) keys.add(root);
+		}
+		return keys;
+	}
+	/**
+	* Stale-data audit: remove stored global-settings keys the addon no longer
+	* declares, and clear the keychain values their markers held — except a value
+	* a surviving key still points at. A declared or absent key is refused.
+	*/
+	async unsetStoredSettingsKeys(keys) {
+		const settings = this._ctx?.settings;
+		const raw = this.rawSettings();
+		if (!settings || !raw) return {
+			removed: [],
+			refused: keys.map((key) => ({
+				key,
+				reason: "no settings store"
+			})),
+			secretsCleared: 0
+		};
+		let stored;
+		try {
+			stored = await raw.readAddonStore();
+		} catch (error) {
+			const reason = `store unreadable: ${error instanceof Error ? error.message : "unknown"}`;
+			return {
+				removed: [],
+				refused: keys.map((key) => ({
+					key,
+					reason
+				})),
+				secretsCleared: 0
+			};
+		}
+		const declared = this.declaredKeySet();
+		const removed = [];
+		const refused = [];
+		for (const key of keys) {
+			const base = key.split("@", 1)[0] ?? key;
+			if (declared.has(base)) refused.push({
+				key,
+				reason: "still declared by the addon"
+			});
+			else if (!(key in stored)) refused.push({
+				key,
+				reason: "not stored"
+			});
+			else removed.push(key);
+		}
+		if (removed.length === 0) return {
+			removed,
+			refused,
+			secretsCleared: 0
+		};
+		const kept = /* @__PURE__ */ new Set();
+		const held = /* @__PURE__ */ new Set();
+		for (const [key, value] of Object.entries(stored)) {
+			const target = removed.includes(key) ? held : kept;
+			for (const ref of collectSecretMarkerRefs(value)) target.add(ref);
+		}
+		const refsToClear = [...held].filter((ref) => !kept.has(ref));
+		const patch = {};
+		for (const key of removed) patch[key] = void 0;
+		await settings.writeAddonStore(patch);
+		const secretsCleared = refsToClear.length > 0 && this._ctx?.secrets ? await this._ctx.secrets.delete(refsToClear) : 0;
+		await this.resolveConfig();
+		return {
+			removed,
+			refused,
+			secretsCleared
+		};
+	}
 	/** Per-device variant of {@link state}, backed by the per-device store. */
 	deviceState(deviceId, key, schema, fallback) {
 		return createDurableState({
@@ -2699,6 +2803,21 @@ function dropPerNodeFields(fields) {
 	}
 	return kept;
 }
+function collectFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectFieldKeys(tab.fields));
+			continue;
+		}
+		if ("key" in field && typeof field.key === "string") collected.push(field.key);
+	}
+	return collected;
+}
 function collectPerNodeFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {

package/dist/{sleep-63gM_1JR.mjs → sleep-CeyhrcOk.mjs}

@@ -150,12 +150,6 @@ function collectSecretConfigKeys(schema) {
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
 	return keys;
 }
-/**
-* Every top-level config key whose value the KEYCHAIN stores (D787) —
-* {@link collectSecretConfigKeys} minus `storage: 'inline'` and minus JSON
-* blobs (see {@link isKeychainStoredField}). What a form sends as
-* `secretKeys` so the owner's door knows which values to keep out of the blob.
-*/
 /** Drop fields marked `omitFromSettings` before an integration settings write. */
 function omitTransientConfig(schema, config) {
 	const omit = /* @__PURE__ */ new Set();
@@ -180,6 +174,14 @@ function collectOmitted(field, out) {
 		for (const tab of tabs) for (const child of fieldsOf(tab)) collectOmitted(child, out);
 	}
 }
+/**
+* Every config key whose value the KEYCHAIN stores (D787) —
+* {@link collectSecretConfigKeys} minus `storage: 'inline'` and minus JSON
+* blobs (see {@link isKeychainStoredField}). What a form sends as
+* `secretKeys` so the owner's door knows which values to keep out of the blob.
+* A secret inside an `editable-array` row is named by its id-addressed path
+* (`boards[id].encryptionKey`).
+*/
 function collectKeychainStoredKeys(schema) {
 	const keys = /* @__PURE__ */ new Set();
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkKeychainField(field, keys);
@@ -192,6 +194,17 @@ function walkKeychainField(field, out) {
 	const isSecret = type === "password" || field["secret"] === true;
 	const isJsonBlob = type === "textarea" && field["isJson"] === true;
 	if (isSecret && !isJsonBlob && field["storage"] !== "inline" && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "editable-array" && typeof key === "string" && key.length > 0) {
+		const idKey = typeof field["itemIdKey"] === "string" ? field["itemIdKey"] : "id";
+		const itemFields = field["itemFields"];
+		if (!Array.isArray(itemFields)) return;
+		for (const item of itemFields) {
+			const members = /* @__PURE__ */ new Set();
+			walkKeychainField(item, members);
+			for (const member of members) out.add(`${key}[${idKey}].${member}`);
+		}
+		return;
+	}
 	if (type === "group") {
 		for (const child of fieldsOf(field)) walkKeychainField(child, out);
 		return;
@@ -2414,6 +2427,7 @@ var BaseAddon = class {
 	* a warning and falls back rather than crashing boot.
 	*/
 	state(key, schema, fallback) {
+		this._declaredStateKeys.add(key);
 		return createDurableState({
 			key,
 			schema,
@@ -2429,6 +2443,96 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** Durable-state keys this process registered through {@link state}. */
+	_declaredStateKeys = /* @__PURE__ */ new Set();
+	/**
+	* Stale-data audit: every global-settings key this addon still declares —
+	* constructor defaults, settings-schema fields (layout containers included),
+	* durable-state keys and the root of each `secretStatePaths` entry. Answered
+	* here, in the addon's own process, so the hub keeps no copy of it.
+	*/
+	async getDeclaredSettingsKeys() {
+		return { keys: [...this.declaredKeySet()].toSorted() };
+	}
+	declaredKeySet() {
+		const keys = new Set(Object.keys(this.defaults));
+		const schema = this.globalSettingsSchema();
+		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
+		for (const key of this._declaredStateKeys) keys.add(key);
+		for (const path of this.secretStatePaths) {
+			const root = path.split(/[.[]/, 1)[0];
+			if (root) keys.add(root);
+		}
+		return keys;
+	}
+	/**
+	* Stale-data audit: remove stored global-settings keys the addon no longer
+	* declares, and clear the keychain values their markers held — except a value
+	* a surviving key still points at. A declared or absent key is refused.
+	*/
+	async unsetStoredSettingsKeys(keys) {
+		const settings = this._ctx?.settings;
+		const raw = this.rawSettings();
+		if (!settings || !raw) return {
+			removed: [],
+			refused: keys.map((key) => ({
+				key,
+				reason: "no settings store"
+			})),
+			secretsCleared: 0
+		};
+		let stored;
+		try {
+			stored = await raw.readAddonStore();
+		} catch (error) {
+			const reason = `store unreadable: ${error instanceof Error ? error.message : "unknown"}`;
+			return {
+				removed: [],
+				refused: keys.map((key) => ({
+					key,
+					reason
+				})),
+				secretsCleared: 0
+			};
+		}
+		const declared = this.declaredKeySet();
+		const removed = [];
+		const refused = [];
+		for (const key of keys) {
+			const base = key.split("@", 1)[0] ?? key;
+			if (declared.has(base)) refused.push({
+				key,
+				reason: "still declared by the addon"
+			});
+			else if (!(key in stored)) refused.push({
+				key,
+				reason: "not stored"
+			});
+			else removed.push(key);
+		}
+		if (removed.length === 0) return {
+			removed,
+			refused,
+			secretsCleared: 0
+		};
+		const kept = /* @__PURE__ */ new Set();
+		const held = /* @__PURE__ */ new Set();
+		for (const [key, value] of Object.entries(stored)) {
+			const target = removed.includes(key) ? held : kept;
+			for (const ref of collectSecretMarkerRefs(value)) target.add(ref);
+		}
+		const refsToClear = [...held].filter((ref) => !kept.has(ref));
+		const patch = {};
+		for (const key of removed) patch[key] = void 0;
+		await settings.writeAddonStore(patch);
+		const secretsCleared = refsToClear.length > 0 && this._ctx?.secrets ? await this._ctx.secrets.delete(refsToClear) : 0;
+		await this.resolveConfig();
+		return {
+			removed,
+			refused,
+			secretsCleared
+		};
+	}
 	/** Per-device variant of {@link state}, backed by the per-device store. */
 	deviceState(deviceId, key, schema, fallback) {
 		return createDurableState({
@@ -2699,6 +2803,21 @@ function dropPerNodeFields(fields) {
 	}
 	return kept;
 }
+function collectFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectFieldKeys(tab.fields));
+			continue;
+		}
+		if ("key" in field && typeof field.key === "string") collected.push(field.key);
+	}
+	return collected;
+}
 function collectPerNodeFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {

package/dist/vendor-login-proxy/cookie-jar.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Server-side cookie jar of ONE vendor sign-in attempt (D955).
+ *
+ * A vendor login (an identity provider's cookie/JS check page) refuses a flow that arrives
+ * without the cookies it set a step earlier. Relying on the browser to store them under the
+ * hub origin loses them whenever the browser refuses the rewritten cookie (a `Secure` cookie
+ * on a plain-http hub, a `__Host-` name with a narrowed Path, a `SameSite=None` without
+ * `Secure`). The proxy therefore keeps every vendor cookie itself and sends them upstream,
+ * whatever the browser did. Values never leave this object except as the upstream `Cookie`
+ * header; nothing here logs.
+ */
+import { type LoginProxyScheme } from './url-rewrite.js';
+export declare class VendorCookieJar {
+    #private;
+    /** Store (or delete, when expired) the cookies of one upstream response. */
+    store(setCookies: readonly string[], origin: {
+        readonly host: string;
+        readonly pathname: string;
+    }, nowMs: number): void;
+    /** The `Cookie` header value for a request to `host` + `pathname`, or null when none applies. */
+    headerFor(target: {
+        readonly host: string;
+        readonly pathname: string;
+        readonly scheme: LoginProxyScheme;
+    }, nowMs: number): string | null;
+}
+/** Cookie names carried by a `Cookie` header value. */
+export declare function cookieHeaderNames(header: string): Set<string>;
+/** `browser` cookies not shadowed by the jar's, then the jar's: the jar is the truth. */
+export declare function mergeCookieHeaders(browser: string, jar: string | null): string;

package/dist/vendor-login-proxy/index.d.ts

@@ -1,3 +1,4 @@
 export { VendorLoginProxy, type LoginProxyAttemptSpec, type LoginProxyResponseView, type LoginProxyVerdict, type VendorLoginProxyOptions, } from './login-proxy.js';
 export { rewriteBody, rewriteLocation, rewriteReferer, rewriteFormBody, rewriteSetCookie, rewriteSetCookies, type LoginProxyRoute, type LoginProxyScheme, type LoginProxyUpstream, } from './url-rewrite.js';
 export { VENDOR_LOGIN_PROXY_PREFIX } from './prefix.js';
+export { VendorCookieJar } from './cookie-jar.js';

package/dist/vendor-login-proxy/login-proxy.d.ts

@@ -28,6 +28,12 @@ export interface LoginProxyAttemptSpec<T> {
     readonly terminal: (view: LoginProxyResponseView) => LoginProxyVerdict<T> | Promise<LoginProxyVerdict<T>>;
     /** Finish the sign-in with the payload; the outcome picks the result page the browser lands on. */
     readonly onDone: (payload: T) => Promise<OauthLandingOutcome>;
+    /**
+     * Keep the vendor's cookies on the server for this attempt and send them upstream, whatever
+     * the browser stored. For a login that refuses a flow arriving without the cookies it set
+     * earlier (a browser-requirements check page). Default off.
+     */
+    readonly serverCookieJar?: boolean;
 }
 export interface VendorLoginProxyOptions {
     readonly addonId: string;

package/dist/vendor-login-proxy/url-rewrite.d.ts

@@ -57,15 +57,22 @@ export declare function rewriteBody(body: string, kind: BodyKind, currentUpstrea
 /**
  * A vendor `Set-Cookie` for the browser: no `Domain` (the cookie belongs to the hub
  * origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
+ * `browserSafe` (the server keeps its own jar, so this copy only serves the page's script):
+ * also no `Secure` / `SameSite`, which a plain-http hub makes the browser refuse, and no
+ * `__Host-` / `__Secure-` cookie, whose rules a narrowed Path breaks.
  */
-export declare function rewriteSetCookie(cookie: string, route: LoginProxyRoute): string;
+export declare function rewriteSetCookie(cookie: string, route: LoginProxyRoute, options?: {
+    readonly browserSafe?: boolean;
+}): string;
 /**
  * Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
  * the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
  * one, so a past-dated set that only deleted the other domain's copy would delete the
  * live one the same response just set: that deletion is dropped.
  */
-export declare function rewriteSetCookies(cookies: readonly string[], route: LoginProxyRoute): string[];
+export declare function rewriteSetCookies(cookies: readonly string[], route: LoginProxyRoute, options?: {
+    readonly browserSafe?: boolean;
+}): string[];
 /**
  * A browser `Referer` that points into this proxy, turned back into the vendor URL it
  * stands for. A Referer that is not ours is dropped (null): it names the hub.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.450",
+  "version": "1.2.452",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",