@threadbase-sh/streamer 1.52.5 → 1.53.0

package/dist/index.d.cts

@@ -1136,6 +1136,8 @@ declare class DevicesRepository {
     private listStmt;
     private revokeStmt;
     private touchStmt;
+    private deleteStmt;
+    private deleteRevokedStmt;
     constructor(db: Database.Database);
     /**
      * Record a newly paired device and mint its token.
@@ -1161,6 +1163,29 @@ declare class DevicesRepository {
     list(): DeviceView[];
     /** Revoke one device. Others are untouched — no key rotation, no collateral. */
     revoke(deviceId: string, now?: number): boolean;
+    /**
+     * Erase one device's record outright.
+     *
+     * Deliberately separate from `revoke`, which is a soft delete that keeps the
+     * row so `list()` can show what happened. That audit trail is the right
+     * default — but it meant a `devices` row, including the user-supplied `name`
+     * ("Ronen's iPhone"), had no removal path at all once the registry moved to
+     * runtime.db, which no command deletes. This is that path.
+     *
+     * Erasure is NOT revocation: deleting a row frees its `token_hash`, so a
+     * device whose token is still on a phone somewhere stops being *known* rather
+     * than being *refused*. Revoke first, delete second, is the safe order, and
+     * `deleteRevoked()` exists so that is the easy thing to do.
+     */
+    delete(deviceId: string): boolean;
+    /**
+     * Erase every already-revoked device. The bulk companion to `delete`, and the
+     * one that is safe by construction: a revoked device is already refused, so
+     * removing its row cannot restore access to anything.
+     *
+     * Returns the number of rows removed.
+     */
+    deleteRevoked(): number;
     touch(deviceId: string, now?: number): void;
 }
 
@@ -1547,14 +1572,49 @@ declare class RuntimeStore {
     /**
      * One-time move of `managed_sessions` rows out of a pre-split `cache.db`.
      *
-     * Non-destructive by design: the source table is left in place so an older
-     * streamer rolled back onto the same machine still finds its registry. Runs
-     * only when this file's table is empty, so a second boot is a no-op rather
-     * than a re-copy that would resurrect rows deleted since.
-     *
      * Returns the number of rows copied.
      */
     importLegacyManagedSessions(source: Database.Database): number;
+    /**
+     * One-time move of `devices` rows out of `cache.db`, where the registry used
+     * to live (migration `011_create_devices.sql`).
+     *
+     * Losing this table invalidates every device token ever issued, and cache.db
+     * is the file `tb-streamer cache clear` deletes and the integrity monitor
+     * rebuilds — see `runtime-migrations/003_create_devices.sql`.
+     *
+     * Unlike `managed_sessions`, this one MOVES rather than copies: the source
+     * rows are deleted once the copy is verified. A `devices` row carries a
+     * user-supplied label ("Ronen's iPhone"), and leaving a second copy of that
+     * on disk indefinitely — in the one file the user is told to delete when
+     * something goes wrong — is more retained personal data than the rollback
+     * path is worth. Recovering from a rollback is re-scanning a pairing QR.
+     *
+     * The delete is conditional on the copy being complete: `INSERT OR IGNORE`
+     * can silently skip a row, so the destination count must match what was read
+     * before anything is removed. A mismatch keeps the source and reports
+     * `purged: false` rather than throwing — the import itself still succeeded,
+     * and keeping data is the safe direction to fail in.
+     */
+    importLegacyDevices(source: Database.Database): {
+        copied: number;
+        purged: boolean;
+    };
+    /**
+     * Copy a whole table out of a pre-split `cache.db` into this file.
+     *
+     * The copy itself is non-destructive — the source is left in place, so an
+     * older streamer rolled back onto the same machine still finds its data.
+     * `importLegacyDevices` deletes the source afterwards for its own reasons;
+     * `managed_sessions` does not. Runs only when this file's table is empty, so
+     * a second boot is a no-op rather than a re-copy that would resurrect rows
+     * deleted since.
+     *
+     * The table name is interpolated into SQL, so it is typed as a closed union
+     * rather than `string` — the set of tables that can ever be lifted is known
+     * at compile time, and that is what keeps a caller from making this a hole.
+     */
+    private importLegacyTable;
     close(): void;
 }
 
@@ -1805,7 +1865,7 @@ type ApiDeps = {
     handleBrowse: (url: URL, res: ServerResponse) => Promise<void>;
     handleMkdir: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleWsOpen: (ws: WebSocket) => void;
-    handleWsMessage: (ws: WebSocket, raw: unknown) => void;
+    handleWsMessage: (ws: WebSocket, raw: unknown, principal: Principal | null) => void;
     handleWsClose: (ws: WebSocket) => void;
     agentClient: AgentClient | null;
     conversationWriter: ConversationWriter | null;

package/dist/index.d.ts

@@ -1136,6 +1136,8 @@ declare class DevicesRepository {
     private listStmt;
     private revokeStmt;
     private touchStmt;
+    private deleteStmt;
+    private deleteRevokedStmt;
     constructor(db: Database.Database);
     /**
      * Record a newly paired device and mint its token.
@@ -1161,6 +1163,29 @@ declare class DevicesRepository {
     list(): DeviceView[];
     /** Revoke one device. Others are untouched — no key rotation, no collateral. */
     revoke(deviceId: string, now?: number): boolean;
+    /**
+     * Erase one device's record outright.
+     *
+     * Deliberately separate from `revoke`, which is a soft delete that keeps the
+     * row so `list()` can show what happened. That audit trail is the right
+     * default — but it meant a `devices` row, including the user-supplied `name`
+     * ("Ronen's iPhone"), had no removal path at all once the registry moved to
+     * runtime.db, which no command deletes. This is that path.
+     *
+     * Erasure is NOT revocation: deleting a row frees its `token_hash`, so a
+     * device whose token is still on a phone somewhere stops being *known* rather
+     * than being *refused*. Revoke first, delete second, is the safe order, and
+     * `deleteRevoked()` exists so that is the easy thing to do.
+     */
+    delete(deviceId: string): boolean;
+    /**
+     * Erase every already-revoked device. The bulk companion to `delete`, and the
+     * one that is safe by construction: a revoked device is already refused, so
+     * removing its row cannot restore access to anything.
+     *
+     * Returns the number of rows removed.
+     */
+    deleteRevoked(): number;
     touch(deviceId: string, now?: number): void;
 }
 
@@ -1547,14 +1572,49 @@ declare class RuntimeStore {
     /**
      * One-time move of `managed_sessions` rows out of a pre-split `cache.db`.
      *
-     * Non-destructive by design: the source table is left in place so an older
-     * streamer rolled back onto the same machine still finds its registry. Runs
-     * only when this file's table is empty, so a second boot is a no-op rather
-     * than a re-copy that would resurrect rows deleted since.
-     *
      * Returns the number of rows copied.
      */
     importLegacyManagedSessions(source: Database.Database): number;
+    /**
+     * One-time move of `devices` rows out of `cache.db`, where the registry used
+     * to live (migration `011_create_devices.sql`).
+     *
+     * Losing this table invalidates every device token ever issued, and cache.db
+     * is the file `tb-streamer cache clear` deletes and the integrity monitor
+     * rebuilds — see `runtime-migrations/003_create_devices.sql`.
+     *
+     * Unlike `managed_sessions`, this one MOVES rather than copies: the source
+     * rows are deleted once the copy is verified. A `devices` row carries a
+     * user-supplied label ("Ronen's iPhone"), and leaving a second copy of that
+     * on disk indefinitely — in the one file the user is told to delete when
+     * something goes wrong — is more retained personal data than the rollback
+     * path is worth. Recovering from a rollback is re-scanning a pairing QR.
+     *
+     * The delete is conditional on the copy being complete: `INSERT OR IGNORE`
+     * can silently skip a row, so the destination count must match what was read
+     * before anything is removed. A mismatch keeps the source and reports
+     * `purged: false` rather than throwing — the import itself still succeeded,
+     * and keeping data is the safe direction to fail in.
+     */
+    importLegacyDevices(source: Database.Database): {
+        copied: number;
+        purged: boolean;
+    };
+    /**
+     * Copy a whole table out of a pre-split `cache.db` into this file.
+     *
+     * The copy itself is non-destructive — the source is left in place, so an
+     * older streamer rolled back onto the same machine still finds its data.
+     * `importLegacyDevices` deletes the source afterwards for its own reasons;
+     * `managed_sessions` does not. Runs only when this file's table is empty, so
+     * a second boot is a no-op rather than a re-copy that would resurrect rows
+     * deleted since.
+     *
+     * The table name is interpolated into SQL, so it is typed as a closed union
+     * rather than `string` — the set of tables that can ever be lifted is known
+     * at compile time, and that is what keeps a caller from making this a hole.
+     */
+    private importLegacyTable;
     close(): void;
 }
 
@@ -1805,7 +1865,7 @@ type ApiDeps = {
     handleBrowse: (url: URL, res: ServerResponse) => Promise<void>;
     handleMkdir: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
     handleWsOpen: (ws: WebSocket) => void;
-    handleWsMessage: (ws: WebSocket, raw: unknown) => void;
+    handleWsMessage: (ws: WebSocket, raw: unknown, principal: Principal | null) => void;
     handleWsClose: (ws: WebSocket) => void;
     agentClient: AgentClient | null;
     conversationWriter: ConversationWriter | null;