@apex-actions/cli 0.74.0 → 0.75.0

package/dist/cli/token/main.js

@@ -1,7 +1,7 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { createToken, listTokens, revokeTokens } from '../../src/application/manage-tokens.js';
-import { MAX_TOKEN_DAYS, TOKENS_PAGE, webBaseFor } from '../../src/domain/credentials.js';
+import { createToken, editToken, listTokens, revokeTokens } from '../../src/application/manage-tokens.js';
+import { MAX_TOKEN_DAYS, TOKENS_PAGE, TOKEN_RESOURCES, describeGrants, webBaseFor } from '../../src/domain/credentials.js';
 import { TOKEN_ENV, WEB_URL_ENV, apiUrlFrom } from '../../src/infrastructure/credentials.js';
 import { HttpLoginExchange, listenForCallback, newPkcePair, openInBrowser } from '../../src/infrastructure/loopback-login.js';
 import { api, collect, usage } from '../secret/shared.js';
@@ -13,10 +13,31 @@ import { api, collect, usage } from '../secret/shared.js';
  * login` does, and prints the token once — the token alone on stdout, so
  * `$(apex token create …)` captures it, and everything a person reads on
  * stderr. It is never saved, and the CLI's own login is left as it was.
+ * A token carries the permissions asked for with `--permission` and belongs
+ * to one Account (control-plane ADR-0071).
+ * `edit` narrows a token at once with whichever credential the CLI has, and
+ * widens one only through the same browser approval.
  * `list` and `revoke` use whichever credential the CLI already has.
  *
  * Exit codes follow §7: 0 done · 1 refused or declined · 2 usage · 3 no such token.
  */
+const PERMISSION_HELP = `resource:read or resource:write (write implies read); resource is one of ${TOKEN_RESOURCES.join(', ')}`;
+/** The browser half `create` and a widening `edit` share. */
+const approvalDeps = (browser, what) => {
+    const apiUrl = apiUrlFrom();
+    return {
+        pkce: newPkcePair,
+        listen: (state) => listenForCallback(state),
+        openBrowser: browser ? (url) => openInBrowser(url) : undefined,
+        announce: (url) => {
+            console.error(browser ? `Opening the browser to approve ${what}. If it does not open, visit:` : `Open this URL to approve ${what}:`);
+            console.error(`  ${url}`);
+            console.error(chalk.dim('Waiting for the approval (5 minutes)…'));
+        },
+        exchange: new HttpLoginExchange(apiUrl),
+        webBase: webBaseFor(apiUrl, process.env[WEB_URL_ENV]),
+    };
+};
 const refused = (message) => {
     console.error(chalk.red(message));
     process.exitCode = 1;
@@ -24,35 +45,41 @@ const refused = (message) => {
 const createCommand = new Command('create')
     .description('Create an API token for a script or CI system, approved in the browser; the token is printed once and not saved')
     .argument('<name>', 'what the token is for, as the token list will show it (1–100 characters)')
+    .option('--permission <permission>', `what the token may do, repeatable and at least one: ${PERMISSION_HELP}`, collect, [])
+    .option('--account <id>', 'the Account the token belongs to — needed when you belong to more than one')
     .option('--expires-in-days <days>', `days until the token expires, 1–${MAX_TOKEN_DAYS} (default 30)`)
-    .option('--repo <owner/repo>', 'hold the token to this repository (repeatable, up to 100); omit for every repository you administer', collect, [])
+    .option('--repo <owner/repo>', 'hold the token to this repository (repeatable, up to 100); omit for every repository you reach in the Account', collect, [])
     .option('--no-browser', 'print the approval URL instead of opening a browser')
     .option('--json', 'print the token and its details as JSON on stdout')
     .action(async (name, opts) => {
     const days = opts.expiresInDays === undefined ? undefined : /^[0-9]+$/.test(opts.expiresInDays) ? Number(opts.expiresInDays) : Number.NaN;
-    const apiUrl = apiUrlFrom();
-    const outcome = await createToken({
-        pkce: newPkcePair,
-        listen: (state) => listenForCallback(state),
-        openBrowser: opts.browser ? (url) => openInBrowser(url) : undefined,
-        announce: (url) => {
-            console.error(opts.browser ? 'Opening the browser to approve this token. If it does not open, visit:' : 'Open this URL to approve this token:');
-            console.error(`  ${url}`);
-            console.error(chalk.dim('Waiting for the approval (5 minutes)…'));
-        },
-        exchange: new HttpLoginExchange(apiUrl),
-        webBase: webBaseFor(apiUrl, process.env[WEB_URL_ENV]),
-    }, { name, days, repos: opts.repo });
+    const outcome = await createToken(approvalDeps(opts.browser, 'this token'), {
+        name,
+        days,
+        repos: opts.repo,
+        permissions: opts.permission,
+        accountId: opts.account,
+    });
     switch (outcome.kind) {
         case 'created': {
             if (opts.json === true) {
-                console.log(JSON.stringify({ token: outcome.token, id: outcome.id, name: outcome.name, login: outcome.login, expiresAt: outcome.expiresAt, repos: outcome.repos ?? null }, null, 2));
+                console.log(JSON.stringify({
+                    token: outcome.token,
+                    id: outcome.id,
+                    name: outcome.name,
+                    login: outcome.login,
+                    expiresAt: outcome.expiresAt,
+                    repos: outcome.repos ?? null,
+                    permissions: outcome.permissions ?? [],
+                    accountId: outcome.accountId ?? null,
+                }, null, 2));
             }
             else {
                 console.log(outcome.token);
             }
-            const reach = outcome.repos === undefined || outcome.repos.length === 0 ? 'every repository you administer' : outcome.repos.join(', ');
+            const reach = outcome.repos === undefined || outcome.repos.length === 0 ? 'every repository you reach' : outcome.repos.join(', ');
             console.error(`${chalk.green('✔')} created "${outcome.name}" for ${outcome.login} — ${reach}; expires ${outcome.expiresAt}`);
+            console.error(`  permissions: ${describeGrants(outcome.permissions)}${outcome.accountId === undefined ? '' : ` · Account ${outcome.accountId}`}`);
             console.error(chalk.yellow('This is the only time the token is shown. Store it now — in your CI system as a secret named APEX_TOKEN.'));
             return;
         }
@@ -69,17 +96,83 @@ const createCommand = new Command('create')
             refused('the browser came back without a code; run apex token create again');
             return;
         case 'timeout':
-            refused('no approval arrived within 5 minutes; run apex token create again');
+            refused('no approval arrived within 5 minutes; the approval page must be opened in a browser on this machine — run apex token create again');
             return;
         case 'refused':
             refused(outcome.detail);
             return;
     }
 });
-const reachOf = (t) => (t.repos === undefined || t.repos.length === 0 ? 'all administered' : t.repos.join(', '));
+const reachOf = (t) => (t.repos === undefined || t.repos.length === 0 ? 'all' : t.repos.join(', '));
 const day = (iso) => (iso === undefined ? '—' : iso.slice(0, 10));
+const editCommand = new Command('edit')
+    .description('Change what a token may do or which repositories it reaches; narrowing applies at once, widening is approved in the browser')
+    .argument('<id>', 'the token id, from apex token list')
+    .option('--permission <permission>', `the token's whole new set of permissions, repeatable: ${PERMISSION_HELP}`, collect, [])
+    .option('--add-permission <permission>', 'add one permission to what the token holds (repeatable)', collect, [])
+    .option('--remove-permission <permission>', 'take one permission away (repeatable)', collect, [])
+    .option('--repo <owner/repo>', "the token's new list of repositories (repeatable, up to 100)", collect, [])
+    .option('--all-repos', 'let the token reach every repository you reach in its Account')
+    .option('--no-browser', 'if the edit widens the token, print the approval URL instead of opening a browser')
+    .option('--json', 'print the edited token as JSON')
+    .action(async (id, opts) => {
+    if (opts.allRepos === true && opts.repo.length > 0) {
+        usage('pass --repo or --all-repos, not both');
+        return;
+    }
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await editToken(client, approvalDeps(opts.browser, 'widening this token'), id, {
+        ...(opts.permission.length > 0 ? { permissions: opts.permission } : {}),
+        add: opts.addPermission,
+        remove: opts.removePermission,
+        ...(opts.allRepos === true ? { repos: 'all' } : opts.repo.length > 0 ? { repos: opts.repo } : {}),
+    });
+    switch (outcome.kind) {
+        case 'edited':
+        case 'unchanged': {
+            const t = outcome.token;
+            if (opts.json === true) {
+                console.log(JSON.stringify({ token: t, changed: outcome.kind === 'edited', ...(outcome.kind === 'edited' ? { via: outcome.via } : {}) }, null, 2));
+                return;
+            }
+            if (outcome.kind === 'unchanged')
+                console.log(chalk.yellow(`"${t.name}" already holds that — nothing changed`));
+            else
+                console.log(`${chalk.green('✔')} edited "${t.name}"${outcome.via === 'browser' ? ' — the widening was approved in the browser' : ''}`);
+            console.log(`  permissions   ${describeGrants(t.permissions)}`);
+            console.log(`  repositories  ${reachOf(t)}`);
+            if (t.accountId !== undefined)
+                console.log(`  account       ${t.accountId}`);
+            return;
+        }
+        case 'invalid':
+            usage(outcome.detail);
+            return;
+        case 'not-found':
+            console.error(chalk.red(`no active token with id ${outcome.id} — apex token list shows yours`));
+            process.exitCode = 3;
+            return;
+        case 'denied':
+            refused(`declined in the browser: ${outcome.detail}`);
+            return;
+        case 'state-mismatch':
+            refused('a callback arrived that did not belong to this request, so it was refused; run apex token edit again');
+            return;
+        case 'malformed':
+            refused('the browser came back without a code; run apex token edit again');
+            return;
+        case 'timeout':
+            refused('no approval arrived within 5 minutes; the approval page must be opened in a browser on this machine — run apex token edit again');
+            return;
+        case 'refused':
+            refused(outcome.detail);
+            return;
+    }
+});
 const listCommand = new Command('list')
-    .description('Your API tokens — names and last four characters, never the tokens')
+    .description('Your API tokens by Account, with what each may do — names and last four characters, never the tokens')
     .option('--all', 'include expired and revoked tokens')
     .option('--json', 'machine-readable output')
     .action(async (opts) => {
@@ -99,23 +192,32 @@ const listCommand = new Command('list')
         console.log(chalk.yellow(outcome.hidden > 0 ? `No active tokens (${outcome.hidden} expired or revoked; --all shows them).` : 'You hold no tokens.'));
         return;
     }
-    const rows = outcome.tokens.map((t) => [
+    const header = ['  NAME', 'ID', 'LAST 4', 'SOURCE', 'PERMISSIONS', 'REPOSITORIES', 'EXPIRES', 'LAST USED', 'STATE'];
+    const rowOf = (t) => [
         `${t.current === true ? '* ' : '  '}${t.name}`,
         t.id,
         `…${t.last4}`,
         t.source,
+        describeGrants(t.permissions),
         reachOf(t),
-        day(t.createdAt),
         day(t.expiresAt),
         day(t.lastUsedAt),
         t.state,
-    ]);
-    const header = ['  NAME', 'ID', 'LAST 4', 'SOURCE', 'REPOSITORIES', 'CREATED', 'EXPIRES', 'LAST USED', 'STATE'];
+    ];
+    const rows = outcome.tokens.map(rowOf);
     const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? '').length)));
     const line = (cells) => cells.map((c, i) => c.padEnd(widths[i] ?? 0)).join('  ').trimEnd();
-    console.log(chalk.dim(line(header)));
-    for (const r of rows)
-        console.log(line(r));
+    // One section per Account: a token belongs to one, and reaches only that Account's repositories.
+    const accounts = [...new Set(outcome.tokens.map((t) => t.accountId ?? ''))].sort((a, b) => (a === '' ? 1 : b === '' ? -1 : a.localeCompare(b)));
+    accounts.forEach((account, i) => {
+        if (i > 0)
+            console.log('');
+        console.log(chalk.bold(account === '' ? 'No Account — these tokens reach nothing; create a new one' : `Account ${account}`));
+        console.log(chalk.dim(line(header)));
+        for (const t of outcome.tokens)
+            if ((t.accountId ?? '') === account)
+                console.log(line(rowOf(t)));
+    });
     if (outcome.tokens.some((t) => t.current === true))
         console.log(chalk.dim('* the token this CLI is using'));
     if (outcome.hidden > 0)
@@ -151,7 +253,8 @@ const revokeCommand = new Command('revoke')
     }
 });
 export default new Command('token')
-    .description(`API tokens for scripts and CI: create one (approved in the browser), list yours, revoke one. Also on the dashboard at ${TOKENS_PAGE}`)
+    .description(`API tokens for scripts and CI: create one with the permissions it needs (approved in the browser), edit, list or revoke yours. Also on the dashboard at ${TOKENS_PAGE}`)
     .addCommand(createCommand)
+    .addCommand(editCommand)
     .addCommand(listCommand)
     .addCommand(revokeCommand);

package/dist/cli/whoami/main.js

@@ -1,7 +1,8 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { whoami } from '../../src/application/authenticate.js';
-import { describeSource } from '../../src/domain/credentials.js';
+import { listTokens } from '../../src/application/manage-tokens.js';
+import { describeGrants, describeSource } from '../../src/domain/credentials.js';
 import { credentialsPath } from '../../src/infrastructure/credentials.js';
 import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
 const credentialLine = (credential) => {
@@ -22,9 +23,21 @@ const credentialLine = (credential) => {
  * `apex whoami`: who the control plane thinks this CLI is, and which
  * credential got it there. The answer is the server's (`GET /api/v1/me`), not
  * a guess from the local file; the credential itself is never printed.
+ *
+ * It also names any credential that was present and lost (ADR-0005: the
+ * environment outranks the saved login), because the surprise this command
+ * exists to prevent is acting as somebody other than the one you meant.
+ *
+ * When the credential is a token it also says what the token may do and which
+ * Account it belongs to — the list of the person's tokens marks it `current`.
  */
 export default new Command('whoami')
     .description('Who the CLI is acting as, with which credential, and where it found it')
+    .addHelpText('after', '\nWhich credential is used, first match wins:\n' +
+    '  1. APEX_TOKEN in the environment\n' +
+    '  2. APEX_ADMIN_TOKEN in the environment (operators)\n' +
+    '  3. the token `apex login` saved\n' +
+    'A variable you exported outranks a saved login. Unset it to use the login.')
     .option('--json', 'machine-readable output')
     .action(async (opts) => {
     let client;
@@ -42,7 +55,14 @@ export default new Command('whoami')
         process.exitCode = 1;
         return;
     }
-    const { identity, source } = outcome;
+    const { identity, source, alsoPresent } = outcome;
+    // The token's grants and Account: best effort, since the identity above is the answer this command owes.
+    let token;
+    if (identity.credential?.kind === 'token') {
+        const listed = await listTokens(client, false);
+        if (listed.kind === 'listed')
+            token = listed.tokens.find((t) => t.current === true);
+    }
     const login = identity.actor.kind === 'user' ? identity.actor.login : undefined;
     const foundIn = source === 'login' ? `${describeSource(source)} (${credentialsPath()})` : describeSource(source);
     if (opts.json === true) {
@@ -57,13 +77,35 @@ export default new Command('whoami')
                     ...(identity.credential.source === undefined ? {} : { source: identity.credential.source }),
                     ...(identity.credential.expiresAt === undefined ? {} : { expiresAt: identity.credential.expiresAt }),
                 },
+            ...(token === undefined
+                ? {}
+                : {
+                    token: {
+                        id: token.id,
+                        name: token.name,
+                        permissions: token.permissions ?? [],
+                        repos: token.repos ?? null,
+                        accountId: token.accountId ?? null,
+                    },
+                }),
             foundIn: source,
+            notUsed: alsoPresent,
             apiUrl: client.baseUrl,
         }, null, 2));
         return;
     }
     console.log(`${'acting as'.padEnd(14)}${login ?? 'the machine principal'}`);
     console.log(`${'credential'.padEnd(14)}${credentialLine(identity.credential)}`);
+    if (token !== undefined) {
+        console.log(`${'token'.padEnd(14)}${token.name} (${token.id})`);
+        console.log(`${'permissions'.padEnd(14)}${describeGrants(token.permissions)}`);
+        console.log(`${'repositories'.padEnd(14)}${token.repos === undefined || token.repos.length === 0 ? 'every repository you reach in its Account' : token.repos.join(', ')}`);
+        console.log(`${'account'.padEnd(14)}${token.accountId ?? 'none — this token reaches nothing; create a new one'}`);
+    }
     console.log(`${'found in'.padEnd(14)}${foundIn}`);
+    for (const other of alsoPresent) {
+        const where = other === 'login' ? `${describeSource(other)} (${credentialsPath()})` : describeSource(other);
+        console.log(`${'not used'.padEnd(14)}${where} — outranked by the credential above`);
+    }
     console.log(`${'control plane'.padEnd(14)}${client.baseUrl}`);
 });

package/dist/src/application/authenticate.js

@@ -1,37 +1,53 @@
-import { authorizeUrl } from '../domain/credentials.js';
+import { authorizeUrl, doneUrl } from '../domain/credentials.js';
 /**
  * The loopback flow itself: open the consent page, wait for the one callback,
  * redeem its code with the verifier. Shared by `apex login`, which saves what
  * it gets, and `apex token create`, which hands it back to be printed once.
  */
-export const approveInBrowser = async (deps, token) => {
+export const approveInBrowser = async (deps, token, accountId) => {
     const pair = deps.pkce();
     const listener = await deps.listen(pair.state);
     try {
-        const url = authorizeUrl(deps.webBase, { port: listener.port, state: pair.state, codeChallenge: pair.challenge, name: deps.name, token });
+        const url = authorizeUrl(deps.webBase, { port: listener.port, state: pair.state, codeChallenge: pair.challenge, name: deps.name, token, accountId });
         deps.announce(url);
         deps.openBrowser?.(url);
         const callback = await listener.wait();
+        const purpose = token === undefined ? 'login' : (token.purpose ?? 'token');
+        if (callback.kind === 'denied')
+            await listener.conclude(doneUrl(deps.webBase, 'denied', purpose));
         if (callback.kind !== 'code')
             return callback;
+        // Redeem first, then hand the tab to the done page: its words must match what actually happened.
+        let outcome;
         try {
-            return { kind: 'minted', minted: await deps.exchange.redeem(callback.code, pair.verifier) };
+            outcome = { kind: 'minted', minted: await deps.exchange.redeem(callback.code, pair.verifier) };
         }
         catch (err) {
-            return { kind: 'refused', detail: err instanceof Error ? err.message : String(err) };
+            outcome = { kind: 'refused', detail: err instanceof Error ? err.message : String(err) };
         }
+        await listener.conclude(doneUrl(deps.webBase, outcome.kind === 'minted' ? 'approved' : 'failed', purpose));
+        return outcome;
     }
     finally {
         await listener.close();
     }
 };
 export const login = async (deps) => {
-    const approval = await approveInBrowser(deps);
+    const approval = await approveInBrowser(deps, undefined, deps.accountId);
     if (approval.kind !== 'minted')
         return approval;
     const { minted } = approval;
+    if (minted.token === undefined)
+        return { kind: 'refused', detail: 'the control plane answered the login without a token' };
     await deps.store.save({ token: minted.token, login: minted.login, apiUrl: deps.apiUrl, expiresAt: minted.expiresAt });
-    return { kind: 'logged-in', login: minted.login, expiresAt: minted.expiresAt, location: deps.store.location };
+    return {
+        kind: 'logged-in',
+        login: minted.login,
+        expiresAt: minted.expiresAt,
+        location: deps.store.location,
+        permissions: minted.permissions,
+        accountId: minted.accountId,
+    };
 };
 /**
  * Revoke the saved token at the control plane that minted it, then forget it
@@ -58,7 +74,7 @@ export const logout = async (store, revoke) => {
 };
 export const whoami = async (api) => {
     try {
-        return { kind: 'identified', identity: await api.whoami(), source: api.credentialSource };
+        return { kind: 'identified', identity: await api.whoami(), source: api.credentialSource, alsoPresent: api.credentialsAlsoPresent ?? [] };
     }
     catch (err) {
         return { kind: 'refused', detail: err instanceof Error ? err.message : String(err) };

package/dist/src/application/manage-tokens.js

@@ -1,5 +1,5 @@
 // application layer — see ../../../../docs/conventions.md §1
-import { tokenRequestProblem } from '../domain/credentials.js';
+import { editedPermissions, tokenEditProblem, tokenRequestProblem } from '../domain/credentials.js';
 import { approveInBrowser } from './authenticate.js';
 const detail = (err) => (err instanceof Error ? err.message : String(err));
 /**
@@ -8,13 +8,21 @@ const detail = (err) => (err instanceof Error ? err.message : String(err));
  */
 export const createToken = async (deps, input) => {
     const name = input.name.trim();
-    const problem = tokenRequestProblem(name, input.days, input.repos);
+    const problem = tokenRequestProblem(name, input.days, input.repos, input.permissions);
     if (problem !== undefined)
         return { kind: 'invalid', detail: problem };
-    const approval = await approveInBrowser({ ...deps, name }, { ...(input.days === undefined ? {} : { days: input.days }), ...(input.repos.length === 0 ? {} : { repos: input.repos }) });
+    const approval = await approveInBrowser({ ...deps, name }, {
+        purpose: 'token',
+        permissions: [...new Set(input.permissions)],
+        ...(input.days === undefined ? {} : { days: input.days }),
+        ...(input.repos.length === 0 ? {} : { repos: input.repos }),
+        ...(input.accountId === undefined ? {} : { accountId: input.accountId }),
+    });
     if (approval.kind !== 'minted')
         return approval;
     const { minted } = approval;
+    if (minted.token === undefined)
+        return { kind: 'refused', detail: 'the control plane answered without a token' };
     return {
         kind: 'created',
         token: minted.token,
@@ -23,6 +31,78 @@ export const createToken = async (deps, input) => {
         id: minted.id,
         name: minted.name ?? name,
         repos: minted.repos,
+        permissions: minted.permissions,
+        accountId: minted.accountId,
+    };
+};
+const sameSet = (a, b) => (a ?? []).length === (b ?? []).length && (a ?? []).every((x) => (b ?? []).includes(x));
+/**
+ * Edit a token's grants or repositories. The token is read first — `--add-permission` needs its current grants, and a
+ * browser approval must carry the repositories unchanged when only the grants change, because an approval that names
+ * none means every repository. Then the edit is asked for directly: a narrowing applies at once. The control plane
+ * refuses a widening to anything but a signed-in person (403), so that one goes through the approval page, whose
+ * redeemed code applies the edit and mints nothing.
+ */
+export const editToken = async (api, approval, id, edit) => {
+    const problem = tokenEditProblem(edit);
+    if (problem !== undefined)
+        return { kind: 'invalid', detail: problem };
+    let target;
+    try {
+        target = (await api.listTokens()).find((t) => t.id === id && t.state === 'active');
+    }
+    catch (err) {
+        return { kind: 'refused', detail: detail(err) };
+    }
+    if (target === undefined)
+        return { kind: 'not-found', id };
+    const permissions = editedPermissions(target.permissions ?? [], edit);
+    if (permissions.length === 0)
+        return { kind: 'invalid', detail: 'that would leave the token no permission — revoke it instead' };
+    const repos = edit.repos === 'all' ? undefined : (edit.repos ?? target.repos);
+    const permissionsChange = !sameSet(permissions, target.permissions);
+    const reposChange = edit.repos !== undefined && !(edit.repos === 'all' ? (target.repos ?? []).length === 0 : sameSet(edit.repos, target.repos));
+    if (!permissionsChange && !reposChange)
+        return { kind: 'unchanged', token: target };
+    let answer;
+    try {
+        answer = await api.editToken(id, {
+            ...(permissionsChange ? { permissions } : {}),
+            ...(reposChange ? { repos: repos === undefined || repos.length === 0 ? null : repos } : {}),
+        });
+    }
+    catch (err) {
+        return { kind: 'refused', detail: detail(err) };
+    }
+    if (answer.kind === 'edited')
+        return { kind: 'edited', token: answer.token, via: 'direct' };
+    if (answer.kind === 'not-found')
+        return { kind: 'not-found', id };
+    if (answer.status !== 403)
+        return { kind: 'refused', detail: answer.detail };
+    // A widening: a person approves it in the browser, within the Account's policy.
+    const approved = await approveInBrowser({ ...approval, name: target.name }, {
+        purpose: 'edit',
+        tokenId: id,
+        permissions,
+        // No repositories keeps the token's own; every repository has to be asked for outright.
+        ...(edit.repos === 'all' ? { allRepos: true } : repos === undefined || repos.length === 0 ? {} : { repos }),
+    });
+    if (approved.kind !== 'minted')
+        return approved;
+    const m = approved.minted;
+    return {
+        kind: 'edited',
+        via: 'browser',
+        token: {
+            ...target,
+            ...(m.name === undefined ? {} : { name: m.name }),
+            expiresAt: m.expiresAt,
+            permissions: m.permissions ?? permissions,
+            // The control plane's view is the answer: no repositories there means every repository.
+            repos: m.repos,
+            ...(m.accountId === undefined ? {} : { accountId: m.accountId }),
+        },
     };
 };
 /** The person's tokens, newest first; only the active ones unless `all`. */