@camstack/server 1.2.603 → 1.2.605

package/dist/api/auth-whoami.js

@@ -1,55 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWhoami = resolveWhoami;
 exports.registerAuthWhoamiRoute = registerAuthWhoamiRoute;
+const trpc_context_js_1 = require("./trpc/trpc.context.js");
+/** The answer for `bearer`, or `null` when it authenticates nobody. */
+async function resolveWhoami(deps, bearer) {
+    const principal = await (0, trpc_context_js_1.hubCredentialVerifier)(deps).verify(bearer);
+    if (principal === null)
+        return null;
+    return {
+        ok: true,
+        kind: principal.userDelegated ? 'jwt' : 'scoped',
+        userId: principal.subjectId,
+        username: principal.username,
+        isAdmin: principal.isAdmin,
+        scopes: principal.scopes,
+        credentialId: principal.credentialId,
+        credential: principal.auditTag,
+        legacy: principal.legacy,
+    };
+}
 async function registerAuthWhoamiRoute(fastify, authService, addonRegistry) {
     fastify.get('/api/auth/whoami', async (request, reply) => {
         const authHeader = request.headers.authorization;
         if (!authHeader) {
-            return reply.status(401).send({ ok: false, error: 'No Authorization header' });
+            const refused = { ok: false, error: 'No Authorization header' };
+            return reply.status(401).send(refused);
         }
-        const token = authHeader.replace('Bearer ', '');
-        // JWT fast path — same logic as addon-upload auth chain.
-        try {
-            const payload = authService.verifyToken(token);
-            const ok = {
-                ok: true,
-                kind: 'jwt',
-                userId: payload.userId ?? 'unknown',
-                username: payload.username ?? 'unknown',
-                isAdmin: payload.isAdmin,
+        const answer = await resolveWhoami({ authService, addonRegistry }, authHeader.replace('Bearer ', ''));
+        if (answer === null) {
+            const refused = {
+                ok: false,
+                error: 'Token not recognised (revoked, expired, or never issued)',
             };
-            return reply.send(ok);
-        }
-        catch {
-            // Not a JWT — try scoped token via cap registry.
-        }
-        try {
-            const capRegistry = addonRegistry.getCapabilityRegistry();
-            const userMgmt = capRegistry.getSingleton('user-management');
-            if (!userMgmt) {
-                return reply.status(503).send({ ok: false, error: 'user-management cap not mounted' });
-            }
-            const record = await userMgmt.validateScopedToken({ token });
-            if (!record) {
-                return reply
-                    .status(401)
-                    .send({ ok: false, error: 'Token not recognised (revoked, expired, or never issued)' });
-            }
-            const ok = {
-                ok: true,
-                kind: 'scoped',
-                userId: record.userId,
-                username: record.userId,
-                tokenPrefix: record.tokenPrefix,
-                scopes: record.scopes,
-                expiresAt: record.expiresAt ?? null,
-                createdAt: record.createdAt,
-            };
-            return reply.send(ok);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            return reply.status(500).send({ ok: false, error: `Validation failed: ${msg}` });
+            return reply.status(401).send(refused);
         }
+        return reply.send(answer);
     });
 }

package/dist/api/core/auth-admin-tokens.procedures.js

@@ -15,6 +15,8 @@ const zod_1 = require("zod");
 const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const auth_tokens_procedures_js_1 = require("./auth-tokens.procedures.js");
+const types_1 = require("@camstack/types");
 const DAY_MS = 86_400_000;
 exports.ADMIN_TOKEN_DEFAULT_DAYS = 7;
 exports.ADMIN_TOKEN_MAX_DAYS = system_1.ADMIN_TOKEN_MAX_LIFETIME_MS / DAY_MS;
@@ -27,7 +29,23 @@ exports.AdminTokenSchema = zod_1.z.object({
     expiresAt: zod_1.z.number(),
     lastUsedAt: zod_1.z.number().nullable(),
     revokedAt: zod_1.z.number().nullable(),
+    /** A pre-D892 `csa_` token: valid until it expires, never minted again. */
+    legacy: zod_1.z.boolean().optional(),
 });
+/** A unified `'*'` token, in the admin-token listing's shape. */
+function adminSummaryOf(record, expiresAt) {
+    return {
+        id: record.id,
+        createdBy: record.createdBy,
+        name: record.label,
+        tokenPrefix: `token:${record.id.slice(0, 8)}`,
+        createdAt: record.createdAt,
+        expiresAt,
+        lastUsedAt: record.lastUsedAt,
+        revokedAt: record.revokedAt,
+        legacy: false,
+    };
+}
 exports.AuthAuditRecordSchema = zod_1.z.object({
     id: zod_1.z.string(),
     at: zod_1.z.number(),
@@ -67,47 +85,47 @@ function createAdminTokenProcedures(deps) {
         }))
             .output(zod_1.z.object({ token: zod_1.z.string(), record: exports.AdminTokenSchema }))
             .mutation(async ({ ctx, input }) => {
-            if (ctx.user.isScoped === true ||
-                ctx.user.shareView !== undefined ||
-                ctx.user.credential !== undefined) {
+            if (ctx.user.interactive !== true) {
                 throw new server_1.TRPCError({
                     code: 'FORBIDDEN',
                     message: 'An admin token can only be created from a signed-in admin session',
                 });
             }
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, ctx.user, input.reauthToken);
-            const internal = requireInternal(deps.registry);
-            const created = await internal.adminTokens.create({
-                createdBy: ctx.user.id,
-                name: input.name,
-                expiresAt: Date.now() + input.expiresInDays * DAY_MS,
-            });
-            const ip = deps.network.clientAddress(ctx.req).ip;
-            await internal.audit.record({
-                action: 'admin-token-created',
-                userId: ctx.user.id,
-                ...(ip !== null ? { ip } : {}),
-                detail: {
-                    tokenId: created.record.id,
-                    name: created.record.name,
-                    prefix: created.record.tokenPrefix,
-                    expiresAt: created.record.expiresAt,
-                },
+            // A thin wrapper for one release (D892): the token is a unified one
+            // holding `'*'`, minted — re-authentication included — by the one mint.
+            const minted = await (0, auth_tokens_procedures_js_1.mintFor)(deps, ctx, {
+                scopes: [types_1.ADMIN_SCOPE],
+                expiresIn: (0, auth_tokens_procedures_js_1.daysToSeconds)(input.expiresInDays),
+                label: input.name,
+                ...(input.reauthToken !== undefined ? { reauthToken: input.reauthToken } : {}),
             });
-            return created;
+            const expiresAt = minted.record.expiresAt ?? Date.now() + input.expiresInDays * DAY_MS;
+            return { token: minted.token, record: adminSummaryOf(minted.record, expiresAt) };
         }),
         /** ADMIN — every admin token not yet reaped (no secrets). */
         listAdminTokens: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.void())
             .output(zod_1.z.array(exports.AdminTokenSchema))
-            .query(async () => [...(await requireInternal(deps.registry).adminTokens.list())]),
+            .query(async () => {
+            const unified = (deps.credentialTokens === null ? [] : await deps.credentialTokens.list())
+                .filter((t) => (0, types_1.scopesGrantAdmin)(t.scopes) && t.expiresAt !== null)
+                .map((t) => adminSummaryOf(t, t.expiresAt ?? 0));
+            const legacy = (await requireInternal(deps.registry).adminTokens.list()).map((t) => ({
+                ...t,
+                legacy: true,
+            }));
+            return [...unified, ...legacy];
+        }),
         /** ADMIN — revoke one admin token; it stops working at once. */
         revokeAdminToken: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
             .output(zod_1.z.object({ success: zod_1.z.boolean() }))
             .mutation(async ({ ctx, input }) => {
             const internal = requireInternal(deps.registry);
-            const success = await internal.adminTokens.revoke(input.id);
+            const unified = deps.credentialTokens === null ? null : await deps.credentialTokens.get(input.id);
+            const success = unified !== null && deps.credentialTokens !== null
+                ? await deps.credentialTokens.revoke(input.id)
+                : await internal.adminTokens.revoke(input.id);
             if (success) {
                 const ip = deps.network.clientAddress(ctx.req).ip;
                 await internal.audit.record({

package/dist/api/core/auth-device-cert.procedures.js

@@ -110,7 +110,7 @@ function createDeviceCertProcedures(deps) {
         }
     };
     const assertPerson = (user) => {
-        if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+        if (user.userDelegated !== true) {
             throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
         }
     };

package/dist/api/core/auth-reauth.procedures.js

@@ -31,7 +31,7 @@ function isPasswordChecker(value) {
 }
 /** Real user sessions only: a scoped or share token cannot prove a password. */
 function assertPerson(user) {
-    if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+    if (user.userDelegated !== true) {
         throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
     }
 }

package/dist/api/core/auth-revoke-credentials.procedures.js

@@ -10,6 +10,7 @@ const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 exports.REVOKE_CREDENTIALS_MAX = 500;
 /** What a bulk revoke can target. Each has a per-row revoke on the server. */
 exports.RevocableCredentialKindSchema = zod_1.z.enum([
+    'token',
     'share-link',
     'admin-token',
     'login-session',
@@ -19,7 +20,13 @@ exports.RevocableCredentialKindSchema = zod_1.z.enum([
 exports.RevokeSkipReasonSchema = zod_1.z.enum(['current-session', 'not-active']);
 const RevokeCredentialsInputSchema = zod_1.z
     .object({
-    kind: exports.RevocableCredentialKindSchema,
+    /**
+     * Deprecated (D892): revocation is by CREDENTIAL ID. Omitted, each id is
+     * resolved against every store — unified tokens, login sessions, legacy
+     * admin / share / scoped tokens, account links. Kept one release for the
+     * clients that still send it; it then restricts the lookup to that store.
+     */
+    kind: exports.RevocableCredentialKindSchema.optional(),
     ids: zod_1.z.array(zod_1.z.string().min(1)).min(1).max(exports.REVOKE_CREDENTIALS_MAX),
     /** The count the operator confirmed. Must equal `ids.length`. */
     confirmCount: zod_1.z.number().int().min(1),
@@ -35,10 +42,7 @@ const RevokeCredentialsOutputSchema = zod_1.z.object({
 /** Keep the audit row bounded; the ids beyond this are counted, not listed. */
 const AUDIT_IDS_MAX_CHARS = 4000;
 function assertSignedInAdminSession(user) {
-    if (user.isScoped === true ||
-        user.shareView !== undefined ||
-        user.credential !== undefined ||
-        user.adminTokenId !== undefined) {
+    if (user.interactive !== true) {
         throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: 'Revoking credentials in bulk needs a signed-in admin session',
@@ -57,6 +61,13 @@ function requireInternal(registry) {
 }
 /** The per-row revoke for `kind`, bound to the caller. `null` = revoked. */
 function revokerFor(kind, caller, deps) {
+    if (kind === 'token') {
+        const service = deps.credentialTokens ?? null;
+        if (service === null) {
+            throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Tokens are not available' });
+        }
+        return async (id) => ((await service.revoke(id)) ? null : 'not-active');
+    }
     if (kind === 'share-link') {
         const service = deps.shareTokens;
         if (service === null) {
@@ -84,6 +95,40 @@ function revokerFor(kind, caller, deps) {
         return (await internal.sessions.revoke(id, 'revoked-by-admin')) ? null : 'not-active';
     };
 }
+/**
+ * Revoke one credential BY ITS ID, whatever it is (D892). Every store is asked
+ * in turn; ids are random UUIDs per store, so at most one knows it. The
+ * caller's own credential is never revoked here.
+ */
+function revokerById(caller, deps) {
+    const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+    return async (id) => {
+        if (id === caller.sessionId || id === caller.credentialId)
+            return 'current-session';
+        const tokens = deps.credentialTokens ?? null;
+        if (tokens !== null && (await tokens.get(id)) !== null) {
+            return (await tokens.revoke(id)) ? null : 'not-active';
+        }
+        if (internal !== null) {
+            if (internal.sessions.check(id).state === 'active') {
+                return (await internal.sessions.revoke(id, 'revoked-by-admin')) ? null : 'not-active';
+            }
+            if (await internal.adminTokens.revoke(id))
+                return null;
+        }
+        if (deps.shareTokens !== null &&
+            (await deps.shareTokens.revoke({ id, callerUserId: caller.id, callerIsAdmin: true }))) {
+            return null;
+        }
+        if (internal !== null) {
+            if (await internal.scopedTokens.revoke(id))
+                return null;
+            if (await internal.oauthSessions.revoke(id))
+                return null;
+        }
+        return 'not-active';
+    };
+}
 function auditIds(ids) {
     const joined = ids.join(',');
     return joined.length <= AUDIT_IDS_MAX_CHARS ? joined : `${joined.slice(0, AUDIT_IDS_MAX_CHARS)}…`;
@@ -102,7 +147,9 @@ function createRevokeCredentialsProcedures(deps) {
                     message: `Confirmed ${input.confirmCount} but ${input.ids.length} were listed — nothing was revoked`,
                 });
             }
-            const revokeOne = revokerFor(input.kind, ctx.user, deps);
+            const revokeOne = input.kind === undefined
+                ? revokerById(ctx.user, deps)
+                : revokerFor(input.kind, ctx.user, deps);
             const revoked = [];
             const skipped = [];
             // Sequential on purpose: the stores are single-writer, and a partial
@@ -122,7 +169,7 @@ function createRevokeCredentialsProcedures(deps) {
                     userId: ctx.user.id,
                     ...(ip !== null ? { ip } : {}),
                     detail: {
-                        kind: input.kind,
+                        kind: input.kind ?? 'by-id',
                         requested: input.ids.length,
                         revoked: revoked.length,
                         skipped: skipped.length,

package/dist/api/core/auth-sessions.procedures.js

@@ -51,7 +51,7 @@ function requireSessions(registry) {
 }
 /** Real user sessions only — a scoped or share token has no login session to manage. */
 function assertLoginSession(user) {
-    if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+    if (user.userDelegated !== true) {
         throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
     }
 }

package/dist/api/core/auth-tokens.procedures.js

@@ -0,0 +1,250 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenSummarySchema = exports.TokenFormatSchema = exports.MintTokenInputSchema = exports.TokenExpiresInSchema = exports.TOKEN_MAX_LIFETIME_SEC = void 0;
+exports.summarizeToken = summarizeToken;
+exports.requireCredentialTokens = requireCredentialTokens;
+exports.mintFor = mintFor;
+exports.createTokenProcedures = createTokenProcedures;
+exports.daysToSeconds = daysToSeconds;
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const scope_escalation_js_1 = require("../../auth/scope-escalation.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const DAY_MS = 86_400_000;
+/** Every token's longest lifetime — the admin token's bound, now everyone's (D816). */
+exports.TOKEN_MAX_LIFETIME_SEC = 90 * 86_400;
+const TOKEN_MIN_LIFETIME_SEC = 60;
+const MAX_SCOPES = 32;
+exports.TokenExpiresInSchema = zod_1.z.union([
+    zod_1.z.number().int().min(TOKEN_MIN_LIFETIME_SEC).max(exports.TOKEN_MAX_LIFETIME_SEC),
+    zod_1.z.literal('never'),
+]);
+exports.MintTokenInputSchema = zod_1.z.object({
+    scopes: zod_1.z.array(types_1.CredentialScopeSchema).min(1).max(MAX_SCOPES),
+    /** Seconds until expiry, or `'never'` (a share-view token only). */
+    expiresIn: exports.TokenExpiresInSchema,
+    label: zod_1.z.string().trim().min(1).max(80),
+    /** Required when `scopes` holds `'*'`. */
+    reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+});
+/** Where a listed token comes from: the unified format, or a legacy table still honoured. */
+exports.TokenFormatSchema = zod_1.z.enum(['token', 'csa', 'cst', 'csv']);
+exports.TokenSummarySchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    subjectId: zod_1.z.string(),
+    label: zod_1.z.string(),
+    scopes: zod_1.z.array(types_1.CredentialScopeSchema),
+    createdAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number().nullable(),
+    lastUsedAt: zod_1.z.number().nullable(),
+    revokedAt: zod_1.z.number().nullable(),
+    /** A pre-D892 token: valid until it expires, never minted again. */
+    legacy: zod_1.z.boolean(),
+    format: exports.TokenFormatSchema,
+});
+function summarizeToken(record) {
+    return {
+        id: record.id,
+        subjectId: record.subjectId,
+        label: record.label,
+        scopes: [...record.scopes],
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+        lastUsedAt: record.lastUsedAt,
+        revokedAt: record.revokedAt,
+        legacy: false,
+        format: 'token',
+    };
+}
+function requireCredentialTokens(service) {
+    if (service === null) {
+        throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Tokens are not available' });
+    }
+    return service;
+}
+/**
+ * The one mint, shared by `auth.mintToken` and every wrapper that kept its
+ * route (`createAdminToken`, `createShareToken`). Refuses; never trims.
+ */
+async function mintFor(deps, ctx, request) {
+    const user = ctx.user;
+    const provenanceOk = request.allowAccountLink === true ? user.userDelegated === true : user.interactive === true;
+    if (!provenanceOk) {
+        throw new server_1.TRPCError({
+            code: 'FORBIDDEN',
+            message: 'A token can only be minted from a signed-in session',
+        });
+    }
+    const share = (0, types_1.shareViewGrantOf)(request.scopes);
+    if (share !== null && request.scopes.length !== 1) {
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'A share-view grant must be the token’s only scope',
+        });
+    }
+    if (request.expiresIn === 'never' && share === null) {
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'Only a share link may be minted without an expiry',
+        });
+    }
+    const verdict = (0, scope_escalation_js_1.scopesWithin)(request.scopes, user.scopes ?? [], ctx.deviceScopeLookup);
+    if (!verdict.ok) {
+        throw new server_1.TRPCError({
+            code: 'FORBIDDEN',
+            message: `A token cannot carry more than you hold: ${verdict.reason}`,
+        });
+    }
+    if ((0, types_1.scopesGrantAdmin)(request.scopes)) {
+        (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, user, request.reauthToken);
+    }
+    const subjectId = request.subjectId ?? user.id;
+    if (subjectId !== user.id && !user.isAdmin) {
+        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Only an admin mints for another user' });
+    }
+    const service = requireCredentialTokens(deps.credentialTokens);
+    const minted = await service.mint({
+        subjectId,
+        createdBy: user.id,
+        label: request.label,
+        scopes: request.scopes,
+        expiresAt: request.expiresIn === 'never' ? null : Date.now() + request.expiresIn * 1000,
+    });
+    const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+    if (internal !== null) {
+        const ip = deps.network.clientAddress(ctx.req).ip;
+        await internal.audit
+            .record({
+            // An admin-capable token keeps the action the audit page already words.
+            action: (0, types_1.scopesGrantAdmin)(request.scopes) ? 'admin-token-created' : 'token-minted',
+            userId: user.id,
+            ...(ip !== null ? { ip } : {}),
+            detail: {
+                tokenId: minted.record.id,
+                name: minted.record.label,
+                subjectId,
+                scopes: request.scopes.length,
+                ...(minted.record.expiresAt !== null ? { expiresAt: minted.record.expiresAt } : {}),
+            },
+        })
+            .catch(() => { });
+    }
+    return minted;
+}
+async function legacyRows(deps, caller) {
+    const out = [];
+    const own = (subjectId) => caller.isAdmin || subjectId === caller.id;
+    const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+    if (internal !== null && caller.isAdmin) {
+        for (const row of await internal.adminTokens.list()) {
+            out.push({
+                id: row.id,
+                subjectId: row.createdBy,
+                label: row.name,
+                scopes: ['*'],
+                createdAt: row.createdAt,
+                expiresAt: row.expiresAt,
+                lastUsedAt: row.lastUsedAt,
+                revokedAt: row.revokedAt,
+                legacy: true,
+                format: 'csa',
+            });
+        }
+    }
+    if (deps.shareTokens !== null) {
+        const rows = caller.isAdmin
+            ? await deps.shareTokens.listAll()
+            : await deps.shareTokens.listForUser(caller.id);
+        for (const row of rows) {
+            if (!own(row.userId))
+                continue;
+            out.push({
+                id: row.id,
+                subjectId: row.userId,
+                label: `share ${row.tokenPrefix}`,
+                scopes: [{ type: 'share-view', grant: row.scope }],
+                createdAt: row.createdAt,
+                expiresAt: row.expiresAt,
+                lastUsedAt: row.lastUsedAt ?? null,
+                revokedAt: null,
+                legacy: true,
+                format: 'csv',
+            });
+        }
+    }
+    return out;
+}
+function createTokenProcedures(deps) {
+    return {
+        /** Issue a token carrying `scopes` (see the module header). Shown once. */
+        mintToken: trpc_middleware_js_1.protectedProcedure
+            .input(exports.MintTokenInputSchema)
+            .output(zod_1.z.object({ token: zod_1.z.string(), record: exports.TokenSummarySchema }))
+            .mutation(async ({ ctx, input }) => {
+            const minted = await mintFor(deps, ctx, {
+                scopes: input.scopes,
+                expiresIn: input.expiresIn,
+                label: input.label,
+                ...(input.reauthToken !== undefined ? { reauthToken: input.reauthToken } : {}),
+            });
+            return { token: minted.token, record: summarizeToken(minted.record) };
+        }),
+        /**
+         * The caller's tokens (an admin: everyone's) — unified and legacy alike,
+         * a legacy row flagged. No secret is ever listed. (The legacy `cst_`
+         * rows are listed by `userManagement.listScopedTokens`, as before.)
+         */
+        listTokens: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(exports.TokenSummarySchema))
+            .query(async ({ ctx }) => {
+            if (ctx.user.userDelegated !== true) {
+                throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
+            }
+            const unified = deps.credentialTokens === null
+                ? []
+                : await deps.credentialTokens.list(ctx.user.isAdmin ? undefined : ctx.user.id);
+            return [...unified.map(summarizeToken), ...(await legacyRows(deps, ctx.user))];
+        }),
+        /** Revoke one unified token: its owner or an admin. It stops working at once. */
+        revokeToken: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            if (ctx.user.userDelegated !== true) {
+                throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
+            }
+            const service = requireCredentialTokens(deps.credentialTokens);
+            const record = await service.get(input.id);
+            if (record === null)
+                return { success: false };
+            if (!ctx.user.isAdmin && record.subjectId !== ctx.user.id) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'Only the owner or an admin revokes a token',
+                });
+            }
+            const success = await service.revoke(input.id);
+            const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+            if (success && internal !== null) {
+                const ip = deps.network.clientAddress(ctx.req).ip;
+                await internal.audit
+                    .record({
+                    action: 'token-revoked',
+                    userId: ctx.user.id,
+                    ...(ip !== null ? { ip } : {}),
+                    detail: { tokenId: input.id },
+                })
+                    .catch(() => { });
+            }
+            return { success };
+        }),
+    };
+}
+/** Days → the `expiresIn` seconds the mint takes. */
+function daysToSeconds(days) {
+    return (days * DAY_MS) / 1000;
+}