@camstack/server 1.2.604 → 1.2.606

package/dist/auth/embed-auth-route.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerEmbedAuthRoute = registerEmbedAuthRoute;
+const spa_mount_js_1 = require("../api/static/spa-mount.js");
+const session_cookie_js_1 = require("./session-cookie.js");
+/** Seconds the cookie may live for `payload`, or `null` when it is not a live person's session. */
+async function sessionCookieTtl(deps, token) {
+    let payload;
+    try {
+        payload = deps.verifyToken(token);
+    }
+    catch {
+        return null;
+    }
+    if (typeof payload !== 'object' || payload === null || !(0, session_cookie_js_1.isSessionGradeJwtPayload)(payload)) {
+        return null;
+    }
+    const userId = Reflect.get(payload, 'userId');
+    if (typeof userId !== 'string' || !(await deps.isLiveUser(userId)))
+        return null;
+    const exp = Reflect.get(payload, 'exp');
+    const expSec = typeof exp === 'number' ? exp : 0;
+    return Math.max(0, expSec - Math.floor(Date.now() / 1000));
+}
+function registerEmbedAuthRoute(fastify, deps) {
+    fastify.get('/api/embed-auth', async (request, reply) => {
+        const authHeader = request.headers.authorization;
+        const token = authHeader?.startsWith('Bearer ')
+            ? authHeader.slice('Bearer '.length)
+            : undefined;
+        if (!token)
+            return reply.status(401).send({ error: 'Bearer token required' });
+        const next = request.query?.next ?? '';
+        if (!(0, session_cookie_js_1.isEmbedRedirectTarget)(next))
+            return reply.status(400).send({ error: 'invalid next' });
+        const ttlSec = await sessionCookieTtl(deps, token);
+        if (ttlSec === null)
+            return reply.status(401).send({ error: 'invalid token' });
+        const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
+            secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_js_1.FORWARDED_PREFIX_HEADER),
+        });
+        reply.setCookie(c.name, c.value, c.options);
+        return reply.redirect(next);
+    });
+}

package/dist/auth/live-user.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.liveUserCheck = liveUserCheck;
+/** A check bound to `registry`'s `user-management` provider. Unreadable ⇒ `false` (fail closed). */
+function liveUserCheck(registry) {
+    return async (userId) => {
+        if (userId === '')
+            return false;
+        const users = registry.getSingleton('user-management');
+        if (users === null || users === undefined)
+            return false;
+        try {
+            return (await users.listUsers()).some((user) => user.id === userId);
+        }
+        catch {
+            return false;
+        }
+    };
+}

package/dist/auth/scope-escalation.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scopesWithin = scopesWithin;
+exports.intersectScopes = intersectScopes;
+const types_1 = require("@camstack/types");
+const principal_visibility_js_1 = require("../api/trpc/principal-visibility.js");
+const scope_access_js_1 = require("../api/trpc/scope-access.js");
+/**
+ * The method a share link's talk-back opens first. Holding it on a device is
+ * what lets a caller hand talk-back on that device to whoever holds the link.
+ */
+const TALK_BACK_PATH = 'intercom.startSession';
+/** May the holder of `held` talk back on every device of `grant`? */
+function canTalkOn(held, deviceIds, lookup) {
+    return deviceIds.every((deviceId) => (0, scope_access_js_1.checkScopeAccess)(held, TALK_BACK_PATH, { deviceId }, lookup).ok);
+}
+function accessCovered(asked, held) {
+    return asked.every((a) => held.includes(a));
+}
+/** The grant without its access list, as a comparable key. */
+function grantKey(scope) {
+    if (scope.type === 'device') {
+        return JSON.stringify({
+            type: scope.type,
+            selector: scope.selector,
+            includeLinked: scope.includeLinked ?? null,
+        });
+    }
+    return JSON.stringify({ type: scope.type, target: scope.target });
+}
+function describe(scope) {
+    if (scope === types_1.ADMIN_SCOPE)
+        return "'*'";
+    if (scope.type === 'share-view')
+        return `share-view:${scope.grant.kind}`;
+    if (scope.type === 'addon-routes')
+        return `addon-routes[${scope.access.join(',')}]`;
+    if (scope.type === 'preferences-self')
+        return 'preferences-self';
+    if (scope.type === 'device')
+        return `device[${scope.access.join(',')}]`;
+    return `${scope.type}:${scope.target}[${scope.access.join(',')}]`;
+}
+function scopesWithin(requested, held, lookup) {
+    if ((0, types_1.scopesGrantAdmin)(held))
+        return { ok: true };
+    const heldCapability = (0, types_1.capabilityScopesOf)(held);
+    for (const scope of requested) {
+        if (scope === types_1.ADMIN_SCOPE) {
+            return { ok: false, reason: "only an admin can mint '*'" };
+        }
+        if (scope.type === 'share-view') {
+            const viewable = (0, principal_visibility_js_1.filterViewableDeviceIds)(heldCapability, scope.grant.deviceIds, lookup);
+            if (viewable.length !== scope.grant.deviceIds.length) {
+                return { ok: false, reason: 'a share-view grant names a device you cannot view' };
+            }
+            if (scope.grant.talk === true && !canTalkOn(heldCapability, scope.grant.deviceIds, lookup)) {
+                return { ok: false, reason: 'a share-view grant asks talk-back on a device you cannot talk on' };
+            }
+            continue;
+        }
+        if (scope.type === 'preferences-self') {
+            const covered = held.some((h) => h !== types_1.ADMIN_SCOPE && h.type === 'preferences-self');
+            if (!covered)
+                return { ok: false, reason: `you do not hold ${describe(scope)}` };
+            continue;
+        }
+        if (scope.type === 'addon-routes') {
+            return {
+                ok: false,
+                reason: `only an admin can mint ${describe(scope)} — name the addon instead (addon:<id>)`,
+            };
+        }
+        const key = grantKey(scope);
+        const covered = heldCapability.some((h) => grantKey(h) === key && accessCovered(scope.access, h.access));
+        if (!covered)
+            return { ok: false, reason: `you do not hold ${describe(scope)}` };
+    }
+    return { ok: true };
+}
+/** A share-view grant cut down to what `held` may still see (and talk on). `null` = nothing left. */
+function narrowShareGrant(grant, held, lookup) {
+    const deviceIds = (0, principal_visibility_js_1.filterViewableDeviceIds)(held, grant.deviceIds, lookup);
+    if (deviceIds.length === 0)
+        return null;
+    const talk = grant.talk === true && canTalkOn(held, deviceIds, lookup);
+    return {
+        kind: grant.kind,
+        deviceIds,
+        ...(grant.talk !== undefined ? { talk } : {}),
+    };
+}
+/**
+ * `token`'s scopes cut down to what `held` — its non-admin subject's scopes
+ * NOW — still covers (security review 2026-10-21): an admin who narrows a user
+ * narrows every token that user minted, at the next verify, rather than
+ * leaving the token the reach the user no longer has.
+ *
+ *   - a capability grant keeps the flavours the subject still holds on the
+ *     SAME grant, and goes when none is left;
+ *   - a share-view grant keeps the devices the subject can still view (and
+ *     talk-back only where it can still talk);
+ *   - `'*'` and `addon-routes` are admin-only and never survive here.
+ *
+ * Never widens: every output scope is covered by an input scope.
+ */
+function intersectScopes(token, held, lookup) {
+    const out = [];
+    for (const scope of token) {
+        if (scope === types_1.ADMIN_SCOPE || scope.type === 'addon-routes')
+            continue;
+        if (scope.type === 'share-view') {
+            const grant = narrowShareGrant(scope.grant, held, lookup);
+            if (grant !== null)
+                out.push({ type: 'share-view', grant });
+            continue;
+        }
+        // The subject's OWN preferences (D894): every person holds it, so a live
+        // subject never loses it — except on a share link. A share-view grant cut
+        // to nothing must not leave a preferences token behind.
+        if (scope.type === 'preferences-self') {
+            if (!token.some((s) => s !== types_1.ADMIN_SCOPE && s.type === 'share-view'))
+                out.push(scope);
+            continue;
+        }
+        const key = grantKey(scope);
+        const heldAccess = new Set(held.filter((h) => grantKey(h) === key).flatMap((h) => [...h.access]));
+        const access = scope.access.filter((a) => heldAccess.has(a));
+        if (access.length > 0)
+            out.push({ ...scope, access });
+    }
+    return out;
+}

package/dist/boot/boot-config.js

@@ -43,6 +43,7 @@ exports.retiredSecretSources = retiredSecretSources;
 exports.loadBootstrapConfig = loadBootstrapConfig;
 exports.setupInfra = setupInfra;
 const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const types_1 = require("@camstack/types");
 const yaml = __importStar(require("js-yaml"));
@@ -241,7 +242,13 @@ async function setupInfra(_configPath, bootstrapConfig) {
         // The certificate comes only from the admin UI (D726): the generated
         // local CA → leaf (D227), or an operator upload served verbatim.
         const extraSans = [...core.readExtraSans(dataPath)];
-        const boot = await core.prepareBootTls(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
+        // A local root CREATED at this boot is named after the hub. The stored name (D861)
+        // lives in the settings database, which is not open yet, so this is the name the
+        // hub shows while unnamed: the hostname. An existing root is never renamed.
+        const boot = await core.prepareBootTls(dataPath, {
+            hubName: (0, types_1.shortHostname)(os.hostname()),
+            ...(extraSans.length > 0 ? { extraSans } : {}),
+        });
         if (boot.uploadedMissing) {
             console.warn(`[Phase2c] WARN the uploaded TLS certificate is missing from ${path.join(dataPath, 'tls')} — serving the generated one. Upload it again in Network → Local access.`);
         }

package/dist/core/addon/addon-registry.service.js

@@ -390,7 +390,7 @@ class AddonRegistryService {
     integrationRegistry = null;
     clusterNodeHistoryStore = null;
     clusterAgentRecords = null;
-    shareTokenService = null;
+    credentialTokenService = null;
     // Device architecture — in-memory registry of live IDevice instances.
     // Persistence is owned by the `device-manager` capability addon.
     deviceRegistry = new system_1.DeviceRegistry();
@@ -1378,8 +1378,9 @@ class AddonRegistryService {
         const kind = records.kind(system_1.clusterNodeHistoryRecordKind);
         clusterStore.bindRecordsKind(() => kind);
     }
-    setShareTokenService(service) {
-        this.shareTokenService = service;
+    /** The unified token store (D892), bound to its `core-auth` records. */
+    setCredentialTokenService(service) {
+        this.credentialTokenService = service;
     }
     async wireHubMainOrphanRecords(store) {
         const recordsCap = this.capabilityRegistry.getSingleton('records');
@@ -1394,12 +1395,22 @@ class AddonRegistryService {
         await clusterRecords.declare(system_1.clusterAgentRecordKinds);
         this.clusterAgentRecords = clusterRecords;
         this.bindClusterNodeHistoryRecordsKind();
-        const shareTokens = this.shareTokenService;
-        if (shareTokens !== null) {
+        const credentialTokens = this.credentialTokenService;
+        if (credentialTokens !== null) {
             const coreRecords = this.recordsForOwner('core-auth', this.secretsForOwner('core-auth'));
+            // Every core-auth kind is declared, `share-view-tokens` included: its
+            // pre-D895 rows stay on disk for the operator to drop, and nothing reads
+            // them.
             await coreRecords.declare(record_kinds_js_1.coreAuthRecordKinds);
-            const shareKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['share-view-tokens']);
-            shareTokens.bindShareTokensKind(() => shareKind);
+            const tokenKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['credential-tokens']);
+            credentialTokens.bindKind(() => tokenKind);
+            // Dead rows (expired or revoked > 30 days) go at boot; the verifier
+            // already refuses them, so this is housekeeping, never a gate.
+            void credentialTokens.reap().catch((error) => {
+                this.logger.warn('Token reap failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                });
+            });
         }
     }
     /**

package/dist/core/auth/credential-token.service.js

@@ -0,0 +1,245 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialTokenService = void 0;
+/**
+ * The unified token store (D892).
+ *
+ * A token is a signed JWT `{ kind: 'credential', sub, jti, scopes }` and one
+ * row here: the SHA-256 of its `jti`, its label, its scopes, its ONE expiry,
+ * when it was last used and whether it was revoked. The verifier reads the
+ * row by `jti` on every request — that is what makes revocation immediate and
+ * the expiry slidable (a share link's `extend`). The raw token leaves this
+ * service exactly once, in `mint`'s answer; neither it nor the `jti` is ever
+ * stored or logged.
+ *
+ * Rows live in the `core-auth` records (`credential-tokens`), declared by the
+ * hub beside the share links. Until that binding happens the store refuses to
+ * mint and authenticates nothing — it never falls back to another table.
+ */
+const crypto = __importStar(require("node:crypto"));
+const types_1 = require("@camstack/types");
+const record_kinds_js_1 = require("./record-kinds.js");
+const TOUCH_EVERY_MS = 60_000;
+const DEAD_RETENTION_MS = 30 * 86_400_000;
+const LABEL_MAX = 80;
+const PAGE = 1000;
+const MAX_PAGES = 100;
+function hashJti(jti) {
+    return crypto.createHash('sha256').update(jti).digest('hex');
+}
+/** Constant-time equality of two hex digests. */
+function sameDigest(a, b) {
+    const left = Buffer.from(a, 'hex');
+    const right = Buffer.from(b, 'hex');
+    return left.length === right.length && crypto.timingSafeEqual(left, right);
+}
+function toRecord(id, body) {
+    return {
+        id,
+        subjectId: body.subjectId,
+        createdBy: body.createdBy,
+        label: body.label,
+        scopes: body.scopes,
+        createdAt: body.createdAt,
+        expiresAt: body.expiresAt,
+        lastUsedAt: body.lastUsedAt ?? null,
+        revokedAt: body.revokedAt ?? null,
+    };
+}
+class CredentialTokenService {
+    signer;
+    logger;
+    now;
+    resolveKind = () => null;
+    constructor(signer, logger = null, now = Date.now) {
+        this.signer = signer;
+        this.logger = logger;
+        this.now = now;
+    }
+    /** Hub wiring after `records.forOwner('core-auth').declare(...)`. */
+    bindKind(resolver) {
+        this.resolveKind = resolver;
+    }
+    kind() {
+        const kind = this.resolveKind();
+        if (kind === null) {
+            throw (0, types_1.userError)('auth.tokens-unavailable', undefined, 'Tokens are not available yet');
+        }
+        return kind;
+    }
+    /** Issue a token. The raw token is in this answer only. */
+    async mint(input) {
+        const label = input.label.trim().slice(0, LABEL_MAX);
+        if (label.length === 0) {
+            throw (0, types_1.userError)('auth.token-label-required', undefined, 'A token needs a name');
+        }
+        const at = this.now();
+        if (input.expiresAt !== null && input.expiresAt <= at) {
+            throw (0, types_1.userError)('auth.token-expiry-past', undefined, 'A token must expire in the future');
+        }
+        const jti = crypto.randomBytes(32).toString('base64url');
+        const id = crypto.randomUUID();
+        const body = {
+            subjectId: input.subjectId,
+            createdBy: input.createdBy,
+            label,
+            jtiHash: hashJti(jti),
+            scopes: [...input.scopes],
+            createdAt: at,
+            expiresAt: input.expiresAt,
+            lastUsedAt: null,
+            revokedAt: null,
+        };
+        const parsed = record_kinds_js_1.coreAuthRecordKinds['credential-tokens'].schema.safeParse(body);
+        if (!parsed.success)
+            throw new Error(parsed.error.message);
+        const kind = this.kind();
+        const token = this.signer.signCredentialToken({
+            kind: types_1.CREDENTIAL_TOKEN_KIND,
+            sub: input.subjectId,
+            jti,
+            scopes: [...input.scopes],
+        });
+        await kind.put({
+            id,
+            ...(body.expiresAt !== null ? { expiresAt: body.expiresAt } : {}),
+            data: parsed.data,
+        });
+        this.logger?.info('Token minted', {
+            meta: { tokenId: id, subjectId: input.subjectId, label, expiresAt: input.expiresAt },
+        });
+        return { token, record: toRecord(id, parsed.data) };
+    }
+    /** The live row behind `jti`: unknown, revoked and expired answer `null`. */
+    async lookupLive(jti) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return null;
+        const digest = hashJti(jti);
+        const page = await kind.query({ where: { jtiHash: digest }, limit: 1 });
+        const row = page.records[0];
+        if (row === undefined || !sameDigest(row.data.jtiHash, digest))
+            return null;
+        const at = this.now();
+        if (row.data.revokedAt !== null && row.data.revokedAt !== undefined)
+            return null;
+        if (row.data.expiresAt !== null && row.data.expiresAt <= at)
+            return null;
+        const lastUsedAt = row.data.lastUsedAt ?? null;
+        if (lastUsedAt === null || at - lastUsedAt > TOUCH_EVERY_MS) {
+            // ONLY `lastUsedAt`, merged into the row as it is when the write lands.
+            // Writing back the row read above (un-awaited) could land after a
+            // revoke / an expiry move and undo it (security review 2026-10-21).
+            void kind.patch(row.id, { lastUsedAt: at }).catch(() => { });
+        }
+        return {
+            id: row.id,
+            subjectId: row.data.subjectId,
+            label: row.data.label,
+            scopes: row.data.scopes,
+        };
+    }
+    async get(id) {
+        const row = await this.kind().get(id);
+        return row === null ? null : toRecord(row.id, row.data);
+    }
+    /** Every row not yet reaped, newest first; `subjectId` narrows to one user's. */
+    async list(subjectId) {
+        const kind = this.resolveKind();
+        if (kind === null)
+            return [];
+        const out = [];
+        let cursor;
+        for (let page = 0; page < MAX_PAGES; page += 1) {
+            const answer = await kind.query({
+                ...(subjectId === undefined ? {} : { where: { subjectId } }),
+                limit: PAGE,
+                ...(cursor === undefined ? {} : { cursor }),
+            });
+            out.push(...answer.records.map((row) => toRecord(row.id, row.data)));
+            if (answer.nextCursor === null)
+                return out.toSorted((a, b) => b.createdAt - a.createdAt);
+            cursor = answer.nextCursor;
+        }
+        throw new Error('credential-tokens: row count exceeds pagination bound');
+    }
+    /** Revoke one token now. `false` when unknown or already revoked. */
+    async revoke(id) {
+        const row = await this.kind().get(id);
+        if (row === null || (row.data.revokedAt !== null && row.data.revokedAt !== undefined)) {
+            return false;
+        }
+        await this.kind().patch(id, { revokedAt: this.now() });
+        this.logger?.info('Token revoked', { meta: { tokenId: id, subjectId: row.data.subjectId } });
+        return true;
+    }
+    /** Move a live token's expiry (`null`: never). `null` when not live. */
+    async setExpiry(id, expiresAt) {
+        const row = await this.kind().get(id);
+        if (row === null)
+            return null;
+        const at = this.now();
+        const dead = (row.data.revokedAt !== null && row.data.revokedAt !== undefined) ||
+            (row.data.expiresAt !== null && row.data.expiresAt <= at);
+        if (dead || (expiresAt !== null && expiresAt <= at))
+            return null;
+        await this.kind().patch(id, { expiresAt }, { expiresAt });
+        return toRecord(id, { ...row.data, expiresAt });
+    }
+    /** Revoke every live token of `subjectId` (the user was deleted). */
+    async revokeAllFor(subjectId) {
+        let revoked = 0;
+        for (const token of await this.list(subjectId)) {
+            if (token.revokedAt === null && (await this.revoke(token.id)))
+                revoked += 1;
+        }
+        return revoked;
+    }
+    /** Delete rows expired or revoked more than 30 days ago. */
+    async reap() {
+        const horizon = this.now() - DEAD_RETENTION_MS;
+        let deleted = 0;
+        for (const token of await this.list()) {
+            const deadAt = token.revokedAt ?? token.expiresAt;
+            if (deadAt !== null && deadAt < horizon) {
+                await this.kind().delete(token.id);
+                deleted += 1;
+            }
+        }
+        return deleted;
+    }
+}
+exports.CredentialTokenService = CredentialTokenService;

package/dist/core/auth/handoff-code.service.js

@@ -60,7 +60,7 @@ const types_1 = require("@camstack/types");
  *     prune-on-mint keeps the map from growing.
  */
 const crypto = __importStar(require("node:crypto"));
-/** Wire prefix — `chc_` = CamStack Handoff Code (cf. `cst_`/`csv_`). */
+/** Wire prefix — `chc_` = CamStack Handoff Code (not a credential: it is redeemed once for a session). */
 exports.HANDOFF_CODE_PREFIX = 'chc_';
 exports.HANDOFF_CODE_TTL_MS = 60_000;
 /** Hard bound on concurrently-pending codes (mint is auth-gated, so this

package/dist/core/auth/record-kinds.js

@@ -12,6 +12,11 @@ const ShareTokenScopeSchema = zod_1.z.object({
     talk: zod_1.z.boolean().optional(),
 });
 exports.SHARE_VIEW_TOKENS_LEGACY = 'share_view_tokens';
+/**
+ * The pre-D892 share-link rows. Nothing writes or reads them since D895 (a
+ * share link is a `credential-tokens` row); the kind stays declared so the
+ * storage layout is unchanged and the operator drops the rows by hand.
+ */
 const ShareViewTokenBodySchema = zod_1.z.object({
     userId: zod_1.z.string(),
     tokenHash: zod_1.z.string(),
@@ -21,18 +26,49 @@ const ShareViewTokenBodySchema = zod_1.z.object({
     expiresAt: zod_1.z.number().nullable(),
     lastUsedAt: zod_1.z.number().nullish(),
 });
+/**
+ * The unified token (D892): one row per token `auth.mintToken` issued — the
+ * hashed `jti` the verifier looks up for revocation, the label, the scopes,
+ * the ONE expiry (`null` only for a never-expiring share link), last use.
+ */
+const CredentialTokenBodySchema = zod_1.z.object({
+    subjectId: zod_1.z.string(),
+    createdBy: zod_1.z.string(),
+    label: zod_1.z.string(),
+    jtiHash: zod_1.z.string(),
+    scopes: zod_1.z.array(types_1.CredentialScopeSchema).min(1),
+    createdAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number().nullable(),
+    lastUsedAt: zod_1.z.number().nullish(),
+    revokedAt: zod_1.z.number().nullish(),
+});
 exports.coreAuthRecordKinds = (0, types_1.defineRecordKinds)({
     'share-view-tokens': {
         schema: ShareViewTokenBodySchema,
         class: 'config',
-        writeTrigger: 'operator mints a share link; validate touches lastUsedAt',
+        writeTrigger: 'none since D895 — legacy rows kept on disk for the operator to drop',
         device: 'none',
         at: 'none',
         indexes: [
             { name: 'hash', fields: ['tokenHash'], unique: true },
             { name: 'user', fields: ['userId'] },
         ],
-        retention: { none: 'revoke only; expiry enforced at validate' },
+        retention: { none: 'operator drops the legacy rows by hand (D895)' },
         adoptsFrom: exports.SHARE_VIEW_TOKENS_LEGACY,
     },
+    'credential-tokens': {
+        schema: CredentialTokenBodySchema,
+        class: 'config',
+        writeTrigger: 'a user mints a token (auth.mintToken or a wrapper); validate touches lastUsedAt at most once a minute; revoke stamps revokedAt',
+        device: 'none',
+        at: 'none',
+        indexes: [
+            { name: 'jti', fields: ['jtiHash'], unique: true },
+            { name: 'subject', fields: ['subjectId'] },
+        ],
+        retention: {
+            owner: 'core-auth',
+            reason: 'the daily reap deletes rows expired or revoked more than 30 days ago',
+        },
+    },
 });