@camstack/server 1.2.605 → 1.2.606

package/dist/boot/boot-config.js

@@ -43,6 +43,7 @@ exports.retiredSecretSources = retiredSecretSources;
 exports.loadBootstrapConfig = loadBootstrapConfig;
 exports.setupInfra = setupInfra;
 const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const types_1 = require("@camstack/types");
 const yaml = __importStar(require("js-yaml"));
@@ -241,7 +242,13 @@ async function setupInfra(_configPath, bootstrapConfig) {
         // The certificate comes only from the admin UI (D726): the generated
         // local CA → leaf (D227), or an operator upload served verbatim.
         const extraSans = [...core.readExtraSans(dataPath)];
-        const boot = await core.prepareBootTls(dataPath, extraSans.length > 0 ? { extraSans } : undefined);
+        // A local root CREATED at this boot is named after the hub. The stored name (D861)
+        // lives in the settings database, which is not open yet, so this is the name the
+        // hub shows while unnamed: the hostname. An existing root is never renamed.
+        const boot = await core.prepareBootTls(dataPath, {
+            hubName: (0, types_1.shortHostname)(os.hostname()),
+            ...(extraSans.length > 0 ? { extraSans } : {}),
+        });
         if (boot.uploadedMissing) {
             console.warn(`[Phase2c] WARN the uploaded TLS certificate is missing from ${path.join(dataPath, 'tls')} — serving the generated one. Upload it again in Network → Local access.`);
         }

package/dist/core/addon/addon-registry.service.js

@@ -390,7 +390,6 @@ class AddonRegistryService {
     integrationRegistry = null;
     clusterNodeHistoryStore = null;
     clusterAgentRecords = null;
-    shareTokenService = null;
     credentialTokenService = null;
     // Device architecture — in-memory registry of live IDevice instances.
     // Persistence is owned by the `device-manager` capability addon.
@@ -1379,10 +1378,7 @@ class AddonRegistryService {
         const kind = records.kind(system_1.clusterNodeHistoryRecordKind);
         clusterStore.bindRecordsKind(() => kind);
     }
-    setShareTokenService(service) {
-        this.shareTokenService = service;
-    }
-    /** The unified token store (D892), bound to its `core-auth` records with the share links. */
+    /** The unified token store (D892), bound to its `core-auth` records. */
     setCredentialTokenService(service) {
         this.credentialTokenService = service;
     }
@@ -1399,24 +1395,22 @@ class AddonRegistryService {
         await clusterRecords.declare(system_1.clusterAgentRecordKinds);
         this.clusterAgentRecords = clusterRecords;
         this.bindClusterNodeHistoryRecordsKind();
-        const shareTokens = this.shareTokenService;
-        if (shareTokens !== null) {
+        const credentialTokens = this.credentialTokenService;
+        if (credentialTokens !== null) {
             const coreRecords = this.recordsForOwner('core-auth', this.secretsForOwner('core-auth'));
+            // Every core-auth kind is declared, `share-view-tokens` included: its
+            // pre-D895 rows stay on disk for the operator to drop, and nothing reads
+            // them.
             await coreRecords.declare(record_kinds_js_1.coreAuthRecordKinds);
-            const shareKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['share-view-tokens']);
-            shareTokens.bindShareTokensKind(() => shareKind);
-            const credentialTokens = this.credentialTokenService;
-            if (credentialTokens !== null) {
-                const tokenKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['credential-tokens']);
-                credentialTokens.bindKind(() => tokenKind);
-                // Dead rows (expired or revoked > 30 days) go at boot; the verifier
-                // already refuses them, so this is housekeeping, never a gate.
-                void credentialTokens.reap().catch((error) => {
-                    this.logger.warn('Token reap failed', {
-                        meta: { error: error instanceof Error ? error.message : String(error) },
-                    });
+            const tokenKind = coreRecords.kind(record_kinds_js_1.coreAuthRecordKinds['credential-tokens']);
+            credentialTokens.bindKind(() => tokenKind);
+            // Dead rows (expired or revoked > 30 days) go at boot; the verifier
+            // already refuses them, so this is housekeeping, never a gate.
+            void credentialTokens.reap().catch((error) => {
+                this.logger.warn('Token reap failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
                 });
-            }
+            });
         }
     }
     /**

package/dist/core/auth/credential-token.service.js

@@ -160,7 +160,10 @@ class CredentialTokenService {
             return null;
         const lastUsedAt = row.data.lastUsedAt ?? null;
         if (lastUsedAt === null || at - lastUsedAt > TOUCH_EVERY_MS) {
-            void this.write(row.id, { ...row.data, lastUsedAt: at }).catch(() => { });
+            // ONLY `lastUsedAt`, merged into the row as it is when the write lands.
+            // Writing back the row read above (un-awaited) could land after a
+            // revoke / an expiry move and undo it (security review 2026-10-21).
+            void kind.patch(row.id, { lastUsedAt: at }).catch(() => { });
         }
         return {
             id: row.id,
@@ -199,11 +202,11 @@ class CredentialTokenService {
         if (row === null || (row.data.revokedAt !== null && row.data.revokedAt !== undefined)) {
             return false;
         }
-        await this.write(id, { ...row.data, revokedAt: this.now() });
+        await this.kind().patch(id, { revokedAt: this.now() });
         this.logger?.info('Token revoked', { meta: { tokenId: id, subjectId: row.data.subjectId } });
         return true;
     }
-    /** Move a live token's expiry (a share link's slide). `null` when not live. */
+    /** Move a live token's expiry (`null`: never). `null` when not live. */
     async setExpiry(id, expiresAt) {
         const row = await this.kind().get(id);
         if (row === null)
@@ -211,11 +214,10 @@ class CredentialTokenService {
         const at = this.now();
         const dead = (row.data.revokedAt !== null && row.data.revokedAt !== undefined) ||
             (row.data.expiresAt !== null && row.data.expiresAt <= at);
-        if (dead || expiresAt <= at)
+        if (dead || (expiresAt !== null && expiresAt <= at))
             return null;
-        const next = { ...row.data, expiresAt };
-        await this.write(id, next);
-        return toRecord(id, next);
+        await this.kind().patch(id, { expiresAt }, { expiresAt });
+        return toRecord(id, { ...row.data, expiresAt });
     }
     /** Revoke every live token of `subjectId` (the user was deleted). */
     async revokeAllFor(subjectId) {
@@ -239,12 +241,5 @@ class CredentialTokenService {
         }
         return deleted;
     }
-    async write(id, body) {
-        await this.kind().put({
-            id,
-            ...(body.expiresAt !== null ? { expiresAt: body.expiresAt } : {}),
-            data: body,
-        });
-    }
 }
 exports.CredentialTokenService = CredentialTokenService;

package/dist/core/auth/handoff-code.service.js

@@ -60,7 +60,7 @@ const types_1 = require("@camstack/types");
  *     prune-on-mint keeps the map from growing.
  */
 const crypto = __importStar(require("node:crypto"));
-/** Wire prefix — `chc_` = CamStack Handoff Code (cf. `cst_`/`csv_`). */
+/** Wire prefix — `chc_` = CamStack Handoff Code (not a credential: it is redeemed once for a session). */
 exports.HANDOFF_CODE_PREFIX = 'chc_';
 exports.HANDOFF_CODE_TTL_MS = 60_000;
 /** Hard bound on concurrently-pending codes (mint is auth-gated, so this

package/dist/core/auth/record-kinds.js

@@ -12,6 +12,11 @@ const ShareTokenScopeSchema = zod_1.z.object({
     talk: zod_1.z.boolean().optional(),
 });
 exports.SHARE_VIEW_TOKENS_LEGACY = 'share_view_tokens';
+/**
+ * The pre-D892 share-link rows. Nothing writes or reads them since D895 (a
+ * share link is a `credential-tokens` row); the kind stays declared so the
+ * storage layout is unchanged and the operator drops the rows by hand.
+ */
 const ShareViewTokenBodySchema = zod_1.z.object({
     userId: zod_1.z.string(),
     tokenHash: zod_1.z.string(),
@@ -41,14 +46,14 @@ exports.coreAuthRecordKinds = (0, types_1.defineRecordKinds)({
     'share-view-tokens': {
         schema: ShareViewTokenBodySchema,
         class: 'config',
-        writeTrigger: 'operator mints a share link; validate touches lastUsedAt',
+        writeTrigger: 'none since D895 — legacy rows kept on disk for the operator to drop',
         device: 'none',
         at: 'none',
         indexes: [
             { name: 'hash', fields: ['tokenHash'], unique: true },
             { name: 'user', fields: ['userId'] },
         ],
-        retention: { none: 'revoke only; expiry enforced at validate' },
+        retention: { none: 'operator drops the legacy rows by hand (D895)' },
         adoptsFrom: exports.SHARE_VIEW_TOKENS_LEGACY,
     },
     'credential-tokens': {

package/dist/main.js

@@ -71,6 +71,8 @@ const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
 const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const model_distributor_js_1 = require("./api/model-distributor.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
+const embed_auth_route_js_1 = require("./auth/embed-auth-route.js");
+const live_user_js_1 = require("./auth/live-user.js");
 const server_upload_1 = require("./api/server-upload");
 const server_upload_propagate_1 = require("./api/server-upload-propagate");
 const sse_no_compression_js_1 = require("./api/sse-no-compression.js");
@@ -122,7 +124,6 @@ const well_known_app_links_1 = require("./core/app-links/well-known-app-links");
 const auth_service_1 = require("./core/auth/auth.service");
 const handoff_code_service_1 = require("./core/auth/handoff-code.service");
 const credential_token_service_js_1 = require("./core/auth/credential-token.service.js");
-const share_token_service_1 = require("./core/auth/share-token.service");
 const config_service_1 = require("./core/config/config.service");
 const event_bus_service_1 = require("./core/events/event-bus.service");
 const feature_service_1 = require("./core/feature/feature.service");
@@ -438,8 +439,8 @@ async function bootstrap() {
     const sessionLifetimes = () => (0, session_lifetimes_js_1.readSessionLifetimes)((key) => config.get(key));
     // Register addon upload route (multipart — must be registered before tRPC).
     // We pass AddonRegistryService so the handler can resolve the
-    // `user-management` cap singleton at request time (the only working
-    // path to validate `cst_*` scoped tokens — see addon-upload.ts).
+    // `user-management` cap singleton at request time (the credential
+    // verifier reads users and admin bits there — see upload-auth.ts).
     try {
         const uploadAuthService = app.get(auth_service_1.AuthService);
         const uploadAddonBridge = app.get(addon_bridge_service_1.AddonBridgeService);
@@ -473,8 +474,8 @@ async function bootstrap() {
                 .getSingleton('local-network')),
         });
         console.log('[bootstrap] Server upload propagate route registered at POST /api/server-upload/propagate');
-        // Companion endpoint: /api/auth/whoami — validates JWT or cst_*
-        // scoped tokens, returns the resolved identity + scope summary.
+        // Companion endpoint: /api/auth/whoami — verifies any hub credential
+        // through the one verifier, returns the resolved identity + scopes.
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
@@ -596,17 +597,13 @@ async function bootstrap() {
     // and the distributed metrics-provider capability — no manual wiring needed.
     let trpcRegistered = false;
     let appRouter = null;
-    // Share-view (`csv_*`) tokens — hub-resident mint/verify/revoke over the
-    // settings backend (lazy getter: the backend lands after the sqlite-storage
-    // builtin registers; the service resolves it per call).
-    const shareTokenService = new share_token_service_1.ShareTokenService(() => addonRegistry.getSettingsBackend(), loggingService.createLogger('share-tokens'));
-    addonRegistry.setShareTokenService(shareTokenService);
-    // The unified token store (D892): rows in the `core-auth` records, bound
-    // with the share links; the JWT is signed with the session signing key.
+    // The one token store (D892, D895): rows in the `core-auth` records — admin
+    // tokens, scoped tokens and share links alike; the JWT is signed with the
+    // session signing key.
     const credentialTokenService = new credential_token_service_js_1.CredentialTokenService(app.get(auth_service_1.AuthService), loggingService.createLogger('tokens'));
     addonRegistry.setCredentialTokenService(credentialTokenService);
     // Every surface that verifies a bearer reads the same stores (D892).
-    (0, trpc_context_1.bindHubCredentialStores)({ shareTokens: shareTokenService, tokenRows: credentialTokenService });
+    (0, trpc_context_1.bindHubCredentialStores)({ tokenRows: credentialTokenService });
     // One-time native-app login handoff codes (in-memory, 60s TTL, single-use) —
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.
@@ -638,7 +635,6 @@ async function bootstrap() {
     });
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
-        shareTokenService,
         credentialTokenService,
         handoffCodeService,
         externalLinkIntents,
@@ -808,7 +804,7 @@ async function bootstrap() {
             trpcOptions: {
                 router: appRouter,
                 createContext: async ({ req }) => {
-                    const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, shareTokenService, 
+                    const trpcCtx = await (0, trpc_context_1.createTrpcContext)(req, authService, addonRegistry, 
                     // A bearer refused for NOT being an API credential never reaches a
                     // procedure, so `onError` below never sees it — the refusal would
                     // be silent without this. Same reason the addon gate logs (D103).
@@ -1047,37 +1043,11 @@ async function bootstrap() {
             reply.setCookie(c.name, c.value, c.options);
             return reply.send({ ok: true });
         });
-        // GET /api/embed-auth?next=<embed-path> — establish the browser session
-        // cookie from a Bearer token, then 302 to the embed. A native WebView can
-        // pass `Authorization` only on the INITIAL navigation, not on the page's
-        // asset sub-requests; the data-plane `authenticated` gate reads the cookie,
-        // so we mint it here (mirroring POST /api/auth/session) and bounce to the
-        // embed — page + assets then authenticate via the cookie. `next` is
-        // restricted to the stream-broker embed prefix (no open redirect).
-        fastify.get('/api/embed-auth', async (request, reply) => {
-            const authHeader = request.headers.authorization;
-            const token = authHeader?.startsWith('Bearer ')
-                ? authHeader.slice('Bearer '.length)
-                : undefined;
-            if (!token)
-                return reply.status(401).send({ error: 'Bearer token required' });
-            const next = request.query?.next ?? '';
-            if (!(0, session_cookie_js_1.isEmbedRedirectTarget)(next))
-                return reply.status(400).send({ error: 'invalid next' });
-            let ttlSec;
-            try {
-                const payload = authService.verifyToken(token);
-                const expSec = typeof payload.exp === 'number' ? payload.exp : 0;
-                ttlSec = Math.max(0, expSec - Math.floor(Date.now() / 1000));
-            }
-            catch {
-                return reply.status(401).send({ error: 'invalid token' });
-            }
-            const c = (0, session_cookie_js_1.buildSessionCookie)(token, ttlSec, {
-                secure: (0, session_cookie_js_1.sessionCookieIsSecure)(request.protocol, request.headers, spa_mount_1.FORWARDED_PREFIX_HEADER),
-            });
-            reply.setCookie(c.name, c.value, c.options);
-            return reply.redirect(next);
+        // GET /api/embed-auth — a person's login session becomes the embed's
+        // cookie (`auth/embed-auth-route.ts`); nothing else this hub signed does.
+        (0, embed_auth_route_js_1.registerEmbedAuthRoute)(fastify, {
+            verifyToken: (token) => authService.verifyToken(token),
+            isLiveUser: (0, live_user_js_1.liveUserCheck)(capabilityRegistry),
         });
         // Every refusal on the addon gate is a request an operator will be asking
         // about ("why did Home Assistant stop actuating?"). Its own scope so the
@@ -1086,7 +1056,6 @@ async function bootstrap() {
         const addonVerifier = (0, trpc_context_1.hubCredentialVerifier)({
             authService,
             addonRegistry,
-            shareTokens: shareTokenService,
             logger: addonGateLogger,
         });
         // Addon HTTP API route catch-all: /addon/:addonId/*
@@ -1255,6 +1224,7 @@ async function bootstrap() {
         (0, oauth2_routes_js_1.registerOauth2Routes)(fastify, {
             getRegistry: () => capabilityRegistry,
             verifyToken: (t) => authService.verifyToken(t),
+            isLiveUser: (0, live_user_js_1.liveUserCheck)(capabilityRegistry),
             // The hub's public endpoint from the `local-network` cap (the flagged
             // address, else tunnel, then mesh, then LAN). `localhost` only when the
             // palette names nothing — the dev case, where it is the truth.
@@ -1341,7 +1311,7 @@ async function bootstrap() {
             // A termination here closes with 1006; the guard's close line names it.
             keepAlive: { enabled: true, pingMs: 30_000, pongWaitMs: 10_000 },
             createContext: async (opts) => {
-                const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
+                const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
                 // The connection's identity, derived ONCE and reused for every
                 // operation on this socket. Frames that arrived while the bearer was
                 // still resolving are held by the session and released here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.605",
+  "version": "1.2.606",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.441",
-    "@camstack/addon-agent-ui": "1.2.247",
-    "@camstack/addon-auth": "1.2.152",
-    "@camstack/addon-decoder-nodeav": "1.2.126",
-    "@camstack/addon-notifiers": "1.2.604",
-    "@camstack/addon-pipeline": "1.2.604",
-    "@camstack/addon-pipeline-orchestrator": "1.2.605",
-    "@camstack/addon-post-analysis": "1.2.610",
-    "@camstack/develop": "0.1.16",
-    "@camstack/sdk": "1.2.136",
-    "@camstack/system": "1.2.455",
-    "@camstack/types": "1.2.386",
-    "@camstack/ui-library": "1.2.303",
+    "@camstack/addon-admin-ui": "1.2.442",
+    "@camstack/addon-agent-ui": "1.2.248",
+    "@camstack/addon-auth": "1.2.153",
+    "@camstack/addon-decoder-nodeav": "1.2.127",
+    "@camstack/addon-notifiers": "1.2.605",
+    "@camstack/addon-pipeline": "1.2.605",
+    "@camstack/addon-pipeline-orchestrator": "1.2.606",
+    "@camstack/addon-post-analysis": "1.2.611",
+    "@camstack/develop": "0.1.17",
+    "@camstack/sdk": "1.2.137",
+    "@camstack/system": "1.2.456",
+    "@camstack/types": "1.2.387",
+    "@camstack/ui-library": "1.2.304",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/api/core/auth-admin-tokens.procedures.js

@@ -1,156 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthAuditRecordSchema = exports.AdminTokenSchema = exports.ADMIN_TOKEN_MAX_DAYS = exports.ADMIN_TOKEN_DEFAULT_DAYS = void 0;
-exports.createAdminTokenProcedures = createAdminTokenProcedures;
-/**
- * Admin tokens (`csa_`) and the auth audit trail, as the `auth` router serves
- * them. The token store and its rules are local-auth's
- * (`admin-token-manager.ts`); this layer adds who may mint one: an ADMIN, in a
- * real signed-in session (never a token minting a token), right after
- * re-authenticating. Every create / use / revoke is audited.
- */
-const system_1 = require("@camstack/system");
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
-const auth_tokens_procedures_js_1 = require("./auth-tokens.procedures.js");
-const types_1 = require("@camstack/types");
-const DAY_MS = 86_400_000;
-exports.ADMIN_TOKEN_DEFAULT_DAYS = 7;
-exports.ADMIN_TOKEN_MAX_DAYS = system_1.ADMIN_TOKEN_MAX_LIFETIME_MS / DAY_MS;
-exports.AdminTokenSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    createdBy: zod_1.z.string(),
-    name: zod_1.z.string(),
-    tokenPrefix: zod_1.z.string(),
-    createdAt: zod_1.z.number(),
-    expiresAt: zod_1.z.number(),
-    lastUsedAt: zod_1.z.number().nullable(),
-    revokedAt: zod_1.z.number().nullable(),
-    /** A pre-D892 `csa_` token: valid until it expires, never minted again. */
-    legacy: zod_1.z.boolean().optional(),
-});
-/** A unified `'*'` token, in the admin-token listing's shape. */
-function adminSummaryOf(record, expiresAt) {
-    return {
-        id: record.id,
-        createdBy: record.createdBy,
-        name: record.label,
-        tokenPrefix: `token:${record.id.slice(0, 8)}`,
-        createdAt: record.createdAt,
-        expiresAt,
-        lastUsedAt: record.lastUsedAt,
-        revokedAt: record.revokedAt,
-        legacy: false,
-    };
-}
-exports.AuthAuditRecordSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    at: zod_1.z.number(),
-    action: zod_1.z.string(),
-    userId: zod_1.z.string().optional(),
-    ip: zod_1.z.string().optional(),
-    detail: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
-});
-function requireInternal(registry) {
-    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
-    if (internal === null) {
-        throw new server_1.TRPCError({
-            code: 'PRECONDITION_FAILED',
-            message: 'User management is not available',
-        });
-    }
-    return internal;
-}
-function createAdminTokenProcedures(deps) {
-    return {
-        /**
-         * ADMIN — mint an admin token for an ops script. Requires a real
-         * signed-in session (an admin token cannot mint another) and a fresh
-         * re-authentication. Expiry mandatory: 1–90 days, default 7. The token
-         * is in this answer only.
-         */
-        createAdminToken: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            name: zod_1.z.string().trim().min(1).max(80),
-            expiresInDays: zod_1.z
-                .number()
-                .int()
-                .min(1)
-                .max(exports.ADMIN_TOKEN_MAX_DAYS)
-                .default(exports.ADMIN_TOKEN_DEFAULT_DAYS),
-            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
-        }))
-            .output(zod_1.z.object({ token: zod_1.z.string(), record: exports.AdminTokenSchema }))
-            .mutation(async ({ ctx, input }) => {
-            if (ctx.user.interactive !== true) {
-                throw new server_1.TRPCError({
-                    code: 'FORBIDDEN',
-                    message: 'An admin token can only be created from a signed-in admin session',
-                });
-            }
-            // A thin wrapper for one release (D892): the token is a unified one
-            // holding `'*'`, minted — re-authentication included — by the one mint.
-            const minted = await (0, auth_tokens_procedures_js_1.mintFor)(deps, ctx, {
-                scopes: [types_1.ADMIN_SCOPE],
-                expiresIn: (0, auth_tokens_procedures_js_1.daysToSeconds)(input.expiresInDays),
-                label: input.name,
-                ...(input.reauthToken !== undefined ? { reauthToken: input.reauthToken } : {}),
-            });
-            const expiresAt = minted.record.expiresAt ?? Date.now() + input.expiresInDays * DAY_MS;
-            return { token: minted.token, record: adminSummaryOf(minted.record, expiresAt) };
-        }),
-        /** ADMIN — every admin token not yet reaped (no secrets). */
-        listAdminTokens: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(exports.AdminTokenSchema))
-            .query(async () => {
-            const unified = (deps.credentialTokens === null ? [] : await deps.credentialTokens.list())
-                .filter((t) => (0, types_1.scopesGrantAdmin)(t.scopes) && t.expiresAt !== null)
-                .map((t) => adminSummaryOf(t, t.expiresAt ?? 0));
-            const legacy = (await requireInternal(deps.registry).adminTokens.list()).map((t) => ({
-                ...t,
-                legacy: true,
-            }));
-            return [...unified, ...legacy];
-        }),
-        /** ADMIN — revoke one admin token; it stops working at once. */
-        revokeAdminToken: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
-            .mutation(async ({ ctx, input }) => {
-            const internal = requireInternal(deps.registry);
-            const unified = deps.credentialTokens === null ? null : await deps.credentialTokens.get(input.id);
-            const success = unified !== null && deps.credentialTokens !== null
-                ? await deps.credentialTokens.revoke(input.id)
-                : await internal.adminTokens.revoke(input.id);
-            if (success) {
-                const ip = deps.network.clientAddress(ctx.req).ip;
-                await internal.audit.record({
-                    action: 'admin-token-revoked',
-                    userId: ctx.user.id,
-                    ...(ip !== null ? { ip } : {}),
-                    detail: { tokenId: input.id },
-                });
-            }
-            return { success };
-        }),
-        /** ADMIN — the authentication audit trail, newest first. */
-        listAuthAudit: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z
-            .object({
-            limit: zod_1.z.number().int().min(1).max(500).optional(),
-            userId: zod_1.z.string().min(1).optional(),
-        })
-            .optional())
-            .output(zod_1.z.array(exports.AuthAuditRecordSchema))
-            .query(async ({ input }) => [
-            ...(await requireInternal(deps.registry).audit.list({
-                ...(input?.limit !== undefined ? { limit: input.limit } : {}),
-                ...(input?.userId !== undefined ? { userId: input.userId } : {}),
-            })),
-        ]),
-    };
-}