@camstack/system 1.2.380 → 1.2.382

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,13 +1,13 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-B9oFw2jh.mjs";
-import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
-import * as crypto$2 from "node:crypto";
+import { Vn as userManagementCapability, W as UserRecordSchema, Y as authProviderCapability, r as ApiKeyRecordSchema, ur as BaseAddon, z as ScopedTokenSchema } from "../../dist-CP5TTjwd.mjs";
+import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CAbozwvF.mjs";
+import * as crypto$1 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
 import * as path$1 from "node:path";
 import * as fs from "node:fs";
 //#region src/auth/parse-record.ts
-function parseRecord(kind, schema, data) {
+function parseRecord$1(kind, schema, data) {
 	try {
 		return schema.parse(data);
 	} catch (err) {
@@ -19,64 +19,26 @@ function parseRecord(kind, schema, data) {
 }
 //#endregion
 //#region src/auth/api-key-manager.ts
+/**
+* Legacy API keys — LIST and REVOKE only.
+*
+* No boundary accepts one (the tRPC context has no branch for them) and
+* nothing creates them any more: what is left is the rows a hub may still
+* hold, so an operator can see and delete them. Scoped tokens (`cst_`) are
+* the credential for scripts and integrations.
+*/
 var API_KEYS_COLLECTION$1 = "api_keys";
 function parseApiKey(data) {
-	return parseRecord("api-key", ApiKeyRecordSchema, data);
+	return parseRecord$1("api-key", ApiKeyRecordSchema, data);
 }
 var ApiKeyManager = class {
 	storageAccess;
-	auth;
-	constructor(storageAccess, auth) {
+	constructor(storageAccess) {
 		this.storageAccess = storageAccess;
-		this.auth = auth;
 	}
 	get store() {
 		return this.storageAccess.getStore();
 	}
-	async create(input) {
-		const { token: rawToken, hash, prefix } = this.auth.generateApiKey();
-		const now = Date.now();
-		const record = {
-			id: crypto$2.randomUUID(),
-			label: input.label,
-			isAdmin: input.isAdmin ?? false,
-			allowedProviders: input.allowedProviders ?? "*",
-			allowedDevices: input.allowedDevices ?? {},
-			tokenHash: hash,
-			tokenPrefix: prefix,
-			createdAt: now
-		};
-		await this.store.insert.mutate({
-			collection: API_KEYS_COLLECTION$1,
-			record: {
-				id: record.id,
-				data: { ...record }
-			}
-		});
-		return {
-			record,
-			token: rawToken
-		};
-	}
-	async validateToken(token) {
-		const allKeys = await this.store.query.query({ collection: API_KEYS_COLLECTION$1 });
-		for (const entry of allKeys) {
-			const record = parseApiKey(entry.data);
-			if (this.auth.validateApiKey(token, record.tokenHash)) {
-				const updatedData = {
-					...record,
-					lastUsedAt: Date.now()
-				};
-				await this.store.update.mutate({
-					collection: API_KEYS_COLLECTION$1,
-					id: record.id,
-					data: { ...updatedData }
-				});
-				return updatedData;
-			}
-		}
-		return null;
-	}
 	async listAll() {
 		return (await this.store.query.query({ collection: API_KEYS_COLLECTION$1 })).map((r) => {
 			const { tokenHash: _th, ...rest } = parseApiKey(r.data);
@@ -189,7 +151,7 @@ function genSalt(rounds, seed_length, callback) {
 * @returns {!Promise} If `callback` has been omitted
 * @throws {Error} If `callback` is present but not a function
 */
-function hash(password, salt, callback, progressCallback) {
+function hash$1(password, salt, callback, progressCallback) {
 	function _async(callback) {
 		if (typeof password === "string" && typeof salt === "number") genSalt(salt, function(err, salt) {
 			_hash(password, salt, callback, progressCallback);
@@ -242,7 +204,7 @@ function compare(password, hashValue, callback, progressCallback) {
 			nextTick(callback.bind(this, null, false));
 			return;
 		}
-		hash(password, hashValue.substring(0, 29), function(err, comp) {
+		hash$1(password, hashValue.substring(0, 29), function(err, comp) {
 			if (err) callback(err);
 			else callback(null, safeStringCompare(comp, hashValue));
 		}, progressCallback);
@@ -2113,14 +2075,14 @@ var require_buffer_equal_constant_time = /* @__PURE__ */ __commonJSMin(((exports
 //#region ../../node_modules/jwa/index.js
 var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var Buffer = require_safe_buffer().Buffer;
-	var crypto$1 = __require("crypto");
+	var crypto$2 = __require("crypto");
 	var formatEcdsa = require_ecdsa_sig_formatter();
 	var util$2 = __require("util");
 	var MSG_INVALID_ALGORITHM = "\"%s\" is not a valid algorithm.\n  Supported algorithms are:\n  \"HS256\", \"HS384\", \"HS512\", \"RS256\", \"RS384\", \"RS512\", \"PS256\", \"PS384\", \"PS512\", \"ES256\", \"ES384\", \"ES512\" and \"none\".";
 	var MSG_INVALID_SECRET = "secret must be a string or buffer";
 	var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
 	var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-	var supportsKeyObjects = typeof crypto$1.createPublicKey === "function";
+	var supportsKeyObjects = typeof crypto$2.createPublicKey === "function";
 	if (supportsKeyObjects) {
 		MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
 		MSG_INVALID_SECRET += "or a KeyObject";
@@ -2173,14 +2135,14 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, secret) {
 			checkIsSecretKey(secret);
 			thing = normalizeInput(thing);
-			var hmac = crypto$1.createHmac("sha" + bits, secret);
+			var hmac = crypto$2.createHmac("sha" + bits, secret);
 			return fromBase64((hmac.update(thing), hmac.digest("base64")));
 		};
 	}
 	var bufferEqual;
-	var timingSafeEqual = "timingSafeEqual" in crypto$1 ? function timingSafeEqual(a, b) {
+	var timingSafeEqual = "timingSafeEqual" in crypto$2 ? function timingSafeEqual(a, b) {
 		if (a.byteLength !== b.byteLength) return false;
-		return crypto$1.timingSafeEqual(a, b);
+		return crypto$2.timingSafeEqual(a, b);
 	} : function timingSafeEqual(a, b) {
 		if (!bufferEqual) bufferEqual = require_buffer_equal_constant_time();
 		return bufferEqual(a, b);
@@ -2195,7 +2157,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto$1.createSign("RSA-SHA" + bits);
+			var signer = crypto$2.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign(privateKey, "base64")));
 		};
 	}
@@ -2204,7 +2166,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto$1.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$2.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify(publicKey, signature, "base64");
 		};
@@ -2213,11 +2175,11 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto$1.createSign("RSA-SHA" + bits);
+			var signer = crypto$2.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign({
 				key: privateKey,
-				padding: crypto$1.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto$1.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$2.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$2.constants.RSA_PSS_SALTLEN_DIGEST
 			}, "base64")));
 		};
 	}
@@ -2226,12 +2188,12 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto$1.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$2.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify({
 				key: publicKey,
-				padding: crypto$1.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto$1.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$2.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$2.constants.RSA_PSS_SALTLEN_DIGEST
 			}, signature, "base64");
 		};
 	}
@@ -4156,7 +4118,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var validateAsymmetricKey = require_validateAsymmetricKey();
 	var PS_SUPPORTED = require_psSupported();
 	var jws = require_jws();
-	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey } = __require("crypto");
+	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey: createPublicKey$1 } = __require("crypto");
 	var PUB_KEY_ALGS = [
 		"RS256",
 		"RS384",
@@ -4224,7 +4186,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (hasSignature && !secretOrPublicKey) return done(new JsonWebTokenError("secret or public key must be provided"));
 			if (!hasSignature && !options.algorithms) return done(new JsonWebTokenError("please specify \"none\" in \"algorithms\" to verify unsigned tokens"));
 			if (secretOrPublicKey != null && !(secretOrPublicKey instanceof KeyObject$1)) try {
-				secretOrPublicKey = createPublicKey(secretOrPublicKey);
+				secretOrPublicKey = createPublicKey$1(secretOrPublicKey);
 			} catch (_) {
 				try {
 					secretOrPublicKey = createSecretKey$1(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
@@ -6221,7 +6183,15 @@ var AuthManager = class {
 	get jwtSecret() {
 		return this.signingKey.current();
 	}
-	signToken(payload) {
+	/**
+	* @param options.expiresInSec an explicit lifetime (a session's access
+	*   token): wins over `auth.tokenExpiry`, bounded to at least one minute.
+	*/
+	signToken(payload, options = {}) {
+		if (options.expiresInSec !== void 0) {
+			const seconds = Math.max(60, Math.floor(options.expiresInSec));
+			return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn: seconds });
+		}
 		const configured = this.readConfiguredExpiry();
 		const parsed = parseTokenExpiry(configured);
 		if (!parsed.ok) {
@@ -6263,42 +6233,14 @@ var AuthManager = class {
 		return import_jsonwebtoken.verify(token, this.jwtSecret);
 	}
 	async hashPassword(password) {
-		return hash(password, 10);
+		return hash$1(password, 10);
 	}
 	async comparePassword(password, hash) {
 		return compare(password, hash);
 	}
-	generateApiKey() {
-		const token = crypto$2.randomBytes(32).toString("hex");
-		return {
-			token,
-			hash: crypto$2.createHash("sha256").update(token).digest("hex"),
-			prefix: token.slice(0, 8)
-		};
-	}
-	validateApiKey(token, storedHash) {
-		return crypto$2.createHash("sha256").update(token).digest("hex") === storedHash;
-	}
-	/**
-	* Create a service token for agent/worker authentication.
-	* Used when forking workers or when agents register.
-	*/
-	createServiceToken(opts) {
-		const payload = {
-			userId: opts.agentId,
-			username: opts.agentId,
-			isAdmin: true,
-			type: "service",
-			agentId: opts.agentId,
-			allowedProviders: "*",
-			allowedDevices: {}
-		};
-		const expiresIn = opts.expiresIn ?? "24h";
-		return import_jsonwebtoken.sign(payload, this.jwtSecret, { expiresIn });
-	}
 	/**
 	* Mint a short-lived HMAC-signed bridge token used by SSO-style auth
-	* providers (OIDC, SAML, magic-link, …) to hand the post-callback
+	* providers (OIDC, SAML, …) to hand the post-callback
 	* claims to `/api/auth/sso/finish` without trusting unsigned query
 	* parameters. The endpoint verifies the token signature with the same
 	* `jwtSecret` and only then mints the user session JWT. This closes
@@ -6328,7 +6270,8 @@ var AuthManager = class {
 			...payload.sessionId !== void 0 ? { sessionId: payload.sessionId } : {},
 			...payload.refreshTtl !== void 0 ? { refreshTtl: payload.refreshTtl } : {},
 			...payload.linkIntent !== void 0 ? { linkIntent: payload.linkIntent } : {},
-			...payload.issuer !== void 0 ? { issuer: payload.issuer } : {}
+			...payload.issuer !== void 0 ? { issuer: payload.issuer } : {},
+			...payload.browserBinding !== void 0 ? { browserBinding: payload.browserBinding } : {}
 		};
 		/**
 		* `'never'` mints with NO `exp` claim, and the option must be OMITTED to do
@@ -6372,6 +6315,7 @@ var AuthManager = class {
 			const sessionId = typeof decoded["sessionId"] === "string" ? decoded["sessionId"] : void 0;
 			const linkIntent = typeof decoded["linkIntent"] === "string" ? decoded["linkIntent"] : void 0;
 			const issuer = typeof decoded["issuer"] === "string" ? decoded["issuer"] : void 0;
+			const browserBinding = typeof decoded["browserBinding"] === "string" ? decoded["browserBinding"] : void 0;
 			const rawRefreshTtl = decoded["refreshTtl"];
 			const refreshTtl = rawRefreshTtl === "never" || typeof rawRefreshTtl === "number" && rawRefreshTtl > 0 ? rawRefreshTtl : void 0;
 			return {
@@ -6389,7 +6333,8 @@ var AuthManager = class {
 				...sessionId !== void 0 ? { sessionId } : {},
 				...refreshTtl !== void 0 ? { refreshTtl } : {},
 				...linkIntent !== void 0 ? { linkIntent } : {},
-				...issuer !== void 0 ? { issuer } : {}
+				...issuer !== void 0 ? { issuer } : {},
+				...browserBinding !== void 0 ? { browserBinding } : {}
 			};
 		} catch {
 			return null;
@@ -6415,10 +6360,43 @@ var AuthManager = class {
 			kind: "totp-challenge",
 			userId: payload.userId,
 			username: payload.username,
-			isAdmin: payload.isAdmin
+			isAdmin: payload.isAdmin,
+			...payload.method !== void 0 ? { method: payload.method } : {}
 		}, this.jwtSecret, { expiresIn: ttlSec });
 	}
 	/**
+	* A short-lived proof that the signed-in user just re-entered their password
+	* or used a passkey. Sensitive self-service actions (linking a sign-in
+	* account, disabling 2FA, removing a passkey, minting an admin token)
+	* require one. `kind: 'reauth'` keeps it from ever being a bearer.
+	*/
+	signReauthToken(claims, ttlSec = 300) {
+		return import_jsonwebtoken.sign({
+			kind: "reauth",
+			userId: claims.userId,
+			method: claims.method,
+			...claims.sessionId !== void 0 ? { sid: claims.sessionId } : {}
+		}, this.jwtSecret, { expiresIn: ttlSec });
+	}
+	/** Decode a re-authentication proof, or `null` (forged, expired, another kind). */
+	verifyReauthToken(token) {
+		try {
+			const decoded = import_jsonwebtoken.verify(token, this.jwtSecret);
+			if (decoded["kind"] !== "reauth") return null;
+			const userId = decoded["userId"];
+			const method = decoded["method"];
+			const sid = decoded["sid"];
+			if (typeof userId !== "string" || method !== "password" && method !== "passkey") return null;
+			return {
+				userId,
+				method,
+				...typeof sid === "string" ? { sessionId: sid } : {}
+			};
+		} catch {
+			return null;
+		}
+	}
+	/**
 	* Verify + decode a TOTP challenge token. Returns `null` for any
 	* failure (invalid signature, expired, wrong `kind`, missing
 	* claims). The caller MUST also verify the 6-digit code against
@@ -6433,10 +6411,12 @@ var AuthManager = class {
 			const username = decoded["username"];
 			const isAdmin = decoded["isAdmin"];
 			if (typeof userId !== "string" || typeof username !== "string" || typeof isAdmin !== "boolean") return null;
+			const method = decoded["method"];
 			return {
 				userId,
 				username,
-				isAdmin
+				isAdmin,
+				...method === "password" || method === "passkey" || method === "sso" ? { method } : {}
 			};
 		} catch {
 			return null;
@@ -6448,7 +6428,7 @@ var AuthManager = class {
 var TOKENS_COLLECTION = "scoped_tokens";
 var TOKEN_PREFIX = "cst_";
 function parseToken(data) {
-	return parseRecord("scoped-token", ScopedTokenSchema, data);
+	return parseRecord$1("scoped-token", ScopedTokenSchema, data);
 }
 /**
 * Manages scoped API tokens with restricted addon/route/capability access.
@@ -6459,11 +6439,11 @@ var ScopedTokenManager = class {
 		this.store = store;
 	}
 	async create(userId, name, scopes, expiresAt) {
-		const rawToken = `${TOKEN_PREFIX}${crypto$2.randomBytes(32).toString("hex")}`;
-		const tokenHash = crypto$2.createHash("sha256").update(rawToken).digest("hex");
+		const rawToken = `${TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("hex")}`;
+		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
 		const tokenPrefix = rawToken.slice(0, 12);
 		const record = {
-			id: crypto$2.randomUUID(),
+			id: crypto$1.randomUUID(),
 			userId,
 			name,
 			tokenHash,
@@ -6487,7 +6467,7 @@ var ScopedTokenManager = class {
 	}
 	async validate(rawToken) {
 		if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
-		const tokenHash = crypto$2.createHash("sha256").update(rawToken).digest("hex");
+		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
 		const results = await this.store.query.query({
 			collection: TOKENS_COLLECTION,
 			filter: { where: { tokenHash } }
@@ -6610,6 +6590,808 @@ var ScopedTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/login-session-manager.ts
+/**
+* Login sessions — the server-side record behind every session token.
+*
+* A session token used to be a self-contained 30-day JWT: nothing on the hub
+* knew it existed, so logout revoked nothing, a password change left every
+* other device signed in, and a deleted user's sessions lived until they
+* expired. Now every login creates a row here and the token carries its id
+* (`sid`); the hub checks the row on every request (`check`, an in-memory
+* lookup), so revoking a row ends the session at once.
+*
+* Two kinds of client:
+*  - **refreshable** — gets a short access token (default 2 h) and an opaque
+*    refresh token (`csr_…`, stored hashed). `refresh` rotates the refresh
+*    token and slides the session's expiry; presenting a rotated-out refresh
+*    token after a short grace window is treated as theft and revokes the
+*    whole session.
+*  - **legacy** — a client from before refresh tokens: its access token lives
+*    as long as the session, and it renews through the handoff-code pair
+*    (`extend`). Kept for one release so installed viewer apps keep working.
+*
+* `legacyCutoff(userId)` covers tokens minted before sessions existed (no
+* `sid`): a token of that user issued before the cutoff is refused. Revoking
+* all of a user's sessions moves the cutoff, so a password change or a user
+* deletion also ends their pre-session tokens.
+*
+* Mirror: every row is held in memory (a homelab hub has tens of sessions) and
+* written through to the store; revocations update the mirror FIRST, so a
+* store hiccup can delay persistence but never the revocation itself.
+*/
+/**
+* @durable class=ledger owner=local-auth
+*   write="one row per login (password, passkey, SSO, handoff, session exchange);
+*     rewritten on every refresh / renewal (expiry slides, refresh hash rotates)
+*     and on revocation"
+*   retention="the daily reap deletes rows expired more than 7 days ago and rows
+*     revoked more than 30 days ago. A session the user keeps refreshing lives as
+*     long as it is used."
+*/
+var LOGIN_SESSIONS_COLLECTION = "login_sessions";
+/**
+* @durable class=config owner=local-auth
+*   write="revoking all of a user's sessions (logout everywhere, password change or
+*     reset, user deletion) sets that user's cutoff to now"
+*   retention="none — one row per user who ever had all sessions revoked; it only
+*     ever matters for tokens minted before sessions existed, and is harmless after."
+*/
+var LOGIN_SESSION_CUTOFFS_COLLECTION = "login_session_cutoffs";
+var LOGIN_SESSIONS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "method",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "refreshable",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	},
+	{
+		name: "refreshHash",
+		type: "TEXT"
+	},
+	{
+		name: "previousRefreshHash",
+		type: "TEXT"
+	},
+	{
+		name: "rotatedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "client",
+		type: "TEXT"
+	},
+	{
+		name: "ip",
+		type: "TEXT"
+	}
+];
+var LOGIN_SESSION_CUTOFFS_COLUMNS = [{
+	name: "userId",
+	type: "TEXT",
+	primaryKey: true,
+	notNull: true
+}, {
+	name: "notBefore",
+	type: "INTEGER",
+	notNull: true
+}];
+var METHODS = [
+	"password",
+	"passkey",
+	"sso",
+	"handoff",
+	"exchange"
+];
+var REFRESH_TOKEN_PREFIX = "csr_";
+/**
+* A rotated-out refresh token is still honoured this long: two tabs (or a
+* retry after a dropped response) may present the same token a moment apart.
+* After it, the old token is evidence of a copy and ends the session.
+*/
+var REFRESH_REUSE_GRACE_MS = 3e4;
+var EXPIRED_RETENTION_MS = 7 * 864e5;
+var REVOKED_RETENTION_MS = 30 * 864e5;
+/** Longest client label kept (a User-Agent can be huge). */
+var MAX_CLIENT_LABEL = 200;
+function hashToken(token) {
+	return crypto$1.createHash("sha256").update(token).digest("hex");
+}
+function str(data, key) {
+	const value = data[key];
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function num(data, key) {
+	const value = data[key];
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function parseSession$1(data) {
+	const id = str(data, "id");
+	const userId = str(data, "userId");
+	const createdAt = num(data, "createdAt");
+	const lastUsedAt = num(data, "lastUsedAt");
+	const expiresAt = num(data, "expiresAt");
+	const method = METHODS.find((m) => m === data["method"]);
+	if (id === null || userId === null || createdAt === null || expiresAt === null) return null;
+	return {
+		id,
+		userId,
+		method: method ?? "password",
+		refreshable: data["refreshable"] === true || data["refreshable"] === 1,
+		createdAt,
+		lastUsedAt: lastUsedAt ?? createdAt,
+		expiresAt,
+		revokedAt: num(data, "revokedAt"),
+		revokedReason: str(data, "revokedReason"),
+		refreshHash: str(data, "refreshHash"),
+		previousRefreshHash: str(data, "previousRefreshHash"),
+		rotatedAt: num(data, "rotatedAt"),
+		client: str(data, "client"),
+		ip: str(data, "ip")
+	};
+}
+function toLoginSessionSummary(record) {
+	const { refreshHash: _r, previousRefreshHash: _p, rotatedAt: _t, ...summary } = record;
+	return summary;
+}
+var LoginSessionManager = class {
+	store;
+	sessions = /* @__PURE__ */ new Map();
+	/** refresh hash (current or previous) → session id */
+	byRefreshHash = /* @__PURE__ */ new Map();
+	cutoffs = /* @__PURE__ */ new Map();
+	now;
+	logger;
+	constructor(store, options = {}) {
+		this.store = store;
+		this.now = options.now ?? Date.now;
+		this.logger = options.logger ?? null;
+	}
+	/** Load every row into the mirror. Call once at init, before serving. */
+	async load() {
+		const rows = await this.store.query.query({ collection: LOGIN_SESSIONS_COLLECTION });
+		for (const row of rows) {
+			const record = parseSession$1(row.data);
+			if (record !== null) this.remember(record);
+		}
+		const cutoffs = await this.store.query.query({ collection: LOGIN_SESSION_CUTOFFS_COLLECTION });
+		for (const row of cutoffs) {
+			const userId = str(row.data, "userId");
+			const notBefore = num(row.data, "notBefore");
+			if (userId !== null && notBefore !== null) this.cutoffs.set(userId, notBefore);
+		}
+	}
+	async create(input) {
+		const at = this.now();
+		const refreshToken = input.refreshable ? this.newRefreshToken() : null;
+		const session = {
+			id: crypto$1.randomUUID(),
+			userId: input.userId,
+			method: input.method,
+			refreshable: input.refreshable,
+			createdAt: at,
+			lastUsedAt: at,
+			expiresAt: at + input.lifetimeMs,
+			revokedAt: null,
+			revokedReason: null,
+			refreshHash: refreshToken === null ? null : hashToken(refreshToken),
+			previousRefreshHash: null,
+			rotatedAt: null,
+			client: input.client === void 0 ? null : input.client.slice(0, MAX_CLIENT_LABEL),
+			ip: input.ip ?? null
+		};
+		await this.store.insert.mutate({
+			collection: LOGIN_SESSIONS_COLLECTION,
+			record: {
+				id: session.id,
+				data: { ...session }
+			}
+		});
+		this.remember(session);
+		return {
+			session,
+			refreshToken
+		};
+	}
+	/** Is `sessionId` a live session right now? Synchronous: the hub asks on every request. */
+	check(sessionId) {
+		const session = this.sessions.get(sessionId);
+		if (session === void 0) return { state: "unknown" };
+		if (session.revokedAt !== null) return { state: "revoked" };
+		if (session.expiresAt <= this.now()) return { state: "expired" };
+		return {
+			state: "active",
+			session
+		};
+	}
+	/** Epoch ms before which a pre-session (no `sid`) token of `userId` is refused; 0 = none. */
+	legacyCutoff(userId) {
+		return this.cutoffs.get(userId) ?? 0;
+	}
+	/** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
+	async refresh(refreshToken, lifetimeMs) {
+		if (!refreshToken.startsWith("csr_")) return {
+			ok: false,
+			reason: "unknown"
+		};
+		const presented = hashToken(refreshToken);
+		const sessionId = this.byRefreshHash.get(presented);
+		const session = sessionId === void 0 ? void 0 : this.sessions.get(sessionId);
+		if (session === void 0) return {
+			ok: false,
+			reason: "unknown"
+		};
+		if (session.revokedAt !== null) return {
+			ok: false,
+			reason: "revoked"
+		};
+		const at = this.now();
+		if (session.expiresAt <= at) return {
+			ok: false,
+			reason: "expired"
+		};
+		if (presented !== session.refreshHash) {
+			if (!(presented === session.previousRefreshHash && session.rotatedAt !== null && at - session.rotatedAt <= REFRESH_REUSE_GRACE_MS)) {
+				await this.revoke(session.id, "refresh-reuse");
+				this.logger?.warn("A rotated-out refresh token was presented — session revoked", { meta: {
+					sessionId: session.id,
+					userId: session.userId
+				} });
+				return {
+					ok: false,
+					reason: "reused"
+				};
+			}
+		}
+		const next = this.newRefreshToken();
+		const updated = {
+			...session,
+			lastUsedAt: at,
+			expiresAt: at + lifetimeMs,
+			previousRefreshHash: session.refreshHash,
+			refreshHash: hashToken(next),
+			rotatedAt: at
+		};
+		this.replace(session, updated);
+		await this.persist(updated);
+		return {
+			ok: true,
+			session: updated,
+			refreshToken: next
+		};
+	}
+	/** Renew an active session (legacy client): slide its expiry. `null` when it is not active. */
+	async extend(sessionId, lifetimeMs) {
+		const check = this.check(sessionId);
+		if (check.state !== "active") return null;
+		const at = this.now();
+		const updated = {
+			...check.session,
+			lastUsedAt: at,
+			expiresAt: at + lifetimeMs
+		};
+		this.replace(check.session, updated);
+		await this.persist(updated);
+		return updated;
+	}
+	/** End one session. `false` when it was unknown or already ended. */
+	async revoke(sessionId, reason) {
+		const session = this.sessions.get(sessionId);
+		if (session === void 0 || session.revokedAt !== null) return false;
+		const updated = {
+			...session,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.replace(session, updated);
+		await this.persist(updated);
+		return true;
+	}
+	/**
+	* End every live session of `userId` except `exceptSessionId`, and move the
+	* user's legacy cutoff to now (pre-session tokens die too). Returns how many
+	* sessions ended.
+	*/
+	async revokeAllForUser(userId, options) {
+		const at = this.now();
+		this.cutoffs.set(userId, at);
+		const ended = [];
+		for (const session of this.sessions.values()) {
+			if (session.userId !== userId || session.revokedAt !== null) continue;
+			if (session.id === options.exceptSessionId) continue;
+			const updated = {
+				...session,
+				revokedAt: at,
+				revokedReason: options.reason
+			};
+			this.replace(session, updated);
+			ended.push(updated);
+		}
+		await this.persistCutoff(userId, at);
+		for (const session of ended) await this.persist(session);
+		return ended.length;
+	}
+	/** `userId`'s live sessions, newest first. */
+	listForUser(userId) {
+		return this.listActive().filter((s) => s.userId === userId);
+	}
+	/** Every live session, newest first. */
+	listActive() {
+		const at = this.now();
+		return [...this.sessions.values()].filter((s) => s.revokedAt === null && s.expiresAt > at).toSorted((a, b) => b.createdAt - a.createdAt).map(toLoginSessionSummary);
+	}
+	/** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
+	async reap() {
+		const at = this.now();
+		const dead = [...this.sessions.values()].filter((s) => s.revokedAt !== null && at - s.revokedAt > REVOKED_RETENTION_MS || s.revokedAt === null && at - s.expiresAt > EXPIRED_RETENTION_MS);
+		for (const session of dead) {
+			this.forget(session);
+			await this.store.delete.mutate({
+				collection: LOGIN_SESSIONS_COLLECTION,
+				key: session.id
+			});
+		}
+		return dead.length;
+	}
+	newRefreshToken() {
+		return `${REFRESH_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
+	}
+	remember(session) {
+		this.sessions.set(session.id, session);
+		if (session.refreshHash !== null) this.byRefreshHash.set(session.refreshHash, session.id);
+		if (session.previousRefreshHash !== null) this.byRefreshHash.set(session.previousRefreshHash, session.id);
+	}
+	forget(session) {
+		this.sessions.delete(session.id);
+		if (session.refreshHash !== null) this.byRefreshHash.delete(session.refreshHash);
+		if (session.previousRefreshHash !== null) this.byRefreshHash.delete(session.previousRefreshHash);
+	}
+	replace(previous, next) {
+		this.forget(previous);
+		this.remember(next);
+	}
+	async persist(session) {
+		try {
+			await this.store.update.mutate({
+				collection: LOGIN_SESSIONS_COLLECTION,
+				id: session.id,
+				data: { ...session }
+			});
+		} catch (error) {
+			this.logger?.error("Login session write failed — the change holds until restart", { meta: {
+				sessionId: session.id,
+				error: error instanceof Error ? error.message : String(error)
+			} });
+		}
+	}
+	async persistCutoff(userId, notBefore) {
+		try {
+			await this.store.delete.mutate({
+				collection: LOGIN_SESSION_CUTOFFS_COLLECTION,
+				key: userId
+			});
+			await this.store.insert.mutate({
+				collection: LOGIN_SESSION_CUTOFFS_COLLECTION,
+				record: {
+					id: userId,
+					data: {
+						userId,
+						notBefore
+					}
+				}
+			});
+		} catch (error) {
+			this.logger?.error("Login session cutoff write failed — it holds until restart", { meta: {
+				userId,
+				error: error instanceof Error ? error.message : String(error)
+			} });
+		}
+	}
+};
+//#endregion
+//#region src/auth/admin-token-manager.ts
+/**
+* Admin tokens (`csa_…`) — the one credential an ops script can hold that
+* acts as an administrator, minted deliberately and kept on a short leash.
+*
+* Scoped tokens (`cst_`) are never admin, and a script that needs admin (the
+* keychain migration, a release's `applyServerUpdate`) otherwise needs a human
+* login. This is that credential, with the rules the operator set:
+*
+*  - created only by an admin, from the UI, after re-authentication (the hub
+*    router enforces both);
+*  - expiry MANDATORY, at most 90 days;
+*  - shown once — only a SHA-256 hash is stored, like `cst_`;
+*  - every use audit-logged (the hub, per request);
+*  - revocable, and dead the moment its creator is deleted or loses admin;
+*  - NOT a session: an opaque token, so it survives a signing-key change.
+*/
+/**
+* @durable class=config owner=local-auth
+*   write="an admin creates a token (after re-authentication); `lastUsedAt` is
+*     rewritten at most once a minute while it is used; `revoke` stamps revokedAt"
+*   retention="the daily reap deletes rows expired or revoked more than 30 days ago"
+*/
+var ADMIN_TOKENS_COLLECTION = "admin_tokens";
+var ADMIN_TOKENS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "createdBy",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "tokenHash",
+		type: "TEXT",
+		notNull: true,
+		unique: true
+	},
+	{
+		name: "tokenPrefix",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	}
+];
+var ADMIN_TOKEN_PREFIX = "csa_";
+var ADMIN_TOKEN_MAX_LIFETIME_MS = 90 * 864e5;
+var DEAD_RETENTION_MS = 30 * 864e5;
+var TOUCH_EVERY_MS = 6e4;
+function hash(token) {
+	return crypto$1.createHash("sha256").update(token).digest("hex");
+}
+function parse(data) {
+	const { id, createdBy, name, tokenHash, tokenPrefix, createdAt, expiresAt } = data;
+	if (typeof id !== "string" || typeof createdBy !== "string" || typeof name !== "string" || typeof tokenHash !== "string" || typeof tokenPrefix !== "string" || typeof createdAt !== "number" || typeof expiresAt !== "number") return null;
+	return {
+		id,
+		createdBy,
+		name,
+		tokenHash,
+		tokenPrefix,
+		createdAt,
+		expiresAt,
+		lastUsedAt: typeof data["lastUsedAt"] === "number" ? data["lastUsedAt"] : null,
+		revokedAt: typeof data["revokedAt"] === "number" ? data["revokedAt"] : null
+	};
+}
+function summary(stored) {
+	const { tokenHash: _hash, ...record } = stored;
+	return record;
+}
+var AdminTokenManager = class {
+	store;
+	now;
+	constructor(store, now = Date.now) {
+		this.store = store;
+		this.now = now;
+	}
+	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
+	async create(input) {
+		const at = this.now();
+		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw new Error("An admin token must expire within 90 days");
+		const name = input.name.trim().slice(0, 80);
+		if (name.length === 0) throw new Error("An admin token needs a name");
+		const token = `${ADMIN_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
+		const stored = {
+			id: crypto$1.randomUUID(),
+			createdBy: input.createdBy,
+			name,
+			tokenHash: hash(token),
+			tokenPrefix: token.slice(0, 12),
+			createdAt: at,
+			expiresAt: input.expiresAt,
+			lastUsedAt: null,
+			revokedAt: null
+		};
+		await this.store.insert.mutate({
+			collection: ADMIN_TOKENS_COLLECTION,
+			record: {
+				id: stored.id,
+				data: { ...stored }
+			}
+		});
+		return {
+			token,
+			record: summary(stored)
+		};
+	}
+	/** The live record behind `token`, or `null` (unknown, revoked, expired, not a `csa_`). */
+	async validate(token) {
+		if (!token.startsWith("csa_")) return null;
+		const first = (await this.store.query.query({
+			collection: ADMIN_TOKENS_COLLECTION,
+			filter: { where: { tokenHash: hash(token) } }
+		}))[0];
+		const stored = first === void 0 ? null : parse(first.data);
+		if (stored === null || stored.revokedAt !== null) return null;
+		const at = this.now();
+		if (stored.expiresAt <= at) return null;
+		if (stored.lastUsedAt === null || at - stored.lastUsedAt > TOUCH_EVERY_MS) this.store.update.mutate({
+			collection: ADMIN_TOKENS_COLLECTION,
+			id: stored.id,
+			data: {
+				...stored,
+				lastUsedAt: at
+			}
+		}).catch(() => {});
+		return summary(stored);
+	}
+	/** Every token not yet reaped, newest first (no hashes). */
+	async list() {
+		return (await this.store.query.query({ collection: ADMIN_TOKENS_COLLECTION })).map((row) => parse(row.data)).filter((r) => r !== null).map(summary).toSorted((a, b) => b.createdAt - a.createdAt);
+	}
+	/** Revoke one token. `false` when unknown or already revoked. */
+	async revoke(id) {
+		const first = (await this.store.query.query({
+			collection: ADMIN_TOKENS_COLLECTION,
+			filter: { where: { id } }
+		}))[0];
+		const stored = first === void 0 ? null : parse(first.data);
+		if (stored === null || stored.revokedAt !== null) return false;
+		await this.store.update.mutate({
+			collection: ADMIN_TOKENS_COLLECTION,
+			id,
+			data: {
+				...stored,
+				revokedAt: this.now()
+			}
+		});
+		return true;
+	}
+	/** Revoke every live token `userId` created (the user was deleted). */
+	async revokeAllCreatedBy(userId) {
+		let revoked = 0;
+		for (const token of await this.list()) if (token.createdBy === userId && token.revokedAt === null) {
+			if (await this.revoke(token.id)) revoked++;
+		}
+		return revoked;
+	}
+	/** Delete rows expired or revoked more than 30 days ago. */
+	async reap() {
+		const horizon = this.now() - DEAD_RETENTION_MS;
+		let deleted = 0;
+		for (const token of await this.list()) if ((token.revokedAt ?? token.expiresAt) < horizon) {
+			await this.store.delete.mutate({
+				collection: ADMIN_TOKENS_COLLECTION,
+				key: token.id
+			});
+			deleted++;
+		}
+		return deleted;
+	}
+};
+//#endregion
+//#region src/auth/auth-audit-log.ts
+/**
+* The authentication audit trail: what an operator must be able to answer
+* after the fact — "who skipped 2FA from the LAN, and from where?", "which
+* admin token ran this, and when?".
+*
+* One row per event, kept 90 days. Writing never throws: an audit row that
+* cannot be stored is logged loudly instead, and never blocks the action
+* (a login must not fail because the audit table is busy).
+*/
+/**
+* @durable class=ledger owner=local-auth
+*   write="one row per audited auth event: a second factor skipped from a trusted
+*     network, an admin token created / used / revoked"
+*   retention="the daily reap deletes rows older than 90 days"
+*/
+var AUTH_AUDIT_COLLECTION = "auth_audit";
+var AUTH_AUDIT_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "action",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT"
+	},
+	{
+		name: "ip",
+		type: "TEXT"
+	},
+	{
+		name: "detail",
+		type: "TEXT"
+	}
+];
+var AUTH_AUDIT_ACTIONS = [
+	"second-factor-skipped",
+	"admin-token-created",
+	"admin-token-used",
+	"admin-token-revoked"
+];
+var RETENTION_MS = 90 * 864e5;
+var MAX_LIST = 500;
+function parseRecord(data) {
+	const id = data["id"];
+	const at = data["at"];
+	const action = data["action"];
+	const known = AUTH_AUDIT_ACTIONS.find((a) => a === action);
+	if (typeof id !== "string" || typeof at !== "number" || known === void 0) return null;
+	let detail;
+	if (typeof data["detail"] === "string") try {
+		const parsed = JSON.parse(data["detail"]);
+		if (parsed !== null && typeof parsed === "object") detail = Object.fromEntries(Object.entries(parsed).filter((e) => typeof e[1] === "string" || typeof e[1] === "number" || typeof e[1] === "boolean"));
+	} catch {
+		detail = void 0;
+	}
+	return {
+		id,
+		at,
+		action: known,
+		...typeof data["userId"] === "string" ? { userId: data["userId"] } : {},
+		...typeof data["ip"] === "string" ? { ip: data["ip"] } : {},
+		...detail !== void 0 ? { detail } : {}
+	};
+}
+var AuthAuditLog = class {
+	store;
+	logger;
+	now;
+	constructor(store, logger = null, now = Date.now) {
+		this.store = store;
+		this.logger = logger;
+		this.now = now;
+	}
+	/** Record `event`. Never throws. */
+	async record(event) {
+		const row = {
+			id: crypto$1.randomUUID(),
+			at: this.now(),
+			action: event.action,
+			userId: event.userId ?? null,
+			ip: event.ip ?? null,
+			detail: event.detail === void 0 ? null : JSON.stringify(event.detail)
+		};
+		this.logger?.info(`auth audit: ${event.action}`, { meta: {
+			userId: event.userId,
+			ip: event.ip,
+			...event.detail
+		} });
+		try {
+			await this.store.insert.mutate({
+				collection: AUTH_AUDIT_COLLECTION,
+				record: {
+					id: row.id,
+					data: row
+				}
+			});
+		} catch (error) {
+			this.logger?.error("auth audit row not written", { meta: {
+				action: event.action,
+				error: error instanceof Error ? error.message : String(error)
+			} });
+		}
+	}
+	/** Newest first, at most `limit` (≤ 500), optionally one user's. */
+	async list(input = {}) {
+		const rows = await this.store.query.query({
+			collection: AUTH_AUDIT_COLLECTION,
+			...input.userId !== void 0 ? { filter: { where: { userId: input.userId } } } : {}
+		});
+		const limit = Math.min(MAX_LIST, Math.max(1, input.limit ?? 100));
+		return rows.map((row) => parseRecord(row.data)).filter((r) => r !== null).toSorted((a, b) => b.at - a.at).slice(0, limit);
+	}
+	/** Delete rows older than 90 days. Returns how many. */
+	async reap() {
+		const horizon = this.now() - RETENTION_MS;
+		const rows = await this.store.query.query({ collection: AUTH_AUDIT_COLLECTION });
+		let deleted = 0;
+		for (const row of rows) {
+			const at = row.data["at"];
+			if (typeof at === "number" && at < horizon) {
+				await this.store.delete.mutate({
+					collection: AUTH_AUDIT_COLLECTION,
+					key: String(row.id)
+				});
+				deleted++;
+			}
+		}
+		return deleted;
+	}
+};
+//#endregion
+//#region src/auth/user-management-internal.ts
+/** Process-global, so every bundled copy of this module agrees on the key. */
+var USER_MANAGEMENT_INTERNAL = Symbol.for("camstack.user-management.internal");
+/** Attach `internal` to `provider` (returns the same object, now carrying it). */
+function attachUserManagementInternal(provider, internal) {
+	Object.defineProperty(provider, USER_MANAGEMENT_INTERNAL, {
+		value: internal,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return provider;
+}
+/** The hub-internal surface of a `user-management` provider, or `null` when it carries none. */
+function getUserManagementInternal(provider) {
+	if (provider === null || typeof provider !== "object") return null;
+	const internal = Reflect.get(provider, USER_MANAGEMENT_INTERNAL);
+	if (internal === null || typeof internal !== "object") return null;
+	return internal;
+}
+//#endregion
 //#region src/auth/user-manager.ts
 var USERS_COLLECTION$1 = "users";
 /**
@@ -6621,7 +7403,7 @@ var USERS_COLLECTION$1 = "users";
 var FIRST_BOOT_ADMIN_USERNAME = "admin";
 var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 function parseUser(data) {
-	return parseRecord("user", UserRecordSchema, data);
+	return parseRecord$1("user", UserRecordSchema, data);
 }
 var UserManager = class {
 	storageAccess;
@@ -6638,7 +7420,7 @@ var UserManager = class {
 		const passwordHash = await this.auth.hashPassword(input.password);
 		const now = Date.now();
 		const record = {
-			id: crypto$2.randomUUID(),
+			id: crypto$1.randomUUID(),
 			username: input.username,
 			passwordHash,
 			isAdmin: input.isAdmin ?? false,
@@ -7195,6 +7977,34 @@ async function declareAuthSchema(store) {
 			columns: ["userId"]
 		}]
 	});
+	await store.declareCollection.mutate({
+		collection: LOGIN_SESSIONS_COLLECTION,
+		columns: LOGIN_SESSIONS_COLUMNS,
+		indexes: [{
+			name: "idx_login_sessions_user_id",
+			columns: ["userId"]
+		}]
+	});
+	await store.declareCollection.mutate({
+		collection: LOGIN_SESSION_CUTOFFS_COLLECTION,
+		columns: LOGIN_SESSION_CUTOFFS_COLUMNS
+	});
+	await store.declareCollection.mutate({
+		collection: ADMIN_TOKENS_COLLECTION,
+		columns: ADMIN_TOKENS_COLUMNS,
+		indexes: [{
+			name: "idx_admin_tokens_created_by",
+			columns: ["createdBy"]
+		}]
+	});
+	await store.declareCollection.mutate({
+		collection: AUTH_AUDIT_COLLECTION,
+		columns: AUTH_AUDIT_COLUMNS,
+		indexes: [{
+			name: "idx_auth_audit_user_id",
+			columns: ["userId"]
+		}]
+	});
 }
 //#endregion
 //#region src/auth/external-identity-manager.ts
@@ -9915,7 +10725,7 @@ var OauthSessionManager = class {
 	async create(input) {
 		const now = Date.now();
 		const session = {
-			id: crypto$2.randomUUID(),
+			id: crypto$1.randomUUID(),
 			userId: input.userId,
 			username: input.username,
 			integrationId: input.integrationId,
@@ -10068,6 +10878,9 @@ var LocalAuthAddon = class extends BaseAddon {
 	totpManager = null;
 	externalIdentities = null;
 	signingKeyKeeper = null;
+	loginSessions = null;
+	adminTokens = null;
+	auditLog = null;
 	constructor() {
 		super({});
 	}
@@ -10088,11 +10901,15 @@ var LocalAuthAddon = class extends BaseAddon {
 				return store;
 			} };
 			this.userManager = new UserManager(storageAccess, this.authManager);
-			this.apiKeyManager = new ApiKeyManager(storageAccess, this.authManager);
+			this.apiKeyManager = new ApiKeyManager(storageAccess);
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			this.oauthSessionManager = new OauthSessionManager(store);
 			this.totpManager = new TotpManager(store);
 			this.externalIdentities = new ExternalIdentityManager(store);
+			this.loginSessions = new LoginSessionManager(store, { logger: this.ctx.logger });
+			await this.loginSessions.load();
+			this.adminTokens = new AdminTokenManager(store);
+			this.auditLog = new AuthAuditLog(store, this.ctx.logger);
 			try {
 				await reconcileAdminAccountAtBoot({
 					users: this.userManager,
@@ -10185,12 +11002,13 @@ var LocalAuthAddon = class extends BaseAddon {
 			deleteUser: async (input) => {
 				if (!this.userManager) throw new Error("User management not available");
 				await this.userManager.delete(input.id);
-				await this.externalIdentities?.removeAllForUser(input.id);
+				await this.endAllAccess(input.id);
 				return { success: true };
 			},
 			resetPassword: async (input) => {
 				if (!this.userManager) throw new Error("User management not available");
 				await this.userManager.resetPassword(input.id, input.newPassword);
+				await this.loginSessions?.revokeAllForUser(input.id, { reason: "password-reset" });
 				return { success: true };
 			},
 			setUserScopes: async (input) => {
@@ -10212,27 +11030,11 @@ var LocalAuthAddon = class extends BaseAddon {
 				if (!this.apiKeyManager) return [];
 				return this.apiKeyManager.listAll();
 			},
-			createApiKey: async (input) => {
-				if (!this.apiKeyManager) throw new Error("API key management not available");
-				const { record, token } = await this.apiKeyManager.create(input);
-				const { tokenHash: _, ...summary } = record;
-				return {
-					token,
-					record: summary
-				};
-			},
 			revokeApiKey: async (input) => {
 				if (!this.apiKeyManager) throw new Error("API key management not available");
 				await this.apiKeyManager.revoke(input.id);
 				return { success: true };
 			},
-			validateApiKey: async (input) => {
-				if (!this.apiKeyManager) return null;
-				const record = await this.apiKeyManager.validateToken(input.token);
-				if (!record) return null;
-				const { tokenHash: _, ...summary } = record;
-				return summary;
-			},
 			createScopedToken: async (input) => {
 				if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
 				const { token, record } = await this.scopedTokenManager.create(input.userId, input.name, input.scopes, input.expiresAt);
@@ -10247,8 +11049,10 @@ var LocalAuthAddon = class extends BaseAddon {
 				return { success: true };
 			},
 			validateScopedToken: async (input) => {
-				if (!this.scopedTokenManager) return null;
-				return this.scopedTokenManager.validate(input.token);
+				if (!this.scopedTokenManager || !this.userManager) return null;
+				const record = await this.scopedTokenManager.validate(input.token);
+				if (record === null) return null;
+				return await this.userManager.findById(record.userId) === null ? null : record;
 			},
 			listScopedTokens: async (input) => {
 				if (!this.scopedTokenManager) return [];
@@ -10291,12 +11095,6 @@ var LocalAuthAddon = class extends BaseAddon {
 					issuer: link.issuer
 				};
 			},
-			linkExternalIdentity: async (input) => {
-				if (!this.externalIdentities || !this.userManager) throw new Error("External sign-in linking not available");
-				if (!await this.userManager.findById(input.userId)) throw new Error(`User not found: ${input.userId}`);
-				await this.externalIdentities.link(input);
-				return { success: true };
-			},
 			unlinkExternalIdentity: async (input) => {
 				if (!this.externalIdentities) return { success: false };
 				return { success: await this.externalIdentities.unlink(input) };
@@ -10334,6 +11132,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			}
 		};
 		this.ctx.logger.info("registered auth-provider + user-management capabilities");
+		attachUserManagementInternal(userMgmt, this.buildInternal());
 		return [{
 			capability: authProviderCapability,
 			provider: authProvider
@@ -10343,6 +11142,93 @@ var LocalAuthAddon = class extends BaseAddon {
 		}];
 	}
 	/**
+	* The hub-internal surface (`user-management-internal.ts`): operations no
+	* wire may reach. Called only by hub code holding this provider object.
+	*/
+	buildInternal() {
+		const sessions = () => {
+			if (this.loginSessions === null) throw new Error("Login sessions not available");
+			return this.loginSessions;
+		};
+		return {
+			sessions: {
+				create: (input) => sessions().create(input),
+				refresh: (token, lifetimeMs) => sessions().refresh(token, lifetimeMs),
+				extend: (id, lifetimeMs) => sessions().extend(id, lifetimeMs),
+				check: (id) => sessions().check(id),
+				legacyCutoff: (userId) => sessions().legacyCutoff(userId),
+				revoke: (id, reason) => sessions().revoke(id, reason),
+				revokeAllForUser: (userId, options) => sessions().revokeAllForUser(userId, options),
+				listForUser: (userId) => sessions().listForUser(userId),
+				listActive: () => sessions().listActive()
+			},
+			adminTokens: {
+				create: async (input) => {
+					if (this.adminTokens === null) throw new Error("Admin tokens not available");
+					return this.adminTokens.create(input);
+				},
+				validate: async (token) => {
+					if (this.adminTokens === null || this.userManager === null) return null;
+					const record = await this.adminTokens.validate(token);
+					if (record === null) return null;
+					const creator = await this.userManager.findById(record.createdBy);
+					return creator !== null && creator.isAdmin ? record : null;
+				},
+				list: async () => this.adminTokens === null ? [] : this.adminTokens.list(),
+				revoke: async (id) => this.adminTokens === null ? false : this.adminTokens.revoke(id)
+			},
+			audit: {
+				record: async (event) => {
+					await this.auditLog?.record(event);
+				},
+				list: async (input) => this.auditLog === null ? [] : this.auditLog.list(input)
+			},
+			setPassword: async (input) => {
+				if (!this.userManager) throw new Error("User management not available");
+				await this.userManager.resetPassword(input.userId, input.newPassword);
+				await sessions().revokeAllForUser(input.userId, {
+					...input.keepSessionId !== void 0 ? { exceptSessionId: input.keepSessionId } : {},
+					reason: "password-changed"
+				});
+			},
+			linkExternalIdentity: async (input) => {
+				if (!this.externalIdentities || !this.userManager) throw new Error("External sign-in linking not available");
+				if (!await this.userManager.findById(input.userId)) throw new Error(`User not found: ${input.userId}`);
+				await this.externalIdentities.link(input);
+				return { success: true };
+			}
+		};
+	}
+	/**
+	* End every way `userId` could still get in: login sessions (and the
+	* pre-session tokens, via the cutoff), scoped tokens, OAuth account links,
+	* the TOTP row and the external sign-in links. Each step is attempted even
+	* if an earlier one fails, and a failure is logged — a half-cleaned user is
+	* worse than a loud one.
+	*/
+	async endAllAccess(userId) {
+		const steps = [
+			["sessions", async () => this.loginSessions?.revokeAllForUser(userId, { reason: "user-deleted" })],
+			["scoped tokens", async () => {
+				for (const token of await this.scopedTokenManager?.listForUser(userId) ?? []) await this.scopedTokenManager?.revoke(token.id);
+			}],
+			["oauth sessions", async () => {
+				for (const session of await this.oauthSessionManager?.list() ?? []) if (session.userId === userId && session.revokedAt === null) await this.oauthSessionManager?.markRevoked(session.id);
+			}],
+			["admin tokens", async () => this.adminTokens?.revokeAllCreatedBy(userId)],
+			["totp", async () => this.totpManager?.disable(userId)],
+			["sign-in links", async () => this.externalIdentities?.removeAllForUser(userId)]
+		];
+		for (const [what, step] of steps) try {
+			await step();
+		} catch (err) {
+			this.ctx.logger.error(`deleting a user: could not remove its ${what}`, { meta: {
+				userId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+	/**
 	* Drop auth rows that are dead but were never removed: scoped tokens past
 	* their expiry, and OAuth sessions revoked longer ago than
 	* {@link OAUTH_REVOKED_RETENTION_MS}.
@@ -10356,9 +11242,13 @@ var LocalAuthAddon = class extends BaseAddon {
 		try {
 			const tokens = await this.scopedTokenManager?.reapExpired() ?? 0;
 			const sessions = await this.oauthSessionManager?.reapRevoked(Date.now() - OAUTH_REVOKED_RETENTION_MS) ?? 0;
-			if (tokens > 0 || sessions > 0) this.ctx.logger.info("auth retention swept", { meta: {
+			const logins = await this.loginSessions?.reap() ?? 0;
+			await this.adminTokens?.reap();
+			await this.auditLog?.reap();
+			if (tokens > 0 || sessions > 0 || logins > 0) this.ctx.logger.info("auth retention swept", { meta: {
 				expiredTokens: tokens,
-				revokedSessions: sessions
+				revokedSessions: sessions,
+				deadLoginSessions: logins
 			} });
 		} catch (err) {
 			this.ctx.logger.warn("auth retention sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -10377,7 +11267,10 @@ var LocalAuthAddon = class extends BaseAddon {
 		this.scopedTokenManager = null;
 		this.oauthSessionManager = null;
 		this.externalIdentities = null;
+		this.loginSessions = null;
+		this.adminTokens = null;
+		this.auditLog = null;
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as a, require_ms as c, ScopedTokenManager as i, require_safe_buffer as l, FIRST_BOOT_ADMIN_USERNAME as n, SettingsReadUnavailableError as o, UserManager as r, isSettingsReadUnavailable as s, FIRST_BOOT_ADMIN_PASSWORD as t, ApiKeyManager as u };
+export { LocalAuthAddon, LocalAuthAddon as default, isSettingsReadUnavailable as _, attachUserManagementInternal as a, ApiKeyManager as b, ADMIN_TOKEN_MAX_LIFETIME_MS as c, LoginSessionManager as d, REFRESH_TOKEN_PREFIX as f, SettingsReadUnavailableError as g, parseTokenExpiry as h, USER_MANAGEMENT_INTERNAL as i, ADMIN_TOKEN_PREFIX as l, AuthManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, ScopedTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, AdminTokenManager as u, require_ms as v, require_safe_buffer as y };