@camstack/system 1.2.412 → 1.2.414

package/dist/auth/scoped-token-manager.d.ts

@@ -18,7 +18,11 @@ export declare class ScopedTokenManager {
 	* `protectedProcedure`.
 	*/
 	matchesScope(token: ScopedToken, addonId?: string, capability?: string): boolean;
-	revoke(tokenId: string): Promise<void>;
+	/**
+	* Delete the token row. `true` when a row was removed; `false` when the id
+	* was already gone (unknown or previously revoked).
+	*/
+	revoke(tokenId: string): Promise<boolean>;
 	listForUser(userId: string): Promise<ScopedToken[]>;
 	updateLastUsed(tokenId: string): Promise<void>;
 	/**

package/dist/auth/user-management-internal.d.ts

@@ -51,9 +51,25 @@ export interface UserManagementInternal {
 	setPassword(input: SetPasswordInput): Promise<void>;
 	/** Admin tokens (`csa_`) — the hub router gates creation (admin + re-auth). */
 	readonly adminTokens: AdminTokensInternal;
+	/**
+	* Scoped tokens (`cst_`) — hub bulk revoke (`auth.revokeCredentials`).
+	* `revoke` deletes the row; `false` when the id was already gone.
+	*/
+	readonly scopedTokens: ScopedTokensInternal;
+	/**
+	* OAuth account-link sessions — hub bulk revoke. Active → mark revoked;
+	* already revoked → delete the row (so "Remove revoked" clears the list).
+	*/
+	readonly oauthSessions: OauthSessionsInternal;
 	/** The authentication audit trail. */
 	readonly audit: AuthAuditInternal;
 }
+export interface ScopedTokensInternal {
+	revoke(id: string): Promise<boolean>;
+}
+export interface OauthSessionsInternal {
+	revoke(id: string): Promise<boolean>;
+}
 export interface AdminTokensInternal {
 	create(input: {
 		readonly createdBy: string;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -6349,11 +6349,20 @@ var ScopedTokenManager = class {
 		}
 		return false;
 	}
+	/**
+	* Delete the token row. `true` when a row was removed; `false` when the id
+	* was already gone (unknown or previously revoked).
+	*/
 	async revoke(tokenId) {
+		if ((await this.store.query.query({
+			collection: TOKENS_COLLECTION,
+			filter: { where: { id: tokenId } }
+		})).length === 0) return false;
 		await this.store.delete.mutate({
 			collection: TOKENS_COLLECTION,
 			key: tokenId
 		});
+		return true;
 	}
 	async listForUser(userId) {
 		return (await this.store.query.query({
@@ -10642,6 +10651,19 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete one session row. Used by hub bulk revoke when the link is already
+	* revoked ("Remove revoked"): absence fails closed the same way as a
+	* revoked row, so dropping it only clears the list.
+	*/
+	async remove(id) {
+		if (await this.getById(id) === null) return false;
+		await this.store.delete.mutate({
+			collection: SESSIONS_COLLECTION,
+			key: id
+		});
+		return true;
+	}
+	/**
 	* Delete sessions revoked longer ago than `horizonMs`.
 	*
 	* Safe because an ABSENT session already fails closed exactly like a revoked
@@ -10900,7 +10922,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			},
 			revokeScopedToken: async (input) => {
 				if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-				await this.scopedTokenManager.revoke(input.id);
+				if (!await this.scopedTokenManager.revoke(input.id)) throw new Error(`Scoped token not found: ${input.id}`);
 				return { success: true };
 			},
 			validateScopedToken: async (input) => {
@@ -11032,6 +11054,14 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				list: async () => this.adminTokens === null ? [] : this.adminTokens.list(),
 				revoke: async (id) => this.adminTokens === null ? false : this.adminTokens.revoke(id)
 			},
+			scopedTokens: { revoke: async (id) => this.scopedTokenManager === null ? false : this.scopedTokenManager.revoke(id) },
+			oauthSessions: { revoke: async (id) => {
+				if (this.oauthSessionManager === null) return false;
+				const session = await this.oauthSessionManager.getById(id);
+				if (session === null) return false;
+				if (session.revokedAt !== null) return this.oauthSessionManager.remove(id);
+				return this.oauthSessionManager.markRevoked(id);
+			} },
 			audit: {
 				record: async (event) => {
 					await this.auditLog?.record(event);

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -6339,11 +6339,20 @@ var ScopedTokenManager = class {
 		}
 		return false;
 	}
+	/**
+	* Delete the token row. `true` when a row was removed; `false` when the id
+	* was already gone (unknown or previously revoked).
+	*/
 	async revoke(tokenId) {
+		if ((await this.store.query.query({
+			collection: TOKENS_COLLECTION,
+			filter: { where: { id: tokenId } }
+		})).length === 0) return false;
 		await this.store.delete.mutate({
 			collection: TOKENS_COLLECTION,
 			key: tokenId
 		});
+		return true;
 	}
 	async listForUser(userId) {
 		return (await this.store.query.query({
@@ -10632,6 +10641,19 @@ var OauthSessionManager = class {
 		return true;
 	}
 	/**
+	* Delete one session row. Used by hub bulk revoke when the link is already
+	* revoked ("Remove revoked"): absence fails closed the same way as a
+	* revoked row, so dropping it only clears the list.
+	*/
+	async remove(id) {
+		if (await this.getById(id) === null) return false;
+		await this.store.delete.mutate({
+			collection: SESSIONS_COLLECTION,
+			key: id
+		});
+		return true;
+	}
+	/**
 	* Delete sessions revoked longer ago than `horizonMs`.
 	*
 	* Safe because an ABSENT session already fails closed exactly like a revoked
@@ -10890,7 +10912,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			revokeScopedToken: async (input) => {
 				if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-				await this.scopedTokenManager.revoke(input.id);
+				if (!await this.scopedTokenManager.revoke(input.id)) throw new Error(`Scoped token not found: ${input.id}`);
 				return { success: true };
 			},
 			validateScopedToken: async (input) => {
@@ -11022,6 +11044,14 @@ var LocalAuthAddon = class extends BaseAddon {
 				list: async () => this.adminTokens === null ? [] : this.adminTokens.list(),
 				revoke: async (id) => this.adminTokens === null ? false : this.adminTokens.revoke(id)
 			},
+			scopedTokens: { revoke: async (id) => this.scopedTokenManager === null ? false : this.scopedTokenManager.revoke(id) },
+			oauthSessions: { revoke: async (id) => {
+				if (this.oauthSessionManager === null) return false;
+				const session = await this.oauthSessionManager.getById(id);
+				if (session === null) return false;
+				if (session.revokedAt !== null) return this.oauthSessionManager.remove(id);
+				return this.oauthSessionManager.markRevoked(id);
+			} },
 			audit: {
 				record: async (event) => {
 					await this.auditLog?.record(event);

package/dist/builtins/local-auth/oauth-session-manager.d.ts

@@ -41,6 +41,12 @@ export declare class OauthSessionManager {
 	*/
 	markRevoked(id: string): Promise<boolean>;
 	/**
+	* Delete one session row. Used by hub bulk revoke when the link is already
+	* revoked ("Remove revoked"): absence fails closed the same way as a
+	* revoked row, so dropping it only clears the list.
+	*/
+	remove(id: string): Promise<boolean>;
+	/**
 	* Delete sessions revoked longer ago than `horizonMs`.
 	*
 	* Safe because an ABSENT session already fails closed exactly like a revoked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.412",
+  "version": "1.2.414",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",