@camstack/system 1.2.455 → 1.2.457

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,10 +1,10 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Ct as buildDeviceEnrollmentLink, D as DEVICE_NONCE_TTL_MS, E as DEVICE_ENROLLMENT_TTL_MS, Kt as deviceCredentialsCapability, Li as defineRecordKinds, Xi as makeSecretMarker, _a as userError, a as ApiKeyRecordSchema, it as SsoBridgeClaimsSchema, ln as formatDeviceRevoker, lt as TokenScopeSchema, nt as ScopedTokenSchema, qi as isSecretMarker, qr as BaseAddon, ut as UserRecordSchema, vt as authProviderCapability, wr as userManagementCapability, wt as buildDeviceSignatureMessage, y as CredentialTokenClaimsSchema } from "../../dist-BpSENkRJ.mjs";
+import { $ as PreferenceDeviceIdSchema, D as DEVICE_ENROLLMENT_TTL_MS, Ea as userError, En as isCredentialTokenPayload, Et as authProviderCapability, Ki as defineRecordKinds, Mt as buildDeviceSignatureMessage, Nr as userManagementCapability, Q as PREFERENCES_MAX_VALUE_BYTES, _n as formatDeviceRevoker, a as ApiKeyRecordSchema, aa as makeSecretMarker, b as CredentialTokenClaimsSchema, dt as SsoBridgeClaimsSchema, en as deviceCredentialsCapability, et as PreferenceNamespaceSchema, g as CREDENTIAL_TOKEN_AUDIENCE, gt as TokenScopeSchema, jt as buildDeviceEnrollmentLink, k as DEVICE_NONCE_TTL_MS, lt as ScopedTokenSchema, na as isSecretMarker, ni as BaseAddon, tt as PreferenceValueSchema, vt as UserRecordSchema } from "../../dist-Dhux90yB.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-uFbTyY_o.mjs";
-import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-JQUqgQgq.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BB6nHAL5.mjs";
+import { t as resolvePhase6UseRecordsPathForHub } from "../../phase6-declare-gate-x9ZCbQJP.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -29,7 +29,7 @@ function parseRecord$2(kind, schema, data) {
 *
 * No boundary accepts one (the tRPC context has no branch for them) and
 * nothing creates them any more: what is left is the rows a hub may still
-* hold, so an operator can see and delete them. Scoped tokens (`cst_`) are
+* hold, so an operator can see and delete them. Tokens (`auth.mintToken`) are
 * the credential for scripts and integrations.
 */
 var import_read_all_rows = require_read_all_rows();
@@ -182,7 +182,7 @@ function genSalt(rounds, seed_length, callback) {
 * @returns {!Promise} If `callback` has been omitted
 * @throws {Error} If `callback` is present but not a function
 */
-function hash$2(password, salt, callback, progressCallback) {
+function hash$1(password, salt, callback, progressCallback) {
 	function _async(callback) {
 		if (typeof password === "string" && typeof salt === "number") genSalt(salt, function(err, salt) {
 			_hash(password, salt, callback, progressCallback);
@@ -235,7 +235,7 @@ function compare(password, hashValue, callback, progressCallback) {
 			nextTick(callback.bind(this, null, false));
 			return;
 		}
-		hash$2(password, hashValue.substring(0, 29), function(err, comp) {
+		hash$1(password, hashValue.substring(0, 29), function(err, comp) {
 			if (err) callback(err);
 			else callback(null, safeStringCompare(comp, hashValue));
 		}, progressCallback);
@@ -6108,13 +6108,29 @@ var AuthManager = class {
 	* before signing, so nothing outside the schema is ever signed.
 	*/
 	signCredentialToken(claims) {
-		return import_jsonwebtoken.sign(CredentialTokenClaimsSchema.parse(claims), this.jwtSecret);
+		return import_jsonwebtoken.sign(CredentialTokenClaimsSchema.parse(claims), this.jwtSecret, { audience: CREDENTIAL_TOKEN_AUDIENCE });
 	}
+	/**
+	* Verify a session-family JWT: a login session, an account link, a bridge or
+	* challenge token. A MINTED token is refused here even though it carries a
+	* valid signature (D895): every surface that calls this wants a person's
+	* session, and a share link or a script's token must never pass for one.
+	* Minted tokens verify only through {@link verifyCredentialToken}.
+	*/
 	verifyToken(token) {
-		return import_jsonwebtoken.verify(token, this.jwtSecret);
+		const payload = import_jsonwebtoken.verify(token, this.jwtSecret);
+		if (isCredentialTokenPayload(payload)) throw new Error("A minted token is not a session credential");
+		return payload;
+	}
+	/** Verify a minted token (`auth.mintToken`): its signature AND its audience. Throws when invalid. */
+	verifyCredentialToken(token) {
+		const payload = import_jsonwebtoken.verify(token, this.jwtSecret, { audience: CREDENTIAL_TOKEN_AUDIENCE });
+		const claims = CredentialTokenClaimsSchema.safeParse(payload);
+		if (!claims.success) throw new Error("Not a minted token");
+		return claims.data;
 	}
 	async hashPassword(password) {
-		return hash$2(password, 10);
+		return hash$1(password, 10);
 	}
 	async comparePassword(password, hash) {
 		return compare(password, hash);
@@ -6505,19 +6521,11 @@ var AuthAuditLog = class {
 	}
 };
 //#endregion
-//#region src/auth/admin-token-manager.ts
-/**
-* Admin tokens (`csa_…`) — the one credential an ops script can hold that
-* acts as an administrator, minted deliberately and kept on a short leash.
-*
-* Before phase-6 cutover: mint a spare `csa_` token, verify it against the hub,
-* and keep the records-adopt snapshot — a boot guard mistake locks operators out.
-*/
+//#region src/auth/legacy-token-tables.ts
 /**
 * @durable class=config owner=local-auth
-*   write="an admin creates a token (after re-authentication); `lastUsedAt` is
-*     rewritten at most once a minute while it is used; `revoke` stamps revokedAt"
-*   retention="the daily reap deletes rows expired or revoked more than 30 days ago"
+*   write="none since D895 — the pre-D892 rows are kept on disk, read by nothing"
+*   retention="the operator drops the table by hand"
 */
 var ADMIN_TOKENS_COLLECTION = "admin_tokens";
 var ADMIN_TOKENS_COLUMNS = [
@@ -6567,210 +6575,6 @@ var ADMIN_TOKENS_COLUMNS = [
 		type: "INTEGER"
 	}
 ];
-var ADMIN_TOKEN_PREFIX = "csa_";
-var ADMIN_TOKEN_MAX_LIFETIME_MS = 90 * 864e5;
-var DEAD_RETENTION_MS = 30 * 864e5;
-var TOUCH_EVERY_MS = 6e4;
-function hash$1(token) {
-	return crypto$1.createHash("sha256").update(token).digest("hex");
-}
-function parse(data) {
-	const { id, createdBy, name, tokenHash, tokenPrefix, createdAt, expiresAt } = data;
-	if (typeof id !== "string" || typeof createdBy !== "string" || typeof name !== "string" || typeof tokenHash !== "string" || typeof tokenPrefix !== "string" || typeof createdAt !== "number" || typeof expiresAt !== "number") return null;
-	return {
-		id,
-		createdBy,
-		name,
-		tokenHash,
-		tokenPrefix,
-		createdAt,
-		expiresAt,
-		lastUsedAt: typeof data["lastUsedAt"] === "number" ? data["lastUsedAt"] : null,
-		revokedAt: typeof data["revokedAt"] === "number" ? data["revokedAt"] : null
-	};
-}
-function parseBody(id, body) {
-	return parse({
-		id,
-		...body
-	});
-}
-function storedToBody(stored) {
-	return {
-		createdBy: stored.createdBy,
-		name: stored.name,
-		tokenHash: stored.tokenHash,
-		tokenPrefix: stored.tokenPrefix,
-		createdAt: stored.createdAt,
-		expiresAt: stored.expiresAt,
-		lastUsedAt: stored.lastUsedAt,
-		revokedAt: stored.revokedAt
-	};
-}
-function summary(stored) {
-	const { tokenHash: _hash, ...record } = stored;
-	return record;
-}
-var AdminTokenManager = class {
-	now;
-	kind;
-	store;
-	constructor(deps, now = Date.now) {
-		this.now = now;
-		if ("adminTokensKind" in deps) {
-			this.kind = deps.adminTokensKind;
-			this.store = deps.store ?? null;
-		} else {
-			this.kind = null;
-			this.store = deps;
-		}
-	}
-	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
-	async create(input) {
-		const at = this.now();
-		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw userError("system.admin-token-expiry-too-long", void 0, "An admin token must expire within 90 days");
-		const name = input.name.trim().slice(0, 80);
-		if (name.length === 0) throw userError("system.admin-token-name-required", void 0, "An admin token needs a name");
-		const token = `${ADMIN_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
-		const stored = {
-			id: crypto$1.randomUUID(),
-			createdBy: input.createdBy,
-			name,
-			tokenHash: hash$1(token),
-			tokenPrefix: token.slice(0, 12),
-			createdAt: at,
-			expiresAt: input.expiresAt,
-			lastUsedAt: null,
-			revokedAt: null
-		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const body = storedToBody(stored);
-			const parsed = localAuthRecordKinds["admin-tokens"].schema.safeParse(body);
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: stored.id,
-				expiresAt: stored.expiresAt,
-				data: parsed.data
-			});
-			return {
-				token,
-				record: summary(stored)
-			};
-		}
-		await this.store.insert.mutate({
-			collection: ADMIN_TOKENS_COLLECTION,
-			record: {
-				id: stored.id,
-				data: { ...stored }
-			}
-		});
-		return {
-			token,
-			record: summary(stored)
-		};
-	}
-	/** The live record behind `token`, or `null` (unknown, revoked, expired, not a `csa_`). */
-	async validate(token) {
-		if (!token.startsWith("csa_")) return null;
-		const tokenHash = hash$1(token);
-		const kind = this.kind;
-		let stored = null;
-		if (kind !== null) {
-			const row = (await kind.query({
-				where: { tokenHash },
-				limit: 1
-			})).records[0];
-			stored = row === void 0 ? null : parseBody(row.id, row.data);
-		} else {
-			const first = (await this.store.query.query({
-				collection: ADMIN_TOKENS_COLLECTION,
-				filter: { where: { tokenHash } }
-			}))[0];
-			stored = first === void 0 ? null : parse(first.data);
-		}
-		if (stored === null || stored.revokedAt !== null) return null;
-		const at = this.now();
-		if (stored.expiresAt <= at) return null;
-		if (stored.lastUsedAt === null || at - stored.lastUsedAt > TOUCH_EVERY_MS) {
-			const next = {
-				...stored,
-				lastUsedAt: at
-			};
-			if (kind !== null) kind.put({
-				id: stored.id,
-				expiresAt: stored.expiresAt,
-				data: storedToBody(next)
-			}).catch(() => {});
-			else this.store.update.mutate({
-				collection: ADMIN_TOKENS_COLLECTION,
-				id: stored.id,
-				data: { ...next }
-			}).catch(() => {});
-		}
-		return summary(stored);
-	}
-	/** Every token not yet reaped, newest first (no hashes). */
-	async list() {
-		const kind = this.kind;
-		if (kind !== null) return (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => parseBody(row.id, row.data)).filter((r) => r !== null).map(summary).toSorted((a, b) => b.createdAt - a.createdAt);
-		return (await this.store.query.query({ collection: ADMIN_TOKENS_COLLECTION })).map((row) => parse(row.data)).filter((r) => r !== null).map(summary).toSorted((a, b) => b.createdAt - a.createdAt);
-	}
-	/** Revoke one token. `false` when unknown or already revoked. */
-	async revoke(id) {
-		const kind = this.kind;
-		let stored = null;
-		if (kind !== null) {
-			const row = await kind.get(id);
-			stored = row === null ? null : parseBody(row.id, row.data);
-		} else {
-			const first = (await this.store.query.query({
-				collection: ADMIN_TOKENS_COLLECTION,
-				filter: { where: { id } }
-			}))[0];
-			stored = first === void 0 ? null : parse(first.data);
-		}
-		if (stored === null || stored.revokedAt !== null) return false;
-		const next = {
-			...stored,
-			revokedAt: this.now()
-		};
-		if (kind !== null) await kind.put({
-			id,
-			expiresAt: next.expiresAt,
-			data: storedToBody(next)
-		});
-		else await this.store.update.mutate({
-			collection: ADMIN_TOKENS_COLLECTION,
-			id,
-			data: { ...next }
-		});
-		return true;
-	}
-	/** Revoke every live token `userId` created (the user was deleted). */
-	async revokeAllCreatedBy(userId) {
-		let revoked = 0;
-		for (const token of await this.list()) if (token.createdBy === userId && token.revokedAt === null) {
-			if (await this.revoke(token.id)) revoked++;
-		}
-		return revoked;
-	}
-	/** Delete rows expired or revoked more than 30 days ago. */
-	async reap() {
-		const horizon = this.now() - DEAD_RETENTION_MS;
-		let deleted = 0;
-		for (const token of await this.list()) if ((token.revokedAt ?? token.expiresAt) < horizon) {
-			const kind = this.kind;
-			if (kind !== null) await kind.delete(token.id);
-			else await this.store.delete.mutate({
-				collection: ADMIN_TOKENS_COLLECTION,
-				key: token.id
-			});
-			deleted++;
-		}
-		return deleted;
-	}
-};
 //#endregion
 //#region src/auth/device-credential-manager.ts
 /**
@@ -7382,82 +7186,80 @@ var DeviceCredentialManager = class {
 	}
 };
 //#endregion
-//#region src/auth/session-revocation-bus.ts
-var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
-function listeners() {
-	const existing = Reflect.get(globalThis, BUS_KEY);
-	if (existing instanceof Set) return existing;
-	const created = /* @__PURE__ */ new Set();
-	Reflect.set(globalThis, BUS_KEY, created);
-	return created;
-}
-/** Subscribe; returns the unsubscribe. */
-function onSessionsRevoked(listener) {
-	const set = listeners();
-	set.add(listener);
-	return () => {
-		set.delete(listener);
-	};
-}
-/** Announce an ended batch. A listener that throws never reaches the revoke. */
-function announceSessionsRevoked(event, onListenerError) {
-	if (event.sessionIds.length === 0 && !event.allOfUser) return;
-	for (const listener of [...listeners()]) try {
-		listener(event);
-	} catch (error) {
-		onListenerError?.(error);
-	}
-}
-//#endregion
-//#region src/auth/login-session-manager.ts
+//#region src/builtins/local-auth/auth-schema.ts
 /**
-* Login sessions — the server-side record behind every session token.
-*
-* A session token used to be a self-contained 30-day JWT: nothing on the hub
-* knew it existed, so logout revoked nothing, a password change left every
-* other device signed in, and a deleted user's sessions lived until they
-* expired. Now every login creates a row here and the token carries its id
-* (`sid`); the hub checks the row on every request (`check`, an in-memory
-* lookup), so revoking a row ends the session at once.
-*
-* Two kinds of client:
-*  - **refreshable** — gets a short access token (default 2 h) and an opaque
-*    refresh token (`csr_…`, stored hashed). `refresh` rotates the refresh
-*    token and slides the session's expiry; presenting a rotated-out refresh
-*    token after a short grace window is treated as theft and revokes the
-*    whole session.
-*  - **legacy** — a client from before refresh tokens: its access token lives
-*    as long as the session, and it renews through the handoff-code pair
-*    (`extend`). Kept for one release so installed viewer apps keep working.
-*
-* `legacyCutoff(userId)` covers tokens minted before sessions existed (no
-* `sid`): a token of that user issued before the cutoff is refused. Revoking
-* all of a user's sessions moves the cutoff, so a password change or a user
-* deletion also ends their pre-session tokens.
-*
-* Mirror: every row is held in memory (a homelab hub has tens of sessions) and
-* written through to the store; revocations update the mirror FIRST, so a
-* store hiccup can delay persistence but never the revocation itself.
+* @durable class=config owner=local-auth
+*   write="an operator creates a user, or `ensureAdminExists` seeds the configured
+*     admin on first boot (or resets its password on the operator's one-shot
+*     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
+*   retention="none — a row goes only when an operator deletes the user. A
+*     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
+*     REBUILDS the table: every account is wiped and only the configured admin
+*     comes back on the next boot."
 */
+var USERS_COLLECTION$1 = "users";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
+*     every request the key authorises"
+*   retention="none — an explicit `revoke` is the only delete. API keys have no
+*     expiry column and no sweep, so a key lives until someone removes it (or the
+*     destructive `declareCollection` rebuild takes the table)."
+*/
+var API_KEYS_COLLECTION = "api_keys";
+/**
+* @durable class=config owner=local-auth
+*   write="none since D895 — the pre-D892 scoped-token rows are kept on disk,
+*     read by nothing (a scoped token is a `credential-tokens` row)"
+*   retention="the operator drops the table by hand"
+*/
+var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
 /**
 * @durable class=ledger owner=local-auth
-*   write="one row per login (password, passkey, SSO, handoff, session exchange);
-*     rewritten on every refresh / renewal (expiry slides, refresh hash rotates)
-*     and on revocation"
-*   retention="the daily reap deletes rows expired more than 7 days ago and rows
-*     revoked more than 30 days ago. A session the user keeps refreshing lives as
-*     long as it is used."
+*   write="one row per redeemed OAuth code — every completed account link through
+*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
+*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
+*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
+*     has `revokedAt` NULL, never expires and is never swept — the table grows one
+*     row per login until an operator revokes the link."
 */
-var LOGIN_SESSIONS_COLLECTION = "login_sessions";
+var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
+/**
+* TOTP enrollment table — split off from `users` to avoid the
+* destructive drop-+-recreate migration `ensureTable` performs when a
+* new column is added to a typed schema (see `sqlite-settings-backend.ts`).
+*
+* Lifecycle:
+*   - Setup: row inserted with `confirmedAt = null` and a fresh secret.
+*   - Confirm: a valid code from the secret flips `confirmedAt` to now().
+*   - Disable: the row is deleted (next setup starts fresh).
+*
+* "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
+* = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+*
+* @durable class=config owner=local-auth
+*   write="`setup` inserts a keychain marker for the user's seed (D878; deleting any pending row
+*     first); `confirm` flips `confirmedAt` once a valid code proves possession"
+*   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
+*     Nothing else prunes — deleting a USER does not cascade here, so their
+*     enrollment row outlives the account."
+*/
+var USER_TOTP_COLLECTION = "user_totp";
 /**
+* External sign-in identities linked to local users (D782): one row per
+* `(provider, subject)` — the row id IS the identity, so one identity maps to
+* one user by primary key. Written only by the identity's owner completing a
+* "Link" flow from their profile (bound to their session).
+*
 * @durable class=config owner=local-auth
-*   write="revoking all of a user's sessions (logout everywhere, password change or
-*     reset, user deletion) sets that user's cutoff to now"
-*   retention="none — one row per user who ever had all sessions revoked; it only
-*     ever matters for tokens minted before sessions existed, and is harmless after."
+*   write="`ExternalIdentityManager.link` when a signed-in user completes a
+*     link flow; `unlink` from the profile or the Users page"
+*   retention="`unlink` deletes one row; deleting the user deletes all of its
+*     rows (`deleteUser` → `removeAllForUser`). A row whose provider instance
+*     was renamed or removed stays, inert, until someone unlinks it."
 */
-var LOGIN_SESSION_CUTOFFS_COLLECTION = "login_session_cutoffs";
-var LOGIN_SESSIONS_COLUMNS = [
+var USER_EXTERNAL_IDENTITIES_COLLECTION = "user_external_identities";
+var USERS_COLUMNS = [
 	{
 		name: "id",
 		type: "TEXT",
@@ -7465,813 +7267,241 @@ var LOGIN_SESSIONS_COLUMNS = [
 		notNull: true
 	},
 	{
-		name: "userId",
+		name: "username",
 		type: "TEXT",
-		notNull: true
+		notNull: true,
+		unique: true
 	},
 	{
-		name: "method",
+		name: "passwordHash",
 		type: "TEXT",
 		notNull: true
 	},
 	{
-		name: "refreshable",
+		name: "isAdmin",
 		type: "BOOLEAN",
 		notNull: true
 	},
 	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
+		name: "allowedProviders",
+		type: "JSON"
 	},
 	{
-		name: "lastUsedAt",
-		type: "INTEGER",
-		notNull: true
+		name: "allowedDevices",
+		type: "JSON"
 	},
 	{
-		name: "expiresAt",
-		type: "INTEGER",
-		notNull: true
+		name: "scopes",
+		type: "JSON"
 	},
 	{
-		name: "revokedAt",
-		type: "INTEGER"
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
 	},
 	{
-		name: "revokedReason",
-		type: "TEXT"
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var API_KEYS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
 	},
 	{
-		name: "refreshHash",
-		type: "TEXT"
+		name: "label",
+		type: "TEXT",
+		notNull: true
 	},
 	{
-		name: "previousRefreshHash",
-		type: "TEXT"
+		name: "isAdmin",
+		type: "BOOLEAN",
+		notNull: true
 	},
 	{
-		name: "rotatedAt",
+		name: "tokenHash",
+		type: "TEXT",
+		notNull: true,
+		unique: true
+	},
+	{
+		name: "tokenPrefix",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "allowedProviders",
+		type: "JSON"
+	},
+	{
+		name: "allowedDevices",
+		type: "JSON"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
 		type: "INTEGER"
+	}
+];
+var USER_TOTP_COLUMNS = [
+	{
+		name: "userId",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
 	},
 	{
-		name: "client",
-		type: "TEXT"
+		name: "secret",
+		type: "TEXT",
+		notNull: true
 	},
 	{
-		name: "ip",
-		type: "TEXT"
+		name: "confirmedAt",
+		type: "INTEGER"
 	},
 	{
-		name: "credentialId",
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var USER_EXTERNAL_IDENTITIES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "provider",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "subject",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "issuer",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "label",
 		type: "TEXT"
+	},
+	{
+		name: "linkedAt",
+		type: "INTEGER",
+		notNull: true
 	}
 ];
-var LOGIN_SESSION_CUTOFFS_COLUMNS = [{
-	name: "userId",
-	type: "TEXT",
-	primaryKey: true,
-	notNull: true
-}, {
-	name: "notBefore",
-	type: "INTEGER",
-	notNull: true
-}];
-var METHODS = [
-	"password",
-	"passkey",
-	"sso",
-	"handoff",
-	"exchange",
-	"device-certificate"
+var SCOPED_TOKENS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "tokenHash",
+		type: "TEXT",
+		notNull: true,
+		unique: true
+	},
+	{
+		name: "tokenPrefix",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "scopes",
+		type: "JSON"
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER"
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var OAUTH_SESSIONS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "username",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "integrationId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "scopes",
+		type: "JSON"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	}
 ];
-var REFRESH_TOKEN_PREFIX = "csr_";
 /**
-* A rotated-out refresh token is still honoured this long: two tabs (or a
-* retry after a dropped response) may present the same token a moment apart.
-* After it, the old token is evidence of a copy and ends the session.
-*/
-var REFRESH_REUSE_GRACE_MS = 3e4;
-var EXPIRED_RETENTION_MS = 7 * 864e5;
-var REVOKED_RETENTION_MS = 30 * 864e5;
-/** Longest client label kept (a User-Agent can be huge). */
-var MAX_CLIENT_LABEL = 200;
-function hashToken(token) {
-	return crypto$1.createHash("sha256").update(token).digest("hex");
-}
-function str(data, key) {
-	const value = data[key];
-	return typeof value === "string" && value.length > 0 ? value : null;
-}
-function num(data, key) {
-	const value = data[key];
-	return typeof value === "number" && Number.isFinite(value) ? value : null;
-}
-function parseSession$1(data) {
-	const id = str(data, "id");
-	const userId = str(data, "userId");
-	const createdAt = num(data, "createdAt");
-	const lastUsedAt = num(data, "lastUsedAt");
-	const expiresAt = num(data, "expiresAt");
-	const method = METHODS.find((m) => m === data["method"]);
-	if (id === null || userId === null || createdAt === null || expiresAt === null) return null;
-	return {
-		id,
-		userId,
-		method: method ?? "password",
-		refreshable: data["refreshable"] === true || data["refreshable"] === 1,
-		createdAt,
-		lastUsedAt: lastUsedAt ?? createdAt,
-		expiresAt,
-		revokedAt: num(data, "revokedAt"),
-		revokedReason: str(data, "revokedReason"),
-		refreshHash: str(data, "refreshHash"),
-		previousRefreshHash: str(data, "previousRefreshHash"),
-		rotatedAt: num(data, "rotatedAt"),
-		client: str(data, "client"),
-		ip: str(data, "ip"),
-		credentialId: str(data, "credentialId")
-	};
-}
-function toLoginSessionSummary(record) {
-	const { refreshHash: _r, previousRefreshHash: _p, rotatedAt: _t, ...summary } = record;
-	return summary;
-}
-function sessionToBody$1(session) {
-	const { id: _id, ...body } = session;
-	return body;
-}
-var LoginSessionManager = class {
-	sessions = /* @__PURE__ */ new Map();
-	/** refresh hash (current or previous) → session id */
-	byRefreshHash = /* @__PURE__ */ new Map();
-	cutoffs = /* @__PURE__ */ new Map();
-	now;
-	logger;
-	sessionsKind;
-	cutoffsKind;
-	store;
-	constructor(deps, options = {}) {
-		if ("sessionsKind" in deps) {
-			this.sessionsKind = deps.sessionsKind;
-			this.cutoffsKind = deps.cutoffsKind;
-			this.store = deps.legacyStore ?? null;
-		} else {
-			this.sessionsKind = null;
-			this.cutoffsKind = null;
-			this.store = deps;
-		}
-		this.now = options.now ?? Date.now;
-		this.logger = options.logger ?? null;
-	}
-	/** Load every row into the mirror. Call once at init, before serving. */
-	async load() {
-		const sessionsKind = this.sessionsKind;
-		if (sessionsKind !== null) {
-			const rows = await (0, import_read_all_rows.readAllRows)(sessionsKind);
-			for (const row of rows) {
-				const record = parseSession$1({
-					id: row.id,
-					...row.data
-				});
-				if (record !== null) this.remember(record);
-			}
-			const cutoffs = await (0, import_read_all_rows.readAllRows)(this.cutoffsKind);
-			for (const row of cutoffs) this.cutoffs.set(row.id, row.data.notBefore);
-			return;
-		}
-		const rows = await this.store.query.query({ collection: LOGIN_SESSIONS_COLLECTION });
-		for (const row of rows) {
-			const record = parseSession$1(row.data);
-			if (record !== null) this.remember(record);
-		}
-		const cutoffs = await this.store.query.query({ collection: LOGIN_SESSION_CUTOFFS_COLLECTION });
-		for (const row of cutoffs) {
-			const userId = str(row.data, "userId");
-			const notBefore = num(row.data, "notBefore");
-			if (userId !== null && notBefore !== null) this.cutoffs.set(userId, notBefore);
-		}
-	}
-	async create(input) {
-		const at = this.now();
-		const refreshToken = input.refreshable ? this.newRefreshToken() : null;
-		const session = {
-			id: crypto$1.randomUUID(),
-			userId: input.userId,
-			method: input.method,
-			refreshable: input.refreshable,
-			createdAt: at,
-			lastUsedAt: at,
-			expiresAt: at + input.lifetimeMs,
-			revokedAt: null,
-			revokedReason: null,
-			refreshHash: refreshToken === null ? null : hashToken(refreshToken),
-			previousRefreshHash: null,
-			rotatedAt: null,
-			client: input.client === void 0 ? null : input.client.slice(0, MAX_CLIENT_LABEL),
-			ip: input.ip ?? null,
-			credentialId: input.credentialId ?? null
-		};
-		const sessionsKind = this.sessionsKind;
-		if (sessionsKind !== null) {
-			const parsed = localAuthRecordKinds["login-sessions"].schema.safeParse(sessionToBody$1(session));
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await sessionsKind.put({
-				id: session.id,
-				at: session.createdAt,
-				expiresAt: session.expiresAt,
-				data: parsed.data
-			});
-		} else await this.store.insert.mutate({
-			collection: LOGIN_SESSIONS_COLLECTION,
-			record: {
-				id: session.id,
-				data: { ...session }
-			}
-		});
-		this.remember(session);
-		return {
-			session,
-			refreshToken
-		};
-	}
-	/** Is `sessionId` a live session right now? Synchronous: the hub asks on every request. */
-	check(sessionId) {
-		const session = this.sessions.get(sessionId);
-		if (session === void 0) return { state: "unknown" };
-		if (session.revokedAt !== null) return { state: "revoked" };
-		if (session.expiresAt <= this.now()) return { state: "expired" };
-		return {
-			state: "active",
-			session
-		};
-	}
-	/** Epoch ms before which a pre-session (no `sid`) token of `userId` is refused; 0 = none. */
-	legacyCutoff(userId) {
-		return this.cutoffs.get(userId) ?? 0;
-	}
-	/**
-	* The session a refresh token belongs to, WITHOUT rotating it - so the
-	* refresh path can judge the session (its device credential) before it
-	* spends the token. `null` when the token names no session.
-	*/
-	peekByRefreshToken(refreshToken) {
-		if (!refreshToken.startsWith("csr_")) return null;
-		const sessionId = this.byRefreshHash.get(hashToken(refreshToken));
-		return sessionId === void 0 ? null : this.sessions.get(sessionId) ?? null;
-	}
-	/** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
-	async refresh(refreshToken, lifetimeMs) {
-		if (!refreshToken.startsWith("csr_")) return {
-			ok: false,
-			reason: "unknown"
-		};
-		const presented = hashToken(refreshToken);
-		const sessionId = this.byRefreshHash.get(presented);
-		const session = sessionId === void 0 ? void 0 : this.sessions.get(sessionId);
-		if (session === void 0) return {
-			ok: false,
-			reason: "unknown"
-		};
-		if (session.revokedAt !== null) return {
-			ok: false,
-			reason: "revoked"
-		};
-		const at = this.now();
-		if (session.expiresAt <= at) return {
-			ok: false,
-			reason: "expired"
-		};
-		if (presented !== session.refreshHash) {
-			if (!(presented === session.previousRefreshHash && session.rotatedAt !== null && at - session.rotatedAt <= REFRESH_REUSE_GRACE_MS)) {
-				await this.revoke(session.id, "refresh-reuse");
-				this.logger?.warn("A rotated-out refresh token was presented — session revoked", { meta: {
-					sessionId: session.id,
-					userId: session.userId
-				} });
-				return {
-					ok: false,
-					reason: "reused"
-				};
-			}
-		}
-		const next = this.newRefreshToken();
-		const updated = {
-			...session,
-			lastUsedAt: at,
-			expiresAt: at + lifetimeMs,
-			previousRefreshHash: session.refreshHash,
-			refreshHash: hashToken(next),
-			rotatedAt: at
-		};
-		this.replace(session, updated);
-		await this.persist(updated);
-		return {
-			ok: true,
-			session: updated,
-			refreshToken: next
-		};
-	}
-	/** Renew an active session (legacy client): slide its expiry. `null` when it is not active. */
-	async extend(sessionId, lifetimeMs) {
-		const check = this.check(sessionId);
-		if (check.state !== "active") return null;
-		const at = this.now();
-		const updated = {
-			...check.session,
-			lastUsedAt: at,
-			expiresAt: at + lifetimeMs
-		};
-		this.replace(check.session, updated);
-		await this.persist(updated);
-		return updated;
-	}
-	/** End one session. `false` when it was unknown or already ended. */
-	async revoke(sessionId, reason) {
-		const session = this.sessions.get(sessionId);
-		if (session === void 0 || session.revokedAt !== null) return false;
-		const updated = {
-			...session,
-			revokedAt: this.now(),
-			revokedReason: reason
-		};
-		this.replace(session, updated);
-		this.announce([updated.id], session.userId, false, null, reason);
-		await this.persist(updated);
-		return true;
-	}
-	/**
-	* End every live session of `userId` except `exceptSessionId`, and move the
-	* user's legacy cutoff to now (pre-session tokens die too). Returns how many
-	* sessions ended.
-	*/
-	async revokeAllForUser(userId, options) {
-		const at = this.now();
-		this.cutoffs.set(userId, at);
-		const ended = [];
-		for (const session of this.sessions.values()) {
-			if (session.userId !== userId || session.revokedAt !== null) continue;
-			if (session.id === options.exceptSessionId) continue;
-			const updated = {
-				...session,
-				revokedAt: at,
-				revokedReason: options.reason
-			};
-			this.replace(session, updated);
-			ended.push(updated);
-		}
-		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
-		await this.persistCutoff(userId, at);
-		for (const session of ended) await this.persist(session);
-		return ended.length;
-	}
-	/** End every live session opened by device credential `credentialId`. Returns how many. */
-	async revokeByCredential(credentialId, reason = "credential-revoked") {
-		const at = this.now();
-		const ended = [];
-		for (const session of this.sessions.values()) {
-			if (session.credentialId !== credentialId || session.revokedAt !== null) continue;
-			const updated = {
-				...session,
-				revokedAt: at,
-				revokedReason: reason
-			};
-			this.replace(session, updated);
-			ended.push(updated);
-		}
-		this.announce(ended.map((s) => s.id), null, false, null, reason);
-		for (const session of ended) await this.persist(session);
-		return ended.length;
-	}
-	/** `userId`'s live sessions, newest first. */
-	listForUser(userId) {
-		return this.listActive().filter((s) => s.userId === userId);
-	}
-	/** Every live session, newest first. */
-	listActive() {
-		const at = this.now();
-		return [...this.sessions.values()].filter((s) => s.revokedAt === null && s.expiresAt > at).toSorted((a, b) => b.createdAt - a.createdAt).map(toLoginSessionSummary);
-	}
-	/** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
-	async reap() {
-		const at = this.now();
-		const dead = [...this.sessions.values()].filter((s) => s.revokedAt !== null && at - s.revokedAt > REVOKED_RETENTION_MS || s.revokedAt === null && at - s.expiresAt > EXPIRED_RETENTION_MS);
-		for (const session of dead) {
-			this.forget(session);
-			const sessionsKind = this.sessionsKind;
-			if (sessionsKind !== null) await sessionsKind.delete(session.id);
-			else await this.store.delete.mutate({
-				collection: LOGIN_SESSIONS_COLLECTION,
-				key: session.id
-			});
-		}
-		return dead.length;
-	}
-	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
-	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
-		announceSessionsRevoked({
-			sessionIds,
-			userId,
-			allOfUser,
-			exceptSessionId,
-			reason
-		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
-	}
-	newRefreshToken() {
-		return `${REFRESH_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
-	}
-	remember(session) {
-		this.sessions.set(session.id, session);
-		if (session.refreshHash !== null) this.byRefreshHash.set(session.refreshHash, session.id);
-		if (session.previousRefreshHash !== null) this.byRefreshHash.set(session.previousRefreshHash, session.id);
-	}
-	forget(session) {
-		this.sessions.delete(session.id);
-		if (session.refreshHash !== null) this.byRefreshHash.delete(session.refreshHash);
-		if (session.previousRefreshHash !== null) this.byRefreshHash.delete(session.previousRefreshHash);
-	}
-	replace(previous, next) {
-		this.forget(previous);
-		this.remember(next);
-	}
-	async persist(session) {
-		try {
-			const sessionsKind = this.sessionsKind;
-			if (sessionsKind !== null) {
-				const parsed = localAuthRecordKinds["login-sessions"].schema.safeParse(sessionToBody$1(session));
-				if (!parsed.success) throw new Error(parsed.error.message);
-				await sessionsKind.put({
-					id: session.id,
-					at: session.createdAt,
-					expiresAt: session.expiresAt,
-					data: parsed.data
-				});
-			} else await this.store.update.mutate({
-				collection: LOGIN_SESSIONS_COLLECTION,
-				id: session.id,
-				data: { ...session }
-			});
-		} catch (error) {
-			this.logger?.error("Login session write failed — the change holds until restart", { meta: {
-				sessionId: session.id,
-				error: error instanceof Error ? error.message : String(error)
-			} });
-		}
-	}
-	async persistCutoff(userId, notBefore) {
-		try {
-			const cutoffsKind = this.cutoffsKind;
-			if (cutoffsKind !== null) {
-				const parsed = localAuthRecordKinds["login-session-cutoffs"].schema.safeParse({ notBefore });
-				if (!parsed.success) throw new Error(parsed.error.message);
-				await cutoffsKind.put({
-					id: userId,
-					data: parsed.data
-				});
-			} else {
-				await this.store.delete.mutate({
-					collection: LOGIN_SESSION_CUTOFFS_COLLECTION,
-					key: userId
-				});
-				await this.store.insert.mutate({
-					collection: LOGIN_SESSION_CUTOFFS_COLLECTION,
-					record: {
-						id: userId,
-						data: {
-							userId,
-							notBefore
-						}
-					}
-				});
-			}
-		} catch (error) {
-			this.logger?.error("Login session cutoff write failed — it holds until restart", { meta: {
-				userId,
-				error: error instanceof Error ? error.message : String(error)
-			} });
-		}
-	}
-};
-//#endregion
-//#region src/builtins/local-auth/auth-schema.ts
-/**
-* @durable class=config owner=local-auth
-*   write="an operator creates a user, or `ensureAdminExists` seeds the configured
-*     admin on first boot (or resets its password on the operator's one-shot
-*     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
-*   retention="none — a row goes only when an operator deletes the user. A
-*     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
-*     REBUILDS the table: every account is wiped and only the configured admin
-*     comes back on the next boot."
-*/
-var USERS_COLLECTION$1 = "users";
-/**
-* @durable class=config owner=local-auth
-*   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
-*     every request the key authorises"
-*   retention="none — an explicit `revoke` is the only delete. API keys have no
-*     expiry column and no sweep, so a key lives until someone removes it (or the
-*     destructive `declareCollection` rebuild takes the table)."
-*/
-var API_KEYS_COLLECTION = "api_keys";
-/**
-* @durable class=config owner=local-auth
-*   write="an operator or the CLI mints a scoped token; `validate` fires
-*     `updateLastUsed` on every accepted call"
-*   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
-*     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
-*     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
-*     id or by a user that no longer exists."
-*/
-var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
-/**
-* @durable class=ledger owner=local-auth
-*   write="one row per redeemed OAuth code — every completed account link through
-*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
-*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
-*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
-*     has `revokedAt` NULL, never expires and is never swept — the table grows one
-*     row per login until an operator revokes the link."
-*/
-var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
-/**
-* TOTP enrollment table — split off from `users` to avoid the
-* destructive drop-+-recreate migration `ensureTable` performs when a
-* new column is added to a typed schema (see `sqlite-settings-backend.ts`).
-*
-* Lifecycle:
-*   - Setup: row inserted with `confirmedAt = null` and a fresh secret.
-*   - Confirm: a valid code from the secret flips `confirmedAt` to now().
-*   - Disable: the row is deleted (next setup starts fresh).
-*
-* "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
-* = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
-*
-* @durable class=config owner=local-auth
-*   write="`setup` inserts a keychain marker for the user's seed (D878; deleting any pending row
-*     first); `confirm` flips `confirmedAt` once a valid code proves possession"
-*   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
-*     Nothing else prunes — deleting a USER does not cascade here, so their
-*     enrollment row outlives the account."
-*/
-var USER_TOTP_COLLECTION = "user_totp";
-/**
-* External sign-in identities linked to local users (D782): one row per
-* `(provider, subject)` — the row id IS the identity, so one identity maps to
-* one user by primary key. Written only by the identity's owner completing a
-* "Link" flow from their profile (bound to their session).
-*
-* @durable class=config owner=local-auth
-*   write="`ExternalIdentityManager.link` when a signed-in user completes a
-*     link flow; `unlink` from the profile or the Users page"
-*   retention="`unlink` deletes one row; deleting the user deletes all of its
-*     rows (`deleteUser` → `removeAllForUser`). A row whose provider instance
-*     was renamed or removed stays, inert, until someone unlinks it."
-*/
-var USER_EXTERNAL_IDENTITIES_COLLECTION = "user_external_identities";
-var USERS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "username",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "passwordHash",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "isAdmin",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "allowedProviders",
-		type: "JSON"
-	},
-	{
-		name: "allowedDevices",
-		type: "JSON"
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "updatedAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var API_KEYS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "label",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "isAdmin",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "tokenHash",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "tokenPrefix",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "allowedProviders",
-		type: "JSON"
-	},
-	{
-		name: "allowedDevices",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	}
-];
-var USER_TOTP_COLUMNS = [
-	{
-		name: "userId",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "secret",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "confirmedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var USER_EXTERNAL_IDENTITIES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "provider",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "subject",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "issuer",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "label",
-		type: "TEXT"
-	},
-	{
-		name: "linkedAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var SCOPED_TOKENS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "name",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "tokenHash",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "tokenPrefix",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "expiresAt",
-		type: "INTEGER"
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var OAUTH_SESSIONS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "username",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "integrationId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "revokedAt",
-		type: "INTEGER"
-	}
-];
-/**
-* Declare every auth collection with the typed schema. Called by
-* `LocalAuthAddon.onInitialize` before constructing the per-collection
-* managers. Idempotent — `declareCollection` is a no-op when the
-* collection has already been declared (same shape).
+* Declare every auth collection with the typed schema. Called by
+* `LocalAuthAddon.onInitialize` before constructing the per-collection
+* managers. Idempotent — `declareCollection` is a no-op when the
+* collection has already been declared (same shape).
 */
 async function declareAuthSchema(store, options) {
 	const skip = new Set(options?.skipCollections ?? []);
@@ -8361,7 +7591,10 @@ async function declareAuthSchema(store, options) {
 * use `storageAdmin.dropCollection` with `expectRows` after verify (see
 * `docs/design/records-phase-6-auth-migration.md`).
 *
-* Before hub restart: mint and test an admin token (`csa_`); snapshot every kind.
+* Before hub restart: mint and test an admin token (`auth.mintToken` with `'*'`); snapshot every kind.
+*
+* `scoped-tokens` and `admin-tokens` hold pre-D892 rows read by nothing since
+* D895; they stay declared so the layout is unchanged.
 */
 var DAY_MS = 864e5;
 var UserBodySchema = UserRecordSchema.omit({ id: true });
@@ -8470,7 +7703,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 	"scoped-tokens": {
 		schema: ScopedTokenBodySchema,
 		class: "config",
-		writeTrigger: "operator or CLI mints a scoped token; validate updates lastUsedAt",
+		writeTrigger: "none since D895 — legacy rows kept on disk for the operator to drop",
 		device: "none",
 		at: "none",
 		indexes: [{
@@ -8481,16 +7714,13 @@ var _localAuthRecordKinds = defineRecordKinds({
 			name: "user",
 			fields: ["userId"]
 		}],
-		retention: {
-			owner: "local-auth",
-			reason: "daily reap of expired and orphan tokens; NULL expiresAt never matches BETWEEN"
-		},
+		retention: { none: "the operator drops the legacy rows by hand (D895)" },
 		adoptsFrom: SCOPED_TOKENS_COLLECTION
 	},
 	"admin-tokens": {
 		schema: AdminTokenBodySchema,
 		class: "config",
-		writeTrigger: "admin mints after re-auth; validate touches lastUsedAt; revoke stamps revokedAt",
+		writeTrigger: "none since D895 — legacy rows kept on disk for the operator to drop",
 		device: "none",
 		at: "none",
 		indexes: [{
@@ -8501,10 +7731,7 @@ var _localAuthRecordKinds = defineRecordKinds({
 			name: "created_by",
 			fields: ["createdBy"]
 		}],
-		retention: {
-			owner: "local-auth",
-			reason: "daily reap deletes rows expired or revoked more than 30 days ago"
-		},
+		retention: { none: "the operator drops the legacy rows by hand (D895)" },
 		adoptsFrom: ADMIN_TOKENS_COLLECTION
 	},
 	"login-sessions": {
@@ -8616,8 +7843,8 @@ var _localAuthRecordKinds = defineRecordKinds({
 var localAuthRecordKinds = _localAuthRecordKinds;
 var localAuthUsersRecordKind = _localAuthRecordKinds.users;
 var localAuthApiKeysRecordKind = _localAuthRecordKinds["api-keys"];
-var localAuthScopedTokensRecordKind = _localAuthRecordKinds["scoped-tokens"];
-var localAuthAdminTokensRecordKind = _localAuthRecordKinds["admin-tokens"];
+_localAuthRecordKinds["scoped-tokens"];
+_localAuthRecordKinds["admin-tokens"];
 var localAuthLoginSessionsRecordKind = _localAuthRecordKinds["login-sessions"];
 var localAuthLoginSessionCutoffsRecordKind = _localAuthRecordKinds["login-session-cutoffs"];
 var localAuthOauthSessionsRecordKind = _localAuthRecordKinds["oauth-sessions"];
@@ -8641,214 +7868,586 @@ var LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS = [
 ];
 function localAuthRecordStoresOf(records) {
 	return {
-		users: records.kind(localAuthUsersRecordKind),
-		apiKeys: records.kind(localAuthApiKeysRecordKind),
-		scopedTokens: records.kind(localAuthScopedTokensRecordKind),
-		adminTokens: records.kind(localAuthAdminTokensRecordKind),
-		loginSessions: records.kind(localAuthLoginSessionsRecordKind),
-		loginSessionCutoffs: records.kind(localAuthLoginSessionCutoffsRecordKind),
-		oauthSessions: records.kind(localAuthOauthSessionsRecordKind),
-		userTotp: records.kind(localAuthUserTotpRecordKind),
-		userExternalIdentities: records.kind(localAuthUserExternalIdentitiesRecordKind),
-		deviceCredentials: records.kind(localAuthDeviceCredentialsRecordKind),
-		authAudit: records.kind(localAuthAuthAuditRecordKind)
+		users: records.kind(localAuthUsersRecordKind),
+		apiKeys: records.kind(localAuthApiKeysRecordKind),
+		loginSessions: records.kind(localAuthLoginSessionsRecordKind),
+		loginSessionCutoffs: records.kind(localAuthLoginSessionCutoffsRecordKind),
+		oauthSessions: records.kind(localAuthOauthSessionsRecordKind),
+		userTotp: records.kind(localAuthUserTotpRecordKind),
+		userExternalIdentities: records.kind(localAuthUserExternalIdentitiesRecordKind),
+		deviceCredentials: records.kind(localAuthDeviceCredentialsRecordKind),
+		authAudit: records.kind(localAuthAuthAuditRecordKind)
+	};
+}
+//#endregion
+//#region src/auth/session-revocation-bus.ts
+var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
+function listeners() {
+	const existing = Reflect.get(globalThis, BUS_KEY);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, BUS_KEY, created);
+	return created;
+}
+/** Subscribe; returns the unsubscribe. */
+function onSessionsRevoked(listener) {
+	const set = listeners();
+	set.add(listener);
+	return () => {
+		set.delete(listener);
+	};
+}
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+function announceSessionsRevoked(event, onListenerError) {
+	if (event.sessionIds.length === 0 && !event.allOfUser) return;
+	for (const listener of [...listeners()]) try {
+		listener(event);
+	} catch (error) {
+		onListenerError?.(error);
+	}
+}
+//#endregion
+//#region src/auth/login-session-manager.ts
+/**
+* Login sessions — the server-side record behind every session token.
+*
+* A session token used to be a self-contained 30-day JWT: nothing on the hub
+* knew it existed, so logout revoked nothing, a password change left every
+* other device signed in, and a deleted user's sessions lived until they
+* expired. Now every login creates a row here and the token carries its id
+* (`sid`); the hub checks the row on every request (`check`, an in-memory
+* lookup), so revoking a row ends the session at once.
+*
+* Two kinds of client:
+*  - **refreshable** — gets a short access token (default 2 h) and an opaque
+*    refresh token (`csr_…`, stored hashed). `refresh` rotates the refresh
+*    token and slides the session's expiry; presenting a rotated-out refresh
+*    token after a short grace window is treated as theft and revokes the
+*    whole session.
+*  - **legacy** — a client from before refresh tokens: its access token lives
+*    as long as the session, and it renews through the handoff-code pair
+*    (`extend`). Kept for one release so installed viewer apps keep working.
+*
+* `legacyCutoff(userId)` covers tokens minted before sessions existed (no
+* `sid`): a token of that user issued before the cutoff is refused. Revoking
+* all of a user's sessions moves the cutoff, so a password change or a user
+* deletion also ends their pre-session tokens.
+*
+* Mirror: every row is held in memory (a homelab hub has tens of sessions) and
+* written through to the store; revocations update the mirror FIRST, so a
+* store hiccup can delay persistence but never the revocation itself.
+*/
+/**
+* @durable class=ledger owner=local-auth
+*   write="one row per login (password, passkey, SSO, handoff, session exchange);
+*     rewritten on every refresh / renewal (expiry slides, refresh hash rotates)
+*     and on revocation"
+*   retention="the daily reap deletes rows expired more than 7 days ago and rows
+*     revoked more than 30 days ago. A session the user keeps refreshing lives as
+*     long as it is used."
+*/
+var LOGIN_SESSIONS_COLLECTION = "login_sessions";
+/**
+* @durable class=config owner=local-auth
+*   write="revoking all of a user's sessions (logout everywhere, password change or
+*     reset, user deletion) sets that user's cutoff to now"
+*   retention="none — one row per user who ever had all sessions revoked; it only
+*     ever matters for tokens minted before sessions existed, and is harmless after."
+*/
+var LOGIN_SESSION_CUTOFFS_COLLECTION = "login_session_cutoffs";
+var LOGIN_SESSIONS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "method",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "refreshable",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "revokedReason",
+		type: "TEXT"
+	},
+	{
+		name: "refreshHash",
+		type: "TEXT"
+	},
+	{
+		name: "previousRefreshHash",
+		type: "TEXT"
+	},
+	{
+		name: "rotatedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "client",
+		type: "TEXT"
+	},
+	{
+		name: "ip",
+		type: "TEXT"
+	},
+	{
+		name: "credentialId",
+		type: "TEXT"
+	}
+];
+var LOGIN_SESSION_CUTOFFS_COLUMNS = [{
+	name: "userId",
+	type: "TEXT",
+	primaryKey: true,
+	notNull: true
+}, {
+	name: "notBefore",
+	type: "INTEGER",
+	notNull: true
+}];
+var METHODS = [
+	"password",
+	"passkey",
+	"sso",
+	"handoff",
+	"exchange",
+	"device-certificate"
+];
+var REFRESH_TOKEN_PREFIX = "csr_";
+/**
+* A rotated-out refresh token is still honoured this long: two tabs (or a
+* retry after a dropped response) may present the same token a moment apart.
+* After it, the old token is evidence of a copy and ends the session.
+*/
+var REFRESH_REUSE_GRACE_MS = 3e4;
+var EXPIRED_RETENTION_MS = 7 * 864e5;
+var REVOKED_RETENTION_MS = 30 * 864e5;
+/** Longest client label kept (a User-Agent can be huge). */
+var MAX_CLIENT_LABEL = 200;
+function hashToken(token) {
+	return crypto$1.createHash("sha256").update(token).digest("hex");
+}
+function str(data, key) {
+	const value = data[key];
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function num(data, key) {
+	const value = data[key];
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function parseSession$1(data) {
+	const id = str(data, "id");
+	const userId = str(data, "userId");
+	const createdAt = num(data, "createdAt");
+	const lastUsedAt = num(data, "lastUsedAt");
+	const expiresAt = num(data, "expiresAt");
+	const method = METHODS.find((m) => m === data["method"]);
+	if (id === null || userId === null || createdAt === null || expiresAt === null) return null;
+	return {
+		id,
+		userId,
+		method: method ?? "password",
+		refreshable: data["refreshable"] === true || data["refreshable"] === 1,
+		createdAt,
+		lastUsedAt: lastUsedAt ?? createdAt,
+		expiresAt,
+		revokedAt: num(data, "revokedAt"),
+		revokedReason: str(data, "revokedReason"),
+		refreshHash: str(data, "refreshHash"),
+		previousRefreshHash: str(data, "previousRefreshHash"),
+		rotatedAt: num(data, "rotatedAt"),
+		client: str(data, "client"),
+		ip: str(data, "ip"),
+		credentialId: str(data, "credentialId")
 	};
 }
-//#endregion
-//#region src/auth/scoped-token-manager.ts
-var TOKENS_COLLECTION = "scoped_tokens";
-var TOKEN_PREFIX = "cst_";
-function parseToken(data) {
-	return parseRecord$2("scoped-token", ScopedTokenSchema, data);
-}
-function tokenToBody(token) {
-	const { id: _id, ...body } = token;
-	return body;
+function toLoginSessionSummary(record) {
+	const { refreshHash: _r, previousRefreshHash: _p, rotatedAt: _t, ...summary } = record;
+	return summary;
 }
-function rowToToken(id, body) {
-	return parseToken({
-		id,
-		...body
-	});
+function sessionToBody$1(session) {
+	const { id: _id, ...body } = session;
+	return body;
 }
-/**
-* Manages scoped API tokens with restricted addon/route/capability access.
-*/
-var ScopedTokenManager = class {
-	kind;
+var LoginSessionManager = class {
+	sessions = /* @__PURE__ */ new Map();
+	/** refresh hash (current or previous) → session id */
+	byRefreshHash = /* @__PURE__ */ new Map();
+	cutoffs = /* @__PURE__ */ new Map();
+	now;
+	logger;
+	sessionsKind;
+	cutoffsKind;
 	store;
-	constructor(deps) {
-		if ("scopedTokensKind" in deps) {
-			this.kind = deps.scopedTokensKind;
+	constructor(deps, options = {}) {
+		if ("sessionsKind" in deps) {
+			this.sessionsKind = deps.sessionsKind;
+			this.cutoffsKind = deps.cutoffsKind;
 			this.store = deps.legacyStore ?? null;
 		} else {
-			this.kind = null;
+			this.sessionsKind = null;
+			this.cutoffsKind = null;
 			this.store = deps;
 		}
+		this.now = options.now ?? Date.now;
+		this.logger = options.logger ?? null;
+	}
+	/** Load every row into the mirror. Call once at init, before serving. */
+	async load() {
+		const sessionsKind = this.sessionsKind;
+		if (sessionsKind !== null) {
+			const rows = await (0, import_read_all_rows.readAllRows)(sessionsKind);
+			for (const row of rows) {
+				const record = parseSession$1({
+					id: row.id,
+					...row.data
+				});
+				if (record !== null) this.remember(record);
+			}
+			const cutoffs = await (0, import_read_all_rows.readAllRows)(this.cutoffsKind);
+			for (const row of cutoffs) this.cutoffs.set(row.id, row.data.notBefore);
+			return;
+		}
+		const rows = await this.store.query.query({ collection: LOGIN_SESSIONS_COLLECTION });
+		for (const row of rows) {
+			const record = parseSession$1(row.data);
+			if (record !== null) this.remember(record);
+		}
+		const cutoffs = await this.store.query.query({ collection: LOGIN_SESSION_CUTOFFS_COLLECTION });
+		for (const row of cutoffs) {
+			const userId = str(row.data, "userId");
+			const notBefore = num(row.data, "notBefore");
+			if (userId !== null && notBefore !== null) this.cutoffs.set(userId, notBefore);
+		}
+	}
+	async create(input) {
+		const at = this.now();
+		const refreshToken = input.refreshable ? this.newRefreshToken() : null;
+		const session = {
+			id: crypto$1.randomUUID(),
+			userId: input.userId,
+			method: input.method,
+			refreshable: input.refreshable,
+			createdAt: at,
+			lastUsedAt: at,
+			expiresAt: at + input.lifetimeMs,
+			revokedAt: null,
+			revokedReason: null,
+			refreshHash: refreshToken === null ? null : hashToken(refreshToken),
+			previousRefreshHash: null,
+			rotatedAt: null,
+			client: input.client === void 0 ? null : input.client.slice(0, MAX_CLIENT_LABEL),
+			ip: input.ip ?? null,
+			credentialId: input.credentialId ?? null
+		};
+		const sessionsKind = this.sessionsKind;
+		if (sessionsKind !== null) {
+			const parsed = localAuthRecordKinds["login-sessions"].schema.safeParse(sessionToBody$1(session));
+			if (!parsed.success) throw new Error(parsed.error.message);
+			await sessionsKind.put({
+				id: session.id,
+				at: session.createdAt,
+				expiresAt: session.expiresAt,
+				data: parsed.data
+			});
+		} else await this.store.insert.mutate({
+			collection: LOGIN_SESSIONS_COLLECTION,
+			record: {
+				id: session.id,
+				data: { ...session }
+			}
+		});
+		this.remember(session);
+		return {
+			session,
+			refreshToken
+		};
+	}
+	/** Is `sessionId` a live session right now? Synchronous: the hub asks on every request. */
+	check(sessionId) {
+		const session = this.sessions.get(sessionId);
+		if (session === void 0) return { state: "unknown" };
+		if (session.revokedAt !== null) return { state: "revoked" };
+		if (session.expiresAt <= this.now()) return { state: "expired" };
+		return {
+			state: "active",
+			session
+		};
+	}
+	/** Epoch ms before which a pre-session (no `sid`) token of `userId` is refused; 0 = none. */
+	legacyCutoff(userId) {
+		return this.cutoffs.get(userId) ?? 0;
+	}
+	/**
+	* The session a refresh token belongs to, WITHOUT rotating it - so the
+	* refresh path can judge the session (its device credential) before it
+	* spends the token. `null` when the token names no session.
+	*/
+	peekByRefreshToken(refreshToken) {
+		if (!refreshToken.startsWith("csr_")) return null;
+		const sessionId = this.byRefreshHash.get(hashToken(refreshToken));
+		return sessionId === void 0 ? null : this.sessions.get(sessionId) ?? null;
+	}
+	/** Swap a refresh token for a rotated one, sliding the session's expiry to now + `lifetimeMs`. */
+	async refresh(refreshToken, lifetimeMs) {
+		if (!refreshToken.startsWith("csr_")) return {
+			ok: false,
+			reason: "unknown"
+		};
+		const presented = hashToken(refreshToken);
+		const sessionId = this.byRefreshHash.get(presented);
+		const session = sessionId === void 0 ? void 0 : this.sessions.get(sessionId);
+		if (session === void 0) return {
+			ok: false,
+			reason: "unknown"
+		};
+		if (session.revokedAt !== null) return {
+			ok: false,
+			reason: "revoked"
+		};
+		const at = this.now();
+		if (session.expiresAt <= at) return {
+			ok: false,
+			reason: "expired"
+		};
+		if (presented !== session.refreshHash) {
+			if (!(presented === session.previousRefreshHash && session.rotatedAt !== null && at - session.rotatedAt <= REFRESH_REUSE_GRACE_MS)) {
+				await this.revoke(session.id, "refresh-reuse");
+				this.logger?.warn("A rotated-out refresh token was presented — session revoked", { meta: {
+					sessionId: session.id,
+					userId: session.userId
+				} });
+				return {
+					ok: false,
+					reason: "reused"
+				};
+			}
+		}
+		const next = this.newRefreshToken();
+		const updated = {
+			...session,
+			lastUsedAt: at,
+			expiresAt: at + lifetimeMs,
+			previousRefreshHash: session.refreshHash,
+			refreshHash: hashToken(next),
+			rotatedAt: at
+		};
+		this.replace(session, updated);
+		await this.persist(updated);
+		return {
+			ok: true,
+			session: updated,
+			refreshToken: next
+		};
+	}
+	/** Renew an active session (legacy client): slide its expiry. `null` when it is not active. */
+	async extend(sessionId, lifetimeMs) {
+		const check = this.check(sessionId);
+		if (check.state !== "active") return null;
+		const at = this.now();
+		const updated = {
+			...check.session,
+			lastUsedAt: at,
+			expiresAt: at + lifetimeMs
+		};
+		this.replace(check.session, updated);
+		await this.persist(updated);
+		return updated;
+	}
+	/** End one session. `false` when it was unknown or already ended. */
+	async revoke(sessionId, reason) {
+		const session = this.sessions.get(sessionId);
+		if (session === void 0 || session.revokedAt !== null) return false;
+		const updated = {
+			...session,
+			revokedAt: this.now(),
+			revokedReason: reason
+		};
+		this.replace(session, updated);
+		this.announce([updated.id], session.userId, false, null, reason);
+		await this.persist(updated);
+		return true;
+	}
+	/**
+	* End every live session of `userId` except `exceptSessionId`, and move the
+	* user's legacy cutoff to now (pre-session tokens die too). Returns how many
+	* sessions ended.
+	*/
+	async revokeAllForUser(userId, options) {
+		const at = this.now();
+		this.cutoffs.set(userId, at);
+		const ended = [];
+		for (const session of this.sessions.values()) {
+			if (session.userId !== userId || session.revokedAt !== null) continue;
+			if (session.id === options.exceptSessionId) continue;
+			const updated = {
+				...session,
+				revokedAt: at,
+				revokedReason: options.reason
+			};
+			this.replace(session, updated);
+			ended.push(updated);
+		}
+		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
+		await this.persistCutoff(userId, at);
+		for (const session of ended) await this.persist(session);
+		return ended.length;
 	}
-	async create(userId, name, scopes, expiresAt) {
-		const rawToken = `${TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("hex")}`;
-		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
-		const tokenPrefix = rawToken.slice(0, 12);
-		const record = {
-			id: crypto$1.randomUUID(),
-			userId,
-			name,
-			tokenHash,
-			tokenPrefix,
-			scopes: scopes.map((s) => ({ ...s })),
-			expiresAt,
-			lastUsedAt: void 0,
-			createdAt: Date.now()
-		};
-		const kind = this.kind;
-		if (kind !== null) {
-			const body = tokenToBody(record);
-			const parsed = localAuthRecordKinds["scoped-tokens"].schema.safeParse(body);
-			if (!parsed.success) throw new Error(parsed.error.message);
-			await kind.put({
-				id: record.id,
-				expiresAt: record.expiresAt ?? void 0,
-				data: parsed.data
-			});
-			return {
-				token: rawToken,
-				record
+	/** End every live session opened by device credential `credentialId`. Returns how many. */
+	async revokeByCredential(credentialId, reason = "credential-revoked") {
+		const at = this.now();
+		const ended = [];
+		for (const session of this.sessions.values()) {
+			if (session.credentialId !== credentialId || session.revokedAt !== null) continue;
+			const updated = {
+				...session,
+				revokedAt: at,
+				revokedReason: reason
 			};
+			this.replace(session, updated);
+			ended.push(updated);
 		}
-		await this.store.insert.mutate({
-			collection: TOKENS_COLLECTION,
-			record: {
-				id: record.id,
-				data: { ...record }
-			}
-		});
-		return {
-			token: rawToken,
-			record
-		};
+		this.announce(ended.map((s) => s.id), null, false, null, reason);
+		for (const session of ended) await this.persist(session);
+		return ended.length;
 	}
-	async validate(rawToken) {
-		if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
-		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
-		const kind = this.kind;
-		let record = null;
-		if (kind !== null) {
-			const row = (await kind.query({
-				where: { tokenHash },
-				limit: 1
-			})).records[0];
-			record = row === void 0 ? null : rowToToken(row.id, row.data);
-		} else {
-			const results = await this.store.query.query({
-				collection: TOKENS_COLLECTION,
-				filter: { where: { tokenHash } }
+	/** `userId`'s live sessions, newest first. */
+	listForUser(userId) {
+		return this.listActive().filter((s) => s.userId === userId);
+	}
+	/** Every live session, newest first. */
+	listActive() {
+		const at = this.now();
+		return [...this.sessions.values()].filter((s) => s.revokedAt === null && s.expiresAt > at).toSorted((a, b) => b.createdAt - a.createdAt).map(toLoginSessionSummary);
+	}
+	/** Delete rows expired more than 7 days ago or revoked more than 30. Returns how many. */
+	async reap() {
+		const at = this.now();
+		const dead = [...this.sessions.values()].filter((s) => s.revokedAt !== null && at - s.revokedAt > REVOKED_RETENTION_MS || s.revokedAt === null && at - s.expiresAt > EXPIRED_RETENTION_MS);
+		for (const session of dead) {
+			this.forget(session);
+			const sessionsKind = this.sessionsKind;
+			if (sessionsKind !== null) await sessionsKind.delete(session.id);
+			else await this.store.delete.mutate({
+				collection: LOGIN_SESSIONS_COLLECTION,
+				key: session.id
 			});
-			record = results.length === 0 ? null : parseToken(results[0].data);
 		}
-		if (record === null) return null;
-		if (record.expiresAt !== void 0 && record.expiresAt !== null && Date.now() > record.expiresAt) return null;
-		this.updateLastUsed(record.id).catch(() => {});
-		return record;
+		return dead.length;
 	}
-	matchesScope(token, addonId, capability) {
-		for (const scope of token.scopes) switch (scope.type) {
-			case "addon":
-				if (addonId && scope.target === addonId) return true;
-				break;
-			case "capability":
-				if (capability && scope.target === capability) return true;
-				break;
-		}
-		return false;
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
+		announceSessionsRevoked({
+			sessionIds,
+			userId,
+			allOfUser,
+			exceptSessionId,
+			reason
+		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
 	}
-	async revoke(tokenId) {
-		const kind = this.kind;
-		if (kind !== null) {
-			if (await kind.get(tokenId) === null) return false;
-			await kind.delete(tokenId);
-			return true;
-		}
-		if ((await this.store.query.query({
-			collection: TOKENS_COLLECTION,
-			filter: { where: { id: tokenId } }
-		})).length === 0) return false;
-		await this.store.delete.mutate({
-			collection: TOKENS_COLLECTION,
-			key: tokenId
-		});
-		return true;
+	newRefreshToken() {
+		return `${REFRESH_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
 	}
-	async listForUser(userId) {
-		const kind = this.kind;
-		if (kind !== null) return (await (0, import_read_all_rows.readAllRows)(kind, { where: { userId } })).map((row) => rowToToken(row.id, row.data));
-		return (await this.store.query.query({
-			collection: TOKENS_COLLECTION,
-			filter: { where: { userId } }
-		})).map((r) => parseToken(r.data));
+	remember(session) {
+		this.sessions.set(session.id, session);
+		if (session.refreshHash !== null) this.byRefreshHash.set(session.refreshHash, session.id);
+		if (session.previousRefreshHash !== null) this.byRefreshHash.set(session.previousRefreshHash, session.id);
 	}
-	async updateLastUsed(tokenId) {
-		const kind = this.kind;
-		if (kind !== null) {
-			const row = await kind.get(tokenId);
-			if (row === null) return;
-			const next = {
-				...rowToToken(row.id, row.data),
-				lastUsedAt: Date.now()
-			};
-			const body = tokenToBody(next);
-			const parsed = localAuthRecordKinds["scoped-tokens"].schema.safeParse(body);
-			if (!parsed.success) return;
-			await kind.put({
-				id: tokenId,
-				expiresAt: next.expiresAt ?? void 0,
-				data: parsed.data
-			});
-			return;
-		}
-		const results = await this.store.query.query({
-			collection: TOKENS_COLLECTION,
-			filter: { where: { id: tokenId } }
-		});
-		if (results.length === 0) return;
-		const existing = parseToken(results[0].data);
-		await this.store.update.mutate({
-			collection: TOKENS_COLLECTION,
-			id: tokenId,
-			data: {
-				...existing,
-				lastUsedAt: Date.now()
-			}
-		});
+	forget(session) {
+		this.sessions.delete(session.id);
+		if (session.refreshHash !== null) this.byRefreshHash.delete(session.refreshHash);
+		if (session.previousRefreshHash !== null) this.byRefreshHash.delete(session.previousRefreshHash);
 	}
-	async reapExpired(nowMs = Date.now()) {
-		const kind = this.kind;
-		if (kind !== null) return kind.deleteWhere({ where: { expiresAt: {
-			gte: 1,
-			lte: nowMs - 1
-		} } });
-		const { deleted } = await this.store.deleteWhere.mutate({
-			collection: TOKENS_COLLECTION,
-			filter: { whereBetween: { expiresAt: [1, nowMs - 1] } }
-		});
-		return deleted;
+	replace(previous, next) {
+		this.forget(previous);
+		this.remember(next);
 	}
-	async cleanupOrphans(validUserIds) {
-		const kind = this.kind;
-		const all = kind !== null ? (await (0, import_read_all_rows.readAllRows)(kind)).map((row) => rowToToken(row.id, row.data)) : (await this.store.query.query({
-			collection: TOKENS_COLLECTION,
-			filter: {}
-		})).map((e) => parseToken(e.data));
-		let removed = 0;
-		for (const record of all) if (record.userId === "system" || !validUserIds.has(record.userId)) {
-			if (kind !== null) await kind.delete(record.id);
-			else await this.store.delete.mutate({
-				collection: TOKENS_COLLECTION,
-				key: record.id
+	async persist(session) {
+		try {
+			const sessionsKind = this.sessionsKind;
+			if (sessionsKind !== null) {
+				const parsed = localAuthRecordKinds["login-sessions"].schema.safeParse(sessionToBody$1(session));
+				if (!parsed.success) throw new Error(parsed.error.message);
+				await sessionsKind.put({
+					id: session.id,
+					at: session.createdAt,
+					expiresAt: session.expiresAt,
+					data: parsed.data
+				});
+			} else await this.store.update.mutate({
+				collection: LOGIN_SESSIONS_COLLECTION,
+				id: session.id,
+				data: { ...session }
 			});
-			removed++;
+		} catch (error) {
+			this.logger?.error("Login session write failed — the change holds until restart", { meta: {
+				sessionId: session.id,
+				error: error instanceof Error ? error.message : String(error)
+			} });
+		}
+	}
+	async persistCutoff(userId, notBefore) {
+		try {
+			const cutoffsKind = this.cutoffsKind;
+			if (cutoffsKind !== null) {
+				const parsed = localAuthRecordKinds["login-session-cutoffs"].schema.safeParse({ notBefore });
+				if (!parsed.success) throw new Error(parsed.error.message);
+				await cutoffsKind.put({
+					id: userId,
+					data: parsed.data
+				});
+			} else {
+				await this.store.delete.mutate({
+					collection: LOGIN_SESSION_CUTOFFS_COLLECTION,
+					key: userId
+				});
+				await this.store.insert.mutate({
+					collection: LOGIN_SESSION_CUTOFFS_COLLECTION,
+					record: {
+						id: userId,
+						data: {
+							userId,
+							notBefore
+						}
+					}
+				});
+			}
+		} catch (error) {
+			this.logger?.error("Login session cutoff write failed — it holds until restart", { meta: {
+				userId,
+				error: error instanceof Error ? error.message : String(error)
+			} });
 		}
-		return removed;
 	}
 };
 //#endregion
@@ -8963,6 +8562,211 @@ var DeviceCaStore = class {
 		return this.loaded;
 	}
 };
+var localAuthPreferencesRecordKinds = defineRecordKinds({ "user-preferences": {
+	schema: z.object({
+		userId: z.string().min(1),
+		namespace: PreferenceNamespaceSchema,
+		value: PreferenceValueSchema,
+		revision: z.number().int().positive(),
+		updatedAt: z.number().int(),
+		updatedByDevice: PreferenceDeviceIdSchema.nullable()
+	}),
+	class: "config",
+	writeTrigger: "a signed-in user saves one of their account preference namespaces (preferences.put) or deletes it",
+	device: "none",
+	at: "none",
+	indexes: [{
+		name: "user",
+		fields: ["userId"]
+	}],
+	retention: { none: "a row goes when its user deletes the namespace, or with the user (deleteUser wipes every row of theirs)" },
+	maxDataBytes: PREFERENCES_MAX_VALUE_BYTES + 4 * 1024
+} });
+/** Namespaces cannot hold `:`, so the id splits unambiguously. */
+function userPreferenceRecordId(userId, namespace) {
+	return `${userId}:${namespace}`;
+}
+//#endregion
+//#region src/builtins/local-auth/user-preferences-store.ts
+/**
+* Per-user account preferences (D894): one row per `(userId, namespace)`.
+*
+* Every method takes the OWNER's id as its first argument and touches only
+* that user's rows; the hub router stamps it from the principal, and nothing
+* here accepts a second user id.
+*
+* The poll (`changedSince`) is answered from an in-memory mirror of each
+* user's `namespace → revision`, loaded once on first touch. This store is the
+* kind's only writer (one in-process instance in `local-auth`), so the mirror
+* cannot fall behind the rows; a poll that finds nothing changed reads no row.
+* Writes of one user are serialized, so a read-modify-write never interleaves.
+*/
+/** A write the limits refuse; nothing was stored. */
+var PreferencesLimitError = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+		this.name = "PreferencesLimitError";
+	}
+};
+/**
+* The limit refusal behind `error`, or `null`. By name and field, not
+* `instanceof`: the store and its caller may load different copies of this
+* module.
+*/
+function preferencesLimitReasonOf(error) {
+	if (!(error instanceof Error) || error.name !== "PreferencesLimitError") return null;
+	const reason = Reflect.get(error, "reason");
+	return reason === "value-too-large" || reason === "too-many-namespaces" ? reason : null;
+}
+/** The page size of a per-user scan; one page covers a user within the limit. */
+var USER_SCAN_PAGE = 40;
+/** The page size of the boot orphan sweep over every user's rows. */
+var ORPHAN_SCAN_PAGE = 500;
+function toRow(body) {
+	return {
+		namespace: body.namespace,
+		value: body.value,
+		revision: body.revision,
+		updatedAt: body.updatedAt,
+		updatedByDevice: body.updatedByDevice
+	};
+}
+function byNamespace(a, b) {
+	return a.namespace < b.namespace ? -1 : a.namespace > b.namespace ? 1 : 0;
+}
+var UserPreferencesStore = class {
+	kind;
+	now;
+	/** `userId → namespace → revision`; absent until the user is first touched. */
+	mirrors = /* @__PURE__ */ new Map();
+	locks = /* @__PURE__ */ new Map();
+	constructor(kind, options = {}) {
+		this.kind = kind;
+		this.now = options.now ?? Date.now;
+	}
+	/** The caller's rows; `namespaces` narrows them (unknown ones are simply absent). */
+	async get(userId, namespaces) {
+		if (namespaces === void 0) return (await this.scanUser(userId)).map((r) => toRow(r.data)).toSorted(byNamespace);
+		return (await this.kind.getMany([...new Set(namespaces)].map((ns) => userPreferenceRecordId(userId, ns)))).filter((r) => r.data.userId === userId).map((r) => toRow(r.data)).toSorted(byNamespace);
+	}
+	async put(userId, input) {
+		const bytes = Buffer.byteLength(JSON.stringify(input.value), "utf8");
+		if (bytes > 262144) throw new PreferencesLimitError("value-too-large", `preferences: ${input.namespace} is ${bytes} bytes, the limit is ${PREFERENCES_MAX_VALUE_BYTES}`);
+		return this.serialized(userId, async () => {
+			const mirror = await this.mirrorOf(userId);
+			const id = userPreferenceRecordId(userId, input.namespace);
+			const existing = await this.kind.get(id);
+			const currentRevision = existing?.data.revision ?? 0;
+			if (input.baseRevision !== void 0 && input.baseRevision !== currentRevision) return {
+				status: "conflict",
+				current: existing === null ? null : toRow(existing.data)
+			};
+			if (existing === null && mirror.size >= 32) throw new PreferencesLimitError("too-many-namespaces", `preferences: a user holds at most 32 namespaces`);
+			const body = {
+				userId,
+				namespace: input.namespace,
+				value: input.value,
+				revision: currentRevision + 1,
+				updatedAt: this.now(),
+				updatedByDevice: input.deviceId ?? null
+			};
+			await this.kind.put({
+				id,
+				data: body
+			}, { ifRev: existing?.rev ?? 0 });
+			mirror.set(input.namespace, body.revision);
+			return {
+				status: "saved",
+				row: toRow(body)
+			};
+		});
+	}
+	/** `false` when the namespace did not exist. */
+	async delete(userId, namespace) {
+		return this.serialized(userId, async () => {
+			const mirror = await this.mirrorOf(userId);
+			const deleted = await this.kind.delete(userPreferenceRecordId(userId, namespace));
+			mirror.delete(namespace);
+			return deleted;
+		});
+	}
+	/**
+	* What the client is missing: every row whose revision differs from the one
+	* it holds (or that it does not list), and every listed namespace now gone.
+	*/
+	async changedSince(userId, known) {
+		const mirror = await this.mirrorOf(userId);
+		const changed = [];
+		for (const [namespace, revision] of mirror) if (known[namespace] !== revision) changed.push(namespace);
+		const deleted = Object.keys(known).filter((namespace) => !mirror.has(namespace)).toSorted();
+		return {
+			rows: [...changed.length === 0 ? [] : await this.get(userId, changed)],
+			deleted
+		};
+	}
+	/** Every row of `userId` goes (user delete). Returns how many. */
+	async wipeUser(userId) {
+		return this.serialized(userId, async () => {
+			const rows = await this.scanUser(userId);
+			const removed = rows.length === 0 ? 0 : await this.kind.deleteMany(rows.map((r) => r.id));
+			this.mirrors.delete(userId);
+			return removed;
+		});
+	}
+	/** Rows whose user is not in `liveUserIds` go (boot sweep). Returns how many. */
+	async wipeOrphans(liveUserIds) {
+		const orphans = /* @__PURE__ */ new Set();
+		let cursor;
+		do {
+			const page = await this.kind.query({
+				order: "id",
+				limit: ORPHAN_SCAN_PAGE,
+				...cursor !== void 0 ? { cursor } : {}
+			});
+			for (const row of page.records) if (!liveUserIds.has(row.data.userId)) orphans.add(row.data.userId);
+			cursor = page.nextCursor ?? void 0;
+		} while (cursor !== void 0);
+		let removed = 0;
+		for (const userId of orphans) removed += await this.wipeUser(userId);
+		return removed;
+	}
+	async mirrorOf(userId) {
+		const cached = this.mirrors.get(userId);
+		if (cached !== void 0) return cached;
+		const rows = await this.scanUser(userId);
+		const raced = this.mirrors.get(userId);
+		if (raced !== void 0) return raced;
+		const mirror = new Map(rows.map((r) => [r.data.namespace, r.data.revision]));
+		this.mirrors.set(userId, mirror);
+		return mirror;
+	}
+	async scanUser(userId) {
+		const out = [];
+		let cursor;
+		do {
+			const page = await this.kind.query({
+				where: { userId },
+				limit: USER_SCAN_PAGE,
+				...cursor !== void 0 ? { cursor } : {}
+			});
+			out.push(...page.records);
+			cursor = page.nextCursor ?? void 0;
+		} while (cursor !== void 0);
+		return out;
+	}
+	/** Run `task` after every earlier write of the same user has settled. */
+	serialized(userId, task) {
+		const next = (this.locks.get(userId) ?? Promise.resolve()).then(task, task);
+		const settled = next.catch(() => void 0);
+		this.locks.set(userId, settled);
+		settled.then(() => {
+			if (this.locks.get(userId) === settled) this.locks.delete(userId);
+		});
+		return next;
+	}
+};
 //#endregion
 //#region src/auth/user-management-internal.ts
 /** Process-global, so every bundled copy of this module agrees on the key. */
@@ -12466,17 +12270,16 @@ var LocalAuthAddon = class extends BaseAddon {
 	authManager = null;
 	userManager = null;
 	apiKeyManager = null;
-	scopedTokenManager = null;
 	oauthSessionManager = null;
 	reapTimer = null;
 	totpManager = null;
 	externalIdentities = null;
 	signingKeyKeeper = null;
 	loginSessions = null;
-	adminTokens = null;
 	auditLog = null;
 	deviceCredentials = null;
 	deviceCa = null;
+	preferences = null;
 	constructor() {
 		super({});
 	}
@@ -12495,21 +12298,18 @@ var LocalAuthAddon = class extends BaseAddon {
 		if (store && records) {
 			const useRecords = await resolvePhase6UseRecordsPathForHub(this.ctx, "local-auth", localAuthRecordKinds, LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS);
 			const authStores = useRecords ? localAuthRecordStoresOf(records) : null;
+			await records.declare(localAuthPreferencesRecordKinds);
+			this.preferences = new UserPreferencesStore(records.kind(localAuthPreferencesRecordKinds["user-preferences"]));
 			const legacyStoreAccess = { getStore: () => store };
 			await declareAuthSchema(store, { ...useRecords ? { skipCollections: LOCAL_AUTH_RECORDS_LEGACY_COLLECTIONS } : {} });
 			this.userManager = authStores === null ? new UserManager(legacyStoreAccess, this.authManager) : new UserManager({
 				usersKind: authStores.users,
 				legacyStore: store
 			}, this.authManager);
-			this.adminTokens = authStores === null ? new AdminTokenManager(store) : new AdminTokenManager({ adminTokensKind: authStores.adminTokens });
 			this.apiKeyManager = authStores === null ? new ApiKeyManager(legacyStoreAccess) : new ApiKeyManager({
 				apiKeysKind: authStores.apiKeys,
 				legacyStore: store
 			});
-			this.scopedTokenManager = authStores === null ? new ScopedTokenManager(store) : new ScopedTokenManager({
-				scopedTokensKind: authStores.scopedTokens,
-				legacyStore: store
-			});
 			this.oauthSessionManager = authStores === null ? new OauthSessionManager(store) : new OauthSessionManager({
 				oauthSessionsKind: authStores.oauthSessions,
 				legacyStore: store
@@ -12570,8 +12370,12 @@ var LocalAuthAddon = class extends BaseAddon {
 				});
 				const liveUsers = await this.userManager.listAll();
 				const liveIds = new Set(liveUsers.map((u) => u.id));
-				const removed = await this.scopedTokenManager.cleanupOrphans(liveIds);
-				if (removed > 0) this.ctx.logger.warn(`cleaned up ${removed} orphan scoped-token(s) on boot`);
+				try {
+					const orphanPrefs = await this.preferences.wipeOrphans(liveIds);
+					if (orphanPrefs > 0) this.ctx.logger.warn(`cleaned up ${orphanPrefs} orphan account-preference row(s) on boot`);
+				} catch (err) {
+					this.ctx.logger.warn("account-preference orphan sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+				}
 				await this.reapAuthRows();
 				this.reapTimer = setInterval(() => {
 					this.reapAuthRows();
@@ -12685,29 +12489,6 @@ var LocalAuthAddon = class extends BaseAddon {
 				await this.apiKeyManager.revoke(input.id);
 				return { success: true };
 			},
-			createScopedToken: async (input) => {
-				if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-				const { token, record } = await this.scopedTokenManager.create(input.userId, input.name, input.scopes, input.expiresAt);
-				return {
-					token,
-					record
-				};
-			},
-			revokeScopedToken: async (input) => {
-				if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-				if (!await this.scopedTokenManager.revoke(input.id)) throw new Error(`Scoped token not found: ${input.id}`);
-				return { success: true };
-			},
-			validateScopedToken: async (input) => {
-				if (!this.scopedTokenManager || !this.userManager) return null;
-				const record = await this.scopedTokenManager.validate(input.token);
-				if (record === null) return null;
-				return await this.userManager.findById(record.userId) === null ? null : record;
-			},
-			listScopedTokens: async (input) => {
-				if (!this.scopedTokenManager) return [];
-				return this.scopedTokenManager.listForUser(input.userId);
-			},
 			oauthIssueCode: async (input) => {
 				return lazyOauthGrants().oauthIssueCode(input);
 			},
@@ -12949,7 +12730,9 @@ var LocalAuthAddon = class extends BaseAddon {
 			if (this.deviceCredentials === null) throw userError("device.credentials-unavailable", void 0, "Device credentials not available");
 			return this.deviceCredentials;
 		};
+		const preferences = this.preferences;
 		return {
+			...preferences !== null ? { preferences } : {},
 			sessions: {
 				create: (input) => sessions().create(input),
 				refresh: (token, lifetimeMs) => sessions().refresh(token, lifetimeMs),
@@ -12974,22 +12757,6 @@ var LocalAuthAddon = class extends BaseAddon {
 				revoke: (id, by) => devices().revoke(id, by),
 				list: (input) => devices().list(input)
 			},
-			adminTokens: {
-				create: async (input) => {
-					if (this.adminTokens === null) throw new Error("Admin tokens not available");
-					return this.adminTokens.create(input);
-				},
-				validate: async (token) => {
-					if (this.adminTokens === null || this.userManager === null) return null;
-					const record = await this.adminTokens.validate(token);
-					if (record === null) return null;
-					const creator = await this.userManager.findById(record.createdBy);
-					return creator !== null && creator.isAdmin ? record : null;
-				},
-				list: async () => this.adminTokens === null ? [] : this.adminTokens.list(),
-				revoke: async (id) => this.adminTokens === null ? false : this.adminTokens.revoke(id)
-			},
-			scopedTokens: { revoke: async (id) => this.scopedTokenManager === null ? false : this.scopedTokenManager.revoke(id) },
 			oauthSessions: { revoke: async (id) => {
 				if (this.oauthSessionManager === null) return false;
 				const session = await this.oauthSessionManager.getById(id);
@@ -13030,18 +12797,15 @@ var LocalAuthAddon = class extends BaseAddon {
 	async endAllAccess(userId) {
 		const steps = [
 			["sessions", async () => this.loginSessions?.revokeAllForUser(userId, { reason: "user-deleted" })],
-			["scoped tokens", async () => {
-				for (const token of await this.scopedTokenManager?.listForUser(userId) ?? []) await this.scopedTokenManager?.revoke(token.id);
-			}],
 			["oauth sessions", async () => {
 				for (const session of await this.oauthSessionManager?.list() ?? []) if (session.userId === userId && session.revokedAt === null) await this.oauthSessionManager?.markRevoked(session.id);
 			}],
-			["admin tokens", async () => this.adminTokens?.revokeAllCreatedBy(userId)],
 			["device credentials", async () => {
 				for (const id of await this.deviceCredentials?.revokeAllForUser(userId, "user-deleted") ?? []) await this.loginSessions?.revokeByCredential(id);
 			}],
 			["totp", async () => this.totpManager?.disable(userId)],
-			["sign-in links", async () => this.externalIdentities?.removeAllForUser(userId)]
+			["sign-in links", async () => this.externalIdentities?.removeAllForUser(userId)],
+			["account preferences", async () => this.preferences?.wipeUser(userId)]
 		];
 		for (const [what, step] of steps) try {
 			await step();
@@ -13053,25 +12817,22 @@ var LocalAuthAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* Drop auth rows that are dead but were never removed: scoped tokens past
-	* their expiry, and OAuth sessions revoked longer ago than
-	* {@link OAUTH_REVOKED_RETENTION_MS}.
+	* Drop auth rows that are dead but were never removed: OAuth sessions
+	* revoked longer ago than {@link OAUTH_REVOKED_RETENTION_MS}, dead login
+	* sessions, old audit rows, dead device credentials. (Tokens are the hub's
+	* `credential-tokens` rows, reaped there.)
 	*
-	* Neither row could authorise anything — `validate` rejects an expired
-	* token, and every consumer treats a missing session exactly like a revoked
-	* one. So this is hygiene, and it is best-effort: a failed sweep is logged
+	* No such row could authorise anything — every consumer treats a missing
+	* session exactly like a revoked one. So this is hygiene, and it is best-effort: a failed sweep is logged
 	* and the next tick tries again. It must never be able to fail boot.
 	*/
 	async reapAuthRows() {
 		try {
-			const tokens = await this.scopedTokenManager?.reapExpired() ?? 0;
 			const sessions = await this.oauthSessionManager?.reapRevoked(Date.now() - OAUTH_REVOKED_RETENTION_MS) ?? 0;
 			const logins = await this.loginSessions?.reap() ?? 0;
-			await this.adminTokens?.reap();
 			await this.auditLog?.reap();
 			await this.deviceCredentials?.reap();
-			if (tokens > 0 || sessions > 0 || logins > 0) this.ctx.logger.info("auth retention swept", { meta: {
-				expiredTokens: tokens,
+			if (sessions > 0 || logins > 0) this.ctx.logger.info("auth retention swept", { meta: {
 				revokedSessions: sessions,
 				deadLoginSessions: logins
 			} });
@@ -13089,15 +12850,13 @@ var LocalAuthAddon = class extends BaseAddon {
 		this.authManager = null;
 		this.userManager = null;
 		this.apiKeyManager = null;
-		this.scopedTokenManager = null;
 		this.oauthSessionManager = null;
 		this.externalIdentities = null;
 		this.loginSessions = null;
-		this.adminTokens = null;
 		this.auditLog = null;
 		this.deviceCredentials = null;
 		this.deviceCa = null;
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, ApiKeyManager as S, AuthAuditLog as _, attachUserManagementInternal as a, SettingsReadUnavailableError as b, ScopedTokenManager as c, onSessionsRevoked as d, DeviceCredentialManager as f, AdminTokenManager as g, ADMIN_TOKEN_PREFIX as h, USER_MANAGEMENT_INTERNAL as i, LoginSessionManager as l, ADMIN_TOKEN_MAX_LIFETIME_MS as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, PREVIOUS_LEAF_GRACE_MS as p, UserManager as r, DeviceCaStore as s, FIRST_BOOT_ADMIN_PASSWORD as t, REFRESH_TOKEN_PREFIX as u, AuthManager as v, isSettingsReadUnavailable as x, parseTokenExpiry as y };
+export { LocalAuthAddon, LocalAuthAddon as default, SettingsReadUnavailableError as _, attachUserManagementInternal as a, DeviceCaStore as c, onSessionsRevoked as d, DeviceCredentialManager as f, parseTokenExpiry as g, AuthManager as h, USER_MANAGEMENT_INTERNAL as i, LoginSessionManager as l, AuthAuditLog as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, PREVIOUS_LEAF_GRACE_MS as p, UserManager as r, preferencesLimitReasonOf as s, FIRST_BOOT_ADMIN_PASSWORD as t, REFRESH_TOKEN_PREFIX as u, isSettingsReadUnavailable as v, ApiKeyManager as y };