Cascade-revoke a key's subtree: compute the api-key ids in keyId's subtree (a keyed caller may revoke ONLY a STRICT
descendant of itself — not itself, an ancestor, or another branch) and soft-disable them via the injected disableKeys
(the app's apikey update — so @suluk/keys stays free of the Better Auth apikey table). MCP ids are skipped (a
connection is revoked elsewhere). Returns the count disabled.
Cascade-revoke a key's subtree: compute the api-key ids in
keyId's subtree (a keyed caller may revoke ONLY a STRICT descendant of itself — not itself, an ancestor, or another branch) and soft-disable them via the injecteddisableKeys(the app's apikey update — so @suluk/keys stays free of the Better Auth apikey table). MCP ids are skipped (a connection is revoked elsewhere). Returns the count disabled.