@aooth/auth 0.1.47 → 0.1.48

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { a as CredentialState, c as RefreshConfig, i as CredentialMetadata, l as SessionEnricher, n as DenylistStore, o as EnrichedSession, r as AuthContext, s as IssueResult, t as CredentialStore, u as SessionInfo } from "./store-BG6m6oSJ.mjs";
-import { n as defaultClock, t as Clock } from "./clock-BjXa0LXb.mjs";
-import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-jFgby4bK.mjs";
+import { a as AuthContext, c as EnrichedSession, d as RefreshResult, f as SessionEnricher, i as DenylistStore, l as IssueResult, n as defaultClock, o as CredentialMetadata, p as SessionInfo, r as CredentialStore, s as CredentialState, t as Clock, u as RefreshConfig } from "./clock-DJ_eroHW.mjs";
+import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-C3qebKuy.mjs";
+import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-pKh0ZaGG.mjs";
 import { CryptoKey } from "jose";
 
 //#region src/errors.d.ts
@@ -203,218 +203,6 @@ declare class CredentialStoreEncapsulated<TPayload extends object = object> impl
   private decrypt;
 }
 //#endregion
-//#region src/credential/auth-credential.d.ts
-interface AuthCredentialOptions<TPayload extends object = object> {
-  /** Pluggable credential store (Memory, JWT, Encapsulated, ...). */
-  store: CredentialStore<TPayload>;
-  /** Default 'token' — distinguishes session-style from token-style use. */
-  method?: "session" | "token";
-  /** Access token TTL in milliseconds. Defaults to 1 hour. Must be > 0. */
-  accessTtl?: number;
-  /** If provided, refresh tokens are enabled. */
-  refresh?: RefreshConfig;
-  /**
-   * Optional denylist consulted by `validate` keyed on the raw token.
-   *
-   * Note: stateless stores (JWT, Encapsulated) maintain their own denylist
-   * keyed on `jti` for `revoke`/`update`/`consume`. Sharing a single
-   * `DenylistStore` instance across both is safe (the keyspaces are disjoint:
-   * raw tokens vs UUID jti) but conceptually they serve different purposes.
-   */
-  denylist?: DenylistStore;
-  /** Maximum concurrent active access credentials per user. */
-  maxConcurrent?: number;
-  /** Behavior when limit reached: 'reject' (default) or 'evict-oldest'. */
-  onLimit?: "reject" | "evict-oldest";
-  /**
-   * Track per-session activity time (`lastSeenAt`). Default `false` — no extra
-   * writes; `listSessions` falls back to `createdAt`.
-   * - `'refresh'` (cheap): stamp `lastSeenAt` on the newly-minted credentials
-   *   during refresh — piggybacks the rotation write, no extra round-trip.
-   * - `'validate'` (accurate, costly): `store.touch(token, now)` on every
-   *   successful `validate()` — one write per authenticated request. Requires a
-   *   store that implements `touch`; a no-op on stores that don't.
-   */
-  trackLastSeen?: "refresh" | "validate" | false;
-  /** Optional clock for testability. */
-  clock?: Clock;
-}
-/**
- * Options for {@link AuthCredential.issue}. The credential's typed payload
- * `TPayload` (the root fields a consumer added to their credential model — e.g.
- * `@arbac.attenuate.*`-annotated fields) is spread flat alongside the
- * framework-level hints below. Reserved keys `metadata`, `sessionId`, `ttl`,
- * `expiresAt`, `kind` (and the {@link CredentialState} envelope keys) must not be
- * reused as payload field names.
- */
-type IssueOptions<TPayload extends object = object> = TPayload & {
-  metadata?: CredentialMetadata;
-  /**
-   * Pre-supply the session id. Omit to let `issue()` mint a random opaque one.
-   * Both the access and refresh tokens of this login share it.
-   */
-  sessionId?: string;
-  /**
-   * Per-mint access-token lifetime in **milliseconds**, overriding the
-   * instance-level `accessTtl` for THIS credential only — so one `AuthCredential`
-   * can mint, say, a 30-minute browser session AND a long-lived PAT/CLI token
-   * without a second instance/posture. Must be `> 0`. Mutually exclusive with
-   * {@link expiresAt}. The refresh token (if any) is unaffected — it keeps
-   * `refresh.ttl`.
-   */
-  ttl?: number;
-  /**
-   * Absolute access-token expiry instant (ms since epoch), overriding both
-   * `ttl` and the instance `accessTtl`. Mutually exclusive with {@link ttl}.
-   * Use when the caller already holds the exact instant.
-   */
-  expiresAt?: number;
-  /**
-   * Semantic credential kind for THIS mint — e.g. `"cli-session"` / `"pat"`.
-   * Distinct from the internal access/refresh discriminator
-   * ({@link CredentialState.kind}): it is stored in `metadata.credentialKind`
-   * and carried forward across rotation, so the whole session family is
-   * labelled. Surfaced as {@link SessionInfo.kind} and consumed by the
-   * `listSessions({ kind })` filter to keep non-browser credentials out of the
-   * default "active sessions" view. Omit for an ordinary interactive session.
-   */
-  kind?: string;
-};
-/**
- * Orchestrates credential issuance, validation, refresh, and revocation
- * on top of a pluggable {@link CredentialStore}.
- *
- * Design notes:
- * - `credentialId` returned in {@link AuthContext} is a SHA-256 fingerprint of
- *   the access token, never the token itself. The fingerprint is stable
- *   per-token, safe to log/persist, and cannot be replayed against the API.
- *   M3 will switch to a `jti` claim for JWT/encapsulated stores.
- * - `kind: 'access' | 'refresh'` on {@link CredentialState} discriminates
- *   tokens stored side-by-side in the same store.
- * - `listForUser` and `maxConcurrent` consider only access-kind credentials,
- *   matching how callers typically display "active sessions".
- * - On detected refresh-reuse, the orchestrator best-effort revokes the
- *   compromised token family (the OAuth-best-practice theft response). Set
- *   `refresh.reuseResponse: 'user'` to escalate to revoking ALL of the user's
- *   sessions. See {@link RefreshConfig.reuseResponse}.
- */
-declare class AuthCredential<TPayload extends object = object> {
-  private readonly store;
-  private readonly method;
-  private readonly accessTtl;
-  private readonly refreshConfig?;
-  private readonly denylist?;
-  private readonly maxConcurrent?;
-  private readonly onLimit;
-  private readonly trackLastSeen;
-  private readonly clock;
-  /**
-   * Recently-consumed refresh tokens, keyed by the raw refresh token string.
-   * Lets `'always'` rotation detect reuse: stateful stores forget the token
-   * after `consume`, and stateless (JWT) stores hide it behind a denylist hit
-   * on `retrieve`. Without this map the orchestrator can no longer distinguish
-   * "fake token" from "previously valid token replayed". Pruned lazily on
-   * access; bounded by refresh TTL.
-   */
-  private readonly consumedRefreshes;
-  constructor(opts: AuthCredentialOptions<TPayload>);
-  issue(userId: string, options?: IssueOptions<TPayload>): Promise<IssueResult>;
-  validate(accessToken: string): Promise<AuthContext<TPayload> | null>;
-  refresh(refreshToken: string): Promise<IssueResult>;
-  private refreshNone;
-  /**
-   * `sliding` rotation: rotate on every use and slide the refresh expiry
-   * forward (rolling session). Grace-tolerant via the shared store-backed
-   * window.
-   */
-  private refreshSliding;
-  /**
-   * `always` rotation: rotate on every use but keep a FIXED session ceiling —
-   * each rotated token inherits the family's original `expiresAt` (no sliding).
-   *
-   * On a stateful store this reuses the same store-backed grace window as
-   * `sliding` (so a benign concurrent refresh within grace is NOT mistaken for
-   * theft, even across instances). On a stateless store the old token cannot be
-   * kept valid (`update` re-issues), so it falls back to single-use semantics
-   * with a process-local reuse signal — the only mechanism possible there.
-   */
-  private refreshAlways;
-  /**
-   * Shared rotation-with-grace mechanism for `sliding` and `always` on stateful
-   * stores. Keeps the old refresh valid + stamps `rotatedAt` on first rotation;
-   * within `rotationGraceMs` of that stamp it re-issues a fresh pair WITHOUT
-   * re-rotating (replay-tolerant); beyond grace it treats the re-presentation
-   * as theft. `preserveExpiry` selects fixed-ceiling (`always`) vs sliding
-   * (`sliding`) expiry for the new refresh token.
-   */
-  private rotateWithGrace;
-  revoke(token: string): Promise<void>;
-  revokeAllForUser(userId: string): Promise<number>;
-  listForUser(userId: string): Promise<Array<AuthContext<TPayload>>>;
-  /**
-   * The session id for a credential: its stored `sessionId`, or the token
-   * fingerprint for legacy rows predating sessionId (so they surface as
-   * singleton sessions). The ONE place this fallback rule lives — shared by
-   * `validate()`, `listForUser()`, and the session-family methods so "this
-   * device" matching stays consistent across all of them.
-   */
-  private sessionIdOf;
-  /** Session-grouping key for a stored credential entry (token attached). */
-  private sessionKeyOf;
-  /**
-   * List the user's active sessions, one row per token family (access +
-   * refresh + every rotation collapsed by `sessionId`). Newest first by
-   * `lastSeenAt` (or `createdAt` when activity isn't tracked). Returns `[]` for
-   * stores that can't enumerate (stateless JWT/encapsulated). Pass `enrich` to
-   * map each row through a {@link SessionEnricher} (device/location labels).
-   */
-  listSessions(userId: string, opts?: {
-    enrich?: SessionEnricher;
-    kind?: string | string[];
-  }): Promise<SessionInfo[] | EnrichedSession[]>;
-  /**
-   * Revoke a single session — every token in its family (access + refresh +
-   * rotations). No-op for stores that can't enumerate. Other sessions keep
-   * validating.
-   */
-  revokeSession(userId: string, sessionId: string): Promise<void>;
-  /**
-   * Revoke every session for the user EXCEPT `keepSessionId` ("log out
-   * everywhere else"). Returns the number of distinct sessions revoked. No-op
-   * (returns 0) for stores that can't enumerate.
-   */
-  revokeOtherSessions(userId: string, keepSessionId: string): Promise<number>;
-  /**
-   * Derive a stable 32-byte key from this credential's underlying store secret,
-   * domain-separated by `label`. Lets adjacent subsystems (e.g. workflow-state
-   * encryption) reuse the auth secret without managing a second one. Throws if
-   * the store has no reusable symmetric secret (stateful/asymmetric) — callers
-   * should then require an explicit secret.
-   */
-  deriveStateKey(label?: string): Buffer;
-  private enforceConcurrencyLimit;
-  private issueAccessFromRefresh;
-  /**
-   * Issue a fresh access + refresh pair off an existing refresh credential.
-   * `preserveExpiry` keeps the family's original refresh `expiresAt` (a fixed
-   * session ceiling, used by `always`); otherwise the new refresh slides to
-   * `now + ttl` (used by `sliding`). `rotateOld` stamps the old refresh as
-   * rotated (keeping it valid through the grace window) instead of consuming it.
-   */
-  private issueRotatedPair;
-  private lookupConsumedRefresh;
-  private fireRefreshReuseTheftResponse;
-  /**
-   * Best-effort theft response for a detected refresh-token reuse. Fires the
-   * `onRotationReuse` hook, then revokes per {@link RefreshConfig.reuseResponse}:
-   * the compromised token family (`'session'`, default) or every session for
-   * the user (`'user'`). Falls back to user-wide revocation when the session
-   * can't be targeted (no `sessionId`, or a store that can't enumerate
-   * sessions). Always throws `REFRESH_REUSE_DETECTED`.
-   */
-  private respondToRefreshReuse;
-}
-//#endregion
 //#region src/rate-limit/rules.d.ts
 /**
  * Rate-limit rule model + the compact string grammar (RL.spec.md §4.1).
@@ -615,10 +403,16 @@ interface SmsSender {
 type BuildMagicLinkUrl = (kind: AuthEmailKind, token: string, ctx?: {
   userId?: string;
 }) => string;
+/** A magic-link token is a plain {@link generateOpaqueToken} mint. */
+declare function generateMagicLinkToken(): string;
+//#endregion
+//#region src/utils/opaque-token.d.ts
 /**
  * 32 bytes of CSPRNG entropy (256 bits) encoded as base64url — 43 chars,
- * URL-safe. Strong enough to survive short TTLs against online guessing.
+ * URL-safe. The single mint for every opaque bearer-style secret in the stack
+ * (magic-link tokens, dynamic-client secrets, authz browser bindings):
+ * unguessable online, cheap to generate, safe to place in a URL.
  */
-declare function generateMagicLinkToken(): string;
+declare function generateOpaqueToken(): string;
 //#endregion
-export { type AuthContext, AuthCredential, type AuthCredentialOptions, type AuthEmailEvent, type AuthEmailKind, AuthError, type AuthErrorType, type AuthSmsEvent, type AuthSmsKind, type BuildMagicLinkUrl, type Clock, type CredentialMetadata, type CredentialState, type CredentialStore, CredentialStoreEncapsulated, type CredentialStoreEncapsulatedOptions, CredentialStoreJwt, type CredentialStoreJwtOptions, CredentialStoreMemory, DEFAULT_RATE_LIMIT_MESSAGE, type DenylistStore, DenylistStoreMemory, type EmailSender, type EnrichedSession, type IssueOptions, type IssueResult, type JwtAlgorithm, type RateLimitDecision, type RateLimitRule, type RateLimitRuleInput, type RateLimitStore, RateLimitStoreMemory, RateLimiter, type RateLimiterOptions, type RefreshConfig, type SessionEnricher, type SessionInfo, type SmsSender, defaultClock, formatDurationMs, generateMagicLinkToken, parseDurationMs, parseRateLimitRule, renderRateLimitMessage };
+export { type AuthContext, AuthCredential, type AuthCredentialOptions, type AuthEmailEvent, type AuthEmailKind, AuthError, type AuthErrorType, type AuthSmsEvent, type AuthSmsKind, type BuildMagicLinkUrl, type Clock, type CredentialMetadata, type CredentialState, type CredentialStore, CredentialStoreEncapsulated, type CredentialStoreEncapsulatedOptions, CredentialStoreJwt, type CredentialStoreJwtOptions, CredentialStoreMemory, DEFAULT_RATE_LIMIT_MESSAGE, type DenylistStore, DenylistStoreMemory, type EmailSender, type EnrichedSession, type IssueOptions, type IssueResult, type JwtAlgorithm, type RateLimitDecision, type RateLimitRule, type RateLimitRuleInput, type RateLimitStore, RateLimitStoreMemory, RateLimiter, type RateLimiterOptions, type RefreshCallOptions, type RefreshConfig, type RefreshResult, type SessionEnricher, type SessionInfo, type SmsSender, defaultClock, formatDurationMs, generateMagicLinkToken, generateOpaqueToken, parseDurationMs, parseRateLimitRule, renderRateLimitMessage };

package/dist/index.mjs

@@ -1,5 +1,6 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
 import { t as credentialPayloadOf } from "./payload-D-DzH5-J.mjs";
+import { t as generateOpaqueToken } from "./opaque-token-BaMOrC1A.mjs";
 import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID, scryptSync } from "node:crypto";
 import { SignJWT, jwtVerify } from "jose";
 //#region src/errors.ts
@@ -585,10 +586,21 @@ var AuthCredential = class {
 	async issue(userId, options) {
 		if (this.maxConcurrent !== void 0 && this.store.listForUser) await this.enforceConcurrencyLimit(userId);
 		const now = this.clock.now();
-		const { metadata, sessionId: providedSessionId, ttl, expiresAt, kind, ...payload } = options ?? {};
-		const effectiveMetadata = kind !== void 0 ? {
+		const { metadata, sessionId: providedSessionId, ttl, expiresAt, kind, refresh, ...payload } = options ?? {};
+		let refreshTtl;
+		if (refresh === void 0) refreshTtl = this.refreshConfig?.ttl;
+		else if (refresh !== false) {
+			refreshTtl = refresh.ttl ?? this.refreshConfig?.ttl;
+			if (refreshTtl === void 0) throw new AuthError("INVALID_CONFIG", "issue: per-mint refresh needs a ttl when no instance refresh config exists");
+			if (refreshTtl <= 0) throw new AuthError("INVALID_CONFIG", `issue: refresh.ttl must be > 0 (got ${refreshTtl})`);
+		}
+		const perMintRefresh = refresh !== void 0 && refresh !== false;
+		const stampAccessTtl = refreshTtl !== void 0 && ttl !== void 0;
+		const effectiveMetadata = kind !== void 0 || stampAccessTtl || perMintRefresh ? {
 			...metadata,
-			credentialKind: kind
+			...kind !== void 0 && { credentialKind: kind },
+			...stampAccessTtl && { accessTtl: ttl },
+			...perMintRefresh && { refreshRotation: "always" }
 		} : metadata;
 		if (ttl !== void 0 && expiresAt !== void 0) throw new AuthError("INVALID_CONFIG", "issue: pass either `ttl` or `expiresAt`, not both");
 		if (ttl !== void 0 && ttl <= 0) throw new AuthError("INVALID_CONFIG", `issue: ttl must be > 0 (got ${ttl})`);
@@ -606,17 +618,17 @@ var AuthCredential = class {
 		const accessToken = await this.store.persist(accessState, accessStoreTtl);
 		let refreshToken;
 		let refreshExpiresAt;
-		if (this.refreshConfig) {
+		if (refreshTtl !== void 0) {
 			const refreshState = stateWithPayload(payload, {
 				userId,
 				issuedAt: now,
-				expiresAt: now + this.refreshConfig.ttl,
+				expiresAt: now + refreshTtl,
 				kind: "refresh",
 				metadata: effectiveMetadata,
 				sessionId
 			});
-			refreshToken = await this.store.persist(refreshState, this.refreshConfig.ttl);
-			refreshExpiresAt = now + this.refreshConfig.ttl;
+			refreshToken = await this.store.persist(refreshState, refreshTtl);
+			refreshExpiresAt = now + refreshTtl;
 		}
 		return {
 			accessToken,
@@ -641,9 +653,7 @@ var AuthCredential = class {
 			expiresAt: state.expiresAt
 		};
 	}
-	async refresh(refreshToken) {
-		if (!this.refreshConfig) throw new AuthError("INVALID_CONFIG", "Refresh not enabled");
-		const rotation = this.refreshConfig.rotation ?? "sliding";
+	async refresh(refreshToken, opts) {
 		const now = this.clock.now();
 		const oldState = await this.store.retrieve(refreshToken);
 		if (!oldState) {
@@ -652,6 +662,8 @@ var AuthCredential = class {
 			throw new AuthError("INVALID_TOKEN");
 		}
 		if (oldState.kind !== "refresh") throw new AuthError("INVALID_TOKEN", "Token is not a refresh credential");
+		await opts?.guard?.(oldState);
+		const rotation = oldState.metadata?.refreshRotation ?? (this.refreshConfig ? this.refreshConfig.rotation ?? "sliding" : "always");
 		switch (rotation) {
 			case "none": return await this.refreshNone(oldState, refreshToken, now);
 			case "always": return await this.refreshAlways(oldState, refreshToken, now);
@@ -665,7 +677,8 @@ var AuthCredential = class {
 			accessToken: newAccess.token,
 			accessExpiresAt: newAccess.expiresAt,
 			refreshToken,
-			refreshExpiresAt: oldState.expiresAt
+			refreshExpiresAt: oldState.expiresAt,
+			userId: oldState.userId
 		};
 	}
 	/**
@@ -708,8 +721,7 @@ var AuthCredential = class {
 	* (`sliding`) expiry for the new refresh token.
 	*/
 	async rotateWithGrace(oldState, refreshToken, now, preserveExpiry) {
-		if (!this.refreshConfig) throw new AuthError("INVALID_CONFIG", "Refresh not enabled");
-		const graceMs = this.refreshConfig.rotationGraceMs ?? DEFAULT_ROTATION_GRACE_MS;
+		const graceMs = this.refreshConfig?.rotationGraceMs ?? DEFAULT_ROTATION_GRACE_MS;
 		if (typeof oldState.rotatedAt !== "number") return await this.issueRotatedPair(oldState, refreshToken, true, now, preserveExpiry);
 		if (now - oldState.rotatedAt > graceMs) await this.respondToRefreshReuse({
 			userId: oldState.userId,
@@ -854,18 +866,19 @@ var AuthCredential = class {
 		for (let i = 0; i < toEvict && i < sorted.length; i++) await this.store.revoke(sorted[i].token);
 	}
 	async issueAccessFromRefresh(refreshState, now) {
+		const accessTtl = refreshState.metadata?.accessTtl ?? this.accessTtl;
 		const accessState = stateWithPayload(credentialPayloadOf(refreshState), {
 			userId: refreshState.userId,
 			issuedAt: now,
-			expiresAt: now + this.accessTtl,
+			expiresAt: now + accessTtl,
 			kind: "access",
 			metadata: refreshState.metadata,
 			sessionId: refreshState.sessionId,
 			...this.trackLastSeen === "refresh" && { lastSeenAt: now }
 		});
 		return {
-			token: await this.store.persist(accessState, this.accessTtl),
-			expiresAt: now + this.accessTtl
+			token: await this.store.persist(accessState, accessTtl),
+			expiresAt: now + accessTtl
 		};
 	}
 	/**
@@ -876,10 +889,10 @@ var AuthCredential = class {
 	* rotated (keeping it valid through the grace window) instead of consuming it.
 	*/
 	async issueRotatedPair(oldRefreshState, oldRefreshToken, rotateOld, now, preserveExpiry = false) {
-		if (!this.refreshConfig) throw new AuthError("INVALID_CONFIG", "Refresh not enabled");
-		const access = await this.issueAccessFromRefresh(oldRefreshState, now);
-		const refreshExpiresAt = preserveExpiry ? oldRefreshState.expiresAt : now + this.refreshConfig.ttl;
-		const refreshTtl = preserveExpiry ? Math.max(0, oldRefreshState.expiresAt - now) : this.refreshConfig.ttl;
+		const slidingTtl = this.refreshConfig?.ttl;
+		if (!preserveExpiry && slidingTtl === void 0) throw new AuthError("INVALID_CONFIG", "Refresh not enabled");
+		const refreshExpiresAt = preserveExpiry ? oldRefreshState.expiresAt : now + slidingTtl;
+		const refreshTtl = preserveExpiry ? Math.max(0, oldRefreshState.expiresAt - now) : slidingTtl;
 		const newRefreshState = stateWithPayload(credentialPayloadOf(oldRefreshState), {
 			userId: oldRefreshState.userId,
 			issuedAt: now,
@@ -890,6 +903,7 @@ var AuthCredential = class {
 			sessionId: oldRefreshState.sessionId,
 			...this.trackLastSeen === "refresh" && { lastSeenAt: now }
 		});
+		const access = await this.issueAccessFromRefresh(oldRefreshState, now);
 		const newRefreshToken = await this.store.persist(newRefreshState, refreshTtl);
 		if (rotateOld) {
 			const rotatedState = {
@@ -902,7 +916,8 @@ var AuthCredential = class {
 			accessToken: access.token,
 			accessExpiresAt: access.expiresAt,
 			refreshToken: newRefreshToken,
-			refreshExpiresAt
+			refreshExpiresAt,
+			userId: oldRefreshState.userId
 		};
 	}
 	lookupConsumedRefresh(token) {
@@ -1135,12 +1150,9 @@ var RateLimiter = class {
 };
 //#endregion
 //#region src/magic-link.ts
-/**
-* 32 bytes of CSPRNG entropy (256 bits) encoded as base64url — 43 chars,
-* URL-safe. Strong enough to survive short TTLs against online guessing.
-*/
+/** A magic-link token is a plain {@link generateOpaqueToken} mint. */
 function generateMagicLinkToken() {
-	return randomBytes(32).toString("base64url");
+	return generateOpaqueToken();
 }
 //#endregion
-export { AuthCredential, AuthError, CredentialStoreEncapsulated, CredentialStoreJwt, CredentialStoreMemory, DEFAULT_RATE_LIMIT_MESSAGE, DenylistStoreMemory, RateLimitStoreMemory, RateLimiter, defaultClock, formatDurationMs, generateMagicLinkToken, parseDurationMs, parseRateLimitRule, renderRateLimitMessage };
+export { AuthCredential, AuthError, CredentialStoreEncapsulated, CredentialStoreJwt, CredentialStoreMemory, DEFAULT_RATE_LIMIT_MESSAGE, DenylistStoreMemory, RateLimitStoreMemory, RateLimiter, defaultClock, formatDurationMs, generateMagicLinkToken, generateOpaqueToken, parseDurationMs, parseRateLimitRule, renderRateLimitMessage };

package/dist/opaque-token-BaMOrC1A.mjs

@@ -0,0 +1,13 @@
+import { randomBytes } from "node:crypto";
+//#region src/utils/opaque-token.ts
+/**
+* 32 bytes of CSPRNG entropy (256 bits) encoded as base64url — 43 chars,
+* URL-safe. The single mint for every opaque bearer-style secret in the stack
+* (magic-link tokens, dynamic-client secrets, authz browser bindings):
+* unguessable online, cheap to generate, safe to place in a URL.
+*/
+function generateOpaqueToken() {
+	return randomBytes(32).toString("base64url");
+}
+//#endregion
+export { generateOpaqueToken as t };

package/dist/opaque-token-CaZgD2i6.cjs

@@ -0,0 +1,18 @@
+let node_crypto = require("node:crypto");
+//#region src/utils/opaque-token.ts
+/**
+* 32 bytes of CSPRNG entropy (256 bits) encoded as base64url — 43 chars,
+* URL-safe. The single mint for every opaque bearer-style secret in the stack
+* (magic-link tokens, dynamic-client secrets, authz browser bindings):
+* unguessable online, cheap to generate, safe to place in a URL.
+*/
+function generateOpaqueToken() {
+	return (0, node_crypto.randomBytes)(32).toString("base64url");
+}
+//#endregion
+Object.defineProperty(exports, "generateOpaqueToken", {
+	enumerable: true,
+	get: function() {
+		return generateOpaqueToken;
+	}
+});

package/dist/redis.d.cts

@@ -1,5 +1,5 @@
-import { a as CredentialState, n as DenylistStore, t as CredentialStore } from "./store-BG6m6oSJ.cjs";
-import { t as RateLimitStore } from "./store-N9daSmHS.cjs";
+import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-DJ_eroHW.cjs";
+import { t as RateLimitStore } from "./store-BYnpA7VK.cjs";
 
 //#region src/redis/index.d.ts
 /**

package/dist/redis.d.mts

@@ -1,5 +1,5 @@
-import { a as CredentialState, n as DenylistStore, t as CredentialStore } from "./store-BG6m6oSJ.mjs";
-import { t as RateLimitStore } from "./store-jFgby4bK.mjs";
+import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-DJ_eroHW.mjs";
+import { t as RateLimitStore } from "./store-pKh0ZaGG.mjs";
 
 //#region src/redis/index.d.ts
 /**

package/dist/{store-N9daSmHS.d.cts → store-BYnpA7VK.d.cts}

@@ -1,4 +1,4 @@
-import { t as Clock } from "./clock-BjXa0LXb.cjs";
+import { t as Clock } from "./clock-DJ_eroHW.cjs";
 
 //#region src/rate-limit/store.d.ts
 /**

package/dist/{store-jFgby4bK.d.mts → store-pKh0ZaGG.d.mts}

@@ -1,4 +1,4 @@
-import { t as Clock } from "./clock-BjXa0LXb.mjs";
+import { t as Clock } from "./clock-DJ_eroHW.mjs";
 
 //#region src/rate-limit/store.d.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/auth",
-  "version": "0.1.47",
+  "version": "0.1.48",
   "description": "Auth method layer for aoothjs (sessions, tokens, password reset, MFA primitives)",
   "keywords": [
     "aoothjs",
@@ -104,7 +104,7 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/user": "0.1.47"
+    "@aooth/user": "0.1.48"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.82",

package/src/atscript-db/auth-credential.as

@@ -29,6 +29,22 @@ export type AoothCredentialMetadataBase = {
      * the internal access/refresh `kind` column on the row.
      */
     credentialKind?: string
+    /**
+     * OAuth client_id the authz token endpoint minted this family for — the
+     * refresh_token grant's client binding (written by @aooth/auth-moost).
+     */
+    authzClientId?: string
+    /**
+     * Per-family access-token ttl (ms) — stamped when a refresh token is
+     * minted with a per-mint ttl, so refreshes keep the mint-time authority.
+     */
+    accessTtl?: number
+    /**
+     * Per-family rotation semantics ("always" for per-mint refresh families)
+     * — honored over the instance rotation so a fixed-ceiling grant never
+     * slides. Stored as a plain string (same portability rule as `kind`).
+     */
+    refreshRotation?: string
 }
 
 @db.table 'aooth_credentials'

package/src/atscript-db/auth-credential.as.d.ts

@@ -19,6 +19,9 @@ export type AoothCredentialMetadataBase = {
   fingerprint?: string
   label?: string
   credentialKind?: string
+  authzClientId?: string
+  accessTtl?: number
+  refreshRotation?: string
 }
 declare namespace AoothCredentialMetadataBase {
   const __is_atscript_annotated_type: true
@@ -33,7 +36,7 @@ declare namespace AoothCredentialMetadataBase {
 
 /**
  * Atscript interface **AoothAuthCredential**
- * @see {@link ./auth-credential.as:36:18}
+ * @see {@link ./auth-credential.as:52:18}
  */
 export declare class AoothAuthCredential {
   token: string

package/src/atscript-db/dynamic-client.as

@@ -23,9 +23,19 @@ export interface AoothDynamicClient {
      */
     redirectUris: string
 
-    /** v1 supports public clients only ("none") — PKCE is the binding. */
+    /**
+     * "none" (public — PKCE is the binding) or "client_secret_post"
+     * (confidential — a server-minted secret is checked at the token endpoint).
+     */
     tokenEndpointAuthMethod: string
 
+    /**
+     * SHA-256 hex digest of the minted client_secret — set iff
+     * tokenEndpointAuthMethod is "client_secret_post". The plaintext is
+     * returned once in the registration response and never stored.
+     */
+    clientSecretHash?: string
+
     /** Registered grant types (narrowed to supported), JSON string array. */
     grantTypes: string
     /** Registered response types (narrowed to supported), JSON string array. */

package/src/atscript-db/dynamic-client.as.d.ts

@@ -18,6 +18,7 @@ export declare class AoothDynamicClient {
   clientName?: string
   redirectUris: string
   tokenEndpointAuthMethod: string
+  clientSecretHash?: string
   grantTypes: string
   responseTypes: string
   scope?: string
@@ -36,6 +37,7 @@ export declare class AoothDynamicClient {
     "clientName"?: string
     "redirectUris": string
     "tokenEndpointAuthMethod": string
+    "clientSecretHash"?: string
     "grantTypes": string
     "responseTypes": string
     "scope"?: string
@@ -47,6 +49,7 @@ export declare class AoothDynamicClient {
     "clientName"?: string
     "redirectUris": string
     "tokenEndpointAuthMethod": string
+    "clientSecretHash"?: string
     "grantTypes": string
     "responseTypes": string
     "scope"?: string

package/dist/clock-BjXa0LXb.d.cts

@@ -1,14 +0,0 @@
-//#region src/utils/clock.d.ts
-/**
- * Minimal time abstraction shared across stores and orchestrators.
- *
- * Defaults to wall-clock; tests inject a fake clock to deterministically
- * advance time. Kept tiny (single `now()` method) so any timing primitive
- * — Date, performance.now-ish, monotonic, etc. — can be plugged in.
- */
-interface Clock {
-  now(): number;
-}
-declare const defaultClock: Clock;
-//#endregion
-export { defaultClock as n, Clock as t };

package/dist/clock-BjXa0LXb.d.mts

@@ -1,14 +0,0 @@
-//#region src/utils/clock.d.ts
-/**
- * Minimal time abstraction shared across stores and orchestrators.
- *
- * Defaults to wall-clock; tests inject a fake clock to deterministically
- * advance time. Kept tiny (single `now()` method) so any timing primitive
- * — Date, performance.now-ish, monotonic, etc. — can be plugged in.
- */
-interface Clock {
-  now(): number;
-}
-declare const defaultClock: Clock;
-//#endregion
-export { defaultClock as n, Clock as t };