@aooth/auth 0.1.7 → 0.1.8

package/src/atscript-db/auth-credential.as

@@ -24,26 +24,32 @@ export interface AoothAuthCredential {
     kind?: string
 
     /**
-     * Custom claims, stored as JSON. Pattern-property shape accepts any key
-     * with a scalar value — matches the JWT registered-claim spec (iss, sub,
-     * iat, exp, jti, aud, etc.) which are all primitives. Consumers needing
-     * nested/structured claims should subclass with an explicit `claims` shape.
+     * Display metadata: ip, userAgent, fingerprint, label, plus the semantic
+     * credential kind (`cli-session` / `pat` / …) folded in by `issue()`. The
+     * `@db.json` column is schema-validated, so every field `CredentialMetadata`
+     * may carry must be declared here.
      */
     @db.json
-    claims?: {
-        [/.*/]: string | number | boolean
-    }
-
-    /** Display metadata: ip, userAgent, fingerprint, label. */
-    @db.json
     metadata?: {
         ip?: string
         userAgent?: string
         fingerprint?: string
         label?: string
+        credentialKind?: string
     }
 
     /** Set by refresh-token rotation. */
     parentCredentialId?: string
     rotatedAt?: number.timestamp
+
+    /**
+     * Stable session-family id. Minted once at login, copied forward on every
+     * rotation. Indexed so a store could group/revoke a family natively (the
+     * orchestrator groups in-memory today, but the index is cheap + forward-looking).
+     */
+    @db.index.plain
+    sessionId?: string
+
+    /** Last-activity timestamp; written only under `trackLastSeen`. */
+    lastSeenAt?: number.timestamp
 }

package/src/atscript-db/auth-credential.as.d.ts

@@ -0,0 +1,68 @@
+// prettier-ignore-start
+/* eslint-disable */
+/* oxlint-disable */
+/// <reference path="./auth-credential.as" />
+/**
+ * 🪄 This file was generated by Atscript
+ * Do not edit this file!
+ */
+
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+
+/**
+ * Atscript interface **AoothAuthCredential**
+ * @see {@link ./auth-credential.as:3:18}
+ */
+export declare class AoothAuthCredential {
+  token: string
+  userId: string
+  issuedAt: number /* timestamp */
+  expiresAt: number /* timestamp */
+  kind?: string
+  metadata?: {
+    ip?: string
+    userAgent?: string
+    fingerprint?: string
+    label?: string
+    credentialKind?: string
+  }
+  parentCredentialId?: string
+  rotatedAt?: number /* timestamp */
+  sessionId?: string
+  lastSeenAt?: number /* timestamp */
+  static __is_atscript_annotated_type: true
+  static type: TAtscriptTypeObject<keyof AoothAuthCredential, AoothAuthCredential>
+  static metadata: TMetadataMap<AtscriptMetadata>
+  static validator: (opts?: Partial<TValidatorOptions>) => Validator<typeof AoothAuthCredential>
+  /** @deprecated JSON Schema support is disabled. Calling this method will throw a runtime error. To enable, set `jsonSchema: 'lazy'` or `jsonSchema: 'bundle'` in tsPlugin options, or add `@emit.jsonSchema` annotation to individual interfaces. */
+  static toJsonSchema: () => any
+  /** @deprecated Example Data support is disabled. To enable, set `exampleData: true` in tsPlugin options. */
+  static toExampleData?: () => any
+  static __flat: {
+    "token": string
+    "userId": string
+    "issuedAt": number /* timestamp */
+    "expiresAt": number /* timestamp */
+    "kind"?: string
+    "metadata"?: string
+    "parentCredentialId"?: string
+    "rotatedAt"?: number /* timestamp */
+    "sessionId"?: string
+    "lastSeenAt"?: number /* timestamp */
+  }
+  static __ownProps: {
+    "token": string
+    "userId": string
+    "issuedAt": number /* timestamp */
+    "expiresAt": number /* timestamp */
+    "kind"?: string
+    "metadata"?: string
+    "parentCredentialId"?: string
+    "rotatedAt"?: number /* timestamp */
+    "sessionId"?: string
+    "lastSeenAt"?: number /* timestamp */
+  }
+  
+  static __pk: string
+}
+// prettier-ignore-end

package/dist/store-B1t8KkfA.d.mts

@@ -1,124 +0,0 @@
-//#region src/credential/types.d.ts
-/**
- * What a successful auth check produces.
- * Generic over TClaims for typed custom claims.
- */
-interface AuthContext<TClaims extends object = object> {
-  userId: string;
-  method: "session" | "token";
-  credentialId: string;
-  expiresAt: number;
-  claims?: TClaims;
-}
-/**
- * Display metadata for stateful credentials.
- * Extensible via TypeScript declaration merging:
- *   declare module '@aooth/auth' {
- *     interface CredentialMetadata { geoCountry?: string }
- *   }
- */
-interface CredentialMetadata {
-  ip?: string;
-  userAgent?: string;
-  fingerprint?: string;
-  label?: string;
-}
-/**
- * Persisted state of a credential.
- */
-interface CredentialState<TClaims extends object = object> {
-  userId: string;
-  issuedAt: number;
-  expiresAt: number;
-  claims?: TClaims;
-  metadata?: CredentialMetadata;
-  /**
-   * Discriminant between access and refresh credentials persisted in the same store.
-   * Defaults to "access" when omitted.
-   */
-  kind?: "access" | "refresh";
-  /** For rotated refresh tokens — id of the parent credential this one replaced */
-  parentCredentialId?: string;
-  /** Timestamp of rotation; used by sliding rotation grace period */
-  rotatedAt?: number;
-}
-/**
- * Result of issuing a credential or refreshing it.
- */
-interface IssueResult {
-  accessToken: string;
-  refreshToken?: string;
-  accessExpiresAt: number;
-  refreshExpiresAt?: number;
-}
-/**
- * Refresh token configuration.
- */
-interface RefreshConfig {
-  /** Refresh token lifetime in milliseconds. */
-  ttl: number;
-  /**
-   * Rotation strategy. Defaults to 'sliding'.
-   *
-   * Note: 'sliding' grace-period replay tolerance only works against stateful
-   * stores (e.g. {@link CredentialStoreMemory}). Stateless stores (JWT,
-   * Encapsulated) cannot mutate an issued token in place; after the first
-   * rotation the old refresh becomes unusable, so 'sliding' degrades to
-   * 'always' semantics. Use 'always' explicitly for stateless deployments.
-   */
-  rotation?: "none" | "always" | "sliding";
-  /** Grace period for sliding rotation, in milliseconds. Defaults to 30_000. */
-  rotationGraceMs?: number;
-  /** Theft detection hook — invoked when a previously-rotated refresh is reused. */
-  onRotationReuse?: (state: CredentialState) => void;
-}
-//#endregion
-//#region src/stores/store.d.ts
-/**
- * Pluggable credential storage. Implementations: Memory, JWT, Encapsulated.
- * Same shape works for stateful and stateless stores. Stateless stores treat
- * the token as the state itself (sign/encrypt on persist, verify/decrypt on retrieve).
- *
- * `TClaims` is constrained to `extends object`, which TypeScript widens to
- * include arrays, class instances, and `Function`. Pass a plain object type
- * (e.g. `{ role: string; tenant: string }`); using arrays/classes will type-
- * check but won't survive JSON-serialised stateless storage round-trips.
- */
-interface CredentialStore<TClaims extends object = object> {
-  /** Persist state, return token. For stateless stores, token IS the state. */
-  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
-  /** Retrieve state from token. Returns null if expired/invalid/revoked. */
-  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
-  /** Retrieve + invalidate (single-use). For stateless: needs denylist. */
-  consume(token: string): Promise<CredentialState<TClaims> | null>;
-  /**
-   * Update state. The returned token MAY differ from the input — stateful
-   * stores typically return the same token, while stateless stores re-issue
-   * a new token (denylisting the old). Callers must use the returned value.
-   */
-  update(token: string, state: CredentialState<TClaims>): Promise<string>;
-  /** Revoke a single token. For stateless: requires denylist; otherwise throws. */
-  revoke(token: string): Promise<void>;
-  /**
-   * Revoke all credentials for a user. Returns count revoked.
-   * Stateless stores cannot enumerate individual tokens; they MAY implement
-   * the cascade via a per-user revocation epoch (see `CredentialStoreJwt`)
-   * and return a sentinel `1` to indicate "revocation took effect".
-   */
-  revokeAllForUser(userId: string): Promise<number>;
-  /** List active credentials for a user (stateful only). */
-  listForUser?(userId: string): Promise<Array<CredentialState<TClaims> & {
-    token: string;
-  }>>;
-}
-/**
- * Denylist for stateless revocation. Stores revoked-but-not-yet-expired token IDs.
- * Auto-bounded by token TTLs.
- */
-interface DenylistStore {
-  add(jti: string, expiresAt: number): Promise<void>;
-  has(jti: string): Promise<boolean>;
-  cleanup(): Promise<number>;
-}
-//#endregion
-export { CredentialState as a, CredentialMetadata as i, DenylistStore as n, IssueResult as o, AuthContext as r, RefreshConfig as s, CredentialStore as t };

package/dist/store-untAtWQz.d.cts

@@ -1,124 +0,0 @@
-//#region src/credential/types.d.ts
-/**
- * What a successful auth check produces.
- * Generic over TClaims for typed custom claims.
- */
-interface AuthContext<TClaims extends object = object> {
-  userId: string;
-  method: "session" | "token";
-  credentialId: string;
-  expiresAt: number;
-  claims?: TClaims;
-}
-/**
- * Display metadata for stateful credentials.
- * Extensible via TypeScript declaration merging:
- *   declare module '@aooth/auth' {
- *     interface CredentialMetadata { geoCountry?: string }
- *   }
- */
-interface CredentialMetadata {
-  ip?: string;
-  userAgent?: string;
-  fingerprint?: string;
-  label?: string;
-}
-/**
- * Persisted state of a credential.
- */
-interface CredentialState<TClaims extends object = object> {
-  userId: string;
-  issuedAt: number;
-  expiresAt: number;
-  claims?: TClaims;
-  metadata?: CredentialMetadata;
-  /**
-   * Discriminant between access and refresh credentials persisted in the same store.
-   * Defaults to "access" when omitted.
-   */
-  kind?: "access" | "refresh";
-  /** For rotated refresh tokens — id of the parent credential this one replaced */
-  parentCredentialId?: string;
-  /** Timestamp of rotation; used by sliding rotation grace period */
-  rotatedAt?: number;
-}
-/**
- * Result of issuing a credential or refreshing it.
- */
-interface IssueResult {
-  accessToken: string;
-  refreshToken?: string;
-  accessExpiresAt: number;
-  refreshExpiresAt?: number;
-}
-/**
- * Refresh token configuration.
- */
-interface RefreshConfig {
-  /** Refresh token lifetime in milliseconds. */
-  ttl: number;
-  /**
-   * Rotation strategy. Defaults to 'sliding'.
-   *
-   * Note: 'sliding' grace-period replay tolerance only works against stateful
-   * stores (e.g. {@link CredentialStoreMemory}). Stateless stores (JWT,
-   * Encapsulated) cannot mutate an issued token in place; after the first
-   * rotation the old refresh becomes unusable, so 'sliding' degrades to
-   * 'always' semantics. Use 'always' explicitly for stateless deployments.
-   */
-  rotation?: "none" | "always" | "sliding";
-  /** Grace period for sliding rotation, in milliseconds. Defaults to 30_000. */
-  rotationGraceMs?: number;
-  /** Theft detection hook — invoked when a previously-rotated refresh is reused. */
-  onRotationReuse?: (state: CredentialState) => void;
-}
-//#endregion
-//#region src/stores/store.d.ts
-/**
- * Pluggable credential storage. Implementations: Memory, JWT, Encapsulated.
- * Same shape works for stateful and stateless stores. Stateless stores treat
- * the token as the state itself (sign/encrypt on persist, verify/decrypt on retrieve).
- *
- * `TClaims` is constrained to `extends object`, which TypeScript widens to
- * include arrays, class instances, and `Function`. Pass a plain object type
- * (e.g. `{ role: string; tenant: string }`); using arrays/classes will type-
- * check but won't survive JSON-serialised stateless storage round-trips.
- */
-interface CredentialStore<TClaims extends object = object> {
-  /** Persist state, return token. For stateless stores, token IS the state. */
-  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
-  /** Retrieve state from token. Returns null if expired/invalid/revoked. */
-  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
-  /** Retrieve + invalidate (single-use). For stateless: needs denylist. */
-  consume(token: string): Promise<CredentialState<TClaims> | null>;
-  /**
-   * Update state. The returned token MAY differ from the input — stateful
-   * stores typically return the same token, while stateless stores re-issue
-   * a new token (denylisting the old). Callers must use the returned value.
-   */
-  update(token: string, state: CredentialState<TClaims>): Promise<string>;
-  /** Revoke a single token. For stateless: requires denylist; otherwise throws. */
-  revoke(token: string): Promise<void>;
-  /**
-   * Revoke all credentials for a user. Returns count revoked.
-   * Stateless stores cannot enumerate individual tokens; they MAY implement
-   * the cascade via a per-user revocation epoch (see `CredentialStoreJwt`)
-   * and return a sentinel `1` to indicate "revocation took effect".
-   */
-  revokeAllForUser(userId: string): Promise<number>;
-  /** List active credentials for a user (stateful only). */
-  listForUser?(userId: string): Promise<Array<CredentialState<TClaims> & {
-    token: string;
-  }>>;
-}
-/**
- * Denylist for stateless revocation. Stores revoked-but-not-yet-expired token IDs.
- * Auto-bounded by token TTLs.
- */
-interface DenylistStore {
-  add(jti: string, expiresAt: number): Promise<void>;
-  has(jti: string): Promise<boolean>;
-  cleanup(): Promise<number>;
-}
-//#endregion
-export { CredentialState as a, CredentialMetadata as i, DenylistStore as n, IssueResult as o, AuthContext as r, RefreshConfig as s, CredentialStore as t };