@aooth/auth 0.1.7 → 0.1.9

package/dist/atscript-db.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_payload = require("./payload-BJjvj8AH.cjs");
 let node_crypto = require("node:crypto");
 //#region src/atscript-db/index.ts
 /**
@@ -22,18 +23,7 @@ var CredentialStoreAtscriptDb = class {
 	async persist(state, ttl) {
 		const token = (0, node_crypto.randomUUID)();
 		const expiresAt = typeof ttl === "number" ? Date.now() + ttl : state.expiresAt;
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.insertOne(row);
+		await this.table.insertOne(stateToRow(state, token, expiresAt));
 		return token;
 	}
 	async retrieve(token) {
@@ -57,23 +47,21 @@ var CredentialStoreAtscriptDb = class {
 			await this.revoke(token);
 			return token;
 		}
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt: state.expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.replaceOne(row);
+		await this.table.replaceOne(stateToRow(state, token, state.expiresAt));
 		return token;
 	}
 	async revoke(token) {
 		await this.table.deleteOne(token);
 	}
+	async touch(token, at) {
+		const row = await this.table.findOne({ filter: { token } });
+		if (!row) return;
+		if (row.expiresAt <= Date.now()) return;
+		await this.table.replaceOne({
+			...row,
+			lastSeenAt: at
+		});
+	}
 	async revokeAllForUser(userId) {
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
@@ -96,17 +84,40 @@ var CredentialStoreAtscriptDb = class {
 		return out;
 	}
 };
+/**
+* Build the persisted row from a credential state: typed payload columns first
+* (so an envelope field wins a name clash), then the fixed envelope fields and
+* the resolved `token` + `expiresAt`. Shared by `persist` and `update`, which
+* differ only in the `expiresAt` they resolve.
+*/
+function stateToRow(state, token, expiresAt) {
+	return {
+		...require_payload.credentialPayloadOf(state),
+		token,
+		userId: state.userId,
+		issuedAt: state.issuedAt,
+		expiresAt,
+		kind: state.kind,
+		metadata: state.metadata,
+		parentCredentialId: state.parentCredentialId,
+		rotatedAt: state.rotatedAt,
+		sessionId: state.sessionId,
+		lastSeenAt: state.lastSeenAt
+	};
+}
 function rowToState(row) {
 	const state = {
+		...require_payload.credentialPayloadOf(row),
 		userId: row.userId,
 		issuedAt: row.issuedAt,
 		expiresAt: row.expiresAt
 	};
-	if (row.claims !== void 0) state.claims = row.claims;
 	if (row.metadata !== void 0) state.metadata = row.metadata;
 	if (row.kind === "access" || row.kind === "refresh") state.kind = row.kind;
 	if (row.parentCredentialId !== void 0) state.parentCredentialId = row.parentCredentialId;
 	if (row.rotatedAt !== void 0) state.rotatedAt = row.rotatedAt;
+	if (row.sessionId !== void 0) state.sessionId = row.sessionId;
+	if (row.lastSeenAt !== void 0) state.lastSeenAt = row.lastSeenAt;
 	return state;
 }
 //#endregion

package/dist/atscript-db.d.cts

@@ -1,20 +1,23 @@
-import { a as CredentialState, t as CredentialStore } from "./store-untAtWQz.cjs";
+import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.cjs";
 
 //#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — mirrors `AoothAuthCredential` from
- * `./auth-credential.as`. Re-declared here as a plain TS interface so
- * consumers can use the adapter without running the atscript build (and so
- * `@aooth/auth` doesn't need to depend on `@atscript/typescript` at build
- * time). When you DO wire the `.as` model, the shapes match by construction.
+ * `./auth-credential.as`. Re-declared here as a plain TS type so consumers can
+ * use the adapter without running the atscript build (and so `@aooth/auth`
+ * doesn't need to depend on `@atscript/typescript` at build time). When you DO
+ * wire the `.as` model, the shapes match by construction.
+ *
+ * The consumer's typed payload `TPayload` (the root fields they add to their
+ * `extends AoothAuthCredential` model) is intersected flat — those become real
+ * typed columns, replacing the dropped free-form `claims` blob.
  */
-interface AuthCredentialRow<TClaims extends object = object> {
+type AuthCredentialRow<TPayload extends object = object> = {
   token: string;
   userId: string;
   issuedAt: number;
   expiresAt: number;
   kind?: string;
-  claims?: TClaims;
   metadata?: {
     ip?: string;
     userAgent?: string;
@@ -23,25 +26,27 @@ interface AuthCredentialRow<TClaims extends object = object> {
   };
   parentCredentialId?: string;
   rotatedAt?: number;
-}
+  sessionId?: string;
+  lastSeenAt?: number;
+} & TPayload;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
  * `@aooth/auth` public surface — consumers pass `db.getTable(AoothAuthCredential)`
  * directly and TypeScript matches by-shape.
  */
-interface AuthCredentialTable<TClaims extends object = object> {
-  insertOne(row: AuthCredentialRow<TClaims>): Promise<{
+interface AuthCredentialTable<TPayload extends object = object> {
+  insertOne(row: AuthCredentialRow<TPayload>): Promise<{
     insertedId: unknown;
   }>;
   findOne(query: {
     filter: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims> | null>;
+  }): Promise<AuthCredentialRow<TPayload> | null>;
   findMany(query: {
     filter?: Record<string, unknown>;
     controls?: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims>[]>;
-  replaceOne(row: AuthCredentialRow<TClaims>): Promise<{
+  }): Promise<AuthCredentialRow<TPayload>[]>;
+  replaceOne(row: AuthCredentialRow<TPayload>): Promise<{
     matchedCount: number;
     modifiedCount: number;
   }>;
@@ -52,8 +57,8 @@ interface AuthCredentialTable<TClaims extends object = object> {
     deletedCount: number;
   }>;
 }
-interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
-  table: AuthCredentialTable<TClaims>;
+interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
+  table: AuthCredentialTable<TPayload>;
 }
 /**
  * atscript-db-backed `CredentialStore`.
@@ -68,16 +73,17 @@ interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
  * `.as` model). Custom tables must keep `token` as PK or override the
  * adapter.
  */
-declare class CredentialStoreAtscriptDb<TClaims extends object = object> implements CredentialStore<TClaims> {
+declare class CredentialStoreAtscriptDb<TPayload extends object = object> implements CredentialStore<TPayload> {
   private readonly table;
-  constructor(opts: CredentialStoreAtscriptDbOptions<TClaims>);
-  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
-  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
-  consume(token: string): Promise<CredentialState<TClaims> | null>;
-  update(token: string, state: CredentialState<TClaims>): Promise<string>;
+  constructor(opts: CredentialStoreAtscriptDbOptions<TPayload>);
+  persist(state: CredentialState & TPayload, ttl?: number): Promise<string>;
+  retrieve(token: string): Promise<(CredentialState & TPayload) | null>;
+  consume(token: string): Promise<(CredentialState & TPayload) | null>;
+  update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
+  touch(token: string, at: number): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
-  listForUser(userId: string): Promise<Array<CredentialState<TClaims> & {
+  listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;
   }>>;
 }

package/dist/atscript-db.d.mts

@@ -1,20 +1,23 @@
-import { a as CredentialState, t as CredentialStore } from "./store-B1t8KkfA.mjs";
+import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.mjs";
 
 //#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — mirrors `AoothAuthCredential` from
- * `./auth-credential.as`. Re-declared here as a plain TS interface so
- * consumers can use the adapter without running the atscript build (and so
- * `@aooth/auth` doesn't need to depend on `@atscript/typescript` at build
- * time). When you DO wire the `.as` model, the shapes match by construction.
+ * `./auth-credential.as`. Re-declared here as a plain TS type so consumers can
+ * use the adapter without running the atscript build (and so `@aooth/auth`
+ * doesn't need to depend on `@atscript/typescript` at build time). When you DO
+ * wire the `.as` model, the shapes match by construction.
+ *
+ * The consumer's typed payload `TPayload` (the root fields they add to their
+ * `extends AoothAuthCredential` model) is intersected flat — those become real
+ * typed columns, replacing the dropped free-form `claims` blob.
  */
-interface AuthCredentialRow<TClaims extends object = object> {
+type AuthCredentialRow<TPayload extends object = object> = {
   token: string;
   userId: string;
   issuedAt: number;
   expiresAt: number;
   kind?: string;
-  claims?: TClaims;
   metadata?: {
     ip?: string;
     userAgent?: string;
@@ -23,25 +26,27 @@ interface AuthCredentialRow<TClaims extends object = object> {
   };
   parentCredentialId?: string;
   rotatedAt?: number;
-}
+  sessionId?: string;
+  lastSeenAt?: number;
+} & TPayload;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
  * `@aooth/auth` public surface — consumers pass `db.getTable(AoothAuthCredential)`
  * directly and TypeScript matches by-shape.
  */
-interface AuthCredentialTable<TClaims extends object = object> {
-  insertOne(row: AuthCredentialRow<TClaims>): Promise<{
+interface AuthCredentialTable<TPayload extends object = object> {
+  insertOne(row: AuthCredentialRow<TPayload>): Promise<{
     insertedId: unknown;
   }>;
   findOne(query: {
     filter: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims> | null>;
+  }): Promise<AuthCredentialRow<TPayload> | null>;
   findMany(query: {
     filter?: Record<string, unknown>;
     controls?: Record<string, unknown>;
-  }): Promise<AuthCredentialRow<TClaims>[]>;
-  replaceOne(row: AuthCredentialRow<TClaims>): Promise<{
+  }): Promise<AuthCredentialRow<TPayload>[]>;
+  replaceOne(row: AuthCredentialRow<TPayload>): Promise<{
     matchedCount: number;
     modifiedCount: number;
   }>;
@@ -52,8 +57,8 @@ interface AuthCredentialTable<TClaims extends object = object> {
     deletedCount: number;
   }>;
 }
-interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
-  table: AuthCredentialTable<TClaims>;
+interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
+  table: AuthCredentialTable<TPayload>;
 }
 /**
  * atscript-db-backed `CredentialStore`.
@@ -68,16 +73,17 @@ interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
  * `.as` model). Custom tables must keep `token` as PK or override the
  * adapter.
  */
-declare class CredentialStoreAtscriptDb<TClaims extends object = object> implements CredentialStore<TClaims> {
+declare class CredentialStoreAtscriptDb<TPayload extends object = object> implements CredentialStore<TPayload> {
   private readonly table;
-  constructor(opts: CredentialStoreAtscriptDbOptions<TClaims>);
-  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
-  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
-  consume(token: string): Promise<CredentialState<TClaims> | null>;
-  update(token: string, state: CredentialState<TClaims>): Promise<string>;
+  constructor(opts: CredentialStoreAtscriptDbOptions<TPayload>);
+  persist(state: CredentialState & TPayload, ttl?: number): Promise<string>;
+  retrieve(token: string): Promise<(CredentialState & TPayload) | null>;
+  consume(token: string): Promise<(CredentialState & TPayload) | null>;
+  update(token: string, state: CredentialState & TPayload): Promise<string>;
   revoke(token: string): Promise<void>;
+  touch(token: string, at: number): Promise<void>;
   revokeAllForUser(userId: string): Promise<number>;
-  listForUser(userId: string): Promise<Array<CredentialState<TClaims> & {
+  listForUser(userId: string): Promise<Array<CredentialState & TPayload & {
     token: string;
   }>>;
 }

package/dist/atscript-db.mjs

@@ -1,3 +1,4 @@
+import { t as credentialPayloadOf } from "./payload-D-DzH5-J.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/atscript-db/index.ts
 /**
@@ -21,18 +22,7 @@ var CredentialStoreAtscriptDb = class {
 	async persist(state, ttl) {
 		const token = randomUUID();
 		const expiresAt = typeof ttl === "number" ? Date.now() + ttl : state.expiresAt;
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.insertOne(row);
+		await this.table.insertOne(stateToRow(state, token, expiresAt));
 		return token;
 	}
 	async retrieve(token) {
@@ -56,23 +46,21 @@ var CredentialStoreAtscriptDb = class {
 			await this.revoke(token);
 			return token;
 		}
-		const row = {
-			token,
-			userId: state.userId,
-			issuedAt: state.issuedAt,
-			expiresAt: state.expiresAt,
-			kind: state.kind,
-			claims: state.claims,
-			metadata: state.metadata,
-			parentCredentialId: state.parentCredentialId,
-			rotatedAt: state.rotatedAt
-		};
-		await this.table.replaceOne(row);
+		await this.table.replaceOne(stateToRow(state, token, state.expiresAt));
 		return token;
 	}
 	async revoke(token) {
 		await this.table.deleteOne(token);
 	}
+	async touch(token, at) {
+		const row = await this.table.findOne({ filter: { token } });
+		if (!row) return;
+		if (row.expiresAt <= Date.now()) return;
+		await this.table.replaceOne({
+			...row,
+			lastSeenAt: at
+		});
+	}
 	async revokeAllForUser(userId) {
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
@@ -95,17 +83,40 @@ var CredentialStoreAtscriptDb = class {
 		return out;
 	}
 };
+/**
+* Build the persisted row from a credential state: typed payload columns first
+* (so an envelope field wins a name clash), then the fixed envelope fields and
+* the resolved `token` + `expiresAt`. Shared by `persist` and `update`, which
+* differ only in the `expiresAt` they resolve.
+*/
+function stateToRow(state, token, expiresAt) {
+	return {
+		...credentialPayloadOf(state),
+		token,
+		userId: state.userId,
+		issuedAt: state.issuedAt,
+		expiresAt,
+		kind: state.kind,
+		metadata: state.metadata,
+		parentCredentialId: state.parentCredentialId,
+		rotatedAt: state.rotatedAt,
+		sessionId: state.sessionId,
+		lastSeenAt: state.lastSeenAt
+	};
+}
 function rowToState(row) {
 	const state = {
+		...credentialPayloadOf(row),
 		userId: row.userId,
 		issuedAt: row.issuedAt,
 		expiresAt: row.expiresAt
 	};
-	if (row.claims !== void 0) state.claims = row.claims;
 	if (row.metadata !== void 0) state.metadata = row.metadata;
 	if (row.kind === "access" || row.kind === "refresh") state.kind = row.kind;
 	if (row.parentCredentialId !== void 0) state.parentCredentialId = row.parentCredentialId;
 	if (row.rotatedAt !== void 0) state.rotatedAt = row.rotatedAt;
+	if (row.sessionId !== void 0) state.sessionId = row.sessionId;
+	if (row.lastSeenAt !== void 0) state.lastSeenAt = row.lastSeenAt;
 	return state;
 }
 //#endregion