@korajs/auth 1.0.0-beta.12 → 1.0.0-beta.13

package/dist/index.d.cts

@@ -1,10 +1,10 @@
-import { A as AuthClientConfig, a as AuthTokenStorage, b as AuthKeyValueStorage, c as AuthDeviceIdentityProvider, D as DeviceKeyStore, d as AuthClient, e as AuthState } from './create-org-session-RsDj9cl4.cjs';
-export { f as AuthDeviceIdentity, g as AuthDeviceIdentityError, h as AuthError, i as AuthSession, j as AuthSessionSnapshot, k as AuthTokenStorageOptions, l as AuthUser, C as ClientInvitation, m as ClientMembership, n as ClientOrganization, o as DeviceKeyStoreError, I as InMemoryDeviceKeyStore, p as IndexedDBDeviceKeyStore, L as LinkedOAuthAccount, O as OAuthAuthorizationOptions, q as OAuthAuthorizationResult, r as OAuthCallbackParams, s as OrgClient, t as OrgClientConfig, u as OrgClientError, v as OrgSession, w as OrgSnapshot, P as PersistentDeviceIdentityOptions, x as checkOrgPermission, y as createAuthSession, z as createAuthTokenStorage, B as createDeviceKeyStore, E as createMemoryAuthTokenStorage, F as createOrgSession, G as createPersistentDeviceIdentity, H as createWebStorageAuthTokenStorage } from './create-org-session-RsDj9cl4.cjs';
+import { A as AuthClientConfig, a as AuthTokenStorage, b as AuthKeyValueStorage, c as AuthDeviceIdentityProvider, D as DeviceKeyStore, d as AuthClient, e as AuthState, f as AuthClientSession } from './create-org-session-ChFdulEM.cjs';
+export { g as AuthDeviceIdentity, h as AuthDeviceIdentityError, i as AuthError, j as AuthSession, k as AuthSessionSnapshot, l as AuthSessionStatus, m as AuthTokenStorageOptions, n as AuthUser, C as ClientInvitation, o as ClientMembership, p as ClientOrganization, q as DeviceKeyStoreError, I as InMemoryDeviceKeyStore, r as IndexedDBDeviceKeyStore, L as LinkedOAuthAccount, M as MfaRequiredError, O as OAuthAuthorizationOptions, s as OAuthAuthorizationResult, t as OAuthCallbackParams, u as OrgClient, v as OrgClientConfig, w as OrgClientError, x as OrgSession, y as OrgSnapshot, P as PersistentDeviceIdentityOptions, z as checkOrgPermission, B as createAuthSession, E as createAuthTokenStorage, F as createDeviceKeyStore, G as createMemoryAuthTokenStorage, H as createOrgSession, J as createPersistentDeviceIdentity, K as createWebStorageAuthTokenStorage } from './create-org-session-ChFdulEM.cjs';
 import { SchemaDefinition, KoraError } from '@korajs/core';
 import { AuthSyncBinding } from '@korajs/core/bindings';
 export { AuthSyncBinding } from '@korajs/core/bindings';
-import { A as AuthTokens } from './operation-encryptor-DRmKNWpF.cjs';
-export { a as AuthConfig, b as AuthEvent, c as AuthEventType, d as AuthStatus, C as CryptoUnavailableError, D as DeviceIdentityError, O as OperationEncryptionError, e as OperationEncryptor, f as OperationEncryptorConfig, T as TokenPayload, g as TokenType, h as computePublicKeyThumbprint, i as exportPublicKeyJwk, j as fromBase64Url, k as generateDeviceKeyPair, l as isEncryptedField, s as signChallenge, t as toBase64Url, v as verifyChallenge } from './operation-encryptor-DRmKNWpF.cjs';
+import { A as AuthTokens } from './operation-encryptor-DDdlb9bm.cjs';
+export { a as AuthConfig, b as AuthEvent, c as AuthEventType, d as AuthStatus, C as CryptoUnavailableError, D as DeviceIdentityError, O as OperationEncryptionError, e as OperationEncryptor, f as OperationEncryptorConfig, T as TokenPayload, g as TokenType, h as computePublicKeyThumbprint, i as exportPublicKeyJwk, j as fromBase64Url, k as generateDeviceKeyPair, l as isEncryptedField, s as signChallenge, t as toBase64Url, v as verifyChallenge } from './operation-encryptor-DDdlb9bm.cjs';
 
 interface CreateKoraAuthOptions extends Omit<AuthClientConfig, 'storage' | 'deviceIdentity'> {
     /**
@@ -43,8 +43,19 @@ declare function createKoraAuth(options: CreateKoraAuthOptions): AuthClient;
  */
 interface AuthSyncClient {
     getAccessToken(): Promise<string | null>;
+    /**
+     * Force a refresh even if the cached token looks valid locally. Called after
+     * the sync server ends a session with `AUTH_EXPIRED` / `AUTH_REVOKED`.
+     */
+    refreshAccessToken?(): Promise<string | null>;
     readonly state?: AuthState;
     onAuthChange?(callback: (state: AuthState) => void): () => void;
+    /** Stored session freshness (authenticated-offline support). */
+    readonly session?: AuthClientSession | null;
+    /** Unverified claims of the stored credentials, available offline. */
+    getStoredClaims?(): Promise<Record<string, unknown> | null>;
+    /** Notifies when session freshness changes (fresh, offline, locked). */
+    onSessionChange?(callback: (session: AuthClientSession | null) => void): () => void;
 }
 /**
  * Sync binding returned by {@link createKoraAuthSync}.
@@ -60,8 +71,9 @@ interface CreateKoraAuthSyncOptions {
     /** Kora auth client from `createKoraAuth()`. */
     authClient: AuthSyncClient;
     /**
-     * Application schema. When provided, scope maps are built automatically
-     * from JWT claims and schema scope declarations.
+     * Application schema. When provided, a client-side scope hint is built from
+     * token claims and schema scope declarations. The server only uses it to
+     * NARROW its own grant; it never authorizes anything.
      */
     schema?: SchemaDefinition;
     /**
@@ -75,8 +87,14 @@ interface CreateKoraAuthSyncOptions {
 /**
  * Creates a sync auth binding for `createApp({ sync: { authClient: binding } })`.
  *
- * Wires token refresh, automatic scope maps from JWT claims, and device-bound
- * sync node ids (`dev` claim) separate from the user id (`sub`).
+ * Wires token refresh, a client-side scope hint, and device-bound sync node ids
+ * (`dev` claim) separate from the user id (`sub`).
+ *
+ * Offline-first: identity (user id, device id) comes from the stored session,
+ * not from token freshness. While the auth server is unreachable the binding
+ * keeps reporting the signed-in user (authenticated-offline, `token: null`), so
+ * the user's own local database opens and the app stays usable; only the sync
+ * transport waits for a fresh token.
  *
  * @example
  * ```typescript
@@ -732,4 +750,4 @@ declare class AutoLockManager {
     private _clearTimer;
 }
 
-export { AuthClient, AuthClientConfig, AuthDeviceIdentityProvider, AuthKeyValueStorage, AuthState, type AuthSyncClient, AuthTokenStorage, AuthTokens, type AutoLockConfig, AutoLockManager, type CreateKoraAuthOptions, type CreateKoraAuthSyncOptions, DeviceKeyStore, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, KeyDerivationError, type KoraAuthSyncBinding, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createKoraAuth, createKoraAuthSync, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };
+export { AuthClient, AuthClientConfig, AuthClientSession, AuthDeviceIdentityProvider, AuthKeyValueStorage, AuthState, type AuthSyncClient, AuthTokenStorage, AuthTokens, type AutoLockConfig, AutoLockManager, type CreateKoraAuthOptions, type CreateKoraAuthSyncOptions, DeviceKeyStore, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, KeyDerivationError, type KoraAuthSyncBinding, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createKoraAuth, createKoraAuthSync, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { A as AuthClientConfig, a as AuthTokenStorage, b as AuthKeyValueStorage, c as AuthDeviceIdentityProvider, D as DeviceKeyStore, d as AuthClient, e as AuthState } from './create-org-session-RsDj9cl4.js';
-export { f as AuthDeviceIdentity, g as AuthDeviceIdentityError, h as AuthError, i as AuthSession, j as AuthSessionSnapshot, k as AuthTokenStorageOptions, l as AuthUser, C as ClientInvitation, m as ClientMembership, n as ClientOrganization, o as DeviceKeyStoreError, I as InMemoryDeviceKeyStore, p as IndexedDBDeviceKeyStore, L as LinkedOAuthAccount, O as OAuthAuthorizationOptions, q as OAuthAuthorizationResult, r as OAuthCallbackParams, s as OrgClient, t as OrgClientConfig, u as OrgClientError, v as OrgSession, w as OrgSnapshot, P as PersistentDeviceIdentityOptions, x as checkOrgPermission, y as createAuthSession, z as createAuthTokenStorage, B as createDeviceKeyStore, E as createMemoryAuthTokenStorage, F as createOrgSession, G as createPersistentDeviceIdentity, H as createWebStorageAuthTokenStorage } from './create-org-session-RsDj9cl4.js';
+import { A as AuthClientConfig, a as AuthTokenStorage, b as AuthKeyValueStorage, c as AuthDeviceIdentityProvider, D as DeviceKeyStore, d as AuthClient, e as AuthState, f as AuthClientSession } from './create-org-session-ChFdulEM.js';
+export { g as AuthDeviceIdentity, h as AuthDeviceIdentityError, i as AuthError, j as AuthSession, k as AuthSessionSnapshot, l as AuthSessionStatus, m as AuthTokenStorageOptions, n as AuthUser, C as ClientInvitation, o as ClientMembership, p as ClientOrganization, q as DeviceKeyStoreError, I as InMemoryDeviceKeyStore, r as IndexedDBDeviceKeyStore, L as LinkedOAuthAccount, M as MfaRequiredError, O as OAuthAuthorizationOptions, s as OAuthAuthorizationResult, t as OAuthCallbackParams, u as OrgClient, v as OrgClientConfig, w as OrgClientError, x as OrgSession, y as OrgSnapshot, P as PersistentDeviceIdentityOptions, z as checkOrgPermission, B as createAuthSession, E as createAuthTokenStorage, F as createDeviceKeyStore, G as createMemoryAuthTokenStorage, H as createOrgSession, J as createPersistentDeviceIdentity, K as createWebStorageAuthTokenStorage } from './create-org-session-ChFdulEM.js';
 import { SchemaDefinition, KoraError } from '@korajs/core';
 import { AuthSyncBinding } from '@korajs/core/bindings';
 export { AuthSyncBinding } from '@korajs/core/bindings';
-import { A as AuthTokens } from './operation-encryptor-DRmKNWpF.js';
-export { a as AuthConfig, b as AuthEvent, c as AuthEventType, d as AuthStatus, C as CryptoUnavailableError, D as DeviceIdentityError, O as OperationEncryptionError, e as OperationEncryptor, f as OperationEncryptorConfig, T as TokenPayload, g as TokenType, h as computePublicKeyThumbprint, i as exportPublicKeyJwk, j as fromBase64Url, k as generateDeviceKeyPair, l as isEncryptedField, s as signChallenge, t as toBase64Url, v as verifyChallenge } from './operation-encryptor-DRmKNWpF.js';
+import { A as AuthTokens } from './operation-encryptor-DDdlb9bm.js';
+export { a as AuthConfig, b as AuthEvent, c as AuthEventType, d as AuthStatus, C as CryptoUnavailableError, D as DeviceIdentityError, O as OperationEncryptionError, e as OperationEncryptor, f as OperationEncryptorConfig, T as TokenPayload, g as TokenType, h as computePublicKeyThumbprint, i as exportPublicKeyJwk, j as fromBase64Url, k as generateDeviceKeyPair, l as isEncryptedField, s as signChallenge, t as toBase64Url, v as verifyChallenge } from './operation-encryptor-DDdlb9bm.js';
 
 interface CreateKoraAuthOptions extends Omit<AuthClientConfig, 'storage' | 'deviceIdentity'> {
     /**
@@ -43,8 +43,19 @@ declare function createKoraAuth(options: CreateKoraAuthOptions): AuthClient;
  */
 interface AuthSyncClient {
     getAccessToken(): Promise<string | null>;
+    /**
+     * Force a refresh even if the cached token looks valid locally. Called after
+     * the sync server ends a session with `AUTH_EXPIRED` / `AUTH_REVOKED`.
+     */
+    refreshAccessToken?(): Promise<string | null>;
     readonly state?: AuthState;
     onAuthChange?(callback: (state: AuthState) => void): () => void;
+    /** Stored session freshness (authenticated-offline support). */
+    readonly session?: AuthClientSession | null;
+    /** Unverified claims of the stored credentials, available offline. */
+    getStoredClaims?(): Promise<Record<string, unknown> | null>;
+    /** Notifies when session freshness changes (fresh, offline, locked). */
+    onSessionChange?(callback: (session: AuthClientSession | null) => void): () => void;
 }
 /**
  * Sync binding returned by {@link createKoraAuthSync}.
@@ -60,8 +71,9 @@ interface CreateKoraAuthSyncOptions {
     /** Kora auth client from `createKoraAuth()`. */
     authClient: AuthSyncClient;
     /**
-     * Application schema. When provided, scope maps are built automatically
-     * from JWT claims and schema scope declarations.
+     * Application schema. When provided, a client-side scope hint is built from
+     * token claims and schema scope declarations. The server only uses it to
+     * NARROW its own grant; it never authorizes anything.
      */
     schema?: SchemaDefinition;
     /**
@@ -75,8 +87,14 @@ interface CreateKoraAuthSyncOptions {
 /**
  * Creates a sync auth binding for `createApp({ sync: { authClient: binding } })`.
  *
- * Wires token refresh, automatic scope maps from JWT claims, and device-bound
- * sync node ids (`dev` claim) separate from the user id (`sub`).
+ * Wires token refresh, a client-side scope hint, and device-bound sync node ids
+ * (`dev` claim) separate from the user id (`sub`).
+ *
+ * Offline-first: identity (user id, device id) comes from the stored session,
+ * not from token freshness. While the auth server is unreachable the binding
+ * keeps reporting the signed-in user (authenticated-offline, `token: null`), so
+ * the user's own local database opens and the app stays usable; only the sync
+ * transport waits for a fresh token.
  *
  * @example
  * ```typescript
@@ -732,4 +750,4 @@ declare class AutoLockManager {
     private _clearTimer;
 }
 
-export { AuthClient, AuthClientConfig, AuthDeviceIdentityProvider, AuthKeyValueStorage, AuthState, type AuthSyncClient, AuthTokenStorage, AuthTokens, type AutoLockConfig, AutoLockManager, type CreateKoraAuthOptions, type CreateKoraAuthSyncOptions, DeviceKeyStore, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, KeyDerivationError, type KoraAuthSyncBinding, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createKoraAuth, createKoraAuthSync, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };
+export { AuthClient, AuthClientConfig, AuthClientSession, AuthDeviceIdentityProvider, AuthKeyValueStorage, AuthState, type AuthSyncClient, AuthTokenStorage, AuthTokens, type AutoLockConfig, AutoLockManager, type CreateKoraAuthOptions, type CreateKoraAuthSyncOptions, DeviceKeyStore, EncryptedTokenStore, type EncryptedTokenStoreConfig, EncryptedTokenStoreError, EncryptionError, KeyDerivationError, type KoraAuthSyncBinding, type PasskeyAuthenticationResponse, PasskeyError, type PasskeyRegistrationResponse, PasskeyUnsupportedError, TokenStore, authenticateWithPasskey, createKoraAuth, createKoraAuthSync, createPasskeyCredential, decryptData, deriveEncryptionKey, encryptData, exportKey, generateEncryptionKey, generateSalt, importKey, isPasskeySupported, isPlatformAuthenticatorAvailable };