@kubun/credential-types 0.17.0 → 0.17.2

package/lib/index.d.ts

@@ -1,3 +1,9 @@
+export type ProviderAccount = {
+    /** OpenID issuer, e.g. `https://accounts.google.com`. */
+    iss: string;
+    /** Stable, opaque provider subject id. Never projected to the graph. */
+    sub: string;
+};
 export type Credential = {
     accessToken: string;
     refreshToken?: string;
@@ -5,6 +11,12 @@ export type Credential = {
     scopes: Array<string>;
     accountLabel?: string;
     metadata?: Record<string, unknown>;
+    /**
+     * Verified stable provider-account identity captured at OAuth completion.
+     * Lives only in the encrypted credential body; the graph sees only a derived
+     * non-reversible key. Preserved verbatim across token refresh.
+     */
+    providerAccount?: ProviderAccount;
 };
 export type CredentialProvider = {
     get(providerName: string, ownerDID: string): Promise<Credential | null>;
@@ -28,3 +40,29 @@ export type CredentialProvider = {
     }): Promise<void>;
     delete(providerName: string, ownerDID: string): Promise<void>;
 };
+/**
+ * Opt-in capability: point `(providerName, ownerDID)` at an entry the
+ * provider already holds, without minting anything. A `CredentialProvider`
+ * that also implements this can bind an alias to an entry created out of
+ * band (e.g. a device-to-device credential handoff).
+ */
+export type AliasBindingCredentialProvider = {
+    bindAlias(providerName: string, ownerDID: string, entryID: string): Promise<void>;
+};
+/**
+ * Opt-in capability: read and write a credential together with the entryID
+ * it resolves to, so a caller can target that entry directly on a
+ * subsequent write without re-resolving the alias.
+ */
+export type EntryPairedCredentialProvider = {
+    getCredentialRef(providerName: string, ownerDID: string): Promise<{
+        credential: Credential;
+        entryID: string;
+    } | null>;
+    setCredentialForEntry(params: {
+        providerName: string;
+        ownerDID: string;
+        entryID: string;
+        credential: Credential;
+    }): Promise<'updated' | 'absent'>;
+};

package/lib/index.js

@@ -2,4 +2,8 @@
 // that stores/refreshes it. Kept in this leaf package so both the low-level
 // `@kubun/connector` (which consumes the port) and `@kubun/credential` (which
 // implements it) can depend on the types without depending on each other.
-export { };
+/**
+ * Opt-in capability: read and write a credential together with the entryID
+ * it resolves to, so a caller can target that entry directly on a
+ * subsequent write without re-resolving the alias.
+ */ export { };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/credential-types",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,