@maravilla-labs/types 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @maravilla-labs/types
 
+## 0.10.0
+
+### Minor Changes
+
+- 3deff26: Add the **Connected Apps** auth surface (`platform.auth.*`) so apps can build a
+  "Connected apps / agents" settings page (the GitHub "Authorized OAuth Apps"
+  equivalent) over the runtime's OAuth/MCP grants.
+
+  New `AuthService` methods, all scoped to the **current authenticated user**
+  (resolved server-side; they take no `user_id`):
+  - `listConnectedClients()` / `revokeClient(clientId)` — authorized OAuth agents
+    (interactive `oc_…` clients + CIMD URL clients); revoke drops consent + all
+    refresh sessions.
+  - `listApiKeys()` / `mintApiKey({ name, scopes, expiresInDays? })` /
+    `revokeApiKey(id)` — headless `mk_…` API keys (`mintApiKey` returns the
+    plaintext key once).
+  - `listSessions()` / `revokeSession(id)` — the user's own browser-login sessions
+    ("where you're signed in").
+
+  New exported shapes: `ConnectedClient`, `ApiKeyInfo`, `LoginSession`. Field
+  names are snake_case to match the runtime op JSON exactly (`client_id`,
+  `active_sessions`, `granted_at`, `last_active_at`, `user_agent`, `last_used_at`,
+  `expires_at`, `created_at`).
+
+  `@maravilla-labs/platform`'s `RemoteAuthService` gains the matching dev-server
+  REST calls, so the API works identically under `maravilla dev` and in
+  production (both terminate at the same `TenantScopedAuthService` facade).
+
+## 0.9.1
+
+### Patch Changes
+
+- f5a503e: Fix `npm run check` error in consumers: re-export the default `Platform` type
+  with `export type` (TS1205 under `verbatimModuleSyntax`). Was `export { Platform
+as default }`; `Platform` is a type, so a strict consumer's type-check failed
+  inside `node_modules/@maravilla-labs/types`.
+
 ## 0.9.0
 
 ### Minor Changes

package/index.d.ts

@@ -898,6 +898,56 @@ export interface CanCheck {
     resourceId: string;
     node?: Record<string, unknown> | null;
 }
+/**
+ * One authorized OAuth agent (an interactive `oc_…` client or a CIMD-URL
+ * client) the current user has granted access to. Returned by
+ * {@link AuthService.listConnectedClients}.
+ */
+export interface ConnectedClient {
+    /** `oc_…` (DCR) id or the CIMD URL that *is* the client identity. */
+    client_id: string;
+    /** Display name (client metadata, CIMD doc, URL host, or raw id fallback). */
+    name: string;
+    /** `'oauth'` for registered `oc_…` clients, `'cimd'` for URL clients. */
+    kind: 'oauth' | 'cimd';
+    /** Granted scopes (from `oauth_consents`). */
+    scopes: string[];
+    /** Count of live refresh sessions for this `(user, client)`. */
+    active_sessions: number;
+    /** When consent was granted (unix seconds). */
+    granted_at: number;
+    /** Newest refresh-issue time across live sessions, or `null` when none. */
+    last_active_at: number | null;
+}
+/**
+ * Headless API-key metadata (never the plaintext or hash). Returned by
+ * {@link AuthService.listApiKeys}.
+ */
+export interface ApiKeyInfo {
+    id: string;
+    /** Optional human label; `null` when the key was minted without a name. */
+    name: string | null;
+    scopes: string[];
+    /** v1 fidelity is issue-time, not literal last-call; `null` when never set. */
+    last_used_at: number | null;
+    /** Expiry (unix seconds), or `null` for a non-expiring key. */
+    expires_at: number | null;
+    created_at: number;
+    revoked: boolean;
+}
+/**
+ * One browser-login session ("where you're signed in"). Returned by
+ * {@link AuthService.listSessions}.
+ */
+export interface LoginSession {
+    id: string;
+    user_agent: string | null;
+    ip: string | null;
+    created_at: number;
+    expires_at: number;
+    /** `true` for the session backing the current request. */
+    current: boolean;
+}
 /**
  * Auth service for end-user authentication and user management.
  * Implemented by the in-runtime native bridge and by the dev-server
@@ -1052,6 +1102,27 @@ export interface AuthService {
     listRelations(options: ListRelationsOptions): Promise<Relation[]>;
     getProfile(userId: string): Promise<Record<string, any>>;
     setProfile(userId: string, data: Record<string, any>): Promise<void>;
+    /** List the OAuth agents (interactive + CIMD) authorized by the current user. */
+    listConnectedClients(): Promise<ConnectedClient[]>;
+    /** Revoke a client grant: drops consent + all refresh sessions for that client. */
+    revokeClient(clientId: string): Promise<void>;
+    /** List the current user's headless API keys (metadata only). */
+    listApiKeys(): Promise<ApiKeyInfo[]>;
+    /** Mint a headless API key. The plaintext `key` is returned **once**. */
+    mintApiKey(opts: {
+        name: string;
+        scopes: string[];
+        expiresInDays?: number;
+    }): Promise<{
+        id: string;
+        key: string;
+    }>;
+    /** Revoke one of the current user's API keys. */
+    revokeApiKey(id: string): Promise<void>;
+    /** List the current user's own browser-login sessions ("where you're signed in"). */
+    listSessions(): Promise<LoginSession[]>;
+    /** Revoke one of the current user's login sessions (no-op if not owned). */
+    revokeSession(id: string): Promise<void>;
     getAuthConfig(): Promise<AuthConfig>;
     setAuthConfig(config: AuthConfig): Promise<void>;
     readonly stewardship: AuthStewardshipApi;
@@ -1188,4 +1259,4 @@ export interface Platform {
  * /// <reference types="@maravilla-labs/types/global" />
  * ```
  */
-export { Platform as default };
+export type { Platform as default };

package/index.ts

@@ -1039,6 +1039,66 @@ export interface CanCheck {
   node?: Record<string, unknown> | null;
 }
 
+// ── Connected apps (profile-page surface) ──
+//
+// Field names match the runtime op JSON verbatim. The underlying Rust
+// structs (`crates/platform/src/auth/connected.rs`, `oauth/apikeys.rs`)
+// derive `serde::Serialize` with no `rename_all`, so every key is
+// **snake_case** — do not camelCase these.
+
+/**
+ * One authorized OAuth agent (an interactive `oc_…` client or a CIMD-URL
+ * client) the current user has granted access to. Returned by
+ * {@link AuthService.listConnectedClients}.
+ */
+export interface ConnectedClient {
+  /** `oc_…` (DCR) id or the CIMD URL that *is* the client identity. */
+  client_id: string;
+  /** Display name (client metadata, CIMD doc, URL host, or raw id fallback). */
+  name: string;
+  /** `'oauth'` for registered `oc_…` clients, `'cimd'` for URL clients. */
+  kind: 'oauth' | 'cimd';
+  /** Granted scopes (from `oauth_consents`). */
+  scopes: string[];
+  /** Count of live refresh sessions for this `(user, client)`. */
+  active_sessions: number;
+  /** When consent was granted (unix seconds). */
+  granted_at: number;
+  /** Newest refresh-issue time across live sessions, or `null` when none. */
+  last_active_at: number | null;
+}
+
+/**
+ * Headless API-key metadata (never the plaintext or hash). Returned by
+ * {@link AuthService.listApiKeys}.
+ */
+export interface ApiKeyInfo {
+  id: string;
+  /** Optional human label; `null` when the key was minted without a name. */
+  name: string | null;
+  scopes: string[];
+  /** v1 fidelity is issue-time, not literal last-call; `null` when never set. */
+  last_used_at: number | null;
+  /** Expiry (unix seconds), or `null` for a non-expiring key. */
+  expires_at: number | null;
+  created_at: number;
+  revoked: boolean;
+}
+
+/**
+ * One browser-login session ("where you're signed in"). Returned by
+ * {@link AuthService.listSessions}.
+ */
+export interface LoginSession {
+  id: string;
+  user_agent: string | null;
+  ip: string | null;
+  created_at: number;
+  expires_at: number;
+  /** `true` for the session backing the current request. */
+  current: boolean;
+}
+
 /**
  * Auth service for end-user authentication and user management.
  * Implemented by the in-runtime native bridge and by the dev-server
@@ -1213,6 +1273,30 @@ export interface AuthService {
   getProfile(userId: string): Promise<Record<string, any>>;
   setProfile(userId: string, data: Record<string, any>): Promise<void>;
 
+  // ── Connected apps (current-user-scoped) ──
+  //
+  // These operate ONLY on the current authenticated user, resolved
+  // server-side from the bound request identity — they take no userId and
+  // cannot enumerate or revoke another user's data. Anonymous requests
+  // reject with `unauthenticated`.
+
+  /** List the OAuth agents (interactive + CIMD) authorized by the current user. */
+  listConnectedClients(): Promise<ConnectedClient[]>;
+  /** Revoke a client grant: drops consent + all refresh sessions for that client. */
+  revokeClient(clientId: string): Promise<void>;
+
+  /** List the current user's headless API keys (metadata only). */
+  listApiKeys(): Promise<ApiKeyInfo[]>;
+  /** Mint a headless API key. The plaintext `key` is returned **once**. */
+  mintApiKey(opts: { name: string; scopes: string[]; expiresInDays?: number }): Promise<{ id: string; key: string }>;
+  /** Revoke one of the current user's API keys. */
+  revokeApiKey(id: string): Promise<void>;
+
+  /** List the current user's own browser-login sessions ("where you're signed in"). */
+  listSessions(): Promise<LoginSession[]>;
+  /** Revoke one of the current user's login sessions (no-op if not owned). */
+  revokeSession(id: string): Promise<void>;
+
   // ── Auth config ──
 
   getAuthConfig(): Promise<AuthConfig>;
@@ -1381,4 +1465,4 @@ export interface Platform {
  * ```
  */
 
-export { Platform as default };
+export type { Platform as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maravilla-labs/types",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "TypeScript definitions for Maravilla Runtime platform APIs",
   "main": "index.ts",
   "types": "index.ts",