@oxyhq/core 3.0.0 → 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -169,7 +169,9 @@ function OxyServicesApplicationsMixin(Base) {
169
169
  }
170
170
  /**
171
171
  * Rotate a credential's secret. The new plaintext `secret` is returned
172
- * exactly ONCE.
172
+ * exactly ONCE, along with audit fields: `rotatedFrom` (the previous
173
+ * credentialId) and `graceExpiresAt` (ISO string for the grace window during
174
+ * which the old credential is still honoured).
173
175
  * @param applicationId - The application's Mongo `_id`.
174
176
  * @param credentialId - The credential's Mongo `_id`.
175
177
  */
@@ -475,6 +475,9 @@ function OxyServicesUtilityMixin(Base) {
475
475
  appId,
476
476
  appName: decoded.appName || 'unknown',
477
477
  scopes: Array.isArray(decoded.scopes) ? decoded.scopes : [],
478
+ ...(typeof decoded.credentialId === 'string' && decoded.credentialId.length > 0
479
+ ? { credentialId: decoded.credentialId }
480
+ : {}),
478
481
  };
479
482
  if (debug) {
480
483
  loggerUtils_1.logger.debug(`[oxy.auth] Service token OK app=${decoded.appName} delegateUser=${oxyUserId || '(none)'}`, {