@oxyhq/core 3.0.0 → 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -166,7 +166,9 @@ export function OxyServicesApplicationsMixin(Base) {
166
166
  }
167
167
  /**
168
168
  * Rotate a credential's secret. The new plaintext `secret` is returned
169
- * exactly ONCE.
169
+ * exactly ONCE, along with audit fields: `rotatedFrom` (the previous
170
+ * credentialId) and `graceExpiresAt` (ISO string for the grace window during
171
+ * which the old credential is still honoured).
170
172
  * @param applicationId - The application's Mongo `_id`.
171
173
  * @param credentialId - The credential's Mongo `_id`.
172
174
  */
@@ -472,6 +472,9 @@ export function OxyServicesUtilityMixin(Base) {
472
472
  appId,
473
473
  appName: decoded.appName || 'unknown',
474
474
  scopes: Array.isArray(decoded.scopes) ? decoded.scopes : [],
475
+ ...(typeof decoded.credentialId === 'string' && decoded.credentialId.length > 0
476
+ ? { credentialId: decoded.credentialId }
477
+ : {}),
475
478
  };
476
479
  if (debug) {
477
480
  logger.debug(`[oxy.auth] Service token OK app=${decoded.appName} delegateUser=${oxyUserId || '(none)'}`, {