create-bcp-app 0.2.4 → 0.2.5

package/README.md

@@ -92,10 +92,10 @@ Example:
   "schemaVersion": 1,
   "framework": "bcp",
   "projectName": "my-app",
-  "frameworkPackage": "npm:@chidchanun/bcp@0.2.4",
+  "frameworkPackage": "npm:@chidchanun/bcp@0.2.5",
   "createdWith": {
     "package": "create-bcp-app",
-    "version": "0.2.4"
+    "version": "0.2.5"
   },
   "packageManager": "npm",
   "presets": {
@@ -277,6 +277,32 @@ Set this to a cryptographically random secret of at least 32 bytes before real a
 
 The generated `authenticateCredentials(email, password)` returns `null` until the application connects it to its own user store and password-hash verification.
 
+Generated auth stays in backward-compatible stateless JWT-cookie mode by default.
+
+BCP `0.2.5+` can opt into revocable server-side auth state without changing the generated auth route structure:
+
+```ts
+import {
+    createAuth,
+    createMemoryAuthSessionStore,
+} from "bcp/auth";
+
+const sessionStore =
+    createMemoryAuthSessionStore();
+
+const frameworkAuth =
+    createAuth<AuthenticatedUser>({
+        store:
+            sessionStore,
+        idleTimeout:
+            60 * 30,
+    });
+```
+
+The memory store is intended for development/tests. Multi-process production deployments should implement `AuthSessionStore` using shared durable storage.
+
+Authentication Platform v2 also provides `logoutAll()`, session/user revocation APIs and `createGuestGuard()` for login/register pages.
+
 ## Application Packaging — 0.2.4+
 
 Generated projects include:
@@ -368,5 +394,5 @@ npx create-bcp-app my-app --yes
 The `--bcp` option is mainly for prerelease/local package verification:
 
 ```bash
-npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.4.tgz
+npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.5.tgz
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bcp-app",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Create a new BCP Framework application.",
   "type": "module",
   "license": "MIT",

package/template/README.md

@@ -39,6 +39,34 @@ It records non-secret scaffold choices such as Tailwind, database, authenticatio
 
 Commit this file with the project. Do not put passwords, access keys, session secrets or tokens in it.
 
+## Authentication — BCP 0.2.5+
+
+Projects created with the `JWT Cookie` preset remain stateless by default and use the generated `lib/auth.ts` helpers.
+
+BCP Authentication Platform v2 can opt into revocable server-side session state:
+
+```ts
+import {
+    createAuth,
+    createMemoryAuthSessionStore,
+} from "bcp/auth";
+
+const sessionStore =
+    createMemoryAuthSessionStore();
+
+export const appAuth =
+    createAuth({
+        store:
+            sessionStore,
+        idleTimeout:
+            60 * 30,
+    });
+```
+
+The memory store is intended for local development/tests. Use a shared durable `AuthSessionStore` implementation for multi-process or multi-container production deployments.
+
+Authentication Platform v2 also provides session revocation, `logoutAll()`, rotation with revocation, and `createGuestGuard()` for guest-only pages such as login/register routes.
+
 ## Generate framework files
 
 BCP can generate common project files: