okengine 0.7.0 → 0.9.0

package/site/content/docs/reference/environment-variables.mdx

@@ -13,14 +13,15 @@ OKE reads environment variables at boot for connection detail and secrets — ne
 
 ## SQL store
 
-| Variable            | Used for                                             | Default when unset              |
-| ------------------- | ---------------------------------------------------- | ------------------------------- |
-| `DATABASE_URL`      | Postgres connection (`postgres` driver, drizzle-kit) | `postgres://localhost:5432/oke` |
-| `OKE_STORE_SQL_URL` | Explicit SQL URL override                            | —                               |
-| `OKE_SQLITE_URL`    | SQLite file path (`sqlite` driver)                   | `.oke/app.sqlite`               |
-| `OKE_LIBSQL_URL`    | libSQL URL or file path (`libsql` driver)            | `.oke/app.libsql`               |
-| `OKE_PGLITE_URL`    | PGlite data dir or `memory://` (`pglite` driver)     | `.oke/pgdata`                   |
-| `OKE_SQL_DRIVER`    | Force the sql driver id at boot                      | config map                      |
+| Variable            | Used for                                                                                                                                        | Default when unset              |
+| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
+| `DATABASE_URL`      | Postgres connection (`postgres` store / clock / journal drivers, drizzle-kit). When PgDog is in the stack, this points at the pooler (`:6432`). | `postgres://localhost:5432/oke` |
+| `OKE_STORE_SQL_URL` | Direct SQL URL (Postgres host, even when PgDog fronts the app)                                                                                  | —                               |
+| `OKE_PGDOG_URL`     | PgDog pooler URL (same value as `DATABASE_URL` when both are present)                                                                           | —                               |
+| `OKE_SQLITE_URL`    | SQLite file path (`sqlite` driver)                                                                                                              | `.oke/app.sqlite`               |
+| `OKE_LIBSQL_URL`    | libSQL URL or file path (`libsql` driver)                                                                                                       | `.oke/app.libsql`               |
+| `OKE_PGLITE_URL`    | PGlite data dir or `memory://` (`pglite` driver)                                                                                                | `.oke/pgdata`                   |
+| `OKE_SQL_DRIVER`    | Force the sql driver id at boot                                                                                                                 | config map                      |
 
 ## Index store
 
@@ -74,6 +75,8 @@ Read when `drivers.channel.email` resolves to that driver id.
 | `RESEND_API_KEY`        | `resend` API key                                 |
 | `SNDR_API_KEY`          | `sndr` API key                                   |
 | `SNDR_BASE_URL`         | Optional SNDR API origin (default `api.sndr.sh`) |
+| `TAQNYAT_MAIL_TOKEN`    | `taqnyat-mail` bearer token (Email-enabled)      |
+| `TAQNYAT_CAMPAIGN`      | `taqnyat-mail` campaign name                     |
 
 ## Channel (SMS) — boot binder
 
@@ -94,6 +97,16 @@ Read when `drivers.channel.sms` resolves to that driver id (`console` opens noth
 WhatsApp (`wa-cloud`) and push (`webpush` / `fcm`) are not opened from env at
 boot — pass them on `BootOptions.channel.drivers` with their open options.
 
+## Live test gates (opt-in)
+
+Provider-quota-burning live suites are double-gated: the medium flag **plus** that
+provider's real credentials — credentials alone never send.
+
+| Variable         | Used for                                                  |
+| ---------------- | --------------------------------------------------------- |
+| `OKE_SMS_LIVE`   | `=1` allows live SMS provider tests (e.g. Taqnyat OTP)    |
+| `OKE_EMAIL_LIVE` | `=1` allows live email provider tests (e.g. Taqnyat Mail) |
+
 ## AI providers
 
 | Variable              | Used for                                                                                                                                  | Default when unset                |

package/site/content/docs/reference/plugins.mdx

@@ -243,7 +243,7 @@ Extending an existing **app-owned** table with plugin columns is not supported i
 
 ## Learn more
 
-- [Plugins](/docs/plugins) — [username](/docs/plugins/username) · [anonymous](/docs/plugins/anonymous) · [magic link](/docs/plugins/magic-link) · [email OTP](/docs/plugins/email-otp) · [phone](/docs/plugins/phone-number) · [two-factor](/docs/plugins/two-factor) · [passkey](/docs/plugins/passkey) · [Headers](/docs/plugins/headers) · [CORS](/docs/plugins/cors) · [CSRF](/docs/plugins/csrf) · [Compression](/docs/plugins/compression) · [Maintenance Mode](/docs/plugins/maintenance-mode) · [IP Allowlist](/docs/plugins/ip-allowlist)
+- [Plugins](/docs/plugins) — [username](/docs/plugins/username) · [anonymous](/docs/plugins/anonymous) · [magic link](/docs/plugins/magic-link) · [OTP](/docs/plugins/otp) · [two-factor](/docs/plugins/two-factor) · [passkey](/docs/plugins/passkey) · [Headers](/docs/plugins/headers) · [CORS](/docs/plugins/cors) · [CSRF](/docs/plugins/csrf) · [Compression](/docs/plugins/compression) · [Maintenance Mode](/docs/plugins/maintenance-mode) · [IP Allowlist](/docs/plugins/ip-allowlist)
 - [Flow](/docs/elements/flow) — what plugin flows and hooks plug into
 - [Store](/docs/elements/store) — `field.*` builders and schema sync
 - [Configuration](/docs/reference/configuration) — where plugin config is declared

package/src/auth/auth.test.ts

@@ -231,6 +231,42 @@ describe("hybrid sessions", () => {
       SessionError,
     );
   });
+
+  test("scopes and audience survive on the session row across store instances", async () => {
+    const store = createSessionStore();
+    let now = 2_000_000;
+    const crypto = {
+      secret: "test-secret",
+      now: () => now,
+      audience: "oke-app",
+    };
+    const issued = await issueSessionWithScopes(store, crypto, {
+      id: "user-2",
+      plane: "user",
+      scopes: ["notes:write", "notes:read"],
+    });
+    expect(issued.session.scopes).toEqual(["notes:write", "notes:read"]);
+    expect(issued.session.audience).toBe("oke-app");
+
+    // Simulate process restart: copy rows into a fresh SessionStore (no module Maps).
+    const restored = createSessionStore();
+    for (const [id, row] of store.sessions) {
+      restored.sessions.set(id, { ...row, scopes: [...row.scopes] });
+    }
+    for (const [id, row] of store.refresh) {
+      restored.refresh.set(id, { ...row });
+    }
+
+    now += 1_000;
+    const rotated = await rotateRefresh(restored, crypto, issued.refreshToken);
+    const { verifyAccess } = await import("./sessions.ts");
+    const claims = await verifyAccess(restored, crypto.secret, rotated.accessToken, {
+      now: () => now,
+      audience: "oke-app",
+    });
+    expect(claims.scopes).toEqual(["notes:write", "notes:read"]);
+    expect(claims.aud).toBe("oke-app");
+  });
 });
 
 describe("operator plane", () => {

package/src/auth/bindings.ts

@@ -32,7 +32,7 @@ import {
   type SessionCrypto,
   type SessionStore,
 } from "./sessions.ts";
-import { touchRateLimit, type LoginAttemptBag, createLoginAttemptBag } from "./rate.ts";
+import { type LoginAttemptBag, createLoginAttemptBag } from "./rate.ts";
 
 /** Built-in policy: verified user session (for `/auth/me` and step-up surfaces). */
 export const AUTH_SESSION_GATE: PolicyGateDecl = gate.policy(
@@ -297,17 +297,8 @@ export function createAuthHttpBindings(
       out: SessionTokensOut,
       errors: { AuthFailed, AuthRateLimited },
       do: async (input) => {
-        const key = input.email.trim().toLowerCase();
-        let bag = loginAttempts.get(key);
-        if (!bag) {
-          bag = [];
-          loginAttempts.set(key, bag);
-        }
-        if (touchRateLimit(bag, ctx.now()) === "rate_limited") {
-          return fail("AuthRateLimited", {
-            reason: "rate_limited",
-          });
-        }
+        // Rate limit is Gate KV (`signInRate` on the binding) — shared across
+        // instances when `drivers.store.kv` is redis. No process-local email bag.
         const user = await authenticateUser(identities, input.email, input.password);
         // Enumeration hygiene: identical failure for unknown email / bad password.
         if (!user) return fail("AuthFailed", { reason: "invalid_credentials" });

package/src/auth/identity.ts

@@ -77,6 +77,39 @@ export function normalizeEmail(email: string): string {
   return email.trim().toLowerCase();
 }
 
+/**
+ * Find or create a user row keyed by email (magic-link / OTP sign-in).
+ *
+ * @param store - Identity store
+ * @param email - Normalized email
+ * @param now - Clock
+ */
+export function ensureUserByEmail(
+  store: IdentityStore,
+  email: string,
+  now: number,
+): UserIdentityRow {
+  const existingId = store.byEmail.get(email);
+  if (existingId) {
+    const existing = store.users.get(existingId);
+    if (existing) return existing;
+  }
+  const id = crypto.randomUUID();
+  const user: UserIdentityRow = {
+    id,
+    email,
+    name: email.split("@")[0] || "user",
+    emailVerified: true,
+    status: "active",
+    createdAt: now,
+    updatedAt: now,
+    extra: {},
+  };
+  store.users.set(id, user);
+  store.byEmail.set(email, id);
+  return user;
+}
+
 /**
  * Create a user with a credential account (provider `credential`).
  *

package/src/auth/index.ts

@@ -69,10 +69,14 @@ export {
   createVerificationStore,
   putVerification,
   findActiveVerification,
+  consumeVerification,
+  invalidateVerifications,
+  wipeSealedOtp,
   hashChallenge,
   generateOtp,
   type VerificationStore,
   type VerificationRow,
+  type OtpChannel,
 } from "./verification.ts";
 
 export { constantTimeEqual } from "./constant-time.ts";
@@ -83,6 +87,7 @@ export {
   authenticateUser,
   getUserById,
   normalizeEmail,
+  ensureUserByEmail,
   IdentityError,
   type IdentityStore,
   type UserIdentityRow,

package/src/auth/otp-capability.ts

@@ -0,0 +1,119 @@
+/**
+ * Fail-loud capability checks for the otp() plugin (Tier 1 / Tier 2).
+ */
+
+import type { ChannelDriver, SmsOtpTransport } from "../drivers/channel-types.ts";
+import type { OtpChannel } from "./verification.ts";
+
+/** Config snapshot stored on the otp plugin for boot-time assertion. */
+export interface OtpPluginConfig {
+  readonly method: "otp";
+  readonly tier: 1 | 2;
+  readonly channels?: readonly OtpChannel[];
+}
+
+/**
+ * Whether an SMS transport exposes provider-managed OTP (structural).
+ *
+ * @param t - Candidate transport
+ */
+export function isSmsOtpTransport(t: unknown): t is SmsOtpTransport {
+  if (!t || typeof t !== "object") return false;
+  const o = t as Partial<SmsOtpTransport>;
+  return typeof o.sendOtp === "function" && typeof o.verifyOtp === "function";
+}
+
+/**
+ * Find a bound SMS driver with real sendOtp/verifyOtp, or undefined.
+ *
+ * @param drivers - Bound channel drivers
+ */
+export function findOtpSmsDriver(
+  drivers: readonly ChannelDriver[],
+): { readonly driver: ChannelDriver; readonly otp: SmsOtpTransport } | undefined {
+  for (const d of drivers) {
+    if (isSmsOtpTransport(d.smsTransport)) {
+      return { driver: d, otp: d.smsTransport };
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Whether any bound driver can deliver on `medium`.
+ *
+ * @param drivers - Bound channel drivers
+ * @param medium - OTP channel
+ */
+export function driverCoversMedium(drivers: readonly ChannelDriver[], medium: OtpChannel): boolean {
+  for (const d of drivers) {
+    if (medium === "email" && d.transport) return true;
+    if (medium === "sms" && (d.smsTransport || d.channel?.mediums.includes("sms"))) return true;
+    if (medium === "whatsapp" && (d.whatsappTransport || d.channel?.mediums.includes("whatsapp"))) {
+      return true;
+    }
+    if (d.channel?.mediums.includes(medium) || d.channel?.mediums.includes("any")) return true;
+  }
+  return false;
+}
+
+/**
+ * Assert Tier 1: a Verify-capable SMS driver must be bound.
+ *
+ * @param drivers - Bound channel drivers
+ */
+export function assertOtpTier1Capability(drivers: readonly ChannelDriver[]): void {
+  if (findOtpSmsDriver(drivers)) return;
+  const sms = drivers.filter((d) => d.smsTransport);
+  if (sms.length === 0) {
+    throw new Error(
+      'otp({ tier: 1 }): no SMS driver with sendOtp/verifyOtp bound — set drivers.channel.sms to a Verify-capable driver (e.g. "taqnyat"), or switch to otp({ tier: 2, channels: [...] })',
+    );
+  }
+  const id = sms[0]?.id ?? "unknown";
+  throw new Error(
+    `otp({ tier: 1 }): SMS driver "${id}" does not support provider-managed OTP — bind a Verify-capable driver (e.g. taqnyat), or switch to otp({ tier: 2, channels: [...] })`,
+  );
+}
+
+/**
+ * Assert Tier 2: every declared channel has a deliverable driver.
+ *
+ * @param drivers - Bound channel drivers
+ * @param channels - Declared channel order
+ */
+export function assertOtpTier2Channels(
+  drivers: readonly ChannelDriver[],
+  channels: readonly OtpChannel[],
+): void {
+  for (const ch of channels) {
+    if (!driverCoversMedium(drivers, ch)) {
+      throw new Error(
+        `otp({ tier: 2 }): no channel driver covers "${ch}" — configure drivers.channel.${ch === "email" ? "email" : ch === "sms" ? "sms" : "whatsapp"}`,
+      );
+    }
+  }
+}
+
+/**
+ * Run the matching boot assertion for an otp plugin config snapshot.
+ *
+ * @param config - Plugin configSnapshot
+ * @param drivers - Bound channel drivers
+ */
+export function assertOtpPluginCapability(
+  config: unknown,
+  drivers: readonly ChannelDriver[],
+): void {
+  if (!config || typeof config !== "object") return;
+  const c = config as Partial<OtpPluginConfig>;
+  if (c.method !== "otp") return;
+  if (c.tier === 1) {
+    assertOtpTier1Capability(drivers);
+    return;
+  }
+  if (c.tier === 2) {
+    const channels = c.channels ?? [];
+    assertOtpTier2Channels(drivers, channels);
+  }
+}

package/src/auth/otp-seal.test.ts

@@ -0,0 +1,61 @@
+/**
+ * OTP seal — HKDF domain separation + AES-GCM round-trip.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { deriveOtpSealKey, OTP_SEAL_HKDF_INFO, sealOtp, unsealOtp } from "./otp-seal.ts";
+
+describe("otp-seal", () => {
+  test("info constant is the literal oke-otp-seal-v1", () => {
+    expect(OTP_SEAL_HKDF_INFO).toBe("oke-otp-seal-v1");
+  });
+
+  test("round-trip seal / unseal", async () => {
+    const secret = "test-secret-at-least-16";
+    const otp = "482913";
+    const blob = await sealOtp(secret, otp);
+    expect(blob).not.toContain(otp);
+    expect(await unsealOtp(secret, blob)).toBe(otp);
+  });
+
+  test("secret A cannot unseal secret B", async () => {
+    const blob = await sealOtp("secret-aaaaaaaaaaaa", "123456");
+    await expect(unsealOtp("secret-bbbbbbbbbbbb", blob)).rejects.toThrow();
+  });
+
+  test("deriveOtpSealKey produces an AES-GCM key (not raw secret)", async () => {
+    const key = await deriveOtpSealKey("test-secret-at-least-16");
+    expect(key.type).toBe("secret");
+    expect(key.algorithm).toMatchObject({ name: "AES-GCM" });
+    // Non-extractable — raw secret bytes never leave HKDF as exportable AES material.
+    expect(key.extractable).toBe(false);
+  });
+
+  test("HKDF info bytes pin domain separation (known key length)", async () => {
+    const ikm = new TextEncoder().encode("fixed-secret-for-vector");
+    const baseKey = await crypto.subtle.importKey("raw", ikm, "HKDF", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(0),
+        info: new TextEncoder().encode(OTP_SEAL_HKDF_INFO),
+      },
+      baseKey,
+      256,
+    );
+    expect(new Uint8Array(bits).byteLength).toBe(32);
+    // Different info → different bits
+    const other = await crypto.subtle.deriveBits(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(0),
+        info: new TextEncoder().encode("session-hmac-v1"),
+      },
+      baseKey,
+      256,
+    );
+    expect(Buffer.from(bits).equals(Buffer.from(other))).toBe(false);
+  });
+});

package/src/auth/otp-seal.ts

@@ -0,0 +1,84 @@
+/**
+ * Domain-separated sealed OTP copy for Tier-2 redelivery.
+ *
+ * AES-GCM key is **never** the raw auth secret. It is derived via
+ * HKDF-SHA-256 with info `oke-otp-seal-v1` so session HMAC material stays
+ * cryptographically isolated from seal encryption.
+ */
+
+/** HKDF `info` — versioned; bump when the seal format changes. */
+export const OTP_SEAL_HKDF_INFO = "oke-otp-seal-v1";
+
+const INFO_BYTES = new TextEncoder().encode(OTP_SEAL_HKDF_INFO);
+const EMPTY_SALT = new Uint8Array(0);
+
+/**
+ * Derive the AES-256-GCM key for OTP sealing from the method secret.
+ *
+ * @param secret - Root auth secret (`resolveMethodSecret`)
+ */
+export async function deriveOtpSealKey(secret: string): Promise<CryptoKey> {
+  const ikm = new TextEncoder().encode(secret);
+  const baseKey = await crypto.subtle.importKey("raw", ikm, "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: EMPTY_SALT,
+      info: INFO_BYTES,
+    },
+    baseKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"],
+  );
+}
+
+/**
+ * Seal a plaintext OTP for later redelivery (base64 `IV || ciphertext+tag`).
+ *
+ * @param secret - Root auth secret
+ * @param otp - Raw OTP digits
+ */
+export async function sealOtp(secret: string, otp: string): Promise<string> {
+  const key = await deriveOtpSealKey(secret);
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const cipher = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    new TextEncoder().encode(otp),
+  );
+  const packed = new Uint8Array(iv.length + cipher.byteLength);
+  packed.set(iv, 0);
+  packed.set(new Uint8Array(cipher), iv.length);
+  return Buffer.from(packed).toString("base64");
+}
+
+/**
+ * Unseal a previously sealed OTP. Call only at the deliberate delivery boundary.
+ *
+ * @param secret - Root auth secret
+ * @param blob - Base64 sealed blob from {@link sealOtp}
+ */
+export async function unsealOtp(secret: string, blob: string): Promise<string> {
+  const key = await deriveOtpSealKey(secret);
+  const packed = Buffer.from(blob, "base64");
+  if (packed.byteLength < 13) {
+    throw new Error("otp-seal: malformed sealed blob");
+  }
+  const iv = packed.subarray(0, 12);
+  const data = packed.subarray(12);
+  const plain = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: new Uint8Array(iv) },
+    key,
+    toArrayBuffer(data),
+  );
+  return new TextDecoder().decode(plain);
+}
+
+/** Copy into a real ArrayBuffer for Web Crypto BufferSource typing. */
+function toArrayBuffer(view: Uint8Array): ArrayBuffer {
+  const copy = new Uint8Array(view.byteLength);
+  copy.set(view);
+  return copy.buffer;
+}

package/src/auth/schema.ts

@@ -73,6 +73,8 @@ export const AUTH_MODEL_DEFAULT_FIELDS: Readonly<
     createdAt: "created_at",
     expiresAt: "expires_at",
     lastActiveAt: "last_active_at",
+    scopes: "scopes",
+    audience: "audience",
   },
   refreshToken: {
     id: "id",
@@ -186,6 +188,7 @@ const CORE_SQL_TYPES: Readonly<Record<string, AuthColumnSqlType>> = {
   value: "TEXT",
   description: "TEXT",
   scopes: "TEXT",
+  audience: "TEXT",
   lastUsedAt: "INTEGER",
 };
 

package/src/auth/sessions.ts

@@ -130,11 +130,10 @@ export async function issueSession(
     createdAt: t,
     expiresAt: t + absoluteCap,
     lastActiveAt: t,
+    scopes: [...principal.scopes],
+    ...(crypto.audience !== undefined ? { audience: crypto.audience } : {}),
   };
   store.sessions.set(sessionId, session);
-  if (crypto.audience !== undefined) {
-    sessionAudiences.set(sessionId, crypto.audience);
-  }
 
   const refreshRaw = `rt_${cryptoRandomId()}`;
   const refreshRow: RefreshTokenRow = {
@@ -223,20 +222,15 @@ export async function rotateRefresh(
   };
   store.refresh.set(newRefresh.id, newRefresh);
 
-  // Recover scopes from the previous access path — stored on session via
-  // a side map would be ideal; for builtin we re-sign with empty and let
-  // callers pass scopes through verify. We keep scopes on a claim cache:
-  const priorScopes = sessionScopes.get(session.id) ?? [];
-  const priorAud = sessionAudiences.get(session.id);
   const accessExpiresAt = t + accessTtl;
   const accessToken = await signAccess(crypto.secret, {
     sub: session.principalId,
     plane: session.plane,
     sid: session.id,
-    scopes: priorScopes,
+    scopes: session.scopes,
     iat: t,
     exp: accessExpiresAt,
-    ...(priorAud !== undefined ? { aud: priorAud } : {}),
+    ...(session.audience !== undefined ? { aud: session.audience } : {}),
   });
 
   return {
@@ -247,34 +241,44 @@ export async function rotateRefresh(
   };
 }
 
-/** Session id → scopes (access-token material). */
-const sessionScopes = new Map<string, string[]>();
-
-/** Session id → audience stamped at issue time. */
-const sessionAudiences = new Map<string, string>();
-
 /**
  * Remember scopes for refresh rotation (call after {@link issueSession}).
+ * Scopes live on the session row — shared with any store hydrate/persist path.
  *
+ * @param store - Session store
  * @param sessionId - Session id
  * @param scopes - Scopes
  */
-export function bindSessionScopes(sessionId: string, scopes: Iterable<string>): void {
-  sessionScopes.set(sessionId, [...scopes]);
+export function bindSessionScopes(
+  store: SessionStore,
+  sessionId: string,
+  scopes: Iterable<string>,
+): void {
+  const session = store.sessions.get(sessionId);
+  if (!session) return;
+  // Mutate in place — SessionRow is a store-owned mutable row.
+  (session as { scopes: string[] }).scopes = [...scopes];
 }
 
 /**
  * Remember audience for refresh rotation (call after {@link issueSession}).
  *
+ * @param store - Session store
  * @param sessionId - Session id
  * @param audience - Audience claim
  */
-export function bindSessionAudience(sessionId: string, audience: string): void {
-  sessionAudiences.set(sessionId, audience);
+export function bindSessionAudience(
+  store: SessionStore,
+  sessionId: string,
+  audience: string,
+): void {
+  const session = store.sessions.get(sessionId);
+  if (!session) return;
+  (session as { audience?: string }).audience = audience;
 }
 
 /**
- * Issue a session and bind scopes for later rotation.
+ * Issue a session with scopes (and optional audience) on the session row.
  *
  * @param store - Session store
  * @param crypto - Crypto
@@ -289,12 +293,7 @@ export async function issueSessionWithScopes(
     readonly scopes: Iterable<string>;
   },
 ): Promise<IssuedSession> {
-  const issued = await issueSession(store, crypto, principal);
-  bindSessionScopes(issued.session.id, principal.scopes);
-  if (crypto.audience !== undefined) {
-    bindSessionAudience(issued.session.id, crypto.audience);
-  }
-  return issued;
+  return issueSession(store, crypto, principal);
 }
 
 /**

package/src/auth/tables.ts

@@ -121,6 +121,10 @@ export interface SessionRow {
   expiresAt: number;
   /** Last activity epoch-ms (idle timeout). Updated on refresh / access touch. */
   lastActiveAt: number;
+  /** Access-token scopes — survives refresh / process restart with the session row. */
+  scopes: string[];
+  /** Audience stamped at issue (`oke-console` · `oke-mcp` · `oke-app`). */
+  audience?: string;
 }
 
 /** Refresh token (hashed at rest); rotation with reuse detection. */