feat(shared): Add oiat field to JwtHeader type

nikosdouvlis · nikosdouvlis · commit f29c8e98e7f6 · 2026-03-18T15:14:54.000+02:00
Session Minter needs an oiat (original_issued_at) field in the JWT header to track when token claims were last assembled from the DB. This enables monotonic freshness checks that prevent edge-minted tokens with stale claims from overwriting fresher ones. Marked @internal so developers don't depend on this field.
diff --git a/packages/shared/src/types/jwtv2.ts b/packages/shared/src/types/jwtv2.ts
@@ -25,6 +25,8 @@ export interface JwtHeader {
   'x5t#S256'?: string;
   x5t?: string;
   x5c?: string | string[];
+  /** @internal - used by Session Minter for monotonic token freshness checks. Do not depend on this field. */
+  oiat?: number;
 }
 
 declare global {

Original file line number	Diff line number	Diff line change
`@@ -25,6 +25,8 @@ export interface JwtHeader {`
`25`	`25`	`'x5t#S256'?: string;`
`26`	`26`	`x5t?: string;`
`27`	`27`	`x5c?: string \| string[];`
	`28`	`+ /** @internal - used by Session Minter for monotonic token freshness checks. Do not depend on this field. */`
	`29`	`+ oiat?: number;`
`28`	`30`	`}`
`29`	`31`
`30`	`32`	`declare global {`