Merge branch 'dev'

README.md

···
     $table->text('access_token');            // JWT access token
     $table->text('refresh_token');           // Single-use refresh token
     $table->timestamp('expires_at');         // Token expiration time
+    $table->json('scope')->nullable();       // Granted OAuth scopes
     $table->timestamps();
 });
 ```
···
             expiresAt: $record->expires_at,
             handle: $record->handle,
             issuer: $record->issuer,
+            scope: $record->scope ?? [],
         );
     }
 
···
                 'access_token' => $token->accessJwt,
                 'refresh_token' => $token->refreshJwt,
                 'expires_at' => $token->expiresAt,
+                'scope' => $token->scope,
             ]
         );
     }
···
             'access_token' => $token->accessJwt,
             'refresh_token' => $token->refreshJwt,
             'expires_at' => $token->expiresAt,
-            // Preserve handle and issuer, or update if provided
             'handle' => $token->handle,
             'issuer' => $token->issuer,
+            'scope' => $token->scope,
         ]);
     }
 
···
         'access_token',
         'refresh_token',
         'expires_at',
+        'scope',
     ];
 
     protected $casts = [
         'expires_at' => 'datetime',
+        'scope' => 'array',
     ];
 
     protected $hidden = [
···
 | `accessToken` | JWT for API authentication (short-lived) |
 | `refreshToken` | Token to get new access tokens (single-use!) |
 | `expiresAt` | When the access token expires |
+| `scope` | Array of granted scopes (e.g., `['atproto', 'transition:generic']`) |
 
 ### Handling Token Refresh Events
 
···
 use SocialDept\AtpClient\Facades\Atp;
 
 Event::listen(OAuthUserAuthenticated::class, function (OAuthUserAuthenticated $event) {
-    // $event->token contains: did, accessJwt, refreshJwt, handle, issuer, expiresAt
+    // $event->token contains: did, accessJwt, refreshJwt, handle, issuer, expiresAt, scope
+
+    // Check granted scopes
+    if (in_array('atproto', $event->token->scope)) {
+        // User granted AT Protocol access
+    }
 
     // Fetch the user's profile
     $client = Atp::as($event->token->did);

src/Data/AccessToken.php

···
         public readonly \DateTimeInterface $expiresAt,
         public readonly ?string $handle = null,
         public readonly ?string $issuer = null,
+        public readonly array $scope = [],
     ) {}
 
     /**
···
                 expiresAt: now()->addSeconds($data['expires_in'] ?? 300),
                 handle: $handle,
                 issuer: $issuer,
+                scope: isset($data['scope']) ? explode(' ', $data['scope']) : [],
             );
         }
 
-        // Legacy createSession format
+        // Legacy createSession format (app passwords have full access)
         return new self(
             accessJwt: $data['accessJwt'],
             refreshJwt: $data['refreshJwt'],
···
             expiresAt: now()->addSeconds($data['expiresIn'] ?? 300),
             handle: $data['handle'] ?? $handle,
             issuer: $issuer,
+            scope: ['atproto', 'transition:generic', 'transition:email'],
         );
     }
 }

src/Data/Credentials.php

···
         public readonly \DateTimeInterface $expiresAt,
         public readonly ?string $handle = null,
         public readonly ?string $issuer = null,
+        public readonly array $scope = [],
     ) {}
 
     public function isExpired(): bool

src/Providers/ArrayCredentialProvider.php

···
             expiresAt: $token->expiresAt,
             handle: $token->handle,
             issuer: $token->issuer,
+            scope: $token->scope,
         );
     }
 

src/Session/Session.php

···
         return $this->credentials->expiresIn();
     }
 
+    public function scopes(): array
+    {
+        return $this->credentials->scope;
+    }
+
+    public function hasScope(string $scope): bool
+    {
+        return in_array($scope, $this->credentials->scope, true);
+    }
+
     public function withCredentials(Credentials $credentials): self
     {
         return new self($credentials, $this->dpopKey, $this->pdsEndpoint);