@_mustachio/openauth 0.11.0 → 0.12.0

package/dist/esm/methods/saml-sp/metadata.js

@@ -0,0 +1,69 @@
+// src/methods/saml-sp/metadata.ts
+import { authError } from "../../types/error";
+import { deriveSpEntityId } from "./saml-instance";
+var NAME_ID_FORMAT_URN = {
+  persistent: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+  transient: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+  emailAddress: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+  unspecified: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+};
+var HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+var HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+function xmlEscape(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function certBody(pem) {
+  return pem.replace(/-----BEGIN CERTIFICATE-----/g, "").replace(/-----END CERTIFICATE-----/g, "").replace(/\s+/g, "");
+}
+function buildSpMetadataXml(input) {
+  const entityId = xmlEscape(input.spEntityId);
+  const acs = xmlEscape(input.acsUrl);
+  const signed = input.signingCertPem !== undefined;
+  const nameIdLine = input.nameIdFormat !== undefined ? `
+    <md:NameIDFormat>${NAME_ID_FORMAT_URN[input.nameIdFormat]}</md:NameIDFormat>` : "";
+  const x509 = (cert) => `<ds:KeyInfo><ds:X509Data><ds:X509Certificate>` + certBody(cert) + `</ds:X509Certificate></ds:X509Data></ds:KeyInfo>`;
+  const keyDescriptor = (signed ? `
+    <md:KeyDescriptor use="signing">` + x509(input.signingCertPem) + `</md:KeyDescriptor>` : "") + (input.encryptionCertPem !== undefined ? `
+    <md:KeyDescriptor use="encryption">` + x509(input.encryptionCertPem) + `</md:KeyDescriptor>` : "");
+  const sls = input.slsUrl !== undefined ? `
+    <md:SingleLogoutService ` + `Binding="${HTTP_REDIRECT}" Location="${xmlEscape(input.slsUrl)}"/>` + `
+    <md:SingleLogoutService ` + `Binding="${HTTP_POST}" Location="${xmlEscape(input.slsUrl)}"/>` : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+` + `<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ` + `xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ` + `entityID="${entityId}">
+` + `  <md:SPSSODescriptor AuthnRequestsSigned="${signed}" ` + `WantAssertionsSigned="true" ` + `protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">` + keyDescriptor + sls + nameIdLine + `
+    <md:AssertionConsumerService ` + `Binding="${HTTP_POST}" Location="${acs}" index="0" isDefault="true"/>` + `
+  </md:SPSSODescriptor>
+` + `</md:EntityDescriptor>
+`;
+}
+async function buildSpMetadata(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: metadata route dispatched without issuer context " + "(ctx.dispatch is null)")
+    };
+  }
+  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const cb = new URL(ctx.dispatch.callbackUrl);
+  const slsUrl = `${cb.protocol}//${cb.host}/m/${methodId}/sls`;
+  const xml = buildSpMetadataXml({
+    spEntityId,
+    acsUrl: ctx.dispatch.callbackUrl,
+    ...config.idp.sloUrl ? { slsUrl } : {},
+    ...config.idp.nameIdFormat !== undefined ? { nameIdFormat: config.idp.nameIdFormat } : {},
+    ...config.signAuthnRequest && config.signingKey ? { signingCertPem: config.signingKey.certPem } : {},
+    ...config.allowEncryptedAssertions && config.decryptionKey ? { encryptionCertPem: config.decryptionKey.certPem } : {}
+  });
+  return {
+    kind: "challenge",
+    response: new Response(xml, {
+      status: 200,
+      headers: { "content-type": "application/samlmetadata+xml" }
+    }),
+    cache: { sMaxAge: 300 }
+  };
+}
+export {
+  buildSpMetadata,
+  buildSpMetadataXml
+};

package/dist/esm/methods/saml-sp/method.js

@@ -0,0 +1,29 @@
+// src/methods/saml-sp/method.ts
+import { consumeAssertion } from "./acs";
+import { buildAuthnRequestRedirect } from "./authnrequest";
+import { buildSpMetadata } from "./metadata";
+import { consumeSls } from "./sls";
+import { initiateSpLogout } from "./slo-initiate";
+function buildSamlSpMethod(id, kind, config) {
+  return {
+    id,
+    kind,
+    type: "custom",
+    routes: {
+      "GET /authorize": (ctx) => buildAuthnRequestRedirect(ctx, id, config),
+      "GET /callback": (ctx) => consumeAssertion(ctx, id, config),
+      "GET /metadata": (ctx) => buildSpMetadata(ctx, id, config),
+      "GET /sls": (ctx) => consumeSls(ctx, id, config),
+      "POST /sls": (ctx) => consumeSls(ctx, id, config),
+      "POST /logout": (ctx) => initiateSpLogout(ctx, id, config)
+    },
+    publicRoutes: [
+      "GET /metadata",
+      ...config.idp.sloUrl ? ["GET /sls", "POST /sls", "POST /logout"] : []
+    ],
+    unsolicitedCallback: config.idpInitiated !== undefined
+  };
+}
+export {
+  buildSamlSpMethod
+};

package/dist/esm/methods/saml-sp/parse-idp-metadata.js

@@ -0,0 +1,102 @@
+// src/methods/saml-sp/parse-idp-metadata.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import xmldom from "@xmldom/xmldom";
+var { DOMParser } = xmldom;
+var HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+var HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+var NAME_ID_FORMAT_BY_URN = {
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent": "persistent",
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:transient": "transient",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress": "emailAddress",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified": "unspecified"
+};
+function els(root, localName) {
+  const list = root.getElementsByTagNameNS("*", localName);
+  const out = [];
+  for (let i = 0;i < list.length; i++) {
+    const n = list[i];
+    if (n)
+      out.push(n);
+  }
+  return out;
+}
+function pickEndpoint(endpoints) {
+  if (endpoints.length === 0)
+    return;
+  const byBinding = (b) => endpoints.find((e) => e.getAttribute("Binding") === b);
+  const chosen = byBinding(HTTP_REDIRECT) ?? byBinding(HTTP_POST) ?? endpoints[0];
+  const loc = chosen?.getAttribute("Location");
+  return loc && loc.length > 0 ? loc : undefined;
+}
+function toPem(rawX509) {
+  const b64 = rawX509.replace(/\s+/g, "");
+  const lines = b64.match(/.{1,64}/g) ?? [b64];
+  return `-----BEGIN CERTIFICATE-----
+` + lines.join(`
+`) + `
+-----END CERTIFICATE-----`;
+}
+function parseSamlIdpMetadata(xml) {
+  if (typeof xml !== "string" || xml.trim().length === 0) {
+    return err(authError.invalidRequest("metadata XML is empty"));
+  }
+  let doc;
+  try {
+    doc = new DOMParser().parseFromString(xml, "text/xml");
+  } catch (e) {
+    return err(authError.invalidRequest(`metadata XML is not well-formed: ${e instanceof Error ? e.message : String(e)}`));
+  }
+  if (!doc?.documentElement) {
+    return err(authError.invalidRequest("metadata XML has no root element"));
+  }
+  const entityDescriptor = els(doc, "EntityDescriptor")[0];
+  if (!entityDescriptor) {
+    return err(authError.invalidRequest("metadata has no <EntityDescriptor>"));
+  }
+  const entityId = entityDescriptor.getAttribute("entityID");
+  if (!entityId) {
+    return err(authError.invalidRequest("EntityDescriptor has no entityID"));
+  }
+  const idp = els(entityDescriptor, "IDPSSODescriptor")[0];
+  if (!idp) {
+    return err(authError.invalidRequest("not an IdP metadata document (no <IDPSSODescriptor>) — this looks " + "like SP metadata"));
+  }
+  const ssoUrl = pickEndpoint(els(idp, "SingleSignOnService"));
+  if (!ssoUrl) {
+    return err(authError.invalidRequest("IDPSSODescriptor has no usable <SingleSignOnService> Location"));
+  }
+  const sloUrl = pickEndpoint(els(idp, "SingleLogoutService"));
+  let nameIdFormat;
+  for (const f of els(idp, "NameIDFormat")) {
+    const mapped = NAME_ID_FORMAT_BY_URN[(f.textContent ?? "").trim()];
+    if (mapped) {
+      nameIdFormat = mapped;
+      break;
+    }
+  }
+  const signingCerts = [];
+  for (const kd of els(idp, "KeyDescriptor")) {
+    const use = kd.getAttribute("use");
+    if (use && use !== "signing")
+      continue;
+    for (const cert of els(kd, "X509Certificate")) {
+      const body = (cert.textContent ?? "").trim();
+      if (body.length > 0)
+        signingCerts.push({ pem: toPem(body) });
+    }
+  }
+  if (signingCerts.length === 0) {
+    return err(authError.invalidRequest("IDPSSODescriptor has no signing <X509Certificate>"));
+  }
+  return ok({
+    entityId,
+    ssoUrl,
+    ...sloUrl !== undefined ? { sloUrl } : {},
+    ...nameIdFormat !== undefined ? { nameIdFormat } : {},
+    signingCerts
+  });
+}
+export {
+  parseSamlIdpMetadata
+};

package/dist/esm/methods/saml-sp/saml-instance.js

@@ -0,0 +1,49 @@
+// src/methods/saml-sp/saml-instance.ts
+import nodeSaml from "@node-saml/node-saml";
+import { methodScratchCacheProvider } from "./cache-provider";
+import { selectActiveCertPems } from "./cert-rotation";
+var { SAML, ValidateInResponseTo } = nodeSaml;
+var NAME_ID_FORMAT_URN = {
+  persistent: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+  transient: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+  emailAddress: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+  unspecified: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+};
+var IN_RESPONSE_TO_TTL_MS = 60 * 60 * 1000;
+function deriveSpEntityId(issuerUrl, tenantId, methodId) {
+  const base = issuerUrl.endsWith("/") ? issuerUrl.slice(0, -1) : issuerUrl;
+  return `${base}/${tenantId}/${methodId}`;
+}
+function buildSamlInstance(config, binding, nowMs) {
+  const activeCerts = selectActiveCertPems(config.idp.signingCerts, nowMs);
+  if (activeCerts.length === 0) {
+    throw new Error("saml-sp: no IdP signing certificate is currently within its " + "validity window — check SamlSpConfig.idp.signingCerts notBefore/notAfter.");
+  }
+  const identifierFormat = config.idp.nameIdFormat !== undefined ? NAME_ID_FORMAT_URN[config.idp.nameIdFormat] : null;
+  return new SAML({
+    idpCert: activeCerts,
+    issuer: binding.spEntityId,
+    callbackUrl: binding.acsUrl,
+    entryPoint: config.idp.ssoUrl,
+    idpIssuer: config.idp.entityId,
+    audience: binding.spEntityId,
+    identifierFormat,
+    validateInResponseTo: binding.logout ? ValidateInResponseTo.never : binding.idpInitiated ? ValidateInResponseTo.ifPresent : ValidateInResponseTo.always,
+    wantAssertionsSigned: true,
+    wantAuthnResponseSigned: false,
+    acceptedClockSkewMs: (config.clockSkewSeconds ?? 60) * 1000,
+    cacheProvider: methodScratchCacheProvider(binding.scratch, IN_RESPONSE_TO_TTL_MS),
+    ...binding.signing ? {
+      privateKey: binding.signing.privateKeyPem,
+      publicCert: binding.signing.certPem,
+      signatureAlgorithm: "sha256"
+    } : {},
+    ...binding.logoutUrl ? { logoutUrl: binding.logoutUrl } : {},
+    ...binding.decryptionPvk ? { decryptionPvk: binding.decryptionPvk } : {}
+  });
+}
+export {
+  NAME_ID_FORMAT_URN,
+  buildSamlInstance,
+  deriveSpEntityId
+};

package/dist/esm/methods/saml-sp/slo-initiate.js

@@ -0,0 +1,84 @@
+// src/methods/saml-sp/slo-initiate.ts
+import { authError } from "../../types/error";
+import {
+  buildSamlInstance,
+  deriveSpEntityId,
+  NAME_ID_FORMAT_URN
+} from "./saml-instance";
+async function initiateSpLogout(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /logout dispatched without issuer context (ctx.dispatch is null)")
+    };
+  }
+  if (!config.idp.sloUrl) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /logout reached with no idp.sloUrl configured")
+    };
+  }
+  let nameId;
+  let sessionIndex;
+  let relayState;
+  let nameIdFormatParam;
+  try {
+    const form = new URLSearchParams(await ctx.request.text());
+    nameId = form.get("nameId");
+    sessionIndex = form.get("sessionIndex");
+    relayState = form.get("relayState");
+    nameIdFormatParam = form.get("nameIdFormat");
+  } catch {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /logout could not read POST body")
+    };
+  }
+  if (!nameId) {
+    return { kind: "denied", reason: "missing nameId" };
+  }
+  if (nameIdFormatParam !== null && !(nameIdFormatParam in NAME_ID_FORMAT_URN)) {
+    return {
+      kind: "denied",
+      reason: `unrecognized nameIdFormat "${nameIdFormatParam}" — expected one ` + `of: ${Object.keys(NAME_ID_FORMAT_URN).join(", ")}`
+    };
+  }
+  const nameIDFormat = nameIdFormatParam !== null ? NAME_ID_FORMAT_URN[nameIdFormatParam] : config.idp.nameIdFormat !== undefined ? NAME_ID_FORMAT_URN[config.idp.nameIdFormat] : NAME_ID_FORMAT_URN.persistent;
+  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  let redirectUrl;
+  try {
+    const saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl: ctx.dispatch.callbackUrl,
+      scratch: ctx.methodScratch,
+      logoutUrl: config.idp.sloUrl,
+      logout: true,
+      ...config.signingKey ? {
+        signing: {
+          privateKeyPem: config.signingKey.privateKeyPem,
+          certPem: config.signingKey.certPem
+        }
+      } : {}
+    }, Date.now());
+    redirectUrl = await saml.getLogoutUrlAsync({
+      nameID: nameId,
+      nameIDFormat,
+      ...sessionIndex !== null ? { sessionIndex } : {}
+    }, relayState ?? "", {});
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: failed to build LogoutRequest: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  return {
+    kind: "challenge",
+    response: new Response(null, {
+      status: 302,
+      headers: { location: redirectUrl }
+    })
+  };
+}
+export {
+  initiateSpLogout
+};

package/dist/esm/methods/saml-sp/sls.js

@@ -0,0 +1,154 @@
+// src/methods/saml-sp/sls.ts
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+var SLO_REPLAY_HORIZON_MS = 10 * 60000;
+async function consumeSls(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /sls dispatched without issuer context (ctx.dispatch is null)")
+    };
+  }
+  if (!config.idp.sloUrl) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /sls reached with no idp.sloUrl configured")
+    };
+  }
+  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const url = new URL(ctx.request.url);
+  const originalQuery = url.search.replace(/^\?/, "");
+  let samlRequest;
+  let samlResponse;
+  let relayState;
+  const isPost = ctx.request.method.toUpperCase() === "POST";
+  let postForm = null;
+  try {
+    if (isPost) {
+      postForm = new URLSearchParams(await ctx.request.text());
+      samlRequest = postForm.get("SAMLRequest");
+      samlResponse = postForm.get("SAMLResponse");
+      relayState = postForm.get("RelayState");
+    } else {
+      samlRequest = url.searchParams.get("SAMLRequest");
+      samlResponse = url.searchParams.get("SAMLResponse");
+      relayState = url.searchParams.get("RelayState");
+    }
+  } catch {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: /sls could not read request")
+    };
+  }
+  if (!samlRequest && !samlResponse) {
+    return { kind: "denied", reason: "missing SAMLRequest / SAMLResponse" };
+  }
+  let saml;
+  try {
+    saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl: ctx.dispatch.callbackUrl,
+      scratch: ctx.methodScratch,
+      logoutUrl: config.idp.sloUrl,
+      logout: true,
+      ...config.signingKey ? {
+        signing: {
+          privateKeyPem: config.signingKey.privateKeyPem,
+          certPem: config.signingKey.certPem
+        }
+      } : {}
+    }, Date.now());
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: cannot construct logout verifier: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  if (samlRequest) {
+    let profile;
+    try {
+      const res = isPost ? await saml.validatePostRequestAsync({
+        SAMLRequest: samlRequest,
+        ...relayState !== null ? { RelayState: relayState } : {}
+      }) : await saml.validateRedirectAsync(Object.fromEntries(url.searchParams), originalQuery);
+      profile = res.profile;
+    } catch (e) {
+      return {
+        kind: "denied",
+        reason: `logout request rejected: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+    if (!profile) {
+      return { kind: "denied", reason: "logout request produced no profile" };
+    }
+    if (!profile.ID) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: LogoutRequest carries no @ID — front-channel replay " + "protection cannot be established. Refusing to process.")
+      };
+    }
+    {
+      const key = `slo-replay:${profile.ID}`;
+      const seen = await ctx.methodScratch.get(key);
+      if (seen.ok) {
+        return {
+          kind: "denied",
+          reason: "logout request replay detected (request ID already seen)"
+        };
+      }
+      const recorded = await ctx.methodScratch.put(key, "1", SLO_REPLAY_HORIZON_MS);
+      if (isErr(recorded)) {
+        return {
+          kind: "error",
+          error: authError.internalError("saml-sp: could not record LogoutRequest ID for replay protection")
+        };
+      }
+    }
+    let logoutResponseUrl;
+    try {
+      logoutResponseUrl = await saml.getLogoutResponseUrlAsync(profile, relayState ?? "", {}, true);
+    } catch (e) {
+      return {
+        kind: "error",
+        error: authError.internalError(`saml-sp: failed to build LogoutResponse: ${e instanceof Error ? e.message : String(e)}`, e)
+      };
+    }
+    return {
+      kind: "challenge",
+      response: new Response(null, {
+        status: 302,
+        headers: { location: logoutResponseUrl }
+      }),
+      logout: {
+        ...profile.nameID !== undefined ? { nameId: profile.nameID } : {},
+        ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {}
+      }
+    };
+  }
+  try {
+    if (isPost) {
+      await saml.validatePostResponseAsync({
+        SAMLResponse: samlResponse,
+        ...relayState !== null ? { RelayState: relayState } : {}
+      });
+    } else {
+      await saml.validateRedirectAsync(Object.fromEntries(url.searchParams), originalQuery);
+    }
+  } catch (e) {
+    return {
+      kind: "denied",
+      reason: `logout response rejected: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  return {
+    kind: "challenge",
+    response: new Response("Logged out.", {
+      status: 200,
+      headers: { "content-type": "text/plain" }
+    })
+  };
+}
+export {
+  consumeSls
+};

package/dist/esm/types/result.js

@@ -4,8 +4,8 @@ var err = (error) => ({ ok: false, error });
 var isOk = (r) => r.ok === true;
 var isErr = (r) => r.ok === false;
 export {
-  ok,
-  isOk,
+  err,
   isErr,
-  err
+  isOk,
+  ok
 };

package/dist/esm/ui/forms.js

@@ -246,8 +246,8 @@ function renderForm(opts) {
   });
 }
 export {
-  renderForm,
-  htmlPage,
+  BASE_STYLES,
   escapeHtml,
-  BASE_STYLES
+  htmlPage,
+  renderForm
 };

package/dist/esm/ui/index.js

@@ -1,8 +1,11 @@
+// src/ui/index.ts
+import { renderForm, escapeHtml, htmlPage, BASE_STYLES } from "./forms";
+import { renderPicker, buildMethodLink } from "./picker";
 export {
-  renderPicker,
-  renderForm,
-  htmlPage,
-  escapeHtml,
+  BASE_STYLES,
   buildMethodLink,
-  BASE_STYLES
+  escapeHtml,
+  htmlPage,
+  renderForm,
+  renderPicker
 };

package/dist/esm/ui/picker.js

@@ -44,6 +44,6 @@ function prettyKind(kind) {
   return kind.split(/[-_]/).map((p) => p.length === 0 ? p : p[0].toUpperCase() + p.slice(1)).join(" ");
 }
 export {
-  renderPicker,
-  buildMethodLink
+  buildMethodLink,
+  renderPicker
 };

package/dist/types/adapters/d1/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,kBAAkB,UAkE9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9D"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,kBAAkB,UAuE9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9D"}

package/dist/types/adapters/d1/session-store.d.ts

@@ -16,5 +16,8 @@ export declare class D1SessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/d1/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,YAAY;;gBAIrC,IAAI,EAAE,qBAAqB;IAKjC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA2BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAuBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA2B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,YAAY;;gBAIrC,IAAI,EAAE,qBAAqB;IAKjC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA2BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAuBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA2B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYvD,WAAW,CACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyBlB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IA2BjD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAWxD"}

package/dist/types/adapters/durable-object/session-store.d.ts

@@ -16,6 +16,9 @@ export declare class DurableObjectSessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 export type { DurableObjectStorageLike, DurableObjectTransactionLike };
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/durable-object/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/session-store.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,SAAS,CAAA;AAYhB,MAAM,MAAM,gCAAgC,GAAG;IAC7C,OAAO,EAAE,wBAAwB,CAAA;IACjC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,yBAA0B,YAAW,YAAY;;gBAIhD,IAAI,EAAE,gCAAgC;IAK5C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAkBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA2BlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAmBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA+BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAmB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ9D;AAMD,YAAY,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,CAAA"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/session-store.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,SAAS,CAAA;AAiBhB,MAAM,MAAM,gCAAgC,GAAG;IAC7C,OAAO,EAAE,wBAAwB,CAAA;IACjC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,yBAA0B,YAAW,YAAY;;gBAIhD,IAAI,EAAE,gCAAgC;IAK5C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAkBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA2BlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAmBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA+BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAmB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASvD,WAAW,CACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAmBjD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQxD;AAOD,YAAY,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,CAAA"}

package/dist/types/adapters/dynamo/session-store.d.ts

@@ -16,5 +16,8 @@ export declare class DynamoSessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/dynamo/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAIzC,IAAI,EAAE,yBAAyB;IAKrC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAsBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAsB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ9D"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAIzC,IAAI,EAAE,yBAAyB;IAKrC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAsBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAsB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASvD,WAAW,CACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA0BlB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAwBjD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQxD"}

package/dist/types/adapters/memory/session-store.d.ts

@@ -17,5 +17,8 @@ export declare class MemorySessionStore implements SessionStore {
     revokeSession(sessionId: string): Promise<Result<void>>;
     savePar(requestUri: string, payload: ParRecord, ttl: number): Promise<Result<void>>;
     consumePar(requestUri: string): Promise<Result<ParRecord>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/memory/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,YAAY,EACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAapC,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAMzC,IAAI,GAAE,yBAA8B;IAI1C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAYrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAgBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAY9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKvD,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CAejE"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,YAAY,EACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAkBpC,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAOzC,IAAI,GAAE,yBAA8B;IAI1C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAYrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAgBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAY9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKvD,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAgB1D,WAAW,CACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAYjD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAIxD"}

package/dist/types/adapters/postgres/migrations.d.ts

@@ -12,7 +12,7 @@
  * comparisons are simple integer math.
  */
 import type { PostgresExecutor } from "./executor";
-export declare const INITIAL_SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS openauth_tenants (\n  id text PRIMARY KEY,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_methods (\n  tenant_id text NOT NULL,\n  method_id text NOT NULL,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, method_id)\n);\n\nCREATE TABLE IF NOT EXISTS openauth_signing_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  crv text,\n  public_jwk jsonb NOT NULL,\n  private_jwk jsonb NOT NULL,\n  private_jwk_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_signing_keys\n  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_encryption_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  key_material bytea NOT NULL,\n  key_material_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_encryption_keys\n  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_codes (\n  code text PRIMARY KEY,\n  ciphertext text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_refresh_tokens (\n  token text PRIMARY KEY,\n  tenant_id text NOT NULL,\n  client_id text NOT NULL,\n  subject_id text NOT NULL,\n  family text NOT NULL,\n  expires_at bigint NOT NULL,\n  consumed_at bigint,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_refresh_family_idx\n  ON openauth_refresh_tokens (family);\nCREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx\n  ON openauth_refresh_tokens (tenant_id, subject_id);\n\nCREATE TABLE IF NOT EXISTS openauth_flows (\n  flow_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_sessions (\n  session_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_audit_events (\n  id bigserial PRIMARY KEY,\n  ts bigint NOT NULL,\n  kind text NOT NULL,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_audit_kind_idx\n  ON openauth_audit_events (kind);\nCREATE INDEX IF NOT EXISTS openauth_audit_ts_idx\n  ON openauth_audit_events (ts);\n\nCREATE TABLE IF NOT EXISTS openauth_passkey_credentials (\n  tenant_id text NOT NULL,\n  credential_id text NOT NULL,\n  user_id text NOT NULL,\n  public_key text NOT NULL,\n  counter bigint NOT NULL DEFAULT 0,\n  transports jsonb,\n  created_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, credential_id)\n);\nCREATE INDEX IF NOT EXISTS openauth_passkey_user_idx\n  ON openauth_passkey_credentials (tenant_id, user_id);\n";
+export declare const INITIAL_SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS openauth_tenants (\n  id text PRIMARY KEY,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_methods (\n  tenant_id text NOT NULL,\n  method_id text NOT NULL,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, method_id)\n);\n\nCREATE TABLE IF NOT EXISTS openauth_signing_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  crv text,\n  public_jwk jsonb NOT NULL,\n  private_jwk jsonb NOT NULL,\n  private_jwk_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_signing_keys\n  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_encryption_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  key_material bytea NOT NULL,\n  key_material_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_encryption_keys\n  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_codes (\n  code text PRIMARY KEY,\n  ciphertext text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_refresh_tokens (\n  token text PRIMARY KEY,\n  tenant_id text NOT NULL,\n  client_id text NOT NULL,\n  subject_id text NOT NULL,\n  family text NOT NULL,\n  expires_at bigint NOT NULL,\n  consumed_at bigint,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_refresh_family_idx\n  ON openauth_refresh_tokens (family);\nCREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx\n  ON openauth_refresh_tokens (tenant_id, subject_id);\n\nCREATE TABLE IF NOT EXISTS openauth_flows (\n  flow_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_sessions (\n  session_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_scratch (\n  scratch_key text PRIMARY KEY,\n  value text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_audit_events (\n  id bigserial PRIMARY KEY,\n  ts bigint NOT NULL,\n  kind text NOT NULL,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_audit_kind_idx\n  ON openauth_audit_events (kind);\nCREATE INDEX IF NOT EXISTS openauth_audit_ts_idx\n  ON openauth_audit_events (ts);\n\nCREATE TABLE IF NOT EXISTS openauth_passkey_credentials (\n  tenant_id text NOT NULL,\n  credential_id text NOT NULL,\n  user_id text NOT NULL,\n  public_key text NOT NULL,\n  counter bigint NOT NULL DEFAULT 0,\n  transports jsonb,\n  created_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, credential_id)\n);\nCREATE INDEX IF NOT EXISTS openauth_passkey_user_idx\n  ON openauth_passkey_credentials (tenant_id, user_id);\n";
 /**
  * Apply the initial schema. Idempotent — uses `CREATE TABLE IF NOT EXISTS`.
  * Deployments using a real migration tool can apply the SQL above directly

package/dist/types/adapters/postgres/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,kBAAkB,mwFAmG9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,kBAAkB,+4FAyG9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE"}