@_mustachio/openauth 0.9.1 → 0.10.0

package/dist/esm/methods/providers/x.js

@@ -0,0 +1,28 @@
+// src/methods/providers/x.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var xFactory = {
+  kind: "x",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    tokenUrl: "https://api.x.com/2/oauth2/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["tweet.read", "users.read"]
+  })
+};
+export {
+  xFactory
+};

package/dist/esm/methods/providers/yahoo.js

@@ -0,0 +1,27 @@
+// src/methods/providers/yahoo.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var yahooFactory = {
+  kind: "yahoo",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://api.login.yahoo.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "email", "profile"]
+  })
+};
+export {
+  yahooFactory
+};

package/dist/esm/pkce.js

@@ -5,11 +5,8 @@ function generateVerifier(length) {
   crypto.getRandomValues(buffer);
   return base64url.encode(buffer);
 }
-async function generateChallenge(verifier, method) {
-  if (method === "plain")
-    return verifier;
-  const encoder = new TextEncoder;
-  const data = encoder.encode(verifier);
+async function s256Challenge(verifier) {
+  const data = new TextEncoder().encode(verifier);
   const hash = await crypto.subtle.digest("SHA-256", data);
   return base64url.encode(new Uint8Array(hash));
 }
@@ -18,18 +15,9 @@ async function generatePKCE(length = 64) {
     throw new Error("Code verifier length must be between 43 and 128 characters");
   }
   const verifier = generateVerifier(length);
-  const challenge = await generateChallenge(verifier, "S256");
-  return {
-    verifier,
-    challenge,
-    method: "S256"
-  };
-}
-async function validatePKCE(verifier, challenge, method = "S256") {
-  const generatedChallenge = await generateChallenge(verifier, method);
-  return generatedChallenge === challenge;
+  const challenge = await s256Challenge(verifier);
+  return { verifier, challenge, method: "S256" };
 }
 export {
-  validatePKCE,
   generatePKCE
 };

package/dist/esm/types/error.js

@@ -0,0 +1,65 @@
+// src/types/error.ts
+var authError = {
+  invalidRequest: (description, field) => ({
+    code: "invalid_request",
+    description,
+    ...field !== undefined ? { field } : {}
+  }),
+  invalidClient: (description) => ({
+    code: "invalid_client",
+    description
+  }),
+  invalidGrant: (description, reuseSignal) => ({
+    code: "invalid_grant",
+    description,
+    ...reuseSignal !== undefined ? { reuseSignal } : {}
+  }),
+  unauthorizedClient: (description) => ({
+    code: "unauthorized_client",
+    description
+  }),
+  unsupportedGrantType: (description) => ({
+    code: "unsupported_grant_type",
+    description
+  }),
+  invalidScope: (description) => ({
+    code: "invalid_scope",
+    description
+  }),
+  accessDenied: (description) => ({
+    code: "access_denied",
+    description
+  }),
+  unknownState: (description) => ({
+    code: "unknown_state",
+    description
+  }),
+  serverError: (description, cause) => ({
+    code: "server_error",
+    description,
+    ...cause !== undefined ? { cause } : {}
+  }),
+  tenantNotFound: (description, tenantId) => ({
+    code: "tenant_not_found",
+    description,
+    tenantId
+  }),
+  methodNotFound: (description, refs) => ({
+    code: "method_not_found",
+    description,
+    ...refs.methodId !== undefined ? { methodId: refs.methodId } : {},
+    ...refs.methodKind !== undefined ? { methodKind: refs.methodKind } : {}
+  }),
+  invalidTarget: (description) => ({
+    code: "invalid_target",
+    description
+  }),
+  internalError: (description, cause) => ({
+    code: "internal_error",
+    description,
+    ...cause !== undefined ? { cause } : {}
+  })
+};
+export {
+  authError
+};

package/dist/esm/types/result.js

@@ -0,0 +1,11 @@
+// src/types/result.ts
+var ok = (value) => ({ ok: true, value });
+var err = (error) => ({ ok: false, error });
+var isOk = (r) => r.ok === true;
+var isErr = (r) => r.ok === false;
+export {
+  ok,
+  isOk,
+  isErr,
+  err
+};

package/dist/esm/types/tenant.js

@@ -0,0 +1,5 @@
+// src/types/tenant.ts
+var asTenantId = (value) => value;
+export {
+  asTenantId
+};

package/dist/esm/ui/forms.js

@@ -0,0 +1,253 @@
+// src/ui/forms.ts
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => {
+    switch (c) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      case "'":
+        return "&#39;";
+      default:
+        return c;
+    }
+  });
+}
+var BASE_STYLES = `
+:root {
+  color-scheme: light dark;
+
+  --bg-page: #eef0f4;
+  --bg-card: #ffffff;
+  --bg-input: #ffffff;
+  --bg-row: #f5f6f8;
+  --bg-row-hover: #eaecf1;
+  --fg-high: #0e1116;
+  --fg-mid: #4a5160;
+  --fg-low: #8b93a3;
+  --border: #d8dce3;
+  --border-strong: #9aa3b2;
+  --primary: #2f3137;
+  --primary-fg: #ffffff;
+  --primary-hover: #1b1d22;
+  --focus-ring: rgba(47, 49, 55, 0.18);
+  --error-bg: #fdecec;
+  --error-fg: #8a1a1a;
+  --radius: 8px;
+  --shadow-card: 0 1px 2px rgba(15, 18, 25, 0.04), 0 12px 28px rgba(15, 18, 25, 0.08);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg-page: #0e0f12;
+    --bg-card: #16181d;
+    --bg-input: #1c1f25;
+    --bg-row: #20242c;
+    --bg-row-hover: #2a2f38;
+    --fg-high: #f3f4f6;
+    --fg-mid: #b6bcc7;
+    --fg-low: #7a8190;
+    --border: #2a2e36;
+    --border-strong: #3a4049;
+    --primary: #f3f4f6;
+    --primary-fg: #0e1116;
+    --primary-hover: #ffffff;
+    --focus-ring: rgba(243, 244, 246, 0.22);
+    --error-bg: #2a1414;
+    --error-fg: #f5b4b4;
+    --shadow-card: 0 1px 2px rgba(0, 0, 0, 0.5), 0 18px 40px rgba(0, 0, 0, 0.5);
+  }
+}
+
+* { box-sizing: border-box; }
+
+html, body { margin: 0; padding: 0; }
+
+body {
+  min-height: 100vh;
+  background: var(--bg-page);
+  color: var(--fg-high);
+  font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", "Inter", "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+  font-size: 15px;
+  line-height: 1.45;
+  display: grid;
+  place-items: center;
+  padding: 1.5rem;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+main {
+  max-width: 380px;
+  width: 100%;
+  padding: 2rem 1.75rem;
+  background: var(--bg-card);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-card);
+}
+
+h1 {
+  font-size: 1.125rem;
+  font-weight: 600;
+  letter-spacing: -0.01em;
+  margin: 0 0 1.25rem;
+  color: var(--fg-high);
+}
+
+form {
+  display: grid;
+  gap: 0.85rem;
+  margin: 0;
+}
+
+label {
+  display: grid;
+  gap: 0.4rem;
+  font-size: 0.78rem;
+  font-weight: 500;
+  color: var(--fg-mid);
+  text-transform: none;
+}
+
+input {
+  width: 100%;
+  height: 2.5rem;
+  padding: 0 0.85rem;
+  background: var(--bg-input);
+  color: var(--fg-high);
+  border: 1px solid var(--border);
+  border-radius: calc(var(--radius) - 2px);
+  font-size: 0.95rem;
+  font-family: inherit;
+  outline: none;
+  transition: border-color 120ms ease, box-shadow 120ms ease;
+}
+input::placeholder { color: var(--fg-low); }
+input:hover { border-color: var(--border-strong); }
+input:focus {
+  border-color: var(--primary);
+  box-shadow: 0 0 0 3px var(--focus-ring);
+}
+input:user-invalid:not(:focus) {
+  border-color: var(--error-fg);
+}
+
+button {
+  height: 2.5rem;
+  padding: 0 1rem;
+  border: 0;
+  border-radius: calc(var(--radius) - 2px);
+  background: var(--primary);
+  color: var(--primary-fg);
+  font-family: inherit;
+  font-size: 0.9rem;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  cursor: pointer;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  transition: background 120ms ease, transform 80ms ease;
+}
+button:hover { background: var(--primary-hover); }
+button:active { transform: translateY(1px); }
+button:focus-visible { box-shadow: 0 0 0 3px var(--focus-ring); outline: none; }
+
+.error {
+  display: flex;
+  align-items: center;
+  min-height: 2.25rem;
+  padding: 0.5rem 0.85rem;
+  margin: 0 0 0.25rem;
+  background: var(--error-bg);
+  color: var(--error-fg);
+  font-size: 0.82rem;
+  border-radius: calc(var(--radius) - 2px);
+}
+
+.methods {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+  display: grid;
+  gap: 0.5rem;
+}
+.methods a {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  min-height: 2.75rem;
+  padding: 0 1rem;
+  background: var(--bg-row);
+  border: 1px solid var(--border);
+  border-radius: calc(var(--radius) - 2px);
+  color: var(--fg-high);
+  font-size: 0.92rem;
+  font-weight: 500;
+  text-decoration: none;
+  transition: background 120ms ease, border-color 120ms ease, transform 80ms ease;
+}
+.methods a::after {
+  content: "›";
+  color: var(--fg-mid);
+  font-size: 1.15rem;
+  font-weight: 500;
+  line-height: 1;
+}
+.methods a:hover {
+  background: var(--bg-row-hover);
+  border-color: var(--border-strong);
+  color: var(--fg-high);
+}
+.methods a:hover::after {
+  color: var(--fg-high);
+}
+.methods a:active { transform: translateY(1px); }
+.methods a:focus-visible {
+  outline: none;
+  border-color: var(--primary);
+  box-shadow: 0 0 0 3px var(--focus-ring);
+}
+`;
+function htmlPage(opts) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(opts.title)}</title>
+  <style>${BASE_STYLES}</style>
+</head>
+<body>
+  <main>${opts.body}</main>
+</body>
+</html>`;
+}
+function renderForm(opts) {
+  const errorHtml = opts.error ? `<p class="error">${escapeHtml(opts.error)}</p>` : "";
+  const hidden = Object.entries(opts.hidden ?? {}).map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join("");
+  const fields = opts.fields.map((f) => `<label>${escapeHtml(f.label)}
+<input
+  name="${escapeHtml(f.name)}"
+  type="${f.type ?? "text"}"
+  value="${escapeHtml(f.value ?? "")}"
+  ${f.required ? "required" : ""}
+  ${f.autocomplete ? `autocomplete="${escapeHtml(f.autocomplete)}"` : ""}
+  ${f.inputmode ? `inputmode="${escapeHtml(f.inputmode)}"` : ""}
+></label>`).join("");
+  return htmlPage({
+    title: opts.title,
+    body: `<h1>${escapeHtml(opts.title)}</h1>${errorHtml}<form method="POST" action="${escapeHtml(opts.action)}">${hidden}${fields}<button type="submit">${escapeHtml(opts.submit)}</button></form>`
+  });
+}
+export {
+  renderForm,
+  htmlPage,
+  escapeHtml,
+  BASE_STYLES
+};

package/dist/esm/ui/index.js

@@ -0,0 +1,8 @@
+export {
+  renderPicker,
+  renderForm,
+  htmlPage,
+  escapeHtml,
+  buildMethodLink,
+  BASE_STYLES
+};

package/dist/esm/ui/picker.js

@@ -0,0 +1,49 @@
+// src/ui/picker.ts
+import { escapeHtml, htmlPage } from "./forms";
+function buildMethodLink(methodId, ctx) {
+  const params = new URLSearchParams;
+  params.set("client_id", ctx.clientId);
+  params.set("redirect_uri", ctx.redirectUri);
+  params.set("response_type", "code");
+  params.set("method_id", methodId);
+  if (ctx.state)
+    params.set("state", ctx.state);
+  if (ctx.scope)
+    params.set("scope", ctx.scope);
+  if (ctx.nonce)
+    params.set("nonce", ctx.nonce);
+  if (ctx.codeChallenge)
+    params.set("code_challenge", ctx.codeChallenge);
+  if (ctx.codeChallengeMethod)
+    params.set("code_challenge_method", ctx.codeChallengeMethod);
+  if (ctx.audience)
+    params.set("audience", ctx.audience);
+  if (ctx.prompt)
+    params.set("prompt", ctx.prompt);
+  if (ctx.uiLocales)
+    params.set("ui_locales", ctx.uiLocales);
+  return `?${params.toString()}`;
+}
+function renderPicker(methods, ctx) {
+  const items = methods.map((m) => {
+    const label = m.displayName ?? prettyKind(m.kind);
+    return `<li><a href="${escapeHtml(buildMethodLink(m.id, ctx))}">${escapeHtml(label)}</a></li>`;
+  }).join("");
+  const body = `<h1>Sign in</h1><ul class="methods">${items}</ul>`;
+  return new Response(htmlPage({ title: "Sign in", body }), {
+    status: 200,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
+    }
+  });
+}
+function prettyKind(kind) {
+  if (!kind)
+    return "Continue";
+  return kind.split(/[-_]/).map((p) => p.length === 0 ? p : p[0].toUpperCase() + p.slice(1)).join(" ");
+}
+export {
+  renderPicker,
+  buildMethodLink
+};

package/dist/types/adapters/d1/audit-log.d.ts

@@ -0,0 +1,19 @@
+/**
+ * D1 `AuditLog`. Append-only inserts; D1's autoincrement provides the
+ * insertion order index for SIEM queries. Per `ports/audit-log.ts`, `log()`
+ * never throws — durability failures are swallowed because the hot OAuth
+ * paths cannot be gated on the audit log.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { AnyD1Database } from "./types";
+export type D1AuditLogOptions = {
+    db: AnyD1Database;
+};
+export declare class D1AuditLog implements AuditLog {
+    #private;
+    constructor(opts: D1AuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/d1/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,aAAa,CAAA;CAClB,CAAA;AAED,qBAAa,UAAW,YAAW,QAAQ;;gBAG7B,IAAI,EAAE,iBAAiB;IAI7B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpE"}

package/dist/types/adapters/d1/config-store.d.ts

@@ -0,0 +1,20 @@
+/**
+ * D1 `ConfigStore`. JSON-as-TEXT, eventual-consistency reads acceptable per
+ * `ports/CONSISTENCY.md`. Invalidation hook fires on every put.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { AnyD1Database } from "./types";
+export type D1ConfigStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+};
+export declare class D1ConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: D1ConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/d1/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/config-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAKnC,IAAI,EAAE,oBAAoB;IAKhC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAgB5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/d1/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Cloudflare D1 adapter set.
+ *
+ * Per AD8 + the D1 read-replication caveat in `ports/CONSISTENCY.md`, every
+ * operation on the security-critical paths (`TokenStore`, `SessionStore`)
+ * wraps its statement in `db.withSession("first-primary")` so reads observe
+ * the latest write. Read-eventual paths (`ConfigStore`, `KeyStore.signingKeys`,
+ * `MethodStore`, `AuditLog`) use the plain `D1Database` and benefit from
+ * replica reads when available.
+ *
+ * Feature detection — if the `D1Database` runtime predates the Sessions API,
+ * the helper degrades to plain `prepare`. This keeps the adapter compatible
+ * with older Workers runtimes and test shims (bun:sqlite via the
+ * `test/adapters/d1.test.ts` harness) at the cost of relying on
+ * single-replica consistency in those environments.
+ *
+ * @example
+ *   export default {
+ *     async fetch(req, env) {
+ *       const keyStore = new D1KeyStore({ db: env.AUTH })
+ *       const tokenStore = new D1TokenStore({ db: env.AUTH, keyStore })
+ *       // ...
+ *     }
+ *   }
+ */
+export { D1AuditLog, type D1AuditLogOptions } from "./audit-log";
+export { D1ConfigStore, type D1ConfigStoreOptions } from "./config-store";
+export { D1KeyStore, type D1KeyStoreOptions } from "./key-store";
+export { D1MethodStore, type D1MethodStoreOptions } from "./method-store";
+export { D1SessionStore, type D1SessionStoreOptions } from "./session-store";
+export { D1TokenStore, type D1TokenStoreOptions } from "./token-store";
+export { INITIAL_SCHEMA_SQL, migrate } from "./migrations";
+export { isSessionsCapable, primarySession } from "./session";
+export { type AnyD1Database, type D1DatabaseSession, type D1DatabaseWithSessions, type D1SessionBookmark, type D1SessionConstraint, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/d1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEtE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,SAAS,CAAA"}

package/dist/types/adapters/d1/key-store.d.ts

@@ -0,0 +1,17 @@
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { AnyD1Database } from "./types";
+export type D1KeyStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+};
+export declare class D1KeyStore implements KeyStore {
+    #private;
+    constructor(opts: D1KeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/d1/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/key-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;CAC/B,CAAA;AAED,qBAAa,UAAW,YAAW,QAAQ;;gBAM7B,IAAI,EAAE,iBAAiB;IAM7B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBhD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAc5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAkBtD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAgGpE"}

package/dist/types/adapters/d1/method-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * D1 `MethodStore`. `(tenant_id, method_id)` composite key, JSON-as-TEXT
+ * config blob.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { AnyD1Database } from "./types";
+export type D1MethodStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+};
+export declare class D1MethodStore implements MethodStore {
+    #private;
+    constructor(opts: D1MethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/d1/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/method-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAInC,IAAI,EAAE,oBAAoB;IAKhC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAchE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAuB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAelB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAezB"}