@_mustachio/openauth 0.9.1 → 0.10.0

package/dist/types/adapters/postgres/config-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Postgres `ConfigStore`. JSONB blob keyed by tenant id. Invalidation hook
+ * fires on every `putTenantConfig` so any in-process cache built on top of
+ * this adapter drops the stale value before the write resolves.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { PostgresExecutor } from "./executor";
+export type PostgresConfigStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: PostgresConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/postgres/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/config-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,mBAAoB,YAAW,WAAW;;gBAKzC,IAAI,EAAE,0BAA0B;IAKtC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAqB5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/postgres/executor.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Thin SQL-executor interface the Postgres adapters depend on.
+ *
+ * Both the production `postgres` (porsager/postgres) driver and the embedded
+ * `@electric-sql/pglite` test driver fit behind this shape. Adapters never
+ * import either driver directly — users wire one of the `from*` helpers
+ * below.
+ */
+/** One row of a SQL result, addressed by column name. */
+export type Row = Record<string, unknown>;
+/**
+ * Minimal Postgres-shaped executor. Positional `$1, $2` parameters; rows are
+ * column-name keyed objects.
+ */
+export type PostgresExecutor = {
+    query<T extends Row = Row>(sql: string, params?: ReadonlyArray<unknown>): Promise<{
+        rows: T[];
+    }>;
+};
+/**
+ * Wrap a porsager/postgres `Sql` instance in the `PostgresExecutor` shape.
+ * The adapter calls `sql.unsafe(text, params)` so positional binds work.
+ *
+ * @example
+ *   import postgres from "postgres"
+ *   import { fromPostgresJs, PostgresTokenStore } from "@_mustachio/openauth/adapters/postgres"
+ *   const sql = postgres(process.env.DATABASE_URL!)
+ *   const exec = fromPostgresJs(sql)
+ *   const store = new PostgresTokenStore({ exec, keyStore })
+ */
+export declare function fromPostgresJs(sql: PostgresJsLike): PostgresExecutor;
+/** Minimal shape we use from porsager/postgres — kept untyped to avoid a runtime import. */
+export type PostgresJsLike = {
+    unsafe: (text: string, params: unknown[]) => Promise<unknown>;
+};
+/**
+ * Wrap a PGlite instance in the `PostgresExecutor` shape. Used by the
+ * port-conformance suite to run the Postgres adapters in-process without a
+ * server.
+ */
+export declare function fromPGlite(db: PGliteLike): PostgresExecutor;
+/** Minimal shape we use from @electric-sql/pglite. */
+export type PGliteLike = {
+    query: <T extends Row = Row>(sql: string, params?: unknown[]) => Promise<{
+        rows: T[];
+    }>;
+};
+//# sourceMappingURL=executor.d.ts.map

package/dist/types/adapters/postgres/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,yDAAyD;AACzD,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEzC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EACvB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAC1B,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,gBAAgB,CAWpE;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,UAAU,GAAG,gBAAgB,CAU3D;AAED,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EACzB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,KACf,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAC5B,CAAA"}

package/dist/types/adapters/postgres/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Postgres adapter set.
+ *
+ * Suitable for Node + Postgres deployments. Satisfies every contract in
+ * `ports/CONSISTENCY.md` — `consumeCode` / `consumeFlow` use
+ * `DELETE … RETURNING` for atomic single-winner CAS, `consumeRefresh` uses
+ * `UPDATE … WHERE consumed_at IS NULL RETURNING payload`, and `KeyStore`
+ * persists JWK material in JSONB columns.
+ *
+ * @example
+ *   import postgres from "postgres"
+ *   import {
+ *     fromPostgresJs,
+ *     migrate,
+ *     PostgresTokenStore,
+ *     PostgresSessionStore,
+ *     PostgresKeyStore,
+ *     PostgresConfigStore,
+ *     PostgresMethodStore,
+ *     PostgresAuditLog,
+ *   } from "@_mustachio/openauth/adapters/postgres"
+ *
+ *   const sql = postgres(process.env.DATABASE_URL!)
+ *   const exec = fromPostgresJs(sql)
+ *   await migrate(exec)
+ *   const keyStore = new PostgresKeyStore({ exec })
+ *   const tokenStore = new PostgresTokenStore({ exec, keyStore })
+ *   // ...
+ */
+export { fromPGlite, fromPostgresJs, type PGliteLike, type PostgresExecutor, type PostgresJsLike, type Row, } from "./executor";
+export { INITIAL_SCHEMA_SQL, migrate } from "./migrations";
+export { PostgresAuditLog, type PostgresAuditLogOptions } from "./audit-log";
+export { PostgresConfigStore, type PostgresConfigStoreOptions, } from "./config-store";
+export { PostgresKeyStore, type PostgresKeyStoreOptions } from "./key-store";
+export { PostgresMethodStore, type PostgresMethodStoreOptions, } from "./method-store";
+export { PostgresSessionStore, type PostgresSessionStoreOptions, } from "./session-store";
+export { PostgresTokenStore, type PostgresTokenStoreOptions, } from "./token-store";
+export { PostgresPasskeyCredentialStore, type PostgresPasskeyCredentialStoreOptions, } from "./passkey-credential-store";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/postgres/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,GAAG,GACT,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,KAAK,qCAAqC,GAC3C,MAAM,4BAA4B,CAAA"}

package/dist/types/adapters/postgres/key-store.d.ts

@@ -0,0 +1,23 @@
+import type { EncryptionKey, KeyStore, KeyWrapper, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { PostgresExecutor } from "./executor";
+export type PostgresKeyStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+    /**
+     * Optional envelope that encrypts private JWKs and encryption-key bytes
+     * before they leave the process. STRONGLY RECOMMENDED in production.
+     * Pair with a cloud KMS or HSM-backed implementation.
+     */
+    wrapper?: KeyWrapper;
+};
+export declare class PostgresKeyStore implements KeyStore {
+    #private;
+    constructor(opts: PostgresKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/postgres/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/key-store.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,EACX,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB,CAAA;AAED,qBAAa,gBAAiB,YAAW,QAAQ;;gBAQnC,IAAI,EAAE,uBAAuB;IAOnC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAchD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAS5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAatD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CA2KpE"}

package/dist/types/adapters/postgres/method-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Postgres `MethodStore`. `(tenant_id, method_id)` composite key, JSONB
+ * `config` column for the method-config blob.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { PostgresExecutor } from "./executor";
+export type PostgresMethodStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresMethodStore implements MethodStore {
+    #private;
+    constructor(opts: PostgresMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/postgres/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/method-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,mBAAoB,YAAW,WAAW;;gBAIzC,IAAI,EAAE,0BAA0B;IAKtC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAahE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAsB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAelB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAazB"}

package/dist/types/adapters/postgres/migrations.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Postgres schema for the IdP adapters. One migration; future schema changes
+ * append new migrations and a small migrate-from-version routine.
+ *
+ * Tables are prefixed `openauth_` so the IdP can share a database with the
+ * application that consumes it. The schema is intentionally narrow — JSONB
+ * blobs carry the bulk of the data (auth-code ciphertext, refresh payload,
+ * tenant config) so that adding fields in later phases is non-breaking.
+ *
+ * Timestamps are `bigint` (epoch ms) rather than `timestamptz` so that the
+ * adapter's injectable clock works seamlessly in tests and so that
+ * comparisons are simple integer math.
+ */
+import type { PostgresExecutor } from "./executor";
+export declare const INITIAL_SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS openauth_tenants (\n  id text PRIMARY KEY,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_methods (\n  tenant_id text NOT NULL,\n  method_id text NOT NULL,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, method_id)\n);\n\nCREATE TABLE IF NOT EXISTS openauth_signing_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  crv text,\n  public_jwk jsonb NOT NULL,\n  private_jwk jsonb NOT NULL,\n  private_jwk_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_signing_keys\n  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_encryption_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  key_material bytea NOT NULL,\n  key_material_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_encryption_keys\n  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_codes (\n  code text PRIMARY KEY,\n  ciphertext text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_refresh_tokens (\n  token text PRIMARY KEY,\n  tenant_id text NOT NULL,\n  client_id text NOT NULL,\n  subject_id text NOT NULL,\n  family text NOT NULL,\n  expires_at bigint NOT NULL,\n  consumed_at bigint,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_refresh_family_idx\n  ON openauth_refresh_tokens (family);\nCREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx\n  ON openauth_refresh_tokens (tenant_id, subject_id);\n\nCREATE TABLE IF NOT EXISTS openauth_flows (\n  flow_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_sessions (\n  session_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_audit_events (\n  id bigserial PRIMARY KEY,\n  ts bigint NOT NULL,\n  kind text NOT NULL,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_audit_kind_idx\n  ON openauth_audit_events (kind);\nCREATE INDEX IF NOT EXISTS openauth_audit_ts_idx\n  ON openauth_audit_events (ts);\n\nCREATE TABLE IF NOT EXISTS openauth_passkey_credentials (\n  tenant_id text NOT NULL,\n  credential_id text NOT NULL,\n  user_id text NOT NULL,\n  public_key text NOT NULL,\n  counter bigint NOT NULL DEFAULT 0,\n  transports jsonb,\n  created_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, credential_id)\n);\nCREATE INDEX IF NOT EXISTS openauth_passkey_user_idx\n  ON openauth_passkey_credentials (tenant_id, user_id);\n";
+/**
+ * Apply the initial schema. Idempotent — uses `CREATE TABLE IF NOT EXISTS`.
+ * Deployments using a real migration tool can apply the SQL above directly
+ * and skip this helper.
+ */
+export declare function migrate(exec: PostgresExecutor): Promise<void>;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/types/adapters/postgres/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,kBAAkB,mwFAmG9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE"}

package/dist/types/adapters/postgres/passkey-credential-store.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Postgres `PasskeyCredentialStore`.
+ *
+ * Schema (created by `migrate()` in `./migrations.ts`):
+ *
+ *   openauth_passkey_credentials
+ *     tenant_id   text  NOT NULL
+ *     credential_id text NOT NULL
+ *     user_id     text  NOT NULL
+ *     public_key  text  NOT NULL
+ *     counter     bigint NOT NULL DEFAULT 0
+ *     transports  jsonb
+ *     created_at  bigint NOT NULL
+ *     PRIMARY KEY (tenant_id, credential_id)
+ *     INDEX (tenant_id, user_id)   -- findByUsername path
+ *
+ * The reference adapter treats `userId` as the username lookup key —
+ * matching the bundled `passkeyMethod` which sets `userId =
+ * parsed.data.username` at registration. Hosts that want a separate
+ * username dimension implement `PasskeyCredentialStore` directly
+ * against their own user table.
+ */
+import type { PasskeyCredentialStore, StoredCredential } from "../../methods/passkey";
+import type { PostgresExecutor } from "./executor";
+export type PostgresPasskeyCredentialStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresPasskeyCredentialStore implements PasskeyCredentialStore {
+    #private;
+    constructor(opts: PostgresPasskeyCredentialStoreOptions);
+    findByUsername(username: string, tenantId: string): Promise<{
+        userId: string;
+        credentials: StoredCredential[];
+    } | null>;
+    findById(credentialId: string, tenantId: string): Promise<StoredCredential | null>;
+    updateCounter(input: {
+        credentialId: string;
+        counter: number;
+        tenantId: string;
+    }): Promise<void>;
+    create(input: {
+        userId: string;
+        credential: StoredCredential;
+        tenantId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=passkey-credential-store.d.ts.map

package/dist/types/adapters/postgres/passkey-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/passkey-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAUD,qBAAa,8BAA+B,YAAW,sBAAsB;;gBAI/D,IAAI,EAAE,qCAAqC;IAKjD,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAchE,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAY7B,aAAa,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IASX,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBlB"}

package/dist/types/adapters/postgres/session-store.d.ts

@@ -0,0 +1,20 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { PostgresExecutor } from "./executor";
+export type PostgresSessionStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresSessionStore implements SessionStore {
+    #private;
+    constructor(opts: PostgresSessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/postgres/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,oBAAqB,YAAW,YAAY;;gBAI3C,IAAI,EAAE,2BAA2B;IAKvC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA6BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA4BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}

package/dist/types/adapters/postgres/token-store.d.ts

@@ -0,0 +1,30 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { PostgresExecutor } from "./executor";
+export type PostgresTokenStoreOptions = {
+    exec: PostgresExecutor;
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    /** Injectable clock — defaults to `Date.now`. Tests advance it. */
+    clock?: () => number;
+};
+export declare class PostgresTokenStore implements TokenStore {
+    #private;
+    constructor(opts: PostgresTokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/postgres/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/token-store.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,gBAAgB,CAAA;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,kBAAmB,YAAW,UAAU;;gBAIvC,IAAI,EAAE,yBAAyB;IAKrC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAyBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IA6EjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAyBlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAYzB"}

package/dist/types/client.d.ts

@@ -1,4 +1,4 @@
-import { SubjectSchema } from "./subject.js";
+import type { SubjectSchema } from "./types/subject";
 import type { v1 } from "@standard-schema/spec";
 import { InvalidAccessTokenError, InvalidAuthorizationCodeError, InvalidRefreshTokenError } from "./error.js";
 /**

package/dist/types/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA0MvD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA4OvD"}

package/dist/types/domain/audit.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Shared `safeAudit` helper — every domain module that emits audit
+ * events used to keep its own private `audit(...)` wrapper around
+ * `auditLog.log(event)` that silently swallowed any thrown error. The
+ * intent (per `ports/audit-log.ts`) is that audit emission must not
+ * derail the OAuth hot path, but operators have no signal when the
+ * pipeline goes down.
+ *
+ * Until the Logger port lands in Phase 8, durability failures here
+ * surface via `console.error` with a discriminating prefix. The Logger
+ * port will replace this single helper — the call sites stay put.
+ */
+import type { AuditLog } from "../ports/audit-log";
+export declare function safeAudit(deps: {
+    auditLog?: AuditLog;
+}, event: Parameters<AuditLog["log"]>[0]): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/types/domain/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/domain/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAElD,wBAAsB,SAAS,CAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,EAC7B,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/types/domain/authorize.d.ts

@@ -0,0 +1,125 @@
+/**
+ * `startAuthorize` — orchestrate the `/authorize` flow.
+ *
+ * Pure domain function over typed ports. The HTTP layer (Phase 3) parses
+ * the incoming `Request` into an `AuthorizationRequest`, runs
+ * `resolveTenant`, then calls into this function. No framework imports.
+ *
+ * Responsibilities (in order):
+ *   1. Validate the request against the registered `ClientConfig` —
+ *      client lookup, redirect-URI exact match, scope subset, PKCE
+ *      required-when-required.
+ *   2. Pick the method to dispatch to: explicit `methodId` if present,
+ *      else the only enabled method, else surface a method-selection
+ *      output for the UI.
+ *   3. Atomically `saveFlow` the `FlowRecord` (creates the
+ *      pre-callback state) under a freshly minted `flowId`.
+ *   4. Mint the MAC-signed `state` envelope under the active key.
+ *   5. Dispatch to the method's `GET /authorize` handler — the method
+ *      builds the upstream redirect (or renders the credential form,
+ *      etc.) using the `dispatch.state` / `dispatch.callbackUrl` data
+ *      we supply.
+ *   6. Translate the `MethodResult` into an `AuthorizeOutput`:
+ *      `challenge` (HTTP layer renders), `success` (HTTP layer issues a
+ *      code immediately — e.g. single-step credential flows), `denied`
+ *      (OAuth `access_denied`), `error` (propagated).
+ *
+ * The framework writes / consumes `FlowRecord`. Methods read via
+ * `MethodContext.flow` / `methodState` and request state changes via
+ * `MethodResult.challenge.saveMethodState`.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { KeyStore } from "../ports/key-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import type { AuthError } from "../types/error";
+import type { AuthorizationRequest } from "../types/authorization";
+import type { AnyAuthMethodFactory, SetCookie, CachePolicy } from "../types/method";
+import type { Result } from "../types/result";
+import type { StateKeyRing, TenantContext } from "../types/tenant";
+import { MethodCache } from "./method-cache";
+/** Default 10-minute pre-callback flow lifetime per plan §"TTLs". */
+export declare const DEFAULT_FLOW_TTL_MS: number;
+/**
+ * Auth-code lifetime per OAuth 2.1 BCP (`draft-ietf-oauth-v2-1-13` §4.1.3):
+ * the framework issues codes with this exact TTL, and every `TokenStore`
+ * adapter rejects `saveCode` calls whose `ttl` exceeds it. Treated as
+ * both the canonical default and the hard ceiling — there is no
+ * separate "max" knob.
+ */
+export declare const AUTH_CODE_TTL_MS: number;
+export type AuthorizeOutput = 
+/**
+ * Render the method's challenge (UI / redirect). HTTP layer applies
+ * cookies. `flowId` is exposed so the HTTP layer can stamp the
+ * framework's `idp.flow` cookie — used by credential POSTs (`/m/...`)
+ * to identify the in-flight flow without trusting form input, and as
+ * defense-in-depth for the OAuth callback path.
+ */
+{
+    kind: "challenge";
+    response: Response;
+    setCookies: SetCookie[];
+    flowId: string;
+    cache?: CachePolicy;
+}
+/**
+ * Method returned synchronous success (e.g. single-step credential flow).
+ * The framework has minted an auth code; HTTP layer 302s back to the RP
+ * with `code` + `state` in the query.
+ */
+ | {
+    kind: "issue-code";
+    code: string;
+    appRedirectUri: string;
+    appState: string | null;
+}
+/** Method denied — surface `access_denied` per OAuth 2.1. */
+ | {
+    kind: "denied";
+    reason: string;
+    setCookies: SetCookie[];
+}
+/**
+ * No `methodId` given and >1 enabled methods configured. HTTP layer
+ * renders a selection page that re-requests `/authorize?methodId=…`.
+ */
+ | {
+    kind: "select-method";
+    methods: Array<{
+        id: string;
+        kind: string;
+        type: string;
+    }>;
+};
+export type StartAuthorizeInput = {
+    request: AuthorizationRequest;
+    /** The raw `Request` — handed to the method via `MethodContext.request`. */
+    rawRequest: Request;
+    tenant: TenantContext;
+    cookies: ReadonlyMap<string, string>;
+};
+export type StartAuthorizeDeps = {
+    sessionStore: SessionStore;
+    tokenStore: TokenStore;
+    /** Needed for at-rest encryption of the code payload — see `domain/token.ts`. */
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    stateKeys: StateKeyRing;
+    /** Issuer URL — used to build the callback URL and threaded to methods. */
+    issuerUrl: string;
+    /** Tenant-partitioned callback host helper. Optional (recovery mechanism #2). */
+    callbackHostFor?: (tenantId: string) => string;
+    clock: () => number;
+    /** Override for testability. Defaults to `randomId` / `randomToken`. */
+    newFlowId?: () => string;
+    newCodeId?: () => string;
+    newNonce?: () => string;
+    /** Override TTLs. */
+    flowTtlMs?: number;
+};
+export declare function startAuthorize(input: StartAuthorizeInput, deps: StartAuthorizeDeps): Promise<Result<AuthorizeOutput, AuthError>>;
+/** Factory map type — exported for HTTP-layer consumers. */
+export type FactoryMap = Record<string, AnyAuthMethodFactory>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/types/domain/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAK5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAmI7C;AAuID,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}

package/dist/types/domain/callback.d.ts

@@ -0,0 +1,70 @@
+/**
+ * `handleCallback` — process the upstream provider's redirect back to the
+ * IdP. The framework:
+ *
+ *   1. Recovers `(tenantId, flowId)` from the MAC-bound `state` envelope.
+ *   2. Atomically `consumeFlow(flowId)` — single delete-on-read, returns
+ *      the full `FlowRecord`.
+ *   3. Runs the **state-flow consistency check** (tenant, nonce, host,
+ *      path). Any mismatch → `invalid_request` + corresponding audit.
+ *   4. Loads tenant config + resolves the method via `MethodCache`.
+ *   5. Dispatches the method's `GET /callback` handler.
+ *   6. On `success`, snapshots the in-memory `FlowRecord` into the
+ *      auth-code payload via `TokenStore.saveCode` and returns
+ *      `issue-code`. `methodState` is NOT snapshotted.
+ *
+ * Phase 2 implements the `mac-state` recovery only. Recovery mechanisms
+ * #2 (partitioned-host) and #3 (`flowId`-in-URI) are wired in Phase 3
+ * alongside the HTTP layer that knows the request's host / path /
+ * registered redirect URIs.
+ */
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import type { AuditLog } from "../ports/audit-log";
+import type { AuthError } from "../types/error";
+import type { SetCookie, CachePolicy } from "../types/method";
+import type { Result } from "../types/result";
+import type { StateKeyRing } from "../types/tenant";
+import { MethodCache } from "./method-cache";
+export type CallbackOutput = {
+    kind: "issue-code";
+    code: string;
+    appRedirectUri: string;
+    appState: string | null;
+} | {
+    kind: "challenge";
+    response: Response;
+    setCookies: SetCookie[];
+    cache?: CachePolicy;
+} | {
+    kind: "denied";
+    reason: string;
+    setCookies: SetCookie[];
+};
+export type HandleCallbackInput = {
+    /** The raw `Request` for the upstream provider's redirect. */
+    rawRequest: Request;
+    cookies: ReadonlyMap<string, string>;
+};
+export type HandleCallbackDeps = {
+    configStore: ConfigStore;
+    sessionStore: SessionStore;
+    tokenStore: TokenStore;
+    /** Needed for at-rest encryption of the code payload — see `domain/token.ts`. */
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    stateKeys: StateKeyRing;
+    clock: () => number;
+    newCodeId?: () => string;
+    /**
+     * Build the `TenantContext.request.custom` blob. Wired through from
+     * `IdPOptions.buildCustomContext` by the HTTP layer; if absent the
+     * blob is `{}`.
+     */
+    buildCustomContext?: (req: Request) => Record<string, unknown> | Promise<Record<string, unknown>>;
+};
+export declare function handleCallback(input: HandleCallbackInput, deps: HandleCallbackDeps): Promise<Result<CallbackOutput, AuthError>>;
+//# sourceMappingURL=callback.d.ts.map

package/dist/types/domain/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAiG5C"}