@_mustachio/openauth 0.9.1 → 0.10.0

package/dist/types/methods/providers/google.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Google — OIDC (auto-discovers `https://accounts.google.com`).
+ *
+ * Default scopes: `openid email profile`. Pass `hostedDomain` to restrict
+ * to a Google Workspace domain.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    hostedDomain: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    hostedDomain?: string | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    hostedDomain?: string | undefined;
+}>;
+export declare const googleFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=google.d.ts.map

package/dist/types/methods/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/google.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;EAKV,CAAA;AAEF,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAoBvB,CAAA"}

package/dist/types/methods/providers/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Pre-configured OAuth/OIDC provider factories.
+ *
+ * Each factory is a thin wrapper over `buildOauth2Method` or
+ * `buildOidcMethod` that bakes in endpoint URLs and provider quirks.
+ * Tenants supply credentials via `MethodConfig.config`; the generic
+ * methods own the rest.
+ */
+export { googleFactory } from "./google";
+export { githubFactory } from "./github";
+export { appleFactory } from "./apple";
+export { microsoftFactory } from "./microsoft";
+export { discordFactory } from "./discord";
+export { facebookFactory } from "./facebook";
+export { linkedinFactory } from "./linkedin";
+export { slackFactory } from "./slack";
+export { spotifyFactory } from "./spotify";
+export { twitchFactory } from "./twitch";
+export { xFactory } from "./x";
+export { yahooFactory } from "./yahoo";
+export { jumpcloudFactory } from "./jumpcloud";
+export { keycloakFactory } from "./keycloak";
+export { cognitoFactory } from "./cognito";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/methods/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA"}

package/dist/types/methods/providers/jumpcloud.d.ts

@@ -0,0 +1,22 @@
+/**
+ * JumpCloud — OIDC, fully spec-compliant discovery doc.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const jumpcloudFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=jumpcloud.d.ts.map

package/dist/types/methods/providers/jumpcloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jumpcloud.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/jumpcloud.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,gBAAgB,EAAE,iBAAiB,CAC9C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAiBvB,CAAA"}

package/dist/types/methods/providers/keycloak.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Keycloak — OIDC, per-realm. Issuer is templated from `baseUrl` + `realm`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    /** Keycloak base URL, e.g. `https://auth.example.com`. */
+    baseUrl: z.ZodString;
+    /** Realm name, e.g. `"acme"`. */
+    realm: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    baseUrl: string;
+    realm: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    baseUrl: string;
+    realm: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const keycloakFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=keycloak.d.ts.map

package/dist/types/methods/providers/keycloak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/keycloak.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;IAGV,0DAA0D;;IAE1D,iCAAiC;;;;;;;;;;;;;;;EAGjC,CAAA;AAEF,eAAO,MAAM,eAAe,EAAE,iBAAiB,CAC7C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAmBvB,CAAA"}

package/dist/types/methods/providers/linkedin.d.ts

@@ -0,0 +1,22 @@
+/**
+ * LinkedIn — OAuth 2.0. Default scopes: `r_liteprofile r_emailaddress`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const linkedinFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=linkedin.d.ts.map

package/dist/types/methods/providers/linkedin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/linkedin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,eAAe,EAAE,iBAAiB,CAC7C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/microsoft.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Microsoft — OIDC, tenant-templated. The `tenant` field is `"common"`,
+ * `"organizations"`, `"consumers"`, or a specific Entra tenant id /
+ * domain.
+ *
+ * Discovery is fetched per tenant; the result is cached inside the
+ * `MethodCache` so subsequent flows skip the round trip.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    tenant: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    tenant?: string | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    tenant?: string | undefined;
+}>;
+export declare const microsoftFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=microsoft.d.ts.map

package/dist/types/methods/providers/microsoft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/microsoft.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;EAKV,CAAA;AAEF,eAAO,MAAM,gBAAgB,EAAE,iBAAiB,CAC9C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAiBvB,CAAA"}

package/dist/types/methods/providers/slack.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Slack — Sign in with Slack (OpenID Connect on Slack's own endpoints).
+ * Slack ships an id_token at the token endpoint; we treat it as OIDC.
+ *
+ * Default scopes: `openid email profile`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const slackFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=slack.d.ts.map

package/dist/types/methods/providers/slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/slack.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,YAAY,EAAE,iBAAiB,CAC1C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAoBvB,CAAA"}

package/dist/types/methods/providers/spotify.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Spotify — OAuth 2.0. Default scopes: `user-read-email user-read-private`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const spotifyFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=spotify.d.ts.map

package/dist/types/methods/providers/spotify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spotify.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/spotify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,cAAc,EAAE,iBAAiB,CAC5C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/twitch.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Twitch — OAuth 2.0 (Twitch supports OIDC but uses OAuth flows by
+ * default). Default scopes: `user:read:email`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const twitchFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=twitch.d.ts.map

package/dist/types/methods/providers/twitch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twitch.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/twitch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/x.d.ts

@@ -0,0 +1,25 @@
+/**
+ * X (formerly Twitter) — OAuth 2.0 with PKCE. Default scope: `tweet.read users.read`.
+ *
+ * X requires PKCE on its OAuth 2.0 endpoints; `pkce` is left at the
+ * `"S256"` default.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const xFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=x.d.ts.map

package/dist/types/methods/providers/x.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/x.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,QAAQ,EAAE,iBAAiB,CACtC,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/yahoo.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Yahoo — OIDC. Default scopes: `openid email profile`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const yahooFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=yahoo.d.ts.map

package/dist/types/methods/providers/yahoo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yahoo.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/yahoo.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,YAAY,EAAE,iBAAiB,CAC1C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAiBvB,CAAA"}

package/dist/types/pkce.d.ts

@@ -1,7 +1,6 @@
 export declare function generatePKCE(length?: number): Promise<{
     verifier: string;
     challenge: string;
-    method: string;
+    method: "S256";
 }>;
-export declare function validatePKCE(verifier: string, challenge: string, method?: "S256" | "plain"): Promise<boolean>;
 //# sourceMappingURL=pkce.d.ts.map

package/dist/types/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/pkce.ts"],"names":[],"mappings":"AAgBA,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW;;;;GAarD;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAM,GAAG,OAAgB,oBAKlC"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/pkce.ts"],"names":[],"mappings":"AAyBA,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,CAAC,CASD"}

package/dist/types/ports/audit-log.d.ts

@@ -0,0 +1,139 @@
+/**
+ * `AuditLog` — append-only event log for security-relevant operations.
+ *
+ * Consistency: append-only, durable. Ordering across instances is **not**
+ * required; consumers (SIEM, dashboards) sort by `timestamp` and `actor`.
+ *
+ * Retention: defined by the adapter. 90 days minimum is the documented
+ * baseline for SOC 2 readiness.
+ *
+ * Audit-event payloads must **never** contain auth-code payloads, refresh
+ * tokens, access tokens, raw cookies, or any other secret. The framework's
+ * built-in events follow this rule; custom emitters must too.
+ */
+import type { TenantId } from "../types/tenant";
+/**
+ * Discriminated event union. The framework emits these; user code may emit
+ * its own with `kind: "custom"`. Each event carries enough id information
+ * for operators to find the offending record without exposing secrets.
+ */
+export type AuditEvent = {
+    kind: "authorize_started";
+    tenantId: TenantId;
+    clientId: string;
+    methodId: string;
+    methodKind: string;
+    flowId: string;
+} | {
+    kind: "authorize_succeeded";
+    tenantId: TenantId;
+    clientId: string;
+    methodId: string;
+    methodKind: string;
+    flowId: string;
+    subjectId: string;
+} | {
+    kind: "authorize_failed";
+    tenantId: TenantId | null;
+    clientId: string | null;
+    methodId?: string;
+    methodKind?: string;
+    flowId?: string;
+    reason: string;
+} | {
+    kind: "token_issued";
+    tenantId: TenantId;
+    clientId: string;
+    methodId: string;
+    methodKind: string;
+    subjectId: string;
+    /** Hash of the issued refresh token id — never the token itself. */
+    refreshTokenIdHash?: string;
+} | {
+    kind: "token_refreshed";
+    tenantId: TenantId;
+    clientId: string;
+    subjectId: string;
+    family: string;
+} | {
+    kind: "token_exchanged";
+    /** Tenant the new tokens are scoped to. */
+    tenantId: TenantId;
+    /** Tenant the subject_token was originally issued for. */
+    fromTenantId: TenantId;
+    clientId: string;
+    subjectId: string;
+    /** Fresh refresh-token family for the issued tokens. */
+    family: string;
+} | {
+    kind: "token_revoked";
+    tenantId: TenantId;
+    clientId: string | null;
+    subjectId?: string;
+    family?: string;
+    reason: string;
+} | {
+    kind: "refresh_reuse_detected";
+    tenantId: TenantId;
+    clientId: string;
+    family: string;
+} | {
+    kind: "flow_replay_attempt";
+    tenantId: TenantId | null;
+    flowId: string;
+} | {
+    kind: "flow_tenant_mismatch";
+    stateTenantId: TenantId;
+    flowTenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "flow_callback_mismatch";
+    tenantId: TenantId;
+    flowId: string;
+    expected: {
+        host: string;
+        path: string;
+    };
+    actual: {
+        host: string;
+        path: string;
+    };
+} | {
+    kind: "factory_id_mismatch";
+    tenantId: TenantId;
+    methodId: string;
+    expectedKind: string;
+    actualKind: string;
+} | {
+    kind: "invalid_method_config";
+    tenantId: TenantId;
+    methodId: string;
+    methodKind: string;
+    /** Zod error path string. Never the raw config blob. */
+    errorPath: string;
+} | {
+    kind: "unknown_method_kind";
+    tenantId: TenantId;
+    methodId: string;
+    methodKind: string;
+} | {
+    kind: "unrecoverable_flow";
+    reason: string;
+    host?: string;
+} | {
+    kind: "custom";
+    type: string;
+    tenantId?: TenantId;
+    data: Record<string, unknown>;
+};
+export type AuditLog = {
+    /**
+     * Append a single event. Should not throw on durability failure; the
+     * adapter is responsible for buffering / retry. Returning never-rejects
+     * is acceptable so the IdP's hot paths are not gated on the log.
+     */
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+};
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/ports/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}

package/dist/types/ports/config-store.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `ConfigStore` — tenant configuration lookup.
+ *
+ * Consistency contract: **eventual + bounded staleness (TTL ≤ 60 s).** This
+ * is a read-heavy, write-rare path; Cloudflare KV / read replicas are
+ * acceptable. Invalidation hook fires immediately on update so callers can
+ * drop stale entries earlier than TTL.
+ *
+ * See `ports/CONSISTENCY.md` for the full table.
+ */
+import type { Result } from "../types/result";
+import type { TenantConfig, TenantId } from "../types/tenant";
+export type ConfigStore = {
+    /**
+     * Look up a tenant's full config. Returns `tenant_not_found` if the id is
+     * unknown. Implementations should cache aggressively (TTL ≤ 60 s).
+     */
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    /**
+     * Persist (create or update) a tenant's config. Implementations must
+     * trigger invalidation of any cached value for `id` before resolving so
+     * a subsequent `getTenantConfig` returns the new value.
+     */
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    /**
+     * Optional: signal to in-process caches that a tenant's config has been
+     * invalidated externally (e.g. via the management console). Adapters that
+     * don't expose cross-process invalidation may omit this.
+     */
+    onInvalidate?(handler: (id: TenantId) => void): void;
+};
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/ports/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../src/ports/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE7D,MAAM,MAAM,WAAW,GAAG;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IAE5D;;;;OAIG;IACH,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5D;;;;OAIG;IACH,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI,CAAA;CACrD,CAAA"}

package/dist/types/ports/key-store.d.ts

@@ -0,0 +1,98 @@
+/**
+ * `KeyStore` — signing keys (JWT) and encryption keys (auth-code payload,
+ * other at-rest secrets).
+ *
+ * Per AD11, ES256 is the default signing algorithm; Ed25519 is supported.
+ *
+ * Consistency:
+ *  - `currentSigningKey` — strong (active key must be unambiguous across
+ *    the cluster).
+ *  - `signingKeys` (JWKS) — eventual OK; verifiers tolerate brief lag
+ *    during rotation.
+ *  - Encryption keys — same as signing for consistency; rotated quarterly,
+ *    old keys retained for `refreshTtl`.
+ *
+ * Note: `StateKeyRing` (HMAC keys for the `state` envelope) is **not** an
+ * abstraction over `KeyStore`. It is supplied directly via
+ * `IdPOptions.stateKeys` to avoid a bootstrap dependency on `KeyStore` for
+ * tenant resolution. A helper `loadStateKeyRingFromKeyStore` is offered
+ * for operators who choose to store the ring inside `KeyStore`.
+ */
+import type { Result } from "../types/result";
+/** Asymmetric signing key. Public material is JWKS-exposed; private is server-only. */
+export type SigningKey = {
+    kid: string;
+    /** JOSE `alg` value, e.g. `"ES256"` or `"EdDSA"`. */
+    alg: string;
+    /** JOSE `crv` for EC / OKP keys (`P-256`, `Ed25519`). Optional for other alg families. */
+    crv?: string;
+    /** JWK form of the public key — published in JWKS. */
+    publicJwk: Record<string, unknown>;
+    /**
+     * Opaque private-key handle. Concrete adapters interpret this:
+     *  - In-memory / Postgres: a serialized JWK.
+     *  - KMS-backed: a KMS key ARN / Cloudflare DO id.
+     */
+    privateKeyRef: unknown;
+    /** Status used by JWKS rotation logic. */
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    /** When this key may no longer be used to sign. Verification continues until removal. */
+    rotatedAt?: number;
+};
+/** Symmetric encryption key for the auth-code payload (and other at-rest data). */
+export type EncryptionKey = {
+    kid: string;
+    /** JOSE `alg`, e.g. `"A256GCM"`. */
+    alg: string;
+    /** Opaque key handle (raw bytes for in-memory; KMS ref for cloud). */
+    keyRef: unknown;
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    rotatedAt?: number;
+};
+/**
+ * Optional host-supplied envelope for wrapping private key material at rest.
+ *
+ * Adapters that persist signing-key private JWKs and encryption-key raw bytes
+ * to durable storage (Postgres, DynamoDB, …) accept a `KeyWrapper` so that
+ * material is encrypted with a key the database server cannot read. The
+ * canonical implementation backs `wrap` / `unwrap` with a cloud KMS
+ * (`AWS KMS Encrypt` / `Decrypt`, GCP KMS, Vault transit, etc.).
+ *
+ * Without a wrapper, `PostgresKeyStore` / `DynamoKeyStore` store private
+ * material in plaintext at rest — acceptable for dev / single-tenant
+ * operators with full-disk encryption who have accepted the trade-off, but
+ * **not** acceptable for production deployments with multi-tenant data. See
+ * `INTEGRATION.md` §4.
+ */
+export type KeyWrapper = {
+    /** Encrypt `plaintext` (≤ a few KB) under the host's master key. */
+    wrap(plaintext: Uint8Array): Promise<Uint8Array>;
+    /** Decrypt a value previously returned by `wrap`. */
+    unwrap(ciphertext: Uint8Array): Promise<Uint8Array>;
+};
+export type KeyStore = {
+    /** The unambiguous active signing key. Strong consistency. */
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    /**
+     * All keys to publish in JWKS — active + recently rotated, within the
+     * verification overlap window. Eventual consistency acceptable.
+     */
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    /** Active encryption key for at-rest payload encryption. Strong consistency. */
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    /**
+     * Look up a specific encryption key by `kid`. Used to decrypt payloads
+     * encrypted under a previous key during the overlap window.
+     */
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+    /**
+     * Rotate signing keys — promote `next` → `active`, retire current
+     * `active`, mint a new `next`. Phase 8 schedules this on a timer.
+     */
+    rotateSigningKeys?(): Promise<Result<void>>;
+    /** Same as `rotateSigningKeys` for encryption keys. Quarterly cadence. */
+    rotateEncryptionKeys?(): Promise<Result<void>>;
+};
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/ports/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../src/ports/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,uFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAA;IACX,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,0CAA0C;IAC1C,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,sEAAsE;IACtE,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,oEAAoE;IACpE,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAChD,qDAAqD;IACrD,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACpD,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,8DAA8D;IAC9D,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhD;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IAE5C,gFAAgF;IAChF,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAEtD;;;OAGG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAE7D;;;OAGG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE3C,0EAA0E;IAC1E,oBAAoB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC/C,CAAA"}