@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/esm/adapters/d1/audit-log.js

@@ -0,0 +1,15 @@
+// src/adapters/d1/audit-log.ts
+class D1AuditLog {
+  #db;
+  constructor(opts) {
+    this.#db = opts.db;
+  }
+  async log(event) {
+    try {
+      await this.#db.prepare(`INSERT INTO openauth_audit_events (ts, kind, payload) VALUES (?1, ?2, ?3)`).bind(event.timestamp, event.kind, JSON.stringify(event)).run();
+    } catch {}
+  }
+}
+export {
+  D1AuditLog
+};

package/dist/esm/adapters/d1/config-store.js

@@ -0,0 +1,45 @@
+// src/adapters/d1/config-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class D1ConfigStore {
+  #db;
+  #clock;
+  #listeners = new Set;
+  constructor(opts) {
+    this.#db = opts.db;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async getTenantConfig(id) {
+    let row;
+    try {
+      row = await this.#db.prepare(`SELECT config FROM openauth_tenants WHERE id = ?1`).bind(id).first();
+    } catch (e) {
+      return err(authError.internalError("getTenantConfig: query failed", e));
+    }
+    if (!row) {
+      return err(authError.tenantNotFound(`tenant "${id}" not found`, id));
+    }
+    return ok(JSON.parse(row.config));
+  }
+  async putTenantConfig(config) {
+    try {
+      await this.#db.prepare(`INSERT INTO openauth_tenants (id, config, updated_at) VALUES (?1, ?2, ?3)
+           ON CONFLICT(id) DO UPDATE SET config = excluded.config, updated_at = excluded.updated_at`).bind(config.id, JSON.stringify(config), this.#clock()).run();
+    } catch (e) {
+      return err(authError.internalError("putTenantConfig: insert failed", e));
+    }
+    for (const fn of this.#listeners) {
+      try {
+        fn(config.id);
+      } catch {}
+    }
+    return ok(undefined);
+  }
+  onInvalidate(handler) {
+    this.#listeners.add(handler);
+  }
+}
+export {
+  D1ConfigStore
+};

package/dist/esm/adapters/d1/index.js

@@ -0,0 +1,12 @@
+export {
+  primarySession,
+  migrate,
+  isSessionsCapable,
+  INITIAL_SCHEMA_SQL,
+  D1TokenStore,
+  D1SessionStore,
+  D1MethodStore,
+  D1KeyStore,
+  D1ConfigStore,
+  D1AuditLog
+};

package/dist/esm/adapters/d1/key-store.js

@@ -0,0 +1,116 @@
+// src/adapters/d1/key-store.ts
+import { exportJWK, generateKeyPair, importJWK } from "jose";
+import { generateSymmetricKey, randomId } from "../../domain/crypto";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import { primarySession } from "./session";
+
+class D1KeyStore {
+  #db;
+  #clock;
+  #signingAlg;
+  #privateKeyCache = new Map;
+  constructor(opts) {
+    this.#db = opts.db;
+    this.#clock = opts.clock ?? (() => Date.now());
+    this.#signingAlg = opts.signingAlg ?? "ES256";
+  }
+  async currentSigningKey() {
+    await this.#ensureSigningKey();
+    const row = await primarySession(this.#db).prepare(`SELECT kid, alg, crv, public_jwk, private_jwk, status, created_at, rotated_at
+           FROM openauth_signing_keys WHERE status = 'active' LIMIT 1`).first();
+    if (!row) {
+      return err(authError.internalError("no active signing key (should be unreachable)"));
+    }
+    return ok(await this.#hydrateSigning(row));
+  }
+  async signingKeys() {
+    await this.#ensureSigningKey();
+    const result = await primarySession(this.#db).prepare(`SELECT kid, alg, crv, public_jwk, private_jwk, status, created_at, rotated_at
+           FROM openauth_signing_keys WHERE status IN ('active','next','retired')`).all();
+    const keys = await Promise.all(result.results.map((r) => this.#hydrateSigning(r)));
+    return ok(keys);
+  }
+  async currentEncryptionKey() {
+    await this.#ensureEncryptionKey();
+    const row = await primarySession(this.#db).prepare(`SELECT kid, alg, key_material, status, created_at, rotated_at
+           FROM openauth_encryption_keys WHERE status = 'active' LIMIT 1`).first();
+    if (!row) {
+      return err(authError.internalError("no active encryption key (should be unreachable)"));
+    }
+    return ok(this.#hydrateEncryption(row));
+  }
+  async getEncryptionKey(kid) {
+    const row = await primarySession(this.#db).prepare(`SELECT kid, alg, key_material, status, created_at, rotated_at
+           FROM openauth_encryption_keys WHERE kid = ?1`).bind(kid).first();
+    if (!row) {
+      return err(authError.internalError(`encryption key "${kid}" not found`));
+    }
+    return ok(this.#hydrateEncryption(row));
+  }
+  async#ensureSigningKey() {
+    const existing = await primarySession(this.#db).prepare(`SELECT 1 AS one FROM openauth_signing_keys WHERE status = 'active' LIMIT 1`).first();
+    if (existing)
+      return;
+    const { publicKey, privateKey } = await generateKeyPair(this.#signingAlg, {
+      extractable: true
+    });
+    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = await exportJWK(privateKey);
+    const kid = randomId();
+    await primarySession(this.#db).prepare(`INSERT OR IGNORE INTO openauth_signing_keys
+           (kid, alg, crv, public_jwk, private_jwk, status, created_at)
+         VALUES (?1, ?2, ?3, ?4, ?5, 'active', ?6)`).bind(kid, this.#signingAlg, publicJwk.crv ?? null, JSON.stringify(publicJwk), JSON.stringify(privateJwk), this.#clock()).run();
+  }
+  async#ensureEncryptionKey() {
+    const existing = await primarySession(this.#db).prepare(`SELECT 1 AS one FROM openauth_encryption_keys WHERE status = 'active' LIMIT 1`).first();
+    if (existing)
+      return;
+    const kid = randomId();
+    const keyMaterial = generateSymmetricKey();
+    await primarySession(this.#db).prepare(`INSERT OR IGNORE INTO openauth_encryption_keys
+           (kid, alg, key_material, status, created_at)
+         VALUES (?1, ?2, ?3, 'active', ?4)`).bind(kid, "A256GCM", keyMaterial, this.#clock()).run();
+  }
+  async#hydrateSigning(row) {
+    let imported = this.#privateKeyCache.get(row.kid);
+    if (!imported) {
+      const privateJwk = JSON.parse(row.private_jwk);
+      imported = await importJWK(privateJwk, row.alg);
+      this.#privateKeyCache.set(row.kid, imported);
+    }
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      ...row.crv ? { crv: row.crv } : {},
+      publicJwk: JSON.parse(row.public_jwk),
+      privateKeyRef: imported,
+      status: row.status,
+      createdAt: Number(row.created_at),
+      ...row.rotated_at !== null && row.rotated_at !== undefined ? { rotatedAt: Number(row.rotated_at) } : {}
+    };
+  }
+  #hydrateEncryption(row) {
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      keyRef: ensureBytes(row.key_material),
+      status: row.status,
+      createdAt: Number(row.created_at),
+      ...row.rotated_at !== null && row.rotated_at !== undefined ? { rotatedAt: Number(row.rotated_at) } : {}
+    };
+  }
+}
+function ensureBytes(value) {
+  if (value instanceof Uint8Array)
+    return value;
+  if (value instanceof ArrayBuffer)
+    return new Uint8Array(value);
+  if (value && typeof value === "object" && "data" in value) {
+    return new Uint8Array(value.data);
+  }
+  throw new Error("D1KeyStore: unsupported BLOB representation");
+}
+export {
+  D1KeyStore
+};

package/dist/esm/adapters/d1/method-store.js

@@ -0,0 +1,52 @@
+// src/adapters/d1/method-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class D1MethodStore {
+  #db;
+  #clock;
+  constructor(opts) {
+    this.#db = opts.db;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async listMethods(tenantId) {
+    try {
+      const result = await this.#db.prepare(`SELECT config FROM openauth_methods WHERE tenant_id = ?1 ORDER BY method_id`).bind(tenantId).all();
+      return ok(result.results.map((r) => JSON.parse(r.config)));
+    } catch (e) {
+      return err(authError.internalError("listMethods: query failed", e));
+    }
+  }
+  async getMethodConfig(tenantId, methodId) {
+    let row;
+    try {
+      row = await this.#db.prepare(`SELECT config FROM openauth_methods WHERE tenant_id = ?1 AND method_id = ?2`).bind(tenantId, methodId).first();
+    } catch (e) {
+      return err(authError.internalError("getMethodConfig: query failed", e));
+    }
+    if (!row) {
+      return err(authError.methodNotFound(`method "${methodId}" not found for tenant "${tenantId}"`, { methodId }));
+    }
+    return ok(JSON.parse(row.config));
+  }
+  async putMethodConfig(tenantId, method) {
+    try {
+      await this.#db.prepare(`INSERT INTO openauth_methods (tenant_id, method_id, config, updated_at) VALUES (?1, ?2, ?3, ?4)
+           ON CONFLICT(tenant_id, method_id) DO UPDATE SET config = excluded.config, updated_at = excluded.updated_at`).bind(tenantId, method.id, JSON.stringify(method), this.#clock()).run();
+    } catch (e) {
+      return err(authError.internalError("putMethodConfig: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async deleteMethodConfig(tenantId, methodId) {
+    try {
+      await this.#db.prepare(`DELETE FROM openauth_methods WHERE tenant_id = ?1 AND method_id = ?2`).bind(tenantId, methodId).run();
+    } catch (e) {
+      return err(authError.internalError("deleteMethodConfig: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+export {
+  D1MethodStore
+};

package/dist/esm/adapters/d1/migrations.js

@@ -0,0 +1,77 @@
+// src/adapters/d1/migrations.ts
+var INITIAL_SCHEMA_SQL = [
+  `CREATE TABLE IF NOT EXISTS openauth_tenants (
+    id TEXT PRIMARY KEY,
+    config TEXT NOT NULL,
+    updated_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_methods (
+    tenant_id TEXT NOT NULL,
+    method_id TEXT NOT NULL,
+    config TEXT NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (tenant_id, method_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_signing_keys (
+    kid TEXT PRIMARY KEY,
+    alg TEXT NOT NULL,
+    crv TEXT,
+    public_jwk TEXT NOT NULL,
+    private_jwk TEXT NOT NULL,
+    status TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    rotated_at INTEGER
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_encryption_keys (
+    kid TEXT PRIMARY KEY,
+    alg TEXT NOT NULL,
+    key_material BLOB NOT NULL,
+    status TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    rotated_at INTEGER
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_codes (
+    code TEXT PRIMARY KEY,
+    ciphertext TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_refresh_tokens (
+    token TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    client_id TEXT NOT NULL,
+    subject_id TEXT NOT NULL,
+    family TEXT NOT NULL,
+    expires_at INTEGER NOT NULL,
+    consumed_at INTEGER,
+    payload TEXT NOT NULL
+  )`,
+  `CREATE INDEX IF NOT EXISTS openauth_refresh_family_idx ON openauth_refresh_tokens (family)`,
+  `CREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx ON openauth_refresh_tokens (tenant_id, subject_id)`,
+  `CREATE TABLE IF NOT EXISTS openauth_flows (
+    flow_id TEXT PRIMARY KEY,
+    payload TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_sessions (
+    session_id TEXT PRIMARY KEY,
+    payload TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS openauth_audit_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ts INTEGER NOT NULL,
+    kind TEXT NOT NULL,
+    payload TEXT NOT NULL
+  )`,
+  `CREATE INDEX IF NOT EXISTS openauth_audit_kind_idx ON openauth_audit_events (kind)`,
+  `CREATE INDEX IF NOT EXISTS openauth_audit_ts_idx ON openauth_audit_events (ts)`
+];
+async function migrate(db) {
+  for (const stmt of INITIAL_SCHEMA_SQL) {
+    await db.prepare(stmt).run();
+  }
+}
+export {
+  migrate,
+  INITIAL_SCHEMA_SQL
+};

package/dist/esm/adapters/d1/session-store.js

@@ -0,0 +1,134 @@
+// src/adapters/d1/session-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import { primarySession } from "./session";
+
+class D1SessionStore {
+  #db;
+  #clock;
+  constructor(opts) {
+    this.#db = opts.db;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async saveFlow(flowId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`));
+    }
+    const expiresAt = this.#clock() + ttl;
+    try {
+      await primarySession(this.#db).prepare(`INSERT INTO openauth_flows (flow_id, payload, expires_at) VALUES (?1, ?2, ?3)`).bind(flowId, JSON.stringify(payload), expiresAt).run();
+    } catch (e) {
+      return err(authError.internalError("saveFlow: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async updateFlowMethodState(flowId, methodState) {
+    const now = this.#clock();
+    const session = primarySession(this.#db);
+    let row;
+    try {
+      row = await session.prepare(`SELECT payload, expires_at FROM openauth_flows WHERE flow_id = ?1`).bind(flowId).first();
+    } catch (e) {
+      return err(authError.internalError("updateFlowMethodState: read failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (now >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(row.payload);
+    } catch (e) {
+      return err(authError.internalError("updateFlowMethodState: parse failed", e));
+    }
+    const next = { ...parsed, methodState };
+    try {
+      const result = await session.prepare(`UPDATE openauth_flows SET payload = ?1
+            WHERE flow_id = ?2 AND expires_at > ?3
+            RETURNING 1 AS hit`).bind(JSON.stringify(next), flowId, now).first();
+      if (!result) {
+        return err(authError.unknownState(`flow "${flowId}" unknown or expired`));
+      }
+    } catch (e) {
+      return err(authError.internalError("updateFlowMethodState: update failed", e));
+    }
+    return ok(undefined);
+  }
+  async readFlow(flowId) {
+    let row;
+    try {
+      row = await primarySession(this.#db).prepare(`SELECT payload, expires_at FROM openauth_flows WHERE flow_id = ?1`).bind(flowId).first();
+    } catch (e) {
+      return err(authError.internalError("readFlow: query failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await primarySession(this.#db).prepare(`DELETE FROM openauth_flows WHERE flow_id = ?1`).bind(flowId).run();
+      } catch {}
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(JSON.parse(row.payload));
+  }
+  async consumeFlow(flowId) {
+    let row;
+    try {
+      row = await primarySession(this.#db).prepare(`DELETE FROM openauth_flows WHERE flow_id = ?1 RETURNING payload, expires_at`).bind(flowId).first();
+    } catch (e) {
+      return err(authError.internalError("consumeFlow: query failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown or already consumed`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(JSON.parse(row.payload));
+  }
+  async createSession(sessionId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`createSession: ttl must be positive, got ${ttl}`));
+    }
+    const expiresAt = this.#clock() + ttl;
+    try {
+      await primarySession(this.#db).prepare(`INSERT INTO openauth_sessions (session_id, payload, expires_at) VALUES (?1, ?2, ?3)
+           ON CONFLICT(session_id) DO UPDATE SET payload = excluded.payload, expires_at = excluded.expires_at`).bind(sessionId, JSON.stringify(payload), expiresAt).run();
+    } catch (e) {
+      return err(authError.internalError("createSession: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async readSession(sessionId) {
+    let row;
+    try {
+      row = await primarySession(this.#db).prepare(`SELECT payload, expires_at FROM openauth_sessions WHERE session_id = ?1`).bind(sessionId).first();
+    } catch (e) {
+      return err(authError.internalError("readSession: query failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await primarySession(this.#db).prepare(`DELETE FROM openauth_sessions WHERE session_id = ?1`).bind(sessionId).run();
+      } catch {}
+      return err(authError.invalidRequest(`session "${sessionId}" expired`));
+    }
+    return ok(JSON.parse(row.payload));
+  }
+  async revokeSession(sessionId) {
+    try {
+      await primarySession(this.#db).prepare(`DELETE FROM openauth_sessions WHERE session_id = ?1`).bind(sessionId).run();
+    } catch (e) {
+      return err(authError.internalError("revokeSession: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+export {
+  D1SessionStore
+};

package/dist/esm/adapters/d1/session.js

@@ -0,0 +1,18 @@
+// src/adapters/d1/session.ts
+function isSessionsCapable(db) {
+  return typeof db.withSession === "function";
+}
+function primarySession(db) {
+  if (isSessionsCapable(db)) {
+    return db.withSession("first-primary");
+  }
+  return {
+    prepare: (q) => db.prepare(q),
+    batch: (s) => db.batch(s),
+    getBookmark: () => null
+  };
+}
+export {
+  primarySession,
+  isSessionsCapable
+};

package/dist/esm/adapters/d1/token-store.js

@@ -0,0 +1,140 @@
+// src/adapters/d1/token-store.ts
+import { AUTH_CODE_TTL_MS } from "../../domain/authorize";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import { primarySession } from "./session";
+
+class D1TokenStore {
+  #db;
+  #clock;
+  constructor(opts) {
+    this.#db = opts.db;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async saveCode(code, ciphertext, ttl) {
+    if (ttl <= 0 || ttl > AUTH_CODE_TTL_MS) {
+      return err(authError.internalError(`saveCode: ttl ${ttl} outside (0, ${AUTH_CODE_TTL_MS}] (auth-code TTL is fixed at 60s by OAuth 2.1 BCP)`));
+    }
+    const expiresAt = this.#clock() + ttl;
+    try {
+      await primarySession(this.#db).prepare(`INSERT INTO openauth_codes (code, ciphertext, expires_at) VALUES (?1, ?2, ?3)`).bind(code, ciphertext, expiresAt).run();
+    } catch (e) {
+      return err(authError.internalError("saveCode: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async consumeCode(code) {
+    let row;
+    try {
+      row = await primarySession(this.#db).prepare(`DELETE FROM openauth_codes WHERE code = ?1 RETURNING ciphertext, expires_at`).bind(code).first();
+    } catch (e) {
+      return err(authError.internalError("consumeCode: query failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidGrant("auth code unknown or already consumed"));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.invalidGrant("auth code expired"));
+    }
+    return ok(row.ciphertext);
+  }
+  async saveRefresh(refresh, payload) {
+    try {
+      await primarySession(this.#db).prepare(`INSERT INTO openauth_refresh_tokens
+             (token, tenant_id, client_id, subject_id, family, expires_at, payload)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)`).bind(refresh, payload.tenantId, payload.clientId, payload.subjectId, payload.family, payload.expiresAt, JSON.stringify(payload)).run();
+    } catch (e) {
+      return err(authError.internalError("saveRefresh: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async consumeRefresh(refresh, options = {}) {
+    const reuseWindow = options.reuseWindowMs ?? 60000;
+    const now = this.#clock();
+    const session = primarySession(this.#db);
+    let claimed;
+    try {
+      claimed = await session.prepare(`UPDATE openauth_refresh_tokens
+             SET consumed_at = ?1
+           WHERE token = ?2
+             AND consumed_at IS NULL
+             AND expires_at > ?1
+           RETURNING payload`).bind(now, refresh).first();
+    } catch (e) {
+      return err(authError.internalError("consumeRefresh: claim failed", e));
+    }
+    if (claimed) {
+      return ok(parseRefresh(claimed.payload));
+    }
+    let existing;
+    try {
+      existing = await session.prepare(`SELECT consumed_at, expires_at, payload
+             FROM openauth_refresh_tokens
+            WHERE token = ?1`).bind(refresh).first();
+    } catch (e) {
+      return err(authError.internalError("consumeRefresh: lookup failed", e));
+    }
+    if (!existing) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (existing.consumed_at !== null && existing.consumed_at !== undefined) {
+      const consumedAt = Number(existing.consumed_at);
+      const withinWindow = now - consumedAt <= reuseWindow;
+      if (withinWindow) {
+        const payload = parseRefresh(existing.payload);
+        await this.revokeFamily(payload.family);
+        return err(authError.invalidGrant(`refresh token reuse detected (family=${payload.family})`, {
+          family: payload.family,
+          tenantId: payload.tenantId,
+          subjectId: payload.subjectId
+        }));
+      }
+      return err(authError.invalidGrant("refresh token already consumed"));
+    }
+    if (now >= Number(existing.expires_at)) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    return err(authError.internalError("consumeRefresh: unexplained miss"));
+  }
+  async peekRefresh(refresh) {
+    let row;
+    try {
+      row = await primarySession(this.#db).prepare(`SELECT expires_at, payload
+             FROM openauth_refresh_tokens
+            WHERE token = ?1`).bind(refresh).first();
+    } catch (e) {
+      return err(authError.internalError("peekRefresh: lookup failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    return ok(parseRefresh(row.payload));
+  }
+  async revokeFamily(family) {
+    try {
+      await primarySession(this.#db).prepare(`DELETE FROM openauth_refresh_tokens WHERE family = ?1`).bind(family).run();
+    } catch (e) {
+      return err(authError.internalError("revokeFamily: delete failed", e));
+    }
+    return ok(undefined);
+  }
+  async revokeBySubject(tenantId, subjectId) {
+    try {
+      await primarySession(this.#db).prepare(`DELETE FROM openauth_refresh_tokens WHERE tenant_id = ?1 AND subject_id = ?2`).bind(tenantId, subjectId).run();
+    } catch (e) {
+      return err(authError.internalError("revokeBySubject: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+function parseRefresh(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  D1TokenStore
+};

package/dist/esm/adapters/durable-object/index.js

@@ -0,0 +1,3 @@
+export {
+  DurableObjectSessionStore
+};