@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/types/adapters/d1/migrations.d.ts

@@ -0,0 +1,18 @@
+/**
+ * D1 / SQLite schema for the IdP adapters. Mirrors the Postgres schema
+ * exactly with SQLite-flavored types (TEXT for JSON, BLOB for bytes,
+ * INTEGER for timestamps and serials).
+ *
+ * The auth-code payload is encrypted at rest by the adapter before the
+ * ciphertext lands in `openauth_codes.ciphertext` — the DB only ever sees
+ * the JWE compact string.
+ */
+import type { AnyD1Database } from "./types";
+export declare const INITIAL_SCHEMA_SQL: string[];
+/**
+ * Apply the initial schema to a D1 database. Idempotent — every statement
+ * is `CREATE … IF NOT EXISTS`. Deployments using `wrangler d1 migrations
+ * apply` can apply the SQL above directly.
+ */
+export declare function migrate(db: AnyD1Database): Promise<void>;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/types/adapters/d1/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,kBAAkB,UAkE9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9D"}

package/dist/types/adapters/d1/session-store.d.ts

@@ -0,0 +1,20 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { AnyD1Database } from "./types";
+export type D1SessionStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+};
+export declare class D1SessionStore implements SessionStore {
+    #private;
+    constructor(opts: D1SessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/d1/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,YAAY;;gBAIrC,IAAI,EAAE,qBAAqB;IAKjC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA2BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAuBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA2B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}

package/dist/types/adapters/d1/session.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Sessions-API helper. Wraps a `D1Database` in a session pinned to the
+ * primary node for read-after-write consistency on security-critical paths.
+ *
+ * If the bundled `D1Database` lacks `withSession` (older runtime), the
+ * helper returns the plain `db` and the caller pays no Sessions-API cost
+ * (and gets eventual-consistency reads — documented in the adapter's
+ * top-level JSDoc).
+ */
+import type { AnyD1Database, D1DatabaseSession, D1DatabaseWithSessions } from "./types";
+export declare function isSessionsCapable(db: AnyD1Database): db is D1DatabaseWithSessions;
+/**
+ * Open a Sessions-API session pinned to the primary node. All `prepare` calls
+ * inside the session see the latest writes; bookmarks may be threaded across
+ * requests by the caller if needed.
+ */
+export declare function primarySession(db: AnyD1Database): D1DatabaseSession;
+//# sourceMappingURL=session.d.ts.map

package/dist/types/adapters/d1/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EACV,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,aAAa,GAChB,EAAE,IAAI,sBAAsB,CAE9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,iBAAiB,CAWnE"}

package/dist/types/adapters/d1/token-store.d.ts

@@ -0,0 +1,29 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { AnyD1Database } from "./types";
+export type D1TokenStoreOptions = {
+    db: AnyD1Database;
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    clock?: () => number;
+};
+export declare class D1TokenStore implements TokenStore {
+    #private;
+    constructor(opts: D1TokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/d1/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/token-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAG5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,aAAa,CAAA;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,YAAa,YAAW,UAAU;;gBAIjC,IAAI,EAAE,mBAAmB;IAK/B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAuBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IA2EjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAuBlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAazB"}

package/dist/types/adapters/d1/types.d.ts

@@ -0,0 +1,43 @@
+/**
+ * D1 type extensions.
+ *
+ * `@cloudflare/workers-types` < 2024-12 does not yet expose the D1 Sessions
+ * API on its `D1Database` class. We declare the augmentation locally and
+ * feature-detect at runtime: if `db.withSession` is a function the adapter
+ * uses it for read-after-write consistency on the security-critical paths;
+ * otherwise it falls back to plain `prepare`. This keeps the adapter
+ * type-safe today and forward-compatible when the workers-types release
+ * catches up.
+ */
+import type { D1Database, D1PreparedStatement, D1Result } from "@cloudflare/workers-types";
+/**
+ * D1 Sessions API constraints. Documented at
+ * <https://developers.cloudflare.com/d1/best-practices/read-replication/>.
+ *  - `"first-primary"` — pin the session to the primary node. All reads see
+ *    the latest write. Used for security-critical paths.
+ *  - `"first-unconstrained"` — pin to whichever node responds first. Lower
+ *    latency, eventual consistency. Used for JWKS / config reads.
+ */
+export type D1SessionConstraint = "first-primary" | "first-unconstrained";
+/** A session bookmark — opaque token returned by `getBookmark()`. */
+export type D1SessionBookmark = string;
+/** Minimal shape we use from `D1DatabaseSession`. */
+export type D1DatabaseSession = {
+    prepare(query: string): D1PreparedStatement;
+    batch<T = unknown>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+    getBookmark(): D1SessionBookmark | null;
+};
+/**
+ * `D1Database` with the Sessions API. Use this type at the adapter boundary;
+ * the runtime feature-detects `withSession` so consumers can still pass a
+ * plain `D1Database` if Sessions is unavailable in their environment.
+ */
+export type D1DatabaseWithSessions = D1Database & {
+    withSession(constraintOrBookmark?: D1SessionConstraint | D1SessionBookmark): D1DatabaseSession;
+};
+/**
+ * Either a real D1Database or our test shim. Feature detection happens at
+ * call time so the adapter still works against both.
+ */
+export type AnyD1Database = D1Database | D1DatabaseWithSessions;
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/d1/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EACnB,QAAQ,EACT,MAAM,2BAA2B,CAAA;AAElC;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG,qBAAqB,CAAA;AAEzE,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEtC,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC7E,WAAW,IAAI,iBAAiB,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG;IAChD,WAAW,CACT,oBAAoB,CAAC,EAAE,mBAAmB,GAAG,iBAAiB,GAC7D,iBAAiB,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,sBAAsB,CAAA"}

package/dist/types/adapters/durable-object/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Cloudflare Durable Objects adapters.
+ *
+ * Durable Objects are an excellent fit for `SessionStore` (flow records)
+ * because every operation on a single DO instance is serialized — atomic
+ * delete-on-read comes for free with `storage.transaction`. Per
+ * `ports/CONSISTENCY.md`, DOs are also acceptable for `TokenStore` in
+ * deployments that don't run D1.
+ *
+ * The adapter is supplied a `DurableObjectStorage` directly (`this.ctx.storage`
+ * from inside a DO class). Users wire their own DO class around the adapter
+ * and forward RPC / fetch calls to the methods. See the JSDoc on
+ * `DurableObjectSessionStore` for the canonical wiring pattern.
+ */
+export { DurableObjectSessionStore, type DurableObjectSessionStoreOptions, } from "./session-store";
+export type { DurableObjectStorageLike, DurableObjectTransactionLike, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/durable-object/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,yBAAyB,EACzB,KAAK,gCAAgC,GACtC,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,SAAS,CAAA"}

package/dist/types/adapters/durable-object/session-store.d.ts

@@ -0,0 +1,21 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { DurableObjectStorageLike, DurableObjectTransactionLike } from "./types";
+export type DurableObjectSessionStoreOptions = {
+    storage: DurableObjectStorageLike;
+    clock?: () => number;
+};
+export declare class DurableObjectSessionStore implements SessionStore {
+    #private;
+    constructor(opts: DurableObjectSessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+export type { DurableObjectStorageLike, DurableObjectTransactionLike };
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/durable-object/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/session-store.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,SAAS,CAAA;AAYhB,MAAM,MAAM,gCAAgC,GAAG;IAC7C,OAAO,EAAE,wBAAwB,CAAA;IACjC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,yBAA0B,YAAW,YAAY;;gBAIhD,IAAI,EAAE,gCAAgC;IAK5C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAkBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA2BlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAmBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA+BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAmB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ9D;AAMD,YAAY,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,CAAA"}

package/dist/types/adapters/durable-object/types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Minimal `DurableObjectStorage` shape the adapter depends on. Defined
+ * locally so the adapter is testable without a real Workers runtime and so
+ * it stays compatible with both legacy and current versions of
+ * `@cloudflare/workers-types`.
+ *
+ * Real `DurableObjectStorage` instances satisfy this interface — pass
+ * `this.ctx.storage` directly.
+ */
+export type DurableObjectTransactionLike = {
+    get<T>(key: string): Promise<T | undefined>;
+    put<T>(key: string, value: T): Promise<void>;
+    delete(key: string): Promise<boolean>;
+};
+export type DurableObjectStorageLike = DurableObjectTransactionLike & {
+    /**
+     * Run a closure atomically. On any DO, all operations within `closure`
+     * see a consistent snapshot of storage; the closure's return value is
+     * resolved after the writes are durable.
+     */
+    transaction<T>(closure: (txn: DurableObjectTransactionLike) => Promise<T>): Promise<T>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/durable-object/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IAC3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG,4BAA4B,GAAG;IACpE;;;;OAIG;IACH,WAAW,CAAC,CAAC,EACX,OAAO,EAAE,CAAC,GAAG,EAAE,4BAA4B,KAAK,OAAO,CAAC,CAAC,CAAC,GACzD,OAAO,CAAC,CAAC,CAAC,CAAA;CACd,CAAA"}

package/dist/types/adapters/dynamo/audit-log.d.ts

@@ -0,0 +1,19 @@
+/**
+ * DynamoDB `AuditLog`. `pk="audit"`, `sk="<paddedTs>:<rand>"` so a Query
+ * pulls events in insertion order. As with all `AuditLog` adapters, `log()`
+ * never throws — durability failures are swallowed so the IdP's hot paths
+ * are not gated on the log.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { DynamoExecutor } from "./client";
+export type DynamoAuditLogOptions = {
+    exec: DynamoExecutor;
+};
+export declare class DynamoAuditLog implements AuditLog {
+    #private;
+    constructor(opts: DynamoAuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/dynamo/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,cAAc,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,QAAQ;;gBAGjC,IAAI,EAAE,qBAAqB;IAIjC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAapE"}

package/dist/types/adapters/dynamo/client.d.ts

@@ -0,0 +1,111 @@
+/**
+ * `DynamoExecutor` — the operation surface the adapters depend on.
+ *
+ * Keeps the AWS SDK out of the adapter's import graph. Production users
+ * wire the executor via `fromDynamoDBClient(docClient, tableName)`; tests
+ * supply an in-memory implementation (`test/helpers/dynamo-shim.ts`).
+ *
+ * All operations target a single table (the adapter is single-table by
+ * design — pk + sk + optional GSIs). The executor knows the table name; the
+ * adapter only passes keys + data.
+ */
+export type DynamoKey = {
+    pk: string;
+    sk: string;
+};
+/**
+ * Strong read by primary key. `consistentRead` MUST be honoured for every
+ * security-critical read (`getCode`, `getRefresh`, `getFlow`) — DynamoDB
+ * defaults to eventually consistent reads which violate the contracts in
+ * `ports/CONSISTENCY.md`.
+ */
+export type DynamoGetInput = {
+    key: DynamoKey;
+    consistentRead: boolean;
+};
+/**
+ * Insert (`condition: "not-exists"`) or unconditional put. The adapter uses:
+ *  - `"not-exists"` for code / refresh / flow inserts so a duplicate token
+ *    never silently overwrites.
+ *  - `"exists"` for read-modify-write paths (e.g. `updateFlowMethodState`)
+ *    so the put fails if a concurrent `consumeFlow` deleted the row between
+ *    the prior `get` and this `put`. The executor surfaces a
+ *    `ConditionalCheckFailedException` that callers translate into a typed
+ *    failure.
+ */
+export type DynamoPutInput = {
+    item: Record<string, unknown> & DynamoKey;
+    condition?: "not-exists" | "exists";
+};
+/**
+ * Atomic delete-on-read — equivalent to `DeleteItem` with
+ * `ReturnValues=ALL_OLD`. Concurrent calls resolve to exactly one winner
+ * that gets the row back; losers get `undefined`.
+ */
+export type DynamoDeleteInput = {
+    key: DynamoKey;
+};
+/**
+ * Conditional UPDATE used for the refresh-token rotation. Sets `consumed_at`
+ * iff it is currently absent. Returns the post-update item on success;
+ * resolves with `null` if the condition failed (`ConditionalCheckFailed`).
+ */
+export type DynamoUpdateConsumeRefreshInput = {
+    key: DynamoKey;
+    now: number;
+};
+/**
+ * Query items by partition key (and optionally a sort-key prefix). Strongly
+ * consistent for the refresh-revoke paths.
+ */
+export type DynamoQueryInput = {
+    pk: string;
+    /** Sort-key prefix filter — emits `begins_with(sk, prefix)`. */
+    skBeginsWith?: string;
+    consistentRead: boolean;
+    /** Filter by an attribute (e.g. `family = :v` for `revokeFamily` via GSI). */
+    filter?: {
+        attribute: string;
+        equals: string;
+    };
+};
+export type DynamoQueryByGsiInput = {
+    /**
+     * GSI name configured on the table. Each entry corresponds to a GSI
+     * the bundled adapters need:
+     *   - `family-index`         (refresh-token family revocation)
+     *   - `subject-index`        (revokeBySubject)
+     *   - `passkey-user-index`   (PasskeyCredentialStore.findByUsername)
+     */
+    indexName: "family-index" | "subject-index" | "passkey-user-index";
+    /** Hash key value on the GSI. */
+    hashKey: string;
+};
+/**
+ * Update a single item's attributes — equivalent to DynamoDB's
+ * `UpdateItem` with a `SET` expression over each provided attribute.
+ *
+ * Used by passkey-counter updates today; future Phase 8 features
+ * (DPoP jti replay, etc.) may reuse it.
+ */
+export type DynamoUpdateItemInput = {
+    key: DynamoKey;
+    /** Attribute name → new value. Top-level only, no nested updates. */
+    set: Record<string, unknown>;
+};
+export type DynamoExecutor = {
+    get(input: DynamoGetInput): Promise<Record<string, unknown> | undefined>;
+    put(input: DynamoPutInput): Promise<void>;
+    /** Returns the deleted item if one was deleted; `undefined` otherwise. */
+    delete(input: DynamoDeleteInput): Promise<Record<string, unknown> | undefined>;
+    /**
+     * Atomic refresh-token claim. Returns the post-update item on success;
+     * `null` if the condition failed (already-consumed race).
+     */
+    consumeRefresh(input: DynamoUpdateConsumeRefreshInput): Promise<Record<string, unknown> | null>;
+    query(input: DynamoQueryInput): Promise<Record<string, unknown>[]>;
+    queryByGsi(input: DynamoQueryByGsiInput): Promise<Record<string, unknown>[]>;
+    /** Generic attribute update. No-op if the item does not exist. */
+    updateItem(input: DynamoUpdateItemInput): Promise<void>;
+};
+//# sourceMappingURL=client.d.ts.map

package/dist/types/adapters/dynamo/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,SAAS,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;IACzC,SAAS,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAA;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,SAAS,CAAA;CACf,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,OAAO,CAAA;IACvB,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;;OAMG;IACH,SAAS,EAAE,cAAc,GAAG,eAAe,GAAG,oBAAoB,CAAA;IAClE,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,EAAE,SAAS,CAAA;IACd,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAA;IACxE,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,0EAA0E;IAC1E,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAA;IAC9E;;;OAGG;IACH,cAAc,CACZ,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;IAC1C,KAAK,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5E,kEAAkE;IAClE,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD,CAAA"}

package/dist/types/adapters/dynamo/config-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * DynamoDB `ConfigStore`. `pk="tenant"`, `sk=<tenantId>`. Read-eventual
+ * by default (config is read-heavy, write-rare); the invalidation hook
+ * fires on every `putTenantConfig` so in-process caches drop stale values
+ * immediately.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { DynamoExecutor } from "./client";
+export type DynamoConfigStoreOptions = {
+    exec: DynamoExecutor;
+};
+export declare class DynamoConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: DynamoConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/dynamo/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/config-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,cAAc,CAAA;CACrB,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAIvC,IAAI,EAAE,wBAAwB;IAIpC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAgB5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAqBlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/dynamo/index.d.ts

@@ -0,0 +1,60 @@
+/**
+ * AWS DynamoDB adapter set.
+ *
+ * Single-table design with `pk` / `sk` primary key plus three GSIs:
+ *
+ *   `family-index`         hash = `family`        (revokeFamily)
+ *   `subject-index`        hash = `subject_key`   (revokeBySubject) — value is `<tenantId>#<subjectId>`
+ *   `passkey-user-index`   hash = `user_key`      (PasskeyCredentialStore.findByUsername) — value is `<tenantId>#<userId>`
+ *
+ * The adapter satisfies every contract in `ports/CONSISTENCY.md` provided
+ * the underlying calls use `ConsistentRead=true` on the strong reads and
+ * `ConditionExpression` on the rotation `UpdateItem` — both are handled by
+ * `fromDynamoDBClient`.
+ *
+ * Wiring:
+ * @example
+ *   import { DynamoDBClient } from "@aws-sdk/client-dynamodb"
+ *   import { DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb"
+ *   import {
+ *     fromDynamoDBClient,
+ *     DynamoTokenStore,
+ *     DynamoSessionStore,
+ *     // ...
+ *   } from "@_mustachio/openauth/adapters/dynamo"
+ *
+ *   const docClient = DynamoDBDocumentClient.from(new DynamoDBClient({ region: "us-east-1" }))
+ *   const exec = fromDynamoDBClient(docClient, "openauth")
+ *   const keyStore = new DynamoKeyStore({ exec })
+ *   const tokenStore = new DynamoTokenStore({ exec, keyStore })
+ *
+ * Table creation is left to the operator (Terraform / CDK / `aws dynamodb
+ * create-table`). The schema you need:
+ *
+ *   Table: openauth (or any name you choose)
+ *     Hash key:  pk (S)
+ *     Range key: sk (S)
+ *     TTL attribute: `ttl` (epoch seconds)
+ *
+ *   GSI: family-index
+ *     Hash key: family (S)
+ *     Projection: ALL
+ *
+ *   GSI: subject-index
+ *     Hash key: subject_key (S)
+ *     Projection: ALL
+ *
+ *   GSI: passkey-user-index
+ *     Hash key: user_key (S)
+ *     Projection: ALL
+ */
+export { DynamoAuditLog, type DynamoAuditLogOptions } from "./audit-log";
+export { DynamoConfigStore, type DynamoConfigStoreOptions, } from "./config-store";
+export { DynamoKeyStore, type DynamoKeyStoreOptions } from "./key-store";
+export { DynamoMethodStore, type DynamoMethodStoreOptions, } from "./method-store";
+export { DynamoSessionStore, type DynamoSessionStoreOptions, } from "./session-store";
+export { DynamoTokenStore, type DynamoTokenStoreOptions } from "./token-store";
+export { DynamoPasskeyCredentialStore, type DynamoPasskeyCredentialStoreOptions, } from "./passkey-credential-store";
+export { fromDynamoDBClient } from "./sdk";
+export type { DynamoDeleteInput, DynamoExecutor, DynamoGetInput, DynamoKey, DynamoPutInput, DynamoQueryByGsiInput, DynamoQueryInput, DynamoUpdateConsumeRefreshInput, DynamoUpdateItemInput, } from "./client";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/dynamo/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EACL,4BAA4B,EAC5B,KAAK,mCAAmC,GACzC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAA;AAC1C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/types/adapters/dynamo/key-store.d.ts

@@ -0,0 +1,23 @@
+import type { EncryptionKey, KeyStore, KeyWrapper, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { DynamoExecutor } from "./client";
+export type DynamoKeyStoreOptions = {
+    exec: DynamoExecutor;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+    /**
+     * Optional envelope that encrypts private JWKs and encryption-key bytes
+     * before they leave the process. STRONGLY RECOMMENDED in production.
+     * Pair with a cloud KMS or HSM-backed implementation.
+     */
+    wrapper?: KeyWrapper;
+};
+export declare class DynamoKeyStore implements KeyStore {
+    #private;
+    constructor(opts: DynamoKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/dynamo/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/key-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,EACX,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,QAAQ;;gBAOjC,IAAI,EAAE,qBAAqB;IAOjC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBhD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAU5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAkBtD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CA+JpE"}

package/dist/types/adapters/dynamo/method-store.d.ts

@@ -0,0 +1,20 @@
+/**
+ * DynamoDB `MethodStore`. `pk="tenant-methods:<tenantId>"`, `sk=<methodId>`.
+ * Co-locating methods per-tenant lets `listMethods` use a single Query.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { DynamoExecutor } from "./client";
+export type DynamoMethodStoreOptions = {
+    exec: DynamoExecutor;
+};
+export declare class DynamoMethodStore implements MethodStore {
+    #private;
+    constructor(opts: DynamoMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/dynamo/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/method-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAI9C,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,cAAc,CAAA;CACrB,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAGvC,IAAI,EAAE,wBAAwB;IAIpC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAgBhE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAqB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAgBlB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAYzB"}

package/dist/types/adapters/dynamo/passkey-credential-store.d.ts

@@ -0,0 +1,47 @@
+/**
+ * DynamoDB `PasskeyCredentialStore`.
+ *
+ * Single-table layout, one item per credential:
+ *
+ *   pk = "passkey-cred"
+ *   sk = "<tenantId>#<credentialId>"
+ *   user_key = "<tenantId>#<userId>"       // GSI hash for findByUsername
+ *   tenant_id, user_id, public_key, counter, transports, created_at
+ *
+ * Required GSI on the table (alongside `family-index` /
+ * `subject-index` from `DynamoTokenStore`):
+ *
+ *   passkey-user-index
+ *     Hash key: user_key (S)
+ *     Projection: ALL
+ *
+ * The reference adapter treats `userId` as the username lookup key —
+ * matching the bundled `passkeyMethod`. Hosts that need
+ * username ≠ userId implement `PasskeyCredentialStore` directly.
+ */
+import type { PasskeyCredentialStore, StoredCredential } from "../../methods/passkey";
+import type { DynamoExecutor } from "./client";
+export type DynamoPasskeyCredentialStoreOptions = {
+    exec: DynamoExecutor;
+    clock?: () => number;
+};
+export declare class DynamoPasskeyCredentialStore implements PasskeyCredentialStore {
+    #private;
+    constructor(opts: DynamoPasskeyCredentialStoreOptions);
+    findByUsername(username: string, tenantId: string): Promise<{
+        userId: string;
+        credentials: StoredCredential[];
+    } | null>;
+    findById(credentialId: string, tenantId: string): Promise<StoredCredential | null>;
+    updateCounter(input: {
+        credentialId: string;
+        counter: number;
+        tenantId: string;
+    }): Promise<void>;
+    create(input: {
+        userId: string;
+        credential: StoredCredential;
+        tenantId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=passkey-credential-store.d.ts.map

package/dist/types/adapters/dynamo/passkey-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/passkey-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;;gBAI7D,IAAI,EAAE,mCAAmC;IAK/C,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAiBhE,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAS7B,aAAa,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUX,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBlB"}

package/dist/types/adapters/dynamo/sdk.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `fromDynamoDBClient` — wires the `DynamoExecutor` interface to a real AWS
+ * SDK `DynamoDBDocumentClient`. Adapter consumers using AWS in production
+ * call this factory once, then pass the returned executor into every store
+ * adapter.
+ *
+ * The AWS SDK is imported via `@aws-sdk/lib-dynamodb` exclusively; the bare
+ * client is the caller's concern (they can configure region, creds, retries,
+ * etc.). This file is the **only** place in the package that imports the
+ * AWS SDK at runtime — keeping the adapter surface clean and the bundle
+ * lean for non-AWS consumers.
+ *
+ * @example
+ *   import { DynamoDBClient } from "@aws-sdk/client-dynamodb"
+ *   import { DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb"
+ *   const docClient = DynamoDBDocumentClient.from(new DynamoDBClient({}))
+ *   const exec = fromDynamoDBClient(docClient, "openauth")
+ *   const tokenStore = new DynamoTokenStore({ exec, keyStore })
+ */
+import type { DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb";
+import type { DynamoExecutor } from "./client";
+export declare function fromDynamoDBClient(client: DynamoDBDocumentClient, tableName: string): DynamoExecutor;
+//# sourceMappingURL=sdk.d.ts.map

package/dist/types/adapters/dynamo/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AASnE,OAAO,KAAK,EAEV,cAAc,EAOf,MAAM,UAAU,CAAA;AAEjB,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,SAAS,EAAE,MAAM,GAChB,cAAc,CA4IhB"}

package/dist/types/adapters/dynamo/session-store.d.ts

@@ -0,0 +1,20 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { DynamoExecutor } from "./client";
+export type DynamoSessionStoreOptions = {
+    exec: DynamoExecutor;
+    clock?: () => number;
+};
+export declare class DynamoSessionStore implements SessionStore {
+    #private;
+    constructor(opts: DynamoSessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/dynamo/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAIzC,IAAI,EAAE,yBAAyB;IAKrC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAsBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAsB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ9D"}