@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/types/adapters/dynamo/token-store.d.ts

@@ -0,0 +1,29 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { DynamoExecutor } from "./client";
+export type DynamoTokenStoreOptions = {
+    exec: DynamoExecutor;
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    clock?: () => number;
+};
+export declare class DynamoTokenStore implements TokenStore {
+    #private;
+    constructor(opts: DynamoTokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/dynamo/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/token-store.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,cAAc,CAAA;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,gBAAiB,YAAW,UAAU;;gBAIrC,IAAI,EAAE,uBAAuB;IAKnC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA2BlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAkBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAqBlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAqDjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAmBlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAmBzB"}

package/dist/types/adapters/kms/in-memory-backing.d.ts

@@ -0,0 +1,9 @@
+/**
+ * In-memory `KmsBackingStore`. Used by the KMS adapter conformance test and
+ * for single-instance dev. Production deployments pass a real backing store
+ * (Postgres, DynamoDB, S3-with-versioning, etc.) so KMS-wrapped key
+ * envelopes survive process restarts.
+ */
+import type { KmsBackingStore } from "./types";
+export declare function inMemoryKmsBackingStore(): KmsBackingStore;
+//# sourceMappingURL=in-memory-backing.d.ts.map

package/dist/types/adapters/kms/in-memory-backing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-backing.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/in-memory-backing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EACV,eAAe,EAGhB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,uBAAuB,IAAI,eAAe,CAuBzD"}

package/dist/types/adapters/kms/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * KMS-backed `KeyStore` adapter set.
+ *
+ * Envelope encryption: private JWK material is wrapped under an AWS KMS
+ * master key and stored in a pluggable backing store (`KmsBackingStore`).
+ * KMS Encrypt / Decrypt are the only KMS operations on the hot path; the
+ * framework still receives a real `CryptoKey` for JWT signing so no surgery
+ * in `domain/jwt.ts` is needed.
+ *
+ * @example
+ *   import { KMSClient } from "@aws-sdk/client-kms"
+ *   import {
+ *     fromKmsClient,
+ *     inMemoryKmsBackingStore,
+ *     KmsKeyStore,
+ *   } from "@_mustachio/openauth/adapters/kms"
+ *
+ *   const kms = fromKmsClient(
+ *     new KMSClient({ region: "us-east-1" }),
+ *     process.env.IDP_KMS_KEY_ARN!,
+ *   )
+ *   // For production, swap in a persistent KmsBackingStore (Postgres,
+ *   // DynamoDB, etc.). The in-memory store is appropriate for single-instance
+ *   // dev only.
+ *   const keyStore = new KmsKeyStore({ kms, backing: inMemoryKmsBackingStore() })
+ *
+ * Operators with strict no-plaintext-cache requirements can disable the
+ * unwrapped-key cache via `cacheUnwrappedKeys: false` — every read then
+ * round-trips to KMS.
+ */
+export { inMemoryKmsBackingStore } from "./in-memory-backing";
+export { KmsKeyStore, type KmsKeyStoreOptions } from "./key-store";
+export { fromKmsClient } from "./sdk";
+export type { KmsBackingStore, KmsClientLike, WrappedEncryptionKey, WrappedSigningKey, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/kms/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AACrC,YAAY,EACV,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,SAAS,CAAA"}

package/dist/types/adapters/kms/key-store.d.ts

@@ -0,0 +1,20 @@
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { KmsBackingStore, KmsClientLike } from "./types";
+export type KmsKeyStoreOptions = {
+    kms: KmsClientLike;
+    backing: KmsBackingStore;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+    /** Default `true`. Set false for strict no-plaintext-cache deployments. */
+    cacheUnwrappedKeys?: boolean;
+};
+export declare class KmsKeyStore implements KeyStore {
+    #private;
+    constructor(opts: KmsKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/kms/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/key-store.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EAGd,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,aAAa,CAAA;IAClB,OAAO,EAAE,eAAe,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,qBAAa,WAAY,YAAW,QAAQ;;gBAS9B,IAAI,EAAE,kBAAkB;IAQ9B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAchD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAO5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IActD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAgFpE"}

package/dist/types/adapters/kms/sdk.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `fromKmsClient` — wires the `KmsClientLike` interface to a real AWS KMS
+ * client. The KMS SDK is imported only from this file to keep the rest of
+ * the adapter bundle KMS-agnostic.
+ *
+ * @example
+ *   import { KMSClient } from "@aws-sdk/client-kms"
+ *   const kmsClient = new KMSClient({ region: "us-east-1" })
+ *   const kms = fromKmsClient(kmsClient, process.env.IDP_KMS_KEY_ARN!)
+ *   const backing = new PostgresKmsBackingStore({ exec })
+ *   const keyStore = new KmsKeyStore({ kms, backing })
+ */
+import type { KMSClient } from "@aws-sdk/client-kms";
+import type { KmsClientLike } from "./types";
+export declare function fromKmsClient(client: KMSClient, keyId: string): KmsClientLike;
+//# sourceMappingURL=sdk.d.ts.map

package/dist/types/adapters/kms/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAqB7E"}

package/dist/types/adapters/kms/types.d.ts

@@ -0,0 +1,58 @@
+/**
+ * KMS adapter interfaces.
+ *
+ * The KMS-backed `KeyStore` uses **envelope encryption** for private key
+ * material: the JWK private bytes (signing) and the raw AES key bytes
+ * (encryption) are wrapped under a KMS master key. The ciphertext blob is
+ * stored in a pluggable backing store; KMS Encrypt / Decrypt are the only
+ * KMS operations on the hot path.
+ *
+ * This shape keeps private material out of plaintext at rest while
+ * preserving the JWT signing path: the framework still receives a real
+ * `CryptoKey` (`importJWK` of the unwrapped JWK) so `domain/jwt.ts` doesn't
+ * need to know KMS exists.
+ */
+/** Minimal KMS surface the adapter depends on. */
+export type KmsClientLike = {
+    /** Encrypt up to ~4 KB of plaintext under the master key. */
+    encrypt(plaintext: Uint8Array): Promise<Uint8Array>;
+    /** Decrypt a previously-issued ciphertext under the master key. */
+    decrypt(ciphertext: Uint8Array): Promise<Uint8Array>;
+};
+/**
+ * Persistent storage for KMS-wrapped key envelopes. Adapters provide their
+ * own (Postgres, DynamoDB, file), or pass `inMemoryKmsBackingStore()` for
+ * tests / single-instance dev.
+ *
+ * `wrappedPrivate` is the KMS-wrapped private material (JWK bytes for
+ * signing keys, raw AES key bytes for encryption keys). `publicJwk` is the
+ * public material (never sensitive); it's kept plaintext alongside the
+ * ciphertext so JWKS lookups don't need a KMS round trip.
+ */
+export type KmsBackingStore = {
+    putSigningKey(row: WrappedSigningKey): Promise<void>;
+    getSigningKey(kid: string): Promise<WrappedSigningKey | undefined>;
+    listSigningKeys(): Promise<WrappedSigningKey[]>;
+    putEncryptionKey(row: WrappedEncryptionKey): Promise<void>;
+    getEncryptionKey(kid: string): Promise<WrappedEncryptionKey | undefined>;
+    listEncryptionKeys(): Promise<WrappedEncryptionKey[]>;
+};
+export type WrappedSigningKey = {
+    kid: string;
+    alg: string;
+    crv?: string;
+    publicJwk: Record<string, unknown>;
+    wrappedPrivate: Uint8Array;
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    rotatedAt?: number;
+};
+export type WrappedEncryptionKey = {
+    kid: string;
+    alg: string;
+    wrappedKey: Uint8Array;
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    rotatedAt?: number;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/kms/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kDAAkD;AAClD,MAAM,MAAM,aAAa,GAAG;IAC1B,6DAA6D;IAC7D,OAAO,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACnD,mEAAmE;IACnE,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACrD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAA;IAClE,eAAe,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC/C,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IACxE,kBAAkB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,cAAc,EAAE,UAAU,CAAA;IAC1B,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA"}

package/dist/types/adapters/kv/audit-log.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Cloudflare KV `AuditLog`. Append-only with per-event keys of the shape
+ * `audit:<paddedTs>:<rand>` so KV's lexicographic list returns events in
+ * insertion order. Suitable for low-volume audit (the IdP) where reads are
+ * SIEM-style after-the-fact, not hot-path. High-volume deployments should
+ * ship events out-of-band to a real append-log.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { KVNamespaceLike } from "./types";
+export type KvAuditLogOptions = {
+    kv: KVNamespaceLike;
+    /** Optional TTL (seconds). 90 days minimum per CONSISTENCY.md SOC 2 baseline. */
+    expirationTtl?: number;
+};
+export declare class KvAuditLog implements AuditLog {
+    #private;
+    constructor(opts: KvAuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/kv/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,eAAe,CAAA;IACnB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,qBAAa,UAAW,YAAW,QAAQ;;gBAI7B,IAAI,EAAE,iBAAiB;IAK7B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAWpE"}

package/dist/types/adapters/kv/config-store.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Cloudflare KV `ConfigStore`. JSON-serialized tenant config under
+ * `tenant:<id>`. Per `ports/CONSISTENCY.md`, KV is **only** acceptable for
+ * read-eventual paths — tenant config qualifies (read-heavy, write-rare,
+ * 60s bounded staleness is fine). Invalidation hook fires on every
+ * `putTenantConfig`.
+ *
+ * KV reads honor the cache hint via `cacheTtl` in the get options. The
+ * 60-second default matches the bounded-staleness contract.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { KVNamespaceLike } from "./types";
+export type KvConfigStoreOptions = {
+    kv: KVNamespaceLike;
+};
+export declare class KvConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: KvConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/kv/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,eAAe,CAAA;CACpB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAInC,IAAI,EAAE,oBAAoB;IAIhC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAa5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAclE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/kv/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Cloudflare KV adapters — **restricted use only**.
+ *
+ * Per `ports/CONSISTENCY.md`, KV's eventual consistency disqualifies it as
+ * a backing store for `TokenStore` (auth codes, refresh tokens) and
+ * `SessionStore` (flow records). Use D1 / Durable Objects / Postgres /
+ * DynamoDB for those. KV remains a great fit for the read-eventual paths
+ * exposed in this package:
+ *
+ *  - `KvConfigStore` — tenant config blob keyed by id
+ *  - `KvMethodStore` — per-tenant method configs
+ *  - `KvAuditLog` — append-only audit events (low-volume only)
+ *
+ * Production users typically mix-and-match: KV for config + D1 for tokens
+ * + Durable Objects for sessions.
+ */
+export { KvAuditLog, type KvAuditLogOptions } from "./audit-log";
+export { KvConfigStore, type KvConfigStoreOptions } from "./config-store";
+export { KvMethodStore, type KvMethodStoreOptions } from "./method-store";
+export type { KVNamespaceLike } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/kv/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,YAAY,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/types/adapters/kv/method-store.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cloudflare KV `MethodStore`. Per-method JSON under
+ * `method:<tenantId>:<methodId>`. `listMethods` uses the KV `list` cursor +
+ * follow-up `get` per key — fine for the read-rare console workflow but
+ * not for hot per-request paths (the IdP framework caches `MethodConfig`
+ * via `MethodCache` in-process).
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { KVNamespaceLike } from "./types";
+export type KvMethodStoreOptions = {
+    kv: KVNamespaceLike;
+};
+export declare class KvMethodStore implements MethodStore {
+    #private;
+    constructor(opts: KvMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/kv/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/method-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAM9C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,eAAe,CAAA;CACpB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAGnC,IAAI,EAAE,oBAAoB;IAIhC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAqBhE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAkB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASlB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAUzB"}

package/dist/types/adapters/kv/types.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Minimal `KVNamespace` shape the adapter depends on. Pinned locally so the
+ * adapter is testable without a real Workers runtime.
+ *
+ * Real `KVNamespace` instances satisfy this interface — pass `env.AUTH_KV`
+ * directly.
+ */
+export type KVNamespaceLike = {
+    get(key: string): Promise<string | null>;
+    get<T>(key: string, type: "json"): Promise<T | null>;
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+        expiration?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(options?: {
+        prefix?: string;
+        cursor?: string | null;
+        limit?: number;
+    }): Promise<{
+        keys: Array<{
+            name: string;
+        }>;
+        list_complete: boolean;
+        cursor?: string;
+    }>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/kv/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACpD,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACxD,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,OAAO,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC;QACV,IAAI,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC7B,aAAa,EAAE,OAAO,CAAA;QACtB,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH,CAAA"}

package/dist/types/adapters/memory/audit-log.d.ts

@@ -0,0 +1,18 @@
+/**
+ * In-memory `AuditLog`. Stores events in an array that tests can inspect.
+ * Production deployments use a real backend (Clickhouse, OTEL, etc.).
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+export type StoredAuditEvent = AuditEvent & {
+    timestamp: number;
+};
+export declare class MemoryAuditLog implements AuditLog {
+    events: StoredAuditEvent[];
+    log(event: StoredAuditEvent): Promise<void>;
+    /** Test helper — find events of a given kind. */
+    byKind<K extends AuditEvent["kind"]>(kind: K): Array<Extract<StoredAuditEvent, {
+        kind: K;
+    }>>;
+    clear(): void;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/memory/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/audit-log.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,qBAAa,cAAe,YAAW,QAAQ;IAC7C,MAAM,EAAE,gBAAgB,EAAE,CAAK;IAEzB,GAAG,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,iDAAiD;IACjD,MAAM,CAAC,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,EACjC,IAAI,EAAE,CAAC,GACN,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAMhD,KAAK,IAAI,IAAI;CAGd"}

package/dist/types/adapters/memory/clock.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Tiny injectable clock used by every memory adapter so tests can advance
+ * time deterministically.
+ */
+export type Clock = () => number;
+export declare const realClock: Clock;
+//# sourceMappingURL=clock.d.ts.map

package/dist/types/adapters/memory/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/clock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAA;AAEhC,eAAO,MAAM,SAAS,EAAE,KAAwB,CAAA"}

package/dist/types/adapters/memory/config-store.d.ts

@@ -0,0 +1,19 @@
+/**
+ * In-memory `ConfigStore`. Single-process; trivially satisfies the
+ * eventual + bounded-staleness contract (it's strong, which is a superset).
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+export type MemoryConfigStoreOptions = {
+    /** Seed tenants — useful for tests. */
+    seed?: ReadonlyArray<TenantConfig>;
+};
+export declare class MemoryConfigStore implements ConfigStore {
+    #private;
+    constructor(opts?: MemoryConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/memory/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/config-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,IAAI,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;CACnC,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAIvC,IAAI,GAAE,wBAA6B;IAIzC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAQ5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/memory/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * In-memory adapter set. Map-backed. Suitable for tests and single-instance
+ * dev. Trivially satisfies all consistency contracts in
+ * `ports/CONSISTENCY.md` because there's no concurrent process / replica
+ * lag.
+ */
+export { MemoryAuditLog, type StoredAuditEvent } from "./audit-log";
+export { MemoryConfigStore, type MemoryConfigStoreOptions, } from "./config-store";
+export { MemoryKeyStore, type MemoryKeyStoreOptions } from "./key-store";
+export { MemoryMethodStore, type MemoryMethodStoreOptions, } from "./method-store";
+export { MemorySessionStore, type MemorySessionStoreOptions, } from "./session-store";
+export { MemoryTokenStore, type MemoryTokenStoreOptions } from "./token-store";
+export { MemoryPasskeyCredentialStore, type MemoryPasskeyCredentialStoreOptions, } from "./passkey-credential-store";
+export { realClock, type Clock } from "./clock";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/memory/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EACL,4BAA4B,EAC5B,KAAK,mCAAmC,GACzC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAA"}

package/dist/types/adapters/memory/key-store.d.ts

@@ -0,0 +1,17 @@
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { Clock } from "./clock";
+export type MemoryKeyStoreOptions = {
+    clock?: Clock;
+    /** Override default `"ES256"` (other supported: `"EdDSA"` per AD11). */
+    signingAlg?: "ES256" | "EdDSA";
+};
+export declare class MemoryKeyStore implements KeyStore {
+    #private;
+    constructor(opts?: MemoryKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/memory/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/key-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAGpC,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,wEAAwE;IACxE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;CAC/B,CAAA;AAED,qBAAa,cAAe,YAAW,QAAQ;;gBAMjC,IAAI,GAAE,qBAA0B;IAKtC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAahD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAK5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAatD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAsCpE"}

package/dist/types/adapters/memory/method-store.d.ts

@@ -0,0 +1,26 @@
+/**
+ * In-memory `MethodStore`. Per-tenant `Map<methodId, MethodConfig>`. Single
+ * process so the eventual + bounded-staleness contract is trivially satisfied.
+ *
+ * `MethodStore` is optional in the IdP — when omitted, the framework falls
+ * back to slicing `MethodConfig[]` out of `ConfigStore.getTenantConfig`. The
+ * memory adapter still ships so the conformance suite has a baseline.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+export type MemoryMethodStoreOptions = {
+    seed?: ReadonlyArray<{
+        tenantId: TenantId;
+        methods: ReadonlyArray<MethodConfig>;
+    }>;
+};
+export declare class MemoryMethodStore implements MethodStore {
+    #private;
+    constructor(opts?: MemoryMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/memory/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/method-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,aAAa,CAAC;QACnB,QAAQ,EAAE,QAAQ,CAAA;QAClB,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;KACrC,CAAC,CAAA;CACH,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAGvC,IAAI,GAAE,wBAA6B;IAQzC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAKhE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAc1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAUlB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAIzB"}

package/dist/types/adapters/memory/passkey-credential-store.d.ts

@@ -0,0 +1,43 @@
+/**
+ * In-memory `PasskeyCredentialStore`. Map-backed, single-process —
+ * suitable for tests and single-instance dev.
+ *
+ * Schema simplification (shared by all three reference adapters): the
+ * `userId` field is also the username lookup key. This matches the
+ * bundled `passkeyMethod`, which sets `userId = parsed.data.username`
+ * at registration time. Hosts that need a richer mapping
+ * (username ≠ userId, multi-username-per-user, etc.) implement
+ * `PasskeyCredentialStore` directly against their own data model.
+ */
+import type { PasskeyCredentialStore, StoredCredential } from "../../methods/passkey";
+export type MemoryPasskeyCredentialStoreOptions = {
+    /**
+     * Optional seed list for tests / dev. Each entry is the full
+     * `StoredCredential` plus its tenant scope. The store treats the
+     * credential's `userId` as the username lookup key.
+     */
+    seed?: Array<{
+        tenantId: string;
+        credential: StoredCredential;
+    }>;
+};
+export declare class MemoryPasskeyCredentialStore implements PasskeyCredentialStore {
+    #private;
+    constructor(opts?: MemoryPasskeyCredentialStoreOptions);
+    findByUsername(username: string, tenantId: string): Promise<{
+        userId: string;
+        credentials: StoredCredential[];
+    } | null>;
+    findById(credentialId: string, tenantId: string): Promise<StoredCredential | null>;
+    updateCounter(input: {
+        credentialId: string;
+        counter: number;
+        tenantId: string;
+    }): Promise<void>;
+    create(input: {
+        userId: string;
+        credential: StoredCredential;
+        tenantId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=passkey-credential-store.d.ts.map

package/dist/types/adapters/memory/passkey-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/passkey-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,MAAM,MAAM,mCAAmC,GAAG;IAChD;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAA;CACjE,CAAA;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;;gBAG7D,IAAI,GAAE,mCAAwC;IAgBpD,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAWhE,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAK7B,aAAa,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOX,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAOlB"}

package/dist/types/adapters/memory/session-store.d.ts

@@ -0,0 +1,19 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { Clock } from "./clock";
+export type MemorySessionStoreOptions = {
+    clock?: Clock;
+};
+export declare class MemorySessionStore implements SessionStore {
+    #private;
+    constructor(opts?: MemorySessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/memory/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAQpC,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAKzC,IAAI,GAAE,yBAA8B;IAI1C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAYrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAgBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAY9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAI9D"}

package/dist/types/adapters/memory/token-store.d.ts

@@ -0,0 +1,28 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { Clock } from "./clock";
+export type MemoryTokenStoreOptions = {
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    clock?: Clock;
+};
+export declare class MemoryTokenStore implements TokenStore {
+    #private;
+    constructor(opts?: MemoryTokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/memory/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/token-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAapC,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,gBAAiB,YAAW,UAAU;;gBAKrC,IAAI,GAAE,uBAA4B;IAIxC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAgBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAqCjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAWlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAWzB"}

package/dist/types/adapters/postgres/audit-log.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Postgres `AuditLog`. Append-only `openauth_audit_events` table; indexed on
+ * `kind` and `ts` for SIEM-style queries. Writes are synchronous — adapters
+ * looking for batching can wrap this with their own buffering layer.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { PostgresExecutor } from "./executor";
+export type PostgresAuditLogOptions = {
+    exec: PostgresExecutor;
+};
+export declare class PostgresAuditLog implements AuditLog {
+    #private;
+    constructor(opts: PostgresAuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/postgres/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/audit-log.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,gBAAgB,CAAA;CACvB,CAAA;AAED,qBAAa,gBAAiB,YAAW,QAAQ;;gBAGnC,IAAI,EAAE,uBAAuB;IAInC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAapE"}