@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/types/types/tenant.d.ts

@@ -0,0 +1,239 @@
+/**
+ * Tenant model + tenant-resolution / callback-recovery types.
+ *
+ * Per AD1, tenancy is **not** a URL concept. A tenant is whatever the
+ * user-supplied `resolveTenant(req)` says it is for an incoming request, plus
+ * a deterministic callback-recovery chain (MAC-bound state, partitioned host,
+ * or `flowId`-in-URI) for the post-redirect leg where the original tenant
+ * signal may no longer be available.
+ *
+ * The minimal state envelope MACed and round-tripped through upstream
+ * providers carries only `{ tenantId, flowId, nonce, kid }`. Everything else
+ * lives in the server-side `FlowRecord` (see `./flow.ts`).
+ */
+/**
+ * Branded tenant id — **opaque to the framework**.
+ *
+ * The framework treats `TenantId` as a comparable string and nothing more.
+ * It never parses it, never assumes a hierarchy or naming convention, never
+ * imposes uniqueness rules, never knows the lifecycle of a tenant. The
+ * embedding application decides what a tenant *is* (an organization, a
+ * workspace, an App-Tenant tuple, a customer, …) and supplies a
+ * `resolveTenant(req)` that maps incoming requests to the right key.
+ *
+ * Common embedding pattern when the host application has two levels of
+ * scoping (e.g. `App` ⇒ `App-Tenant`): encode the tuple into the key.
+ *
+ * ```ts
+ * // Inside the host application's resolveTenant:
+ * return ok(`${app.id}:${appTenant?.id ?? "__default__"}` as TenantId)
+ *
+ * // Inside the host application's ConfigStore.getTenantConfig:
+ * const [appId, subId] = (id as string).split(":")
+ * // merge App defaults + App-Tenant overrides from your own DB ...
+ * ```
+ *
+ * The brand exists to keep arbitrary `string` values from being passed
+ * where a `TenantId` is expected; the *meaning* of the string is the host
+ * application's concern.
+ */
+export type TenantId = string & {
+    readonly __brand: "TenantId";
+};
+/**
+ * Cast helper for code that mints `TenantId` from a validated string. The
+ * framework imposes no validation on the value — callers ensure their key
+ * is non-empty and stable per partition.
+ */
+export declare const asTenantId: (value: string) => TenantId;
+/** OAuth 2.1 grant types in scope for this IdP. Implicit is intentionally absent. */
+export type GrantType = "authorization_code" | "refresh_token" | "client_credentials";
+/**
+ * `MethodType` is the canonical discriminator for an `AuthMethod`. It mirrors
+ * the existing provider taxonomy. The UI uses it to decide which selection /
+ * form to render; the framework uses it as a routing / dispatch hint.
+ */
+export type MethodType = "oauth2" | "oidc" | "password" | "code" | "m2m" | "passkey" | "custom";
+/**
+ * Per-tenant configuration for a single auth method **instance**.
+ *
+ * `id` is the **tenant-local instance id** — the value that ends up in URLs
+ * (`/<id>/*`) and that the framework dispatches by.
+ *
+ * `kind` is the **factory id** — the value that selects which
+ * `AuthMethodFactory` builds this instance. A tenant may register multiple
+ * instances of the same factory (e.g. one Google Workspace SSO and one
+ * consumer Google Sign-In) by giving each instance a unique `id` while
+ * sharing a `kind`.
+ *
+ * `type` is the `MethodType` discriminator the UI uses. The framework
+ * verifies it agrees with the factory's declared type at load time.
+ *
+ * `config` is the tenant-supplied configuration blob. The framework validates
+ * it against the factory's Zod `configSchema` before any handler runs.
+ */
+export type MethodConfig = {
+    id: string;
+    kind: string;
+    type: MethodType;
+    enabled: boolean;
+    config: Record<string, unknown>;
+};
+/** Optional theme metadata. Schema expanded in later phases. */
+export type ThemeConfig = {
+    primary?: string;
+    logo?: string;
+    favicon?: string;
+    background?: string;
+    font?: string;
+};
+/**
+ * Registered OAuth client of this IdP (an app, SPA, mobile, M2M).
+ *
+ * Phase 8: split into a discriminated union so misconfiguration is a type
+ * error, not a runtime check. The runtime in `domain/authorize.ts` still
+ * enforces PKCE for public clients defensively, but hosts will see the
+ * problem at compile time.
+ *
+ * - **Public clients** (SPAs, mobile apps, native apps): no client secret;
+ *   `pkceRequired` is the literal `true`. PKCE is non-negotiable per
+ *   OAuth 2.1 BCP §2.1.1.
+ * - **Confidential clients** (server-side apps, M2M): `secretHash` is
+ *   required (this used to be optional, in practice always set). PKCE
+ *   recommended but may be disabled by the host.
+ */
+export type ClientConfig = PublicClientConfig | ConfidentialClientConfig;
+export type PublicClientConfig = {
+    id: string;
+    name: string;
+    type: "public";
+    redirectUris: string[];
+    grantTypes: GrantType[];
+    scopes: string[];
+    /** Must be `true` for public clients per OAuth 2.1 §2.1.1. */
+    pkceRequired: true;
+    /** Phase 8. */
+    dpopRequired?: boolean;
+};
+export type ConfidentialClientConfig = {
+    id: string;
+    name: string;
+    type: "confidential";
+    /** Hash of the client secret. Required for confidential clients. */
+    secretHash: string;
+    redirectUris: string[];
+    grantTypes: GrantType[];
+    scopes: string[];
+    /**
+     * Default true. Disabling it is permitted for confidential clients but
+     * strongly discouraged; OAuth 2.1 §2.1.1 recommends PKCE for every client.
+     */
+    pkceRequired: boolean;
+    /** Phase 8. */
+    dpopRequired?: boolean;
+};
+export type TenantConfig = {
+    id: TenantId;
+    displayName: string;
+    clients: ClientConfig[];
+    methods: MethodConfig[];
+    theme?: ThemeConfig;
+    /** Set when the tenant needs cross-subdomain SSO. */
+    cookieDomain?: string;
+    /** Override default refresh-token TTL (seconds). */
+    refreshTtl?: number;
+    /** Override default access-token TTL (seconds). */
+    accessTtl?: number;
+};
+/**
+ * Per-request tenant context handed to methods and the user-supplied
+ * `success` callback. `request.raw` is the Web Fetch `Request` the framework
+ * received; `request.custom` is whatever the host returned from the
+ * `IdPOptions.buildCustomContext` hook (request id, decoded JWT claims, mTLS
+ * cert info, geo hints — anything per-request that methods or `success`
+ * should see). Without the hook the blob is `{}`. The same blob is also
+ * persisted on the `FlowRecord` at `/authorize` time so it survives the
+ * upstream redirect and re-presents on the callback side.
+ */
+export type TenantContext = {
+    id: TenantId;
+    config: TenantConfig;
+    request: {
+        raw: Request;
+        custom: Record<string, unknown>;
+    };
+};
+/**
+ * Outcome of the framework's tenant-recovery chain, evaluated **before**
+ * `resolveTenant` runs on the incoming request. Each non-`fresh-request`
+ * variant carries a `flowId`; the framework consumes the matching
+ * `FlowRecord` and dispatches without consulting `resolveTenant`.
+ *
+ * Order of evaluation (see plan §"Tenant Recovery Across Redirects"):
+ *   1. If `callbackHostFor` configured AND host matches a known tenant:
+ *        a. `state` MAC-verifies → host-plus-mac
+ *        b. `flowId` in URI       → host-plus-uri
+ *        c. otherwise              → invalid_request, audit unrecoverable_flow
+ *   2. Else if `state` MAC-verifies → mac-state
+ *   3. Else if `flowId` in registered URI path/query → flow-id-in-uri
+ *   4. Else → fresh-request → call user's `resolveTenant(req)`
+ */
+export type TenantRecovery = {
+    kind: "mac-state";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "host-plus-uri";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "host-plus-mac";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "flow-id-in-uri";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "fresh-request";
+};
+/**
+ * Minimal envelope MACed into the `state` query parameter. Intentionally
+ * tiny — under 256 base64url bytes — so it stays clear of provider URL
+ * limits. **No sensitive data must ever be added here.** Everything else
+ * lives in the server-side `FlowRecord`.
+ */
+export type StateEnvelope = {
+    tenantId: TenantId;
+    flowId: string;
+    /** Per-flow nonce. Distinct from the relying party's `state` param. */
+    nonce: string;
+    /** Key id of the HMAC key used to mint this envelope (`StateKeyRing` lookup). */
+    kid: string;
+};
+/**
+ * HMAC-SHA-256 key entry used to mint / verify the `state` envelope MAC.
+ * The 32-byte key is global (shared across IdP instances) — recovery has to
+ * work before tenant config is loaded, so per-tenant keys would create a
+ * bootstrap problem.
+ */
+export type StateKey = {
+    kid: string;
+    /** 32 raw bytes. */
+    key: Uint8Array;
+};
+/**
+ * State-MAC key ring with overlap-based rotation. `active` mints new state;
+ * any key in `verify` accepts existing state during its overlap window.
+ *
+ * Rotation cadence: monthly. The overlap window must be at least as long as
+ * the flow-record TTL (default 10 minutes); a 1-hour overlap is the
+ * recommended default. New keys are added to `verify` first, promoted to
+ * `active` on the next rotation, then dropped from `verify` after overlap.
+ */
+export type StateKeyRing = {
+    active: StateKey;
+    /** Includes `active` plus any previous keys still inside their overlap window. */
+    verify: ReadonlyArray<StateKey>;
+};
+//# sourceMappingURL=tenant.d.ts.map

package/dist/types/types/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}

package/dist/types/types/token.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Token-domain shapes — auth code payload (snapshot of `FlowRecord` at
+ * handoff), access-token claims, refresh-token payload, and the small
+ * envelopes the `TokenStore` persists.
+ *
+ * Per AD9, access tokens are JWTs (ES256 by default, Ed25519 optional per
+ * AD11) and refresh tokens are opaque server-side records.
+ */
+import type { SubjectClaim } from "./subject";
+import type { TenantId } from "./tenant";
+/**
+ * Payload stored under an auth code. Built at callback time from the consumed
+ * `FlowRecord` plus the method's `success` result. Encrypted at rest by
+ * `TokenStore.saveCode` (see `ports/CONSISTENCY.md`).
+ *
+ * `methodState` is intentionally **not** snapshotted: it served its
+ * upstream-callback purpose and is dropped with the flow record.
+ */
+export type CodePayload = {
+    tenantId: TenantId;
+    clientId: string;
+    appRedirectUri: string;
+    /** Relying party's `state` param, echoed back at success. */
+    appState: string | null;
+    scopes: string[];
+    audience?: string;
+    /** Relying-party → IdP PKCE; verified at `/token` against the RP's verifier. */
+    clientPkce?: {
+        challenge: string;
+        method: "S256";
+    };
+    /** Tenant-local method instance id (`MethodConfig.id`). */
+    methodId: string;
+    /** Factory kind (`MethodConfig.kind`). */
+    methodKind: string;
+    /** User's `requestContext` snapshot, if any. */
+    context?: Record<string, unknown> | null;
+    /** Upstream system's stable identifier (from `MethodResult.success`). */
+    providerSubject: string;
+    /** Typed-per-method properties from `MethodResult.success`. */
+    properties: unknown;
+    /** Auth-code TTL is 60 s — framework refuses anything longer. */
+    expiresAt: number;
+};
+/** Access-token JWT claims this IdP issues. */
+export type AccessTokenClaims = {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    /** Tenant id. */
+    tid: TenantId;
+    /** Tenant-local method instance id that originated this token. */
+    mid?: string;
+    /** Factory kind that originated this token. */
+    mkind?: string;
+    scope?: string;
+    /** DPoP confirmation claim (Phase 8). */
+    cnf?: {
+        jkt: string;
+    };
+    /** The structured subject (matches `SubjectClaim`). Inlined for resource servers. */
+    claim: SubjectClaim;
+};
+/**
+ * Opaque refresh-token payload — persisted in `TokenStore` with strong CAS
+ * semantics (see `ports/CONSISTENCY.md`). The token itself is a random
+ * string; the payload is what the store returns on consume.
+ */
+export type RefreshTokenPayload = {
+    tenantId: TenantId;
+    clientId: string;
+    /** Stable subject id derived from the issued `SubjectClaim`. */
+    subjectId: string;
+    claim: SubjectClaim;
+    scopes: string[];
+    audience?: string;
+    /** Reuse-detection chain id. Rotation issues a new token with the same family. */
+    family: string;
+    /**
+     * Tenant-local method instance id (`MethodConfig.id`) that originated the
+     * chain. Preserved across `refresh_token` rotations so descendant access
+     * tokens carry the original `mid` / `mkind` claims instead of the
+     * grant-type literal "refresh".
+     */
+    methodId: string;
+    /** Factory kind (`MethodConfig.kind`) that originated the chain. */
+    methodKind: string;
+    /** Wall-clock issuance and absolute-expiry timestamps. */
+    issuedAt: number;
+    expiresAt: number;
+};
+/** Response body of `/token` (RFC 6749 §5.1). */
+export type TokenResponse = {
+    access_token: string;
+    token_type: "Bearer" | "DPoP";
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+    id_token?: string;
+};
+//# sourceMappingURL=token.d.ts.map

package/dist/types/types/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/types/token.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACxC,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAA;IACnB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,iBAAiB;IACjB,GAAG,EAAE,QAAQ,CAAA;IACb,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yCAAyC;IACzC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB,qFAAqF;IACrF,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA"}

package/dist/types/ui/forms.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Server-rendered HTML helpers for the bundled credential methods and the
+ * default authorization picker.
+ *
+ * Intentionally minimal — zero JS, no client framework. Hosts that want a
+ * richer UI override `IdPOptions.renderPicker` (for method selection) or
+ * supply their own `success-response` from method handlers (for credential
+ * forms). The helpers escape user-provided strings so callers can drop
+ * arbitrary labels or error messages without thinking about XSS.
+ */
+export declare function escapeHtml(s: string): string;
+export declare const BASE_STYLES = "\n:root {\n  color-scheme: light dark;\n\n  --bg-page: #eef0f4;\n  --bg-card: #ffffff;\n  --bg-input: #ffffff;\n  --bg-row: #f5f6f8;\n  --bg-row-hover: #eaecf1;\n  --fg-high: #0e1116;\n  --fg-mid: #4a5160;\n  --fg-low: #8b93a3;\n  --border: #d8dce3;\n  --border-strong: #9aa3b2;\n  --primary: #2f3137;\n  --primary-fg: #ffffff;\n  --primary-hover: #1b1d22;\n  --focus-ring: rgba(47, 49, 55, 0.18);\n  --error-bg: #fdecec;\n  --error-fg: #8a1a1a;\n  --radius: 8px;\n  --shadow-card: 0 1px 2px rgba(15, 18, 25, 0.04), 0 12px 28px rgba(15, 18, 25, 0.08);\n}\n\n@media (prefers-color-scheme: dark) {\n  :root {\n    --bg-page: #0e0f12;\n    --bg-card: #16181d;\n    --bg-input: #1c1f25;\n    --bg-row: #20242c;\n    --bg-row-hover: #2a2f38;\n    --fg-high: #f3f4f6;\n    --fg-mid: #b6bcc7;\n    --fg-low: #7a8190;\n    --border: #2a2e36;\n    --border-strong: #3a4049;\n    --primary: #f3f4f6;\n    --primary-fg: #0e1116;\n    --primary-hover: #ffffff;\n    --focus-ring: rgba(243, 244, 246, 0.22);\n    --error-bg: #2a1414;\n    --error-fg: #f5b4b4;\n    --shadow-card: 0 1px 2px rgba(0, 0, 0, 0.5), 0 18px 40px rgba(0, 0, 0, 0.5);\n  }\n}\n\n* { box-sizing: border-box; }\n\nhtml, body { margin: 0; padding: 0; }\n\nbody {\n  min-height: 100vh;\n  background: var(--bg-page);\n  color: var(--fg-high);\n  font-family: ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", \"Inter\", \"Helvetica Neue\", sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\";\n  font-size: 15px;\n  line-height: 1.45;\n  display: grid;\n  place-items: center;\n  padding: 1.5rem;\n  -webkit-font-smoothing: antialiased;\n  -moz-osx-font-smoothing: grayscale;\n}\n\nmain {\n  max-width: 380px;\n  width: 100%;\n  padding: 2rem 1.75rem;\n  background: var(--bg-card);\n  border-radius: var(--radius);\n  box-shadow: var(--shadow-card);\n}\n\nh1 {\n  font-size: 1.125rem;\n  font-weight: 600;\n  letter-spacing: -0.01em;\n  margin: 0 0 1.25rem;\n  color: var(--fg-high);\n}\n\nform {\n  display: grid;\n  gap: 0.85rem;\n  margin: 0;\n}\n\nlabel {\n  display: grid;\n  gap: 0.4rem;\n  font-size: 0.78rem;\n  font-weight: 500;\n  color: var(--fg-mid);\n  text-transform: none;\n}\n\ninput {\n  width: 100%;\n  height: 2.5rem;\n  padding: 0 0.85rem;\n  background: var(--bg-input);\n  color: var(--fg-high);\n  border: 1px solid var(--border);\n  border-radius: calc(var(--radius) - 2px);\n  font-size: 0.95rem;\n  font-family: inherit;\n  outline: none;\n  transition: border-color 120ms ease, box-shadow 120ms ease;\n}\ninput::placeholder { color: var(--fg-low); }\ninput:hover { border-color: var(--border-strong); }\ninput:focus {\n  border-color: var(--primary);\n  box-shadow: 0 0 0 3px var(--focus-ring);\n}\ninput:user-invalid:not(:focus) {\n  border-color: var(--error-fg);\n}\n\nbutton {\n  height: 2.5rem;\n  padding: 0 1rem;\n  border: 0;\n  border-radius: calc(var(--radius) - 2px);\n  background: var(--primary);\n  color: var(--primary-fg);\n  font-family: inherit;\n  font-size: 0.9rem;\n  font-weight: 600;\n  letter-spacing: 0.01em;\n  cursor: pointer;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  gap: 0.5rem;\n  transition: background 120ms ease, transform 80ms ease;\n}\nbutton:hover { background: var(--primary-hover); }\nbutton:active { transform: translateY(1px); }\nbutton:focus-visible { box-shadow: 0 0 0 3px var(--focus-ring); outline: none; }\n\n.error {\n  display: flex;\n  align-items: center;\n  min-height: 2.25rem;\n  padding: 0.5rem 0.85rem;\n  margin: 0 0 0.25rem;\n  background: var(--error-bg);\n  color: var(--error-fg);\n  font-size: 0.82rem;\n  border-radius: calc(var(--radius) - 2px);\n}\n\n.methods {\n  list-style: none;\n  padding: 0;\n  margin: 0;\n  display: grid;\n  gap: 0.5rem;\n}\n.methods a {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  min-height: 2.75rem;\n  padding: 0 1rem;\n  background: var(--bg-row);\n  border: 1px solid var(--border);\n  border-radius: calc(var(--radius) - 2px);\n  color: var(--fg-high);\n  font-size: 0.92rem;\n  font-weight: 500;\n  text-decoration: none;\n  transition: background 120ms ease, border-color 120ms ease, transform 80ms ease;\n}\n.methods a::after {\n  content: \"\u203A\";\n  color: var(--fg-mid);\n  font-size: 1.15rem;\n  font-weight: 500;\n  line-height: 1;\n}\n.methods a:hover {\n  background: var(--bg-row-hover);\n  border-color: var(--border-strong);\n  color: var(--fg-high);\n}\n.methods a:hover::after {\n  color: var(--fg-high);\n}\n.methods a:active { transform: translateY(1px); }\n.methods a:focus-visible {\n  outline: none;\n  border-color: var(--primary);\n  box-shadow: 0 0 0 3px var(--focus-ring);\n}\n";
+export declare function htmlPage(opts: {
+    title: string;
+    body: string;
+}): string;
+export type FormField = {
+    name: string;
+    label: string;
+    type?: "text" | "password" | "email" | "tel";
+    value?: string;
+    required?: boolean;
+    autocomplete?: string;
+    inputmode?: string;
+};
+/** Build a `<form>` POSTing to `action`. */
+export declare function renderForm(opts: {
+    title: string;
+    action: string;
+    fields: FormField[];
+    submit: string;
+    error?: string;
+    hidden?: Record<string, string>;
+}): string;
+//# sourceMappingURL=forms.d.ts.map

package/dist/types/ui/forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms.d.ts","sourceRoot":"","sources":["../../../src/ui/forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAiB5C;AAED,eAAO,MAAM,WAAW,+jJAoMvB,CAAA;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAatE;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,KAAK,CAAA;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,SAAS,EAAE,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,GAAG,MAAM,CA2BT"}

package/dist/types/ui/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Public surface for the built-in server-rendered UI helpers.
+ *
+ * Hosts who want their own UI typically don't import from here at all —
+ * they intercept at the host application layer. Hosts that want to keep
+ * the defaults but tweak around the edges (e.g. supply a custom picker
+ * while keeping the default credential forms) can pull renderForm /
+ * renderPicker from here.
+ */
+export { renderForm, escapeHtml, htmlPage, BASE_STYLES } from "./forms";
+export type { FormField } from "./forms";
+export { renderPicker, buildMethodLink } from "./picker";
+export type { PickerMethod, PickerContext } from "./picker";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACvE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AACxD,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}

package/dist/types/ui/picker.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Default provider picker — rendered when an `/authorize` request matches
+ * more than one enabled method and no `method_id` was specified.
+ *
+ * Hosts that want a fully custom UI override `IdPOptions.renderPicker`.
+ * Both the default and any override return a `Response`; the framework
+ * applies caching headers afterward.
+ */
+import type { PickerContext, PickerMethod } from "../types/picker";
+export type { PickerContext, PickerMethod };
+/**
+ * Build an `/authorize` URL that pre-selects a specific `method_id` while
+ * carrying every other OAuth param through unchanged.
+ */
+export declare function buildMethodLink(methodId: string, ctx: PickerContext): string;
+/** Default styled HTML picker. */
+export declare function renderPicker(methods: PickerMethod[], ctx: PickerContext): Response;
+//# sourceMappingURL=picker.d.ts.map

package/dist/types/ui/picker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../../src/ui/picker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGlE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AAE3C;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAgB5E;AAED,kCAAkC;AAClC,wBAAgB,YAAY,CAC1B,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,GACjB,QAAQ,CAeV"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_mustachio/openauth",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -9,15 +9,22 @@
   "type": "module",
   "scripts": {
     "build": "bun run script/build.ts",
-    "test": "bun test"
+    "build:watch": "bun run script/build-watch.ts",
+    "test": "bun test",
+    "preview:ui": "bun --hot run script/preview-ui.ts"
   },
   "sideEffects": false,
   "devDependencies": {
+    "@aws-sdk/client-dynamodb": "3.1045.0",
+    "@aws-sdk/client-kms": "3.1045.0",
+    "@aws-sdk/lib-dynamodb": "3.1045.0",
     "@cloudflare/workers-types": "4.20241205.0",
+    "@electric-sql/pglite": "0.4.5",
     "@tsconfig/node22": "22.0.0",
     "@types/node": "22.10.1",
-    "arctic": "2.2.2",
+    "aws-sdk-client-mock": "4.1.0",
     "hono": "4.11.3",
+    "postgres": "3.4.9",
     "typescript": "5.6.3",
     "valibot": "1.0.0-beta.15"
   },
@@ -26,6 +33,10 @@
       "import": "./dist/esm/index.js",
       "types": "./dist/types/index.d.ts"
     },
+    "./adapters/*": {
+      "import": "./dist/esm/adapters/*/index.js",
+      "types": "./dist/types/adapters/*/index.d.ts"
+    },
     "./*": {
       "import": "./dist/esm/*.js",
       "types": "./dist/types/*.d.ts"
@@ -36,14 +47,38 @@
     }
   },
   "peerDependencies": {
-    "arctic": "^2.2.2",
-    "hono": "^4.0.0"
+    "@aws-sdk/client-dynamodb": "^3.0.0",
+    "@aws-sdk/client-kms": "^3.0.0",
+    "@aws-sdk/lib-dynamodb": "^3.0.0",
+    "@cloudflare/workers-types": "^4.0.0",
+    "hono": "^4.0.0",
+    "postgres": "^3.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@aws-sdk/client-dynamodb": {
+      "optional": true
+    },
+    "@aws-sdk/client-kms": {
+      "optional": true
+    },
+    "@aws-sdk/lib-dynamodb": {
+      "optional": true
+    },
+    "@cloudflare/workers-types": {
+      "optional": true
+    },
+    "postgres": {
+      "optional": true
+    }
   },
   "dependencies": {
+    "@noble/hashes": "2.2.0",
     "@simplewebauthn/server": "13.1.1",
     "@standard-schema/spec": "1.0.0-beta.3",
     "aws4fetch": "1.0.20",
-    "jose": "5.9.6"
+    "jose": "5.9.6",
+    "oauth4webapi": "3.8.6",
+    "zod": "^3.24.1"
   },
   "files": [
     "src",

package/src/adapters/d1/audit-log.ts

@@ -0,0 +1,32 @@
+/**
+ * D1 `AuditLog`. Append-only inserts; D1's autoincrement provides the
+ * insertion order index for SIEM queries. Per `ports/audit-log.ts`, `log()`
+ * never throws — durability failures are swallowed because the hot OAuth
+ * paths cannot be gated on the audit log.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log"
+
+import type { AnyD1Database } from "./types"
+
+export type D1AuditLogOptions = {
+  db: AnyD1Database
+}
+
+export class D1AuditLog implements AuditLog {
+  #db: AnyD1Database
+
+  constructor(opts: D1AuditLogOptions) {
+    this.#db = opts.db
+  }
+
+  async log(event: AuditEvent & { timestamp: number }): Promise<void> {
+    try {
+      await this.#db
+        .prepare(
+          `INSERT INTO openauth_audit_events (ts, kind, payload) VALUES (?1, ?2, ?3)`,
+        )
+        .bind(event.timestamp, event.kind, JSON.stringify(event))
+        .run()
+    } catch {}
+  }
+}

package/src/adapters/d1/config-store.ts

@@ -0,0 +1,67 @@
+/**
+ * D1 `ConfigStore`. JSON-as-TEXT, eventual-consistency reads acceptable per
+ * `ports/CONSISTENCY.md`. Invalidation hook fires on every put.
+ */
+import type { ConfigStore } from "../../ports/config-store"
+import { authError } from "../../types/error"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+import type { TenantConfig, TenantId } from "../../types/tenant"
+
+import type { AnyD1Database } from "./types"
+
+export type D1ConfigStoreOptions = {
+  db: AnyD1Database
+  clock?: () => number
+}
+
+export class D1ConfigStore implements ConfigStore {
+  #db: AnyD1Database
+  #clock: () => number
+  #listeners = new Set<(id: TenantId) => void>()
+
+  constructor(opts: D1ConfigStoreOptions) {
+    this.#db = opts.db
+    this.#clock = opts.clock ?? (() => Date.now())
+  }
+
+  async getTenantConfig(id: TenantId): Promise<Result<TenantConfig>> {
+    let row: { config: string } | null
+    try {
+      row = await this.#db
+        .prepare(`SELECT config FROM openauth_tenants WHERE id = ?1`)
+        .bind(id)
+        .first<{ config: string }>()
+    } catch (e) {
+      return err(authError.internalError("getTenantConfig: query failed", e))
+    }
+    if (!row) {
+      return err(authError.tenantNotFound(`tenant "${id}" not found`, id))
+    }
+    return ok(JSON.parse(row.config) as TenantConfig)
+  }
+
+  async putTenantConfig(config: TenantConfig): Promise<Result<void>> {
+    try {
+      await this.#db
+        .prepare(
+          `INSERT INTO openauth_tenants (id, config, updated_at) VALUES (?1, ?2, ?3)
+           ON CONFLICT(id) DO UPDATE SET config = excluded.config, updated_at = excluded.updated_at`,
+        )
+        .bind(config.id, JSON.stringify(config), this.#clock())
+        .run()
+    } catch (e) {
+      return err(authError.internalError("putTenantConfig: insert failed", e))
+    }
+    for (const fn of this.#listeners) {
+      try {
+        fn(config.id)
+      } catch {}
+    }
+    return ok(undefined)
+  }
+
+  onInvalidate(handler: (id: TenantId) => void): void {
+    this.#listeners.add(handler)
+  }
+}