@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/ui/forms.js

@@ -0,0 +1,253 @@
+// src/ui/forms.ts
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => {
+    switch (c) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      case "'":
+        return "&#39;";
+      default:
+        return c;
+    }
+  });
+}
+var BASE_STYLES = `
+:root {
+  color-scheme: light dark;
+
+  --bg-page: #eef0f4;
+  --bg-card: #ffffff;
+  --bg-input: #ffffff;
+  --bg-row: #f5f6f8;
+  --bg-row-hover: #eaecf1;
+  --fg-high: #0e1116;
+  --fg-mid: #4a5160;
+  --fg-low: #8b93a3;
+  --border: #d8dce3;
+  --border-strong: #9aa3b2;
+  --primary: #2f3137;
+  --primary-fg: #ffffff;
+  --primary-hover: #1b1d22;
+  --focus-ring: rgba(47, 49, 55, 0.18);
+  --error-bg: #fdecec;
+  --error-fg: #8a1a1a;
+  --radius: 8px;
+  --shadow-card: 0 1px 2px rgba(15, 18, 25, 0.04), 0 12px 28px rgba(15, 18, 25, 0.08);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg-page: #0e0f12;
+    --bg-card: #16181d;
+    --bg-input: #1c1f25;
+    --bg-row: #20242c;
+    --bg-row-hover: #2a2f38;
+    --fg-high: #f3f4f6;
+    --fg-mid: #b6bcc7;
+    --fg-low: #7a8190;
+    --border: #2a2e36;
+    --border-strong: #3a4049;
+    --primary: #f3f4f6;
+    --primary-fg: #0e1116;
+    --primary-hover: #ffffff;
+    --focus-ring: rgba(243, 244, 246, 0.22);
+    --error-bg: #2a1414;
+    --error-fg: #f5b4b4;
+    --shadow-card: 0 1px 2px rgba(0, 0, 0, 0.5), 0 18px 40px rgba(0, 0, 0, 0.5);
+  }
+}
+
+* { box-sizing: border-box; }
+
+html, body { margin: 0; padding: 0; }
+
+body {
+  min-height: 100vh;
+  background: var(--bg-page);
+  color: var(--fg-high);
+  font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", "Inter", "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+  font-size: 15px;
+  line-height: 1.45;
+  display: grid;
+  place-items: center;
+  padding: 1.5rem;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+main {
+  max-width: 380px;
+  width: 100%;
+  padding: 2rem 1.75rem;
+  background: var(--bg-card);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-card);
+}
+
+h1 {
+  font-size: 1.125rem;
+  font-weight: 600;
+  letter-spacing: -0.01em;
+  margin: 0 0 1.25rem;
+  color: var(--fg-high);
+}
+
+form {
+  display: grid;
+  gap: 0.85rem;
+  margin: 0;
+}
+
+label {
+  display: grid;
+  gap: 0.4rem;
+  font-size: 0.78rem;
+  font-weight: 500;
+  color: var(--fg-mid);
+  text-transform: none;
+}
+
+input {
+  width: 100%;
+  height: 2.5rem;
+  padding: 0 0.85rem;
+  background: var(--bg-input);
+  color: var(--fg-high);
+  border: 1px solid var(--border);
+  border-radius: calc(var(--radius) - 2px);
+  font-size: 0.95rem;
+  font-family: inherit;
+  outline: none;
+  transition: border-color 120ms ease, box-shadow 120ms ease;
+}
+input::placeholder { color: var(--fg-low); }
+input:hover { border-color: var(--border-strong); }
+input:focus {
+  border-color: var(--primary);
+  box-shadow: 0 0 0 3px var(--focus-ring);
+}
+input:user-invalid:not(:focus) {
+  border-color: var(--error-fg);
+}
+
+button {
+  height: 2.5rem;
+  padding: 0 1rem;
+  border: 0;
+  border-radius: calc(var(--radius) - 2px);
+  background: var(--primary);
+  color: var(--primary-fg);
+  font-family: inherit;
+  font-size: 0.9rem;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  cursor: pointer;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  transition: background 120ms ease, transform 80ms ease;
+}
+button:hover { background: var(--primary-hover); }
+button:active { transform: translateY(1px); }
+button:focus-visible { box-shadow: 0 0 0 3px var(--focus-ring); outline: none; }
+
+.error {
+  display: flex;
+  align-items: center;
+  min-height: 2.25rem;
+  padding: 0.5rem 0.85rem;
+  margin: 0 0 0.25rem;
+  background: var(--error-bg);
+  color: var(--error-fg);
+  font-size: 0.82rem;
+  border-radius: calc(var(--radius) - 2px);
+}
+
+.methods {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+  display: grid;
+  gap: 0.5rem;
+}
+.methods a {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  min-height: 2.75rem;
+  padding: 0 1rem;
+  background: var(--bg-row);
+  border: 1px solid var(--border);
+  border-radius: calc(var(--radius) - 2px);
+  color: var(--fg-high);
+  font-size: 0.92rem;
+  font-weight: 500;
+  text-decoration: none;
+  transition: background 120ms ease, border-color 120ms ease, transform 80ms ease;
+}
+.methods a::after {
+  content: "›";
+  color: var(--fg-mid);
+  font-size: 1.15rem;
+  font-weight: 500;
+  line-height: 1;
+}
+.methods a:hover {
+  background: var(--bg-row-hover);
+  border-color: var(--border-strong);
+  color: var(--fg-high);
+}
+.methods a:hover::after {
+  color: var(--fg-high);
+}
+.methods a:active { transform: translateY(1px); }
+.methods a:focus-visible {
+  outline: none;
+  border-color: var(--primary);
+  box-shadow: 0 0 0 3px var(--focus-ring);
+}
+`;
+function htmlPage(opts) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(opts.title)}</title>
+  <style>${BASE_STYLES}</style>
+</head>
+<body>
+  <main>${opts.body}</main>
+</body>
+</html>`;
+}
+function renderForm(opts) {
+  const errorHtml = opts.error ? `<p class="error">${escapeHtml(opts.error)}</p>` : "";
+  const hidden = Object.entries(opts.hidden ?? {}).map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join("");
+  const fields = opts.fields.map((f) => `<label>${escapeHtml(f.label)}
+<input
+  name="${escapeHtml(f.name)}"
+  type="${f.type ?? "text"}"
+  value="${escapeHtml(f.value ?? "")}"
+  ${f.required ? "required" : ""}
+  ${f.autocomplete ? `autocomplete="${escapeHtml(f.autocomplete)}"` : ""}
+  ${f.inputmode ? `inputmode="${escapeHtml(f.inputmode)}"` : ""}
+></label>`).join("");
+  return htmlPage({
+    title: opts.title,
+    body: `<h1>${escapeHtml(opts.title)}</h1>${errorHtml}<form method="POST" action="${escapeHtml(opts.action)}">${hidden}${fields}<button type="submit">${escapeHtml(opts.submit)}</button></form>`
+  });
+}
+export {
+  renderForm,
+  htmlPage,
+  escapeHtml,
+  BASE_STYLES
+};

package/dist/esm/ui/index.js

@@ -0,0 +1,8 @@
+export {
+  renderPicker,
+  renderForm,
+  htmlPage,
+  escapeHtml,
+  buildMethodLink,
+  BASE_STYLES
+};

package/dist/esm/ui/picker.js

@@ -0,0 +1,49 @@
+// src/ui/picker.ts
+import { escapeHtml, htmlPage } from "./forms";
+function buildMethodLink(methodId, ctx) {
+  const params = new URLSearchParams;
+  params.set("client_id", ctx.clientId);
+  params.set("redirect_uri", ctx.redirectUri);
+  params.set("response_type", "code");
+  params.set("method_id", methodId);
+  if (ctx.state)
+    params.set("state", ctx.state);
+  if (ctx.scope)
+    params.set("scope", ctx.scope);
+  if (ctx.nonce)
+    params.set("nonce", ctx.nonce);
+  if (ctx.codeChallenge)
+    params.set("code_challenge", ctx.codeChallenge);
+  if (ctx.codeChallengeMethod)
+    params.set("code_challenge_method", ctx.codeChallengeMethod);
+  if (ctx.audience)
+    params.set("audience", ctx.audience);
+  if (ctx.prompt)
+    params.set("prompt", ctx.prompt);
+  if (ctx.uiLocales)
+    params.set("ui_locales", ctx.uiLocales);
+  return `?${params.toString()}`;
+}
+function renderPicker(methods, ctx) {
+  const items = methods.map((m) => {
+    const label = m.displayName ?? prettyKind(m.kind);
+    return `<li><a href="${escapeHtml(buildMethodLink(m.id, ctx))}">${escapeHtml(label)}</a></li>`;
+  }).join("");
+  const body = `<h1>Sign in</h1><ul class="methods">${items}</ul>`;
+  return new Response(htmlPage({ title: "Sign in", body }), {
+    status: 200,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
+    }
+  });
+}
+function prettyKind(kind) {
+  if (!kind)
+    return "Continue";
+  return kind.split(/[-_]/).map((p) => p.length === 0 ? p : p[0].toUpperCase() + p.slice(1)).join(" ");
+}
+export {
+  renderPicker,
+  buildMethodLink
+};

package/dist/types/adapters/d1/audit-log.d.ts

@@ -0,0 +1,19 @@
+/**
+ * D1 `AuditLog`. Append-only inserts; D1's autoincrement provides the
+ * insertion order index for SIEM queries. Per `ports/audit-log.ts`, `log()`
+ * never throws — durability failures are swallowed because the hot OAuth
+ * paths cannot be gated on the audit log.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { AnyD1Database } from "./types";
+export type D1AuditLogOptions = {
+    db: AnyD1Database;
+};
+export declare class D1AuditLog implements AuditLog {
+    #private;
+    constructor(opts: D1AuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/d1/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,aAAa,CAAA;CAClB,CAAA;AAED,qBAAa,UAAW,YAAW,QAAQ;;gBAG7B,IAAI,EAAE,iBAAiB;IAI7B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpE"}

package/dist/types/adapters/d1/config-store.d.ts

@@ -0,0 +1,20 @@
+/**
+ * D1 `ConfigStore`. JSON-as-TEXT, eventual-consistency reads acceptable per
+ * `ports/CONSISTENCY.md`. Invalidation hook fires on every put.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { AnyD1Database } from "./types";
+export type D1ConfigStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+};
+export declare class D1ConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: D1ConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/d1/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/config-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAKnC,IAAI,EAAE,oBAAoB;IAKhC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAgB5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/d1/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Cloudflare D1 adapter set.
+ *
+ * Per AD8 + the D1 read-replication caveat in `ports/CONSISTENCY.md`, every
+ * operation on the security-critical paths (`TokenStore`, `SessionStore`)
+ * wraps its statement in `db.withSession("first-primary")` so reads observe
+ * the latest write. Read-eventual paths (`ConfigStore`, `KeyStore.signingKeys`,
+ * `MethodStore`, `AuditLog`) use the plain `D1Database` and benefit from
+ * replica reads when available.
+ *
+ * Feature detection — if the `D1Database` runtime predates the Sessions API,
+ * the helper degrades to plain `prepare`. This keeps the adapter compatible
+ * with older Workers runtimes and test shims (bun:sqlite via the
+ * `test/adapters/d1.test.ts` harness) at the cost of relying on
+ * single-replica consistency in those environments.
+ *
+ * @example
+ *   export default {
+ *     async fetch(req, env) {
+ *       const keyStore = new D1KeyStore({ db: env.AUTH })
+ *       const tokenStore = new D1TokenStore({ db: env.AUTH, keyStore })
+ *       // ...
+ *     }
+ *   }
+ */
+export { D1AuditLog, type D1AuditLogOptions } from "./audit-log";
+export { D1ConfigStore, type D1ConfigStoreOptions } from "./config-store";
+export { D1KeyStore, type D1KeyStoreOptions } from "./key-store";
+export { D1MethodStore, type D1MethodStoreOptions } from "./method-store";
+export { D1SessionStore, type D1SessionStoreOptions } from "./session-store";
+export { D1TokenStore, type D1TokenStoreOptions } from "./token-store";
+export { INITIAL_SCHEMA_SQL, migrate } from "./migrations";
+export { isSessionsCapable, primarySession } from "./session";
+export { type AnyD1Database, type D1DatabaseSession, type D1DatabaseWithSessions, type D1SessionBookmark, type D1SessionConstraint, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/d1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEtE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,SAAS,CAAA"}

package/dist/types/adapters/d1/key-store.d.ts

@@ -0,0 +1,17 @@
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { AnyD1Database } from "./types";
+export type D1KeyStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+};
+export declare class D1KeyStore implements KeyStore {
+    #private;
+    constructor(opts: D1KeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/d1/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/key-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;CAC/B,CAAA;AAED,qBAAa,UAAW,YAAW,QAAQ;;gBAM7B,IAAI,EAAE,iBAAiB;IAM7B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBhD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAc5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAkBtD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAgGpE"}

package/dist/types/adapters/d1/method-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * D1 `MethodStore`. `(tenant_id, method_id)` composite key, JSON-as-TEXT
+ * config blob.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { AnyD1Database } from "./types";
+export type D1MethodStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+};
+export declare class D1MethodStore implements MethodStore {
+    #private;
+    constructor(opts: D1MethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/d1/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/method-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAInC,IAAI,EAAE,oBAAoB;IAKhC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAchE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAuB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAelB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAezB"}

package/dist/types/adapters/d1/migrations.d.ts

@@ -0,0 +1,18 @@
+/**
+ * D1 / SQLite schema for the IdP adapters. Mirrors the Postgres schema
+ * exactly with SQLite-flavored types (TEXT for JSON, BLOB for bytes,
+ * INTEGER for timestamps and serials).
+ *
+ * The auth-code payload is encrypted at rest by the adapter before the
+ * ciphertext lands in `openauth_codes.ciphertext` — the DB only ever sees
+ * the JWE compact string.
+ */
+import type { AnyD1Database } from "./types";
+export declare const INITIAL_SCHEMA_SQL: string[];
+/**
+ * Apply the initial schema to a D1 database. Idempotent — every statement
+ * is `CREATE … IF NOT EXISTS`. Deployments using `wrangler d1 migrations
+ * apply` can apply the SQL above directly.
+ */
+export declare function migrate(db: AnyD1Database): Promise<void>;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/types/adapters/d1/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,kBAAkB,UAkE9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9D"}

package/dist/types/adapters/d1/session-store.d.ts

@@ -0,0 +1,20 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { AnyD1Database } from "./types";
+export type D1SessionStoreOptions = {
+    db: AnyD1Database;
+    clock?: () => number;
+};
+export declare class D1SessionStore implements SessionStore {
+    #private;
+    constructor(opts: D1SessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/d1/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAIhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,YAAY;;gBAIrC,IAAI,EAAE,qBAAqB;IAKjC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA2BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAuBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA2B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}

package/dist/types/adapters/d1/session.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Sessions-API helper. Wraps a `D1Database` in a session pinned to the
+ * primary node for read-after-write consistency on security-critical paths.
+ *
+ * If the bundled `D1Database` lacks `withSession` (older runtime), the
+ * helper returns the plain `db` and the caller pays no Sessions-API cost
+ * (and gets eventual-consistency reads — documented in the adapter's
+ * top-level JSDoc).
+ */
+import type { AnyD1Database, D1DatabaseSession, D1DatabaseWithSessions } from "./types";
+export declare function isSessionsCapable(db: AnyD1Database): db is D1DatabaseWithSessions;
+/**
+ * Open a Sessions-API session pinned to the primary node. All `prepare` calls
+ * inside the session see the latest writes; bookmarks may be threaded across
+ * requests by the caller if needed.
+ */
+export declare function primarySession(db: AnyD1Database): D1DatabaseSession;
+//# sourceMappingURL=session.d.ts.map

package/dist/types/adapters/d1/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EACV,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,aAAa,GAChB,EAAE,IAAI,sBAAsB,CAE9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,iBAAiB,CAWnE"}

package/dist/types/adapters/d1/token-store.d.ts

@@ -0,0 +1,29 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { AnyD1Database } from "./types";
+export type D1TokenStoreOptions = {
+    db: AnyD1Database;
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    clock?: () => number;
+};
+export declare class D1TokenStore implements TokenStore {
+    #private;
+    constructor(opts: D1TokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/d1/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/token-store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAG5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,aAAa,CAAA;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,YAAa,YAAW,UAAU;;gBAIjC,IAAI,EAAE,mBAAmB;IAK/B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAuBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IA2EjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAuBlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAazB"}

package/dist/types/adapters/d1/types.d.ts

@@ -0,0 +1,43 @@
+/**
+ * D1 type extensions.
+ *
+ * `@cloudflare/workers-types` < 2024-12 does not yet expose the D1 Sessions
+ * API on its `D1Database` class. We declare the augmentation locally and
+ * feature-detect at runtime: if `db.withSession` is a function the adapter
+ * uses it for read-after-write consistency on the security-critical paths;
+ * otherwise it falls back to plain `prepare`. This keeps the adapter
+ * type-safe today and forward-compatible when the workers-types release
+ * catches up.
+ */
+import type { D1Database, D1PreparedStatement, D1Result } from "@cloudflare/workers-types";
+/**
+ * D1 Sessions API constraints. Documented at
+ * <https://developers.cloudflare.com/d1/best-practices/read-replication/>.
+ *  - `"first-primary"` — pin the session to the primary node. All reads see
+ *    the latest write. Used for security-critical paths.
+ *  - `"first-unconstrained"` — pin to whichever node responds first. Lower
+ *    latency, eventual consistency. Used for JWKS / config reads.
+ */
+export type D1SessionConstraint = "first-primary" | "first-unconstrained";
+/** A session bookmark — opaque token returned by `getBookmark()`. */
+export type D1SessionBookmark = string;
+/** Minimal shape we use from `D1DatabaseSession`. */
+export type D1DatabaseSession = {
+    prepare(query: string): D1PreparedStatement;
+    batch<T = unknown>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+    getBookmark(): D1SessionBookmark | null;
+};
+/**
+ * `D1Database` with the Sessions API. Use this type at the adapter boundary;
+ * the runtime feature-detects `withSession` so consumers can still pass a
+ * plain `D1Database` if Sessions is unavailable in their environment.
+ */
+export type D1DatabaseWithSessions = D1Database & {
+    withSession(constraintOrBookmark?: D1SessionConstraint | D1SessionBookmark): D1DatabaseSession;
+};
+/**
+ * Either a real D1Database or our test shim. Feature detection happens at
+ * call time so the adapter still works against both.
+ */
+export type AnyD1Database = D1Database | D1DatabaseWithSessions;
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/d1/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/d1/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EACnB,QAAQ,EACT,MAAM,2BAA2B,CAAA;AAElC;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG,qBAAqB,CAAA;AAEzE,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEtC,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC7E,WAAW,IAAI,iBAAiB,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG;IAChD,WAAW,CACT,oBAAoB,CAAC,EAAE,mBAAmB,GAAG,iBAAiB,GAC7D,iBAAiB,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,sBAAsB,CAAA"}

package/dist/types/adapters/durable-object/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Cloudflare Durable Objects adapters.
+ *
+ * Durable Objects are an excellent fit for `SessionStore` (flow records)
+ * because every operation on a single DO instance is serialized — atomic
+ * delete-on-read comes for free with `storage.transaction`. Per
+ * `ports/CONSISTENCY.md`, DOs are also acceptable for `TokenStore` in
+ * deployments that don't run D1.
+ *
+ * The adapter is supplied a `DurableObjectStorage` directly (`this.ctx.storage`
+ * from inside a DO class). Users wire their own DO class around the adapter
+ * and forward RPC / fetch calls to the methods. See the JSDoc on
+ * `DurableObjectSessionStore` for the canonical wiring pattern.
+ */
+export { DurableObjectSessionStore, type DurableObjectSessionStoreOptions, } from "./session-store";
+export type { DurableObjectStorageLike, DurableObjectTransactionLike, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/durable-object/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,yBAAyB,EACzB,KAAK,gCAAgC,GACtC,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,SAAS,CAAA"}

package/dist/types/adapters/durable-object/session-store.d.ts

@@ -0,0 +1,21 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { DurableObjectStorageLike, DurableObjectTransactionLike } from "./types";
+export type DurableObjectSessionStoreOptions = {
+    storage: DurableObjectStorageLike;
+    clock?: () => number;
+};
+export declare class DurableObjectSessionStore implements SessionStore {
+    #private;
+    constructor(opts: DurableObjectSessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+export type { DurableObjectStorageLike, DurableObjectTransactionLike };
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/durable-object/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/session-store.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,SAAS,CAAA;AAYhB,MAAM,MAAM,gCAAgC,GAAG;IAC7C,OAAO,EAAE,wBAAwB,CAAA;IACjC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,yBAA0B,YAAW,YAAY;;gBAIhD,IAAI,EAAE,gCAAgC;IAK5C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAkBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA2BlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAmBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA+BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAmB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ9D;AAMD,YAAY,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,CAAA"}