@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/adapters/durable-object/types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Minimal `DurableObjectStorage` shape the adapter depends on. Defined
+ * locally so the adapter is testable without a real Workers runtime and so
+ * it stays compatible with both legacy and current versions of
+ * `@cloudflare/workers-types`.
+ *
+ * Real `DurableObjectStorage` instances satisfy this interface — pass
+ * `this.ctx.storage` directly.
+ */
+export type DurableObjectTransactionLike = {
+    get<T>(key: string): Promise<T | undefined>;
+    put<T>(key: string, value: T): Promise<void>;
+    delete(key: string): Promise<boolean>;
+};
+export type DurableObjectStorageLike = DurableObjectTransactionLike & {
+    /**
+     * Run a closure atomically. On any DO, all operations within `closure`
+     * see a consistent snapshot of storage; the closure's return value is
+     * resolved after the writes are durable.
+     */
+    transaction<T>(closure: (txn: DurableObjectTransactionLike) => Promise<T>): Promise<T>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/durable-object/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/durable-object/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IAC3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG,4BAA4B,GAAG;IACpE;;;;OAIG;IACH,WAAW,CAAC,CAAC,EACX,OAAO,EAAE,CAAC,GAAG,EAAE,4BAA4B,KAAK,OAAO,CAAC,CAAC,CAAC,GACzD,OAAO,CAAC,CAAC,CAAC,CAAA;CACd,CAAA"}

package/dist/types/adapters/dynamo/audit-log.d.ts

@@ -0,0 +1,19 @@
+/**
+ * DynamoDB `AuditLog`. `pk="audit"`, `sk="<paddedTs>:<rand>"` so a Query
+ * pulls events in insertion order. As with all `AuditLog` adapters, `log()`
+ * never throws — durability failures are swallowed so the IdP's hot paths
+ * are not gated on the log.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { DynamoExecutor } from "./client";
+export type DynamoAuditLogOptions = {
+    exec: DynamoExecutor;
+};
+export declare class DynamoAuditLog implements AuditLog {
+    #private;
+    constructor(opts: DynamoAuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/dynamo/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,cAAc,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,QAAQ;;gBAGjC,IAAI,EAAE,qBAAqB;IAIjC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAapE"}

package/dist/types/adapters/dynamo/client.d.ts

@@ -0,0 +1,111 @@
+/**
+ * `DynamoExecutor` — the operation surface the adapters depend on.
+ *
+ * Keeps the AWS SDK out of the adapter's import graph. Production users
+ * wire the executor via `fromDynamoDBClient(docClient, tableName)`; tests
+ * supply an in-memory implementation (`test/helpers/dynamo-shim.ts`).
+ *
+ * All operations target a single table (the adapter is single-table by
+ * design — pk + sk + optional GSIs). The executor knows the table name; the
+ * adapter only passes keys + data.
+ */
+export type DynamoKey = {
+    pk: string;
+    sk: string;
+};
+/**
+ * Strong read by primary key. `consistentRead` MUST be honoured for every
+ * security-critical read (`getCode`, `getRefresh`, `getFlow`) — DynamoDB
+ * defaults to eventually consistent reads which violate the contracts in
+ * `ports/CONSISTENCY.md`.
+ */
+export type DynamoGetInput = {
+    key: DynamoKey;
+    consistentRead: boolean;
+};
+/**
+ * Insert (`condition: "not-exists"`) or unconditional put. The adapter uses:
+ *  - `"not-exists"` for code / refresh / flow inserts so a duplicate token
+ *    never silently overwrites.
+ *  - `"exists"` for read-modify-write paths (e.g. `updateFlowMethodState`)
+ *    so the put fails if a concurrent `consumeFlow` deleted the row between
+ *    the prior `get` and this `put`. The executor surfaces a
+ *    `ConditionalCheckFailedException` that callers translate into a typed
+ *    failure.
+ */
+export type DynamoPutInput = {
+    item: Record<string, unknown> & DynamoKey;
+    condition?: "not-exists" | "exists";
+};
+/**
+ * Atomic delete-on-read — equivalent to `DeleteItem` with
+ * `ReturnValues=ALL_OLD`. Concurrent calls resolve to exactly one winner
+ * that gets the row back; losers get `undefined`.
+ */
+export type DynamoDeleteInput = {
+    key: DynamoKey;
+};
+/**
+ * Conditional UPDATE used for the refresh-token rotation. Sets `consumed_at`
+ * iff it is currently absent. Returns the post-update item on success;
+ * resolves with `null` if the condition failed (`ConditionalCheckFailed`).
+ */
+export type DynamoUpdateConsumeRefreshInput = {
+    key: DynamoKey;
+    now: number;
+};
+/**
+ * Query items by partition key (and optionally a sort-key prefix). Strongly
+ * consistent for the refresh-revoke paths.
+ */
+export type DynamoQueryInput = {
+    pk: string;
+    /** Sort-key prefix filter — emits `begins_with(sk, prefix)`. */
+    skBeginsWith?: string;
+    consistentRead: boolean;
+    /** Filter by an attribute (e.g. `family = :v` for `revokeFamily` via GSI). */
+    filter?: {
+        attribute: string;
+        equals: string;
+    };
+};
+export type DynamoQueryByGsiInput = {
+    /**
+     * GSI name configured on the table. Each entry corresponds to a GSI
+     * the bundled adapters need:
+     *   - `family-index`         (refresh-token family revocation)
+     *   - `subject-index`        (revokeBySubject)
+     *   - `passkey-user-index`   (PasskeyCredentialStore.findByUsername)
+     */
+    indexName: "family-index" | "subject-index" | "passkey-user-index";
+    /** Hash key value on the GSI. */
+    hashKey: string;
+};
+/**
+ * Update a single item's attributes — equivalent to DynamoDB's
+ * `UpdateItem` with a `SET` expression over each provided attribute.
+ *
+ * Used by passkey-counter updates today; future Phase 8 features
+ * (DPoP jti replay, etc.) may reuse it.
+ */
+export type DynamoUpdateItemInput = {
+    key: DynamoKey;
+    /** Attribute name → new value. Top-level only, no nested updates. */
+    set: Record<string, unknown>;
+};
+export type DynamoExecutor = {
+    get(input: DynamoGetInput): Promise<Record<string, unknown> | undefined>;
+    put(input: DynamoPutInput): Promise<void>;
+    /** Returns the deleted item if one was deleted; `undefined` otherwise. */
+    delete(input: DynamoDeleteInput): Promise<Record<string, unknown> | undefined>;
+    /**
+     * Atomic refresh-token claim. Returns the post-update item on success;
+     * `null` if the condition failed (already-consumed race).
+     */
+    consumeRefresh(input: DynamoUpdateConsumeRefreshInput): Promise<Record<string, unknown> | null>;
+    query(input: DynamoQueryInput): Promise<Record<string, unknown>[]>;
+    queryByGsi(input: DynamoQueryByGsiInput): Promise<Record<string, unknown>[]>;
+    /** Generic attribute update. No-op if the item does not exist. */
+    updateItem(input: DynamoUpdateItemInput): Promise<void>;
+};
+//# sourceMappingURL=client.d.ts.map

package/dist/types/adapters/dynamo/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,SAAS,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;IACzC,SAAS,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAA;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,SAAS,CAAA;CACf,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,OAAO,CAAA;IACvB,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;;OAMG;IACH,SAAS,EAAE,cAAc,GAAG,eAAe,GAAG,oBAAoB,CAAA;IAClE,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,EAAE,SAAS,CAAA;IACd,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAA;IACxE,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,0EAA0E;IAC1E,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAA;IAC9E;;;OAGG;IACH,cAAc,CACZ,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;IAC1C,KAAK,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5E,kEAAkE;IAClE,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD,CAAA"}

package/dist/types/adapters/dynamo/config-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * DynamoDB `ConfigStore`. `pk="tenant"`, `sk=<tenantId>`. Read-eventual
+ * by default (config is read-heavy, write-rare); the invalidation hook
+ * fires on every `putTenantConfig` so in-process caches drop stale values
+ * immediately.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { DynamoExecutor } from "./client";
+export type DynamoConfigStoreOptions = {
+    exec: DynamoExecutor;
+};
+export declare class DynamoConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: DynamoConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/dynamo/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/config-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,cAAc,CAAA;CACrB,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAIvC,IAAI,EAAE,wBAAwB;IAIpC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAgB5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAqBlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/dynamo/index.d.ts

@@ -0,0 +1,60 @@
+/**
+ * AWS DynamoDB adapter set.
+ *
+ * Single-table design with `pk` / `sk` primary key plus three GSIs:
+ *
+ *   `family-index`         hash = `family`        (revokeFamily)
+ *   `subject-index`        hash = `subject_key`   (revokeBySubject) — value is `<tenantId>#<subjectId>`
+ *   `passkey-user-index`   hash = `user_key`      (PasskeyCredentialStore.findByUsername) — value is `<tenantId>#<userId>`
+ *
+ * The adapter satisfies every contract in `ports/CONSISTENCY.md` provided
+ * the underlying calls use `ConsistentRead=true` on the strong reads and
+ * `ConditionExpression` on the rotation `UpdateItem` — both are handled by
+ * `fromDynamoDBClient`.
+ *
+ * Wiring:
+ * @example
+ *   import { DynamoDBClient } from "@aws-sdk/client-dynamodb"
+ *   import { DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb"
+ *   import {
+ *     fromDynamoDBClient,
+ *     DynamoTokenStore,
+ *     DynamoSessionStore,
+ *     // ...
+ *   } from "@_mustachio/openauth/adapters/dynamo"
+ *
+ *   const docClient = DynamoDBDocumentClient.from(new DynamoDBClient({ region: "us-east-1" }))
+ *   const exec = fromDynamoDBClient(docClient, "openauth")
+ *   const keyStore = new DynamoKeyStore({ exec })
+ *   const tokenStore = new DynamoTokenStore({ exec, keyStore })
+ *
+ * Table creation is left to the operator (Terraform / CDK / `aws dynamodb
+ * create-table`). The schema you need:
+ *
+ *   Table: openauth (or any name you choose)
+ *     Hash key:  pk (S)
+ *     Range key: sk (S)
+ *     TTL attribute: `ttl` (epoch seconds)
+ *
+ *   GSI: family-index
+ *     Hash key: family (S)
+ *     Projection: ALL
+ *
+ *   GSI: subject-index
+ *     Hash key: subject_key (S)
+ *     Projection: ALL
+ *
+ *   GSI: passkey-user-index
+ *     Hash key: user_key (S)
+ *     Projection: ALL
+ */
+export { DynamoAuditLog, type DynamoAuditLogOptions } from "./audit-log";
+export { DynamoConfigStore, type DynamoConfigStoreOptions, } from "./config-store";
+export { DynamoKeyStore, type DynamoKeyStoreOptions } from "./key-store";
+export { DynamoMethodStore, type DynamoMethodStoreOptions, } from "./method-store";
+export { DynamoSessionStore, type DynamoSessionStoreOptions, } from "./session-store";
+export { DynamoTokenStore, type DynamoTokenStoreOptions } from "./token-store";
+export { DynamoPasskeyCredentialStore, type DynamoPasskeyCredentialStoreOptions, } from "./passkey-credential-store";
+export { fromDynamoDBClient } from "./sdk";
+export type { DynamoDeleteInput, DynamoExecutor, DynamoGetInput, DynamoKey, DynamoPutInput, DynamoQueryByGsiInput, DynamoQueryInput, DynamoUpdateConsumeRefreshInput, DynamoUpdateItemInput, } from "./client";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/dynamo/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EACL,4BAA4B,EAC5B,KAAK,mCAAmC,GACzC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAA;AAC1C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/types/adapters/dynamo/key-store.d.ts

@@ -0,0 +1,23 @@
+import type { EncryptionKey, KeyStore, KeyWrapper, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { DynamoExecutor } from "./client";
+export type DynamoKeyStoreOptions = {
+    exec: DynamoExecutor;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+    /**
+     * Optional envelope that encrypts private JWKs and encryption-key bytes
+     * before they leave the process. STRONGLY RECOMMENDED in production.
+     * Pair with a cloud KMS or HSM-backed implementation.
+     */
+    wrapper?: KeyWrapper;
+};
+export declare class DynamoKeyStore implements KeyStore {
+    #private;
+    constructor(opts: DynamoKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/dynamo/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/key-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,EACX,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,YAAW,QAAQ;;gBAOjC,IAAI,EAAE,qBAAqB;IAOjC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBhD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAU5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAkBtD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CA+JpE"}

package/dist/types/adapters/dynamo/method-store.d.ts

@@ -0,0 +1,20 @@
+/**
+ * DynamoDB `MethodStore`. `pk="tenant-methods:<tenantId>"`, `sk=<methodId>`.
+ * Co-locating methods per-tenant lets `listMethods` use a single Query.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { DynamoExecutor } from "./client";
+export type DynamoMethodStoreOptions = {
+    exec: DynamoExecutor;
+};
+export declare class DynamoMethodStore implements MethodStore {
+    #private;
+    constructor(opts: DynamoMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/dynamo/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/method-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAI9C,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,cAAc,CAAA;CACrB,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAGvC,IAAI,EAAE,wBAAwB;IAIpC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAgBhE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAqB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAgBlB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAYzB"}

package/dist/types/adapters/dynamo/passkey-credential-store.d.ts

@@ -0,0 +1,47 @@
+/**
+ * DynamoDB `PasskeyCredentialStore`.
+ *
+ * Single-table layout, one item per credential:
+ *
+ *   pk = "passkey-cred"
+ *   sk = "<tenantId>#<credentialId>"
+ *   user_key = "<tenantId>#<userId>"       // GSI hash for findByUsername
+ *   tenant_id, user_id, public_key, counter, transports, created_at
+ *
+ * Required GSI on the table (alongside `family-index` /
+ * `subject-index` from `DynamoTokenStore`):
+ *
+ *   passkey-user-index
+ *     Hash key: user_key (S)
+ *     Projection: ALL
+ *
+ * The reference adapter treats `userId` as the username lookup key —
+ * matching the bundled `passkeyMethod`. Hosts that need
+ * username ≠ userId implement `PasskeyCredentialStore` directly.
+ */
+import type { PasskeyCredentialStore, StoredCredential } from "../../methods/passkey";
+import type { DynamoExecutor } from "./client";
+export type DynamoPasskeyCredentialStoreOptions = {
+    exec: DynamoExecutor;
+    clock?: () => number;
+};
+export declare class DynamoPasskeyCredentialStore implements PasskeyCredentialStore {
+    #private;
+    constructor(opts: DynamoPasskeyCredentialStoreOptions);
+    findByUsername(username: string, tenantId: string): Promise<{
+        userId: string;
+        credentials: StoredCredential[];
+    } | null>;
+    findById(credentialId: string, tenantId: string): Promise<StoredCredential | null>;
+    updateCounter(input: {
+        credentialId: string;
+        counter: number;
+        tenantId: string;
+    }): Promise<void>;
+    create(input: {
+        userId: string;
+        credential: StoredCredential;
+        tenantId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=passkey-credential-store.d.ts.map

package/dist/types/adapters/dynamo/passkey-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/passkey-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;;gBAI7D,IAAI,EAAE,mCAAmC;IAK/C,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAiBhE,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAS7B,aAAa,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUX,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBlB"}

package/dist/types/adapters/dynamo/sdk.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `fromDynamoDBClient` — wires the `DynamoExecutor` interface to a real AWS
+ * SDK `DynamoDBDocumentClient`. Adapter consumers using AWS in production
+ * call this factory once, then pass the returned executor into every store
+ * adapter.
+ *
+ * The AWS SDK is imported via `@aws-sdk/lib-dynamodb` exclusively; the bare
+ * client is the caller's concern (they can configure region, creds, retries,
+ * etc.). This file is the **only** place in the package that imports the
+ * AWS SDK at runtime — keeping the adapter surface clean and the bundle
+ * lean for non-AWS consumers.
+ *
+ * @example
+ *   import { DynamoDBClient } from "@aws-sdk/client-dynamodb"
+ *   import { DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb"
+ *   const docClient = DynamoDBDocumentClient.from(new DynamoDBClient({}))
+ *   const exec = fromDynamoDBClient(docClient, "openauth")
+ *   const tokenStore = new DynamoTokenStore({ exec, keyStore })
+ */
+import type { DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb";
+import type { DynamoExecutor } from "./client";
+export declare function fromDynamoDBClient(client: DynamoDBDocumentClient, tableName: string): DynamoExecutor;
+//# sourceMappingURL=sdk.d.ts.map

package/dist/types/adapters/dynamo/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AASnE,OAAO,KAAK,EAEV,cAAc,EAOf,MAAM,UAAU,CAAA;AAEjB,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,SAAS,EAAE,MAAM,GAChB,cAAc,CA4IhB"}

package/dist/types/adapters/dynamo/session-store.d.ts

@@ -0,0 +1,20 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { DynamoExecutor } from "./client";
+export type DynamoSessionStoreOptions = {
+    exec: DynamoExecutor;
+    clock?: () => number;
+};
+export declare class DynamoSessionStore implements SessionStore {
+    #private;
+    constructor(opts: DynamoSessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/dynamo/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAIzC,IAAI,EAAE,yBAAyB;IAKrC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoDlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAsBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAkBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAsB9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAQ9D"}

package/dist/types/adapters/dynamo/token-store.d.ts

@@ -0,0 +1,29 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { DynamoExecutor } from "./client";
+export type DynamoTokenStoreOptions = {
+    exec: DynamoExecutor;
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    clock?: () => number;
+};
+export declare class DynamoTokenStore implements TokenStore {
+    #private;
+    constructor(opts: DynamoTokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/dynamo/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/dynamo/token-store.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,cAAc,CAAA;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,gBAAiB,YAAW,UAAU;;gBAIrC,IAAI,EAAE,uBAAuB;IAKnC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA2BlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAkBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAqBlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAqDjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAmBlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAmBzB"}

package/dist/types/adapters/kms/in-memory-backing.d.ts

@@ -0,0 +1,9 @@
+/**
+ * In-memory `KmsBackingStore`. Used by the KMS adapter conformance test and
+ * for single-instance dev. Production deployments pass a real backing store
+ * (Postgres, DynamoDB, S3-with-versioning, etc.) so KMS-wrapped key
+ * envelopes survive process restarts.
+ */
+import type { KmsBackingStore } from "./types";
+export declare function inMemoryKmsBackingStore(): KmsBackingStore;
+//# sourceMappingURL=in-memory-backing.d.ts.map

package/dist/types/adapters/kms/in-memory-backing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-backing.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/in-memory-backing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EACV,eAAe,EAGhB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,uBAAuB,IAAI,eAAe,CAuBzD"}

package/dist/types/adapters/kms/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * KMS-backed `KeyStore` adapter set.
+ *
+ * Envelope encryption: private JWK material is wrapped under an AWS KMS
+ * master key and stored in a pluggable backing store (`KmsBackingStore`).
+ * KMS Encrypt / Decrypt are the only KMS operations on the hot path; the
+ * framework still receives a real `CryptoKey` for JWT signing so no surgery
+ * in `domain/jwt.ts` is needed.
+ *
+ * @example
+ *   import { KMSClient } from "@aws-sdk/client-kms"
+ *   import {
+ *     fromKmsClient,
+ *     inMemoryKmsBackingStore,
+ *     KmsKeyStore,
+ *   } from "@_mustachio/openauth/adapters/kms"
+ *
+ *   const kms = fromKmsClient(
+ *     new KMSClient({ region: "us-east-1" }),
+ *     process.env.IDP_KMS_KEY_ARN!,
+ *   )
+ *   // For production, swap in a persistent KmsBackingStore (Postgres,
+ *   // DynamoDB, etc.). The in-memory store is appropriate for single-instance
+ *   // dev only.
+ *   const keyStore = new KmsKeyStore({ kms, backing: inMemoryKmsBackingStore() })
+ *
+ * Operators with strict no-plaintext-cache requirements can disable the
+ * unwrapped-key cache via `cacheUnwrappedKeys: false` — every read then
+ * round-trips to KMS.
+ */
+export { inMemoryKmsBackingStore } from "./in-memory-backing";
+export { KmsKeyStore, type KmsKeyStoreOptions } from "./key-store";
+export { fromKmsClient } from "./sdk";
+export type { KmsBackingStore, KmsClientLike, WrappedEncryptionKey, WrappedSigningKey, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/kms/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AACrC,YAAY,EACV,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,SAAS,CAAA"}

package/dist/types/adapters/kms/key-store.d.ts

@@ -0,0 +1,20 @@
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { KmsBackingStore, KmsClientLike } from "./types";
+export type KmsKeyStoreOptions = {
+    kms: KmsClientLike;
+    backing: KmsBackingStore;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+    /** Default `true`. Set false for strict no-plaintext-cache deployments. */
+    cacheUnwrappedKeys?: boolean;
+};
+export declare class KmsKeyStore implements KeyStore {
+    #private;
+    constructor(opts: KmsKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/kms/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/key-store.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EAGd,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,aAAa,CAAA;IAClB,OAAO,EAAE,eAAe,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,qBAAa,WAAY,YAAW,QAAQ;;gBAS9B,IAAI,EAAE,kBAAkB;IAQ9B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAchD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAO5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IActD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAgFpE"}

package/dist/types/adapters/kms/sdk.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `fromKmsClient` — wires the `KmsClientLike` interface to a real AWS KMS
+ * client. The KMS SDK is imported only from this file to keep the rest of
+ * the adapter bundle KMS-agnostic.
+ *
+ * @example
+ *   import { KMSClient } from "@aws-sdk/client-kms"
+ *   const kmsClient = new KMSClient({ region: "us-east-1" })
+ *   const kms = fromKmsClient(kmsClient, process.env.IDP_KMS_KEY_ARN!)
+ *   const backing = new PostgresKmsBackingStore({ exec })
+ *   const keyStore = new KmsKeyStore({ kms, backing })
+ */
+import type { KMSClient } from "@aws-sdk/client-kms";
+import type { KmsClientLike } from "./types";
+export declare function fromKmsClient(client: KMSClient, keyId: string): KmsClientLike;
+//# sourceMappingURL=sdk.d.ts.map

package/dist/types/adapters/kms/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAqB7E"}

package/dist/types/adapters/kms/types.d.ts

@@ -0,0 +1,58 @@
+/**
+ * KMS adapter interfaces.
+ *
+ * The KMS-backed `KeyStore` uses **envelope encryption** for private key
+ * material: the JWK private bytes (signing) and the raw AES key bytes
+ * (encryption) are wrapped under a KMS master key. The ciphertext blob is
+ * stored in a pluggable backing store; KMS Encrypt / Decrypt are the only
+ * KMS operations on the hot path.
+ *
+ * This shape keeps private material out of plaintext at rest while
+ * preserving the JWT signing path: the framework still receives a real
+ * `CryptoKey` (`importJWK` of the unwrapped JWK) so `domain/jwt.ts` doesn't
+ * need to know KMS exists.
+ */
+/** Minimal KMS surface the adapter depends on. */
+export type KmsClientLike = {
+    /** Encrypt up to ~4 KB of plaintext under the master key. */
+    encrypt(plaintext: Uint8Array): Promise<Uint8Array>;
+    /** Decrypt a previously-issued ciphertext under the master key. */
+    decrypt(ciphertext: Uint8Array): Promise<Uint8Array>;
+};
+/**
+ * Persistent storage for KMS-wrapped key envelopes. Adapters provide their
+ * own (Postgres, DynamoDB, file), or pass `inMemoryKmsBackingStore()` for
+ * tests / single-instance dev.
+ *
+ * `wrappedPrivate` is the KMS-wrapped private material (JWK bytes for
+ * signing keys, raw AES key bytes for encryption keys). `publicJwk` is the
+ * public material (never sensitive); it's kept plaintext alongside the
+ * ciphertext so JWKS lookups don't need a KMS round trip.
+ */
+export type KmsBackingStore = {
+    putSigningKey(row: WrappedSigningKey): Promise<void>;
+    getSigningKey(kid: string): Promise<WrappedSigningKey | undefined>;
+    listSigningKeys(): Promise<WrappedSigningKey[]>;
+    putEncryptionKey(row: WrappedEncryptionKey): Promise<void>;
+    getEncryptionKey(kid: string): Promise<WrappedEncryptionKey | undefined>;
+    listEncryptionKeys(): Promise<WrappedEncryptionKey[]>;
+};
+export type WrappedSigningKey = {
+    kid: string;
+    alg: string;
+    crv?: string;
+    publicJwk: Record<string, unknown>;
+    wrappedPrivate: Uint8Array;
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    rotatedAt?: number;
+};
+export type WrappedEncryptionKey = {
+    kid: string;
+    alg: string;
+    wrappedKey: Uint8Array;
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    rotatedAt?: number;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/kms/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kms/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kDAAkD;AAClD,MAAM,MAAM,aAAa,GAAG;IAC1B,6DAA6D;IAC7D,OAAO,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACnD,mEAAmE;IACnE,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACrD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAA;IAClE,eAAe,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC/C,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IACxE,kBAAkB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,cAAc,EAAE,UAAU,CAAA;IAC1B,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA"}