@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/adapters/kv/audit-log.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Cloudflare KV `AuditLog`. Append-only with per-event keys of the shape
+ * `audit:<paddedTs>:<rand>` so KV's lexicographic list returns events in
+ * insertion order. Suitable for low-volume audit (the IdP) where reads are
+ * SIEM-style after-the-fact, not hot-path. High-volume deployments should
+ * ship events out-of-band to a real append-log.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { KVNamespaceLike } from "./types";
+export type KvAuditLogOptions = {
+    kv: KVNamespaceLike;
+    /** Optional TTL (seconds). 90 days minimum per CONSISTENCY.md SOC 2 baseline. */
+    expirationTtl?: number;
+};
+export declare class KvAuditLog implements AuditLog {
+    #private;
+    constructor(opts: KvAuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/kv/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,eAAe,CAAA;IACnB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,qBAAa,UAAW,YAAW,QAAQ;;gBAI7B,IAAI,EAAE,iBAAiB;IAK7B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAWpE"}

package/dist/types/adapters/kv/config-store.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Cloudflare KV `ConfigStore`. JSON-serialized tenant config under
+ * `tenant:<id>`. Per `ports/CONSISTENCY.md`, KV is **only** acceptable for
+ * read-eventual paths — tenant config qualifies (read-heavy, write-rare,
+ * 60s bounded staleness is fine). Invalidation hook fires on every
+ * `putTenantConfig`.
+ *
+ * KV reads honor the cache hint via `cacheTtl` in the get options. The
+ * 60-second default matches the bounded-staleness contract.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { KVNamespaceLike } from "./types";
+export type KvConfigStoreOptions = {
+    kv: KVNamespaceLike;
+};
+export declare class KvConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: KvConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/kv/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,eAAe,CAAA;CACpB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAInC,IAAI,EAAE,oBAAoB;IAIhC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAa5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAclE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/kv/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Cloudflare KV adapters — **restricted use only**.
+ *
+ * Per `ports/CONSISTENCY.md`, KV's eventual consistency disqualifies it as
+ * a backing store for `TokenStore` (auth codes, refresh tokens) and
+ * `SessionStore` (flow records). Use D1 / Durable Objects / Postgres /
+ * DynamoDB for those. KV remains a great fit for the read-eventual paths
+ * exposed in this package:
+ *
+ *  - `KvConfigStore` — tenant config blob keyed by id
+ *  - `KvMethodStore` — per-tenant method configs
+ *  - `KvAuditLog` — append-only audit events (low-volume only)
+ *
+ * Production users typically mix-and-match: KV for config + D1 for tokens
+ * + Durable Objects for sessions.
+ */
+export { KvAuditLog, type KvAuditLogOptions } from "./audit-log";
+export { KvConfigStore, type KvConfigStoreOptions } from "./config-store";
+export { KvMethodStore, type KvMethodStoreOptions } from "./method-store";
+export type { KVNamespaceLike } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/kv/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACzE,YAAY,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/types/adapters/kv/method-store.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cloudflare KV `MethodStore`. Per-method JSON under
+ * `method:<tenantId>:<methodId>`. `listMethods` uses the KV `list` cursor +
+ * follow-up `get` per key — fine for the read-rare console workflow but
+ * not for hot per-request paths (the IdP framework caches `MethodConfig`
+ * via `MethodCache` in-process).
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { KVNamespaceLike } from "./types";
+export type KvMethodStoreOptions = {
+    kv: KVNamespaceLike;
+};
+export declare class KvMethodStore implements MethodStore {
+    #private;
+    constructor(opts: KvMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/kv/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/method-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAM9C,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,eAAe,CAAA;CACpB,CAAA;AAED,qBAAa,aAAc,YAAW,WAAW;;gBAGnC,IAAI,EAAE,oBAAoB;IAIhC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAqBhE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAkB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASlB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAUzB"}

package/dist/types/adapters/kv/types.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Minimal `KVNamespace` shape the adapter depends on. Pinned locally so the
+ * adapter is testable without a real Workers runtime.
+ *
+ * Real `KVNamespace` instances satisfy this interface — pass `env.AUTH_KV`
+ * directly.
+ */
+export type KVNamespaceLike = {
+    get(key: string): Promise<string | null>;
+    get<T>(key: string, type: "json"): Promise<T | null>;
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+        expiration?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(options?: {
+        prefix?: string;
+        cursor?: string | null;
+        limit?: number;
+    }): Promise<{
+        keys: Array<{
+            name: string;
+        }>;
+        list_complete: boolean;
+        cursor?: string;
+    }>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/adapters/kv/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/kv/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACpD,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACxD,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,OAAO,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC;QACV,IAAI,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC7B,aAAa,EAAE,OAAO,CAAA;QACtB,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAC,CAAA;CACH,CAAA"}

package/dist/types/adapters/memory/audit-log.d.ts

@@ -0,0 +1,18 @@
+/**
+ * In-memory `AuditLog`. Stores events in an array that tests can inspect.
+ * Production deployments use a real backend (Clickhouse, OTEL, etc.).
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+export type StoredAuditEvent = AuditEvent & {
+    timestamp: number;
+};
+export declare class MemoryAuditLog implements AuditLog {
+    events: StoredAuditEvent[];
+    log(event: StoredAuditEvent): Promise<void>;
+    /** Test helper — find events of a given kind. */
+    byKind<K extends AuditEvent["kind"]>(kind: K): Array<Extract<StoredAuditEvent, {
+        kind: K;
+    }>>;
+    clear(): void;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/memory/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/audit-log.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,qBAAa,cAAe,YAAW,QAAQ;IAC7C,MAAM,EAAE,gBAAgB,EAAE,CAAK;IAEzB,GAAG,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,iDAAiD;IACjD,MAAM,CAAC,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,EACjC,IAAI,EAAE,CAAC,GACN,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAMhD,KAAK,IAAI,IAAI;CAGd"}

package/dist/types/adapters/memory/clock.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Tiny injectable clock used by every memory adapter so tests can advance
+ * time deterministically.
+ */
+export type Clock = () => number;
+export declare const realClock: Clock;
+//# sourceMappingURL=clock.d.ts.map

package/dist/types/adapters/memory/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/clock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAA;AAEhC,eAAO,MAAM,SAAS,EAAE,KAAwB,CAAA"}

package/dist/types/adapters/memory/config-store.d.ts

@@ -0,0 +1,19 @@
+/**
+ * In-memory `ConfigStore`. Single-process; trivially satisfies the
+ * eventual + bounded-staleness contract (it's strong, which is a superset).
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+export type MemoryConfigStoreOptions = {
+    /** Seed tenants — useful for tests. */
+    seed?: ReadonlyArray<TenantConfig>;
+};
+export declare class MemoryConfigStore implements ConfigStore {
+    #private;
+    constructor(opts?: MemoryConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/memory/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/config-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,IAAI,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;CACnC,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAIvC,IAAI,GAAE,wBAA6B;IAIzC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAQ5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/memory/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * In-memory adapter set. Map-backed. Suitable for tests and single-instance
+ * dev. Trivially satisfies all consistency contracts in
+ * `ports/CONSISTENCY.md` because there's no concurrent process / replica
+ * lag.
+ */
+export { MemoryAuditLog, type StoredAuditEvent } from "./audit-log";
+export { MemoryConfigStore, type MemoryConfigStoreOptions, } from "./config-store";
+export { MemoryKeyStore, type MemoryKeyStoreOptions } from "./key-store";
+export { MemoryMethodStore, type MemoryMethodStoreOptions, } from "./method-store";
+export { MemorySessionStore, type MemorySessionStoreOptions, } from "./session-store";
+export { MemoryTokenStore, type MemoryTokenStoreOptions } from "./token-store";
+export { MemoryPasskeyCredentialStore, type MemoryPasskeyCredentialStoreOptions, } from "./passkey-credential-store";
+export { realClock, type Clock } from "./clock";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/memory/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EACL,4BAA4B,EAC5B,KAAK,mCAAmC,GACzC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAA"}

package/dist/types/adapters/memory/key-store.d.ts

@@ -0,0 +1,17 @@
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { Clock } from "./clock";
+export type MemoryKeyStoreOptions = {
+    clock?: Clock;
+    /** Override default `"ES256"` (other supported: `"EdDSA"` per AD11). */
+    signingAlg?: "ES256" | "EdDSA";
+};
+export declare class MemoryKeyStore implements KeyStore {
+    #private;
+    constructor(opts?: MemoryKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/memory/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/key-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAGpC,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,wEAAwE;IACxE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;CAC/B,CAAA;AAED,qBAAa,cAAe,YAAW,QAAQ;;gBAMjC,IAAI,GAAE,qBAA0B;IAKtC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAahD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAK5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAatD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAsCpE"}

package/dist/types/adapters/memory/method-store.d.ts

@@ -0,0 +1,26 @@
+/**
+ * In-memory `MethodStore`. Per-tenant `Map<methodId, MethodConfig>`. Single
+ * process so the eventual + bounded-staleness contract is trivially satisfied.
+ *
+ * `MethodStore` is optional in the IdP — when omitted, the framework falls
+ * back to slicing `MethodConfig[]` out of `ConfigStore.getTenantConfig`. The
+ * memory adapter still ships so the conformance suite has a baseline.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+export type MemoryMethodStoreOptions = {
+    seed?: ReadonlyArray<{
+        tenantId: TenantId;
+        methods: ReadonlyArray<MethodConfig>;
+    }>;
+};
+export declare class MemoryMethodStore implements MethodStore {
+    #private;
+    constructor(opts?: MemoryMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/memory/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/method-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,aAAa,CAAC;QACnB,QAAQ,EAAE,QAAQ,CAAA;QAClB,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;KACrC,CAAC,CAAA;CACH,CAAA;AAED,qBAAa,iBAAkB,YAAW,WAAW;;gBAGvC,IAAI,GAAE,wBAA6B;IAQzC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAKhE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAc1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAUlB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAIzB"}

package/dist/types/adapters/memory/passkey-credential-store.d.ts

@@ -0,0 +1,43 @@
+/**
+ * In-memory `PasskeyCredentialStore`. Map-backed, single-process —
+ * suitable for tests and single-instance dev.
+ *
+ * Schema simplification (shared by all three reference adapters): the
+ * `userId` field is also the username lookup key. This matches the
+ * bundled `passkeyMethod`, which sets `userId = parsed.data.username`
+ * at registration time. Hosts that need a richer mapping
+ * (username ≠ userId, multi-username-per-user, etc.) implement
+ * `PasskeyCredentialStore` directly against their own data model.
+ */
+import type { PasskeyCredentialStore, StoredCredential } from "../../methods/passkey";
+export type MemoryPasskeyCredentialStoreOptions = {
+    /**
+     * Optional seed list for tests / dev. Each entry is the full
+     * `StoredCredential` plus its tenant scope. The store treats the
+     * credential's `userId` as the username lookup key.
+     */
+    seed?: Array<{
+        tenantId: string;
+        credential: StoredCredential;
+    }>;
+};
+export declare class MemoryPasskeyCredentialStore implements PasskeyCredentialStore {
+    #private;
+    constructor(opts?: MemoryPasskeyCredentialStoreOptions);
+    findByUsername(username: string, tenantId: string): Promise<{
+        userId: string;
+        credentials: StoredCredential[];
+    } | null>;
+    findById(credentialId: string, tenantId: string): Promise<StoredCredential | null>;
+    updateCounter(input: {
+        credentialId: string;
+        counter: number;
+        tenantId: string;
+    }): Promise<void>;
+    create(input: {
+        userId: string;
+        credential: StoredCredential;
+        tenantId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=passkey-credential-store.d.ts.map

package/dist/types/adapters/memory/passkey-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/passkey-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,MAAM,MAAM,mCAAmC,GAAG;IAChD;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAA;CACjE,CAAA;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;;gBAG7D,IAAI,GAAE,mCAAwC;IAgBpD,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAWhE,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAK7B,aAAa,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOX,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAOlB"}

package/dist/types/adapters/memory/session-store.d.ts

@@ -0,0 +1,21 @@
+import type { FlowRecord } from "../../types/flow";
+import type { ParRecord, SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { Clock } from "./clock";
+export type MemorySessionStoreOptions = {
+    clock?: Clock;
+};
+export declare class MemorySessionStore implements SessionStore {
+    #private;
+    constructor(opts?: MemorySessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+    savePar(requestUri: string, payload: ParRecord, ttl: number): Promise<Result<void>>;
+    consumePar(requestUri: string): Promise<Result<ParRecord>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/memory/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,YAAY,EACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAapC,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAMzC,IAAI,GAAE,yBAA8B;IAI1C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAYrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAgBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAY9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKvD,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CAejE"}

package/dist/types/adapters/memory/token-store.d.ts

@@ -0,0 +1,29 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { Clock } from "./clock";
+export type MemoryTokenStoreOptions = {
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    clock?: Clock;
+};
+export declare class MemoryTokenStore implements TokenStore {
+    #private;
+    constructor(opts?: MemoryTokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+    recordDpopJti(jti: string, ttlMs: number): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/memory/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/token-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAapC,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,gBAAiB,YAAW,UAAU;;gBAOrC,IAAI,GAAE,uBAA4B;IAIxC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAgBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAqCjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAWlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAavE"}

package/dist/types/adapters/postgres/audit-log.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Postgres `AuditLog`. Append-only `openauth_audit_events` table; indexed on
+ * `kind` and `ts` for SIEM-style queries. Writes are synchronous — adapters
+ * looking for batching can wrap this with their own buffering layer.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log";
+import type { PostgresExecutor } from "./executor";
+export type PostgresAuditLogOptions = {
+    exec: PostgresExecutor;
+};
+export declare class PostgresAuditLog implements AuditLog {
+    #private;
+    constructor(opts: PostgresAuditLogOptions);
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/adapters/postgres/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/audit-log.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,gBAAgB,CAAA;CACvB,CAAA;AAED,qBAAa,gBAAiB,YAAW,QAAQ;;gBAGnC,IAAI,EAAE,uBAAuB;IAInC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAapE"}

package/dist/types/adapters/postgres/config-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Postgres `ConfigStore`. JSONB blob keyed by tenant id. Invalidation hook
+ * fires on every `putTenantConfig` so any in-process cache built on top of
+ * this adapter drops the stale value before the write resolves.
+ */
+import type { ConfigStore } from "../../ports/config-store";
+import type { Result } from "../../types/result";
+import type { TenantConfig, TenantId } from "../../types/tenant";
+import type { PostgresExecutor } from "./executor";
+export type PostgresConfigStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresConfigStore implements ConfigStore {
+    #private;
+    constructor(opts: PostgresConfigStoreOptions);
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    onInvalidate(handler: (id: TenantId) => void): void;
+}
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/adapters/postgres/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/config-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,mBAAoB,YAAW,WAAW;;gBAKzC,IAAI,EAAE,0BAA0B;IAKtC,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAqB5D,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlE,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI;CAGpD"}

package/dist/types/adapters/postgres/executor.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Thin SQL-executor interface the Postgres adapters depend on.
+ *
+ * Both the production `postgres` (porsager/postgres) driver and the embedded
+ * `@electric-sql/pglite` test driver fit behind this shape. Adapters never
+ * import either driver directly — users wire one of the `from*` helpers
+ * below.
+ */
+/** One row of a SQL result, addressed by column name. */
+export type Row = Record<string, unknown>;
+/**
+ * Minimal Postgres-shaped executor. Positional `$1, $2` parameters; rows are
+ * column-name keyed objects.
+ */
+export type PostgresExecutor = {
+    query<T extends Row = Row>(sql: string, params?: ReadonlyArray<unknown>): Promise<{
+        rows: T[];
+    }>;
+};
+/**
+ * Wrap a porsager/postgres `Sql` instance in the `PostgresExecutor` shape.
+ * The adapter calls `sql.unsafe(text, params)` so positional binds work.
+ *
+ * @example
+ *   import postgres from "postgres"
+ *   import { fromPostgresJs, PostgresTokenStore } from "@_mustachio/openauth/adapters/postgres"
+ *   const sql = postgres(process.env.DATABASE_URL!)
+ *   const exec = fromPostgresJs(sql)
+ *   const store = new PostgresTokenStore({ exec, keyStore })
+ */
+export declare function fromPostgresJs(sql: PostgresJsLike): PostgresExecutor;
+/** Minimal shape we use from porsager/postgres — kept untyped to avoid a runtime import. */
+export type PostgresJsLike = {
+    unsafe: (text: string, params: unknown[]) => Promise<unknown>;
+};
+/**
+ * Wrap a PGlite instance in the `PostgresExecutor` shape. Used by the
+ * port-conformance suite to run the Postgres adapters in-process without a
+ * server.
+ */
+export declare function fromPGlite(db: PGliteLike): PostgresExecutor;
+/** Minimal shape we use from @electric-sql/pglite. */
+export type PGliteLike = {
+    query: <T extends Row = Row>(sql: string, params?: unknown[]) => Promise<{
+        rows: T[];
+    }>;
+};
+//# sourceMappingURL=executor.d.ts.map

package/dist/types/adapters/postgres/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,yDAAyD;AACzD,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEzC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EACvB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAC1B,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,gBAAgB,CAWpE;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,UAAU,GAAG,gBAAgB,CAU3D;AAED,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,EACzB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,KACf,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAC5B,CAAA"}

package/dist/types/adapters/postgres/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Postgres adapter set.
+ *
+ * Suitable for Node + Postgres deployments. Satisfies every contract in
+ * `ports/CONSISTENCY.md` — `consumeCode` / `consumeFlow` use
+ * `DELETE … RETURNING` for atomic single-winner CAS, `consumeRefresh` uses
+ * `UPDATE … WHERE consumed_at IS NULL RETURNING payload`, and `KeyStore`
+ * persists JWK material in JSONB columns.
+ *
+ * @example
+ *   import postgres from "postgres"
+ *   import {
+ *     fromPostgresJs,
+ *     migrate,
+ *     PostgresTokenStore,
+ *     PostgresSessionStore,
+ *     PostgresKeyStore,
+ *     PostgresConfigStore,
+ *     PostgresMethodStore,
+ *     PostgresAuditLog,
+ *   } from "@_mustachio/openauth/adapters/postgres"
+ *
+ *   const sql = postgres(process.env.DATABASE_URL!)
+ *   const exec = fromPostgresJs(sql)
+ *   await migrate(exec)
+ *   const keyStore = new PostgresKeyStore({ exec })
+ *   const tokenStore = new PostgresTokenStore({ exec, keyStore })
+ *   // ...
+ */
+export { fromPGlite, fromPostgresJs, type PGliteLike, type PostgresExecutor, type PostgresJsLike, type Row, } from "./executor";
+export { INITIAL_SCHEMA_SQL, migrate } from "./migrations";
+export { PostgresAuditLog, type PostgresAuditLogOptions } from "./audit-log";
+export { PostgresConfigStore, type PostgresConfigStoreOptions, } from "./config-store";
+export { PostgresKeyStore, type PostgresKeyStoreOptions } from "./key-store";
+export { PostgresMethodStore, type PostgresMethodStoreOptions, } from "./method-store";
+export { PostgresSessionStore, type PostgresSessionStoreOptions, } from "./session-store";
+export { PostgresTokenStore, type PostgresTokenStoreOptions, } from "./token-store";
+export { PostgresPasskeyCredentialStore, type PostgresPasskeyCredentialStoreOptions, } from "./passkey-credential-store";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/adapters/postgres/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,GAAG,GACT,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,KAAK,qCAAqC,GAC3C,MAAM,4BAA4B,CAAA"}

package/dist/types/adapters/postgres/key-store.d.ts

@@ -0,0 +1,23 @@
+import type { EncryptionKey, KeyStore, KeyWrapper, SigningKey } from "../../ports/key-store";
+import type { Result } from "../../types/result";
+import type { PostgresExecutor } from "./executor";
+export type PostgresKeyStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+    signingAlg?: "ES256" | "EdDSA";
+    /**
+     * Optional envelope that encrypts private JWKs and encryption-key bytes
+     * before they leave the process. STRONGLY RECOMMENDED in production.
+     * Pair with a cloud KMS or HSM-backed implementation.
+     */
+    wrapper?: KeyWrapper;
+};
+export declare class PostgresKeyStore implements KeyStore {
+    #private;
+    constructor(opts: PostgresKeyStoreOptions);
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+}
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/adapters/postgres/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/key-store.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,EACX,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB,CAAA;AAED,qBAAa,gBAAiB,YAAW,QAAQ;;gBAQnC,IAAI,EAAE,uBAAuB;IAOnC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAchD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAS5C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAatD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CA2KpE"}

package/dist/types/adapters/postgres/method-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Postgres `MethodStore`. `(tenant_id, method_id)` composite key, JSONB
+ * `config` column for the method-config blob.
+ */
+import type { MethodStore } from "../../ports/method-store";
+import type { Result } from "../../types/result";
+import type { MethodConfig, TenantId } from "../../types/tenant";
+import type { PostgresExecutor } from "./executor";
+export type PostgresMethodStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresMethodStore implements MethodStore {
+    #private;
+    constructor(opts: PostgresMethodStoreOptions);
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/adapters/postgres/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/method-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAEhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,mBAAoB,YAAW,WAAW;;gBAIzC,IAAI,EAAE,0BAA0B;IAKtC,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAahE,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAsB1B,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAelB,kBAAkB,CACtB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAazB"}