@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/methods/providers/linkedin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/linkedin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,eAAe,EAAE,iBAAiB,CAC7C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/microsoft.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Microsoft — OIDC, tenant-templated. The `tenant` field is `"common"`,
+ * `"organizations"`, `"consumers"`, or a specific Entra tenant id /
+ * domain.
+ *
+ * Discovery is fetched per tenant; the result is cached inside the
+ * `MethodCache` so subsequent flows skip the round trip.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    tenant: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    tenant?: string | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    tenant?: string | undefined;
+}>;
+export declare const microsoftFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=microsoft.d.ts.map

package/dist/types/methods/providers/microsoft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/microsoft.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;EAKV,CAAA;AAEF,eAAO,MAAM,gBAAgB,EAAE,iBAAiB,CAC9C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAiBvB,CAAA"}

package/dist/types/methods/providers/slack.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Slack — Sign in with Slack (OpenID Connect on Slack's own endpoints).
+ * Slack ships an id_token at the token endpoint; we treat it as OIDC.
+ *
+ * Default scopes: `openid email profile`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const slackFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=slack.d.ts.map

package/dist/types/methods/providers/slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/slack.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,YAAY,EAAE,iBAAiB,CAC1C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAoBvB,CAAA"}

package/dist/types/methods/providers/spotify.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Spotify — OAuth 2.0. Default scopes: `user-read-email user-read-private`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const spotifyFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=spotify.d.ts.map

package/dist/types/methods/providers/spotify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spotify.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/spotify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,cAAc,EAAE,iBAAiB,CAC5C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/twitch.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Twitch — OAuth 2.0 (Twitch supports OIDC but uses OAuth flows by
+ * default). Default scopes: `user:read:email`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const twitchFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=twitch.d.ts.map

package/dist/types/methods/providers/twitch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twitch.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/twitch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/x.d.ts

@@ -0,0 +1,25 @@
+/**
+ * X (formerly Twitter) — OAuth 2.0 with PKCE. Default scope: `tweet.read users.read`.
+ *
+ * X requires PKCE on its OAuth 2.0 endpoints; `pkce` is left at the
+ * `"S256"` default.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const xFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=x.d.ts.map

package/dist/types/methods/providers/x.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/x.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,QAAQ,EAAE,iBAAiB,CACtC,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/yahoo.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Yahoo — OIDC. Default scopes: `openid email profile`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const yahooFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=yahoo.d.ts.map

package/dist/types/methods/providers/yahoo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yahoo.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/yahoo.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,YAAY,EAAE,iBAAiB,CAC1C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAiBvB,CAAA"}

package/dist/types/pkce.d.ts

@@ -1,7 +1,6 @@
 export declare function generatePKCE(length?: number): Promise<{
     verifier: string;
     challenge: string;
-    method: string;
+    method: "S256";
 }>;
-export declare function validatePKCE(verifier: string, challenge: string, method?: "S256" | "plain"): Promise<boolean>;
 //# sourceMappingURL=pkce.d.ts.map

package/dist/types/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/pkce.ts"],"names":[],"mappings":"AAgBA,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW;;;;GAarD;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAM,GAAG,OAAgB,oBAKlC"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/pkce.ts"],"names":[],"mappings":"AAyBA,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,CAAC,CASD"}

package/dist/types/ports/audit-log.d.ts

@@ -0,0 +1,166 @@
+/**
+ * `AuditLog` — append-only event log for security-relevant operations.
+ *
+ * Consistency: append-only, durable. Ordering across instances is **not**
+ * required; consumers (SIEM, dashboards) sort by `timestamp` and `actor`.
+ *
+ * Retention: defined by the adapter. 90 days minimum is the documented
+ * baseline for SOC 2 readiness.
+ *
+ * Audit-event payloads must **never** contain auth-code payloads, refresh
+ * tokens, access tokens, raw cookies, or any other secret. The framework's
+ * built-in events follow this rule; custom emitters must too.
+ */
+import type { TenantId } from "../types/tenant";
+/**
+ * Discriminated event union. The framework emits these; user code may emit
+ * its own with `kind: "custom"`. Each event carries enough id information
+ * for operators to find the offending record without exposing secrets.
+ */
+export type AuditEvent = {
+    kind: "authorize_started";
+    tenantId: TenantId;
+    clientId: string;
+    methodId: string;
+    methodKind: string;
+    flowId: string;
+} | {
+    kind: "authorize_succeeded";
+    tenantId: TenantId;
+    clientId: string;
+    methodId: string;
+    methodKind: string;
+    flowId: string;
+    subjectId: string;
+} | {
+    kind: "authorize_failed";
+    tenantId: TenantId | null;
+    clientId: string | null;
+    methodId?: string;
+    methodKind?: string;
+    flowId?: string;
+    reason: string;
+} | {
+    kind: "token_issued";
+    tenantId: TenantId;
+    clientId: string;
+    methodId: string;
+    methodKind: string;
+    subjectId: string;
+    /** Hash of the issued refresh token id — never the token itself. */
+    refreshTokenIdHash?: string;
+    /** OIDC Core §2 — set when the response carried an `id_token`. */
+    idTokenIssued?: boolean;
+    /** RFC 9449 — set when the access token is DPoP-bound. */
+    dpopBound?: boolean;
+} | {
+    kind: "token_refreshed";
+    tenantId: TenantId;
+    clientId: string;
+    subjectId: string;
+    family: string;
+} | {
+    kind: "token_exchanged";
+    /** Tenant the new tokens are scoped to. */
+    tenantId: TenantId;
+    /** Tenant the subject_token was originally issued for. */
+    fromTenantId: TenantId;
+    clientId: string;
+    subjectId: string;
+    /** Fresh refresh-token family for the issued tokens. */
+    family: string;
+} | {
+    kind: "token_revoked";
+    tenantId: TenantId;
+    clientId: string | null;
+    subjectId?: string;
+    family?: string;
+    reason: string;
+} | {
+    kind: "refresh_reuse_detected";
+    tenantId: TenantId;
+    clientId: string;
+    family: string;
+} | {
+    /**
+     * Emitted by `/end_session` (OIDC RP-Initiated Logout 1.0 §2) after
+     * processing the logout request — regardless of whether a
+     * `post_logout_redirect_uri` was supplied. `subjectId` is present
+     * when the request carried an `id_token_hint` that successfully
+     * verified; absent otherwise.
+     */
+    kind: "session_logout";
+    tenantId: TenantId;
+    clientId?: string;
+    subjectId?: string;
+} | {
+    /**
+     * Emitted when a DPoP proof's `jti` is presented within the replay
+     * window (RFC 9449 §11.1). The request was rejected with
+     * `invalid_dpop_proof`. Operators / SIEM use this to spot
+     * stolen-key replay attempts.
+     */
+    kind: "dpop_replay_detected";
+    tenantId: TenantId | null;
+    /** First-half of the offending jti so logs can correlate without storing it. */
+    jtiPrefix: string;
+} | {
+    kind: "flow_replay_attempt";
+    tenantId: TenantId | null;
+    flowId: string;
+} | {
+    kind: "flow_tenant_mismatch";
+    stateTenantId: TenantId;
+    flowTenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "flow_callback_mismatch";
+    tenantId: TenantId;
+    flowId: string;
+    expected: {
+        host: string;
+        path: string;
+    };
+    actual: {
+        host: string;
+        path: string;
+    };
+} | {
+    kind: "factory_id_mismatch";
+    tenantId: TenantId;
+    methodId: string;
+    expectedKind: string;
+    actualKind: string;
+} | {
+    kind: "invalid_method_config";
+    tenantId: TenantId;
+    methodId: string;
+    methodKind: string;
+    /** Zod error path string. Never the raw config blob. */
+    errorPath: string;
+} | {
+    kind: "unknown_method_kind";
+    tenantId: TenantId;
+    methodId: string;
+    methodKind: string;
+} | {
+    kind: "unrecoverable_flow";
+    reason: string;
+    host?: string;
+} | {
+    kind: "custom";
+    type: string;
+    tenantId?: TenantId;
+    data: Record<string, unknown>;
+};
+export type AuditLog = {
+    /**
+     * Append a single event. Should not throw on durability failure; the
+     * adapter is responsible for buffering / retry. Returning never-rejects
+     * is acceptable so the IdP's hot paths are not gated on the log.
+     */
+    log(event: AuditEvent & {
+        timestamp: number;
+    }): Promise<void>;
+};
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/types/ports/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE;;;;;;OAMG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}

package/dist/types/ports/config-store.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `ConfigStore` — tenant configuration lookup.
+ *
+ * Consistency contract: **eventual + bounded staleness (TTL ≤ 60 s).** This
+ * is a read-heavy, write-rare path; Cloudflare KV / read replicas are
+ * acceptable. Invalidation hook fires immediately on update so callers can
+ * drop stale entries earlier than TTL.
+ *
+ * See `ports/CONSISTENCY.md` for the full table.
+ */
+import type { Result } from "../types/result";
+import type { TenantConfig, TenantId } from "../types/tenant";
+export type ConfigStore = {
+    /**
+     * Look up a tenant's full config. Returns `tenant_not_found` if the id is
+     * unknown. Implementations should cache aggressively (TTL ≤ 60 s).
+     */
+    getTenantConfig(id: TenantId): Promise<Result<TenantConfig>>;
+    /**
+     * Persist (create or update) a tenant's config. Implementations must
+     * trigger invalidation of any cached value for `id` before resolving so
+     * a subsequent `getTenantConfig` returns the new value.
+     */
+    putTenantConfig(config: TenantConfig): Promise<Result<void>>;
+    /**
+     * Optional: signal to in-process caches that a tenant's config has been
+     * invalidated externally (e.g. via the management console). Adapters that
+     * don't expose cross-process invalidation may omit this.
+     */
+    onInvalidate?(handler: (id: TenantId) => void): void;
+};
+//# sourceMappingURL=config-store.d.ts.map

package/dist/types/ports/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../../src/ports/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE7D,MAAM,MAAM,WAAW,GAAG;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IAE5D;;;;OAIG;IACH,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5D;;;;OAIG;IACH,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI,CAAA;CACrD,CAAA"}

package/dist/types/ports/key-store.d.ts

@@ -0,0 +1,98 @@
+/**
+ * `KeyStore` — signing keys (JWT) and encryption keys (auth-code payload,
+ * other at-rest secrets).
+ *
+ * Per AD11, ES256 is the default signing algorithm; Ed25519 is supported.
+ *
+ * Consistency:
+ *  - `currentSigningKey` — strong (active key must be unambiguous across
+ *    the cluster).
+ *  - `signingKeys` (JWKS) — eventual OK; verifiers tolerate brief lag
+ *    during rotation.
+ *  - Encryption keys — same as signing for consistency; rotated quarterly,
+ *    old keys retained for `refreshTtl`.
+ *
+ * Note: `StateKeyRing` (HMAC keys for the `state` envelope) is **not** an
+ * abstraction over `KeyStore`. It is supplied directly via
+ * `IdPOptions.stateKeys` to avoid a bootstrap dependency on `KeyStore` for
+ * tenant resolution. A helper `loadStateKeyRingFromKeyStore` is offered
+ * for operators who choose to store the ring inside `KeyStore`.
+ */
+import type { Result } from "../types/result";
+/** Asymmetric signing key. Public material is JWKS-exposed; private is server-only. */
+export type SigningKey = {
+    kid: string;
+    /** JOSE `alg` value, e.g. `"ES256"` or `"EdDSA"`. */
+    alg: string;
+    /** JOSE `crv` for EC / OKP keys (`P-256`, `Ed25519`). Optional for other alg families. */
+    crv?: string;
+    /** JWK form of the public key — published in JWKS. */
+    publicJwk: Record<string, unknown>;
+    /**
+     * Opaque private-key handle. Concrete adapters interpret this:
+     *  - In-memory / Postgres: a serialized JWK.
+     *  - KMS-backed: a KMS key ARN / Cloudflare DO id.
+     */
+    privateKeyRef: unknown;
+    /** Status used by JWKS rotation logic. */
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    /** When this key may no longer be used to sign. Verification continues until removal. */
+    rotatedAt?: number;
+};
+/** Symmetric encryption key for the auth-code payload (and other at-rest data). */
+export type EncryptionKey = {
+    kid: string;
+    /** JOSE `alg`, e.g. `"A256GCM"`. */
+    alg: string;
+    /** Opaque key handle (raw bytes for in-memory; KMS ref for cloud). */
+    keyRef: unknown;
+    status: "active" | "next" | "retired";
+    createdAt: number;
+    rotatedAt?: number;
+};
+/**
+ * Optional host-supplied envelope for wrapping private key material at rest.
+ *
+ * Adapters that persist signing-key private JWKs and encryption-key raw bytes
+ * to durable storage (Postgres, DynamoDB, …) accept a `KeyWrapper` so that
+ * material is encrypted with a key the database server cannot read. The
+ * canonical implementation backs `wrap` / `unwrap` with a cloud KMS
+ * (`AWS KMS Encrypt` / `Decrypt`, GCP KMS, Vault transit, etc.).
+ *
+ * Without a wrapper, `PostgresKeyStore` / `DynamoKeyStore` store private
+ * material in plaintext at rest — acceptable for dev / single-tenant
+ * operators with full-disk encryption who have accepted the trade-off, but
+ * **not** acceptable for production deployments with multi-tenant data. See
+ * `INTEGRATION.md` §4.
+ */
+export type KeyWrapper = {
+    /** Encrypt `plaintext` (≤ a few KB) under the host's master key. */
+    wrap(plaintext: Uint8Array): Promise<Uint8Array>;
+    /** Decrypt a value previously returned by `wrap`. */
+    unwrap(ciphertext: Uint8Array): Promise<Uint8Array>;
+};
+export type KeyStore = {
+    /** The unambiguous active signing key. Strong consistency. */
+    currentSigningKey(): Promise<Result<SigningKey>>;
+    /**
+     * All keys to publish in JWKS — active + recently rotated, within the
+     * verification overlap window. Eventual consistency acceptable.
+     */
+    signingKeys(): Promise<Result<SigningKey[]>>;
+    /** Active encryption key for at-rest payload encryption. Strong consistency. */
+    currentEncryptionKey(): Promise<Result<EncryptionKey>>;
+    /**
+     * Look up a specific encryption key by `kid`. Used to decrypt payloads
+     * encrypted under a previous key during the overlap window.
+     */
+    getEncryptionKey(kid: string): Promise<Result<EncryptionKey>>;
+    /**
+     * Rotate signing keys — promote `next` → `active`, retire current
+     * `active`, mint a new `next`. Phase 8 schedules this on a timer.
+     */
+    rotateSigningKeys?(): Promise<Result<void>>;
+    /** Same as `rotateSigningKeys` for encryption keys. Quarterly cadence. */
+    rotateEncryptionKeys?(): Promise<Result<void>>;
+};
+//# sourceMappingURL=key-store.d.ts.map

package/dist/types/ports/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../../src/ports/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,uFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAA;IACX,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,0CAA0C;IAC1C,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,sEAAsE;IACtE,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,oEAAoE;IACpE,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAChD,qDAAqD;IACrD,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACpD,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,8DAA8D;IAC9D,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhD;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IAE5C,gFAAgF;IAChF,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAEtD;;;OAGG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAE7D;;;OAGG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE3C,0EAA0E;IAC1E,oBAAoB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC/C,CAAA"}

package/dist/types/ports/method-store.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `MethodStore` — per-tenant `MethodConfig` lookup.
+ *
+ * This is a subset of `ConfigStore` exposed as a separate port for two
+ * reasons:
+ *  1. Adapters may want to back `MethodStore` with a more frequently
+ *     invalidated cache than the full tenant config.
+ *  2. The management console can update auth-method config independently
+ *     of other tenant-level fields.
+ *
+ * Consistency: same as `ConfigStore` — eventual + bounded staleness
+ * (TTL ≤ 60 s). Invalidation hook fires on update.
+ */
+import type { Result } from "../types/result";
+import type { MethodConfig, TenantId } from "../types/tenant";
+export type MethodStore = {
+    /** All method instances configured for a tenant (enabled and disabled). */
+    listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>>;
+    /**
+     * Look up a single method instance by tenant-local id. Returns
+     * `method_not_found` if `methodId` does not exist in this tenant.
+     */
+    getMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<MethodConfig>>;
+    /** Persist (create or update) a method instance. Triggers invalidation. */
+    putMethodConfig(tenantId: TenantId, method: MethodConfig): Promise<Result<void>>;
+    /** Delete a method instance. Tokens issued by it remain valid until expiry. */
+    deleteMethodConfig(tenantId: TenantId, methodId: string): Promise<Result<void>>;
+};
+//# sourceMappingURL=method-store.d.ts.map

package/dist/types/ports/method-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-store.d.ts","sourceRoot":"","sources":["../../../src/ports/method-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE7D,MAAM,MAAM,WAAW,GAAG;IACxB,2EAA2E;IAC3E,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IAEhE;;;OAGG;IACH,eAAe,CACb,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IAEhC,2EAA2E;IAC3E,eAAe,CACb,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB,+EAA+E;IAC/E,kBAAkB,CAChB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACzB,CAAA"}

package/dist/types/ports/session-store.d.ts

@@ -0,0 +1,109 @@
+/**
+ * `SessionStore` — flow records (required) and optional long-lived sessions.
+ *
+ * Flow records are the single server-side source of truth for an in-flight
+ * authorization. They are written at `/authorize`, updated when a method
+ * returns a `challenge` with `saveMethodState`, and consumed exactly once
+ * on the upstream callback.
+ *
+ * The framework owns flow-record I/O — methods only observe
+ * (`MethodContext.flow`) and request updates via
+ * `MethodResult.challenge.saveMethodState`. Methods MUST NOT call
+ * `saveFlow` / `consumeFlow` directly.
+ *
+ * See `ports/CONSISTENCY.md`.
+ */
+import type { FlowRecord } from "../types/flow";
+import type { Result } from "../types/result";
+export type SessionStore = {
+    /**
+     * Persist a new flow record under `flowId`. Strong, atomic write — the
+     * record must be visible to `consumeFlow` on any node by the time this
+     * resolves. `ttl` is in milliseconds and must equal `expiresAt -
+     * createdAt` on the supplied record (default 10 minutes).
+     */
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    /**
+     * Merge `methodState` into an existing flow record. The framework calls
+     * this when a method handler returns
+     * `{ kind: "challenge", saveMethodState }`, **before** sending the
+     * upstream redirect response — the user agent never sees the redirect
+     * until `methodState` is durably saved.
+     *
+     * Returns `unknown_state` if `flowId` is missing or already consumed.
+     */
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    /**
+     * **Peek** at a flow record without consuming it. Used by the method-route
+     * mount (Phase 4) where credential POSTs may need to dispatch the
+     * method multiple times before the flow is consumed on `success`.
+     *
+     * Consistency: strong (the record must be visible to a `consumeFlow`
+     * called immediately after). Returns `unknown_state` if missing /
+     * expired.
+     *
+     * The framework is the only legitimate caller; methods should never read
+     * the flow directly — they observe via `MethodContext.flow`.
+     */
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    /**
+     * Atomic delete-on-read. Returns the full `FlowRecord` on success — the
+     * framework needs every field to snapshot into the auth-code payload
+     * before the record is gone. Concurrent calls with the same `flowId`
+     * resolve to exactly one winner; losers receive `unknown_state` which
+     * the HTTP layer maps to `invalid_request` (audit
+     * `flow_replay_attempt`).
+     *
+     * This is the **only** consume; the framework does not call it twice.
+     * Methods receive the in-memory record via `MethodContext.flow` for the
+     * rest of the callback request.
+     */
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    /**
+     * Optional: long-lived session support (cross-request remember-me beyond
+     * the OAuth flow). Adapters that don't implement this can omit it; the
+     * framework only requires the flow-record methods above.
+     */
+    createSession?(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession?(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession?(sessionId: string): Promise<Result<void>>;
+    /**
+     * Optional: Pushed Authorization Request (RFC 9126) storage. Persists the
+     * pre-parsed `/authorize` parameters under an opaque `request_uri` for
+     * one-shot retrieval at `/authorize` time. Strong consistency + atomic
+     * delete-on-read — same semantics as `saveFlow` / `consumeFlow`.
+     *
+     * Adapters without these methods cannot satisfy `/par`; the framework's
+     * `/par` handler returns `invalid_request` when called against such a
+     * store. Implement both methods together (the framework only exposes
+     * the endpoint when both are present).
+     */
+    savePar?(requestUri: string, payload: ParRecord, ttl: number): Promise<Result<void>>;
+    consumePar?(requestUri: string): Promise<Result<ParRecord>>;
+};
+/**
+ * Stored PAR payload. The `params` blob is the raw form/query record from
+ * `POST /par`, kept verbatim so the `/authorize` rehydrate path can feed
+ * it through the same Zod parser the direct path uses.
+ */
+export type ParRecord = {
+    requestUri: string;
+    /** Raw key/value record as posted to `/par` (excluding auth fields). */
+    params: Record<string, string>;
+    clientId: string;
+    /** Wall-clock issuance + absolute expiry (ms). */
+    issuedAt: number;
+    expiresAt: number;
+};
+/** Optional long-lived session payload (used by `createSession` family). */
+export type SessionRecord = {
+    sessionId: string;
+    tenantId: string;
+    subjectId: string;
+    /** Wall-clock issued / expires timestamps (ms). */
+    issuedAt: number;
+    expiresAt: number;
+    /** Free-form metadata adapters may use (device, user agent fingerprint, etc.). */
+    metadata?: Record<string, unknown>;
+};
+//# sourceMappingURL=session-store.d.ts.map