@exortek/apikey 1.1.2 → 1.2.0

package/dist/middleware/express.mjs

@@ -387,7 +387,7 @@ const ALPHABET$1 = /^[A-Za-z0-9_-]*$/;
  * @param {Buffer | Uint8Array} bytes
  * @returns {string}
  */
-function encode(bytes) {
+function encode$1(bytes) {
   if (bytes == null || (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array))) {
     throw new TypeError('base64url.encode: expected Buffer or Uint8Array');
   }
@@ -451,6 +451,39 @@ for (const [alias, canonical] of [
   DECODE_TABLE[alias.charCodeAt(0)] = DECODE_TABLE[canonical.charCodeAt(0)];
 }
 
+/**
+ * Encode bytes as a Crockford base32 string.
+ *
+ * @param {Buffer | Uint8Array} bytes
+ * @returns {string}
+ * @throws {TypeError} if `bytes` is not a Buffer or Uint8Array.
+ */
+function encode(bytes) {
+  if (!(bytes instanceof Uint8Array)) {
+    throw new TypeError('encode: input must be a Buffer or Uint8Array.');
+  }
+  if (bytes.length === 0) {
+    return '';
+  }
+
+  let out = '';
+  let bits = 0;
+  let value = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    value = (value << 8) | bytes[i];
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      out += ALPHABET[(value >>> bits) & 0x1f];
+      value &= (1 << bits) - 1;
+    }
+  }
+  if (bits > 0) {
+    out += ALPHABET[(value << (5 - bits)) & 0x1f];
+  }
+  return out;
+}
+
 /**
  * Decode a Crockford base32 string into a Buffer.
  *
@@ -610,7 +643,7 @@ function hashSecret(secretBytes, pepper) {
   const digest = pepper
     ? createHmac('sha256', pepper).update(secretBytes).digest()
     : createHash('sha256').update(secretBytes).digest();
-  return encode(digest);
+  return encode$1(digest);
 }
 
 /**
@@ -702,6 +735,12 @@ function candidateHashesFor(rawSecret, peppers) {
   } catch {
     return { candidateHashes: [] };
   }
+  // Crockford decoding is forgiving (case, I/L→1, O→0), so one secret has
+  // many accepted spellings. A key must have exactly one: anything keyed on
+  // the wire string (logs, deny lists, dedupe) would otherwise miss variants.
+  if (encode(secretBytes) !== rawSecret) {
+    return { candidateHashes: [] };
+  }
   if (!peppers || peppers.length === 0) {
     return { candidateHashes: [hashSecret(secretBytes, null)] };
   }
@@ -772,19 +811,15 @@ async function verifyApiKey(rawKey, options) {
   if (!record) {
     return { valid: false, reason: 'not_found' };
   }
-  const now = _now(options.now);
-  if (record.revokedAt) {
-    return { valid: false, reason: 'revoked' };
-  }
-  if (record.expiresAt && record.expiresAt <= now) {
-    return { valid: false, reason: 'expired' };
-  }
   if (parsed.prefix !== record.prefix) {
     // Someone submitted a key whose id belongs to a different prefix —
     // treat as bad, not merely 'prefix_mismatch', because the id half
     // was correct: the attacker guessed the id and swapped the prefix.
     return { valid: false, reason: 'prefix_mismatch' };
   }
+  // The secret is checked before lifecycle state: the id is not secret (it
+  // is in every masked key), so answering 'revoked' / 'expired' first
+  // would tell anyone holding an id the key's status without its secret.
   const { candidateHashes } = candidateHashesFor(parsed.secret, peppers);
   let matched = false;
   let matchedIndex = -1;
@@ -798,6 +833,13 @@ async function verifyApiKey(rawKey, options) {
   if (!matched) {
     return { valid: false, reason: 'bad_secret' };
   }
+  const now = _now(options.now);
+  if (record.revokedAt) {
+    return { valid: false, reason: 'revoked' };
+  }
+  if (record.expiresAt && record.expiresAt <= now) {
+    return { valid: false, reason: 'expired' };
+  }
   if (isArray(requiredScopes) && requiredScopes.length > 0 && !hasAll(record.scopes, requiredScopes)) {
     return { valid: false, reason: 'missing_scope' };
   }

package/dist/middleware/fastify.cjs

@@ -450,7 +450,7 @@ const ALPHABET$1 = /^[A-Za-z0-9_-]*$/;
  * @param {Buffer | Uint8Array} bytes
  * @returns {string}
  */
-function encode(bytes) {
+function encode$1(bytes) {
   if (bytes == null || (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array))) {
     throw new TypeError('base64url.encode: expected Buffer or Uint8Array');
   }
@@ -514,6 +514,39 @@ for (const [alias, canonical] of [
   DECODE_TABLE[alias.charCodeAt(0)] = DECODE_TABLE[canonical.charCodeAt(0)];
 }
 
+/**
+ * Encode bytes as a Crockford base32 string.
+ *
+ * @param {Buffer | Uint8Array} bytes
+ * @returns {string}
+ * @throws {TypeError} if `bytes` is not a Buffer or Uint8Array.
+ */
+function encode(bytes) {
+  if (!(bytes instanceof Uint8Array)) {
+    throw new TypeError('encode: input must be a Buffer or Uint8Array.');
+  }
+  if (bytes.length === 0) {
+    return '';
+  }
+
+  let out = '';
+  let bits = 0;
+  let value = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    value = (value << 8) | bytes[i];
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      out += ALPHABET[(value >>> bits) & 0x1f];
+      value &= (1 << bits) - 1;
+    }
+  }
+  if (bits > 0) {
+    out += ALPHABET[(value << (5 - bits)) & 0x1f];
+  }
+  return out;
+}
+
 /**
  * Decode a Crockford base32 string into a Buffer.
  *
@@ -673,7 +706,7 @@ function hashSecret(secretBytes, pepper) {
   const digest = pepper
     ? node_crypto.createHmac('sha256', pepper).update(secretBytes).digest()
     : node_crypto.createHash('sha256').update(secretBytes).digest();
-  return encode(digest);
+  return encode$1(digest);
 }
 
 /**
@@ -765,6 +798,12 @@ function candidateHashesFor(rawSecret, peppers) {
   } catch {
     return { candidateHashes: [] };
   }
+  // Crockford decoding is forgiving (case, I/L→1, O→0), so one secret has
+  // many accepted spellings. A key must have exactly one: anything keyed on
+  // the wire string (logs, deny lists, dedupe) would otherwise miss variants.
+  if (encode(secretBytes) !== rawSecret) {
+    return { candidateHashes: [] };
+  }
   if (!peppers || peppers.length === 0) {
     return { candidateHashes: [hashSecret(secretBytes, null)] };
   }
@@ -835,19 +874,15 @@ async function verifyApiKey(rawKey, options) {
   if (!record) {
     return { valid: false, reason: 'not_found' };
   }
-  const now = _now(options.now);
-  if (record.revokedAt) {
-    return { valid: false, reason: 'revoked' };
-  }
-  if (record.expiresAt && record.expiresAt <= now) {
-    return { valid: false, reason: 'expired' };
-  }
   if (parsed.prefix !== record.prefix) {
     // Someone submitted a key whose id belongs to a different prefix —
     // treat as bad, not merely 'prefix_mismatch', because the id half
     // was correct: the attacker guessed the id and swapped the prefix.
     return { valid: false, reason: 'prefix_mismatch' };
   }
+  // The secret is checked before lifecycle state: the id is not secret (it
+  // is in every masked key), so answering 'revoked' / 'expired' first
+  // would tell anyone holding an id the key's status without its secret.
   const { candidateHashes } = candidateHashesFor(parsed.secret, peppers);
   let matched = false;
   let matchedIndex = -1;
@@ -861,6 +896,13 @@ async function verifyApiKey(rawKey, options) {
   if (!matched) {
     return { valid: false, reason: 'bad_secret' };
   }
+  const now = _now(options.now);
+  if (record.revokedAt) {
+    return { valid: false, reason: 'revoked' };
+  }
+  if (record.expiresAt && record.expiresAt <= now) {
+    return { valid: false, reason: 'expired' };
+  }
   if (isArray(requiredScopes) && requiredScopes.length > 0 && !hasAll(record.scopes, requiredScopes)) {
     return { valid: false, reason: 'missing_scope' };
   }

package/dist/middleware/fastify.d.ts

@@ -1 +1,3 @@
-export const apiKeyPlugin: Function;
+declare const apiKeyPlugin: Function;
+
+export { apiKeyPlugin };

package/dist/middleware/fastify.mjs

@@ -448,7 +448,7 @@ const ALPHABET$1 = /^[A-Za-z0-9_-]*$/;
  * @param {Buffer | Uint8Array} bytes
  * @returns {string}
  */
-function encode(bytes) {
+function encode$1(bytes) {
   if (bytes == null || (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array))) {
     throw new TypeError('base64url.encode: expected Buffer or Uint8Array');
   }
@@ -512,6 +512,39 @@ for (const [alias, canonical] of [
   DECODE_TABLE[alias.charCodeAt(0)] = DECODE_TABLE[canonical.charCodeAt(0)];
 }
 
+/**
+ * Encode bytes as a Crockford base32 string.
+ *
+ * @param {Buffer | Uint8Array} bytes
+ * @returns {string}
+ * @throws {TypeError} if `bytes` is not a Buffer or Uint8Array.
+ */
+function encode(bytes) {
+  if (!(bytes instanceof Uint8Array)) {
+    throw new TypeError('encode: input must be a Buffer or Uint8Array.');
+  }
+  if (bytes.length === 0) {
+    return '';
+  }
+
+  let out = '';
+  let bits = 0;
+  let value = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    value = (value << 8) | bytes[i];
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      out += ALPHABET[(value >>> bits) & 0x1f];
+      value &= (1 << bits) - 1;
+    }
+  }
+  if (bits > 0) {
+    out += ALPHABET[(value << (5 - bits)) & 0x1f];
+  }
+  return out;
+}
+
 /**
  * Decode a Crockford base32 string into a Buffer.
  *
@@ -671,7 +704,7 @@ function hashSecret(secretBytes, pepper) {
   const digest = pepper
     ? createHmac('sha256', pepper).update(secretBytes).digest()
     : createHash('sha256').update(secretBytes).digest();
-  return encode(digest);
+  return encode$1(digest);
 }
 
 /**
@@ -763,6 +796,12 @@ function candidateHashesFor(rawSecret, peppers) {
   } catch {
     return { candidateHashes: [] };
   }
+  // Crockford decoding is forgiving (case, I/L→1, O→0), so one secret has
+  // many accepted spellings. A key must have exactly one: anything keyed on
+  // the wire string (logs, deny lists, dedupe) would otherwise miss variants.
+  if (encode(secretBytes) !== rawSecret) {
+    return { candidateHashes: [] };
+  }
   if (!peppers || peppers.length === 0) {
     return { candidateHashes: [hashSecret(secretBytes, null)] };
   }
@@ -833,19 +872,15 @@ async function verifyApiKey(rawKey, options) {
   if (!record) {
     return { valid: false, reason: 'not_found' };
   }
-  const now = _now(options.now);
-  if (record.revokedAt) {
-    return { valid: false, reason: 'revoked' };
-  }
-  if (record.expiresAt && record.expiresAt <= now) {
-    return { valid: false, reason: 'expired' };
-  }
   if (parsed.prefix !== record.prefix) {
     // Someone submitted a key whose id belongs to a different prefix —
     // treat as bad, not merely 'prefix_mismatch', because the id half
     // was correct: the attacker guessed the id and swapped the prefix.
     return { valid: false, reason: 'prefix_mismatch' };
   }
+  // The secret is checked before lifecycle state: the id is not secret (it
+  // is in every masked key), so answering 'revoked' / 'expired' first
+  // would tell anyone holding an id the key's status without its secret.
   const { candidateHashes } = candidateHashesFor(parsed.secret, peppers);
   let matched = false;
   let matchedIndex = -1;
@@ -859,6 +894,13 @@ async function verifyApiKey(rawKey, options) {
   if (!matched) {
     return { valid: false, reason: 'bad_secret' };
   }
+  const now = _now(options.now);
+  if (record.revokedAt) {
+    return { valid: false, reason: 'revoked' };
+  }
+  if (record.expiresAt && record.expiresAt <= now) {
+    return { valid: false, reason: 'expired' };
+  }
   if (isArray(requiredScopes) && requiredScopes.length > 0 && !hasAll(record.scopes, requiredScopes)) {
     return { valid: false, reason: 'missing_scope' };
   }

package/dist/stores/custom.d.ts

@@ -1,8 +1 @@
-export function customStore(impl: any): {
-    put: (record: any) => Promise<any>;
-    getById: (id: any) => Promise<any>;
-    update: (id: any, patch: any) => Promise<any>;
-    revoke: (id: any, reason: any) => Promise<any>;
-    revokeAllForUser: (userId: any, reason: any) => Promise<any>;
-    listByUser: (userId: any) => Promise<any>;
-};
+export const customStore: (impl: object) => Record<string, (...args: any[]) => Promise<any>>;

package/dist/stores/index.d.ts

@@ -1,3 +1,79 @@
-export { memoryStore } from "./memory.js";
-export { redisStore } from "./redis.js";
-export { customStore } from "./custom.js";
+type ApiKeyRecord = {
+    /**
+     * Plaintext lookup key (128-bit b64u).
+     */
+    id: string;
+    /**
+     * Storage hash of the secret (43-char b64u).
+     */
+    hash: string;
+    /**
+     * The prefix the key was minted with.
+     */
+    prefix: string;
+    userId: string;
+    scopes: string[];
+    /**
+     * Human label ("Production Backend").
+     */
+    name?: string | undefined;
+    /**
+     * `'live'` / `'test'` / caller-defined.
+     */
+    environment?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    /**
+     * ms epoch.
+     */
+    createdAt: number;
+    /**
+     * ms epoch; absent = no expiry.
+     */
+    expiresAt?: number | undefined;
+    /**
+     * ms epoch when the record was revoked.
+     */
+    revokedAt?: number | undefined;
+    revokedReason?: string | undefined;
+    /**
+     * ms epoch of the last successful verify.
+     */
+    lastUsedAt?: number | undefined;
+    /**
+     * Index into the peppers array that was used at mint. 0 = newest.
+     */
+    pepperVersion?: number | undefined;
+};
+type ApiKeyStore = {
+    put: (record: ApiKeyRecord) => Promise<void>;
+    getById: (id: string) => Promise<ApiKeyRecord | null>;
+    update: (id: string, patch: Partial<ApiKeyRecord>) => Promise<ApiKeyRecord | null>;
+    revoke: (id: string, reason?: string) => Promise<boolean>;
+    revokeAllForUser: (userId: string, reason?: string) => Promise<number>;
+    listByUser: (userId: string) => Promise<ApiKeyRecord[]>;
+};
+
+/**
+ * @returns {import('../index.js').ApiKeyStore & { _size: () => number }}
+ */
+declare function memoryStore(): ApiKeyStore & {
+    _size: () => number;
+};
+
+/**
+ * @typedef {object} RedisStoreOptions
+ * @property {string} [keyPrefix='apikey:']
+ */
+/**
+ * @param {any} client
+ * @param {RedisStoreOptions} [options]
+ * @returns {import('../index.js').ApiKeyStore}
+ */
+declare function redisStore(client: any, options?: RedisStoreOptions): ApiKeyStore;
+type RedisStoreOptions = {
+    keyPrefix?: string | undefined;
+};
+
+declare const customStore: (impl: object) => Record<string, (...args: any[]) => Promise<any>>;
+
+export { customStore, memoryStore, redisStore };

package/dist/stores.cjs

@@ -169,6 +169,8 @@ function detectDialect(client) {
  *   smembers: (key: string) => Promise<string[]>,
  *   setWithTTL: (key: string, value: string, ttlMs: number) => Promise<void>,
  *   setPlain: (key: string, value: string) => Promise<void>,
+ *   setKeepTTL: (key: string, value: string) => Promise<void>,
+ *   setIfAbsent: (key: string, value: string, ttlMs: number) => Promise<boolean>,
  *   parseRecord: (raw: string|object|null) => object|null,
  * }}
  */
@@ -238,6 +240,29 @@ function createRedisHelpers(client) {
       await client.set(key, value);
     },
 
+    // Overwrite a value but keep whatever expiry the key already has
+    // (Redis ≥ 6.0 `SET … KEEPTTL`). A plain SET clears the TTL, so an
+    // update to an expiring record would otherwise make it immortal.
+    async setKeepTTL(key, value) {
+      if (dialect === 'ioredis') {
+        await client.set(key, value, 'KEEPTTL');
+      } else {
+        await client.set(key, value, { KEEPTTL: true });
+      }
+    },
+
+    // Atomic claim: `SET key value PX ttl NX`. Resolves true when this call
+    // created the key, false when it already existed — a cross-process
+    // compare-and-set for "only the first caller wins".
+    async setIfAbsent(key, value, ttlMs) {
+      const px = Math.max(1, Math.ceil(ttlMs));
+      const reply =
+        dialect === 'ioredis'
+          ? await client.set(key, value, 'PX', px, 'NX')
+          : await client.set(key, value, { PX: px, NX: true });
+      return reply === 'OK';
+    },
+
     parseRecord(raw) {
       if (!raw) {
         return null;
@@ -333,8 +358,15 @@ function createMemoryRecordStore(config) {
     byIndex,
 
     async put(record) {
-      byId.set(record[idField], copy(record));
-      addIndex(record[indexField], record[idField]);
+      const id = record[idField];
+      const previous = byId.get(id);
+      // Overwriting a record under a different owner must drop the old
+      // owner's index entry, or the old owner keeps listing it.
+      if (previous && previous[indexField] !== record[indexField]) {
+        removeIndex(previous[indexField], id);
+      }
+      byId.set(id, copy(record));
+      addIndex(record[indexField], id);
     },
 
     async getById(id) {
@@ -399,7 +431,7 @@ function createMemoryRecordStore(config) {
  * @returns {{
  *   put: (record: object, ttlMs?: number) => Promise<void>,
  *   getById: (id: string) => Promise<object|null>,
- *   update: (id: string, patch: object, ttlMs?: number) => Promise<object|null>,
+ *   update: (id: string, patch: object, ttlMs?: number) => Promise<object|null>,  without `ttlMs` a TTL store keeps the key's remaining expiry
  *   listByIndex: (indexValue: string) => Promise<object[]>,
  *   readRecord: (id: string) => Promise<object|null>,
  *   writeRecord: (record: object, ttlMs?: number) => Promise<void>,
@@ -464,6 +496,16 @@ function createRedisRecordStore(client, config) {
     }
   }
 
+  // An update with no explicit TTL keeps the key's remaining expiry
+  // instead of clearing it.
+  async function rewriteRecord(record, ttlMs) {
+    if (ttl && ttlMs === undefined) {
+      await helpers.setKeepTTL(rk(record[idField]), JSON.stringify(record));
+      return;
+    }
+    await writeRecord(record, ttlMs);
+  }
+
   async function writeTombstone(id, data, ttlMs) {
     const value = JSON.stringify(data);
     if (ttl && ttlMs !== undefined) {
@@ -500,7 +542,10 @@ function createRedisRecordStore(client, config) {
       const raw = rows[i * stride];
       const rawTomb = tombstones ? rows[i * stride + 1] : null;
       const record = helpers.parseRecord(raw);
-      if (!record) {
+      // Gone, or re-put under another owner (`put` does not read the old
+      // record, so it cannot unlink the old index entry itself) — prune the
+      // stale entry and never hand the record to this owner.
+      if (!record || record[indexField] !== indexValue) {
         await indexRemove(indexValue, ids[i]);
         pairs.push([ids[i], null]);
         continue;
@@ -529,7 +574,7 @@ function createRedisRecordStore(client, config) {
       }
       const oldIndex = existing[indexField];
       const next = { ...existing, ...patch };
-      await writeRecord(next, ttlMs);
+      await rewriteRecord(next, ttlMs);
       if (!isUndefined(patch[indexField]) && patch[indexField] !== oldIndex) {
         if (isString(oldIndex)) {
           await indexRemove(oldIndex, id);
@@ -897,39 +942,101 @@ function redisStore(client, options = {}) {
 }
 
 /**
- * Wrap a user-supplied store into the `ApiKeyStore` interface.
- * Validates that the required methods exist so a misconfiguration
- * surfaces at construction time, not on the first `createApiKey` /
- * `verifyApiKey` call. Sync implementations are wrapped transparently
- * — return a plain value or a Promise, either works.
+ * Family factory for the `customStore(impl)` wrapper every store-shipping
+ * package exposes.
  *
- * Required: `put`, `getById`, `update`, `revoke`, `revokeAllForUser`, `listByUser`.
+ * Each package used to hand-roll the same three steps: assert `impl` is an
+ * object, assert its required methods are functions, then `Promise.resolve()`
+ * -wrap every call so a sync implementation is transparently promoted to the
+ * async store interface. Only the method-name arrays and the typed error
+ * differ. This collapses all of that into one binding per package.
  *
- * @param {Partial<import('../index.js').ApiKeyStore>} impl
- * @returns {import('../index.js').ApiKeyStore}
+ * Consumers: `apikey`, `challenge`, `magic-link`, `opaque`, `session`.
  */
 
-const REQUIRED = ['put', 'getById', 'update', 'revoke', 'revokeAllForUser', 'listByUser'];
 
-function customStore(impl) {
+/**
+ * Assert `impl` is an object exposing every method in `required` as a function.
+ * Throws the caller's typed error (via `wrap`) on the first failure. Used on
+ * its own by stores that keep a caller's implementation verbatim (jwt / paseto
+ * token registries), and internally by {@link createCustomStoreValidator}.
+ *
+ * @param {unknown} impl
+ * @param {readonly string[]} required
+ * @param {(message: string) => Error} wrap
+ *   The package's error factory; its returned error is thrown. A `wrap` that
+ *   throws directly also works (the outer `throw` is then unreachable).
+ * @returns {void}
+ */
+function assertStoreShape(impl, required, wrap) {
   if (!isObject(impl)) {
-    throw invalidArgument(`customStore(impl) requires an object with { ${REQUIRED.join(', ')} } methods`);
+    throw wrap(`customStore(impl) requires an object with { ${required.join(', ')} } methods`);
   }
-  for (const name of REQUIRED) {
-    if (!isFunction(impl[name])) {
-      throw invalidArgument(`customStore: impl.${name} is required and must be a function`);
+  for (const name of required) {
+    if (!isFunction(/** @type {any} */ (impl)[name])) {
+      throw wrap(`customStore: impl.${name} is required and must be a function`);
     }
   }
-  return {
-    put: record => Promise.resolve(impl.put(record)),
-    getById: id => Promise.resolve(impl.getById(id)),
-    update: (id, patch) => Promise.resolve(impl.update(id, patch)),
-    revoke: (id, reason) => Promise.resolve(impl.revoke(id, reason)),
-    revokeAllForUser: (userId, reason) => Promise.resolve(impl.revokeAllForUser(userId, reason)),
-    listByUser: userId => Promise.resolve(impl.listByUser(userId)),
+}
+
+/**
+ * @param {object} spec
+ * @param {readonly string[]} spec.required
+ *   Methods that must exist on `impl`; missing ones fail at construction time.
+ * @param {readonly string[]} [spec.optional]
+ *   Methods wrapped through only when present (feature-gated store extras).
+ * @param {(message: string) => Error} spec.wrap
+ *   The package's error factory (its `invalidArgument`) — called with a
+ *   diagnostic message; its returned typed error is thrown so
+ *   `err instanceof <Pkg>Error` holds. A `wrap` that throws directly also
+ *   works (the outer `throw` is then unreachable).
+ * @param {Record<string, (result: any) => any>} [spec.coerce]
+ *   Optional per-method post-processor applied to the resolved result — e.g.
+ *   opaque coerces `set` to `undefined` so a native `Map.set` return value
+ *   can't leak out as `Promise<Map>`.
+ * @returns {(impl: object) => Record<string, (...args: any[]) => Promise<any>>}
+ */
+function createCustomStoreValidator({ required, optional = [], wrap, coerce = {} }) {
+  return function customStore(impl) {
+    assertStoreShape(impl, required, wrap);
+
+    /** @type {Record<string, (...args: any[]) => Promise<any>>} */
+    const store = {};
+    const bind = name => {
+      const post = coerce[name];
+      store[name] = post
+        ? (...args) => Promise.resolve(impl[name](...args)).then(post)
+        : (...args) => Promise.resolve(impl[name](...args));
+    };
+
+    for (const name of required) {
+      bind(name);
+    }
+    for (const name of optional) {
+      if (isFunction(impl[name])) {
+        bind(name);
+      }
+    }
+    return store;
   };
 }
 
+/**
+ * Wrap a user-supplied store into the `ApiKeyStore` interface. Validates the
+ * required methods at construction time (not on first use) and promotes sync
+ * implementations to the async interface.
+ *
+ * Required: `put`, `getById`, `update`, `revoke`, `revokeAllForUser`, `listByUser`.
+ *
+ * @param {Partial<import('../index.js').ApiKeyStore>} impl
+ * @returns {import('../index.js').ApiKeyStore}
+ */
+
+const customStore = createCustomStoreValidator({
+  required: ['put', 'getById', 'update', 'revoke', 'revokeAllForUser', 'listByUser'],
+  wrap: invalidArgument,
+});
+
 exports.customStore = customStore;
 exports.memoryStore = memoryStore;
 exports.redisStore = redisStore;