@o3co/auth-provider-templates 0.0.0 → 0.18.0-rc.1

package/federation-tokens-store/src/module.js

@@ -0,0 +1,43 @@
+import { refreshLocks, upstreamTokenStore, } from "@o3co/auth-provider-upstream-login/federation-tokens";
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { recordsIn } from "@o3co/auth-provider-foundation/records";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+/** Each need federation-tokens states for its records, as the guarantee a space declares for it. */
+const tokensGuaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesFailover: "replicated",
+};
+/** Each need it states for its locks. */
+const locksGuaranteeFor = {
+    neverEvicted: "no-eviction",
+};
+const tokens = {
+    name: "federation-tokens-store.tokens",
+    guarantees: Object.values(tokensGuaranteeFor),
+};
+const locks = {
+    name: "federation-tokens-store.locks",
+    guarantees: Object.values(locksGuaranteeFor),
+};
+export default defineModule({ name: "federation-tokens-store" }, (m) => [
+    m.contribute(spaces).by(() => tokens),
+    m.contribute(spaces).by(() => locks),
+    m.provide(upstreamTokenStore).by(async (c) => {
+        const place = { store: await c.get(store), space: tokens, log: c.log, random: c.random };
+        const records = recordsIn(place);
+        return {
+            save: records.create,
+            read: records.read,
+            update: records.change,
+            remove: records.remove,
+        };
+    }),
+    m.provide(refreshLocks).by(async (c) => {
+        const place = { store: await c.get(store), space: locks, log: c.log, random: c.random };
+        const marked = recordsIn(place);
+        return {
+            hold: (name, mark, lifetimeMs) => marked.create(name, mark, lifetimeMs),
+            update: marked.change,
+        };
+    }),
+]);

package/mfa-flows-store/README.md

@@ -0,0 +1,3 @@
+# mfa-flows-store
+
+Wires `mfa-flows`' store interface, transactions, to `records`' records under a secret, so a transaction's identifier never reaches the store. Its one space declares a guarantee for each of the other needs `mfa-flows` states. A need with nothing mapped to it fails the type check, and `mfa-flows`' store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `mfa-flows`, `records` and `store`.

package/mfa-flows-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/mfa-flows-store/src/module.js

@@ -0,0 +1,23 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { transactionStore, } from "@o3co/auth-provider-second-factor/mfa-flows";
+import { secretRecordsIn } from "@o3co/auth-provider-foundation/records";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+/** Each need mfa-flows states, as what meets it: a guarantee its space declares, or records under a secret. */
+const { namesFromSecret: recordsFor, ...guaranteeFor } = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+    namesFromSecret: secretRecordsIn,
+};
+const transactions = {
+    name: "mfa-flows-store.transactions",
+    guarantees: Object.values(guaranteeFor),
+};
+export default defineModule({ name: "mfa-flows-store" }, (m) => [
+    m.contribute(spaces).by(() => transactions),
+    m.provide(transactionStore).by(async (c) => {
+        const place = { store: await c.get(store), space: transactions, log: c.log, random: c.random };
+        const records = recordsFor(place);
+        return { save: records.create, read: records.read, update: records.change };
+    }),
+]);

package/mfa-store/README.md

@@ -0,0 +1,3 @@
+# mfa-store
+
+Wires `mfa`'s store interface, factor lists, to `records`' records, kept without end. Its one space declares a guarantee for each need `mfa` states. A need with nothing mapped to it fails the type check, and `mfa`'s store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `mfa`, `records` and `store`.

package/mfa-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/mfa-store/src/module.js

@@ -0,0 +1,24 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { factorStore } from "@o3co/auth-provider-second-factor/mfa";
+import { recordsIn } from "@o3co/auth-provider-foundation/records";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+/** Each need mfa states, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+    confirmedReads: "confirmed-reads",
+};
+const factors = { name: "mfa-store.factors", guarantees: Object.values(guaranteeFor) };
+export default defineModule({ name: "mfa-store" }, (m) => [
+    m.contribute(spaces).by(() => factors),
+    m.provide(factorStore).by(async (c) => {
+        const place = { store: await c.get(store), space: factors, log: c.log, random: c.random };
+        const records = recordsIn(place);
+        return {
+            save: (key, record) => records.create(key, record, "endless"),
+            read: records.read,
+            update: records.change,
+        };
+    }),
+]);

package/package.json

@@ -1,10 +1,102 @@
 {
   "name": "@o3co/auth-provider-templates",
-  "version": "0.0.0",
+  "version": "0.18.0-rc.1",
+  "type": "module",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/o3co/auth.provider.git",
+    "url": "https://github.com/o3co/auth.provider",
     "directory": "modules/templates"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    "./authorize-store/module": {
+      "types": "./authorize-store/src/module.d.ts",
+      "default": "./authorize-store/src/module.js"
+    },
+    "./client-assertion-store/module": {
+      "types": "./client-assertion-store/src/module.d.ts",
+      "default": "./client-assertion-store/src/module.js"
+    },
+    "./code-grant-store/module": {
+      "types": "./code-grant-store/src/module.d.ts",
+      "default": "./code-grant-store/src/module.js"
+    },
+    "./consent-store/module": {
+      "types": "./consent-store/src/module.d.ts",
+      "default": "./consent-store/src/module.js"
+    },
+    "./device-grant-store/module": {
+      "types": "./device-grant-store/src/module.d.ts",
+      "default": "./device-grant-store/src/module.js"
+    },
+    "./dpop-store/module": {
+      "types": "./dpop-store/src/module.d.ts",
+      "default": "./dpop-store/src/module.js"
+    },
+    "./federation-grants-store/module": {
+      "types": "./federation-grants-store/src/module.d.ts",
+      "default": "./federation-grants-store/src/module.js"
+    },
+    "./federation-store/module": {
+      "types": "./federation-store/src/module.d.ts",
+      "default": "./federation-store/src/module.js"
+    },
+    "./federation-tokens-store/module": {
+      "types": "./federation-tokens-store/src/module.d.ts",
+      "default": "./federation-tokens-store/src/module.js"
+    },
+    "./mfa-flows-store/module": {
+      "types": "./mfa-flows-store/src/module.d.ts",
+      "default": "./mfa-flows-store/src/module.js"
+    },
+    "./mfa-store/module": {
+      "types": "./mfa-store/src/module.d.ts",
+      "default": "./mfa-store/src/module.js"
+    },
+    "./refresh-store/module": {
+      "types": "./refresh-store/src/module.d.ts",
+      "default": "./refresh-store/src/module.js"
+    },
+    "./rp-logout-store/module": {
+      "types": "./rp-logout-store/src/module.d.ts",
+      "default": "./rp-logout-store/src/module.js"
+    },
+    "./session-store/module": {
+      "types": "./session-store/src/module.d.ts",
+      "default": "./session-store/src/module.js"
+    },
+    "./session-tokens-store/module": {
+      "types": "./session-tokens-store/src/module.d.ts",
+      "default": "./session-tokens-store/src/module.js"
+    },
+    "./subject-revocation-store/module": {
+      "types": "./subject-revocation-store/src/module.d.ts",
+      "default": "./subject-revocation-store/src/module.js"
+    },
+    "./tokens-store/module": {
+      "types": "./tokens-store/src/module.d.ts",
+      "default": "./tokens-store/src/module.js"
+    },
+    "./users-store/module": {
+      "types": "./users-store/src/module.d.ts",
+      "default": "./users-store/src/module.js"
+    },
+    "./webauthn-store/module": {
+      "types": "./webauthn-store/src/module.d.ts",
+      "default": "./webauthn-store/src/module.js"
+    }
+  },
+  "dependencies": {
+    "@o3co/auth-provider-delegation": "0.18.0-rc.1",
+    "@o3co/auth-provider-foundation": "0.18.0-rc.1",
+    "@o3co/auth-provider-identity": "0.18.0-rc.1",
+    "@o3co/auth-provider-oauth": "0.18.0-rc.1",
+    "@o3co/auth-provider-passkey": "0.18.0-rc.1",
+    "@o3co/auth-provider-second-factor": "0.18.0-rc.1",
+    "@o3co/auth-provider-upstream-login": "0.18.0-rc.1",
+    "zod": "4.6.5"
   }
-}
+}

package/refresh-store/README.md

@@ -0,0 +1,3 @@
+# refresh-store
+
+Wires `refresh`'s store interfaces to `records`: families, what each redemption left and the family of each access token to records, the families of each session and the access tokens of each family to keyed sets on `kernel`'s clock, and the families to settle to deferred work. Each has its own space, which declares a guarantee for each need `refresh` states, so names from different interfaces never meet. The operator section sets `families-per-session` and `tokens-per-family` (1–10000, default 1000), the caps of the keyed sets; each set is one record rewritten whole, so its cap stays small, and 1,000 is more than a client should need within one access token's lifetime. Past a cap, `refresh` revokes what is pushed out. The families to settle are spread over `settle-shards` shards (1–65536, default 1024) of up to `settles-per-shard` families (1–10000, default 1000); a family stays listed only while revoking its tokens keeps failing, so the defaults, about a million, leave room for a long outage while one shard stays near 50 KB. A need with nothing mapped to it fails the type check, and `refresh`'s store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `refresh`, `records` and `store`.

package/refresh-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/refresh-store/src/module.js

@@ -0,0 +1,60 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { deferredIn, keyedSetsIn, recordsIn } from "@o3co/auth-provider-foundation/records";
+import { familyStore, issuedAccess, redemptionStore, sessionFamilies, settleList, tokenFamilies, } from "@o3co/auth-provider-oauth/refresh";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { section } from "./section.js";
+/** Each need refresh states, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+};
+const guarantees = Object.values(guaranteeFor);
+const families = { name: "refresh-store.families", guarantees };
+const redemptions = { name: "refresh-store.redemptions", guarantees };
+const bySession = { name: "refresh-store.session-families", guarantees };
+const byFamily = { name: "refresh-store.issued-access", guarantees };
+const links = { name: "refresh-store.token-families", guarantees };
+const settles = { name: "refresh-store.settles", guarantees };
+/** A space's place: the composition's store, with its log and randomness. */
+const placeIn = async (c, space) => ({
+    store: await c.get(store),
+    space,
+    log: c.log,
+    random: c.random,
+});
+export default defineModule({ name: "refresh-store", section }, (m) => [
+    m.contribute(spaces).by(() => families),
+    m.contribute(spaces).by(() => redemptions),
+    m.contribute(spaces).by(() => bySession),
+    m.contribute(spaces).by(() => byFamily),
+    m.contribute(spaces).by(() => links),
+    m.contribute(spaces).by(() => settles),
+    m.provide(familyStore).by(async (c) => {
+        const records = recordsIn(await placeIn(c, families));
+        return { save: records.create, read: records.read, update: records.change };
+    }),
+    m.provide(redemptionStore).by(async (c) => {
+        const records = recordsIn(await placeIn(c, redemptions));
+        return { save: records.create, read: records.read };
+    }),
+    m.provide(tokenFamilies).by(async (c) => {
+        const records = recordsIn(await placeIn(c, links));
+        return { save: records.create, read: records.read };
+    }),
+    m.provide(sessionFamilies).by(async (c) => keyedSetsIn({
+        ...(await placeIn(c, bySession)),
+        cap: c.section["families-per-session"],
+        clock: c.clock,
+    })),
+    m.provide(issuedAccess).by(async (c) => keyedSetsIn({
+        ...(await placeIn(c, byFamily)),
+        cap: c.section["tokens-per-family"],
+        clock: c.clock,
+    })),
+    m.provide(settleList).by(async (c) => deferredIn({
+        ...(await placeIn(c, settles)),
+        shards: c.section["settle-shards"],
+        perShard: c.section["settles-per-shard"],
+    })),
+]);

package/refresh-store/src/section.d.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+/** How many members each list keeps to a key, and how the settle list is spread; the card says why the defaults. */
+export declare const section: z.ZodObject<{
+    "families-per-session": z.ZodDefault<z.ZodNumber>;
+    "tokens-per-family": z.ZodDefault<z.ZodNumber>;
+    "settle-shards": z.ZodDefault<z.ZodNumber>;
+    "settles-per-shard": z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;

package/refresh-store/src/section.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+/** How many members each list keeps to a key, and how the settle list is spread; the card says why the defaults. */
+export const section = z.strictObject({
+    "families-per-session": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(1000)
+        .describe("How many refresh token families a session's set keeps; past it, one is pushed out and revoked."),
+    "tokens-per-family": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(1000)
+        .describe("How many access tokens a family's set keeps; past it, one is pushed out and revoked."),
+    "settle-shards": z
+        .number()
+        .int()
+        .min(1)
+        .max(65_536)
+        .default(1024)
+        .describe("How many shards the list of families to settle is spread over."),
+    "settles-per-shard": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(1000)
+        .describe("How many families to settle one shard holds at most."),
+});

package/rp-logout-store/README.md

@@ -0,0 +1,3 @@
+# rp-logout-store
+
+Wires `rp-logout`'s store interfaces to `records`: the clients of each session to keyed sets on `kernel`'s clock, and the notices not yet delivered to deferred work. Each has its own space, which declares a guarantee for each need `rp-logout` states. The operator section sets `clients-per-session` (1–1000, default 64), the cap of each session's set; a session's clients are those that redeemed a code in it, few in practice, and one pushed out over the cap is answered, so `rp-logout` logs it. The notices are spread over `notice-shards` shards (1–65536, default 64) of up to `notices-per-shard` notices (1–10000, default 1000), and an add to a full shard is refused rather than push one out; a notice stays only while its client cannot be reached, so the defaults, about 64,000, leave room for an outage of some clients. A need with nothing mapped to it fails the type check, and `rp-logout`'s store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `rp-logout`, `records` and `store`.

package/rp-logout-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/rp-logout-store/src/module.js

@@ -0,0 +1,39 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { deferredIn, keyedSetsIn } from "@o3co/auth-provider-foundation/records";
+import { pendingNotices, sessionClients, } from "@o3co/auth-provider-oauth/rp-logout";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { section } from "./section.js";
+/** Each need rp-logout states, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+};
+const held = { name: "rp-logout-store.clients", guarantees: Object.values(guaranteeFor) };
+/** The notices state the same needs; typed by their own, so a need they add alone fails the type check. */
+const noticeGuaranteeFor = guaranteeFor;
+const pending = {
+    name: "rp-logout-store.notices",
+    guarantees: Object.values(noticeGuaranteeFor),
+};
+/** A space's place: the composition's store, with its log and randomness. */
+const placeIn = async (c, space) => ({
+    store: await c.get(store),
+    space,
+    log: c.log,
+    random: c.random,
+});
+export default defineModule({ name: "rp-logout-store", section }, (m) => [
+    m.contribute(spaces).by(() => held),
+    m.contribute(spaces).by(() => pending),
+    m.provide(sessionClients).by(async (c) => keyedSetsIn({
+        ...(await placeIn(c, held)),
+        cap: c.section["clients-per-session"],
+        clock: c.clock,
+    })),
+    m.provide(pendingNotices).by(async (c) => deferredIn({
+        ...(await placeIn(c, pending)),
+        shards: c.section["notice-shards"],
+        perShard: c.section["notices-per-shard"],
+    })),
+]);

package/rp-logout-store/src/section.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+/** How many clients the set keeps to a session, and how the pending notices are spread; the card says why the defaults. */
+export declare const section: z.ZodObject<{
+    "clients-per-session": z.ZodDefault<z.ZodNumber>;
+    "notice-shards": z.ZodDefault<z.ZodNumber>;
+    "notices-per-shard": z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;

package/rp-logout-store/src/section.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+/** How many clients the set keeps to a session, and how the pending notices are spread; the card says why the defaults. */
+export const section = z.strictObject({
+    "clients-per-session": z
+        .number()
+        .int()
+        .min(1)
+        .max(1000)
+        .default(64)
+        .describe("How many clients a session's set keeps; past it, one is pushed out and logged."),
+    "notice-shards": z
+        .number()
+        .int()
+        .min(1)
+        .max(65_536)
+        .default(64)
+        .describe("How many shards the logout notices not yet delivered are spread over."),
+    "notices-per-shard": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(1000)
+        .describe("How many undelivered notices one shard holds; an add to a full shard is refused."),
+});

package/session-store/README.md

@@ -0,0 +1,3 @@
+# session-store
+
+Wires `session-lifecycle`'s store interfaces to `records`: session records to records, the cookie index to records under a secret, so a cookie's secret never reaches the store, and the list of closings to deferred work. Each has its own space, so a handle and a cookie's name never meet, and every space but the listings confirms its reads, as `session-lifecycle` needs: an entry decides on a raise or a close another request wrote, so it reads only what a failover keeps. The list of closings is spread over `closing-shards` shards (1–65536, default 1024) of up to `closings-per-shard` sessions (1–10000, default 1000); a session stays listed only while a participant keeps failing to close, so the defaults, about a million, leave room for a long outage while one shard stays near 50 KB. Each subject's listed sessions are keyed sets on `kernel`'s clock, of up to `sessions-per-subject` sessions (1–10000, default 100); a login rewrites its subject's set whole, so the default keeps it near 7 KB, far above what one person holds. Over the cap, the set pushes out the session ending first; `session-lifecycle` logs it and closes it, listing the closing first so a crash still finishes it. A need with nothing mapped to it, a guarantee or records under a secret, fails the type check, and `session-lifecycle`'s store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `session-lifecycle`, `records` and `store`.

package/session-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/session-store/src/module.js

@@ -0,0 +1,65 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { deferredIn, keyedSetsIn, recordsIn, secretRecordsIn } from "@o3co/auth-provider-foundation/records";
+import { closingList, cookieIndex, sessionStore, subjectSessions, } from "@o3co/auth-provider-identity/session-lifecycle";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { section } from "./section.js";
+/** Each need session-lifecycle states, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+    readsConfirmed: "confirmed-reads",
+};
+const guarantees = Object.values(guaranteeFor);
+/** Each need the cookie index states, as what meets it: a guarantee its space declares, or records under a secret. */
+const { namesFromSecret: cookieRecordsFor, ...cookieGuaranteeFor } = {
+    ...guaranteeFor,
+    namesFromSecret: secretRecordsIn,
+};
+const sessions = { name: "session-store.sessions", guarantees };
+const cookies = {
+    name: "session-store.cookies",
+    guarantees: Object.values(cookieGuaranteeFor),
+};
+const closings = { name: "session-store.closings", guarantees };
+const { neverEvicted, survivesCrash, survivesFailover } = guaranteeFor;
+const listedGuaranteeFor = {
+    neverEvicted,
+    survivesCrash,
+    survivesFailover,
+};
+const subjects = {
+    name: "session-store.subjects",
+    guarantees: Object.values(listedGuaranteeFor),
+};
+/** A space's place: the composition's store, with its log and randomness. */
+const placeIn = async (c, space) => ({
+    store: await c.get(store),
+    space,
+    log: c.log,
+    random: c.random,
+});
+export default defineModule({ name: "session-store", section }, (m) => [
+    m.contribute(spaces).by(() => sessions),
+    m.contribute(spaces).by(() => cookies),
+    m.contribute(spaces).by(() => closings),
+    m.contribute(spaces).by(() => subjects),
+    m.provide(sessionStore).by(async (c) => {
+        const records = recordsIn(await placeIn(c, sessions));
+        return { save: records.create, read: records.read, update: records.change };
+    }),
+    m.provide(cookieIndex).by(async (c) => {
+        const records = cookieRecordsFor(await placeIn(c, cookies));
+        return { save: records.create, read: records.read, remove: records.remove };
+    }),
+    m.provide(subjectSessions).by(async (c) => keyedSetsIn({
+        ...(await placeIn(c, subjects)),
+        cap: c.section["sessions-per-subject"],
+        clock: c.clock,
+    })),
+    m.provide(closingList).by(async (c) => deferredIn({
+        ...(await placeIn(c, closings)),
+        shards: c.section["closing-shards"],
+        perShard: c.section["closings-per-shard"],
+    })),
+]);

package/session-store/src/section.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+/** How the list of closings is spread, and how many sessions a subject's listing keeps; the card says why the defaults. */
+export declare const section: z.ZodObject<{
+    "closing-shards": z.ZodDefault<z.ZodNumber>;
+    "closings-per-shard": z.ZodDefault<z.ZodNumber>;
+    "sessions-per-subject": z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;

package/session-store/src/section.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+/** How the list of closings is spread, and how many sessions a subject's listing keeps; the card says why the defaults. */
+export const section = z.strictObject({
+    "closing-shards": z
+        .number()
+        .int()
+        .min(1)
+        .max(65_536)
+        .default(1024)
+        .describe("How many shards the list of sessions still closing is spread over."),
+    "closings-per-shard": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(1000)
+        .describe("How many sessions still closing one shard holds at most."),
+    "sessions-per-subject": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(100)
+        .describe("How many sessions a subject's listing keeps; past it, the one ending first is pushed out and logged."),
+});

package/session-tokens-store/README.md

@@ -0,0 +1,3 @@
+# session-tokens-store
+
+Wires `session-tokens`' store interfaces to `records`: the tokens issued in each session to keyed sets on `kernel`'s clock, the token index to records, and the sessions pending a push-out to deferred work. Each has its own space, which declares a guarantee for each need `session-tokens` states. The operator section sets `references-per-session` (1–10000, default 1000), the cap of each session's set: past it, the set answers the reference that ends first as pushed out, keeping it awaiting in the same write, and `session-tokens` revokes its token. The index keeps one record per token id with no cap, ended by the store after its lifetime, and names it by the token id as it is, as `session-tokens` states no names from secrets. The pending sessions are spread over `pending-shards` shards (1–65536, default 64) of up to `pending-per-shard` sessions (1–10000, default 1000), and refuse when a shard is full rather than push one out; a session is listed when an add comes near its cap, and leaves once what it pushed out is revoked, so the defaults, about 64,000, leave room for an outage of revocation. A need with nothing mapped to it fails the type check, and `session-tokens`' store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `session-tokens`, `records` and `store`.

package/session-tokens-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/session-tokens-store/src/module.js

@@ -0,0 +1,55 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { deferredIn, keyedSetsIn, recordsIn } from "@o3co/auth-provider-foundation/records";
+import { issuedTokens, pendingSessions, tokenIndex, } from "@o3co/auth-provider-oauth/session-tokens";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { section } from "./section.js";
+/** Each need session-tokens states, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+};
+const issued = {
+    name: "session-tokens-store.issued",
+    guarantees: Object.values(guaranteeFor),
+};
+const indexGuaranteeFor = guaranteeFor;
+const indexed = {
+    name: "session-tokens-store.index",
+    guarantees: Object.values(indexGuaranteeFor),
+};
+const pendingGuaranteeFor = guaranteeFor;
+const pending = {
+    name: "session-tokens-store.pending-sessions",
+    guarantees: Object.values(pendingGuaranteeFor),
+};
+/** A space's place: the composition's store, with its log and randomness. */
+const placeIn = async (c, space) => ({
+    store: await c.get(store),
+    space,
+    log: c.log,
+    random: c.random,
+});
+export default defineModule({ name: "session-tokens-store", section }, (m) => [
+    m.contribute(spaces).by(() => issued),
+    m.contribute(spaces).by(() => indexed),
+    m.contribute(spaces).by(() => pending),
+    m.provide(issuedTokens).by(async (c) => {
+        const cap = c.section["references-per-session"];
+        const sets = keyedSetsIn({
+            ...(await placeIn(c, issued)),
+            cap,
+            clock: c.clock,
+        });
+        return { ...sets, size: cap };
+    }),
+    m.provide(tokenIndex).by(async (c) => {
+        const records = recordsIn(await placeIn(c, indexed));
+        return { save: records.create, read: records.read };
+    }),
+    m.provide(pendingSessions).by(async (c) => deferredIn({
+        ...(await placeIn(c, pending)),
+        shards: c.section["pending-shards"],
+        perShard: c.section["pending-per-shard"],
+    })),
+]);

package/session-tokens-store/src/section.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+/** How many references the set keeps to a session, and how the pending sessions are spread; the card says why the defaults. */
+export declare const section: z.ZodObject<{
+    "references-per-session": z.ZodDefault<z.ZodNumber>;
+    "pending-shards": z.ZodDefault<z.ZodNumber>;
+    "pending-per-shard": z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;

package/session-tokens-store/src/section.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+/** How many references the set keeps to a session, and how the pending sessions are spread; the card says why the defaults. */
+export const section = z.strictObject({
+    "references-per-session": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(1000)
+        .describe("How many token references a session's set keeps; past it, one is pushed out and its token revoked."),
+    "pending-shards": z
+        .number()
+        .int()
+        .min(1)
+        .max(65_536)
+        .default(64)
+        .describe("How many shards the sessions pending a push-out are spread over."),
+    "pending-per-shard": z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(1000)
+        .describe("How many pending sessions one shard holds; an add to a full shard is refused."),
+});

package/subject-revocation-store/README.md

@@ -0,0 +1,3 @@
+# subject-revocation-store
+
+Wires `subject-revocation`'s store interface, boundaries by subject, to `records`' records, kept without end. Its one space declares a guarantee for each need `subject-revocation` states. A need with nothing mapped to it fails the type check, and `subject-revocation`'s store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `subject-revocation`, `records` and `store`.

package/subject-revocation-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;