dynamodb-refresh-token-provider 0.1.2

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,90 @@
+# DynamoDB Refresh Token Provider
+
+[![npm version](https://img.shields.io/npm/v/dynamodb-refresh-token-provider.svg)](https://www.npmjs.com/package/dynamodb-refresh-token-provider)
+[![License](https://img.shields.io/npm/l/dynamodb-refresh-token-provider.svg)](https://github.com/gammarers-aws-sdk-extensions/athena-query-result-collector/blob/main/LICENSE)
+[![build](https://github.com/gammarers-aws-sdk-extensions/athena-query-result-collector/actions/workflows/build.yml/badge.svg)](https://github.com/gammarers-aws-sdk-extensions/athena-query-result-collector/actions/workflows/build.yml)
+
+TypeScript library that stores **opaque refresh tokens** in **Amazon DynamoDB** using AWS SDK for JavaScript v3. Tokens are persisted under a hash of the plaintext value; **issue**, **rotate** (with reuse detection via a transactional write), and **revoke** (idempotent) are supported.
+
+## Features
+
+- **`RefreshTokenStore` interface** — swap implementations while keeping the same API.
+- **`DynamoRefreshTokenStore`** — single-table design with partition key `pk` (string), strongly consistent reads by default.
+- **Rotation safety** — marks the old row as rotated and inserts the successor in one DynamoDB transaction; detects reuse and conflicting updates.
+- **Structured errors** — `RefreshTokenInvalidError`, `RefreshTokenExpiredError`, `RefreshTokenRevokedError`, `RefreshTokenReusedError`, and related types for `instanceof` handling.
+- **Utilities** — `sha256hex` and `randomtoken` for hashing and token generation aligned with the store.
+
+## Installation
+
+```bash
+npm install dynamodb-refresh-token-provider
+```
+
+```bash
+yarn add dynamodb-refresh-token-provider
+```
+
+## Usage
+
+Create a store with your table name, AWS region, and optional `StoreOptions`. Ensure your DynamoDB table has a **string partition key** named `pk` (same attribute name the library uses for items).
+
+```typescript
+import {
+  DynamoRefreshTokenStore,
+  RefreshTokenInvalidError,
+  RefreshTokenReusedError,
+} from 'dynamodb-refresh-token-provider';
+
+const store = new DynamoRefreshTokenStore('your-refresh-token-table', 'us-east-1', {
+  ttlDays: 60,
+  pkPrefix: 'rt#',
+});
+
+// Issue a new refresh token for a subject/session
+const issued = await store.issue({
+  subjectId: 'user-123',
+  sessionId: 'session-456',
+});
+// issued.refreshToken — send to the client (plaintext)
+// issued.refreshTokenExpiresAt — Unix seconds
+
+// Rotate: exchange current token for a new one
+try {
+  const rotated = await store.rotate({ refreshToken: issued.refreshToken });
+  // rotated.refreshToken, rotated.refreshTokenExpiresAt, rotated.subjectId, rotated.sessionId
+} catch (e) {
+  if (e instanceof RefreshTokenReusedError) {
+    // token was already rotated or transaction lost the race
+  }
+  if (e instanceof RefreshTokenInvalidError) {
+    // unknown or malformed token
+  }
+  throw e;
+}
+
+// Revoke: idempotent; succeeds even if the row does not exist
+await store.revoke({ refreshToken: issued.refreshToken });
+```
+
+## Options
+
+Constructor: `new DynamoRefreshTokenStore(tableName, region, options?)`.
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `ttlDays` | `number` | `60` | Lifetime of issued/rotated tokens in days (added to `now` in seconds). |
+| `pkPrefix` | `string` | `'rt#'` | Prefix for the partition key; full `pk` is `prefix` + SHA-256 hex of the plaintext token. |
+| `consistentRead` | `boolean` | `true` | Use strongly consistent reads on `GetItem` when loading a token row. |
+| `endpoint` | `string` | (none) | Custom DynamoDB API endpoint (e.g. LocalStack or DynamoDB Local). |
+
+Method parameters also accept an optional `now?: Date` on `issue`, `rotate`, and `revoke` for testing or clock injection.
+
+## Requirements
+
+- **Node.js** 20.0.0 or later.
+- A **DynamoDB table** with a string partition key attribute **`pk`**.
+- **AWS credentials** and permissions for `PutItem`, `GetItem`, `UpdateItem`, and `TransactWriteItems` on that table (and the configured `endpoint` if used).
+
+## License
+
+This project is licensed under the Apache-2.0 License.

package/lib/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Public API: refresh token store types, DynamoDB-backed implementation, errors, and crypto helpers.
+ */
+export type { RefreshTokenStore, IssueParams, IssueResult, RotateParams, RotateResult, RevokeParams, StoreOptions, TokenRecord, EpochSec, } from './types/index';
+export { DynamoRefreshTokenStore } from './stores/dynamodb';
+export { RefreshTokenError, RefreshTokenExpiredError, RefreshTokenInvalidError, RefreshTokenReusedError, RefreshTokenRevokedError, RefreshTokenRotateFailedError, } from './stores/refresh-token-errors';
+export { sha256hex, randomtoken } from './utils/hash';

package/lib/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.randomtoken = exports.sha256hex = exports.RefreshTokenRotateFailedError = exports.RefreshTokenRevokedError = exports.RefreshTokenReusedError = exports.RefreshTokenInvalidError = exports.RefreshTokenExpiredError = exports.RefreshTokenError = exports.DynamoRefreshTokenStore = void 0;
+var dynamodb_1 = require("./stores/dynamodb");
+Object.defineProperty(exports, "DynamoRefreshTokenStore", { enumerable: true, get: function () { return dynamodb_1.DynamoRefreshTokenStore; } });
+var refresh_token_errors_1 = require("./stores/refresh-token-errors");
+Object.defineProperty(exports, "RefreshTokenError", { enumerable: true, get: function () { return refresh_token_errors_1.RefreshTokenError; } });
+Object.defineProperty(exports, "RefreshTokenExpiredError", { enumerable: true, get: function () { return refresh_token_errors_1.RefreshTokenExpiredError; } });
+Object.defineProperty(exports, "RefreshTokenInvalidError", { enumerable: true, get: function () { return refresh_token_errors_1.RefreshTokenInvalidError; } });
+Object.defineProperty(exports, "RefreshTokenReusedError", { enumerable: true, get: function () { return refresh_token_errors_1.RefreshTokenReusedError; } });
+Object.defineProperty(exports, "RefreshTokenRevokedError", { enumerable: true, get: function () { return refresh_token_errors_1.RefreshTokenRevokedError; } });
+Object.defineProperty(exports, "RefreshTokenRotateFailedError", { enumerable: true, get: function () { return refresh_token_errors_1.RefreshTokenRotateFailedError; } });
+var hash_1 = require("./utils/hash");
+Object.defineProperty(exports, "sha256hex", { enumerable: true, get: function () { return hash_1.sha256hex; } });
+Object.defineProperty(exports, "randomtoken", { enumerable: true, get: function () { return hash_1.randomtoken; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBZUEsOENBQTREO0FBQW5ELG1IQUFBLHVCQUF1QixPQUFBO0FBQ2hDLHNFQU91QztBQU5yQyx5SEFBQSxpQkFBaUIsT0FBQTtBQUNqQixnSUFBQSx3QkFBd0IsT0FBQTtBQUN4QixnSUFBQSx3QkFBd0IsT0FBQTtBQUN4QiwrSEFBQSx1QkFBdUIsT0FBQTtBQUN2QixnSUFBQSx3QkFBd0IsT0FBQTtBQUN4QixxSUFBQSw2QkFBNkIsT0FBQTtBQUUvQixxQ0FBc0Q7QUFBN0MsaUdBQUEsU0FBUyxPQUFBO0FBQUUsbUdBQUEsV0FBVyxPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBQdWJsaWMgQVBJOiByZWZyZXNoIHRva2VuIHN0b3JlIHR5cGVzLCBEeW5hbW9EQi1iYWNrZWQgaW1wbGVtZW50YXRpb24sIGVycm9ycywgYW5kIGNyeXB0byBoZWxwZXJzLlxuICovXG5leHBvcnQgdHlwZSB7XG4gIFJlZnJlc2hUb2tlblN0b3JlLFxuICBJc3N1ZVBhcmFtcyxcbiAgSXNzdWVSZXN1bHQsXG4gIFJvdGF0ZVBhcmFtcyxcbiAgUm90YXRlUmVzdWx0LFxuICBSZXZva2VQYXJhbXMsXG4gIFN0b3JlT3B0aW9ucyxcbiAgVG9rZW5SZWNvcmQsXG4gIEVwb2NoU2VjLFxufSBmcm9tICcuL3R5cGVzL2luZGV4JztcblxuZXhwb3J0IHsgRHluYW1vUmVmcmVzaFRva2VuU3RvcmUgfSBmcm9tICcuL3N0b3Jlcy9keW5hbW9kYic7XG5leHBvcnQge1xuICBSZWZyZXNoVG9rZW5FcnJvcixcbiAgUmVmcmVzaFRva2VuRXhwaXJlZEVycm9yLFxuICBSZWZyZXNoVG9rZW5JbnZhbGlkRXJyb3IsXG4gIFJlZnJlc2hUb2tlblJldXNlZEVycm9yLFxuICBSZWZyZXNoVG9rZW5SZXZva2VkRXJyb3IsXG4gIFJlZnJlc2hUb2tlblJvdGF0ZUZhaWxlZEVycm9yLFxufSBmcm9tICcuL3N0b3Jlcy9yZWZyZXNoLXRva2VuLWVycm9ycyc7XG5leHBvcnQgeyBzaGEyNTZoZXgsIHJhbmRvbXRva2VuIH0gZnJvbSAnLi91dGlscy9oYXNoJztcbiJdfQ==

package/lib/stores/dynamodb.d.ts

@@ -0,0 +1,65 @@
+import type { RefreshTokenStore, StoreOptions, TokenRecord, IssueParams, RotateParams, RevokeParams, IssueResult, RotateResult } from '../types/index';
+/** Re-exported types for consumers that import the DynamoDB store module. */
+export { RefreshTokenStore, StoreOptions, TokenRecord, IssueParams, RotateParams, RevokeParams, IssueResult, RotateResult };
+/**
+ * {@link RefreshTokenStore} implementation using a single DynamoDB table.
+ *
+ * This class owns the DynamoDB client; callers supply `tableName`, `region`, and optional {@link StoreOptions}.
+ */
+export declare class DynamoRefreshTokenStore implements RefreshTokenStore {
+    private readonly tableName;
+    private readonly region;
+    private readonly options?;
+    /** Lazily initialized and cached document client. */
+    private ddb;
+    /** Random byte length for generated refresh tokens (default 32 → 256-bit). */
+    private readonly tokenBytes;
+    /**
+     * @param tableName - DynamoDB table name for refresh token items.
+     * @param region - AWS region for the DynamoDB client.
+     * @param options - TTL, PK prefix, consistent reads, or custom endpoint.
+     */
+    constructor(tableName: string, region: string, options?: StoreOptions | undefined);
+    /**
+     * Inserts a new token record. Fails the put if the partition key already exists.
+     *
+     * @param params - Subject, session, and optional clock (`now`).
+     * @returns Plaintext refresh token and expiration as Unix seconds.
+     */
+    issue: (params: IssueParams) => Promise<IssueResult>;
+    /**
+     * Marks the current token as rotated and creates the successor row in one transaction.
+     *
+     * @param params - Client refresh token and optional clock (`now`).
+     * @returns Subject, session, new plaintext token, and new expiration.
+     * @throws {@link RefreshTokenInvalidError} When the token format is invalid or no row exists.
+     * @throws {@link RefreshTokenExpiredError} When `expiresAt` is not after `now`.
+     * @throws {@link RefreshTokenRevokedError} When the token row has `revokedAt` set.
+     * @throws {@link RefreshTokenReusedError} When the token was already rotated or the transaction indicates reuse.
+     */
+    rotate: (params: RotateParams) => Promise<RotateResult>;
+    /**
+     * Sets `revokedAt` on the token row. Missing items succeed (idempotent revoke).
+     *
+     * @param params - Refresh token and optional clock (`now`).
+     * @returns `true` after a successful update or no-op when the item is absent.
+     * @throws {@link RefreshTokenInvalidError} When the token string format is invalid.
+     */
+    revoke: (params: RevokeParams) => Promise<true>;
+    /** Returns the cached client, creating it on first use. */
+    private getddb;
+    /** Loads a token row by partition key, or `null` if absent. */
+    private getTokenRecord;
+    /** Effective PK prefix from options or {@link DEFAULT_PRIMARY_KEY_PREFIX}. */
+    private getPrimaryKeyPrefix;
+    /** Full partition key: prefix + SHA-256 hex of the raw token. */
+    private getPrimaryKey;
+    /** Expiration timestamp: `nowSec` plus TTL from options (default 60 days). */
+    private makeExpiresAt;
+    /**
+     * Ensures the token is non-empty and matches the expected base64url length for `tokenBytes` (32 bytes → URL-safe base64 length).
+     *
+     * @throws {@link RefreshTokenInvalidError} When validation fails.
+     */
+    private validateRefreshToken;
+}

package/lib/stores/dynamodb.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DynamoRefreshTokenStore = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const lib_dynamodb_1 = require("@aws-sdk/lib-dynamodb");
+const refresh_token_errors_1 = require("./refresh-token-errors");
+const hash_1 = require("../utils/hash");
+const time_1 = require("../utils/time");
+/** Default partition key prefix for refresh token items. */
+const DEFAULT_PRIMARY_KEY_PREFIX = 'rt#';
+/**
+ * {@link RefreshTokenStore} implementation using a single DynamoDB table.
+ *
+ * This class owns the DynamoDB client; callers supply `tableName`, `region`, and optional {@link StoreOptions}.
+ */
+class DynamoRefreshTokenStore {
+    /**
+     * @param tableName - DynamoDB table name for refresh token items.
+     * @param region - AWS region for the DynamoDB client.
+     * @param options - TTL, PK prefix, consistent reads, or custom endpoint.
+     */
+    constructor(tableName, region, options) {
+        this.tableName = tableName;
+        this.region = region;
+        this.options = options;
+        /** Lazily initialized and cached document client. */
+        this.ddb = null;
+        /** Random byte length for generated refresh tokens (default 32 → 256-bit). */
+        this.tokenBytes = 32;
+        /**
+         * Inserts a new token record. Fails the put if the partition key already exists.
+         *
+         * @param params - Subject, session, and optional clock (`now`).
+         * @returns Plaintext refresh token and expiration as Unix seconds.
+         */
+        this.issue = async (params) => {
+            const ddb = this.getddb();
+            const now = params.now ?? new Date();
+            const nowSec = (0, time_1.epochsec)(now);
+            const expiresAt = this.makeExpiresAt(nowSec);
+            const refreshToken = (0, hash_1.randomtoken)(this.tokenBytes);
+            const hash = (0, hash_1.sha256hex)(refreshToken);
+            const pk = this.getPrimaryKey(hash);
+            await ddb.send(new lib_dynamodb_1.PutCommand({
+                TableName: this.tableName,
+                Item: {
+                    pk,
+                    subjectId: params.subjectId,
+                    sessionId: params.sessionId,
+                    createdAt: nowSec,
+                    expiresAt,
+                },
+                ConditionExpression: 'attribute_not_exists(pk)',
+            }));
+            return {
+                refreshToken,
+                refreshTokenExpiresAt: expiresAt,
+            };
+        };
+        /**
+         * Marks the current token as rotated and creates the successor row in one transaction.
+         *
+         * @param params - Client refresh token and optional clock (`now`).
+         * @returns Subject, session, new plaintext token, and new expiration.
+         * @throws {@link RefreshTokenInvalidError} When the token format is invalid or no row exists.
+         * @throws {@link RefreshTokenExpiredError} When `expiresAt` is not after `now`.
+         * @throws {@link RefreshTokenRevokedError} When the token row has `revokedAt` set.
+         * @throws {@link RefreshTokenReusedError} When the token was already rotated or the transaction indicates reuse.
+         */
+        this.rotate = async (params) => {
+            // validate refresh token
+            this.validateRefreshToken(params.refreshToken);
+            const ddb = this.getddb();
+            const now = params.now ?? new Date();
+            const nowSec = (0, time_1.epochsec)(now);
+            const currentHash = (0, hash_1.sha256hex)(params.refreshToken);
+            const currentPk = this.getPrimaryKey(currentHash);
+            const current = await this.getTokenRecord(currentPk);
+            if (!current) {
+                throw new refresh_token_errors_1.RefreshTokenInvalidError();
+            }
+            if (current.expiresAt <= nowSec) {
+                throw new refresh_token_errors_1.RefreshTokenExpiredError();
+            }
+            if (current.revokedAt) {
+                throw new refresh_token_errors_1.RefreshTokenRevokedError();
+            }
+            if (current.rotatedAt) {
+                throw new refresh_token_errors_1.RefreshTokenReusedError();
+            }
+            const nextRefreshTokenExpiresAt = this.makeExpiresAt(nowSec);
+            const nextRefreshToken = (0, hash_1.randomtoken)(this.tokenBytes);
+            const nextHash = (0, hash_1.sha256hex)(nextRefreshToken);
+            const nextPk = this.getPrimaryKey(nextHash);
+            try {
+                await ddb.send(new lib_dynamodb_1.TransactWriteCommand({
+                    TransactItems: [
+                        {
+                            Update: {
+                                TableName: this.tableName,
+                                Key: { pk: currentPk },
+                                UpdateExpression: 'SET rotatedAt = :now, replacedByPk = :nextPk',
+                                ConditionExpression: 'attribute_exists(pk) AND attribute_not_exists(rotatedAt) AND attribute_not_exists(revokedAt)',
+                                ExpressionAttributeValues: {
+                                    ':now': nowSec,
+                                    ':nextPk': nextPk,
+                                },
+                            },
+                        },
+                        {
+                            Put: {
+                                TableName: this.tableName,
+                                Item: {
+                                    pk: nextPk,
+                                    subjectId: current.subjectId,
+                                    sessionId: current.sessionId,
+                                    createdAt: nowSec,
+                                    expiresAt: nextRefreshTokenExpiresAt,
+                                },
+                                ConditionExpression: 'attribute_not_exists(pk)',
+                            },
+                        },
+                    ],
+                }));
+            }
+            catch (error) {
+                if (error instanceof Error && error.name === 'TransactionCanceledException') {
+                    // Treat conditional transaction failure as token reuse.
+                    throw new refresh_token_errors_1.RefreshTokenReusedError();
+                }
+                throw error;
+            }
+            return {
+                subjectId: current.subjectId,
+                sessionId: current.sessionId,
+                refreshToken: nextRefreshToken,
+                refreshTokenExpiresAt: nextRefreshTokenExpiresAt,
+            };
+        };
+        /**
+         * Sets `revokedAt` on the token row. Missing items succeed (idempotent revoke).
+         *
+         * @param params - Refresh token and optional clock (`now`).
+         * @returns `true` after a successful update or no-op when the item is absent.
+         * @throws {@link RefreshTokenInvalidError} When the token string format is invalid.
+         */
+        this.revoke = async (params) => {
+            // validate refresh token
+            this.validateRefreshToken(params.refreshToken);
+            const ddb = this.getddb();
+            const now = params.now ?? new Date();
+            const nowSec = (0, time_1.epochsec)(now);
+            const hash = (0, hash_1.sha256hex)(params.refreshToken);
+            const pk = this.getPrimaryKey(hash);
+            try {
+                await ddb.send(new lib_dynamodb_1.UpdateCommand({
+                    TableName: this.tableName,
+                    Key: { pk },
+                    UpdateExpression: 'SET revokedAt = :now',
+                    ConditionExpression: 'attribute_exists(pk)',
+                    ExpressionAttributeValues: {
+                        ':now': nowSec,
+                    },
+                }));
+            }
+            catch (error) {
+                // Missing item: treat as success (idempotent revoke).
+                if (error instanceof Error && error.name === 'ConditionalCheckFailedException') {
+                    return true;
+                }
+                throw error;
+            }
+            return true;
+        };
+        /** Returns the cached client, creating it on first use. */
+        this.getddb = () => {
+            if (!this.ddb) {
+                const client = new client_dynamodb_1.DynamoDBClient({
+                    region: this.region,
+                    endpoint: (() => {
+                        if (this.options?.endpoint) {
+                            return this.options.endpoint;
+                        }
+                        return `https://dynamodb.${this.region}.amazonaws.com`;
+                    })(),
+                });
+                this.ddb = lib_dynamodb_1.DynamoDBDocumentClient.from(client);
+            }
+            return this.ddb;
+        };
+        /** Loads a token row by partition key, or `null` if absent. */
+        this.getTokenRecord = async (pk) => {
+            const ddb = this.getddb();
+            const res = await ddb.send(new lib_dynamodb_1.GetCommand({
+                TableName: this.tableName,
+                Key: { pk },
+                ConsistentRead: this.options?.consistentRead ?? true,
+            }));
+            return res.Item ?? null;
+        };
+        /** Effective PK prefix from options or {@link DEFAULT_PRIMARY_KEY_PREFIX}. */
+        this.getPrimaryKeyPrefix = () => {
+            return `${this.options?.pkPrefix ?? DEFAULT_PRIMARY_KEY_PREFIX}`;
+        };
+        /** Full partition key: prefix + SHA-256 hex of the raw token. */
+        this.getPrimaryKey = (hash) => {
+            return `${this.getPrimaryKeyPrefix()}${hash}`;
+        };
+        /** Expiration timestamp: `nowSec` plus TTL from options (default 60 days). */
+        this.makeExpiresAt = (nowSec) => {
+            return nowSec + (this.options?.ttlDays ?? 60) * 24 * 60 * 60;
+        };
+    }
+    /**
+     * Ensures the token is non-empty and matches the expected base64url length for `tokenBytes` (32 bytes → URL-safe base64 length).
+     *
+     * @throws {@link RefreshTokenInvalidError} When validation fails.
+     */
+    validateRefreshToken(token) {
+        if (!token || token.length !== Math.ceil(this.tokenBytes * 8 / 6)) {
+            throw new refresh_token_errors_1.RefreshTokenInvalidError();
+        }
+    }
+}
+exports.DynamoRefreshTokenStore = DynamoRefreshTokenStore;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZHluYW1vZGIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc3RvcmVzL2R5bmFtb2RiLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDhEQUEwRDtBQUMxRCx3REFBNEg7QUFFNUgsaUVBS2dDO0FBRWhDLHdDQUF1RDtBQUN2RCx3Q0FBeUM7QUFLekMsNERBQTREO0FBQzVELE1BQU0sMEJBQTBCLEdBQUcsS0FBSyxDQUFDO0FBRXpDOzs7O0dBSUc7QUFDSCxNQUFhLHVCQUF1QjtJQU9sQzs7OztPQUlHO0lBQ0gsWUFDbUIsU0FBaUIsRUFDakIsTUFBYyxFQUNkLE9BQXNCO1FBRnRCLGNBQVMsR0FBVCxTQUFTLENBQVE7UUFDakIsV0FBTSxHQUFOLE1BQU0sQ0FBUTtRQUNkLFlBQU8sR0FBUCxPQUFPLENBQWU7UUFkekMscURBQXFEO1FBQzdDLFFBQUcsR0FBa0MsSUFBSSxDQUFDO1FBRWxELDhFQUE4RTtRQUM3RCxlQUFVLEdBQUcsRUFBRSxDQUFDO1FBYWpDOzs7OztXQUtHO1FBQ0ksVUFBSyxHQUFHLEtBQUssRUFBRSxNQUFtQixFQUF3QixFQUFFO1lBQ2pFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUUxQixNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsR0FBRyxJQUFJLElBQUksSUFBSSxFQUFFLENBQUM7WUFDckMsTUFBTSxNQUFNLEdBQUcsSUFBQSxlQUFRLEVBQUMsR0FBRyxDQUFDLENBQUM7WUFDN0IsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUU3QyxNQUFNLFlBQVksR0FBRyxJQUFBLGtCQUFXLEVBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2xELE1BQU0sSUFBSSxHQUFHLElBQUEsZ0JBQVMsRUFBQyxZQUFZLENBQUMsQ0FBQztZQUNyQyxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBRXBDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FDWixJQUFJLHlCQUFVLENBQUM7Z0JBQ2IsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2dCQUN6QixJQUFJLEVBQUU7b0JBQ0osRUFBRTtvQkFDRixTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7b0JBQzNCLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUztvQkFDM0IsU0FBUyxFQUFFLE1BQU07b0JBQ2pCLFNBQVM7aUJBQ1Y7Z0JBQ0QsbUJBQW1CLEVBQUUsMEJBQTBCO2FBQ2hELENBQUMsQ0FDSCxDQUFDO1lBRUYsT0FBTztnQkFDTCxZQUFZO2dCQUNaLHFCQUFxQixFQUFFLFNBQVM7YUFDakMsQ0FBQztRQUNKLENBQUMsQ0FBQztRQUVGOzs7Ozs7Ozs7V0FTRztRQUNJLFdBQU0sR0FBRyxLQUFLLEVBQUUsTUFBb0IsRUFBeUIsRUFBRTtZQUNwRSx5QkFBeUI7WUFDekIsSUFBSSxDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUUvQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFFMUIsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLEdBQUcsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3JDLE1BQU0sTUFBTSxHQUFHLElBQUEsZUFBUSxFQUFDLEdBQUcsQ0FBQyxDQUFDO1lBRTdCLE1BQU0sV0FBVyxHQUFHLElBQUEsZ0JBQVMsRUFBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDbkQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUVsRCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDckQsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNiLE1BQU0sSUFBSSwrQ0FBd0IsRUFBRSxDQUFDO1lBQ3ZDLENBQUM7WUFDRCxJQUFJLE9BQU8sQ0FBQyxTQUFTLElBQUksTUFBTSxFQUFFLENBQUM7Z0JBQ2hDLE1BQU0sSUFBSSwrQ0FBd0IsRUFBRSxDQUFDO1lBQ3ZDLENBQUM7WUFDRCxJQUFJLE9BQU8sQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDdEIsTUFBTSxJQUFJLCtDQUF3QixFQUFFLENBQUM7WUFDdkMsQ0FBQztZQUNELElBQUksT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDO2dCQUN0QixNQUFNLElBQUksOENBQXVCLEVBQUUsQ0FBQztZQUN0QyxDQUFDO1lBRUQsTUFBTSx5QkFBeUIsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzdELE1BQU0sZ0JBQWdCLEdBQUcsSUFBQSxrQkFBVyxFQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUN0RCxNQUFNLFFBQVEsR0FBRyxJQUFBLGdCQUFTLEVBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUM3QyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBRTVDLElBQUksQ0FBQztnQkFDSCxNQUFNLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxtQ0FBb0IsQ0FBQztvQkFDdEMsYUFBYSxFQUFFO3dCQUNiOzRCQUNFLE1BQU0sRUFBRTtnQ0FDTixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7Z0NBQ3pCLEdBQUcsRUFBRSxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUU7Z0NBQ3RCLGdCQUFnQixFQUFFLDhDQUE4QztnQ0FDaEUsbUJBQW1CLEVBQUUsOEZBQThGO2dDQUNuSCx5QkFBeUIsRUFBRTtvQ0FDekIsTUFBTSxFQUFFLE1BQU07b0NBQ2QsU0FBUyxFQUFFLE1BQU07aUNBQ2xCOzZCQUNGO3lCQUNGO3dCQUNEOzRCQUNFLEdBQUcsRUFBRTtnQ0FDSCxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7Z0NBQ3pCLElBQUksRUFBRTtvQ0FDSixFQUFFLEVBQUUsTUFBTTtvQ0FDVixTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7b0NBQzVCLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztvQ0FDNUIsU0FBUyxFQUFFLE1BQU07b0NBQ2pCLFNBQVMsRUFBRSx5QkFBeUI7aUNBQ3JDO2dDQUNELG1CQUFtQixFQUFFLDBCQUEwQjs2QkFDaEQ7eUJBQ0Y7cUJBQ0Y7aUJBQ0YsQ0FBQyxDQUFDLENBQUM7WUFFTixDQUFDO1lBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztnQkFDeEIsSUFBSSxLQUFLLFlBQVksS0FBSyxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssOEJBQThCLEVBQUUsQ0FBQztvQkFDNUUsd0RBQXdEO29CQUN4RCxNQUFNLElBQUksOENBQXVCLEVBQUUsQ0FBQztnQkFDdEMsQ0FBQztnQkFDRCxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7WUFFRCxPQUFPO2dCQUNMLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztnQkFDNUIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO2dCQUM1QixZQUFZLEVBQUUsZ0JBQWdCO2dCQUM5QixxQkFBcUIsRUFBRSx5QkFBeUI7YUFDakQsQ0FBQztRQUNKLENBQUMsQ0FBQztRQUVGOzs7Ozs7V0FNRztRQUNJLFdBQU0sR0FBRyxLQUFLLEVBQUUsTUFBb0IsRUFBaUIsRUFBRTtZQUM1RCx5QkFBeUI7WUFDekIsSUFBSSxDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUUvQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFFMUIsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLEdBQUcsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3JDLE1BQU0sTUFBTSxHQUFHLElBQUEsZUFBUSxFQUFDLEdBQUcsQ0FBQyxDQUFDO1lBRTdCLE1BQU0sSUFBSSxHQUFHLElBQUEsZ0JBQVMsRUFBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDNUMsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUVwQyxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUNaLElBQUksNEJBQWEsQ0FBQztvQkFDaEIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO29CQUN6QixHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUU7b0JBQ1gsZ0JBQWdCLEVBQUUsc0JBQXNCO29CQUN4QyxtQkFBbUIsRUFBRSxzQkFBc0I7b0JBQzNDLHlCQUF5QixFQUFFO3dCQUN6QixNQUFNLEVBQUUsTUFBTTtxQkFDZjtpQkFDRixDQUFDLENBQ0gsQ0FBQztZQUNKLENBQUM7WUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO2dCQUN4QixzREFBc0Q7Z0JBQ3RELElBQUksS0FBSyxZQUFZLEtBQUssSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGlDQUFpQyxFQUFFLENBQUM7b0JBQy9FLE9BQU8sSUFBSSxDQUFDO2dCQUNkLENBQUM7Z0JBQ0QsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDLENBQUM7UUFFRiwyREFBMkQ7UUFDbkQsV0FBTSxHQUFHLEdBQTJCLEVBQUU7WUFDNUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztnQkFDZCxNQUFNLE1BQU0sR0FBRyxJQUFJLGdDQUFjLENBQUM7b0JBQ2hDLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtvQkFDbkIsUUFBUSxFQUFFLENBQUMsR0FBRyxFQUFFO3dCQUNkLElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQzs0QkFDM0IsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQzt3QkFDL0IsQ0FBQzt3QkFDRCxPQUFPLG9CQUFvQixJQUFJLENBQUMsTUFBTSxnQkFBZ0IsQ0FBQztvQkFDekQsQ0FBQyxDQUFDLEVBQUU7aUJBQ0wsQ0FBQyxDQUFDO2dCQUNILElBQUksQ0FBQyxHQUFHLEdBQUcscUNBQXNCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ2pELENBQUM7WUFDRCxPQUFPLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDbEIsQ0FBQyxDQUFDO1FBRUYsK0RBQStEO1FBQ3ZELG1CQUFjLEdBQUcsS0FBSyxFQUFFLEVBQVUsRUFBK0IsRUFBRTtZQUN6RSxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFFMUIsTUFBTSxHQUFHLEdBQUcsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUN4QixJQUFJLHlCQUFVLENBQUM7Z0JBQ2IsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2dCQUN6QixHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUU7Z0JBQ1gsY0FBYyxFQUFFLElBQUksQ0FBQyxPQUFPLEVBQUUsY0FBYyxJQUFJLElBQUk7YUFDckQsQ0FBQyxDQUNILENBQUM7WUFDRixPQUFRLEdBQUcsQ0FBQyxJQUFvQixJQUFJLElBQUksQ0FBQztRQUMzQyxDQUFDLENBQUM7UUFFRiw4RUFBOEU7UUFDdEUsd0JBQW1CLEdBQUcsR0FBVyxFQUFFO1lBQ3pDLE9BQU8sR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLFFBQVEsSUFBSSwwQkFBMEIsRUFBRSxDQUFDO1FBQ25FLENBQUMsQ0FBQztRQUVGLGlFQUFpRTtRQUN6RCxrQkFBYSxHQUFHLENBQUMsSUFBWSxFQUFVLEVBQUU7WUFDL0MsT0FBTyxHQUFHLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxHQUFHLElBQUksRUFBRSxDQUFDO1FBQ2hELENBQUMsQ0FBQztRQUVGLDhFQUE4RTtRQUN0RSxrQkFBYSxHQUFHLENBQUMsTUFBYyxFQUFVLEVBQUU7WUFDakQsT0FBTyxNQUFNLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE9BQU8sSUFBSSxFQUFFLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQztRQUMvRCxDQUFDLENBQUM7SUFwTkMsQ0FBQztJQXNOSjs7OztPQUlHO0lBQ0ssb0JBQW9CLENBQUMsS0FBYTtRQUN4QyxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sSUFBSSwrQ0FBd0IsRUFBRSxDQUFDO1FBQ3ZDLENBQUM7SUFDSCxDQUFDO0NBRUY7QUFqUEQsMERBaVBDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgRHluYW1vREJDbGllbnQgfSBmcm9tICdAYXdzLXNkay9jbGllbnQtZHluYW1vZGInO1xuaW1wb3J0IHsgRHluYW1vREJEb2N1bWVudENsaWVudCwgR2V0Q29tbWFuZCwgUHV0Q29tbWFuZCwgVXBkYXRlQ29tbWFuZCwgVHJhbnNhY3RXcml0ZUNvbW1hbmQgfSBmcm9tICdAYXdzLXNkay9saWItZHluYW1vZGInO1xuXG5pbXBvcnQge1xuICBSZWZyZXNoVG9rZW5FeHBpcmVkRXJyb3IsXG4gIFJlZnJlc2hUb2tlbkludmFsaWRFcnJvcixcbiAgUmVmcmVzaFRva2VuUmV1c2VkRXJyb3IsXG4gIFJlZnJlc2hUb2tlblJldm9rZWRFcnJvcixcbn0gZnJvbSAnLi9yZWZyZXNoLXRva2VuLWVycm9ycyc7XG5pbXBvcnQgdHlwZSB7IFJlZnJlc2hUb2tlblN0b3JlLCBTdG9yZU9wdGlvbnMsIFRva2VuUmVjb3JkLCBJc3N1ZVBhcmFtcywgUm90YXRlUGFyYW1zLCBSZXZva2VQYXJhbXMsIElzc3VlUmVzdWx0LCBSb3RhdGVSZXN1bHQgfSBmcm9tICcuLi90eXBlcy9pbmRleCc7XG5pbXBvcnQgeyByYW5kb210b2tlbiwgc2hhMjU2aGV4IH0gZnJvbSAnLi4vdXRpbHMvaGFzaCc7XG5pbXBvcnQgeyBlcG9jaHNlYyB9IGZyb20gJy4uL3V0aWxzL3RpbWUnO1xuXG4vKiogUmUtZXhwb3J0ZWQgdHlwZXMgZm9yIGNvbnN1bWVycyB0aGF0IGltcG9ydCB0aGUgRHluYW1vREIgc3RvcmUgbW9kdWxlLiAqL1xuZXhwb3J0IHsgUmVmcmVzaFRva2VuU3RvcmUsIFN0b3JlT3B0aW9ucywgVG9rZW5SZWNvcmQsIElzc3VlUGFyYW1zLCBSb3RhdGVQYXJhbXMsIFJldm9rZVBhcmFtcywgSXNzdWVSZXN1bHQsIFJvdGF0ZVJlc3VsdCB9O1xuXG4vKiogRGVmYXVsdCBwYXJ0aXRpb24ga2V5IHByZWZpeCBmb3IgcmVmcmVzaCB0b2tlbiBpdGVtcy4gKi9cbmNvbnN0IERFRkFVTFRfUFJJTUFSWV9LRVlfUFJFRklYID0gJ3J0Iyc7XG5cbi8qKlxuICoge0BsaW5rIFJlZnJlc2hUb2tlblN0b3JlfSBpbXBsZW1lbnRhdGlvbiB1c2luZyBhIHNpbmdsZSBEeW5hbW9EQiB0YWJsZS5cbiAqXG4gKiBUaGlzIGNsYXNzIG93bnMgdGhlIER5bmFtb0RCIGNsaWVudDsgY2FsbGVycyBzdXBwbHkgYHRhYmxlTmFtZWAsIGByZWdpb25gLCBhbmQgb3B0aW9uYWwge0BsaW5rIFN0b3JlT3B0aW9uc30uXG4gKi9cbmV4cG9ydCBjbGFzcyBEeW5hbW9SZWZyZXNoVG9rZW5TdG9yZSBpbXBsZW1lbnRzIFJlZnJlc2hUb2tlblN0b3JlIHtcbiAgLyoqIExhemlseSBpbml0aWFsaXplZCBhbmQgY2FjaGVkIGRvY3VtZW50IGNsaWVudC4gKi9cbiAgcHJpdmF0ZSBkZGI6IER5bmFtb0RCRG9jdW1lbnRDbGllbnQgfCBudWxsID0gbnVsbDtcblxuICAvKiogUmFuZG9tIGJ5dGUgbGVuZ3RoIGZvciBnZW5lcmF0ZWQgcmVmcmVzaCB0b2tlbnMgKGRlZmF1bHQgMzIg4oaSIDI1Ni1iaXQpLiAqL1xuICBwcml2YXRlIHJlYWRvbmx5IHRva2VuQnl0ZXMgPSAzMjtcblxuICAvKipcbiAgICogQHBhcmFtIHRhYmxlTmFtZSAtIER5bmFtb0RCIHRhYmxlIG5hbWUgZm9yIHJlZnJlc2ggdG9rZW4gaXRlbXMuXG4gICAqIEBwYXJhbSByZWdpb24gLSBBV1MgcmVnaW9uIGZvciB0aGUgRHluYW1vREIgY2xpZW50LlxuICAgKiBAcGFyYW0gb3B0aW9ucyAtIFRUTCwgUEsgcHJlZml4LCBjb25zaXN0ZW50IHJlYWRzLCBvciBjdXN0b20gZW5kcG9pbnQuXG4gICAqL1xuICBjb25zdHJ1Y3RvcihcbiAgICBwcml2YXRlIHJlYWRvbmx5IHRhYmxlTmFtZTogc3RyaW5nLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcmVnaW9uOiBzdHJpbmcsXG4gICAgcHJpdmF0ZSByZWFkb25seSBvcHRpb25zPzogU3RvcmVPcHRpb25zLFxuICApIHt9XG5cbiAgLyoqXG4gICAqIEluc2VydHMgYSBuZXcgdG9rZW4gcmVjb3JkLiBGYWlscyB0aGUgcHV0IGlmIHRoZSBwYXJ0aXRpb24ga2V5IGFscmVhZHkgZXhpc3RzLlxuICAgKlxuICAgKiBAcGFyYW0gcGFyYW1zIC0gU3ViamVjdCwgc2Vzc2lvbiwgYW5kIG9wdGlvbmFsIGNsb2NrIChgbm93YCkuXG4gICAqIEByZXR1cm5zIFBsYWludGV4dCByZWZyZXNoIHRva2VuIGFuZCBleHBpcmF0aW9uIGFzIFVuaXggc2Vjb25kcy5cbiAgICovXG4gIHB1YmxpYyBpc3N1ZSA9IGFzeW5jIChwYXJhbXM6IElzc3VlUGFyYW1zKTogUHJvbWlzZTxJc3N1ZVJlc3VsdD4gPT4ge1xuICAgIGNvbnN0IGRkYiA9IHRoaXMuZ2V0ZGRiKCk7XG5cbiAgICBjb25zdCBub3cgPSBwYXJhbXMubm93ID8/IG5ldyBEYXRlKCk7XG4gICAgY29uc3Qgbm93U2VjID0gZXBvY2hzZWMobm93KTtcbiAgICBjb25zdCBleHBpcmVzQXQgPSB0aGlzLm1ha2VFeHBpcmVzQXQobm93U2VjKTtcblxuICAgIGNvbnN0IHJlZnJlc2hUb2tlbiA9IHJhbmRvbXRva2VuKHRoaXMudG9rZW5CeXRlcyk7XG4gICAgY29uc3QgaGFzaCA9IHNoYTI1NmhleChyZWZyZXNoVG9rZW4pO1xuICAgIGNvbnN0IHBrID0gdGhpcy5nZXRQcmltYXJ5S2V5KGhhc2gpO1xuXG4gICAgYXdhaXQgZGRiLnNlbmQoXG4gICAgICBuZXcgUHV0Q29tbWFuZCh7XG4gICAgICAgIFRhYmxlTmFtZTogdGhpcy50YWJsZU5hbWUsXG4gICAgICAgIEl0ZW06IHtcbiAgICAgICAgICBwayxcbiAgICAgICAgICBzdWJqZWN0SWQ6IHBhcmFtcy5zdWJqZWN0SWQsXG4gICAgICAgICAgc2Vzc2lvbklkOiBwYXJhbXMuc2Vzc2lvbklkLFxuICAgICAgICAgIGNyZWF0ZWRBdDogbm93U2VjLFxuICAgICAgICAgIGV4cGlyZXNBdCxcbiAgICAgICAgfSxcbiAgICAgICAgQ29uZGl0aW9uRXhwcmVzc2lvbjogJ2F0dHJpYnV0ZV9ub3RfZXhpc3RzKHBrKScsXG4gICAgICB9KSxcbiAgICApO1xuXG4gICAgcmV0dXJuIHtcbiAgICAgIHJlZnJlc2hUb2tlbixcbiAgICAgIHJlZnJlc2hUb2tlbkV4cGlyZXNBdDogZXhwaXJlc0F0LFxuICAgIH07XG4gIH07XG5cbiAgLyoqXG4gICAqIE1hcmtzIHRoZSBjdXJyZW50IHRva2VuIGFzIHJvdGF0ZWQgYW5kIGNyZWF0ZXMgdGhlIHN1Y2Nlc3NvciByb3cgaW4gb25lIHRyYW5zYWN0aW9uLlxuICAgKlxuICAgKiBAcGFyYW0gcGFyYW1zIC0gQ2xpZW50IHJlZnJlc2ggdG9rZW4gYW5kIG9wdGlvbmFsIGNsb2NrIChgbm93YCkuXG4gICAqIEByZXR1cm5zIFN1YmplY3QsIHNlc3Npb24sIG5ldyBwbGFpbnRleHQgdG9rZW4sIGFuZCBuZXcgZXhwaXJhdGlvbi5cbiAgICogQHRocm93cyB7QGxpbmsgUmVmcmVzaFRva2VuSW52YWxpZEVycm9yfSBXaGVuIHRoZSB0b2tlbiBmb3JtYXQgaXMgaW52YWxpZCBvciBubyByb3cgZXhpc3RzLlxuICAgKiBAdGhyb3dzIHtAbGluayBSZWZyZXNoVG9rZW5FeHBpcmVkRXJyb3J9IFdoZW4gYGV4cGlyZXNBdGAgaXMgbm90IGFmdGVyIGBub3dgLlxuICAgKiBAdGhyb3dzIHtAbGluayBSZWZyZXNoVG9rZW5SZXZva2VkRXJyb3J9IFdoZW4gdGhlIHRva2VuIHJvdyBoYXMgYHJldm9rZWRBdGAgc2V0LlxuICAgKiBAdGhyb3dzIHtAbGluayBSZWZyZXNoVG9rZW5SZXVzZWRFcnJvcn0gV2hlbiB0aGUgdG9rZW4gd2FzIGFscmVhZHkgcm90YXRlZCBvciB0aGUgdHJhbnNhY3Rpb24gaW5kaWNhdGVzIHJldXNlLlxuICAgKi9cbiAgcHVibGljIHJvdGF0ZSA9IGFzeW5jIChwYXJhbXM6IFJvdGF0ZVBhcmFtcyk6IFByb21pc2U8Um90YXRlUmVzdWx0PiA9PiB7XG4gICAgLy8gdmFsaWRhdGUgcmVmcmVzaCB0b2tlblxuICAgIHRoaXMudmFsaWRhdGVSZWZyZXNoVG9rZW4ocGFyYW1zLnJlZnJlc2hUb2tlbik7XG5cbiAgICBjb25zdCBkZGIgPSB0aGlzLmdldGRkYigpO1xuXG4gICAgY29uc3Qgbm93ID0gcGFyYW1zLm5vdyA/PyBuZXcgRGF0ZSgpO1xuICAgIGNvbnN0IG5vd1NlYyA9IGVwb2Noc2VjKG5vdyk7XG5cbiAgICBjb25zdCBjdXJyZW50SGFzaCA9IHNoYTI1NmhleChwYXJhbXMucmVmcmVzaFRva2VuKTtcbiAgICBjb25zdCBjdXJyZW50UGsgPSB0aGlzLmdldFByaW1hcnlLZXkoY3VycmVudEhhc2gpO1xuXG4gICAgY29uc3QgY3VycmVudCA9IGF3YWl0IHRoaXMuZ2V0VG9rZW5SZWNvcmQoY3VycmVudFBrKTtcbiAgICBpZiAoIWN1cnJlbnQpIHtcbiAgICAgIHRocm93IG5ldyBSZWZyZXNoVG9rZW5JbnZhbGlkRXJyb3IoKTtcbiAgICB9XG4gICAgaWYgKGN1cnJlbnQuZXhwaXJlc0F0IDw9IG5vd1NlYykge1xuICAgICAgdGhyb3cgbmV3IFJlZnJlc2hUb2tlbkV4cGlyZWRFcnJvcigpO1xuICAgIH1cbiAgICBpZiAoY3VycmVudC5yZXZva2VkQXQpIHtcbiAgICAgIHRocm93IG5ldyBSZWZyZXNoVG9rZW5SZXZva2VkRXJyb3IoKTtcbiAgICB9XG4gICAgaWYgKGN1cnJlbnQucm90YXRlZEF0KSB7XG4gICAgICB0aHJvdyBuZXcgUmVmcmVzaFRva2VuUmV1c2VkRXJyb3IoKTtcbiAgICB9XG5cbiAgICBjb25zdCBuZXh0UmVmcmVzaFRva2VuRXhwaXJlc0F0ID0gdGhpcy5tYWtlRXhwaXJlc0F0KG5vd1NlYyk7XG4gICAgY29uc3QgbmV4dFJlZnJlc2hUb2tlbiA9IHJhbmRvbXRva2VuKHRoaXMudG9rZW5CeXRlcyk7XG4gICAgY29uc3QgbmV4dEhhc2ggPSBzaGEyNTZoZXgobmV4dFJlZnJlc2hUb2tlbik7XG4gICAgY29uc3QgbmV4dFBrID0gdGhpcy5nZXRQcmltYXJ5S2V5KG5leHRIYXNoKTtcblxuICAgIHRyeSB7XG4gICAgICBhd2FpdCBkZGIuc2VuZChuZXcgVHJhbnNhY3RXcml0ZUNvbW1hbmQoe1xuICAgICAgICBUcmFuc2FjdEl0ZW1zOiBbXG4gICAgICAgICAge1xuICAgICAgICAgICAgVXBkYXRlOiB7XG4gICAgICAgICAgICAgIFRhYmxlTmFtZTogdGhpcy50YWJsZU5hbWUsXG4gICAgICAgICAgICAgIEtleTogeyBwazogY3VycmVudFBrIH0sXG4gICAgICAgICAgICAgIFVwZGF0ZUV4cHJlc3Npb246ICdTRVQgcm90YXRlZEF0ID0gOm5vdywgcmVwbGFjZWRCeVBrID0gOm5leHRQaycsXG4gICAgICAgICAgICAgIENvbmRpdGlvbkV4cHJlc3Npb246ICdhdHRyaWJ1dGVfZXhpc3RzKHBrKSBBTkQgYXR0cmlidXRlX25vdF9leGlzdHMocm90YXRlZEF0KSBBTkQgYXR0cmlidXRlX25vdF9leGlzdHMocmV2b2tlZEF0KScsXG4gICAgICAgICAgICAgIEV4cHJlc3Npb25BdHRyaWJ1dGVWYWx1ZXM6IHtcbiAgICAgICAgICAgICAgICAnOm5vdyc6IG5vd1NlYyxcbiAgICAgICAgICAgICAgICAnOm5leHRQayc6IG5leHRQayxcbiAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICB7XG4gICAgICAgICAgICBQdXQ6IHtcbiAgICAgICAgICAgICAgVGFibGVOYW1lOiB0aGlzLnRhYmxlTmFtZSxcbiAgICAgICAgICAgICAgSXRlbToge1xuICAgICAgICAgICAgICAgIHBrOiBuZXh0UGssXG4gICAgICAgICAgICAgICAgc3ViamVjdElkOiBjdXJyZW50LnN1YmplY3RJZCxcbiAgICAgICAgICAgICAgICBzZXNzaW9uSWQ6IGN1cnJlbnQuc2Vzc2lvbklkLFxuICAgICAgICAgICAgICAgIGNyZWF0ZWRBdDogbm93U2VjLFxuICAgICAgICAgICAgICAgIGV4cGlyZXNBdDogbmV4dFJlZnJlc2hUb2tlbkV4cGlyZXNBdCxcbiAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgQ29uZGl0aW9uRXhwcmVzc2lvbjogJ2F0dHJpYnV0ZV9ub3RfZXhpc3RzKHBrKScsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICB9IGNhdGNoIChlcnJvcjogdW5rbm93bikge1xuICAgICAgaWYgKGVycm9yIGluc3RhbmNlb2YgRXJyb3IgJiYgZXJyb3IubmFtZSA9PT0gJ1RyYW5zYWN0aW9uQ2FuY2VsZWRFeGNlcHRpb24nKSB7XG4gICAgICAgIC8vIFRyZWF0IGNvbmRpdGlvbmFsIHRyYW5zYWN0aW9uIGZhaWx1cmUgYXMgdG9rZW4gcmV1c2UuXG4gICAgICAgIHRocm93IG5ldyBSZWZyZXNoVG9rZW5SZXVzZWRFcnJvcigpO1xuICAgICAgfVxuICAgICAgdGhyb3cgZXJyb3I7XG4gICAgfVxuXG4gICAgcmV0dXJuIHtcbiAgICAgIHN1YmplY3RJZDogY3VycmVudC5zdWJqZWN0SWQsXG4gICAgICBzZXNzaW9uSWQ6IGN1cnJlbnQuc2Vzc2lvbklkLFxuICAgICAgcmVmcmVzaFRva2VuOiBuZXh0UmVmcmVzaFRva2VuLFxuICAgICAgcmVmcmVzaFRva2VuRXhwaXJlc0F0OiBuZXh0UmVmcmVzaFRva2VuRXhwaXJlc0F0LFxuICAgIH07XG4gIH07XG5cbiAgLyoqXG4gICAqIFNldHMgYHJldm9rZWRBdGAgb24gdGhlIHRva2VuIHJvdy4gTWlzc2luZyBpdGVtcyBzdWNjZWVkIChpZGVtcG90ZW50IHJldm9rZSkuXG4gICAqXG4gICAqIEBwYXJhbSBwYXJhbXMgLSBSZWZyZXNoIHRva2VuIGFuZCBvcHRpb25hbCBjbG9jayAoYG5vd2ApLlxuICAgKiBAcmV0dXJucyBgdHJ1ZWAgYWZ0ZXIgYSBzdWNjZXNzZnVsIHVwZGF0ZSBvciBuby1vcCB3aGVuIHRoZSBpdGVtIGlzIGFic2VudC5cbiAgICogQHRocm93cyB7QGxpbmsgUmVmcmVzaFRva2VuSW52YWxpZEVycm9yfSBXaGVuIHRoZSB0b2tlbiBzdHJpbmcgZm9ybWF0IGlzIGludmFsaWQuXG4gICAqL1xuICBwdWJsaWMgcmV2b2tlID0gYXN5bmMgKHBhcmFtczogUmV2b2tlUGFyYW1zKTogUHJvbWlzZTx0cnVlPiA9PiB7XG4gICAgLy8gdmFsaWRhdGUgcmVmcmVzaCB0b2tlblxuICAgIHRoaXMudmFsaWRhdGVSZWZyZXNoVG9rZW4ocGFyYW1zLnJlZnJlc2hUb2tlbik7XG5cbiAgICBjb25zdCBkZGIgPSB0aGlzLmdldGRkYigpO1xuXG4gICAgY29uc3Qgbm93ID0gcGFyYW1zLm5vdyA/PyBuZXcgRGF0ZSgpO1xuICAgIGNvbnN0IG5vd1NlYyA9IGVwb2Noc2VjKG5vdyk7XG5cbiAgICBjb25zdCBoYXNoID0gc2hhMjU2aGV4KHBhcmFtcy5yZWZyZXNoVG9rZW4pO1xuICAgIGNvbnN0IHBrID0gdGhpcy5nZXRQcmltYXJ5S2V5KGhhc2gpO1xuXG4gICAgdHJ5IHtcbiAgICAgIGF3YWl0IGRkYi5zZW5kKFxuICAgICAgICBuZXcgVXBkYXRlQ29tbWFuZCh7XG4gICAgICAgICAgVGFibGVOYW1lOiB0aGlzLnRhYmxlTmFtZSxcbiAgICAgICAgICBLZXk6IHsgcGsgfSxcbiAgICAgICAgICBVcGRhdGVFeHByZXNzaW9uOiAnU0VUIHJldm9rZWRBdCA9IDpub3cnLFxuICAgICAgICAgIENvbmRpdGlvbkV4cHJlc3Npb246ICdhdHRyaWJ1dGVfZXhpc3RzKHBrKScsXG4gICAgICAgICAgRXhwcmVzc2lvbkF0dHJpYnV0ZVZhbHVlczoge1xuICAgICAgICAgICAgJzpub3cnOiBub3dTZWMsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSksXG4gICAgICApO1xuICAgIH0gY2F0Y2ggKGVycm9yOiB1bmtub3duKSB7XG4gICAgICAvLyBNaXNzaW5nIGl0ZW06IHRyZWF0IGFzIHN1Y2Nlc3MgKGlkZW1wb3RlbnQgcmV2b2tlKS5cbiAgICAgIGlmIChlcnJvciBpbnN0YW5jZW9mIEVycm9yICYmIGVycm9yLm5hbWUgPT09ICdDb25kaXRpb25hbENoZWNrRmFpbGVkRXhjZXB0aW9uJykge1xuICAgICAgICByZXR1cm4gdHJ1ZTtcbiAgICAgIH1cbiAgICAgIHRocm93IGVycm9yO1xuICAgIH1cbiAgICByZXR1cm4gdHJ1ZTtcbiAgfTtcblxuICAvKiogUmV0dXJucyB0aGUgY2FjaGVkIGNsaWVudCwgY3JlYXRpbmcgaXQgb24gZmlyc3QgdXNlLiAqL1xuICBwcml2YXRlIGdldGRkYiA9ICgpOiBEeW5hbW9EQkRvY3VtZW50Q2xpZW50ID0+IHtcbiAgICBpZiAoIXRoaXMuZGRiKSB7XG4gICAgICBjb25zdCBjbGllbnQgPSBuZXcgRHluYW1vREJDbGllbnQoe1xuICAgICAgICByZWdpb246IHRoaXMucmVnaW9uLFxuICAgICAgICBlbmRwb2ludDogKCgpID0+IHtcbiAgICAgICAgICBpZiAodGhpcy5vcHRpb25zPy5lbmRwb2ludCkge1xuICAgICAgICAgICAgcmV0dXJuIHRoaXMub3B0aW9ucy5lbmRwb2ludDtcbiAgICAgICAgICB9XG4gICAgICAgICAgcmV0dXJuIGBodHRwczovL2R5bmFtb2RiLiR7dGhpcy5yZWdpb259LmFtYXpvbmF3cy5jb21gO1xuICAgICAgICB9KSgpLFxuICAgICAgfSk7XG4gICAgICB0aGlzLmRkYiA9IER5bmFtb0RCRG9jdW1lbnRDbGllbnQuZnJvbShjbGllbnQpO1xuICAgIH1cbiAgICByZXR1cm4gdGhpcy5kZGI7XG4gIH07XG5cbiAgLyoqIExvYWRzIGEgdG9rZW4gcm93IGJ5IHBhcnRpdGlvbiBrZXksIG9yIGBudWxsYCBpZiBhYnNlbnQuICovXG4gIHByaXZhdGUgZ2V0VG9rZW5SZWNvcmQgPSBhc3luYyAocGs6IHN0cmluZyk6IFByb21pc2U8VG9rZW5SZWNvcmQgfCBudWxsPiA9PiB7XG4gICAgY29uc3QgZGRiID0gdGhpcy5nZXRkZGIoKTtcblxuICAgIGNvbnN0IHJlcyA9IGF3YWl0IGRkYi5zZW5kKFxuICAgICAgbmV3IEdldENvbW1hbmQoe1xuICAgICAgICBUYWJsZU5hbWU6IHRoaXMudGFibGVOYW1lLFxuICAgICAgICBLZXk6IHsgcGsgfSxcbiAgICAgICAgQ29uc2lzdGVudFJlYWQ6IHRoaXMub3B0aW9ucz8uY29uc2lzdGVudFJlYWQgPz8gdHJ1ZSxcbiAgICAgIH0pLFxuICAgICk7XG4gICAgcmV0dXJuIChyZXMuSXRlbSBhcyBUb2tlblJlY29yZCkgPz8gbnVsbDtcbiAgfTtcblxuICAvKiogRWZmZWN0aXZlIFBLIHByZWZpeCBmcm9tIG9wdGlvbnMgb3Ige0BsaW5rIERFRkFVTFRfUFJJTUFSWV9LRVlfUFJFRklYfS4gKi9cbiAgcHJpdmF0ZSBnZXRQcmltYXJ5S2V5UHJlZml4ID0gKCk6IHN0cmluZyA9PiB7XG4gICAgcmV0dXJuIGAke3RoaXMub3B0aW9ucz8ucGtQcmVmaXggPz8gREVGQVVMVF9QUklNQVJZX0tFWV9QUkVGSVh9YDtcbiAgfTtcblxuICAvKiogRnVsbCBwYXJ0aXRpb24ga2V5OiBwcmVmaXggKyBTSEEtMjU2IGhleCBvZiB0aGUgcmF3IHRva2VuLiAqL1xuICBwcml2YXRlIGdldFByaW1hcnlLZXkgPSAoaGFzaDogc3RyaW5nKTogc3RyaW5nID0+IHtcbiAgICByZXR1cm4gYCR7dGhpcy5nZXRQcmltYXJ5S2V5UHJlZml4KCl9JHtoYXNofWA7XG4gIH07XG5cbiAgLyoqIEV4cGlyYXRpb24gdGltZXN0YW1wOiBgbm93U2VjYCBwbHVzIFRUTCBmcm9tIG9wdGlvbnMgKGRlZmF1bHQgNjAgZGF5cykuICovXG4gIHByaXZhdGUgbWFrZUV4cGlyZXNBdCA9IChub3dTZWM6IG51bWJlcik6IG51bWJlciA9PiB7XG4gICAgcmV0dXJuIG5vd1NlYyArICh0aGlzLm9wdGlvbnM/LnR0bERheXMgPz8gNjApICogMjQgKiA2MCAqIDYwO1xuICB9O1xuXG4gIC8qKlxuICAgKiBFbnN1cmVzIHRoZSB0b2tlbiBpcyBub24tZW1wdHkgYW5kIG1hdGNoZXMgdGhlIGV4cGVjdGVkIGJhc2U2NHVybCBsZW5ndGggZm9yIGB0b2tlbkJ5dGVzYCAoMzIgYnl0ZXMg4oaSIFVSTC1zYWZlIGJhc2U2NCBsZW5ndGgpLlxuICAgKlxuICAgKiBAdGhyb3dzIHtAbGluayBSZWZyZXNoVG9rZW5JbnZhbGlkRXJyb3J9IFdoZW4gdmFsaWRhdGlvbiBmYWlscy5cbiAgICovXG4gIHByaXZhdGUgdmFsaWRhdGVSZWZyZXNoVG9rZW4odG9rZW46IHN0cmluZyk6IHZvaWQge1xuICAgIGlmICghdG9rZW4gfHwgdG9rZW4ubGVuZ3RoICE9PSBNYXRoLmNlaWwodGhpcy50b2tlbkJ5dGVzICogOCAvIDYpKSB7XG4gICAgICB0aHJvdyBuZXcgUmVmcmVzaFRva2VuSW52YWxpZEVycm9yKCk7XG4gICAgfVxuICB9XG5cbn1cbiJdfQ==

package/lib/stores/refresh-token-errors.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Base class for refresh token store errors.
+ * Use `instanceof` on concrete classes or this base for handling.
+ */
+export declare abstract class RefreshTokenError extends Error {
+    protected constructor(message: string);
+}
+/**
+ * Thrown when the refresh token is missing, malformed, or not recognized.
+ */
+export declare class RefreshTokenInvalidError extends RefreshTokenError {
+    constructor(message?: string);
+}
+/**
+ * Thrown when the refresh token has passed its expiration time.
+ */
+export declare class RefreshTokenExpiredError extends RefreshTokenError {
+    constructor(message?: string);
+}
+/**
+ * Thrown when the refresh token has been explicitly revoked.
+ */
+export declare class RefreshTokenRevokedError extends RefreshTokenError {
+    constructor(message?: string);
+}
+/**
+ * Thrown when a refresh token is presented after it has already been rotated (reuse detection).
+ */
+export declare class RefreshTokenReusedError extends RefreshTokenError {
+    constructor(message?: string);
+}
+/**
+ * Thrown when rotation fails for a reason other than reuse (e.g. transient store failure).
+ */
+export declare class RefreshTokenRotateFailedError extends RefreshTokenError {
+    constructor(message?: string);
+}

package/lib/stores/refresh-token-errors.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshTokenRotateFailedError = exports.RefreshTokenReusedError = exports.RefreshTokenRevokedError = exports.RefreshTokenExpiredError = exports.RefreshTokenInvalidError = exports.RefreshTokenError = void 0;
+/**
+ * Base class for refresh token store errors.
+ * Use `instanceof` on concrete classes or this base for handling.
+ */
+class RefreshTokenError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+exports.RefreshTokenError = RefreshTokenError;
+/**
+ * Thrown when the refresh token is missing, malformed, or not recognized.
+ */
+class RefreshTokenInvalidError extends RefreshTokenError {
+    constructor(message = 'The refresh token is missing, malformed, or not recognized.') {
+        super(message);
+    }
+}
+exports.RefreshTokenInvalidError = RefreshTokenInvalidError;
+/**
+ * Thrown when the refresh token has passed its expiration time.
+ */
+class RefreshTokenExpiredError extends RefreshTokenError {
+    constructor(message = 'The refresh token has expired. Please sign in again.') {
+        super(message);
+    }
+}
+exports.RefreshTokenExpiredError = RefreshTokenExpiredError;
+/**
+ * Thrown when the refresh token has been explicitly revoked.
+ */
+class RefreshTokenRevokedError extends RefreshTokenError {
+    constructor(message = 'The refresh token has been revoked.') {
+        super(message);
+    }
+}
+exports.RefreshTokenRevokedError = RefreshTokenRevokedError;
+/**
+ * Thrown when a refresh token is presented after it has already been rotated (reuse detection).
+ */
+class RefreshTokenReusedError extends RefreshTokenError {
+    constructor(message = 'This refresh token has already been rotated and cannot be used again.') {
+        super(message);
+    }
+}
+exports.RefreshTokenReusedError = RefreshTokenReusedError;
+/**
+ * Thrown when rotation fails for a reason other than reuse (e.g. transient store failure).
+ */
+class RefreshTokenRotateFailedError extends RefreshTokenError {
+    constructor(message = 'The refresh token could not be rotated. Please try signing in again.') {
+        super(message);
+    }
+}
+exports.RefreshTokenRotateFailedError = RefreshTokenRotateFailedError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVmcmVzaC10b2tlbi1lcnJvcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc3RvcmVzL3JlZnJlc2gtdG9rZW4tZXJyb3JzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7R0FHRztBQUNILE1BQXNCLGlCQUFrQixTQUFRLEtBQUs7SUFDbkQsWUFBc0IsT0FBZTtRQUNuQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDZixJQUFJLENBQUMsSUFBSSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDO0lBQzlCLENBQUM7Q0FDRjtBQUxELDhDQUtDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHdCQUF5QixTQUFRLGlCQUFpQjtJQUM3RCxZQUNFLE9BQU8sR0FBRyw2REFBNkQ7UUFFdkUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQU5ELDREQU1DO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHdCQUF5QixTQUFRLGlCQUFpQjtJQUM3RCxZQUFZLE9BQU8sR0FBRyxzREFBc0Q7UUFDMUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQUpELDREQUlDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHdCQUF5QixTQUFRLGlCQUFpQjtJQUM3RCxZQUFZLE9BQU8sR0FBRyxxQ0FBcUM7UUFDekQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQUpELDREQUlDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHVCQUF3QixTQUFRLGlCQUFpQjtJQUM1RCxZQUNFLE9BQU8sR0FBRyx1RUFBdUU7UUFFakYsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQU5ELDBEQU1DO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLDZCQUE4QixTQUFRLGlCQUFpQjtJQUNsRSxZQUNFLE9BQU8sR0FBRyxzRUFBc0U7UUFFaEYsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2pCLENBQUM7Q0FDRjtBQU5ELHNFQU1DIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCYXNlIGNsYXNzIGZvciByZWZyZXNoIHRva2VuIHN0b3JlIGVycm9ycy5cbiAqIFVzZSBgaW5zdGFuY2VvZmAgb24gY29uY3JldGUgY2xhc3NlcyBvciB0aGlzIGJhc2UgZm9yIGhhbmRsaW5nLlxuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgUmVmcmVzaFRva2VuRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIHByb3RlY3RlZCBjb25zdHJ1Y3RvcihtZXNzYWdlOiBzdHJpbmcpIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSBuZXcudGFyZ2V0Lm5hbWU7XG4gIH1cbn1cblxuLyoqXG4gKiBUaHJvd24gd2hlbiB0aGUgcmVmcmVzaCB0b2tlbiBpcyBtaXNzaW5nLCBtYWxmb3JtZWQsIG9yIG5vdCByZWNvZ25pemVkLlxuICovXG5leHBvcnQgY2xhc3MgUmVmcmVzaFRva2VuSW52YWxpZEVycm9yIGV4dGVuZHMgUmVmcmVzaFRva2VuRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihcbiAgICBtZXNzYWdlID0gJ1RoZSByZWZyZXNoIHRva2VuIGlzIG1pc3NpbmcsIG1hbGZvcm1lZCwgb3Igbm90IHJlY29nbml6ZWQuJyxcbiAgKSB7XG4gICAgc3VwZXIobWVzc2FnZSk7XG4gIH1cbn1cblxuLyoqXG4gKiBUaHJvd24gd2hlbiB0aGUgcmVmcmVzaCB0b2tlbiBoYXMgcGFzc2VkIGl0cyBleHBpcmF0aW9uIHRpbWUuXG4gKi9cbmV4cG9ydCBjbGFzcyBSZWZyZXNoVG9rZW5FeHBpcmVkRXJyb3IgZXh0ZW5kcyBSZWZyZXNoVG9rZW5FcnJvciB7XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2UgPSAnVGhlIHJlZnJlc2ggdG9rZW4gaGFzIGV4cGlyZWQuIFBsZWFzZSBzaWduIGluIGFnYWluLicpIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgfVxufVxuXG4vKipcbiAqIFRocm93biB3aGVuIHRoZSByZWZyZXNoIHRva2VuIGhhcyBiZWVuIGV4cGxpY2l0bHkgcmV2b2tlZC5cbiAqL1xuZXhwb3J0IGNsYXNzIFJlZnJlc2hUb2tlblJldm9rZWRFcnJvciBleHRlbmRzIFJlZnJlc2hUb2tlbkVycm9yIHtcbiAgY29uc3RydWN0b3IobWVzc2FnZSA9ICdUaGUgcmVmcmVzaCB0b2tlbiBoYXMgYmVlbiByZXZva2VkLicpIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgfVxufVxuXG4vKipcbiAqIFRocm93biB3aGVuIGEgcmVmcmVzaCB0b2tlbiBpcyBwcmVzZW50ZWQgYWZ0ZXIgaXQgaGFzIGFscmVhZHkgYmVlbiByb3RhdGVkIChyZXVzZSBkZXRlY3Rpb24pLlxuICovXG5leHBvcnQgY2xhc3MgUmVmcmVzaFRva2VuUmV1c2VkRXJyb3IgZXh0ZW5kcyBSZWZyZXNoVG9rZW5FcnJvciB7XG4gIGNvbnN0cnVjdG9yKFxuICAgIG1lc3NhZ2UgPSAnVGhpcyByZWZyZXNoIHRva2VuIGhhcyBhbHJlYWR5IGJlZW4gcm90YXRlZCBhbmQgY2Fubm90IGJlIHVzZWQgYWdhaW4uJyxcbiAgKSB7XG4gICAgc3VwZXIobWVzc2FnZSk7XG4gIH1cbn1cblxuLyoqXG4gKiBUaHJvd24gd2hlbiByb3RhdGlvbiBmYWlscyBmb3IgYSByZWFzb24gb3RoZXIgdGhhbiByZXVzZSAoZS5nLiB0cmFuc2llbnQgc3RvcmUgZmFpbHVyZSkuXG4gKi9cbmV4cG9ydCBjbGFzcyBSZWZyZXNoVG9rZW5Sb3RhdGVGYWlsZWRFcnJvciBleHRlbmRzIFJlZnJlc2hUb2tlbkVycm9yIHtcbiAgY29uc3RydWN0b3IoXG4gICAgbWVzc2FnZSA9ICdUaGUgcmVmcmVzaCB0b2tlbiBjb3VsZCBub3QgYmUgcm90YXRlZC4gUGxlYXNlIHRyeSBzaWduaW5nIGluIGFnYWluLicsXG4gICkge1xuICAgIHN1cGVyKG1lc3NhZ2UpO1xuICB9XG59XG4iXX0=

package/lib/types/index.d.ts

@@ -0,0 +1,91 @@
+/** Unix timestamp in whole seconds. */
+export type EpochSec = number;
+export type StoreOptions = {
+    /**
+     * Refresh token time-to-live in days.
+     * @defaultValue 60
+     */
+    ttlDays?: number;
+    /**
+     * Partition key prefix for DynamoDB items.
+     * @defaultValue `'rt#'`
+     */
+    pkPrefix?: string;
+    /**
+     * Whether to use strongly consistent reads on GetItem.
+     * @defaultValue true
+     */
+    consistentRead?: boolean;
+    /**
+     * Custom DynamoDB API endpoint (e.g. for LocalStack or DynamoDB Local).
+     */
+    endpoint?: string;
+};
+export type IssueParams = {
+    /** Subject (user) identifier to associate with the token. */
+    subjectId: string;
+    /** Session identifier to associate with the token. */
+    sessionId: string;
+    /** Clock override for tests; defaults to `new Date()`. */
+    now?: Date;
+};
+export type IssueResult = {
+    /** Opaque refresh token string (plaintext; store only a hash at rest). */
+    refreshToken: string;
+    /** Expiration time as Unix seconds. */
+    refreshTokenExpiresAt: EpochSec;
+};
+export type RotateParams = {
+    /** Current refresh token from the client. */
+    refreshToken: string;
+    /** Clock override for tests; defaults to `new Date()`. */
+    now?: Date;
+};
+export type RotateResult = {
+    subjectId: string;
+    sessionId: string;
+    /** New opaque refresh token after rotation. */
+    refreshToken: string;
+    /** Expiration time of the new token as Unix seconds. */
+    refreshTokenExpiresAt: EpochSec;
+};
+export type RevokeParams = {
+    /** Refresh token to revoke. */
+    refreshToken: string;
+    /** Clock override for tests; defaults to `new Date()`. */
+    now?: Date;
+};
+/** DynamoDB item shape for a stored refresh token (hash-keyed). */
+export type TokenRecord = {
+    pk: string;
+    subjectId: string;
+    sessionId: string;
+    createdAt: EpochSec;
+    expiresAt: EpochSec;
+    rotatedAt?: EpochSec | null;
+    replacedByPk?: string | null;
+    revokedAt?: EpochSec | null;
+};
+/**
+ * Persistence abstraction for opaque refresh tokens: issue, rotate, and revoke.
+ */
+export interface RefreshTokenStore {
+    /**
+     * Creates a new refresh token row and returns the plaintext token.
+     *
+     * @param params - Subject, session, and optional clock.
+     */
+    issue(params: IssueParams): Promise<IssueResult>;
+    /**
+     * Validates the current token, marks it rotated, inserts the successor row, and returns the new token.
+     *
+     * @param params - Current token and optional clock.
+     */
+    rotate(params: RotateParams): Promise<RotateResult>;
+    /**
+     * Sets `revokedAt` on the token row. Idempotent if the row does not exist.
+     *
+     * @param params - Token to revoke and optional clock.
+     */
+    revoke(params: RevokeParams): Promise<true>;
+}

package/lib/types/index.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiIsInNvdXJjZXNDb250ZW50IjpbIi8qKiBVbml4IHRpbWVzdGFtcCBpbiB3aG9sZSBzZWNvbmRzLiAqL1xuZXhwb3J0IHR5cGUgRXBvY2hTZWMgPSBudW1iZXI7XG5cbmV4cG9ydCB0eXBlIFN0b3JlT3B0aW9ucyA9IHtcbiAgLyoqXG4gICAqIFJlZnJlc2ggdG9rZW4gdGltZS10by1saXZlIGluIGRheXMuXG4gICAqIEBkZWZhdWx0VmFsdWUgNjBcbiAgICovXG4gIHR0bERheXM/OiBudW1iZXI7XG5cbiAgLyoqXG4gICAqIFBhcnRpdGlvbiBrZXkgcHJlZml4IGZvciBEeW5hbW9EQiBpdGVtcy5cbiAgICogQGRlZmF1bHRWYWx1ZSBgJ3J0IydgXG4gICAqL1xuICBwa1ByZWZpeD86IHN0cmluZztcblxuICAvKipcbiAgICogV2hldGhlciB0byB1c2Ugc3Ryb25nbHkgY29uc2lzdGVudCByZWFkcyBvbiBHZXRJdGVtLlxuICAgKiBAZGVmYXVsdFZhbHVlIHRydWVcbiAgICovXG4gIGNvbnNpc3RlbnRSZWFkPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogQ3VzdG9tIER5bmFtb0RCIEFQSSBlbmRwb2ludCAoZS5nLiBmb3IgTG9jYWxTdGFjayBvciBEeW5hbW9EQiBMb2NhbCkuXG4gICAqL1xuICBlbmRwb2ludD86IHN0cmluZztcbn07XG5cbmV4cG9ydCB0eXBlIElzc3VlUGFyYW1zID0ge1xuICAvKiogU3ViamVjdCAodXNlcikgaWRlbnRpZmllciB0byBhc3NvY2lhdGUgd2l0aCB0aGUgdG9rZW4uICovXG4gIHN1YmplY3RJZDogc3RyaW5nO1xuICAvKiogU2Vzc2lvbiBpZGVudGlmaWVyIHRvIGFzc29jaWF0ZSB3aXRoIHRoZSB0b2tlbi4gKi9cbiAgc2Vzc2lvbklkOiBzdHJpbmc7XG4gIC8qKiBDbG9jayBvdmVycmlkZSBmb3IgdGVzdHM7IGRlZmF1bHRzIHRvIGBuZXcgRGF0ZSgpYC4gKi9cbiAgbm93PzogRGF0ZTtcbn07XG5cbmV4cG9ydCB0eXBlIElzc3VlUmVzdWx0ID0ge1xuICAvKiogT3BhcXVlIHJlZnJlc2ggdG9rZW4gc3RyaW5nIChwbGFpbnRleHQ7IHN0b3JlIG9ubHkgYSBoYXNoIGF0IHJlc3QpLiAqL1xuICByZWZyZXNoVG9rZW46IHN0cmluZztcbiAgLyoqIEV4cGlyYXRpb24gdGltZSBhcyBVbml4IHNlY29uZHMuICovXG4gIHJlZnJlc2hUb2tlbkV4cGlyZXNBdDogRXBvY2hTZWM7XG59O1xuXG5leHBvcnQgdHlwZSBSb3RhdGVQYXJhbXMgPSB7XG4gIC8qKiBDdXJyZW50IHJlZnJlc2ggdG9rZW4gZnJvbSB0aGUgY2xpZW50LiAqL1xuICByZWZyZXNoVG9rZW46IHN0cmluZztcbiAgLyoqIENsb2NrIG92ZXJyaWRlIGZvciB0ZXN0czsgZGVmYXVsdHMgdG8gYG5ldyBEYXRlKClgLiAqL1xuICBub3c/OiBEYXRlO1xufTtcblxuZXhwb3J0IHR5cGUgUm90YXRlUmVzdWx0ID0ge1xuICBzdWJqZWN0SWQ6IHN0cmluZztcbiAgc2Vzc2lvbklkOiBzdHJpbmc7XG4gIC8qKiBOZXcgb3BhcXVlIHJlZnJlc2ggdG9rZW4gYWZ0ZXIgcm90YXRpb24uICovXG4gIHJlZnJlc2hUb2tlbjogc3RyaW5nO1xuICAvKiogRXhwaXJhdGlvbiB0aW1lIG9mIHRoZSBuZXcgdG9rZW4gYXMgVW5peCBzZWNvbmRzLiAqL1xuICByZWZyZXNoVG9rZW5FeHBpcmVzQXQ6IEVwb2NoU2VjO1xufTtcblxuZXhwb3J0IHR5cGUgUmV2b2tlUGFyYW1zID0ge1xuICAvKiogUmVmcmVzaCB0b2tlbiB0byByZXZva2UuICovXG4gIHJlZnJlc2hUb2tlbjogc3RyaW5nO1xuICAvKiogQ2xvY2sgb3ZlcnJpZGUgZm9yIHRlc3RzOyBkZWZhdWx0cyB0byBgbmV3IERhdGUoKWAuICovXG4gIG5vdz86IERhdGU7XG59O1xuXG4vKiogRHluYW1vREIgaXRlbSBzaGFwZSBmb3IgYSBzdG9yZWQgcmVmcmVzaCB0b2tlbiAoaGFzaC1rZXllZCkuICovXG5leHBvcnQgdHlwZSBUb2tlblJlY29yZCA9IHtcbiAgcGs6IHN0cmluZztcbiAgc3ViamVjdElkOiBzdHJpbmc7XG4gIHNlc3Npb25JZDogc3RyaW5nO1xuXG4gIGNyZWF0ZWRBdDogRXBvY2hTZWM7XG4gIGV4cGlyZXNBdDogRXBvY2hTZWM7XG5cbiAgcm90YXRlZEF0PzogRXBvY2hTZWMgfCBudWxsO1xuICByZXBsYWNlZEJ5UGs/OiBzdHJpbmcgfCBudWxsO1xuICByZXZva2VkQXQ/OiBFcG9jaFNlYyB8IG51bGw7XG59O1xuXG4vKipcbiAqIFBlcnNpc3RlbmNlIGFic3RyYWN0aW9uIGZvciBvcGFxdWUgcmVmcmVzaCB0b2tlbnM6IGlzc3VlLCByb3RhdGUsIGFuZCByZXZva2UuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmVmcmVzaFRva2VuU3RvcmUge1xuICAvKipcbiAgICogQ3JlYXRlcyBhIG5ldyByZWZyZXNoIHRva2VuIHJvdyBhbmQgcmV0dXJucyB0aGUgcGxhaW50ZXh0IHRva2VuLlxuICAgKlxuICAgKiBAcGFyYW0gcGFyYW1zIC0gU3ViamVjdCwgc2Vzc2lvbiwgYW5kIG9wdGlvbmFsIGNsb2NrLlxuICAgKi9cbiAgaXNzdWUocGFyYW1zOiBJc3N1ZVBhcmFtcyk6IFByb21pc2U8SXNzdWVSZXN1bHQ+O1xuXG4gIC8qKlxuICAgKiBWYWxpZGF0ZXMgdGhlIGN1cnJlbnQgdG9rZW4sIG1hcmtzIGl0IHJvdGF0ZWQsIGluc2VydHMgdGhlIHN1Y2Nlc3NvciByb3csIGFuZCByZXR1cm5zIHRoZSBuZXcgdG9rZW4uXG4gICAqXG4gICAqIEBwYXJhbSBwYXJhbXMgLSBDdXJyZW50IHRva2VuIGFuZCBvcHRpb25hbCBjbG9jay5cbiAgICovXG4gIHJvdGF0ZShwYXJhbXM6IFJvdGF0ZVBhcmFtcyk6IFByb21pc2U8Um90YXRlUmVzdWx0PjtcblxuICAvKipcbiAgICogU2V0cyBgcmV2b2tlZEF0YCBvbiB0aGUgdG9rZW4gcm93LiBJZGVtcG90ZW50IGlmIHRoZSByb3cgZG9lcyBub3QgZXhpc3QuXG4gICAqXG4gICAqIEBwYXJhbSBwYXJhbXMgLSBUb2tlbiB0byByZXZva2UgYW5kIG9wdGlvbmFsIGNsb2NrLlxuICAgKi9cbiAgcmV2b2tlKHBhcmFtczogUmV2b2tlUGFyYW1zKTogUHJvbWlzZTx0cnVlPjtcbn1cbiJdfQ==

package/lib/utils/hash.d.ts

@@ -0,0 +1,15 @@
+/**
+ * SHA-256 digest of `input` as a lowercase hexadecimal string.
+ * Used so refresh tokens are not stored in plaintext in DynamoDB.
+ *
+ * @param input - String to hash (e.g. raw refresh token).
+ * @returns 64-character hex string.
+ */
+export declare const sha256hex: (input: string) => string;
+/**
+ * Generates an opaque URL-safe refresh token using cryptographically secure random bytes.
+ *
+ * @param bytes - Number of random bytes (default: 32, i.e. 256 bits).
+ * @returns Base64url-encoded token string.
+ */
+export declare const randomtoken: (bytes?: number) => string;

package/lib/utils/hash.js

@@ -0,0 +1,29 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.randomtoken = exports.sha256hex = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+/**
+ * SHA-256 digest of `input` as a lowercase hexadecimal string.
+ * Used so refresh tokens are not stored in plaintext in DynamoDB.
+ *
+ * @param input - String to hash (e.g. raw refresh token).
+ * @returns 64-character hex string.
+ */
+const sha256hex = (input) => {
+    return crypto_1.default.createHash('sha256').update(input).digest('hex');
+};
+exports.sha256hex = sha256hex;
+/**
+ * Generates an opaque URL-safe refresh token using cryptographically secure random bytes.
+ *
+ * @param bytes - Number of random bytes (default: 32, i.e. 256 bits).
+ * @returns Base64url-encoded token string.
+ */
+const randomtoken = (bytes = 32) => {
+    return crypto_1.default.randomBytes(bytes).toString('base64url');
+};
+exports.randomtoken = randomtoken;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGFzaC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9oYXNoLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLG9EQUE0QjtBQUU1Qjs7Ozs7O0dBTUc7QUFDSSxNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWEsRUFBVSxFQUFFO0lBQ2pELE9BQU8sZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNqRSxDQUFDLENBQUM7QUFGVyxRQUFBLFNBQVMsYUFFcEI7QUFFRjs7Ozs7R0FLRztBQUNJLE1BQU0sV0FBVyxHQUFHLENBQUMsUUFBZ0IsRUFBRSxFQUFVLEVBQUU7SUFDeEQsT0FBTyxnQkFBTSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFDekQsQ0FBQyxDQUFDO0FBRlcsUUFBQSxXQUFXLGVBRXRCIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGNyeXB0byBmcm9tICdjcnlwdG8nO1xuXG4vKipcbiAqIFNIQS0yNTYgZGlnZXN0IG9mIGBpbnB1dGAgYXMgYSBsb3dlcmNhc2UgaGV4YWRlY2ltYWwgc3RyaW5nLlxuICogVXNlZCBzbyByZWZyZXNoIHRva2VucyBhcmUgbm90IHN0b3JlZCBpbiBwbGFpbnRleHQgaW4gRHluYW1vREIuXG4gKlxuICogQHBhcmFtIGlucHV0IC0gU3RyaW5nIHRvIGhhc2ggKGUuZy4gcmF3IHJlZnJlc2ggdG9rZW4pLlxuICogQHJldHVybnMgNjQtY2hhcmFjdGVyIGhleCBzdHJpbmcuXG4gKi9cbmV4cG9ydCBjb25zdCBzaGEyNTZoZXggPSAoaW5wdXQ6IHN0cmluZyk6IHN0cmluZyA9PiB7XG4gIHJldHVybiBjcnlwdG8uY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKGlucHV0KS5kaWdlc3QoJ2hleCcpO1xufTtcblxuLyoqXG4gKiBHZW5lcmF0ZXMgYW4gb3BhcXVlIFVSTC1zYWZlIHJlZnJlc2ggdG9rZW4gdXNpbmcgY3J5cHRvZ3JhcGhpY2FsbHkgc2VjdXJlIHJhbmRvbSBieXRlcy5cbiAqXG4gKiBAcGFyYW0gYnl0ZXMgLSBOdW1iZXIgb2YgcmFuZG9tIGJ5dGVzIChkZWZhdWx0OiAzMiwgaS5lLiAyNTYgYml0cykuXG4gKiBAcmV0dXJucyBCYXNlNjR1cmwtZW5jb2RlZCB0b2tlbiBzdHJpbmcuXG4gKi9cbmV4cG9ydCBjb25zdCByYW5kb210b2tlbiA9IChieXRlczogbnVtYmVyID0gMzIpOiBzdHJpbmcgPT4ge1xuICByZXR1cm4gY3J5cHRvLnJhbmRvbUJ5dGVzKGJ5dGVzKS50b1N0cmluZygnYmFzZTY0dXJsJyk7XG59O1xuIl19

package/lib/utils/time.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Converts a JavaScript `Date` to Unix time in whole seconds (floor).
+ *
+ * @param date - Instant to convert.
+ * @returns Seconds since the Unix epoch.
+ */
+export declare const epochsec: (date: Date) => number;

package/lib/utils/time.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.epochsec = void 0;
+/**
+ * Converts a JavaScript `Date` to Unix time in whole seconds (floor).
+ *
+ * @param date - Instant to convert.
+ * @returns Seconds since the Unix epoch.
+ */
+const epochsec = (date) => {
+    return Math.floor(date.getTime() / 1000);
+};
+exports.epochsec = epochsec;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy90aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7OztHQUtHO0FBQ0ksTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFVLEVBQVUsRUFBRTtJQUM3QyxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDO0FBQzNDLENBQUMsQ0FBQztBQUZXLFFBQUEsUUFBUSxZQUVuQiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQ29udmVydHMgYSBKYXZhU2NyaXB0IGBEYXRlYCB0byBVbml4IHRpbWUgaW4gd2hvbGUgc2Vjb25kcyAoZmxvb3IpLlxuICpcbiAqIEBwYXJhbSBkYXRlIC0gSW5zdGFudCB0byBjb252ZXJ0LlxuICogQHJldHVybnMgU2Vjb25kcyBzaW5jZSB0aGUgVW5peCBlcG9jaC5cbiAqL1xuZXhwb3J0IGNvbnN0IGVwb2Noc2VjID0gKGRhdGU6IERhdGUpOiBudW1iZXIgPT4ge1xuICByZXR1cm4gTWF0aC5mbG9vcihkYXRlLmdldFRpbWUoKSAvIDEwMDApO1xufTtcbiJdfQ==

package/package.json

@@ -0,0 +1,120 @@
+{
+  "name": "dynamodb-refresh-token-provider",
+  "description": "TypeScript library that stores **opaque refresh tokens** in **Amazon DynamoDB** using AWS SDK for JavaScript v3. Tokens are persisted under a hash of the plaintext value; **issue**, **rotate** (with reuse detection via a transactional write), and **revoke** (idempotent) are supported.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/gammarers-aws-sdk-modules/dynamodb-refresh-token-provider.git"
+  },
+  "scripts": {
+    "build": "npx projen build",
+    "bump": "npx projen bump",
+    "clobber": "npx projen clobber",
+    "compile": "npx projen compile",
+    "default": "npx projen default",
+    "eject": "npx projen eject",
+    "eslint": "npx projen eslint",
+    "package": "npx projen package",
+    "post-compile": "npx projen post-compile",
+    "post-upgrade": "npx projen post-upgrade",
+    "pre-compile": "npx projen pre-compile",
+    "release": "npx projen release",
+    "test": "npx projen test",
+    "test:watch": "npx projen test:watch",
+    "unbump": "npx projen unbump",
+    "upgrade": "npx projen upgrade",
+    "watch": "npx projen watch",
+    "projen": "npx projen"
+  },
+  "author": {
+    "name": "yicr",
+    "email": "yicr@users.noreply.github.com",
+    "organization": false
+  },
+  "devDependencies": {
+    "@stylistic/eslint-plugin": "^2",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^20",
+    "@typescript-eslint/eslint-plugin": "^8",
+    "@typescript-eslint/parser": "^8",
+    "commit-and-tag-version": "^12",
+    "constructs": "^10.0.0",
+    "eslint": "^9",
+    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-plugin-import": "^2.32.0",
+    "jest": "^30.3.0",
+    "jest-junit": "^16",
+    "projen": "^0.99.36",
+    "ts-jest": "^29.4.9",
+    "ts-node": "^10.9.2",
+    "typescript": "5.9.x"
+  },
+  "dependencies": {
+    "@aws-sdk/client-dynamodb": "^3.777.0",
+    "@aws-sdk/lib-dynamodb": "^3.777.0",
+    "@aws-sdk/util-dynamodb": "^3.777.0"
+  },
+  "engines": {
+    "node": ">= 20.0.0"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "yarn",
+      "version": "1.22.22",
+      "onFail": "ignore"
+    }
+  },
+  "main": "lib/index.js",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "version": "0.1.2",
+  "jest": {
+    "coverageProvider": "v8",
+    "testMatch": [
+      "<rootDir>/@(src|test)/**/*(*.)@(spec|test).ts?(x)",
+      "<rootDir>/@(src|test)/**/__tests__/**/*.ts?(x)",
+      "<rootDir>/@(projenrc)/**/*(*.)@(spec|test).ts?(x)",
+      "<rootDir>/@(projenrc)/**/__tests__/**/*.ts?(x)"
+    ],
+    "clearMocks": true,
+    "collectCoverage": true,
+    "coverageReporters": [
+      "json",
+      "lcov",
+      "clover",
+      "cobertura",
+      "text"
+    ],
+    "coverageDirectory": "coverage",
+    "coveragePathIgnorePatterns": [
+      "/node_modules/"
+    ],
+    "testPathIgnorePatterns": [
+      "/node_modules/"
+    ],
+    "watchPathIgnorePatterns": [
+      "/node_modules/"
+    ],
+    "reporters": [
+      "default",
+      [
+        "jest-junit",
+        {
+          "outputDirectory": "test-reports"
+        }
+      ]
+    ],
+    "transform": {
+      "^.+\\.[t]sx?$": [
+        "ts-jest",
+        {
+          "tsconfig": "tsconfig.dev.json"
+        }
+      ]
+    }
+  },
+  "types": "lib/index.d.ts",
+  "packageManager": "yarn@1.22.22",
+  "//": "~~ Generated by projen. To modify, edit .projenrc.ts and run \"npx projen\"."
+}