@authhero/kysely-adapter 12.8.3 → 12.10.0

package/dist/types/migrate/migrations/2026-09-25T12:00:00_token_exchange_profiles.d.ts

@@ -0,0 +1,4 @@
+import { Kysely } from "kysely";
+import { Database } from "../../src/db";
+export declare function up(db: Kysely<Database>): Promise<void>;
+export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/index.d.ts

@@ -8,6 +8,7 @@ import * as pageHooks from "./2026-08-11T12:00:00_page_hooks";
 import * as refreshTokenSessionId from "./2026-08-20T12:00:00_refresh_token_session_id";
 import * as refreshTokenSessionIdBackfill from "./2026-08-21T12:00:00_refresh_token_session_id_backfill";
 import * as tenantOperationRows from "./2026-09-01T12:00:00_tenant_operation_rows";
+import * as tokenExchangeProfiles from "./2026-09-25T12:00:00_token_exchange_profiles";
 /**
  * Kysely runs these in key order and refuses to start if an already-executed
  * migration sorts after a pending one, so the keys must sort in execution
@@ -34,5 +35,6 @@ declare const _default: {
     "2026-08-20T12:00:00_refresh_token_session_id": typeof refreshTokenSessionId;
     "2026-08-21T12:00:00_refresh_token_session_id_backfill": typeof refreshTokenSessionIdBackfill;
     "2026-09-01T12:00:00_tenant_operation_rows": typeof tenantOperationRows;
+    "2026-09-25T12:00:00_token_exchange_profiles": typeof tokenExchangeProfiles;
 };
 export default _default;

package/dist/types/migrate/plan.d.ts

@@ -0,0 +1,43 @@
+import { Kysely } from "kysely";
+import { Database } from "../src/db";
+export interface PlannedStatement {
+    sql: string;
+    parameters: readonly unknown[];
+}
+export interface PlannedMigration {
+    name: string;
+    /** Writes (DDL and DML) the migration would execute, in order. */
+    statements: PlannedStatement[];
+    /**
+     * Set when the migration threw during planning. The statements captured
+     * before the failure are still listed. This can be a dry-run artifact: a
+     * migration that reads a column an earlier pending migration adds will fail
+     * here because the earlier migration was never applied.
+     */
+    error?: string;
+    /** True when planning stopped at MAX_STATEMENTS_PER_MIGRATION. */
+    truncated?: boolean;
+}
+export interface MigrationPlan {
+    /** Migrations already recorded as executed, in order. */
+    executed: string[];
+    /** Migrations `migrateToLatest` would run, in order. */
+    pending: PlannedMigration[];
+}
+/**
+ * Dry run of `migrateToLatest`: lists the pending migrations and the SQL each
+ * would execute, without changing the database.
+ *
+ * Each pending migration's `up` runs against a wrapper around `db` that
+ * passes reads through and captures writes. Nothing is written — including
+ * the `kysely_migration` bookkeeping tables, which are only read if present.
+ *
+ * Because captured writes are never applied, the plan can diverge from a real
+ * run where a migration depends on its own or an earlier migration's writes:
+ * "tolerate duplicate column" guards never fire (so an already-present column
+ * still shows up as an ALTER), and reads of not-yet-created columns fail (see
+ * `PlannedMigration.error`).
+ */
+export declare function planMigrations(db: Kysely<Database>): Promise<MigrationPlan>;
+/** Renders a plan as an SQL-ish script for printing. */
+export declare function formatMigrationPlan(plan: MigrationPlan): string;

package/dist/types/src/codes/create.d.ts

@@ -3,7 +3,7 @@ import { Kysely } from "kysely";
 import { Database } from "../db";
 export declare function create(db: Kysely<Database>): (tenant_id: string, code: CodeInsert) => Promise<{
     code_id: string;
-    code_type: "otp" | "password_reset" | "email_verification" | "mfa_otp" | "authorization_code" | "oauth2_state" | "ticket" | "client_assertion_jti";
+    code_type: "otp" | "password_reset" | "email_verification" | "mfa_otp" | "authorization_code" | "oauth2_state" | "ticket" | "client_assertion_jti" | "subject_token_jti";
     expires_at: string;
     created_at: string;
     login_id?: string | undefined;

package/dist/types/src/db.d.ts

@@ -792,6 +792,7 @@ declare const sqlClientSchema: z.ZodObject<{
     owner_user_id: z.ZodNullable<z.ZodOptional<z.ZodString>>;
     registration_type: z.ZodNullable<z.ZodOptional<z.ZodString>>;
     registration_metadata: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+    token_exchange: z.ZodNullable<z.ZodOptional<z.ZodString>>;
 }, z.core.$strip>;
 export declare const sqlClientRegistrationTokenSchema: z.ZodObject<{
     id: z.ZodString;
@@ -938,6 +939,17 @@ export interface Database {
         created_at: string;
         updated_at: string;
     };
+    token_exchange_profiles: {
+        id: string;
+        tenant_id: string;
+        name: string;
+        subject_token_type: string;
+        action_id: string | null;
+        type: string;
+        jwt_verification: string | null;
+        created_at: string;
+        updated_at: string;
+    };
     scim_configurations: {
         connection_id: string;
         tenant_id: string;

package/dist/types/src/index.d.ts

@@ -2,6 +2,8 @@ import { Kysely } from "kysely";
 import { Database } from "./db";
 import { DataAdapters } from "@authhero/adapter-interfaces";
 export { migrateToLatest, migrateDown } from "../migrate/migrate";
+export { planMigrations, formatMigrationPlan } from "../migrate/plan";
+export type { MigrationPlan, PlannedMigration, PlannedStatement, } from "../migrate/plan";
 export type { Database } from "./db";
 export { createProxyRoutesAdapter, createProxyDataAdapter, } from "./proxyRoutes";
 export default function createAdapters(db: Kysely<Database>, databaseOptions?: {

package/dist/types/src/tokenExchangeProfiles/adapter.d.ts

@@ -0,0 +1,4 @@
+import { Kysely } from "kysely";
+import { TokenExchangeProfilesAdapter } from "@authhero/adapter-interfaces";
+import { Database } from "../db";
+export declare function createTokenExchangeProfilesAdapter(db: Kysely<Database>): TokenExchangeProfilesAdapter;

package/dist/types/src/tokenExchangeProfiles/index.d.ts

@@ -0,0 +1 @@
+export { createTokenExchangeProfilesAdapter } from "./adapter";

package/dist/types/src/tokenExchangeProfiles/serialize.d.ts

@@ -0,0 +1,4 @@
+import { TokenExchangeProfile } from "@authhero/adapter-interfaces";
+import { Database } from "../db";
+export type TokenExchangeProfileRow = Database["token_exchange_profiles"];
+export declare function rowToTokenExchangeProfile(row: TokenExchangeProfileRow): TokenExchangeProfile;