@julr/sesame 0.5.1 → 0.7.0

package/build/src/storage/drivers/lucid.js

@@ -0,0 +1,549 @@
+import { t as retryConsentConflict } from "../../../consent_retry-DMkfhmk9.js";
+import { t as __decorate } from "../../../decorate-RQD1h28J.js";
+import { DateTime } from "luxon";
+import { BaseModel, column } from "@adonisjs/lucid/orm";
+//#region src/decorators.ts
+/**
+* Column decorator for JSON values (arrays, objects).
+*
+* Lucid ORM doesn't handle JSON serialization automatically —
+* `prepare` stringifies before INSERT/UPDATE, `consume` parses
+* after SELECT. The typeof check in consume handles both drivers
+* that return strings (SQLite, MySQL) and parsed objects (PostgreSQL JSONB).
+*/
+function json(options) {
+	return column({
+		...options,
+		prepare: (value) => value == null ? null : JSON.stringify(value),
+		consume: (value) => value == null ? null : typeof value === "string" ? JSON.parse(value) : value
+	});
+}
+//#endregion
+//#region src/models/oauth_access_token.ts
+/**
+* Database record for an issued OAuth 2.0 access token.
+*
+* Access tokens are opaque random values. Only the SHA-256 hash
+* is stored so raw tokens cannot be reconstructed from a DB leak.
+* A token is considered revoked when `revokedAt` is set.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7662
+*/
+var OAuthAccessToken = class extends BaseModel {
+	static table = "oauth_access_tokens";
+};
+__decorate([column({ isPrimary: true })], OAuthAccessToken.prototype, "id", void 0);
+__decorate([column()], OAuthAccessToken.prototype, "tokenHash", void 0);
+__decorate([column()], OAuthAccessToken.prototype, "clientId", void 0);
+__decorate([column()], OAuthAccessToken.prototype, "userId", void 0);
+__decorate([json()], OAuthAccessToken.prototype, "scopes", void 0);
+__decorate([column.dateTime()], OAuthAccessToken.prototype, "expiresAt", void 0);
+__decorate([column.dateTime()], OAuthAccessToken.prototype, "revokedAt", void 0);
+__decorate([column.dateTime({ autoCreate: true })], OAuthAccessToken.prototype, "createdAt", void 0);
+__decorate([column.dateTime({
+	autoCreate: true,
+	autoUpdate: true
+})], OAuthAccessToken.prototype, "updatedAt", void 0);
+//#endregion
+//#region src/models/oauth_authorization_code.ts
+/**
+* Database record for an OAuth 2.0 authorization code (RFC 6749 §4.1.2).
+*
+* Authorization codes are short-lived, single-use tokens issued
+* during the authorization flow. The `code` column stores the
+* SHA-256 hash of the raw code value sent to the client.
+*
+* When PKCE (RFC 7636) is used, the `codeChallenge` and
+* `codeChallengeMethod` (always S256) are stored alongside the
+* code for verification at the token endpoint.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2
+* @see https://datatracker.ietf.org/doc/html/rfc7636
+*/
+var OAuthAuthorizationCode = class extends BaseModel {
+	static table = "oauth_authorization_codes";
+};
+__decorate([column({ isPrimary: true })], OAuthAuthorizationCode.prototype, "id", void 0);
+__decorate([column()], OAuthAuthorizationCode.prototype, "code", void 0);
+__decorate([column()], OAuthAuthorizationCode.prototype, "clientId", void 0);
+__decorate([column()], OAuthAuthorizationCode.prototype, "userId", void 0);
+__decorate([json()], OAuthAuthorizationCode.prototype, "scopes", void 0);
+__decorate([column()], OAuthAuthorizationCode.prototype, "redirectUri", void 0);
+__decorate([column()], OAuthAuthorizationCode.prototype, "codeChallenge", void 0);
+__decorate([column()], OAuthAuthorizationCode.prototype, "codeChallengeMethod", void 0);
+__decorate([column()], OAuthAuthorizationCode.prototype, "nonce", void 0);
+__decorate([column.dateTime()], OAuthAuthorizationCode.prototype, "expiresAt", void 0);
+__decorate([column.dateTime({ autoCreate: true })], OAuthAuthorizationCode.prototype, "createdAt", void 0);
+__decorate([column.dateTime({
+	autoCreate: true,
+	autoUpdate: true
+})], OAuthAuthorizationCode.prototype, "updatedAt", void 0);
+//#endregion
+//#region src/models/oauth_client.ts
+/**
+* Represents a registered OAuth 2.0 client (RFC 6749 §2).
+*
+* Clients can be either confidential (with a hashed secret) or
+* public (no secret, e.g. SPAs, native apps). Public clients must
+* use PKCE (RFC 7636) for authorization code exchanges.
+*
+* Clients may be created manually or via dynamic client registration
+* (RFC 7591) through the `/oauth/register` endpoint.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-2
+* @see https://datatracker.ietf.org/doc/html/rfc7591
+*/
+var OAuthClient = class extends BaseModel {
+	static table = "oauth_clients";
+};
+__decorate([column({ isPrimary: true })], OAuthClient.prototype, "id", void 0);
+__decorate([column()], OAuthClient.prototype, "clientId", void 0);
+__decorate([column({ serializeAs: null })], OAuthClient.prototype, "clientSecret", void 0);
+__decorate([column()], OAuthClient.prototype, "name", void 0);
+__decorate([json()], OAuthClient.prototype, "redirectUris", void 0);
+__decorate([json()], OAuthClient.prototype, "scopes", void 0);
+__decorate([json()], OAuthClient.prototype, "grantTypes", void 0);
+__decorate([column()], OAuthClient.prototype, "isPublic", void 0);
+__decorate([column()], OAuthClient.prototype, "isDisabled", void 0);
+__decorate([column()], OAuthClient.prototype, "requirePkce", void 0);
+__decorate([column()], OAuthClient.prototype, "type", void 0);
+__decorate([json()], OAuthClient.prototype, "metadata", void 0);
+__decorate([column()], OAuthClient.prototype, "userId", void 0);
+__decorate([column.dateTime({ autoCreate: true })], OAuthClient.prototype, "createdAt", void 0);
+__decorate([column.dateTime({
+	autoCreate: true,
+	autoUpdate: true
+})], OAuthClient.prototype, "updatedAt", void 0);
+//#endregion
+//#region src/models/oauth_consent.ts
+/**
+* Tracks which scopes a user has approved for a given client.
+*
+* When a user grants consent during the authorization flow,
+* the approved scopes are persisted here. On subsequent
+* authorization requests, if the requested scopes are a subset
+* of previously approved scopes, the user is not prompted again.
+*
+* New scopes are merged into the existing record when the user
+* approves additional permissions.
+*/
+var OAuthConsent = class extends BaseModel {
+	static table = "oauth_consents";
+};
+__decorate([column({ isPrimary: true })], OAuthConsent.prototype, "id", void 0);
+__decorate([column()], OAuthConsent.prototype, "clientId", void 0);
+__decorate([column()], OAuthConsent.prototype, "userId", void 0);
+__decorate([json()], OAuthConsent.prototype, "scopes", void 0);
+__decorate([column.dateTime({ autoCreate: true })], OAuthConsent.prototype, "createdAt", void 0);
+__decorate([column.dateTime({
+	autoCreate: true,
+	autoUpdate: true
+})], OAuthConsent.prototype, "updatedAt", void 0);
+//#endregion
+//#region src/models/oauth_pending_authorization_request.ts
+/**
+* Temporary server-side record for an in-flight OAuth authorization
+* request, created when the user is redirected to the consent page
+* and consumed (deleted) when the user approves or denies.
+*
+* Stored in the database instead of the HTTP session to avoid
+* last-write-wins race conditions when concurrent SPA requests
+* overwrite session data.
+*
+* The `token` column stores a SHA-256 hash of the raw auth_token
+* sent to the consent page, consistent with how authorization
+* codes are stored.
+*/
+var OAuthPendingAuthorizationRequest = class extends BaseModel {
+	static table = "oauth_pending_authorization_requests";
+};
+__decorate([column({ isPrimary: true })], OAuthPendingAuthorizationRequest.prototype, "id", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "token", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "userId", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "clientId", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "redirectUri", void 0);
+__decorate([json()], OAuthPendingAuthorizationRequest.prototype, "scopes", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "state", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "codeChallenge", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "codeChallengeMethod", void 0);
+__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "nonce", void 0);
+__decorate([column.dateTime()], OAuthPendingAuthorizationRequest.prototype, "expiresAt", void 0);
+__decorate([column.dateTime({ autoCreate: true })], OAuthPendingAuthorizationRequest.prototype, "createdAt", void 0);
+//#endregion
+//#region src/models/oauth_refresh_token.ts
+/**
+* Database record for an OAuth 2.0 refresh token (RFC 6749 §6).
+*
+* The `token` column stores the SHA-256 hash of the raw refresh
+* token value. Refresh token rotation is enforced: each use
+* produces a new token and revokes the old one.
+*
+* Replay detection is implemented by checking `revokedAt` —
+* if a revoked token is presented, all tokens for that
+* client+user pair are deleted as a security measure.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+* @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-4.14.2
+*/
+var OAuthRefreshToken = class extends BaseModel {
+	static table = "oauth_refresh_tokens";
+};
+__decorate([column({ isPrimary: true })], OAuthRefreshToken.prototype, "id", void 0);
+__decorate([column({ serializeAs: null })], OAuthRefreshToken.prototype, "token", void 0);
+__decorate([column()], OAuthRefreshToken.prototype, "accessTokenId", void 0);
+__decorate([column()], OAuthRefreshToken.prototype, "clientId", void 0);
+__decorate([column()], OAuthRefreshToken.prototype, "userId", void 0);
+__decorate([json()], OAuthRefreshToken.prototype, "scopes", void 0);
+__decorate([column.dateTime()], OAuthRefreshToken.prototype, "expiresAt", void 0);
+__decorate([column.dateTime()], OAuthRefreshToken.prototype, "revokedAt", void 0);
+__decorate([column.dateTime({ autoCreate: true })], OAuthRefreshToken.prototype, "createdAt", void 0);
+__decorate([column.dateTime({
+	autoCreate: true,
+	autoUpdate: true
+})], OAuthRefreshToken.prototype, "updatedAt", void 0);
+//#endregion
+//#region src/storage/drivers/lucid.ts
+/**
+* Persist OAuth records through the application's Lucid connection.
+*/
+var LucidStore = class LucidStore {
+	#client;
+	/**
+	* Bind this store to a Lucid transaction when one is supplied.
+	*/
+	constructor(client) {
+		this.#client = client;
+	}
+	/**
+	* Normalize affected-row results across Lucid's SQL drivers.
+	*/
+	#affectedRows(result) {
+		if (Array.isArray(result)) return Number(result[0] ?? 0);
+		return Number(result);
+	}
+	/**
+	* Bind a model query to this store's transaction when present.
+	*/
+	#query(model) {
+		return model.query(this.#client ? { client: this.#client } : void 0);
+	}
+	/**
+	* Return a plain record with omitted nullable columns normalized.
+	*/
+	#record(model, nullableFields = []) {
+		const attributes = { ...model.$attributes };
+		for (const field of nullableFields) if (attributes[field] === void 0) attributes[field] = null;
+		return attributes;
+	}
+	/**
+	* Normalize Lucid client values to the store's plain-record contract.
+	*/
+	#clientRecord(client) {
+		const record = this.#record(client, [
+			"clientSecret",
+			"metadata",
+			"type",
+			"userId"
+		]);
+		return {
+			...record,
+			isPublic: Boolean(record.isPublic),
+			isDisabled: Boolean(record.isDisabled),
+			requirePkce: Boolean(record.requirePkce)
+		};
+	}
+	/**
+	* Execute related writes in one real database transaction.
+	*/
+	async #transaction(callback) {
+		return OAuthClient.transaction(async (client) => callback(new LucidStore(client)));
+	}
+	/**
+	* Find a registered client by its public identifier.
+	*/
+	async findClient(clientId) {
+		const client = await this.#query(OAuthClient).where("clientId", clientId).first();
+		return client ? this.#clientRecord(client) : null;
+	}
+	/**
+	* List clients newest first, optionally for a single owner.
+	*/
+	async listClients(options) {
+		const query = this.#query(OAuthClient).orderBy("createdAt", "desc");
+		if (options?.userId) query.where("userId", options.userId);
+		return (await query).map((client) => this.#clientRecord(client));
+	}
+	/**
+	* Insert a client and return its stored record.
+	*/
+	async createClient(data) {
+		await OAuthClient.create(data, this.#client ? { client: this.#client } : void 0);
+		const client = await this.findClient(data.clientId);
+		if (!client) throw new Error("Failed to reload inserted OAuth client");
+		return client;
+	}
+	/**
+	* Update only the supplied public client fields.
+	*/
+	async updateClient(options) {
+		const values = {};
+		const { data } = options;
+		if (data.name !== void 0) values.name = data.name;
+		if (data.redirectUris !== void 0) values.redirectUris = JSON.stringify(data.redirectUris);
+		if (data.scopes !== void 0) values.scopes = JSON.stringify(data.scopes);
+		if (data.grantTypes !== void 0) values.grantTypes = JSON.stringify(data.grantTypes);
+		if (data.isDisabled !== void 0) values.isDisabled = data.isDisabled;
+		if (data.requirePkce !== void 0) values.requirePkce = data.requirePkce;
+		if (data.metadata !== void 0) values.metadata = data.metadata === null ? null : JSON.stringify(data.metadata);
+		if (Object.keys(values).length === 0) return;
+		values.updatedAt = DateTime.now().toSQL();
+		await this.#query(OAuthClient).where("id", options.id).update(values);
+	}
+	/**
+	* Replace a confidential client's stored secret hash.
+	*/
+	async updateClientSecret(options) {
+		await this.#query(OAuthClient).where("id", options.id).update({
+			clientSecret: options.secret,
+			updatedAt: DateTime.now().toSQL()
+		});
+	}
+	/**
+	* Delete a client and all its associated OAuth records atomically.
+	*/
+	async deleteClient(clientId) {
+		return this.#transaction(async (store) => {
+			const client = await store.findClient(clientId);
+			if (!client) return false;
+			await store.#query(OAuthRefreshToken).where("clientId", clientId).delete();
+			await store.#query(OAuthAccessToken).where("clientId", clientId).delete();
+			await store.#query(OAuthAuthorizationCode).where("clientId", clientId).delete();
+			await store.#query(OAuthPendingAuthorizationRequest).where("clientId", clientId).delete();
+			await store.#query(OAuthConsent).where("clientId", clientId).delete();
+			return this.#affectedRows(await store.#query(OAuthClient).where("id", client.id).delete()) === 1;
+		});
+	}
+	/**
+	* Look up an access-token hash, optionally limited to one client.
+	*/
+	async findAccessToken(options) {
+		const query = this.#query(OAuthAccessToken).where("tokenHash", options.hash);
+		if (options.clientId) query.where("clientId", options.clientId);
+		const token = await query.first();
+		return token ? this.#record(token, ["userId", "revokedAt"]) : null;
+	}
+	/**
+	* Insert a hashed access token.
+	*/
+	async createAccessToken(data) {
+		await OAuthAccessToken.create(data, this.#client ? { client: this.#client } : void 0);
+	}
+	/**
+	* Revoke an active access token owned by the requesting client.
+	*/
+	async revokeAccessToken(options) {
+		const result = await this.#query(OAuthAccessToken).where("tokenHash", options.hash).where("clientId", options.clientId).whereNull("revokedAt").update({
+			revokedAt: options.now.toSQL(),
+			updatedAt: options.now.toSQL()
+		});
+		return this.#affectedRows(result) === 1;
+	}
+	/**
+	* Look up a refresh-token hash owned by a client.
+	*/
+	async findRefreshToken(options) {
+		const token = await this.#query(OAuthRefreshToken).where("token", options.hash).where("clientId", options.clientId).first();
+		return token ? this.#record(token, ["revokedAt"]) : null;
+	}
+	/**
+	* Revoke a refresh token and its associated active access token together.
+	*/
+	async revokeRefreshToken(options) {
+		await this.#transaction(async (store) => {
+			const token = await store.findRefreshToken(options);
+			if (!token) return;
+			const result = await store.#query(OAuthRefreshToken).where("id", token.id).whereNull("revokedAt").update({
+				revokedAt: options.now.toSQL(),
+				updatedAt: options.now.toSQL()
+			});
+			if (this.#affectedRows(result) !== 1) return;
+			await store.#query(OAuthAccessToken).where("id", token.accessTokenId).whereNull("revokedAt").update({
+				revokedAt: options.now.toSQL(),
+				updatedAt: options.now.toSQL()
+			});
+		});
+	}
+	/**
+	* Invalidate a client's token family after refresh-token replay.
+	*/
+	async revokeTokenFamily(options) {
+		await this.#transaction(async (store) => {
+			await store.#query(OAuthRefreshToken).where("clientId", options.clientId).where("userId", options.userId).delete();
+			await store.#query(OAuthAccessToken).where("clientId", options.clientId).where("userId", options.userId).whereNull("revokedAt").update({
+				revokedAt: options.now.toSQL(),
+				updatedAt: options.now.toSQL()
+			});
+		});
+	}
+	/**
+	* Find an authorization-code hash issued to a client.
+	*/
+	async findAuthorizationCode(options) {
+		const code = await this.#query(OAuthAuthorizationCode).where("code", options.code).where("clientId", options.clientId).first();
+		return code ? this.#record(code, [
+			"codeChallenge",
+			"codeChallengeMethod",
+			"nonce"
+		]) : null;
+	}
+	/**
+	* Store a short-lived authorization-code hash.
+	*/
+	async createAuthorizationCode(data) {
+		await OAuthAuthorizationCode.create(data, this.#client ? { client: this.#client } : void 0);
+	}
+	/**
+	* Discard an expired or invalid authorization code.
+	*/
+	async deleteAuthorizationCode(id) {
+		await this.#query(OAuthAuthorizationCode).where("id", id).delete();
+	}
+	/**
+	* Consume a code exactly once and issue its tokens in one transaction.
+	*/
+	async exchangeAuthorizationCode(options) {
+		return this.#transaction(async (store) => {
+			if (this.#affectedRows(await store.#query(OAuthAuthorizationCode).where("id", options.codeId).delete()) !== 1) return false;
+			await store.createAccessToken(options.accessToken);
+			if (options.refreshToken) await OAuthRefreshToken.create(options.refreshToken, { client: store.#client });
+			return true;
+		});
+	}
+	/**
+	* Find a user's current consent for a client.
+	*/
+	async findConsent(options) {
+		const consent = await this.#query(OAuthConsent).where("clientId", options.clientId).where("userId", options.userId).first();
+		return consent ? this.#record(consent) : null;
+	}
+	/**
+	* Merge newly approved scopes into the user's consent.
+	*/
+	async grantConsent(options) {
+		await retryConsentConflict(() => this.#transaction(async (store) => {
+			const row = await store.#query(OAuthConsent).where("clientId", options.clientId).where("userId", options.userId).forUpdate().first();
+			if (row) {
+				const existing = this.#record(row);
+				const scopes = [.../* @__PURE__ */ new Set([...existing.scopes, ...options.scopes])];
+				await store.#query(OAuthConsent).where("id", existing.id).update({
+					scopes: JSON.stringify(scopes),
+					updatedAt: DateTime.now().toSQL()
+				});
+				return;
+			}
+			await OAuthConsent.create({
+				id: crypto.randomUUID(),
+				clientId: options.clientId,
+				userId: options.userId,
+				scopes: options.scopes
+			}, { client: store.#client });
+		}));
+	}
+	/**
+	* Persist an authorization request awaiting user consent.
+	*/
+	async createPendingAuthorizationRequest(data) {
+		await OAuthPendingAuthorizationRequest.create(data, this.#client ? { client: this.#client } : void 0);
+	}
+	/**
+	* Return a valid pending request only to the process that deletes it.
+	*/
+	async consumePendingAuthorizationRequest(options) {
+		const row = await this.#query(OAuthPendingAuthorizationRequest).where("token", options.token).where("userId", options.userId).where("expiresAt", ">", options.now.toSQL()).first();
+		if (!row) return null;
+		if (this.#affectedRows(await this.#query(OAuthPendingAuthorizationRequest).where("id", row.$attributes.id).delete()) !== 1) return null;
+		return this.#record(row, [
+			"state",
+			"codeChallenge",
+			"codeChallengeMethod",
+			"nonce"
+		]);
+	}
+	/**
+	* Persist a new access/refresh pair atomically during the grace period.
+	*/
+	async issueTokenPair(options) {
+		await this.#transaction(async (store) => {
+			await store.createAccessToken(options.accessToken);
+			await OAuthRefreshToken.create(options.refreshToken, { client: store.#client });
+		});
+	}
+	/**
+	* Conditionally consume a refresh token and persist its replacement pair.
+	*/
+	async rotateRefreshToken(options) {
+		return this.#transaction(async (store) => {
+			if (this.#affectedRows(await store.#query(OAuthRefreshToken).where("id", options.oldRefreshTokenId).whereNull("revokedAt").update({
+				revokedAt: options.revokedAt.toSQL(),
+				updatedAt: options.revokedAt.toSQL()
+			})) !== 1) return false;
+			await store.#query(OAuthAccessToken).where("id", options.oldAccessTokenId).whereNull("revokedAt").update({
+				revokedAt: options.revokedAt.toSQL(),
+				updatedAt: options.revokedAt.toSQL()
+			});
+			await store.createAccessToken(options.accessToken);
+			await OAuthRefreshToken.create(options.refreshToken, { client: store.#client });
+			return true;
+		});
+	}
+	/**
+	* Revoke a user's tokens and remove their short-lived OAuth records.
+	*/
+	async revokeAllForUser(options) {
+		await this.#transaction(async (store) => {
+			await store.#query(OAuthAccessToken).where("userId", options.userId).whereNull("revokedAt").update({
+				revokedAt: options.now.toSQL(),
+				updatedAt: options.now.toSQL()
+			});
+			await store.#query(OAuthRefreshToken).where("userId", options.userId).whereNull("revokedAt").update({
+				revokedAt: options.now.toSQL(),
+				updatedAt: options.now.toSQL()
+			});
+			await store.#query(OAuthAuthorizationCode).where("userId", options.userId).delete();
+			await store.#query(OAuthPendingAuthorizationRequest).where("userId", options.userId).delete();
+			await store.#query(OAuthConsent).where("userId", options.userId).delete();
+		});
+	}
+	/**
+	* Remove revoked and aged OAuth records and return per-table counts.
+	*/
+	async purgeTokens(options) {
+		return this.#transaction(async (store) => {
+			const counts = {
+				accessTokens: 0,
+				refreshTokens: 0,
+				authorizationCodes: 0,
+				pendingRequests: 0
+			};
+			if (options.purgeRevoked) {
+				counts.accessTokens += this.#affectedRows(await store.#query(OAuthAccessToken).whereNotNull("revokedAt").delete());
+				counts.refreshTokens += this.#affectedRows(await store.#query(OAuthRefreshToken).whereNotNull("revokedAt").delete());
+			}
+			if (options.purgeExpired) {
+				counts.accessTokens += this.#affectedRows(await store.#query(OAuthAccessToken).where("expiresAt", "<", options.cutoff.toSQL()).whereNull("revokedAt").delete());
+				counts.refreshTokens += this.#affectedRows(await store.#query(OAuthRefreshToken).where("expiresAt", "<", options.cutoff.toSQL()).whereNull("revokedAt").delete());
+				counts.authorizationCodes += this.#affectedRows(await store.#query(OAuthAuthorizationCode).where("expiresAt", "<", options.cutoff.toSQL()).delete());
+			}
+			counts.pendingRequests += this.#affectedRows(await store.#query(OAuthPendingAuthorizationRequest).where("expiresAt", "<", options.now.toSQL()).delete());
+			return counts;
+		});
+	}
+};
+/**
+* Create a Sesame store backed by the application's Lucid connection.
+*/
+function lucidStore() {
+	return new LucidStore();
+}
+//#endregion
+export { LucidStore, OAuthAccessToken, OAuthAuthorizationCode, OAuthClient, OAuthConsent, OAuthPendingAuthorizationRequest, OAuthRefreshToken, lucidStore };

package/build/src/storage/migrations/kysely.d.ts

@@ -0,0 +1,6 @@
+import type { Kysely } from 'kysely';
+/**
+ * Kysely migration for Sesame's OAuth tables.
+ */
+export declare function up(db: Kysely<any>): Promise<void>;
+export declare function down(db: Kysely<any>): Promise<void>;