@julr/sesame 0.6.0 → 0.7.0

package/README.md

@@ -20,28 +20,88 @@ When you need identity claims on top of authorization, Sésame supports OpenID C
 
 ## Installation
 
+`@adonisjs/auth` is required, including when you use Kysely without Lucid. If your application does not already have it, run `pnpm add @adonisjs/auth` before installing Sésame.
+
 ```bash
 node ace add @julr/sesame
 ```
 
-This will publish the configuration file to `config/sesame.ts`, create six database migration files, and register the service provider and commands. Then run the migrations:
+By default, this publishes `config/sesame.ts`, creates six Lucid migrations, and registers the service provider and commands. Make sure `@adonisjs/lucid` is installed in your application, then run the migrations:
 
 ```bash
 node ace migration:run
 ```
 
+### Kysely installation
+
+You can use Sésame in a Kysely application without installing Lucid. The installer publishes a configuration file and a migration, but it does not connect to the database or create tables automatically.
+
+```bash title="Terminal"
+pnpm add kysely
+node ace add @julr/sesame --store=kysely
+```
+
+The generated `config/sesame.ts` selects the Kysely driver. Its `#services/kysely` import is a placeholder. Replace it with the module that exports your application's existing Kysely connection. For example, if that module exports `appDb` from `#services/database`, configure the store like this:
+
+```ts title="config/sesame.ts"
+import env from '#start/env'
+import { defineConfig, stores } from '@julr/sesame'
+import type { InferScopes } from '@julr/sesame/types'
+
+const sesameConfig = defineConfig({
+  issuer: env.get('APP_URL'),
+  store: stores.kysely({
+    connection: async () => {
+      const { appDb } = await import('#services/database')
+      return appDb
+    },
+  }),
+  scopes: {},
+  defaultScopes: [],
+  grantTypes: ['authorization_code', 'refresh_token'],
+  accessTokenTtl: '1h',
+  refreshTokenTtl: '30d',
+  authorizationCodeTtl: '10m',
+  loginPage: '/login',
+  consentPage: '/oauth/consent',
+  allowDynamicRegistration: false,
+  allowPublicRegistration: false,
+})
+
+export default sesameConfig
+
+declare module '@julr/sesame/types' {
+  interface SesameScopes extends InferScopes<typeof sesameConfig> {}
+}
+```
+
+> [!WARNING]
+> The generated config reads `APP_URL`. Your `start/env.ts` must validate that variable, and its value must be the public URL of the OAuth server, not the frontend URL or a `0.0.0.0` bind address. If your application already validates another public API URL, use that variable for `issuer` instead. Without a validated value, `env.get('APP_URL')` can be `undefined` and TypeScript will reject the config.
+
+The installer writes the complete migration to `database/kysely_migrations/create_oauth_tables.ts`. Keep that generated file in your application as a schema snapshot. When you already have a Kysely migrator, move it into that migrator's `migrationFolder`, give it a filename that sorts after your existing migrations, and run your usual migration command. For example, an application whose migrator reads `database/migrations` should put the file there. Do not pass it to Lucid's `node ace migration:run`.
+
+If Sésame uses its own migration folder, configure a separate [Kysely migrator](https://kysely-org.github.io/kysely-apidoc/classes/migration.Migrator.html) for `database/kysely_migrations` and call `migrateToLatest()` explicitly. Give that migrator unique `migrationTableName` and `migrationLockTableName` values when your application already has another Kysely migrator on the same database. Commit the generated migration so future Sésame upgrades cannot alter a migration you already applied.
+
+The Kysely driver supports SQLite, PostgreSQL, and MySQL. The default tests cover SQLite; `pnpm test:sql` runs the PostgreSQL and MySQL integration suite in temporary Docker containers. For a custom adapter backed by one of these databases, pass its `dialect` explicitly to `stores.kysely()`.
+
+Sésame configures one `store` at a time. It must be an AdonisJS `ConfigProvider<SesameStore>`; the service provider resolves it with the application before creating the manager. Choose `stores.lucid()`, `stores.kysely()`, or a custom driver. To add a custom driver, implement `SesameStore` from `@julr/sesame/types` and wrap it with `configProvider.create()`. The store interface exposes OAuth operations rather than generic CRUD queries. Its `exchangeAuthorizationCode`, `rotateRefreshToken`, and `issueTokenPair` methods must use real database transactions; the first two return `false` when another request consumed the credential first.
+
+Upgrading an existing Lucid application from 0.6.0 requires config and import changes. Follow the [0.6.0 to 0.7.0 migration guide](docs/migration-0.6-to-0.7.md).
+
 ## Configuration
 
 The configuration file lives at `config/sesame.ts`. You define your issuer URL, available scopes, grant types, token lifetimes, and page redirects for the authorization flow.
 
 ```ts title="config/sesame.ts"
 import env from '#start/env'
-import { defineConfig } from '@julr/sesame'
+import { defineConfig, stores } from '@julr/sesame'
 import type { InferScopes } from '@julr/sesame/types'
 
 const sesameConfig = defineConfig({
   issuer: env.get('APP_URL'),
 
+  store: stores.lucid(),
+
   scopes: {
     read: 'Read access',
     write: 'Write access',
@@ -128,7 +188,8 @@ Sésame provides an OAuth guard for `@adonisjs/auth` that verifies opaque Bearer
 
 ```ts title="config/auth.ts"
 import { defineConfig } from '@adonisjs/auth'
-import { oauthGuard, oauthUserProvider } from '@julr/sesame/guard'
+import { oauthGuard } from '@julr/sesame/guard'
+import { oauthUserProvider } from '@julr/sesame/guard/lucid'
 
 const authConfig = defineConfig({
   default: 'web',
@@ -259,12 +320,14 @@ Pass the JWK and a user provider to `defineConfig`. The `oidcProvider` uses the
 
 ```ts title="config/sesame.ts"
 import env from '#start/env'
-import { defineConfig } from '@julr/sesame'
-import { oauthUserProvider } from '@julr/sesame/guard'
+import { defineConfig, stores } from '@julr/sesame'
+import { oauthUserProvider } from '@julr/sesame/guard/lucid'
 
 const sesameConfig = defineConfig({
   issuer: env.get('APP_URL'),
 
+  store: stores.lucid(),
+
   scopes: {
     read: 'Read access',
     write: 'Write access',
@@ -429,7 +492,7 @@ const { client: spa } = await sesame.createClient({
 })
 ```
 
-`createClient` returns the client model and the raw secret. The secret is only available at creation time.
+`createClient` returns a plain client record and the raw secret. The secret is only available at creation time. Client records returned by the public management methods do not serialize the stored `clientSecret` hash.
 
 To find, list, update, or delete clients:
 

package/build/{authorize_controller-BiycO4be.js → authorize_controller-sCZIjnc-.js}

@@ -1,10 +1,7 @@
-import "./chunk-DF48asd8.js";
-import { n as OAuthPendingAuthorizationRequest, o as ClientService, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import { t as OAuthClient } from "./oauth_client-BSanvSql.js";
-import { d as E_UNSUPPORTED_RESPONSE_TYPE, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-C7UhDb2q.js";
-import "./oauth_access_token-Cz_5gNBx.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
-import { t as IssueAuthorizationCodeAction } from "./issue_authorization_code-B9ERu1uO.js";
+import { d as E_UNSUPPORTED_RESPONSE_TYPE, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-CvxtZvjp.js";
+import { n as ClientService, t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
+import { t as IssueAuthorizationCodeAction } from "./issue_authorization_code-Dr4-bbMp.js";
 import { DateTime } from "luxon";
 import string from "@adonisjs/core/helpers/string";
 import vine from "@vinejs/vine";
@@ -28,7 +25,7 @@ var AuthorizeAction = class {
 	*/
 	async execute(manager, input) {
 		if (input.responseType !== "code") throw new E_UNSUPPORTED_RESPONSE_TYPE("Only \"code\" is supported");
-		const client = await OAuthClient.query().where("clientId", input.clientId).first();
+		const client = await manager.store.findClient(input.clientId);
 		if (!client) throw new E_INVALID_CLIENT("Client not found");
 		if (client.isDisabled) throw new E_INVALID_CLIENT("Client is disabled");
 		if (!client.redirectUris.includes(input.redirectUri)) throw new E_INVALID_REQUEST("Invalid redirect_uri");
@@ -99,7 +96,10 @@ var AuthorizeAction = class {
 	* a pending authorization request for the consent page.
 	*/
 	async #resolveConsent(manager, input, client, scopes) {
-		const existingConsent = await OAuthConsent.query().where("clientId", client.clientId).where("userId", input.userId).first();
+		const existingConsent = await manager.store.findConsent({
+			clientId: client.clientId,
+			userId: input.userId
+		});
 		if (existingConsent) {
 			const consentedSet = new Set(existingConsent.scopes);
 			if (scopes.every((s) => consentedSet.has(s))) return {
@@ -129,7 +129,7 @@ var AuthorizeAction = class {
 		const tokenService = new TokenService(manager);
 		const rawToken = tokenService.generateOpaqueToken();
 		const ttl = string.seconds.parse(manager.config.authorizationRequestTtl);
-		await OAuthPendingAuthorizationRequest.create({
+		await manager.store.createPendingAuthorizationRequest({
 			id: crypto.randomUUID(),
 			token: tokenService.hashToken(rawToken),
 			userId: input.userId,

package/build/{client_info_controller-AcOG8lWu.js → client_info_controller-B5A3tpbk.js}

@@ -1,6 +1,5 @@
-import "./chunk-DF48asd8.js";
-import { t as OAuthClient } from "./oauth_client-BSanvSql.js";
-import { o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-C7UhDb2q.js";
+import { o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-CvxtZvjp.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
 import vine from "@vinejs/vine";
 //#region src/controllers/client_info_controller.ts
 /**
@@ -14,7 +13,7 @@ var ClientInfoController = class ClientInfoController {
 	async handle(ctx) {
 		const [error, query] = await ClientInfoController.validator.tryValidate(ctx.request.qs());
 		if (error) throw new E_INVALID_REQUEST("Missing client_id");
-		const client = await OAuthClient.query().where("clientId", query.client_id).first();
+		const client = await (await ctx.containerResolver.make(SesameManager)).store.findClient(query.client_id);
 		if (!client) throw new E_INVALID_CLIENT("Client not found");
 		return {
 			client_id: client.clientId,

package/build/commands/sesame_key.d.ts

@@ -8,5 +8,5 @@ export default class SesameKey extends BaseCommand {
     static description: string;
     raw: boolean;
     writeEnv: boolean;
-    run(): Promise<boolean | void>;
+    run(): Promise<void | boolean>;
 }

package/build/commands/sesame_purge.js

@@ -1,8 +1,5 @@
-import "../chunk-DF48asd8.js";
-import { t as SesameManager } from "../sesame_manager-DYUSZ0NC.js";
-import { n as __decorate } from "../oauth_client-BSanvSql.js";
-import "../oauth_error-C7UhDb2q.js";
-import "../oauth_access_token-Cz_5gNBx.js";
+import { t as SesameManager } from "../sesame_manager-CeEmlzba.js";
+import { t as __decorate } from "../decorate-RQD1h28J.js";
 import { BaseCommand, flags } from "@adonisjs/core/ace";
 //#region commands/sesame_purge.ts
 /**

package/build/{configure-DkDkIlt8.js → configure-t9q3KonY.js}

@@ -3,15 +3,19 @@ import { join } from "node:path";
 async function configure(command) {
 	const codemods = await command.createCodemods();
 	const stubsRoot = join(import.meta.dirname, "stubs");
-	await codemods.makeUsingStub(stubsRoot, "config/sesame.stub", {});
-	for (const stub of [
+	const store = command.parsedFlags.store ?? "lucid";
+	if (store !== "lucid" && store !== "kysely") throw new Error("Invalid Sesame store. Use --store=lucid or --store=kysely");
+	const configStub = store === "kysely" ? "config/sesame_kysely.stub" : "config/sesame.stub";
+	await codemods.makeUsingStub(stubsRoot, configStub, {});
+	const migrationStubs = store === "kysely" ? ["migrations/kysely/create_oauth_tables.stub"] : [
 		"migrations/create_oauth_clients_table.stub",
 		"migrations/create_oauth_authorization_codes_table.stub",
 		"migrations/create_oauth_access_tokens_table.stub",
 		"migrations/create_oauth_refresh_tokens_table.stub",
 		"migrations/create_oauth_consents_table.stub",
 		"migrations/create_oauth_pending_authorization_requests_table.stub"
-	]) await codemods.makeUsingStub(stubsRoot, stub, {});
+	];
+	for (const stub of migrationStubs) await codemods.makeUsingStub(stubsRoot, stub, {});
 	await codemods.updateRcFile((rcFile) => {
 		rcFile.addProvider("@julr/sesame/sesame_provider").addCommand("@julr/sesame/commands");
 	});

package/build/configure.js

@@ -1,3 +1,2 @@
-import "./chunk-DF48asd8.js";
-import { t as configure } from "./configure-DkDkIlt8.js";
+import { t as configure } from "./configure-t9q3KonY.js";
 export { configure };

package/build/{consent_controller-Dsdhv6-f.js → consent_controller-ChBboaSd.js}

@@ -1,10 +1,7 @@
-import "./chunk-DF48asd8.js";
-import { n as OAuthPendingAuthorizationRequest, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import { t as OAuthClient } from "./oauth_client-BSanvSql.js";
-import { a as E_INVALID_GRANT, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-C7UhDb2q.js";
-import "./oauth_access_token-Cz_5gNBx.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
-import { t as IssueAuthorizationCodeAction } from "./issue_authorization_code-B9ERu1uO.js";
+import { a as E_INVALID_GRANT, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-CvxtZvjp.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
+import { t as IssueAuthorizationCodeAction } from "./issue_authorization_code-Dr4-bbMp.js";
 import { DateTime } from "luxon";
 import vine from "@vinejs/vine";
 //#region src/controllers/consent_controller.ts
@@ -37,14 +34,14 @@ var ConsentController = class ConsentController {
 		if (error) throw new E_INVALID_REQUEST("Missing required parameter: auth_token");
 		const userId = String(user.id);
 		const hashedToken = new TokenService(manager).hashToken(body.auth_token);
-		const pendingRequest = await this.#consumePendingRequest(hashedToken, userId);
+		const pendingRequest = await this.#consumePendingRequest(manager, hashedToken, userId);
 		if (!pendingRequest) throw new E_INVALID_GRANT("Authorization request not found or expired");
-		const client = await OAuthClient.query().where("clientId", pendingRequest.clientId).first();
+		const client = await manager.store.findClient(pendingRequest.clientId);
 		if (!client) throw new E_INVALID_CLIENT("Client not found");
 		if (client.isDisabled) throw new E_INVALID_CLIENT("Client is disabled");
 		if (!client.redirectUris.includes(pendingRequest.redirectUri)) throw new E_INVALID_REQUEST("Invalid redirect_uri");
 		if (!ctx.request.body().accept) return this.#redirectWithDenied(ctx, manager, pendingRequest);
-		await this.#persistConsent(client.clientId, userId, pendingRequest.scopes);
+		await this.#persistConsent(manager, client.clientId, userId, pendingRequest.scopes);
 		const code = await new IssueAuthorizationCodeAction().execute(manager, {
 			client,
 			userId,
@@ -61,31 +58,22 @@ var ConsentController = class ConsentController {
 		return ctx.response.redirect().toPath(url.toString());
 	}
 	/**
-	* Atomically consume a pending authorization request.
-	* Uses DELETE-by-PK with affected-row check to prevent
-	* concurrent consent submissions from producing two
-	* authorization codes.
+	* Atomically consume a pending authorization request so concurrent
+	* consent submissions cannot produce two authorization codes.
 	*/
-	async #consumePendingRequest(hashedToken, userId) {
-		const row = await OAuthPendingAuthorizationRequest.query().where("token", hashedToken).where("userId", userId).where("expiresAt", ">", DateTime.now().toSQL()).first();
-		if (!row) return null;
-		const deleted = await OAuthPendingAuthorizationRequest.query().where("id", row.id).delete();
-		if ((Array.isArray(deleted) ? Number(deleted[0]) : Number(deleted)) === 0) return null;
-		return row;
+	async #consumePendingRequest(manager, hashedToken, userId) {
+		return manager.store.consumePendingAuthorizationRequest({
+			token: hashedToken,
+			userId,
+			now: DateTime.now()
+		});
 	}
 	/**
 	* Persist or merge consent so future authorization requests
 	* for the same client skip the consent screen.
 	*/
-	async #persistConsent(clientId, userId, scopes) {
-		const existingConsent = await OAuthConsent.query().where("clientId", clientId).where("userId", userId).first();
-		if (existingConsent) {
-			existingConsent.scopes = [...new Set([...existingConsent.scopes, ...scopes])];
-			await existingConsent.save();
-			return;
-		}
-		await OAuthConsent.create({
-			id: crypto.randomUUID(),
+	async #persistConsent(manager, clientId, userId, scopes) {
+		await manager.store.grantConsent({
 			clientId,
 			userId,
 			scopes

package/build/consent_retry-DMkfhmk9.js

@@ -0,0 +1,41 @@
+//#region src/storage/consent_retry.ts
+const RETRYABLE_CODES = /* @__PURE__ */ new Set([
+	"23505",
+	"40001",
+	"40P01",
+	"ER_DUP_ENTRY",
+	"ER_LOCK_DEADLOCK",
+	"ER_LOCK_WAIT_TIMEOUT",
+	"SQLITE_BUSY",
+	"SQLITE_BUSY_SNAPSHOT",
+	"SQLITE_CONSTRAINT_UNIQUE"
+]);
+const RETRYABLE_ERRNOS = /* @__PURE__ */ new Set([
+	1062,
+	1205,
+	1213
+]);
+/**
+* Identify database conflicts that can be retried in a fresh transaction.
+*/
+function isRetryableConsentConflict(error) {
+	if (!error || typeof error !== "object") return false;
+	const candidate = error;
+	if (typeof candidate.code === "string" && RETRYABLE_CODES.has(candidate.code)) return true;
+	if (typeof candidate.errno === "number" && RETRYABLE_ERRNOS.has(candidate.errno)) return true;
+	return candidate.cause ? isRetryableConsentConflict(candidate.cause) : false;
+}
+/**
+* Retry consent writes after uniqueness, serialization, or lock conflicts.
+*/
+async function retryConsentConflict(operation) {
+	for (let attempt = 1; attempt <= 3; attempt++) try {
+		return await operation();
+	} catch (error) {
+		if (attempt === 3 || !isRetryableConsentConflict(error)) throw error;
+		await new Promise((resolve) => setTimeout(resolve, attempt * 5));
+	}
+	throw new Error("Consent retry limit exceeded");
+}
+//#endregion
+export { retryConsentConflict as t };

package/build/decorate-RQD1h28J.js

@@ -0,0 +1,9 @@
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+export { __decorate as t };

package/build/{id_token_service-CpTzOUDe.js → id_token_service-BtBUiL_n.js}

@@ -1,4 +1,4 @@
-import { l as RESERVED_OIDC_CLAIMS } from "./sesame_manager-DYUSZ0NC.js";
+import { r as RESERVED_OIDC_CLAIMS } from "./types-DEtn2Zdb.js";
 import { createHash } from "node:crypto";
 import string from "@adonisjs/core/helpers/string";
 //#region src/services/id_token_service.ts

package/build/index.d.ts

@@ -1,12 +1,6 @@
 export { configure } from './configure.ts';
 export { defineConfig } from './src/define_config.ts';
+export { stores } from './src/stores.ts';
 export { SesameManager } from './src/sesame_manager.ts';
-export type { CreateClientOptions, CreateClientResult, UpdateClientOptions } from './src/types.ts';
-export { OAuthClient } from './src/models/oauth_client.ts';
-export { OAuthAccessToken } from './src/models/oauth_access_token.ts';
-export { OAuthRefreshToken } from './src/models/oauth_refresh_token.ts';
-export { OAuthAuthorizationCode } from './src/models/oauth_authorization_code.ts';
-export { OAuthConsent } from './src/models/oauth_consent.ts';
 export { OAuthGuard } from './src/guard/guard.ts';
-export { OAuthLucidUserProvider } from './src/guard/user_provider.ts';
-export { oauthGuard, oauthUserProvider } from './src/guard/main.ts';
+export { oauthGuard } from './src/guard/main.ts';

package/build/index.js

@@ -1,11 +1,8 @@
-import "./chunk-DF48asd8.js";
-import { t as configure } from "./configure-DkDkIlt8.js";
-import { a as OAuthRefreshToken, i as OAuthAuthorizationCode, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import { t as OAuthClient } from "./oauth_client-BSanvSql.js";
-import "./oauth_error-C7UhDb2q.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-Cz_5gNBx.js";
-import "./token_service-DwnfAR9F.js";
-import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t as oauthGuard } from "./main-DGBJhq3E.js";
+import { t as configure } from "./configure-t9q3KonY.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { n as OAuthGuard, t as oauthGuard } from "./main-Dx9kZv07.js";
+import { InvalidArgumentsException } from "@adonisjs/core/exceptions";
+import { configProvider } from "@adonisjs/core";
 //#region src/define_config.ts
 /**
 * Resolve user-supplied `SesameConfig` into a `ResolvedSesameConfig`
@@ -22,7 +19,9 @@ import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t
 * - `allowPublicRegistration`: `false`
 */
 function defineConfig(config) {
+	if (!config.store) throw new InvalidArgumentsException("Missing \"store\" in Sesame config");
 	return {
+		store: config.store,
 		issuer: config.issuer,
 		scopes: config.scopes ?? {},
 		defaultScopes: config.defaultScopes ?? [],
@@ -43,4 +42,34 @@ function defineConfig(config) {
 	};
 }
 //#endregion
-export { OAuthAccessToken, OAuthAuthorizationCode, OAuthClient, OAuthConsent, OAuthGuard, OAuthLucidUserProvider, OAuthRefreshToken, SesameManager, configure, defineConfig, oauthGuard, oauthUserProvider };
+//#region src/stores.ts
+/**
+* Store driver factories resolved by the AdonisJS service provider.
+*/
+const stores = {
+	/**
+	* Use the application's Lucid connection for OAuth persistence.
+	*/
+	lucid() {
+		return configProvider.create(async (app) => {
+			await app.container.make("lucid.db");
+			const { lucidStore } = await import("./src/storage/drivers/lucid.js");
+			return lucidStore();
+		});
+	},
+	/**
+	* Use an existing Kysely connection for OAuth persistence.
+	*/
+	kysely(options) {
+		return configProvider.create(async (app) => {
+			const connection = typeof options.connection === "function" ? await options.connection(app) : options.connection;
+			const { kyselyStore } = await import("./src/storage/drivers/kysely.js");
+			return kyselyStore({
+				db: connection,
+				dialect: options.dialect
+			});
+		});
+	}
+};
+//#endregion
+export { OAuthGuard, SesameManager, configure, defineConfig, oauthGuard, stores };

package/build/{introspect_controller-DvOp9scr.js → introspect_controller-LVYGWhMj.js}

@@ -1,9 +1,5 @@
-import "./chunk-DF48asd8.js";
-import { a as OAuthRefreshToken, o as ClientService, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import "./oauth_client-BSanvSql.js";
-import "./oauth_error-C7UhDb2q.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-Cz_5gNBx.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
+import { n as ClientService, t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
 //#region src/controllers/introspect_controller.ts
 const INACTIVE = { active: false };
 /**
@@ -22,7 +18,9 @@ const INACTIVE = { active: false };
 var IntrospectController = class {
 	async handle(ctx) {
 		const manager = await ctx.containerResolver.make(SesameManager);
-		const client = await new ClientService().authenticateClient({
+		const clientService = new ClientService(manager);
+		const store = manager.store;
+		const client = await clientService.authenticateClient({
 			authorizationHeader: ctx.request.header("authorization"),
 			bodyClientId: ctx.request.body().client_id,
 			bodyClientSecret: ctx.request.body().client_secret
@@ -32,7 +30,10 @@ var IntrospectController = class {
 		const tokenTypeHint = ctx.request.body().token_type_hint;
 		const hashed = new TokenService(manager).hashToken(token);
 		if (!tokenTypeHint || tokenTypeHint === "access_token") {
-			const record = await OAuthAccessToken.query().where("tokenHash", hashed).where("clientId", client.clientId).first();
+			const record = await store.findAccessToken({
+				hash: hashed,
+				clientId: client.clientId
+			});
 			if (record && !record.revokedAt && record.expiresAt.toJSDate() >= /* @__PURE__ */ new Date()) return {
 				active: true,
 				token_type: "Bearer",
@@ -46,7 +47,10 @@ var IntrospectController = class {
 			if (tokenTypeHint === "access_token") return INACTIVE;
 		}
 		if (!tokenTypeHint || tokenTypeHint === "refresh_token") {
-			const refreshToken = await OAuthRefreshToken.query().where("token", hashed).where("clientId", client.clientId).first();
+			const refreshToken = await store.findRefreshToken({
+				hash: hashed,
+				clientId: client.clientId
+			});
 			if (!refreshToken) return INACTIVE;
 			if (refreshToken.revokedAt) return INACTIVE;
 			if (refreshToken.expiresAt.toJSDate() < /* @__PURE__ */ new Date()) return INACTIVE;

package/build/{issue_authorization_code-B9ERu1uO.js → issue_authorization_code-Dr4-bbMp.js}

@@ -1,5 +1,4 @@
-import { i as OAuthAuthorizationCode } from "./sesame_manager-DYUSZ0NC.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
 import { DateTime } from "luxon";
 import string from "@adonisjs/core/helpers/string";
 //#region src/actions/issue_authorization_code.ts
@@ -21,7 +20,7 @@ var IssueAuthorizationCodeAction = class {
 		const raw = tokenService.generateOpaqueToken();
 		const hashed = tokenService.hashToken(raw);
 		const ttl = string.seconds.parse(manager.config.authorizationCodeTtl);
-		await OAuthAuthorizationCode.create({
+		await manager.store.createAuthorizationCode({
 			id: crypto.randomUUID(),
 			code: hashed,
 			clientId: input.client.clientId,

package/build/{jwks_controller-keo4kBZc.js → jwks_controller-4HUVS_HC.js}

@@ -1,8 +1,4 @@
-import "./chunk-DF48asd8.js";
-import { t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import "./oauth_client-BSanvSql.js";
-import "./oauth_error-C7UhDb2q.js";
-import "./oauth_access_token-Cz_5gNBx.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
 //#region src/controllers/jwks_controller.ts
 /**
 * Serves the JSON Web Key Set (JWKS) containing public keys

package/build/{main-DGBJhq3E.js → main-Dx9kZv07.js}

@@ -1,8 +1,5 @@
-import { t as OAuthClient } from "./oauth_client-BSanvSql.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-Cz_5gNBx.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
 import { DateTime } from "luxon";
-import { RuntimeException } from "@adonisjs/core/exceptions";
 import { errors } from "@adonisjs/auth";
 //#region src/guard/guard.ts
 /**
@@ -66,7 +63,7 @@ var OAuthGuard = class {
 		const tokenService = new TokenService(this.#manager);
 		const includeError = { includeError: true };
 		const hashed = tokenService.hashToken(rawToken);
-		const record = await OAuthAccessToken.query().where("tokenHash", hashed).first();
+		const record = await this.#manager.store.findAccessToken({ hash: hashed });
 		if (!record) throw this.#authenticationFailed("Invalid or expired token", includeError);
 		if (record.revokedAt) throw this.#authenticationFailed("Invalid or expired token", includeError);
 		if (record.expiresAt.toJSDate() < /* @__PURE__ */ new Date()) throw this.#authenticationFailed("Invalid or expired token", includeError);
@@ -109,19 +106,26 @@ var OAuthGuard = class {
 	async authenticateAsClient(user) {
 		const tokenService = new TokenService(this.#manager);
 		const defaultScopes = this.#manager.config.defaultScopes;
-		const testClient = await OAuthClient.firstOrCreate({ clientId: "__test_client__" }, {
+		const store = this.#manager.store;
+		let testClient = await store.findClient("__test_client__");
+		if (!testClient) testClient = await store.createClient({
 			id: crypto.randomUUID(),
 			clientId: "__test_client__",
+			clientSecret: null,
 			name: "Test Client",
 			redirectUris: ["http://localhost/callback"],
 			grantTypes: ["authorization_code"],
 			scopes: defaultScopes,
 			isPublic: true,
-			requirePkce: false
+			isDisabled: false,
+			requirePkce: false,
+			type: "public",
+			metadata: null,
+			userId: null
 		});
 		const userId = String(user.id ?? user.getId?.() ?? "test-user");
 		const { raw, hash, expiresAt } = tokenService.createAccessToken();
-		await OAuthAccessToken.create({
+		await store.createAccessToken({
 			id: crypto.randomUUID(),
 			tokenHash: hash,
 			clientId: testClient.clientId,
@@ -133,42 +137,6 @@ var OAuthGuard = class {
 	}
 };
 //#endregion
-//#region src/guard/user_provider.ts
-/**
-* Lucid-based user provider for the OAuth guard.
-* Lazily loads the model and wraps instances as guard users.
-*/
-var OAuthLucidUserProvider = class {
-	#model;
-	#options;
-	constructor(options) {
-		this.#options = options;
-	}
-	async #getModel() {
-		if (this.#model && !("hot" in import.meta)) return this.#model;
-		this.#model = (await this.#options.model()).default;
-		return this.#model;
-	}
-	async createUserForGuard(user) {
-		const model = await this.#getModel();
-		if (user instanceof model === false) throw new RuntimeException(`Invalid user object. It must be an instance of the "${model.name}" model`);
-		return {
-			getId() {
-				if (!user.$primaryKeyValue) throw new RuntimeException(`Cannot use "${model.name}" model for authentication. The value of column "${model.primaryKey}" is undefined or null`);
-				return user.$primaryKeyValue;
-			},
-			getOriginal() {
-				return user;
-			}
-		};
-	}
-	async findById(identifier) {
-		const user = await (await this.#getModel()).find(identifier);
-		if (!user) return null;
-		return this.createUserForGuard(user);
-	}
-};
-//#endregion
 //#region src/guard/main.ts
 /**
 * Configure the OAuth guard for `@adonisjs/auth`.
@@ -176,16 +144,10 @@ var OAuthLucidUserProvider = class {
 function oauthGuard(config) {
 	return { async resolver(name, app) {
 		const emitter = await app.container.make("emitter");
-		const { SesameManager } = await import("./sesame_manager-B1Jgq1v2.js");
+		const { SesameManager } = await import("./sesame_manager-DQxvsTEq.js");
 		const manager = await app.container.make(SesameManager);
 		return (ctx) => new OAuthGuard(name, ctx, emitter, config.provider, manager, config.resource);
 	} };
 }
-/**
-* Create a Lucid-based user provider for the OAuth guard.
-*/
-function oauthUserProvider(options) {
-	return new OAuthLucidUserProvider(options);
-}
 //#endregion
-export { OAuthGuard as i, oauthUserProvider as n, OAuthLucidUserProvider as r, oauthGuard as t };
+export { OAuthGuard as n, oauthGuard as t };