@julr/sesame 0.6.0 → 0.7.0

package/build/{metadata_controller-BVsTo0Gp.js → metadata_controller-hwfmxlF7.js}

@@ -1,8 +1,6 @@
-import "./chunk-DF48asd8.js";
-import { s as BUILTIN_SCOPES, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import "./oauth_client-BSanvSql.js";
-import { l as E_SERVER_ERROR } from "./oauth_error-C7UhDb2q.js";
-import "./oauth_access_token-Cz_5gNBx.js";
+import { t as BUILTIN_SCOPES } from "./types-DEtn2Zdb.js";
+import { l as E_SERVER_ERROR } from "./oauth_error-CvxtZvjp.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
 //#region src/controllers/metadata_controller.ts
 const DISCOVERY_ROUTE_NAMES = {
 	authorization_endpoint: "sesame.authorize",
@@ -113,7 +111,7 @@ var MetadataController = class {
 			jwks_uri: router.makeUrl("sesame.jwks", {}, { prefixUrl }),
 			subject_types_supported: ["public"],
 			id_token_signing_alg_values_supported: ["RS256"],
-			scopes_supported: [...new Set([
+			scopes_supported: [.../* @__PURE__ */ new Set([
 				"openid",
 				"profile",
 				"email",

package/build/providers/sesame_provider.d.ts

@@ -3,7 +3,7 @@ import type { ApplicationService } from '@adonisjs/core/types';
  * AdonisJS service provider for the Sésame OAuth 2.1 server.
  */
 export default class SesameProvider {
-    protected app: ApplicationService;
+    #private;
     constructor(app: ApplicationService);
     /**
      * Register `SesameManager` as a singleton binding.

package/build/providers/sesame_provider.js

@@ -1,23 +1,23 @@
-import "../chunk-DF48asd8.js";
-import { t as SesameManager } from "../sesame_manager-DYUSZ0NC.js";
-import "../oauth_client-BSanvSql.js";
-import "../oauth_error-C7UhDb2q.js";
-import "../oauth_access_token-Cz_5gNBx.js";
+import { t as SesameManager } from "../sesame_manager-CeEmlzba.js";
 //#region providers/sesame_provider.ts
 /**
 * AdonisJS service provider for the Sésame OAuth 2.1 server.
 */
 var SesameProvider = class {
+	#app;
 	constructor(app) {
-		this.app = app;
+		this.#app = app;
 	}
 	/**
 	* Register `SesameManager` as a singleton binding.
 	* The manager is resolved from the `sesame` config key.
 	*/
 	register() {
-		this.app.container.singleton(SesameManager, async () => {
-			return new SesameManager(this.app.config.get("sesame"), await this.app.container.make("router"));
+		this.#app.container.singleton(SesameManager, async () => {
+			const config = this.#app.config.get("sesame");
+			const router = await this.#app.container.make("router");
+			const store = await config.store.resolver(this.#app);
+			return new SesameManager(config, router, store);
 		});
 	}
 };

package/build/{register_controller-gbq7p8a5.js → register_controller-Cdk3c32j.js}

@@ -1,8 +1,5 @@
-import "./chunk-DF48asd8.js";
-import { o as ClientService, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import { t as OAuthClient } from "./oauth_client-BSanvSql.js";
-import { i as E_INVALID_CLIENT_METADATA, o as E_INVALID_REQUEST, s as E_INVALID_SCOPE, t as E_ACCESS_DENIED } from "./oauth_error-C7UhDb2q.js";
-import "./oauth_access_token-Cz_5gNBx.js";
+import { i as E_INVALID_CLIENT_METADATA, o as E_INVALID_REQUEST, s as E_INVALID_SCOPE, t as E_ACCESS_DENIED } from "./oauth_error-CvxtZvjp.js";
+import { n as ClientService, t as SesameManager } from "./sesame_manager-CeEmlzba.js";
 import vine from "@vinejs/vine";
 //#region src/rules.ts
 const DANGEROUS_SCHEMES = [
@@ -128,7 +125,7 @@ var RegisterController = class RegisterController {
 			...body.software_id ? { software_id: body.software_id } : {},
 			...body.software_version ? { software_version: body.software_version } : {}
 		};
-		await OAuthClient.create({
+		await manager.store.createClient({
 			id: crypto.randomUUID(),
 			clientId,
 			clientSecret: hashedSecret,

package/build/{revoke_controller-z_ghrEB7.js → revoke_controller-Daz4Yqfs.js}

@@ -1,9 +1,5 @@
-import "./chunk-DF48asd8.js";
-import { a as OAuthRefreshToken, o as ClientService, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import "./oauth_client-BSanvSql.js";
-import "./oauth_error-C7UhDb2q.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-Cz_5gNBx.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
+import { n as ClientService, t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
 import { DateTime } from "luxon";
 //#region src/controllers/revoke_controller.ts
 /**
@@ -21,7 +17,9 @@ import { DateTime } from "luxon";
 var RevokeController = class {
 	async handle(ctx) {
 		const manager = await ctx.containerResolver.make(SesameManager);
-		const client = await new ClientService().authenticateClient({
+		const clientService = new ClientService(manager);
+		const store = manager.store;
+		const client = await clientService.authenticateClient({
 			authorizationHeader: ctx.request.header("authorization"),
 			bodyClientId: ctx.request.body().client_id,
 			bodyClientSecret: ctx.request.body().client_secret
@@ -31,22 +29,18 @@ var RevokeController = class {
 		const tokenTypeHint = ctx.request.body().token_type_hint;
 		const hashed = new TokenService(manager).hashToken(token);
 		if (!tokenTypeHint || tokenTypeHint === "access_token") {
-			const record = await OAuthAccessToken.query().where("tokenHash", hashed).where("clientId", client.clientId).first();
-			if (record && !record.revokedAt) {
-				record.revokedAt = DateTime.now();
-				await record.save();
-				return ctx.response.ok({});
-			}
+			if (await store.revokeAccessToken({
+				hash: hashed,
+				clientId: client.clientId,
+				now: DateTime.now()
+			})) return ctx.response.ok({});
 			if (tokenTypeHint === "access_token") return ctx.response.ok({});
 		}
-		if (!tokenTypeHint || tokenTypeHint === "refresh_token") {
-			const refreshToken = await OAuthRefreshToken.query().where("token", hashed).where("clientId", client.clientId).first();
-			if (refreshToken && !refreshToken.revokedAt) {
-				refreshToken.revokedAt = DateTime.now();
-				await refreshToken.save();
-				await OAuthAccessToken.query().where("id", refreshToken.accessTokenId).whereNull("revokedAt").update({ revokedAt: DateTime.now().toSQL() });
-			}
-		}
+		if (!tokenTypeHint || tokenTypeHint === "refresh_token") await store.revokeRefreshToken({
+			hash: hashed,
+			clientId: client.clientId,
+			now: DateTime.now()
+		});
 		return ctx.response.ok({});
 	}
 };

package/build/services/main.js

@@ -1,8 +1,4 @@
-import "../chunk-DF48asd8.js";
-import { t as SesameManager } from "../sesame_manager-DYUSZ0NC.js";
-import "../oauth_client-BSanvSql.js";
-import "../oauth_error-C7UhDb2q.js";
-import "../oauth_access_token-Cz_5gNBx.js";
+import { t as SesameManager } from "../sesame_manager-CeEmlzba.js";
 import app from "@adonisjs/core/services/app";
 //#region services/main.ts
 let sesame;

package/build/{sesame_manager-DYUSZ0NC.js → sesame_manager-CeEmlzba.js}

@@ -1,63 +1,8 @@
-import { n as __decorate, r as json, t as OAuthClient } from "./oauth_client-BSanvSql.js";
-import { o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE } from "./oauth_error-C7UhDb2q.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-Cz_5gNBx.js";
+import { n as OIDC_SCOPES, t as BUILTIN_SCOPES } from "./types-DEtn2Zdb.js";
+import { o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE } from "./oauth_error-CvxtZvjp.js";
 import { DateTime } from "luxon";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { BaseModel, column } from "@adonisjs/lucid/orm";
 import { SignJWT, importJWK } from "jose";
-//#region src/types.ts
-/**
-* Standard OAuth/OIDC scopes that are always valid regardless
-* of server or client scope configuration.
-*
-* These scopes are:
-* - Accepted during scope validation (client and server level)
-* - Advertised in `scopes_supported` of all metadata endpoints
-*   (protected resource, OIDC discovery) so MCP clients know
-*   they can request them
-*
-* - `offline_access`: signals that the client needs a refresh token
-*   (OIDC Core §11). Note: Sesame issues refresh tokens by default
-*   when the `refresh_token` grant is enabled, regardless of whether
-*   the client requests this scope (per RFC 6749 §5.1). This scope
-*   is still advertised for clients that check metadata before
-*   building their authorization request.
-*
-* @see https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
-* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
-*/
-const BUILTIN_SCOPES = new Set(["offline_access"]);
-/**
-* OIDC-recognized scopes that are accepted by server-level validation
-* without needing to be declared in the config `scopes` map.
-*
-* Unlike `BUILTIN_SCOPES`, these still require explicit client authorization
-* via `ClientService.validateClientScopes()`.
-*/
-const OIDC_SCOPES = new Set([
-	"openid",
-	"profile",
-	"email"
-]);
-/**
-* Protocol-managed claims that must never be overridden by `getOidcClaims()`.
-*/
-const RESERVED_OIDC_CLAIMS = new Set([
-	"sub",
-	"iss",
-	"aud",
-	"exp",
-	"iat",
-	"nbf",
-	"jti",
-	"nonce",
-	"at_hash",
-	"auth_time",
-	"acr",
-	"azp",
-	"sid"
-]);
-//#endregion
 //#region src/services/client_service.ts
 /**
 * Handles OAuth client authentication and credential management.
@@ -73,6 +18,10 @@ const RESERVED_OIDC_CLAIMS = new Set([
 * @see https://datatracker.ietf.org/doc/html/rfc6749#section-2.3
 */
 var ClientService = class {
+	#manager;
+	constructor(manager) {
+		this.#manager = manager;
+	}
 	/**
 	* Parse an HTTP Basic Authorization header into client credentials.
 	* Follows RFC 6749 §2.3.1 — the client_id and client_secret are
@@ -117,7 +66,8 @@ var ClientService = class {
 	async authenticateClient(options) {
 		const credentials = this.extractCredentials(options);
 		if (!credentials) throw new E_INVALID_CLIENT("Client authentication failed");
-		const client = await OAuthClient.query().where("clientId", credentials.clientId).first();
+		if (!this.#manager) throw new Error("ClientService requires SesameManager for authentication");
+		const client = await this.#manager.store.findClient(credentials.clientId);
 		if (!client || client.isDisabled) throw new E_INVALID_CLIENT("Client authentication failed");
 		if (!client.isPublic) {
 			if (!credentials.clientSecret || !this.verifySecret(credentials.clientSecret, client.clientSecret)) throw new E_INVALID_CLIENT("Client authentication failed");
@@ -235,16 +185,16 @@ var KeyService = class KeyService {
 * their routes are hit.
 */
 const controllers = {
-	token: () => import("./token_controller-DyI7oy-U.js"),
-	authorize: () => import("./authorize_controller-BiycO4be.js"),
-	consent: () => import("./consent_controller-Dsdhv6-f.js"),
-	introspect: () => import("./introspect_controller-DvOp9scr.js"),
-	revoke: () => import("./revoke_controller-z_ghrEB7.js"),
-	register: () => import("./register_controller-gbq7p8a5.js"),
-	metadata: () => import("./metadata_controller-BVsTo0Gp.js"),
-	clientInfo: () => import("./client_info_controller-AcOG8lWu.js"),
-	jwks: () => import("./jwks_controller-keo4kBZc.js"),
-	userinfo: () => import("./userinfo_controller-RLk8cN_o.js")
+	token: () => import("./token_controller-DRatCQNT.js"),
+	authorize: () => import("./authorize_controller-sCZIjnc-.js"),
+	consent: () => import("./consent_controller-ChBboaSd.js"),
+	introspect: () => import("./introspect_controller-LVYGWhMj.js"),
+	revoke: () => import("./revoke_controller-Daz4Yqfs.js"),
+	register: () => import("./register_controller-Cdk3c32j.js"),
+	metadata: () => import("./metadata_controller-hwfmxlF7.js"),
+	clientInfo: () => import("./client_info_controller-B5A3tpbk.js"),
+	jwks: () => import("./jwks_controller-4HUVS_HC.js"),
+	userinfo: () => import("./userinfo_controller-YwN26wK-.js")
 };
 /**
 * Register OAuth 2.1 endpoint routes on the given router.
@@ -291,127 +241,6 @@ function registerWellKnownRoutes(router, options) {
 	router.get(jwksPath, [controllers.jwks]).as("sesame.jwks");
 }
 //#endregion
-//#region src/models/oauth_refresh_token.ts
-/**
-* Database record for an OAuth 2.0 refresh token (RFC 6749 §6).
-*
-* The `token` column stores the SHA-256 hash of the raw refresh
-* token value. Refresh token rotation is enforced: each use
-* produces a new token and revokes the old one.
-*
-* Replay detection is implemented by checking `revokedAt` —
-* if a revoked token is presented, all tokens for that
-* client+user pair are deleted as a security measure.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
-* @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-4.14.2
-*/
-var OAuthRefreshToken = class extends BaseModel {
-	static table = "oauth_refresh_tokens";
-};
-__decorate([column({ isPrimary: true })], OAuthRefreshToken.prototype, "id", void 0);
-__decorate([column({ serializeAs: null })], OAuthRefreshToken.prototype, "token", void 0);
-__decorate([column()], OAuthRefreshToken.prototype, "accessTokenId", void 0);
-__decorate([column()], OAuthRefreshToken.prototype, "clientId", void 0);
-__decorate([column()], OAuthRefreshToken.prototype, "userId", void 0);
-__decorate([json()], OAuthRefreshToken.prototype, "scopes", void 0);
-__decorate([column.dateTime()], OAuthRefreshToken.prototype, "expiresAt", void 0);
-__decorate([column.dateTime()], OAuthRefreshToken.prototype, "revokedAt", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthRefreshToken.prototype, "createdAt", void 0);
-__decorate([column.dateTime({
-	autoCreate: true,
-	autoUpdate: true
-})], OAuthRefreshToken.prototype, "updatedAt", void 0);
-//#endregion
-//#region src/models/oauth_authorization_code.ts
-/**
-* Database record for an OAuth 2.0 authorization code (RFC 6749 §4.1.2).
-*
-* Authorization codes are short-lived, single-use tokens issued
-* during the authorization flow. The `code` column stores the
-* SHA-256 hash of the raw code value sent to the client.
-*
-* When PKCE (RFC 7636) is used, the `codeChallenge` and
-* `codeChallengeMethod` (always S256) are stored alongside the
-* code for verification at the token endpoint.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2
-* @see https://datatracker.ietf.org/doc/html/rfc7636
-*/
-var OAuthAuthorizationCode = class extends BaseModel {
-	static table = "oauth_authorization_codes";
-};
-__decorate([column({ isPrimary: true })], OAuthAuthorizationCode.prototype, "id", void 0);
-__decorate([column()], OAuthAuthorizationCode.prototype, "code", void 0);
-__decorate([column()], OAuthAuthorizationCode.prototype, "clientId", void 0);
-__decorate([column()], OAuthAuthorizationCode.prototype, "userId", void 0);
-__decorate([json()], OAuthAuthorizationCode.prototype, "scopes", void 0);
-__decorate([column()], OAuthAuthorizationCode.prototype, "redirectUri", void 0);
-__decorate([column()], OAuthAuthorizationCode.prototype, "codeChallenge", void 0);
-__decorate([column()], OAuthAuthorizationCode.prototype, "codeChallengeMethod", void 0);
-__decorate([column()], OAuthAuthorizationCode.prototype, "nonce", void 0);
-__decorate([column.dateTime()], OAuthAuthorizationCode.prototype, "expiresAt", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthAuthorizationCode.prototype, "createdAt", void 0);
-__decorate([column.dateTime({
-	autoCreate: true,
-	autoUpdate: true
-})], OAuthAuthorizationCode.prototype, "updatedAt", void 0);
-//#endregion
-//#region src/models/oauth_consent.ts
-/**
-* Tracks which scopes a user has approved for a given client.
-*
-* When a user grants consent during the authorization flow,
-* the approved scopes are persisted here. On subsequent
-* authorization requests, if the requested scopes are a subset
-* of previously approved scopes, the user is not prompted again.
-*
-* New scopes are merged into the existing record when the user
-* approves additional permissions.
-*/
-var OAuthConsent = class extends BaseModel {
-	static table = "oauth_consents";
-};
-__decorate([column({ isPrimary: true })], OAuthConsent.prototype, "id", void 0);
-__decorate([column()], OAuthConsent.prototype, "clientId", void 0);
-__decorate([column()], OAuthConsent.prototype, "userId", void 0);
-__decorate([json()], OAuthConsent.prototype, "scopes", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthConsent.prototype, "createdAt", void 0);
-__decorate([column.dateTime({
-	autoCreate: true,
-	autoUpdate: true
-})], OAuthConsent.prototype, "updatedAt", void 0);
-//#endregion
-//#region src/models/oauth_pending_authorization_request.ts
-/**
-* Temporary server-side record for an in-flight OAuth authorization
-* request, created when the user is redirected to the consent page
-* and consumed (deleted) when the user approves or denies.
-*
-* Stored in the database instead of the HTTP session to avoid
-* last-write-wins race conditions when concurrent SPA requests
-* overwrite session data.
-*
-* The `token` column stores a SHA-256 hash of the raw auth_token
-* sent to the consent page, consistent with how authorization
-* codes are stored.
-*/
-var OAuthPendingAuthorizationRequest = class extends BaseModel {
-	static table = "oauth_pending_authorization_requests";
-};
-__decorate([column({ isPrimary: true })], OAuthPendingAuthorizationRequest.prototype, "id", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "token", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "userId", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "clientId", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "redirectUri", void 0);
-__decorate([json()], OAuthPendingAuthorizationRequest.prototype, "scopes", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "state", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "codeChallenge", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "codeChallengeMethod", void 0);
-__decorate([column()], OAuthPendingAuthorizationRequest.prototype, "nonce", void 0);
-__decorate([column.dateTime()], OAuthPendingAuthorizationRequest.prototype, "expiresAt", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthPendingAuthorizationRequest.prototype, "createdAt", void 0);
-//#endregion
 //#region src/sesame_manager.ts
 /**
 * Central manager for the Sésame OAuth 2.1 server.
@@ -423,14 +252,28 @@ var SesameManager = class {
 	#config;
 	#router;
 	#keyService;
-	constructor(config, router) {
+	#store;
+	constructor(config, router, store) {
 		this.#config = config;
 		this.#router = router;
+		this.#store = store;
 		this.#keyService = config.jwk ? new KeyService(config.jwk) : null;
 	}
+	#publicClient(client) {
+		const publicClient = { ...client };
+		Object.defineProperty(publicClient, "clientSecret", {
+			value: client.clientSecret,
+			enumerable: false,
+			writable: false
+		});
+		return publicClient;
+	}
 	get config() {
 		return this.#config;
 	}
+	get store() {
+		return this.#store;
+	}
 	get keyService() {
 		if (!this.#keyService) throw new Error("OIDC requires a JWK. Set the `jwk` option in defineConfig().");
 		return this.#keyService;
@@ -496,11 +339,10 @@ var SesameManager = class {
 	*/
 	async revokeAllForUser(userId) {
 		const now = DateTime.now();
-		await OAuthAccessToken.query().where("userId", userId).whereNull("revokedAt").update({ revokedAt: now.toSQL() });
-		await OAuthRefreshToken.query().where("userId", userId).whereNull("revokedAt").update({ revokedAt: now.toSQL() });
-		await OAuthAuthorizationCode.query().where("userId", userId).delete();
-		await OAuthPendingAuthorizationRequest.query().where("userId", userId).delete();
-		await OAuthConsent.query().where("userId", userId).delete();
+		await this.#store.revokeAllForUser({
+			userId,
+			now
+		});
 	}
 	/**
 	* Purge revoked and/or expired tokens and authorization codes.
@@ -516,26 +358,12 @@ var SesameManager = class {
 		const purgeRevoked = revokedOnly || !expiredOnly;
 		const purgeExpired = expiredOnly || !revokedOnly;
 		const cutoff = DateTime.now().minus({ hours: retentionHours });
-		let accessTokens = 0;
-		let refreshTokens = 0;
-		let authorizationCodes = 0;
-		let pendingRequests = 0;
-		if (purgeRevoked) {
-			accessTokens += await this.#deleteCount(OAuthAccessToken.query().whereNotNull("revokedAt").delete());
-			refreshTokens += await this.#deleteCount(OAuthRefreshToken.query().whereNotNull("revokedAt").delete());
-		}
-		if (purgeExpired) {
-			accessTokens += await this.#deleteCount(OAuthAccessToken.query().where("expiresAt", "<", cutoff.toSQL()).whereNull("revokedAt").delete());
-			refreshTokens += await this.#deleteCount(OAuthRefreshToken.query().where("expiresAt", "<", cutoff.toSQL()).whereNull("revokedAt").delete());
-			authorizationCodes += await this.#deleteCount(OAuthAuthorizationCode.query().where("expiresAt", "<", cutoff.toSQL()).delete());
-		}
-		pendingRequests += await this.#deleteCount(OAuthPendingAuthorizationRequest.query().where("expiresAt", "<", DateTime.now().toSQL()).delete());
-		return {
-			accessTokens,
-			refreshTokens,
-			authorizationCodes,
-			pendingRequests
-		};
+		return this.#store.purgeTokens({
+			purgeRevoked,
+			purgeExpired,
+			cutoff,
+			now: DateTime.now()
+		});
 	}
 	/**
 	* Create a new OAuth client programmatically.
@@ -549,22 +377,23 @@ var SesameManager = class {
 		const clientId = clientService.generateClientId();
 		const clientSecret = isPublic ? null : clientService.generateClientSecret();
 		const hashedSecret = clientSecret ? clientService.hashSecret(clientSecret) : null;
+		const client = await this.#store.createClient({
+			id: crypto.randomUUID(),
+			clientId,
+			clientSecret: hashedSecret,
+			name: options.name,
+			redirectUris: options.redirectUris,
+			scopes,
+			grantTypes,
+			isPublic,
+			isDisabled: false,
+			requirePkce: options.requirePkce ?? true,
+			type: isPublic ? "public" : "confidential",
+			metadata: options.metadata ?? null,
+			userId: options.userId ?? null
+		});
 		return {
-			client: await OAuthClient.create({
-				id: crypto.randomUUID(),
-				clientId,
-				clientSecret: hashedSecret,
-				name: options.name,
-				redirectUris: options.redirectUris,
-				scopes,
-				grantTypes,
-				isPublic,
-				isDisabled: false,
-				requirePkce: options.requirePkce ?? true,
-				type: isPublic ? "public" : "confidential",
-				metadata: options.metadata ?? null,
-				userId: options.userId ?? null
-			}),
+			client: this.#publicClient(client),
 			clientSecret
 		};
 	}
@@ -572,22 +401,22 @@ var SesameManager = class {
 	* Find a client by its public client_id.
 	*/
 	async findClient(clientId) {
-		return OAuthClient.query().where("clientId", clientId).first();
+		const client = await this.#store.findClient(clientId);
+		return client ? this.#publicClient(client) : null;
 	}
 	/**
 	* List all clients, optionally filtered by userId.
 	*/
 	async listClients(options) {
-		const query = OAuthClient.query().orderBy("createdAt", "desc");
-		if (options?.userId) query.where("userId", options.userId);
-		return query;
+		return (await this.#store.listClients(options)).map((client) => this.#publicClient(client));
 	}
 	/**
 	* Update an existing client by its public client_id.
 	* Returns the updated client, or null if not found.
 	*/
 	async updateClient(clientId, options) {
-		const client = await OAuthClient.query().where("clientId", clientId).first();
+		const store = this.#store;
+		const client = await store.findClient(clientId);
 		if (!client) return null;
 		if (options.name !== void 0) client.name = options.name;
 		if (options.redirectUris !== void 0) client.redirectUris = options.redirectUris;
@@ -596,39 +425,35 @@ var SesameManager = class {
 		if (options.isDisabled !== void 0) client.isDisabled = options.isDisabled;
 		if (options.requirePkce !== void 0) client.requirePkce = options.requirePkce;
 		if (options.metadata !== void 0) client.metadata = options.metadata;
-		await client.save();
-		return client;
+		await store.updateClient({
+			id: client.id,
+			data: options
+		});
+		const updated = await store.findClient(clientId);
+		return updated ? this.#publicClient(updated) : null;
 	}
 	/**
 	* Delete a client and all its associated tokens, codes, and consents.
 	* Returns true if the client was found and deleted.
 	*/
 	async deleteClient(clientId) {
-		const client = await OAuthClient.query().where("clientId", clientId).first();
-		if (!client) return false;
-		await OAuthClient.transaction(async (trx) => {
-			await Promise.all([
-				OAuthRefreshToken.query({ client: trx }).where("clientId", clientId).delete(),
-				OAuthAccessToken.query({ client: trx }).where("clientId", clientId).delete(),
-				OAuthAuthorizationCode.query({ client: trx }).where("clientId", clientId).delete(),
-				OAuthPendingAuthorizationRequest.query({ client: trx }).where("clientId", clientId).delete(),
-				OAuthConsent.query({ client: trx }).where("clientId", clientId).delete()
-			]);
-			await client.useTransaction(trx).delete();
-		});
-		return true;
+		return this.#store.deleteClient(clientId);
 	}
 	/**
 	* Rotate the secret of a confidential client.
 	* Returns the new raw secret, or null if the client is public or not found.
 	*/
 	async rotateClientSecret(clientId) {
-		const client = await OAuthClient.query().where("clientId", clientId).first();
+		const store = this.#store;
+		const client = await store.findClient(clientId);
 		if (!client || client.isPublic) return null;
 		const clientService = new ClientService();
 		const newSecret = clientService.generateClientSecret();
 		client.clientSecret = clientService.hashSecret(newSecret);
-		await client.save();
+		await store.updateClientSecret({
+			id: client.id,
+			secret: client.clientSecret
+		});
 		return newSecret;
 	}
 	/**
@@ -685,9 +510,6 @@ var SesameManager = class {
 			};
 		});
 	}
-	#deleteCount(result) {
-		return result.then((r) => Array.isArray(r) ? Number(r[0] ?? 0) : Number(r));
-	}
 };
 //#endregion
-export { OAuthRefreshToken as a, OIDC_SCOPES as c, OAuthAuthorizationCode as i, RESERVED_OIDC_CLAIMS as l, OAuthPendingAuthorizationRequest as n, ClientService as o, OAuthConsent as r, BUILTIN_SCOPES as s, SesameManager as t };
+export { ClientService as n, SesameManager as t };

package/build/sesame_manager-DQxvsTEq.js

@@ -0,0 +1,2 @@
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+export { SesameManager };

package/build/src/actions/exchange_authorization_code.d.ts

@@ -1,7 +1,7 @@
 import type { SesameManager } from '../sesame_manager.ts';
-import type { OAuthClient } from '../models/oauth_client.ts';
+import type { OAuthClientRecord } from '../storage/types.ts';
 export interface ExchangeAuthorizationCodeInput {
-    client: OAuthClient;
+    client: OAuthClientRecord;
     code: string;
     redirectUri: string;
     codeVerifier: string;
@@ -24,11 +24,11 @@ export declare class ExchangeAuthorizationCodeAction {
      * consumed atomically inside a transaction.
      */
     execute(manager: SesameManager, input: ExchangeAuthorizationCodeInput): Promise<{
-        id_token?: string | undefined;
-        refresh_token?: string | undefined;
         access_token: string;
-        token_type: "Bearer";
+        token_type: 'Bearer';
         expires_in: number;
         scope: string;
+        refresh_token?: string | undefined;
+        id_token?: string | undefined;
     }>;
 }

package/build/src/actions/exchange_client_credentials.d.ts

@@ -1,7 +1,7 @@
 import type { SesameManager } from '../sesame_manager.ts';
-import type { OAuthClient } from '../models/oauth_client.ts';
+import type { OAuthClientRecord } from '../storage/types.ts';
 export interface ExchangeClientCredentialsInput {
-    client: OAuthClient;
+    client: OAuthClientRecord;
     scope?: string;
 }
 /**
@@ -21,7 +21,7 @@ export declare class ExchangeClientCredentialsAction {
      */
     execute(manager: SesameManager, input: ExchangeClientCredentialsInput): Promise<{
         access_token: string;
-        token_type: "Bearer";
+        token_type: 'Bearer';
         expires_in: number;
         scope: string;
     }>;