@julr/sesame 0.6.0 → 0.7.0

package/build/{token_controller-DyI7oy-U.js → token_controller-DRatCQNT.js}

@@ -1,10 +1,8 @@
-import "./chunk-DF48asd8.js";
-import { a as OAuthRefreshToken, c as OIDC_SCOPES, i as OAuthAuthorizationCode, o as ClientService, s as BUILTIN_SCOPES, t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import "./oauth_client-BSanvSql.js";
-import { a as E_INVALID_GRANT, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE, u as E_UNSUPPORTED_GRANT_TYPE } from "./oauth_error-C7UhDb2q.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-Cz_5gNBx.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
-import { t as IdTokenService } from "./id_token_service-CpTzOUDe.js";
+import { n as OIDC_SCOPES, t as BUILTIN_SCOPES } from "./types-DEtn2Zdb.js";
+import { a as E_INVALID_GRANT, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE, u as E_UNSUPPORTED_GRANT_TYPE } from "./oauth_error-CvxtZvjp.js";
+import { n as ClientService, t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
+import { t as IdTokenService } from "./id_token_service-BtBUiL_n.js";
 import { DateTime } from "luxon";
 import { createHash } from "node:crypto";
 import string from "@adonisjs/core/helpers/string";
@@ -35,13 +33,13 @@ var ExchangeAuthorizationCodeAction = class {
 		const tokenService = new TokenService(manager);
 		const clientService = new ClientService();
 		if (!input.client.grantTypes.includes("authorization_code")) throw new E_INVALID_CLIENT("Client is not allowed to use the authorization_code grant");
-		const authCode = await this.#validateAuthorizationCode(tokenService, input);
-		await this.#verifyPkce(input.codeVerifier, authCode);
+		const authCode = await this.#validateAuthorizationCode(manager, tokenService, input);
+		await this.#verifyPkce(manager, input.codeVerifier, authCode);
 		clientService.validateClientScopes(authCode.scopes, input.client.scopes);
 		const accessToken = tokenService.createAccessToken();
 		const refreshToken = this.#prepareRefreshToken(manager, tokenService);
 		const idToken = await this.#prepareIdToken(manager, authCode, input.client, accessToken.raw);
-		await this.#atomicExchange(input, authCode, accessToken, refreshToken);
+		await this.#atomicExchange(manager, input, authCode, accessToken, refreshToken);
 		const ttlSeconds = string.seconds.parse(manager.config.accessTokenTtl);
 		return {
 			access_token: accessToken.raw,
@@ -56,14 +54,18 @@ var ExchangeAuthorizationCodeAction = class {
 	* Lookup the authorization code by hash and validate
 	* it has not expired and matches the redirect_uri.
 	*/
-	async #validateAuthorizationCode(tokenService, input) {
+	async #validateAuthorizationCode(manager, tokenService, input) {
 		if (!input.code) throw new E_INVALID_REQUEST("Missing required parameter: code");
 		if (!input.redirectUri) throw new E_INVALID_REQUEST("Missing required parameter: redirect_uri");
 		const hashedCode = tokenService.hashToken(input.code);
-		const authCode = await OAuthAuthorizationCode.query().where("code", hashedCode).where("clientId", input.client.clientId).first();
+		const store = manager.store;
+		const authCode = await store.findAuthorizationCode({
+			code: hashedCode,
+			clientId: input.client.clientId
+		});
 		if (!authCode) throw new E_INVALID_GRANT("Authorization code not found");
 		if (authCode.expiresAt < DateTime.now()) {
-			await OAuthAuthorizationCode.query().where("id", authCode.id).delete();
+			await store.deleteAuthorizationCode(authCode.id);
 			throw new E_INVALID_GRANT("Authorization code has expired");
 		}
 		if (authCode.redirectUri !== input.redirectUri) throw new E_INVALID_GRANT("Redirect URI mismatch");
@@ -73,18 +75,19 @@ var ExchangeAuthorizationCodeAction = class {
 	* Verify the PKCE code_verifier against the stored
 	* code_challenge using S256 (mandatory per OAuth 2.1).
 	*/
-	async #verifyPkce(codeVerifier, authCode) {
+	async #verifyPkce(manager, codeVerifier, authCode) {
+		const store = manager.store;
 		const [verifierError] = await codeVerifierValidator.tryValidate({ code_verifier: codeVerifier });
 		if (verifierError) {
-			await OAuthAuthorizationCode.query().where("id", authCode.id).delete();
+			await store.deleteAuthorizationCode(authCode.id);
 			throw new E_INVALID_REQUEST("code_verifier must be 43-128 characters using only [A-Za-z0-9-._~] (RFC 7636 §4.1)");
 		}
 		if (!authCode.codeChallenge) {
-			await OAuthAuthorizationCode.query().where("id", authCode.id).delete();
+			await store.deleteAuthorizationCode(authCode.id);
 			throw new E_INVALID_GRANT("Authorization code is missing PKCE challenge");
 		}
 		if (createHash("sha256").update(codeVerifier).digest("base64url") !== authCode.codeChallenge) {
-			await OAuthAuthorizationCode.query().where("id", authCode.id).delete();
+			await store.deleteAuthorizationCode(authCode.id);
 			throw new E_INVALID_GRANT("PKCE verification failed");
 		}
 	}
@@ -125,20 +128,20 @@ var ExchangeAuthorizationCodeAction = class {
 	* the new access token (and optionally refresh token)
 	* inside a single transaction.
 	*/
-	async #atomicExchange(input, authCode, accessToken, refreshToken) {
-		await OAuthAuthorizationCode.transaction(async (trx) => {
-			const deleteResult = await OAuthAuthorizationCode.query({ client: trx }).where("id", authCode.id).delete();
-			if ((Array.isArray(deleteResult) ? Number(deleteResult[0] ?? 0) : Number(deleteResult)) !== 1) throw new E_INVALID_GRANT("Authorization code has already been consumed");
-			const accessTokenId = crypto.randomUUID();
-			await OAuthAccessToken.create({
+	async #atomicExchange(manager, input, authCode, accessToken, refreshToken) {
+		const store = manager.store;
+		const accessTokenId = crypto.randomUUID();
+		if (!await store.exchangeAuthorizationCode({
+			codeId: authCode.id,
+			accessToken: {
 				id: accessTokenId,
 				tokenHash: accessToken.hash,
 				clientId: input.client.clientId,
 				userId: authCode.userId,
 				scopes: authCode.scopes,
 				expiresAt: DateTime.fromJSDate(accessToken.expiresAt)
-			}, { client: trx });
-			if (refreshToken) await OAuthRefreshToken.create({
+			},
+			refreshToken: refreshToken ? {
 				id: crypto.randomUUID(),
 				token: refreshToken.hash,
 				accessTokenId,
@@ -146,8 +149,8 @@ var ExchangeAuthorizationCodeAction = class {
 				userId: authCode.userId,
 				scopes: authCode.scopes,
 				expiresAt: refreshToken.expiresAt
-			}, { client: trx });
-		});
+			} : null
+		})) throw new E_INVALID_GRANT("Authorization code has already been consumed");
 	}
 };
 //#endregion
@@ -200,13 +203,16 @@ var ExchangeRefreshTokenAction = class {
 		if (!input.refreshToken) throw new E_INVALID_REQUEST("Missing required parameter: refresh_token");
 		if (!input.client.grantTypes.includes("refresh_token")) throw new E_INVALID_CLIENT("Client is not allowed to use the refresh_token grant");
 		const hashedToken = tokenService.hashToken(input.refreshToken);
-		const refreshToken = await OAuthRefreshToken.query().where("token", hashedToken).where("clientId", input.client.clientId).first();
+		const refreshToken = await manager.store.findRefreshToken({
+			hash: hashedToken,
+			clientId: input.client.clientId
+		});
 		if (!refreshToken) throw new E_INVALID_GRANT("Refresh token not found");
 		if (refreshToken.revokedAt) {
 			const gracePeriodSeconds = manager.config.refreshTokenRotationGracePeriod;
 			const revokedSecondsAgo = DateTime.now().diff(refreshToken.revokedAt, "seconds").seconds;
 			if (gracePeriodSeconds <= 0 || revokedSecondsAgo > gracePeriodSeconds) {
-				await this.#nukeTokensForReplay(input.client.clientId, refreshToken.userId);
+				await this.#nukeTokensForReplay(manager, input.client.clientId, refreshToken.userId);
 				throw new E_INVALID_GRANT("Refresh token has been revoked (possible replay attack)");
 			}
 			/**
@@ -223,7 +229,7 @@ var ExchangeRefreshTokenAction = class {
 		const accessToken = tokenService.createAccessToken();
 		const newRefreshToken = this.#prepareRefreshToken(manager, tokenService);
 		const idToken = await this.#prepareIdToken(manager, scopes, refreshToken, input.client, accessToken.raw);
-		await this.#atomicRotation(input, refreshToken, accessToken, newRefreshToken, scopes);
+		await this.#atomicRotation(manager, input, refreshToken, accessToken, newRefreshToken, scopes);
 		const ttlSeconds = string.seconds.parse(manager.config.accessTokenTtl);
 		return {
 			access_token: accessToken.raw,
@@ -248,22 +254,24 @@ var ExchangeRefreshTokenAction = class {
 		const newRefreshToken = this.#prepareRefreshToken(manager, tokenService);
 		const idToken = await this.#prepareIdToken(manager, scopes, revokedRefreshToken, input.client, accessToken.raw);
 		const accessTokenId = crypto.randomUUID();
-		await OAuthAccessToken.create({
-			id: accessTokenId,
-			tokenHash: accessToken.hash,
-			clientId: input.client.clientId,
-			userId: revokedRefreshToken.userId,
-			scopes,
-			expiresAt: DateTime.fromJSDate(accessToken.expiresAt)
-		});
-		await OAuthRefreshToken.create({
-			id: crypto.randomUUID(),
-			token: newRefreshToken.hash,
-			accessTokenId,
-			clientId: input.client.clientId,
-			userId: revokedRefreshToken.userId,
-			scopes,
-			expiresAt: newRefreshToken.expiresAt
+		await manager.store.issueTokenPair({
+			accessToken: {
+				id: accessTokenId,
+				tokenHash: accessToken.hash,
+				clientId: input.client.clientId,
+				userId: revokedRefreshToken.userId,
+				scopes,
+				expiresAt: DateTime.fromJSDate(accessToken.expiresAt)
+			},
+			refreshToken: {
+				id: crypto.randomUUID(),
+				token: newRefreshToken.hash,
+				accessTokenId,
+				clientId: input.client.clientId,
+				userId: revokedRefreshToken.userId,
+				scopes,
+				expiresAt: newRefreshToken.expiresAt
+			}
 		});
 		const ttlSeconds = string.seconds.parse(manager.config.accessTokenTtl);
 		return {
@@ -279,9 +287,12 @@ var ExchangeRefreshTokenAction = class {
 	* Replay detection: nuke all tokens for this client+user
 	* pair when a revoked token is reused.
 	*/
-	async #nukeTokensForReplay(clientId, userId) {
-		await OAuthRefreshToken.query().where("clientId", clientId).where("userId", userId).delete();
-		await OAuthAccessToken.query().where("clientId", clientId).where("userId", userId).whereNull("revokedAt").update({ revokedAt: DateTime.now().toSQL() });
+	async #nukeTokensForReplay(manager, clientId, userId) {
+		await manager.store.revokeTokenFamily({
+			clientId,
+			userId,
+			now: DateTime.now()
+		});
 	}
 	/**
 	* Resolve the effective scopes for the new token. Supports
@@ -335,22 +346,22 @@ var ExchangeRefreshTokenAction = class {
 	* Atomically revoke the old token pair and persist the
 	* new access + refresh tokens inside a single transaction.
 	*/
-	async #atomicRotation(input, oldRefreshToken, accessToken, newRefreshToken, scopes) {
-		await OAuthRefreshToken.transaction(async (trx) => {
-			const revokedAt = DateTime.now();
-			const updateResult = await OAuthRefreshToken.query({ client: trx }).where("id", oldRefreshToken.id).whereNull("revokedAt").update({ revokedAt: revokedAt.toSQL() });
-			if ((Array.isArray(updateResult) ? Number(updateResult[0] ?? 0) : Number(updateResult)) !== 1) throw new E_INVALID_GRANT("Refresh token has already been consumed");
-			await OAuthAccessToken.query({ client: trx }).where("id", oldRefreshToken.accessTokenId).whereNull("revokedAt").update({ revokedAt: revokedAt.toSQL() });
-			const accessTokenId = crypto.randomUUID();
-			await OAuthAccessToken.create({
+	async #atomicRotation(manager, input, oldRefreshToken, accessToken, newRefreshToken, scopes) {
+		const store = manager.store;
+		const accessTokenId = crypto.randomUUID();
+		if (!await store.rotateRefreshToken({
+			oldRefreshTokenId: oldRefreshToken.id,
+			oldAccessTokenId: oldRefreshToken.accessTokenId,
+			revokedAt: DateTime.now(),
+			accessToken: {
 				id: accessTokenId,
 				tokenHash: accessToken.hash,
 				clientId: input.client.clientId,
 				userId: oldRefreshToken.userId,
 				scopes,
 				expiresAt: DateTime.fromJSDate(accessToken.expiresAt)
-			}, { client: trx });
-			await OAuthRefreshToken.create({
+			},
+			refreshToken: {
 				id: crypto.randomUUID(),
 				token: newRefreshToken.hash,
 				accessTokenId,
@@ -358,8 +369,8 @@ var ExchangeRefreshTokenAction = class {
 				userId: oldRefreshToken.userId,
 				scopes,
 				expiresAt: newRefreshToken.expiresAt
-			}, { client: trx });
-		});
+			}
+		})) throw new E_INVALID_GRANT("Refresh token has already been consumed");
 	}
 };
 //#endregion
@@ -388,7 +399,7 @@ var ExchangeClientCredentialsAction = class {
 		const ttlSeconds = string.seconds.parse(manager.config.clientCredentialsAccessTokenTtl);
 		const { raw: accessTokenRaw, hash: tokenHash } = tokenService.createAccessToken();
 		const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
-		await OAuthAccessToken.create({
+		await manager.store.createAccessToken({
 			id: crypto.randomUUID(),
 			tokenHash,
 			clientId: input.client.clientId,
@@ -441,7 +452,7 @@ var TokenController = class TokenController {
 		const [error, validated] = await TokenController.validator.tryValidate(body);
 		if (error) throw new E_UNSUPPORTED_GRANT_TYPE("Missing required parameter: grant_type");
 		if (!manager.isGrantTypeEnabled(validated.grant_type)) throw new E_UNSUPPORTED_GRANT_TYPE(`Grant type "${validated.grant_type}" is not enabled`);
-		const client = await new ClientService().authenticateClient({
+		const client = await new ClientService(manager).authenticateClient({
 			authorizationHeader: ctx.request.header("authorization"),
 			bodyClientId: body.client_id,
 			bodyClientSecret: body.client_secret

package/build/types-DEtn2Zdb.js

@@ -0,0 +1,75 @@
+//#region src/types.ts
+/**
+* Standard OAuth/OIDC scopes that are always valid regardless
+* of server or client scope configuration.
+*
+* These scopes are:
+* - Accepted during scope validation (client and server level)
+* - Advertised in `scopes_supported` of all metadata endpoints
+*   (protected resource, OIDC discovery) so MCP clients know
+*   they can request them
+*
+* - `offline_access`: signals that the client needs a refresh token
+*   (OIDC Core §11). Note: Sesame issues refresh tokens by default
+*   when the `refresh_token` grant is enabled, regardless of whether
+*   the client requests this scope (per RFC 6749 §5.1). This scope
+*   is still advertised for clients that check metadata before
+*   building their authorization request.
+*
+* @see https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+*/
+const BUILTIN_SCOPES = /* @__PURE__ */ new Set(["offline_access"]);
+/**
+* OIDC-recognized scopes that are accepted by server-level validation
+* without needing to be declared in the config `scopes` map.
+*
+* Unlike `BUILTIN_SCOPES`, these still require explicit client authorization
+* via `ClientService.validateClientScopes()`.
+*/
+const OIDC_SCOPES = /* @__PURE__ */ new Set([
+	"openid",
+	"profile",
+	"email"
+]);
+/**
+* Protocol-managed claims that must never be overridden by `getOidcClaims()`.
+*/
+const RESERVED_OIDC_CLAIMS = /* @__PURE__ */ new Set([
+	"sub",
+	"iss",
+	"aud",
+	"exp",
+	"iat",
+	"nbf",
+	"jti",
+	"nonce",
+	"at_hash",
+	"auth_time",
+	"acr",
+	"azp",
+	"sid"
+]);
+/**
+* Collect OIDC claims based on the granted scopes.
+*
+* Maps each scope to its corresponding claims object and merges
+* only the claims for scopes present in the granted set.
+*
+* @example
+* ```ts
+* getOidcClaims(scopes: Scope[]) {
+*   return collectOidcClaims(scopes, {
+*     profile: { name: this.fullName },
+*     email: { email: this.email },
+*   })
+* }
+* ```
+*/
+function collectOidcClaims(scopes, claimsMap) {
+	const result = {};
+	for (const [scope, claims] of Object.entries(claimsMap)) if (scopes.includes(scope) && claims) Object.assign(result, claims);
+	return result;
+}
+//#endregion
+export { collectOidcClaims as i, OIDC_SCOPES as n, RESERVED_OIDC_CLAIMS as r, BUILTIN_SCOPES as t };

package/build/{userinfo_controller-RLk8cN_o.js → userinfo_controller-YwN26wK-.js}

@@ -1,10 +1,7 @@
-import "./chunk-DF48asd8.js";
-import { t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import "./oauth_client-BSanvSql.js";
-import { c as E_INVALID_TOKEN, n as E_INSUFFICIENT_SCOPE, o as E_INVALID_REQUEST } from "./oauth_error-C7UhDb2q.js";
-import { t as OAuthAccessToken } from "./oauth_access_token-Cz_5gNBx.js";
-import { t as TokenService } from "./token_service-DwnfAR9F.js";
-import { t as IdTokenService } from "./id_token_service-CpTzOUDe.js";
+import { c as E_INVALID_TOKEN, n as E_INSUFFICIENT_SCOPE, o as E_INVALID_REQUEST } from "./oauth_error-CvxtZvjp.js";
+import { t as SesameManager } from "./sesame_manager-CeEmlzba.js";
+import { t as TokenService } from "./token_service-DDQ3Dxaj.js";
+import { t as IdTokenService } from "./id_token_service-BtBUiL_n.js";
 //#region src/controllers/userinfo_controller.ts
 /**
 * OpenID Connect UserInfo endpoint (OIDC Core §5.3).
@@ -21,7 +18,7 @@ var UserinfoController = class {
 		const rawToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : ctx.request.body().access_token;
 		if (!rawToken) throw new E_INVALID_REQUEST("Missing Bearer token");
 		const hashed = new TokenService(manager).hashToken(rawToken);
-		const token = await OAuthAccessToken.query().where("tokenHash", hashed).first();
+		const token = await manager.store.findAccessToken({ hash: hashed });
 		if (!token) throw new E_INVALID_TOKEN("Invalid access token");
 		if (token.revokedAt) throw new E_INVALID_TOKEN("Access token has been revoked");
 		if (token.expiresAt.toJSDate() < /* @__PURE__ */ new Date()) throw new E_INVALID_TOKEN("Access token has expired");

package/build/vite.config.d.ts

@@ -1,2 +1,2 @@
-declare const _default: UserConfig;
+declare const _default: import("vite").UserConfig;
 export default _default;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@julr/sesame",
   "description": "OAuth 2.1 + OIDC server for AdonisJS",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@10.26.2",
+  "packageManager": "pnpm@10.34.5",
   "type": "module",
   "files": [
     "build",
@@ -17,8 +17,12 @@
     ".": "./build/index.js",
     "./exceptions": "./build/src/oauth_error.js",
     "./types": "./build/src/types.js",
+    "./storage/types": "./build/src/storage/types.js",
+    "./drivers/lucid": "./build/src/storage/drivers/lucid.js",
+    "./drivers/kysely": "./build/src/storage/drivers/kysely.js",
     "./sesame_provider": "./build/providers/sesame_provider.js",
     "./guard": "./build/src/guard/main.js",
+    "./guard/lucid": "./build/src/guard/lucid.js",
     "./scope_middleware": "./build/src/middleware/scope_middleware.js",
     "./any_scope_middleware": "./build/src/middleware/any_scope_middleware.js",
     "./services/main": "./build/services/main.js",
@@ -29,6 +33,7 @@
     "check": "vp check",
     "format": "vp fmt --write .",
     "quick:test": "node --import=@poppinss/ts-exec --enable-source-maps bin/test.ts",
+    "test:sql": "bash bin/test_sql_dialects.sh",
     "test": "c8 npm run quick:test",
     "build": "vp pack && tsc --emitDeclarationOnly --declaration && adonis-kit index build/commands",
     "release": "release-it",
@@ -58,25 +63,32 @@
   "author": "Julien Ripouteau",
   "license": "MIT",
   "devDependencies": {
-    "@adonisjs/assembler": "^8.0.0",
-    "@adonisjs/auth": "^10.0.0",
-    "@adonisjs/core": "^7.0.0",
-    "@adonisjs/lucid": "^22.0.0",
+    "@adonisjs/assembler": "^8.5.2",
+    "@adonisjs/auth": "^10.1.0",
+    "@adonisjs/core": "^7.5.2",
+    "@adonisjs/lucid": "^22.4.2",
     "@adonisjs/tsconfig": "^2.0.0",
     "@japa/api-client": "^3.2.1",
     "@japa/assert": "^4.2.0",
     "@japa/expect-type": "^2.0.4",
     "@japa/runner": "^5.3.0",
     "@poppinss/ts-exec": "^1.4.4",
-    "@release-it/conventional-changelog": "^10.0.5",
-    "@types/luxon": "^3.7.1",
-    "@types/node": "^25.3.3",
-    "@vinejs/vine": "^4.3.0",
-    "better-sqlite3": "^12.6.2",
-    "c8": "^11.0.0",
+    "@release-it/conventional-changelog": "^12.0.2",
+    "@types/better-sqlite3": "^9.6.0",
+    "@types/luxon": "^3.7.5",
+    "@types/node": "^26.6.2",
+    "@types/pg": "^8.23.1",
+    "@vinejs/vine": "^4.4.0",
+    "better-sqlite3": "^13.0.3",
+    "c8": "^12.0.0",
     "cross-env": "^10.1.0",
-    "release-it": "^19.2.4",
-    "typescript": "^5.9.3",
+    "kysely": "^0.29.6",
+    "mysql2": "^3.24.4",
+    "node-gyp": "^13.0.2",
+    "pg": "^8.23.0",
+    "release-it": "^21.1.0",
+    "taze": "^21.1.0",
+    "typescript": "^7.0.2",
     "vite-plus": "catalog:"
   },
   "peerDependencies": {
@@ -84,13 +96,17 @@
     "@adonisjs/auth": "^10.0.0",
     "@adonisjs/core": "^7.0.0",
     "@adonisjs/lucid": "^21.0.0 || ^22.0.0",
-    "@vinejs/vine": "^4.0.0"
+    "@vinejs/vine": "^4.0.0",
+    "kysely": "^0.29.0"
   },
   "peerDependenciesMeta": {
     "@adonisjs/assembler": {
       "optional": true
     },
-    "@adonisjs/auth": {
+    "@adonisjs/lucid": {
+      "optional": true
+    },
+    "kysely": {
       "optional": true
     }
   },
@@ -131,7 +147,7 @@
     ]
   },
   "dependencies": {
-    "jose": "^6.2.1",
+    "jose": "^6.2.12",
     "luxon": "^3.7.2"
   }
 }

package/build/chunk-DF48asd8.js

@@ -1,9 +0,0 @@
-import "node:module";
-Object.create;
-Object.defineProperty;
-Object.getOwnPropertyDescriptor;
-Object.getOwnPropertyNames;
-Object.getPrototypeOf;
-Object.prototype.hasOwnProperty;
-//#endregion
-export {};

package/build/oauth_access_token-Cz_5gNBx.js

@@ -1,29 +0,0 @@
-import { n as __decorate, r as json } from "./oauth_client-BSanvSql.js";
-import { BaseModel, column } from "@adonisjs/lucid/orm";
-//#region src/models/oauth_access_token.ts
-/**
-* Database record for an issued OAuth 2.0 access token.
-*
-* Access tokens are opaque random values. Only the SHA-256 hash
-* is stored so raw tokens cannot be reconstructed from a DB leak.
-* A token is considered revoked when `revokedAt` is set.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc7662
-*/
-var OAuthAccessToken = class extends BaseModel {
-	static table = "oauth_access_tokens";
-};
-__decorate([column({ isPrimary: true })], OAuthAccessToken.prototype, "id", void 0);
-__decorate([column()], OAuthAccessToken.prototype, "tokenHash", void 0);
-__decorate([column()], OAuthAccessToken.prototype, "clientId", void 0);
-__decorate([column()], OAuthAccessToken.prototype, "userId", void 0);
-__decorate([json()], OAuthAccessToken.prototype, "scopes", void 0);
-__decorate([column.dateTime()], OAuthAccessToken.prototype, "expiresAt", void 0);
-__decorate([column.dateTime()], OAuthAccessToken.prototype, "revokedAt", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthAccessToken.prototype, "createdAt", void 0);
-__decorate([column.dateTime({
-	autoCreate: true,
-	autoUpdate: true
-})], OAuthAccessToken.prototype, "updatedAt", void 0);
-//#endregion
-export { OAuthAccessToken as t };

package/build/oauth_client-BSanvSql.js

@@ -1,63 +0,0 @@
-import { BaseModel, column } from "@adonisjs/lucid/orm";
-//#region src/decorators.ts
-/**
-* Column decorator for JSON values (arrays, objects).
-*
-* Lucid ORM doesn't handle JSON serialization automatically —
-* `prepare` stringifies before INSERT/UPDATE, `consume` parses
-* after SELECT. The typeof check in consume handles both drivers
-* that return strings (SQLite, MySQL) and parsed objects (PostgreSQL JSONB).
-*/
-function json(options) {
-	return column({
-		...options,
-		prepare: (value) => value == null ? null : JSON.stringify(value),
-		consume: (value) => value == null ? null : typeof value === "string" ? JSON.parse(value) : value
-	});
-}
-//#endregion
-//#region \0@oxc-project+runtime@0.115.0/helpers/decorate.js
-function __decorate(decorators, target, key, desc) {
-	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-	return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-//#endregion
-//#region src/models/oauth_client.ts
-/**
-* Represents a registered OAuth 2.0 client (RFC 6749 §2).
-*
-* Clients can be either confidential (with a hashed secret) or
-* public (no secret, e.g. SPAs, native apps). Public clients must
-* use PKCE (RFC 7636) for authorization code exchanges.
-*
-* Clients may be created manually or via dynamic client registration
-* (RFC 7591) through the `/oauth/register` endpoint.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc6749#section-2
-* @see https://datatracker.ietf.org/doc/html/rfc7591
-*/
-var OAuthClient = class extends BaseModel {
-	static table = "oauth_clients";
-};
-__decorate([column({ isPrimary: true })], OAuthClient.prototype, "id", void 0);
-__decorate([column()], OAuthClient.prototype, "clientId", void 0);
-__decorate([column({ serializeAs: null })], OAuthClient.prototype, "clientSecret", void 0);
-__decorate([column()], OAuthClient.prototype, "name", void 0);
-__decorate([json()], OAuthClient.prototype, "redirectUris", void 0);
-__decorate([json()], OAuthClient.prototype, "scopes", void 0);
-__decorate([json()], OAuthClient.prototype, "grantTypes", void 0);
-__decorate([column()], OAuthClient.prototype, "isPublic", void 0);
-__decorate([column()], OAuthClient.prototype, "isDisabled", void 0);
-__decorate([column()], OAuthClient.prototype, "requirePkce", void 0);
-__decorate([column()], OAuthClient.prototype, "type", void 0);
-__decorate([json()], OAuthClient.prototype, "metadata", void 0);
-__decorate([column()], OAuthClient.prototype, "userId", void 0);
-__decorate([column.dateTime({ autoCreate: true })], OAuthClient.prototype, "createdAt", void 0);
-__decorate([column.dateTime({
-	autoCreate: true,
-	autoUpdate: true
-})], OAuthClient.prototype, "updatedAt", void 0);
-//#endregion
-export { __decorate as n, json as r, OAuthClient as t };

package/build/sesame_manager-B1Jgq1v2.js

@@ -1,6 +0,0 @@
-import "./chunk-DF48asd8.js";
-import { t as SesameManager } from "./sesame_manager-DYUSZ0NC.js";
-import "./oauth_client-BSanvSql.js";
-import "./oauth_error-C7UhDb2q.js";
-import "./oauth_access_token-Cz_5gNBx.js";
-export { SesameManager };