@nxgt/janus-drizzle 0.3.2 → 0.4.0

package/dist/index.js

@@ -1,58 +1,19 @@
-// src/relations.ts
-import { withTransaction } from "@nxgt/drizzle/pg";
-import {
-  isSubjectSet
-} from "@nxgt/janus";
-import { and, asc, eq, gt, isNotNull, isNull, or } from "drizzle-orm";
+// src/tables/index.ts
+import { pgTable } from "drizzle-orm/pg-core";
 
-// src/tables.ts
-import { sql } from "drizzle-orm";
-import {
-  boolean,
-  check,
-  customType,
-  foreignKey,
-  index,
-  integer,
-  jsonb,
-  pgTable,
-  primaryKey,
-  text,
-  timestamp,
-  unique
-} from "drizzle-orm/pg-core";
+// src/tables/logins.ts
+import { foreignKey, index, primaryKey } from "drizzle-orm/pg-core";
+
+// src/tables/columns.ts
+import { customType, timestamp } from "drizzle-orm/pg-core";
 var key = customType({
   dataType: () => 'text collate "C"'
 });
 var at = (name) => timestamp(name, { withTimezone: true, precision: 3 });
-function defineJanusTables(options = {}) {
-  const { schema } = options;
-  const table = schema === undefined ? pgTable : schema.table;
-  const users = table("users", {
-    id: key("id").primaryKey(),
-    type: key("type").notNull(),
-    schemaVersion: text("schema_version").notNull(),
-    active: boolean("active").notNull(),
-    fields: jsonb("fields").notNull(),
-    logins: text("logins").array().notNull(),
-    passwordHash: text("password_hash"),
-    passwordUpdatedAt: at("password_updated_at"),
-    secondFactorMethod: text("second_factor_method", { enum: ["totp"] }),
-    secondFactorSecret: text("second_factor_secret"),
-    secondFactorConfirmedAt: at("second_factor_confirmed_at"),
-    secondFactorLastStep: integer("second_factor_last_step"),
-    emailVerifiedAt: at("email_verified_at"),
-    version: integer("version").notNull(),
-    createdAt: at("created_at").notNull(),
-    updatedAt: at("updated_at").notNull()
-  }, (t) => [
-    unique("users_id_type_unique").on(t.id, t.type),
-    index("users_type_id").on(t.type, t.id),
-    check("users_password_whole", sql`(${t.passwordHash} is null) = (${t.passwordUpdatedAt} is null)`),
-    check("users_second_factor_whole", sql`(${t.secondFactorMethod} is null) = (${t.secondFactorSecret} is null) and (${t.secondFactorMethod} is not null or (${t.secondFactorConfirmedAt} is null and ${t.secondFactorLastStep} is null))`),
-    check("users_second_factor_values", sql`${t.secondFactorMethod} in ('totp') and ${t.secondFactorLastStep} >= 0`)
-  ]);
-  const logins = table("logins", {
+
+// src/tables/logins.ts
+function loginsTable(table, users) {
+  return table("logins", {
     type: key("type").notNull(),
     login: key("login").notNull(),
     userId: key("user_id").notNull()
@@ -65,7 +26,28 @@ function defineJanusTables(options = {}) {
     }).onDelete("cascade"),
     index("logins_user_id").on(t.userId)
   ]);
-  const sessions = table("sessions", {
+}
+
+// src/tables/relations.ts
+import { index as index2, unique } from "drizzle-orm/pg-core";
+function relationsTable(table) {
+  return table("relations", {
+    objectType: key("object_type").notNull(),
+    objectId: key("object_id").notNull(),
+    relation: key("relation").notNull(),
+    subjectType: key("subject_type").notNull(),
+    subjectId: key("subject_id").notNull(),
+    subjectRelation: key("subject_relation")
+  }, (t) => [
+    unique("relations_tuple_unique").on(t.subjectType, t.subjectId, t.subjectRelation, t.relation, t.objectType, t.objectId).nullsNotDistinct(),
+    index2("relations_object").on(t.objectType, t.objectId, t.relation)
+  ]);
+}
+
+// src/tables/sessions.ts
+import { index as index3, unique as unique2 } from "drizzle-orm/pg-core";
+function sessionsTable(table) {
+  return table("sessions", {
     id: key("id").primaryKey(),
     tokenHash: key("token_hash").notNull(),
     userId: key("user_id").notNull(),
@@ -74,11 +56,17 @@ function defineJanusTables(options = {}) {
     revokedAt: at("revoked_at"),
     createdAt: at("created_at").notNull()
   }, (t) => [
-    unique("sessions_token_hash_unique").on(t.tokenHash),
-    index("sessions_user_id").on(t.userId),
-    index("sessions_expires_at").on(t.expiresAt)
+    unique2("sessions_token_hash_unique").on(t.tokenHash),
+    index3("sessions_user_id").on(t.userId),
+    index3("sessions_expires_at").on(t.expiresAt)
   ]);
-  const tokens = table("tokens", {
+}
+
+// src/tables/tokens.ts
+import { sql } from "drizzle-orm";
+import { check, index as index4, integer, text } from "drizzle-orm/pg-core";
+function tokensTable(table) {
+  return table("tokens", {
     tokenHash: key("token_hash").primaryKey(),
     kind: text("kind", {
       enum: ["verifyEmail", "resetPassword", "secondFactor", "signInCode"]
@@ -93,19 +81,58 @@ function defineJanusTables(options = {}) {
   }, (t) => [
     check("tokens_kind", sql`${t.kind} in ('verifyEmail', 'resetPassword', 'secondFactor', 'signInCode')`),
     check("tokens_attempts", sql`${t.attempts} >= 0`),
-    index("tokens_user_id").on(t.userId)
+    index4("tokens_user_id").on(t.userId)
   ]);
-  const relations = table("relations", {
-    objectType: key("object_type").notNull(),
-    objectId: key("object_id").notNull(),
-    relation: key("relation").notNull(),
-    subjectType: key("subject_type").notNull(),
-    subjectId: key("subject_id").notNull(),
-    subjectRelation: key("subject_relation")
+}
+
+// src/tables/users.ts
+import { sql as sql2 } from "drizzle-orm";
+import {
+  boolean,
+  check as check2,
+  index as index5,
+  integer as integer2,
+  jsonb,
+  text as text2,
+  unique as unique3
+} from "drizzle-orm/pg-core";
+function usersTable(table) {
+  return table("users", {
+    id: key("id").primaryKey(),
+    type: key("type").notNull(),
+    schemaVersion: text2("schema_version").notNull(),
+    active: boolean("active").notNull(),
+    fields: jsonb("fields").notNull(),
+    logins: text2("logins").array().notNull(),
+    passwordHash: text2("password_hash"),
+    passwordUpdatedAt: at("password_updated_at"),
+    secondFactorMethod: text2("second_factor_method", { enum: ["totp"] }),
+    secondFactorSecret: text2("second_factor_secret"),
+    secondFactorConfirmedAt: at("second_factor_confirmed_at"),
+    secondFactorLastStep: integer2("second_factor_last_step"),
+    secondFactorRecoveryCodes: text2("second_factor_recovery_codes").array(),
+    emailVerifiedAt: at("email_verified_at"),
+    version: integer2("version").notNull(),
+    createdAt: at("created_at").notNull(),
+    updatedAt: at("updated_at").notNull()
   }, (t) => [
-    unique("relations_tuple_unique").on(t.subjectType, t.subjectId, t.subjectRelation, t.relation, t.objectType, t.objectId).nullsNotDistinct(),
-    index("relations_object").on(t.objectType, t.objectId, t.relation)
+    unique3("users_id_type_unique").on(t.id, t.type),
+    index5("users_type_id").on(t.type, t.id),
+    check2("users_password_whole", sql2`(${t.passwordHash} is null) = (${t.passwordUpdatedAt} is null)`),
+    check2("users_second_factor_whole", sql2`(${t.secondFactorMethod} is null) = (${t.secondFactorSecret} is null) and (${t.secondFactorMethod} is not null or (${t.secondFactorConfirmedAt} is null and ${t.secondFactorLastStep} is null and ${t.secondFactorRecoveryCodes} is null))`),
+    check2("users_second_factor_values", sql2`${t.secondFactorMethod} in ('totp') and ${t.secondFactorLastStep} >= 0`)
   ]);
+}
+
+// src/tables/index.ts
+function defineJanusTables(options = {}) {
+  const { schema } = options;
+  const table = schema === undefined ? pgTable : schema.table;
+  const users = usersTable(table);
+  const logins = loginsTable(table, users);
+  const sessions = sessionsTable(table);
+  const tokens = tokensTable(table);
+  const relations = relationsTable(table);
   return { users, logins, sessions, tokens, relations };
 }
 
@@ -129,62 +156,12 @@ function loginTaken(operation, type, login) {
   return new StoreConflict("login", `${operation}: the login is taken by another ${type}`, { login, userType: type, operation });
 }
 
-// src/relations.ts
-function createDrizzleRelations(db, options = {}) {
-  const tables = options.tables ?? defineJanusTables();
-  const { rowOf, subjectIs, matching } = tupleSql(tables.relations);
-  const run$ = (operation, body) => run("relations", operation, body);
-  const holding = (object, relation, sets) => db.select({
-    type: tables.relations.subjectType,
-    id: tables.relations.subjectId,
-    relation: tables.relations.subjectRelation
-  }).from(tables.relations).where(and(eq(tables.relations.objectType, object.type), eq(tables.relations.objectId, object.id), eq(tables.relations.relation, relation), sets ? isNotNull(tables.relations.subjectRelation) : isNull(tables.relations.subjectRelation)));
-  const apply = async (tx, add, remove) => {
-    for (const tuple of inOrder(remove)) {
-      await tx.delete(tables.relations).where(matching(tuple));
-    }
-    if (add.length > 0) {
-      await tx.insert(tables.relations).values(inOrder(add).map(rowOf)).onConflictDoNothing();
-    }
-  };
-  return {
-    write: ({ add = [], remove = [] }) => run$("write", async () => {
-      if (add.length + remove.length <= 1)
-        return apply(db, add, remove);
-      await withTransaction(db, (tx) => apply(tx, add, remove));
-    }),
-    has: (tuple) => run$("has", async () => {
-      const found = await db.select({ relation: tables.relations.relation }).from(tables.relations).where(matching(tuple)).limit(1);
-      return found.length === 1;
-    }),
-    findSubjectSets: (object, relation) => run$("findSubjectSets", async () => (await holding(object, relation, true)).map((row) => ({
-      type: row.type,
-      id: row.id,
-      relation: row.relation ?? ""
-    }))),
-    findEntities: (object, relation) => run$("findEntities", async () => (await holding(object, relation, false)).map((row) => ({ type: row.type, id: row.id }))),
-    findObjects: ({ type, relation, subject, after, limit }) => run$("findObjects", async () => {
-      const conditions = [
-        subjectIs(subject),
-        eq(tables.relations.relation, relation),
-        eq(tables.relations.objectType, type)
-      ];
-      if (after !== null)
-        conditions.push(gt(tables.relations.objectId, after));
-      const found = await db.select({ id: tables.relations.objectId }).from(tables.relations).where(and(...conditions)).orderBy(asc(tables.relations.objectId)).limit(limit + 1);
-      const items = found.slice(0, limit).map((row) => row.id);
-      const last = items.at(-1);
-      return {
-        items,
-        nextCursor: found.length > limit && last !== undefined ? last : null
-      };
-    }),
-    deleteEntity: (entity) => run$("deleteEntity", async () => {
-      const deleted = await db.delete(tables.relations).where(or(and(eq(tables.relations.objectType, entity.type), eq(tables.relations.objectId, entity.id)), and(eq(tables.relations.subjectType, entity.type), eq(tables.relations.subjectId, entity.id)))).returning({ relation: tables.relations.relation });
-      return deleted.length;
-    })
-  };
-}
+// src/relations/reads.ts
+import { and as and2, asc, eq as eq2, gt, isNotNull, isNull as isNull2 } from "drizzle-orm";
+
+// src/relations/tuples.ts
+import { isSubjectSet } from "@nxgt/janus";
+import { and, eq, isNull } from "drizzle-orm";
 function inOrder(tuples) {
   const keyOf = (tuple) => JSON.stringify([
     tuple.object.type,
@@ -199,194 +176,103 @@ function inOrder(tuples) {
     return x < y ? -1 : x > y ? 1 : 0;
   });
 }
-function tupleSql(relations) {
-  function rowOf(tuple) {
-    return {
-      objectType: tuple.object.type,
-      objectId: tuple.object.id,
-      relation: tuple.relation,
-      subjectType: tuple.subject.type,
-      subjectId: tuple.subject.id,
-      subjectRelation: isSubjectSet(tuple.subject) ? tuple.subject.relation : null
-    };
-  }
-  function subjectIs(subject) {
-    return and(eq(relations.subjectType, subject.type), eq(relations.subjectId, subject.id), isSubjectSet(subject) ? eq(relations.subjectRelation, subject.relation) : isNull(relations.subjectRelation));
-  }
-  function matching(tuple) {
-    return and(eq(relations.objectType, tuple.object.type), eq(relations.objectId, tuple.object.id), eq(relations.relation, tuple.relation), subjectIs(tuple.subject));
-  }
-  return { rowOf, subjectIs, matching };
-}
-
-// src/stores.ts
-import { withTransaction as withTransaction2 } from "@nxgt/drizzle/pg";
-import { NotFoundError, StoreConflict as StoreConflict2 } from "@nxgt/janus";
-import { and as and2, asc as asc2, eq as eq2, gt as gt2, isNull as isNull2, lte, ne, sql as sql2 } from "drizzle-orm";
-function createDrizzleStores(db, options = {}) {
-  const tables = options.tables ?? defineJanusTables();
+function rowOf(tuple) {
   return {
-    users: userStore(db, tables),
-    sessions: sessionStore(db, tables),
-    tokens: tokenStore(db, tables)
+    objectType: tuple.object.type,
+    objectId: tuple.object.id,
+    relation: tuple.relation,
+    subjectType: tuple.subject.type,
+    subjectId: tuple.subject.id,
+    subjectRelation: isSubjectSet(tuple.subject) ? tuple.subject.relation : null
   };
 }
-function userStore(db, tables) {
-  const run$ = (operation, body) => run("users", operation, body);
-  const find = async (id) => {
-    const [row] = await db.select().from(tables.users).where(eq2(tables.users.id, id));
-    return row === undefined ? null : toUser(row);
-  };
-  const claim = async (tx, operation, user, logins) => {
-    const distinct = [...new Set(logins)].sort();
-    if (distinct.length === 0)
-      return;
-    const written = await tx.insert(tables.logins).values(distinct.map((login) => ({ type: user.type, login, userId: user.id }))).onConflictDoNothing().returning({ login: tables.logins.login });
-    if (written.length === distinct.length)
-      return;
-    const claimed = new Set(written.map((row) => row.login));
-    const taken = distinct.find((login) => !claimed.has(login)) ?? "";
-    throw loginTaken(operation, user.type, taken);
-  };
-  return {
-    insertUser: (record) => run$("insertUser", async () => {
-      const inserted = await withTransaction2(db, async (tx) => {
-        const [row] = await tx.insert(tables.users).values(toUserRow(record)).onConflictDoNothing({ target: tables.users.id }).returning();
-        if (row === undefined)
-          return null;
-        await claim(tx, "insertUser", record, record.logins);
-        return toUser(row);
-      });
-      if (inserted !== null)
-        return inserted;
-      const stored = await find(record.id);
-      if (stored !== null)
-        return stored;
-      throw new NotFoundError("insertUser: the user was deleted meanwhile", {
-        userId: record.id,
-        operation: "insertUser"
-      });
-    }),
-    findUser: (id) => run$("findUser", () => find(id)),
-    findUserByLogin: (type, login) => run$("findUserByLogin", async () => {
-      const [row] = await db.select({ user: tables.users }).from(tables.logins).innerJoin(tables.users, eq2(tables.users.id, tables.logins.userId)).where(and2(eq2(tables.logins.type, type), eq2(tables.logins.login, login)));
-      return row === undefined ? null : toUser(row.user);
-    }),
-    listUsers: ({ type, after, limit }) => run$("listUsers", async () => {
-      const found = await db.select().from(tables.users).where(after === null ? eq2(tables.users.type, type) : and2(eq2(tables.users.type, type), gt2(tables.users.id, after))).orderBy(asc2(tables.users.id)).limit(limit + 1);
-      const items = found.slice(0, limit).map(toUser);
-      const last = items.at(-1);
-      return {
-        items,
-        nextCursor: found.length > limit && last !== undefined ? last.id : null
-      };
-    }),
-    updateUser: (id, patch, ifVersion) => run$("updateUser", () => withTransaction2(db, async (tx) => {
-      const [row] = await tx.update(tables.users).set({
-        ...toUserSet(patch),
-        version: sql2`${tables.users.version} + 1`
-      }).where(and2(eq2(tables.users.id, id), eq2(tables.users.version, ifVersion))).returning();
-      if (row === undefined) {
-        const [stored] = await tx.select({ version: tables.users.version }).from(tables.users).where(eq2(tables.users.id, id));
-        if (stored === undefined) {
-          throw new NotFoundError("updateUser: no user has this id", {
-            userId: id,
-            operation: "updateUser"
-          });
-        }
-        throw new StoreConflict2("version", `updateUser: expected version ${ifVersion}, found ${stored.version}`, {
-          userId: id,
-          expectedVersion: ifVersion,
-          actualVersion: stored.version,
-          operation: "updateUser"
-        });
-      }
-      if (patch.logins !== undefined) {
-        await tx.delete(tables.logins).where(eq2(tables.logins.userId, id));
-        await claim(tx, "updateUser", row, patch.logins);
-      }
-      return toUser(row);
-    })),
-    deleteUser: (id) => run$("deleteUser", async () => {
-      const deleted = await db.delete(tables.users).where(eq2(tables.users.id, id)).returning({ id: tables.users.id });
-      return deleted.length === 1;
-    })
-  };
+function subjectIs(relations, subject) {
+  return and(eq(relations.subjectType, subject.type), eq(relations.subjectId, subject.id), isSubjectSet(subject) ? eq(relations.subjectRelation, subject.relation) : isNull(relations.subjectRelation));
 }
-function sessionStore(db, tables) {
-  const run$ = (operation, body) => run("sessions", operation, body);
+function matching(relations, tuple) {
+  return and(eq(relations.objectType, tuple.object.type), eq(relations.objectId, tuple.object.id), eq(relations.relation, tuple.relation), subjectIs(relations, tuple.subject));
+}
+
+// src/relations/reads.ts
+async function has({ db, relations }, tuple) {
+  const found = await db.select({ relation: relations.relation }).from(relations).where(matching(relations, tuple)).limit(1);
+  return found.length === 1;
+}
+async function findSubjectSets(context, object, relation) {
+  return (await holding(context, object, relation, true)).map((row) => ({
+    type: row.type,
+    id: row.id,
+    relation: row.relation ?? ""
+  }));
+}
+async function findEntities(context, object, relation) {
+  return (await holding(context, object, relation, false)).map((row) => ({ type: row.type, id: row.id }));
+}
+function holding({ db, relations }, object, relation, sets) {
+  return db.select({
+    type: relations.subjectType,
+    id: relations.subjectId,
+    relation: relations.subjectRelation
+  }).from(relations).where(and2(eq2(relations.objectType, object.type), eq2(relations.objectId, object.id), eq2(relations.relation, relation), sets ? isNotNull(relations.subjectRelation) : isNull2(relations.subjectRelation)));
+}
+async function findObjects({ db, relations }, { type, relation, subject, after, limit }) {
+  const conditions = [
+    subjectIs(relations, subject),
+    eq2(relations.relation, relation),
+    eq2(relations.objectType, type)
+  ];
+  if (after !== null)
+    conditions.push(gt(relations.objectId, after));
+  const found = await db.select({ id: relations.objectId }).from(relations).where(and2(...conditions)).orderBy(asc(relations.objectId)).limit(limit + 1);
+  const items = found.slice(0, limit).map((row) => row.id);
+  const last = items.at(-1);
   return {
-    insertSession: (record) => run$("insertSession", async () => {
-      await db.insert(tables.sessions).values(record).onConflictDoNothing({ target: tables.sessions.id });
-    }),
-    findSessionByTokenHash: (tokenHash) => run$("findSessionByTokenHash", async () => {
-      const [row] = await db.select().from(tables.sessions).where(eq2(tables.sessions.tokenHash, tokenHash));
-      return row === undefined ? null : toSession(row);
-    }),
-    extendSession: (id, expiresAt) => run$("extendSession", async () => {
-      const [row] = await db.update(tables.sessions).set({ expiresAt }).where(and2(eq2(tables.sessions.id, id), isNull2(tables.sessions.revokedAt))).returning();
-      return row === undefined ? null : toSession(row);
-    }),
-    revokeSession: (id, at) => run$("revokeSession", async () => {
-      const matched = await db.update(tables.sessions).set({
-        revokedAt: sql2`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`
-      }).where(eq2(tables.sessions.id, id)).returning({ id: tables.sessions.id });
-      return matched.length === 1;
-    }),
-    revokeUserSessions: (userId, at, except) => run$("revokeUserSessions", async () => {
-      const standing = and2(eq2(tables.sessions.userId, userId), isNull2(tables.sessions.revokedAt));
-      const revoked = await db.update(tables.sessions).set({ revokedAt: at }).where(except === undefined ? standing : and2(standing, ne(tables.sessions.id, except))).returning({ id: tables.sessions.id });
-      return revoked.length;
-    }),
-    deleteUserSessions: (userId) => run$("deleteUserSessions", async () => {
-      const deleted = await db.delete(tables.sessions).where(eq2(tables.sessions.userId, userId)).returning({ id: tables.sessions.id });
-      return deleted.length;
-    }),
-    deleteExpiredSessions: (before) => run$("deleteExpiredSessions", async () => {
-      const deleted = await db.delete(tables.sessions).where(lte(tables.sessions.expiresAt, before)).returning({ id: tables.sessions.id });
-      return deleted.length;
-    })
+    items,
+    nextCursor: found.length > limit && last !== undefined ? last : null
   };
 }
-function tokenStore(db, tables) {
-  const run$ = (operation, body) => run("tokens", operation, body);
+
+// src/relations/writes.ts
+import { withTransaction } from "@nxgt/drizzle/pg";
+import { and as and3, eq as eq3, or } from "drizzle-orm";
+async function write({ db, relations }, add, remove) {
+  if (add.length + remove.length <= 1)
+    return apply(db, relations, add, remove);
+  await withTransaction(db, (tx) => apply(tx, relations, add, remove));
+}
+async function apply(tx, relations, add, remove) {
+  for (const tuple of inOrder(remove)) {
+    await tx.delete(relations).where(matching(relations, tuple));
+  }
+  if (add.length > 0) {
+    await tx.insert(relations).values(inOrder(add).map(rowOf)).onConflictDoNothing();
+  }
+}
+async function deleteEntity({ db, relations }, entity) {
+  const deleted = await db.delete(relations).where(or(and3(eq3(relations.objectType, entity.type), eq3(relations.objectId, entity.id)), and3(eq3(relations.subjectType, entity.type), eq3(relations.subjectId, entity.id)))).returning({ relation: relations.relation });
+  return deleted.length;
+}
+
+// src/relations/index.ts
+function createDrizzleRelations(db, options = {}) {
+  const tables = options.tables ?? defineJanusTables();
+  const context = { db, relations: tables.relations };
+  const run$ = (operation, body) => run("relations", operation, body);
   return {
-    insertToken: (record) => run$("insertToken", async () => {
-      await db.insert(tables.tokens).values(record).onConflictDoNothing();
-    }),
-    consumeToken: (tokenHash, kind, at) => run$("consumeToken", async () => {
-      const before = db.$with("before").as(db.select().from(tables.tokens).where(and2(eq2(tables.tokens.tokenHash, tokenHash), eq2(tables.tokens.kind, kind))).for("update"));
-      const [spent] = await db.with(before).update(tables.tokens).set({
-        spentAt: sql2`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`
-      }).from(before).where(eq2(tables.tokens.tokenHash, before.tokenHash)).returning({
-        tokenHash: before.tokenHash,
-        kind: before.kind,
-        userId: before.userId,
-        address: before.address,
-        codeHash: before.codeHash,
-        attempts: before.attempts,
-        expiresAt: before.expiresAt,
-        spentAt: before.spentAt,
-        createdAt: before.createdAt
-      });
-      return spent === undefined ? null : { ...spent, userId: spent.userId };
-    }),
-    countAttempt: (tokenHash, kind) => run$("countAttempt", async () => {
-      const match = and2(eq2(tables.tokens.tokenHash, tokenHash), eq2(tables.tokens.kind, kind));
-      const [counted] = await db.update(tables.tokens).set({ attempts: sql2`${tables.tokens.attempts} + 1` }).where(and2(match, isNull2(tables.tokens.spentAt))).returning();
-      const row = counted ?? (await db.select().from(tables.tokens).where(match))[0];
-      return row === undefined ? null : { ...row, userId: row.userId };
-    }),
-    spendUserTokens: (userId, kind, at, except) => run$("spendUserTokens", async () => {
-      const spent = await db.update(tables.tokens).set({ spentAt: at }).where(and2(eq2(tables.tokens.userId, userId), eq2(tables.tokens.kind, kind), isNull2(tables.tokens.spentAt), except === undefined ? undefined : ne(tables.tokens.tokenHash, except))).returning({ tokenHash: tables.tokens.tokenHash });
-      return spent.length;
-    }),
-    deleteUserTokens: (userId) => run$("deleteUserTokens", async () => {
-      const deleted = await db.delete(tables.tokens).where(eq2(tables.tokens.userId, userId)).returning({ tokenHash: tables.tokens.tokenHash });
-      return deleted.length;
-    })
+    write: ({ add = [], remove = [] }) => run$("write", () => write(context, add, remove)),
+    has: (tuple) => run$("has", () => has(context, tuple)),
+    findSubjectSets: (object, relation) => run$("findSubjectSets", () => findSubjectSets(context, object, relation)),
+    findEntities: (object, relation) => run$("findEntities", () => findEntities(context, object, relation)),
+    findObjects: ({ type, relation, subject, after, limit }) => run$("findObjects", () => findObjects(context, { type, relation, subject, after, limit })),
+    deleteEntity: (entity) => run$("deleteEntity", () => deleteEntity(context, entity))
   };
 }
+
+// src/stores/sessions.ts
+import { and as and4, eq as eq4, isNull as isNull3, lte, ne, sql as sql4 } from "drizzle-orm";
+
+// src/stores/records.ts
+import { sql as sql3 } from "drizzle-orm";
 function toUserRow(record) {
   return {
     id: record.id,
@@ -428,11 +314,13 @@ function toUserSet(patch) {
   return set;
 }
 function toSecondFactorColumns(secondFactor) {
+  const codes = secondFactor?.recoveryCodes ?? [];
   return {
     secondFactorMethod: secondFactor?.method ?? null,
     secondFactorSecret: secondFactor?.secret ?? null,
     secondFactorConfirmedAt: secondFactor?.confirmedAt ?? null,
-    secondFactorLastStep: secondFactor?.lastStep ?? null
+    secondFactorLastStep: secondFactor?.lastStep ?? null,
+    secondFactorRecoveryCodes: codes.length === 0 ? null : [...codes]
   };
 }
 function toUser(row) {
@@ -448,7 +336,8 @@ function toUser(row) {
       method: row.secondFactorMethod,
       secret: row.secondFactorSecret,
       confirmedAt: row.secondFactorConfirmedAt,
-      lastStep: row.secondFactorLastStep
+      lastStep: row.secondFactorLastStep,
+      recoveryCodes: [...row.secondFactorRecoveryCodes ?? []]
     },
     emailVerifiedAt: row.emailVerifiedAt,
     version: row.version,
@@ -468,7 +357,193 @@ function toSession(row) {
   };
 }
 function stamp(at) {
-  return sql2`${at.toISOString()}::timestamptz`;
+  return sql3`${at.toISOString()}::timestamptz`;
+}
+
+// src/stores/sessions.ts
+function sessionStore(db, tables) {
+  const run$ = (operation, body) => run("sessions", operation, body);
+  return {
+    insertSession: (record) => run$("insertSession", async () => {
+      await db.insert(tables.sessions).values(record).onConflictDoNothing({ target: tables.sessions.id });
+    }),
+    findSessionByTokenHash: (tokenHash) => run$("findSessionByTokenHash", async () => {
+      const [row] = await db.select().from(tables.sessions).where(eq4(tables.sessions.tokenHash, tokenHash));
+      return row === undefined ? null : toSession(row);
+    }),
+    extendSession: (id, expiresAt) => run$("extendSession", async () => {
+      const [row] = await db.update(tables.sessions).set({ expiresAt }).where(and4(eq4(tables.sessions.id, id), isNull3(tables.sessions.revokedAt))).returning();
+      return row === undefined ? null : toSession(row);
+    }),
+    revokeSession: (id, at) => run$("revokeSession", () => revokeSession(db, tables, id, at)),
+    revokeUserSessions: (userId, at, except) => run$("revokeUserSessions", () => revokeUserSessions(db, tables, userId, at, except)),
+    deleteUserSessions: (userId) => run$("deleteUserSessions", async () => {
+      const deleted = await db.delete(tables.sessions).where(eq4(tables.sessions.userId, userId)).returning({ id: tables.sessions.id });
+      return deleted.length;
+    }),
+    deleteExpiredSessions: (before) => run$("deleteExpiredSessions", async () => {
+      const deleted = await db.delete(tables.sessions).where(lte(tables.sessions.expiresAt, before)).returning({ id: tables.sessions.id });
+      return deleted.length;
+    })
+  };
+}
+async function revokeSession(db, tables, id, at) {
+  const matched = await db.update(tables.sessions).set({
+    revokedAt: sql4`coalesce(${tables.sessions.revokedAt}, ${stamp(at)})`
+  }).where(eq4(tables.sessions.id, id)).returning({ id: tables.sessions.id });
+  return matched.length === 1;
+}
+async function revokeUserSessions(db, tables, userId, at, except) {
+  const standing = and4(eq4(tables.sessions.userId, userId), isNull3(tables.sessions.revokedAt));
+  const revoked = await db.update(tables.sessions).set({ revokedAt: at }).where(except === undefined ? standing : and4(standing, ne(tables.sessions.id, except))).returning({ id: tables.sessions.id });
+  return revoked.length;
+}
+
+// src/stores/tokens.ts
+import { and as and5, eq as eq5, isNull as isNull4, ne as ne2, sql as sql5 } from "drizzle-orm";
+function tokenStore(db, tables) {
+  const run$ = (operation, body) => run("tokens", operation, body);
+  return {
+    insertToken: (record) => run$("insertToken", async () => {
+      await db.insert(tables.tokens).values(record).onConflictDoNothing();
+    }),
+    consumeToken: (tokenHash, kind, at) => run$("consumeToken", () => consumeToken(db, tables, tokenHash, kind, at)),
+    countAttempt: (tokenHash, kind) => run$("countAttempt", () => countAttempt(db, tables, tokenHash, kind)),
+    spendUserTokens: (userId, kind, at, except) => run$("spendUserTokens", async () => {
+      const spent = await db.update(tables.tokens).set({ spentAt: at }).where(and5(eq5(tables.tokens.userId, userId), eq5(tables.tokens.kind, kind), isNull4(tables.tokens.spentAt), except === undefined ? undefined : ne2(tables.tokens.tokenHash, except))).returning({ tokenHash: tables.tokens.tokenHash });
+      return spent.length;
+    }),
+    deleteUserTokens: (userId) => run$("deleteUserTokens", async () => {
+      const deleted = await db.delete(tables.tokens).where(eq5(tables.tokens.userId, userId)).returning({ tokenHash: tables.tokens.tokenHash });
+      return deleted.length;
+    })
+  };
+}
+async function consumeToken(db, tables, tokenHash, kind, at) {
+  const before = db.$with("before").as(db.select().from(tables.tokens).where(and5(eq5(tables.tokens.tokenHash, tokenHash), eq5(tables.tokens.kind, kind))).for("update"));
+  const [spent] = await db.with(before).update(tables.tokens).set({
+    spentAt: sql5`coalesce(${tables.tokens.spentAt}, ${stamp(at)})`
+  }).from(before).where(eq5(tables.tokens.tokenHash, before.tokenHash)).returning({
+    tokenHash: before.tokenHash,
+    kind: before.kind,
+    userId: before.userId,
+    address: before.address,
+    codeHash: before.codeHash,
+    attempts: before.attempts,
+    expiresAt: before.expiresAt,
+    spentAt: before.spentAt,
+    createdAt: before.createdAt
+  });
+  return spent === undefined ? null : { ...spent, userId: spent.userId };
+}
+async function countAttempt(db, tables, tokenHash, kind) {
+  const match = and5(eq5(tables.tokens.tokenHash, tokenHash), eq5(tables.tokens.kind, kind));
+  const [counted] = await db.update(tables.tokens).set({ attempts: sql5`${tables.tokens.attempts} + 1` }).where(and5(match, isNull4(tables.tokens.spentAt))).returning();
+  const row = counted ?? (await db.select().from(tables.tokens).where(match))[0];
+  return row === undefined ? null : { ...row, userId: row.userId };
+}
+
+// src/stores/users.ts
+import { withTransaction as withTransaction2 } from "@nxgt/drizzle/pg";
+import { NotFoundError, StoreConflict as StoreConflict2 } from "@nxgt/janus";
+import { and as and6, asc as asc2, eq as eq6, gt as gt2, sql as sql6 } from "drizzle-orm";
+
+// src/stores/logins.ts
+async function claimLogins(tx, tables, operation, user, logins) {
+  const distinct = [...new Set(logins)].sort();
+  if (distinct.length === 0)
+    return;
+  const written = await tx.insert(tables.logins).values(distinct.map((login) => ({ type: user.type, login, userId: user.id }))).onConflictDoNothing().returning({ login: tables.logins.login });
+  if (written.length === distinct.length)
+    return;
+  const claimed = new Set(written.map((row) => row.login));
+  const taken = distinct.find((login) => !claimed.has(login)) ?? "";
+  throw loginTaken(operation, user.type, taken);
+}
+
+// src/stores/users.ts
+function userStore(db, tables) {
+  const run$ = (operation, body) => run("users", operation, body);
+  return {
+    insertUser: (record) => run$("insertUser", () => insertUser(db, tables, record)),
+    findUser: (id) => run$("findUser", () => findUser(db, tables, id)),
+    findUserByLogin: (type, login) => run$("findUserByLogin", async () => {
+      const [row] = await db.select({ user: tables.users }).from(tables.logins).innerJoin(tables.users, eq6(tables.users.id, tables.logins.userId)).where(and6(eq6(tables.logins.type, type), eq6(tables.logins.login, login)));
+      return row === undefined ? null : toUser(row.user);
+    }),
+    listUsers: ({ type, after, limit }) => run$("listUsers", async () => {
+      const found = await db.select().from(tables.users).where(after === null ? eq6(tables.users.type, type) : and6(eq6(tables.users.type, type), gt2(tables.users.id, after))).orderBy(asc2(tables.users.id)).limit(limit + 1);
+      const items = found.slice(0, limit).map(toUser);
+      const last = items.at(-1);
+      return {
+        items,
+        nextCursor: found.length > limit && last !== undefined ? last.id : null
+      };
+    }),
+    updateUser: (id, patch, ifVersion) => run$("updateUser", () => withTransaction2(db, (tx) => updateUser(tx, tables, id, patch, ifVersion))),
+    deleteUser: (id) => run$("deleteUser", async () => {
+      const deleted = await db.delete(tables.users).where(eq6(tables.users.id, id)).returning({ id: tables.users.id });
+      return deleted.length === 1;
+    })
+  };
+}
+async function findUser(db, tables, id) {
+  const [row] = await db.select().from(tables.users).where(eq6(tables.users.id, id));
+  return row === undefined ? null : toUser(row);
+}
+async function insertUser(db, tables, record) {
+  const inserted = await withTransaction2(db, async (tx) => {
+    const [row] = await tx.insert(tables.users).values(toUserRow(record)).onConflictDoNothing({ target: tables.users.id }).returning();
+    if (row === undefined)
+      return null;
+    await claimLogins(tx, tables, "insertUser", record, record.logins);
+    return toUser(row);
+  });
+  if (inserted !== null)
+    return inserted;
+  const stored = await findUser(db, tables, record.id);
+  if (stored !== null)
+    return stored;
+  throw new NotFoundError("insertUser: the user was deleted meanwhile", {
+    userId: record.id,
+    operation: "insertUser"
+  });
+}
+async function updateUser(tx, tables, id, patch, ifVersion) {
+  const [row] = await tx.update(tables.users).set({
+    ...toUserSet(patch),
+    version: sql6`${tables.users.version} + 1`
+  }).where(and6(eq6(tables.users.id, id), eq6(tables.users.version, ifVersion))).returning();
+  if (row === undefined) {
+    const [stored] = await tx.select({ version: tables.users.version }).from(tables.users).where(eq6(tables.users.id, id));
+    if (stored === undefined) {
+      throw new NotFoundError("updateUser: no user has this id", {
+        userId: id,
+        operation: "updateUser"
+      });
+    }
+    throw new StoreConflict2("version", `updateUser: expected version ${ifVersion}, found ${stored.version}`, {
+      userId: id,
+      expectedVersion: ifVersion,
+      actualVersion: stored.version,
+      operation: "updateUser"
+    });
+  }
+  if (patch.logins !== undefined) {
+    await tx.delete(tables.logins).where(eq6(tables.logins.userId, id));
+    await claimLogins(tx, tables, "updateUser", row, patch.logins);
+  }
+  return toUser(row);
+}
+
+// src/stores/index.ts
+function createDrizzleStores(db, options = {}) {
+  const tables = options.tables ?? defineJanusTables();
+  return {
+    users: userStore(db, tables),
+    sessions: sessionStore(db, tables),
+    tokens: tokenStore(db, tables)
+  };
 }
 
 // src/adapter.ts
@@ -485,5 +560,5 @@ export {
   defineJanusTables
 };
 
-//# debugId=7AD52CBFCEA4D74A64756E2164756E21
+//# debugId=BBBB8A4136A5079264756E2164756E21
 //# sourceMappingURL=index.js.map