@oidcraft/drizzle 0.0.0-stage → 0.1.0

package/dist/index.mjs

@@ -0,0 +1,620 @@
+import { and, eq, gt, isNull, lte } from "drizzle-orm";
+import { index, integer, primaryKey, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
+import { customType, index as index$1, integer as integer$1, pgSchema, pgTable, primaryKey as primaryKey$1, text as text$1, uniqueIndex as uniqueIndex$1 } from "drizzle-orm/pg-core";
+// src/schema.ts
+/**
+* Real columns and real indexes for every value the core queries by (FR-A5).
+*
+* The shape a key-value adapter is forced into — one row of JSON per artifact — turns revocation
+* and the user-code lookup into full scans. Those are on the hot path of every token request, so a
+* relational adapter must not reproduce it.
+*/
+const clients = sqliteTable("oidc_clients", {
+	clientId: text("client_id").primaryKey(),
+	data: text("data", { mode: "json" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+});
+const artifacts = sqliteTable("oidc_artifacts", {
+	kind: text("kind").notNull(),
+	id: text("id").notNull(),
+	clientId: text("client_id").notNull(),
+	accountId: text("account_id"),
+	grantId: text("grant_id"),
+	userCode: text("user_code"),
+	payload: text("payload", { mode: "json" }).notNull(),
+	consumedAt: integer("consumed_at", { mode: "timestamp_ms" }),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [
+	primaryKey({ columns: [table.kind, table.id] }),
+	index("oidc_artifacts_grant_idx").on(table.grantId),
+	index("oidc_artifacts_user_code_idx").on(table.userCode),
+	index("oidc_artifacts_expiry_idx").on(table.expiresAt)
+]);
+const sessions = sqliteTable("oidc_sessions", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	authTime: integer("auth_time", { mode: "timestamp_ms" }).notNull(),
+	acr: text("acr"),
+	amr: text("amr", { mode: "json" }),
+	idp: text("idp"),
+	upstreamSessionId: text("upstream_session_id"),
+	clients: text("clients", { mode: "json" }).notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [
+	index("oidc_sessions_account_idx").on(table.accountId),
+	index("oidc_sessions_upstream_idx").on(table.idp, table.upstreamSessionId),
+	index("oidc_sessions_expiry_idx").on(table.expiresAt)
+]);
+const grants = sqliteTable("oidc_grants", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	clientId: text("client_id").notNull(),
+	scopes: text("scopes", { mode: "json" }).notNull(),
+	claims: text("claims", { mode: "json" }).notNull(),
+	resources: text("resources", { mode: "json" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" })
+}, (table) => [uniqueIndex("oidc_grants_account_client_idx").on(table.accountId, table.clientId)]);
+const identities = sqliteTable("oidc_identities", {
+	provider: text("provider").notNull(),
+	subject: text("subject").notNull(),
+	accountId: text("account_id").notNull(),
+	email: text("email"),
+	claims: text("claims", { mode: "json" }).notNull(),
+	linkedAt: integer("linked_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [primaryKey({ columns: [table.provider, table.subject] }), index("oidc_identities_account_idx").on(table.accountId)]);
+const replay = sqliteTable("oidc_replay", {
+	namespace: text("namespace").notNull(),
+	value: text("value").notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [primaryKey({ columns: [table.namespace, table.value] }), index("oidc_replay_expiry_idx").on(table.expiresAt)]);
+const credentials = sqliteTable("oidc_credentials", {
+	accountId: text("account_id").primaryKey(),
+	username: text("username").notNull(),
+	passwordHash: text("password_hash").notNull(),
+	claims: text("claims", { mode: "json" }).notNull(),
+	totpSecret: text("totp_secret"),
+	totpConfirmedAt: integer("totp_confirmed_at", { mode: "timestamp_ms" }),
+	recoveryCodes: text("recovery_codes", { mode: "json" }),
+	failedAttempts: integer("failed_attempts").notNull().default(0),
+	lockedUntil: integer("locked_until", { mode: "timestamp_ms" }),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [uniqueIndex("oidc_credentials_username_idx").on(table.username)]);
+const realms = sqliteTable("oidc_realms", {
+	id: text("id").primaryKey(),
+	displayName: text("display_name"),
+	enabled: integer("enabled", { mode: "boolean" }).notNull(),
+	settings: text("settings", { mode: "json" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+});
+const schema = {
+	clients,
+	artifacts,
+	sessions,
+	grants,
+	identities,
+	replay,
+	credentials,
+	realms
+};
+// ../sql/dist/postgres.mjs
+/**
+* The same tables as `SQLITE_MIGRATIONS`, with the same ids, for Postgres (FR-A4). Milliseconds are
+* `bigint` and JSON stays `text`, so every adapter reads and writes exactly what it does on SQLite.
+* Table names are unqualified: they land in whatever schema the host migrates into, which is how a
+* realm gets a schema of its own in one database (G-6).
+*/
+const POSTGRES_MIGRATIONS = [
+	{
+		id: "0001_init",
+		statements: [
+			"create table oidc_clients (client_id text primary key, data text not null, created_at bigint not null, updated_at bigint not null)",
+			"create table oidc_artifacts (kind text not null, id text not null, client_id text not null, account_id text, grant_id text, user_code text, payload text not null, consumed_at bigint, expires_at bigint not null, primary key (kind, id))",
+			"create index oidc_artifacts_grant_idx on oidc_artifacts (grant_id)",
+			"create index oidc_artifacts_user_code_idx on oidc_artifacts (user_code)",
+			"create index oidc_artifacts_expiry_idx on oidc_artifacts (expires_at)",
+			"create table oidc_sessions (id text primary key, account_id text not null, auth_time bigint not null, acr text, amr text, idp text, upstream_session_id text, clients text not null, expires_at bigint not null)",
+			"create index oidc_sessions_account_idx on oidc_sessions (account_id)",
+			"create index oidc_sessions_upstream_idx on oidc_sessions (idp, upstream_session_id)",
+			"create table oidc_grants (id text primary key, account_id text not null, client_id text not null, scopes text not null, claims text not null, resources text not null, created_at bigint not null, expires_at bigint)",
+			"create unique index oidc_grants_account_client_idx on oidc_grants (account_id, client_id)",
+			"create table oidc_identities (provider text not null, subject text not null, account_id text not null, email text, claims text not null, linked_at bigint not null, primary key (provider, subject))",
+			"create table oidc_replay (namespace text not null, value text not null, expires_at bigint not null, primary key (namespace, value))"
+		]
+	},
+	{
+		id: "0002_credentials",
+		statements: [
+			"create table oidc_credentials (account_id text primary key, username text not null, password_hash text not null, claims text not null, totp_secret text, totp_confirmed_at bigint, recovery_codes text, failed_attempts integer not null default 0, locked_until bigint, created_at bigint not null, updated_at bigint not null)",
+			"create unique index oidc_credentials_username_idx on oidc_credentials (username)",
+			"create index oidc_identities_account_idx on oidc_identities (account_id)",
+			"create index oidc_replay_expiry_idx on oidc_replay (expires_at)"
+		]
+	},
+	{
+		id: "0003_realms",
+		statements: ["create table oidc_realms (id text primary key, display_name text, enabled integer not null, settings text not null, created_at bigint not null, updated_at bigint not null)"]
+	}
+];
+// ../sql/dist/sqlite.mjs
+/**
+* The SQLite schema every SQL adapter queries, as ordered migrations the host applies with its own
+* tooling. The library never runs them: a library that migrates on import migrates during a rolling
+* deploy, from several processes at once (ARCHITECTURE.md §4.2, FR-A4).
+*/
+const SQLITE_MIGRATIONS = [
+	{
+		id: "0001_init",
+		statements: [
+			"create table oidc_clients (client_id text primary key, data text not null, created_at integer not null, updated_at integer not null)",
+			"create table oidc_artifacts (kind text not null, id text not null, client_id text not null, account_id text, grant_id text, user_code text, payload text not null, consumed_at integer, expires_at integer not null, primary key (kind, id))",
+			"create index oidc_artifacts_grant_idx on oidc_artifacts (grant_id)",
+			"create index oidc_artifacts_user_code_idx on oidc_artifacts (user_code)",
+			"create index oidc_artifacts_expiry_idx on oidc_artifacts (expires_at)",
+			"create table oidc_sessions (id text primary key, account_id text not null, auth_time integer not null, acr text, amr text, idp text, upstream_session_id text, clients text not null, expires_at integer not null)",
+			"create index oidc_sessions_account_idx on oidc_sessions (account_id)",
+			"create index oidc_sessions_upstream_idx on oidc_sessions (idp, upstream_session_id)",
+			"create table oidc_grants (id text primary key, account_id text not null, client_id text not null, scopes text not null, claims text not null, resources text not null, created_at integer not null, expires_at integer)",
+			"create unique index oidc_grants_account_client_idx on oidc_grants (account_id, client_id)",
+			"create table oidc_identities (provider text not null, subject text not null, account_id text not null, email text, claims text not null, linked_at integer not null, primary key (provider, subject))",
+			"create table oidc_replay (namespace text not null, value text not null, expires_at integer not null, primary key (namespace, value))"
+		]
+	},
+	{
+		id: "0002_credentials",
+		statements: [
+			"create table oidc_credentials (account_id text primary key, username text not null, password_hash text not null, claims text not null, totp_secret text, totp_confirmed_at integer, recovery_codes text, failed_attempts integer not null default 0, locked_until integer, created_at integer not null, updated_at integer not null)",
+			"create unique index oidc_credentials_username_idx on oidc_credentials (username)",
+			"create index oidc_identities_account_idx on oidc_identities (account_id)",
+			"create index oidc_replay_expiry_idx on oidc_replay (expires_at)"
+		]
+	},
+	{
+		id: "0003_realms",
+		statements: ["create table oidc_realms (id text primary key, display_name text, enabled integer not null, settings text not null, created_at integer not null, updated_at integer not null)"]
+	}
+];
+// src/postgres-schema.ts
+const millis = customType({
+	dataType: () => "bigint",
+	toDriver: (value) => value.getTime(),
+	fromDriver: (value) => new Date(Number(value))
+});
+const json = customType({
+	dataType: () => "text",
+	toDriver: (value) => JSON.stringify(value),
+	fromDriver: (value) => JSON.parse(value)
+});
+const flag = customType({
+	dataType: () => "integer",
+	toDriver: (value) => value ? 1 : 0,
+	fromDriver: (value) => Boolean(value)
+});
+/**
+* The oidcraft tables for Postgres, in `schema` or in the search path when it is omitted. A factory,
+* because Drizzle fixes a table's schema when the table is defined: a realm with a schema of its own
+* (G-6) needs tables of its own. Pass the result as `drizzleAdapter`'s `tables`.
+*/
+const postgresTables = (schema) => {
+	const table = schema ? pgSchema(schema).table.bind(pgSchema(schema)) : pgTable;
+	return {
+		clients: table("oidc_clients", {
+			clientId: text$1("client_id").primaryKey(),
+			data: json("data").notNull(),
+			createdAt: millis("created_at").notNull(),
+			updatedAt: millis("updated_at").notNull()
+		}),
+		artifacts: table("oidc_artifacts", {
+			kind: text$1("kind").notNull(),
+			id: text$1("id").notNull(),
+			clientId: text$1("client_id").notNull(),
+			accountId: text$1("account_id"),
+			grantId: text$1("grant_id"),
+			userCode: text$1("user_code"),
+			payload: json("payload").notNull(),
+			consumedAt: millis("consumed_at"),
+			expiresAt: millis("expires_at").notNull()
+		}, (t) => [
+			primaryKey$1({ columns: [t.kind, t.id] }),
+			index$1("oidc_artifacts_grant_idx").on(t.grantId),
+			index$1("oidc_artifacts_user_code_idx").on(t.userCode),
+			index$1("oidc_artifacts_expiry_idx").on(t.expiresAt)
+		]),
+		sessions: table("oidc_sessions", {
+			id: text$1("id").primaryKey(),
+			accountId: text$1("account_id").notNull(),
+			authTime: millis("auth_time").notNull(),
+			acr: text$1("acr"),
+			amr: json("amr"),
+			idp: text$1("idp"),
+			upstreamSessionId: text$1("upstream_session_id"),
+			clients: json("clients").notNull(),
+			expiresAt: millis("expires_at").notNull()
+		}, (t) => [index$1("oidc_sessions_account_idx").on(t.accountId), index$1("oidc_sessions_upstream_idx").on(t.idp, t.upstreamSessionId)]),
+		grants: table("oidc_grants", {
+			id: text$1("id").primaryKey(),
+			accountId: text$1("account_id").notNull(),
+			clientId: text$1("client_id").notNull(),
+			scopes: json("scopes").notNull(),
+			claims: json("claims").notNull(),
+			resources: json("resources").notNull(),
+			createdAt: millis("created_at").notNull(),
+			expiresAt: millis("expires_at")
+		}, (t) => [uniqueIndex$1("oidc_grants_account_client_idx").on(t.accountId, t.clientId)]),
+		identities: table("oidc_identities", {
+			provider: text$1("provider").notNull(),
+			subject: text$1("subject").notNull(),
+			accountId: text$1("account_id").notNull(),
+			email: text$1("email"),
+			claims: json("claims").notNull(),
+			linkedAt: millis("linked_at").notNull()
+		}, (t) => [primaryKey$1({ columns: [t.provider, t.subject] }), index$1("oidc_identities_account_idx").on(t.accountId)]),
+		replay: table("oidc_replay", {
+			namespace: text$1("namespace").notNull(),
+			value: text$1("value").notNull(),
+			expiresAt: millis("expires_at").notNull()
+		}, (t) => [primaryKey$1({ columns: [t.namespace, t.value] }), index$1("oidc_replay_expiry_idx").on(t.expiresAt)]),
+		credentials: table("oidc_credentials", {
+			accountId: text$1("account_id").primaryKey(),
+			username: text$1("username").notNull(),
+			passwordHash: text$1("password_hash").notNull(),
+			claims: json("claims").notNull(),
+			totpSecret: text$1("totp_secret"),
+			totpConfirmedAt: millis("totp_confirmed_at"),
+			recoveryCodes: json("recovery_codes"),
+			failedAttempts: integer$1("failed_attempts").notNull().default(0),
+			lockedUntil: millis("locked_until"),
+			createdAt: millis("created_at").notNull(),
+			updatedAt: millis("updated_at").notNull()
+		}, (t) => [uniqueIndex$1("oidc_credentials_username_idx").on(t.username)]),
+		realms: table("oidc_realms", {
+			id: text$1("id").primaryKey(),
+			displayName: text$1("display_name"),
+			enabled: flag("enabled").notNull(),
+			settings: json("settings").notNull(),
+			createdAt: millis("created_at").notNull(),
+			updatedAt: millis("updated_at").notNull()
+		})
+	};
+};
+// src/index.ts
+const now = () => /* @__PURE__ */ new Date();
+/** FR-T5: enforced by the query, so a missed prune still cannot serve an expired row. */
+const live = (column) => gt(column, now());
+const drizzleAdapter = (options) => {
+	const db = options.db;
+	const { clients, artifacts, sessions, grants, identities, replay, credentials, realms } = options.tables ?? schema;
+	const toArtifact = (row) => ({
+		id: row.id,
+		kind: row.kind,
+		clientId: row.clientId,
+		...row.accountId && { accountId: row.accountId },
+		...row.grantId && { grantId: row.grantId },
+		payload: row.payload,
+		...row.consumedAt && { consumedAt: row.consumedAt },
+		expiresAt: row.expiresAt
+	});
+	const toSession = (row) => ({
+		id: row.id,
+		accountId: row.accountId,
+		authTime: row.authTime,
+		...row.acr && { acr: row.acr },
+		...row.amr ? { amr: row.amr } : {},
+		...row.idp && { idp: row.idp },
+		...row.upstreamSessionId && { upstreamSessionId: row.upstreamSessionId },
+		clients: row.clients,
+		expiresAt: row.expiresAt
+	});
+	const toGrant = (row) => ({
+		id: row.id,
+		accountId: row.accountId,
+		clientId: row.clientId,
+		scopes: row.scopes,
+		claims: row.claims,
+		resources: row.resources,
+		createdAt: row.createdAt,
+		...row.expiresAt && { expiresAt: row.expiresAt }
+	});
+	return {
+		clients: {
+			async find(clientId) {
+				const [row] = await db.select().from(clients).where(eq(clients.clientId, clientId)).limit(1);
+				return row ? {
+					...row.data,
+					createdAt: row.createdAt,
+					updatedAt: row.updatedAt
+				} : void 0;
+			},
+			async upsert(client) {
+				await db.insert(clients).values({
+					clientId: client.clientId,
+					data: client,
+					createdAt: client.createdAt,
+					updatedAt: client.updatedAt
+				}).onConflictDoUpdate({
+					target: clients.clientId,
+					set: {
+						data: client,
+						updatedAt: client.updatedAt
+					}
+				});
+			},
+			async destroy(clientId) {
+				await db.delete(clients).where(eq(clients.clientId, clientId));
+			},
+			async list() {
+				return { clients: (await db.select().from(clients)).map((row) => ({
+					...row.data,
+					createdAt: row.createdAt,
+					updatedAt: row.updatedAt
+				})) };
+			}
+		},
+		artifacts: {
+			async upsert(artifact) {
+				const row = {
+					kind: artifact.kind,
+					id: artifact.id,
+					clientId: artifact.clientId,
+					accountId: artifact.accountId ?? null,
+					grantId: artifact.grantId ?? null,
+					userCode: artifact.payload.userCode ?? null,
+					payload: artifact.payload,
+					consumedAt: artifact.consumedAt ?? null,
+					expiresAt: artifact.expiresAt
+				};
+				await db.insert(artifacts).values(row).onConflictDoUpdate({
+					target: [artifacts.kind, artifacts.id],
+					set: {
+						...row,
+						consumedAt: void 0
+					}
+				});
+			},
+			async find(kind, id) {
+				const [row] = await db.select().from(artifacts).where(and(eq(artifacts.kind, kind), eq(artifacts.id, id), live(artifacts.expiresAt))).limit(1);
+				return row ? toArtifact(row) : void 0;
+			},
+			async findByUserCode(userCode) {
+				const [row] = await db.select().from(artifacts).where(and(eq(artifacts.userCode, userCode), live(artifacts.expiresAt))).limit(1);
+				return row ? toArtifact(row) : void 0;
+			},
+			async consume(kind, id) {
+				return (await db.update(artifacts).set({ consumedAt: now() }).where(and(eq(artifacts.kind, kind), eq(artifacts.id, id), isNull(artifacts.consumedAt), live(artifacts.expiresAt))).returning({ id: artifacts.id })).length === 1;
+			},
+			async destroy(kind, id) {
+				await db.delete(artifacts).where(and(eq(artifacts.kind, kind), eq(artifacts.id, id)));
+			},
+			async revokeByGrantId(grantId) {
+				await db.delete(artifacts).where(eq(artifacts.grantId, grantId));
+			},
+			async prune(before, limit) {
+				const doomed = await db.select({
+					kind: artifacts.kind,
+					id: artifacts.id
+				}).from(artifacts).where(lte(artifacts.expiresAt, before)).limit(limit);
+				for (const row of doomed) await db.delete(artifacts).where(and(eq(artifacts.kind, row.kind), eq(artifacts.id, row.id)));
+				return doomed.length;
+			}
+		},
+		sessions: {
+			async find(id) {
+				const [row] = await db.select().from(sessions).where(and(eq(sessions.id, id), gt(sessions.expiresAt, now()))).limit(1);
+				return row ? toSession(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.select().from(sessions).where(and(eq(sessions.accountId, accountId), gt(sessions.expiresAt, now())))).map(toSession);
+			},
+			async findByUpstreamSession(provider, upstreamSessionId) {
+				return (await db.select().from(sessions).where(and(eq(sessions.idp, provider), eq(sessions.upstreamSessionId, upstreamSessionId)))).map(toSession);
+			},
+			async upsert(session) {
+				const row = {
+					id: session.id,
+					accountId: session.accountId,
+					authTime: session.authTime,
+					acr: session.acr ?? null,
+					amr: session.amr ?? null,
+					idp: session.idp ?? null,
+					upstreamSessionId: session.upstreamSessionId ?? null,
+					clients: session.clients,
+					expiresAt: session.expiresAt
+				};
+				await db.insert(sessions).values(row).onConflictDoUpdate({
+					target: sessions.id,
+					set: row
+				});
+			},
+			async addClient(id, clientId) {
+				for (let attempt = 0; attempt < 64; attempt++) {
+					const [row] = await db.select({ clients: sessions.clients }).from(sessions).where(eq(sessions.id, id)).limit(1);
+					if (!row) return;
+					const current = row.clients;
+					if (current.includes(clientId)) return;
+					if ((await db.update(sessions).set({ clients: [...current, clientId] }).where(and(eq(sessions.id, id), eq(sessions.clients, current))).returning({ id: sessions.id })).length) return;
+				}
+				throw new Error(`session ${id} kept changing; its client list could not be updated`);
+			},
+			async destroy(id) {
+				await db.delete(sessions).where(eq(sessions.id, id));
+			}
+		},
+		grants: {
+			async find(id) {
+				const [row] = await db.select().from(grants).where(eq(grants.id, id)).limit(1);
+				return row ? toGrant(row) : void 0;
+			},
+			async findByAccountAndClient(accountId, clientId) {
+				const [row] = await db.select().from(grants).where(and(eq(grants.accountId, accountId), eq(grants.clientId, clientId))).limit(1);
+				return row ? toGrant(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.select().from(grants).where(eq(grants.accountId, accountId))).map(toGrant);
+			},
+			async upsert(grant) {
+				const row = {
+					id: grant.id,
+					accountId: grant.accountId,
+					clientId: grant.clientId,
+					scopes: grant.scopes,
+					claims: grant.claims,
+					resources: grant.resources,
+					createdAt: grant.createdAt,
+					expiresAt: grant.expiresAt ?? null
+				};
+				await db.insert(grants).values(row).onConflictDoUpdate({
+					target: grants.id,
+					set: row
+				});
+			},
+			async destroy(id) {
+				await db.delete(grants).where(eq(grants.id, id));
+			}
+		},
+		accounts: options.accounts ?? noAccounts,
+		keys: options.keys,
+		replay: { async claim(namespace, value, ttl) {
+			const expiresAt = new Date(Date.now() + ttl * 1e3);
+			return (await db.insert(replay).values({
+				namespace,
+				value,
+				expiresAt
+			}).onConflictDoUpdate({
+				target: [replay.namespace, replay.value],
+				set: { expiresAt },
+				setWhere: lte(replay.expiresAt, now())
+			}).returning({ value: replay.value })).length === 1;
+		} },
+		credentials: {
+			async find(accountId) {
+				const [row] = await db.select().from(credentials).where(eq(credentials.accountId, accountId)).limit(1);
+				return row ? toCredential(row) : void 0;
+			},
+			async findByUsername(username) {
+				const [row] = await db.select().from(credentials).where(eq(credentials.username, username)).limit(1);
+				return row ? toCredential(row) : void 0;
+			},
+			async create(credential) {
+				return (await db.insert(credentials).values(credentialRow(credential)).onConflictDoNothing().returning({ id: credentials.accountId })).length === 1;
+			},
+			async upsert(credential) {
+				const row = credentialRow(credential);
+				await db.insert(credentials).values(row).onConflictDoUpdate({
+					target: credentials.accountId,
+					set: row
+				});
+			},
+			async destroy(accountId) {
+				await db.delete(credentials).where(eq(credentials.accountId, accountId));
+			}
+		},
+		realms: {
+			async find(id) {
+				const [row] = await db.select().from(realms).where(eq(realms.id, id)).limit(1);
+				return row ? toRealm(row) : void 0;
+			},
+			async list() {
+				return (await db.select().from(realms)).map(toRealm);
+			},
+			async create(realm) {
+				return (await db.insert(realms).values(realmRow(realm)).onConflictDoNothing().returning({ id: realms.id })).length === 1;
+			},
+			async upsert(realm) {
+				const row = realmRow(realm);
+				await db.insert(realms).values(row).onConflictDoUpdate({
+					target: realms.id,
+					set: row
+				});
+			},
+			async destroy(id) {
+				await db.delete(realms).where(eq(realms.id, id));
+			}
+		},
+		identities: {
+			async find(provider, subject) {
+				const [row] = await db.select().from(identities).where(and(eq(identities.provider, provider), eq(identities.subject, subject))).limit(1);
+				return row ? toIdentity(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.select().from(identities).where(eq(identities.accountId, accountId))).map(toIdentity);
+			},
+			async upsert(identity) {
+				const row = {
+					provider: identity.provider,
+					subject: identity.subject,
+					accountId: identity.accountId,
+					email: identity.email ?? null,
+					claims: identity.claims,
+					linkedAt: identity.linkedAt
+				};
+				await db.insert(identities).values(row).onConflictDoUpdate({
+					target: [identities.provider, identities.subject],
+					set: row
+				});
+			},
+			async destroy(provider, subject) {
+				await db.delete(identities).where(and(eq(identities.provider, provider), eq(identities.subject, subject)));
+			}
+		}
+	};
+};
+const noAccounts = {
+	async find() {},
+	async claims() {}
+};
+const credentialRow = (credential) => ({
+	accountId: credential.accountId,
+	username: credential.username,
+	passwordHash: credential.passwordHash,
+	claims: credential.claims,
+	totpSecret: credential.totp?.secret ?? null,
+	totpConfirmedAt: credential.totp?.confirmedAt ?? null,
+	recoveryCodes: credential.recoveryCodes ?? null,
+	failedAttempts: credential.failedAttempts,
+	lockedUntil: credential.lockedUntil ?? null,
+	createdAt: credential.createdAt,
+	updatedAt: credential.updatedAt
+});
+const toCredential = (row) => ({
+	accountId: row.accountId,
+	username: row.username,
+	passwordHash: row.passwordHash,
+	claims: row.claims,
+	...row.totpSecret && { totp: {
+		secret: row.totpSecret,
+		...row.totpConfirmedAt && { confirmedAt: row.totpConfirmedAt }
+	} },
+	...row.recoveryCodes ? { recoveryCodes: row.recoveryCodes } : {},
+	failedAttempts: row.failedAttempts,
+	...row.lockedUntil && { lockedUntil: row.lockedUntil },
+	createdAt: row.createdAt,
+	updatedAt: row.updatedAt
+});
+const realmRow = (realm) => ({
+	id: realm.id,
+	displayName: realm.displayName ?? null,
+	enabled: realm.enabled,
+	settings: realm.settings,
+	createdAt: realm.createdAt,
+	updatedAt: realm.updatedAt
+});
+const toRealm = (row) => ({
+	id: row.id,
+	...row.displayName && { displayName: row.displayName },
+	enabled: row.enabled,
+	settings: row.settings,
+	createdAt: row.createdAt,
+	updatedAt: row.updatedAt
+});
+const toIdentity = (row) => ({
+	accountId: row.accountId,
+	provider: row.provider,
+	subject: row.subject,
+	...row.email && { email: row.email },
+	claims: row.claims,
+	linkedAt: row.linkedAt
+});
+export { POSTGRES_MIGRATIONS, SQLITE_MIGRATIONS, artifacts, clients, credentials, drizzleAdapter, grants, identities, postgresTables, realms, replay, schema, sessions };

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@oidcraft/drizzle",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "A Drizzle storage adapter for @oidcraft/provider, on Postgres or SQLite.",
+  "license": "MIT",
+  "author": "Fl0r14n <florian.chis@gmail.com>",
+  "homepage": "https://github.com/Fl0r14n/oidcraft/tree/main/packages/drizzle",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Fl0r14n/oidcraft",
+    "directory": "packages/drizzle"
+  },
+  "keywords": [
+    "oidc",
+    "openid",
+    "oauth2",
+    "authorization-server",
+    "oidcraft",
+    "storage",
+    "adapter",
+    "drizzle"
+  ],
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsdown && bun run verify:entries",
+    "prepublishOnly": "bun run build",
+    "test": "bun test",
+    "typecheck": "bun check",
+    "verify:entries": "bun run verify-entries.ts"
+  },
+  "peerDependencies": {
+    "@oidcraft/adapter": "^0.1.0",
+    "drizzle-orm": ">=1.0.0-rc.5"
+  },
+  "devDependencies": {
+    "@oidcraft/adapter": "^0.1.0",
+    "@oidcraft/sql": "0.0.0",
+    "@types/pg": "^8.23.1",
+    "drizzle-orm": "1.0.0-rc.5",
+    "pg": "^8.23.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=24.7"
+  }
+}