@oidcraft/drizzle 0.0.0-stage → 0.2.0

package/dist/index.mjs

@@ -0,0 +1,685 @@
+import { noAccounts } from "@oidcraft/adapter";
+import { and, eq, gt, isNull, lte } from "drizzle-orm";
+import { index, integer, primaryKey, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
+import { customType, index as index$1, integer as integer$1, pgSchema, pgTable, primaryKey as primaryKey$1, text as text$1, uniqueIndex as uniqueIndex$1 } from "drizzle-orm/pg-core";
+// src/schema.ts
+/**
+* Real columns and real indexes for every value the core queries by (FR-A5).
+*
+* The shape a key-value adapter is forced into — one row of JSON per artifact — turns revocation
+* and the user-code lookup into full scans. Those are on the hot path of every token request, so a
+* relational adapter must not reproduce it.
+*/
+const clients = sqliteTable("oidc_clients", {
+	clientId: text("client_id").primaryKey(),
+	data: text("data", { mode: "json" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+});
+const artifacts = sqliteTable("oidc_artifacts", {
+	kind: text("kind").notNull(),
+	id: text("id").notNull(),
+	clientId: text("client_id").notNull(),
+	accountId: text("account_id"),
+	grantId: text("grant_id"),
+	familyId: text("family_id"),
+	userCode: text("user_code"),
+	payload: text("payload", { mode: "json" }).notNull(),
+	consumedAt: integer("consumed_at", { mode: "timestamp_ms" }),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [
+	primaryKey({ columns: [table.kind, table.id] }),
+	index("oidc_artifacts_grant_idx").on(table.grantId),
+	index("oidc_artifacts_user_code_idx").on(table.userCode),
+	index("oidc_artifacts_expiry_idx").on(table.expiresAt),
+	index("oidc_artifacts_client_idx").on(table.clientId),
+	index("oidc_artifacts_family_idx").on(table.familyId)
+]);
+const sessions = sqliteTable("oidc_sessions", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	authTime: integer("auth_time", { mode: "timestamp_ms" }).notNull(),
+	acr: text("acr"),
+	amr: text("amr", { mode: "json" }),
+	idp: text("idp"),
+	upstreamSessionId: text("upstream_session_id"),
+	clients: text("clients", { mode: "json" }).notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [
+	index("oidc_sessions_account_idx").on(table.accountId),
+	index("oidc_sessions_upstream_idx").on(table.idp, table.upstreamSessionId),
+	index("oidc_sessions_expiry_idx").on(table.expiresAt)
+]);
+const grants = sqliteTable("oidc_grants", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	clientId: text("client_id").notNull(),
+	scopes: text("scopes", { mode: "json" }).notNull(),
+	claims: text("claims", { mode: "json" }).notNull(),
+	resources: text("resources", { mode: "json" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" })
+}, (table) => [uniqueIndex("oidc_grants_account_client_idx").on(table.accountId, table.clientId), index("oidc_grants_client_idx").on(table.clientId)]);
+const identities = sqliteTable("oidc_identities", {
+	provider: text("provider").notNull(),
+	subject: text("subject").notNull(),
+	accountId: text("account_id").notNull(),
+	email: text("email"),
+	claims: text("claims", { mode: "json" }).notNull(),
+	linkedAt: integer("linked_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [primaryKey({ columns: [table.provider, table.subject] }), index("oidc_identities_account_idx").on(table.accountId)]);
+const replay = sqliteTable("oidc_replay", {
+	namespace: text("namespace").notNull(),
+	value: text("value").notNull(),
+	expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [primaryKey({ columns: [table.namespace, table.value] }), index("oidc_replay_expiry_idx").on(table.expiresAt)]);
+const credentials = sqliteTable("oidc_credentials", {
+	accountId: text("account_id").primaryKey(),
+	username: text("username").notNull(),
+	passwordHash: text("password_hash").notNull(),
+	claims: text("claims", { mode: "json" }).notNull(),
+	totpSecret: text("totp_secret"),
+	totpConfirmedAt: integer("totp_confirmed_at", { mode: "timestamp_ms" }),
+	recoveryCodes: text("recovery_codes", { mode: "json" }),
+	failedAttempts: integer("failed_attempts").notNull().default(0),
+	lockedUntil: integer("locked_until", { mode: "timestamp_ms" }),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [uniqueIndex("oidc_credentials_username_idx").on(table.username)]);
+const realms = sqliteTable("oidc_realms", {
+	id: text("id").primaryKey(),
+	displayName: text("display_name"),
+	enabled: integer("enabled", { mode: "boolean" }).notNull(),
+	settings: text("settings", { mode: "json" }).notNull(),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+});
+const schema = {
+	clients,
+	artifacts,
+	sessions,
+	grants,
+	identities,
+	replay,
+	credentials,
+	realms
+};
+// ../sql/dist/postgres.mjs
+/**
+* The same tables as `SQLITE_MIGRATIONS`, with the same ids, for Postgres (FR-A4). Milliseconds are
+* `bigint` and JSON stays `text`, so every adapter reads and writes exactly what it does on SQLite.
+* Table names are unqualified: they land in whatever schema the host migrates into, which is how a
+* realm gets a schema of its own in one database (G-6).
+*/
+const POSTGRES_MIGRATIONS = [
+	{
+		id: "0001_init",
+		statements: [
+			"create table oidc_clients (client_id text primary key, data text not null, created_at bigint not null, updated_at bigint not null)",
+			"create table oidc_artifacts (kind text not null, id text not null, client_id text not null, account_id text, grant_id text, user_code text, payload text not null, consumed_at bigint, expires_at bigint not null, primary key (kind, id))",
+			"create index oidc_artifacts_grant_idx on oidc_artifacts (grant_id)",
+			"create index oidc_artifacts_user_code_idx on oidc_artifacts (user_code)",
+			"create index oidc_artifacts_expiry_idx on oidc_artifacts (expires_at)",
+			"create table oidc_sessions (id text primary key, account_id text not null, auth_time bigint not null, acr text, amr text, idp text, upstream_session_id text, clients text not null, expires_at bigint not null)",
+			"create index oidc_sessions_account_idx on oidc_sessions (account_id)",
+			"create index oidc_sessions_upstream_idx on oidc_sessions (idp, upstream_session_id)",
+			"create table oidc_grants (id text primary key, account_id text not null, client_id text not null, scopes text not null, claims text not null, resources text not null, created_at bigint not null, expires_at bigint)",
+			"create unique index oidc_grants_account_client_idx on oidc_grants (account_id, client_id)",
+			"create table oidc_identities (provider text not null, subject text not null, account_id text not null, email text, claims text not null, linked_at bigint not null, primary key (provider, subject))",
+			"create table oidc_replay (namespace text not null, value text not null, expires_at bigint not null, primary key (namespace, value))"
+		]
+	},
+	{
+		id: "0002_credentials",
+		statements: [
+			"create table oidc_credentials (account_id text primary key, username text not null, password_hash text not null, claims text not null, totp_secret text, totp_confirmed_at bigint, recovery_codes text, failed_attempts integer not null default 0, locked_until bigint, created_at bigint not null, updated_at bigint not null)",
+			"create unique index oidc_credentials_username_idx on oidc_credentials (username)",
+			"create index oidc_identities_account_idx on oidc_identities (account_id)",
+			"create index oidc_replay_expiry_idx on oidc_replay (expires_at)"
+		]
+	},
+	{
+		id: "0003_realms",
+		statements: ["create table oidc_realms (id text primary key, display_name text, enabled integer not null, settings text not null, created_at bigint not null, updated_at bigint not null)"]
+	},
+	{
+		id: "0004_indexes",
+		statements: [
+			"create index oidc_artifacts_client_idx on oidc_artifacts (client_id)",
+			"create index oidc_grants_client_idx on oidc_grants (client_id)",
+			"create index oidc_sessions_expiry_idx on oidc_sessions (expires_at)"
+		]
+	},
+	{
+		id: "0005_families",
+		statements: ["alter table oidc_artifacts add column family_id text", "create index oidc_artifacts_family_idx on oidc_artifacts (family_id)"]
+	}
+];
+// ../sql/dist/sqlite.mjs
+/**
+* The SQLite schema every SQL adapter queries, as ordered migrations the host applies with its own
+* tooling. The library never runs them: a library that migrates on import migrates during a rolling
+* deploy, from several processes at once (ARCHITECTURE.md §4.2, FR-A4).
+*/
+const SQLITE_MIGRATIONS = [
+	{
+		id: "0001_init",
+		statements: [
+			"create table oidc_clients (client_id text primary key, data text not null, created_at integer not null, updated_at integer not null)",
+			"create table oidc_artifacts (kind text not null, id text not null, client_id text not null, account_id text, grant_id text, user_code text, payload text not null, consumed_at integer, expires_at integer not null, primary key (kind, id))",
+			"create index oidc_artifacts_grant_idx on oidc_artifacts (grant_id)",
+			"create index oidc_artifacts_user_code_idx on oidc_artifacts (user_code)",
+			"create index oidc_artifacts_expiry_idx on oidc_artifacts (expires_at)",
+			"create table oidc_sessions (id text primary key, account_id text not null, auth_time integer not null, acr text, amr text, idp text, upstream_session_id text, clients text not null, expires_at integer not null)",
+			"create index oidc_sessions_account_idx on oidc_sessions (account_id)",
+			"create index oidc_sessions_upstream_idx on oidc_sessions (idp, upstream_session_id)",
+			"create table oidc_grants (id text primary key, account_id text not null, client_id text not null, scopes text not null, claims text not null, resources text not null, created_at integer not null, expires_at integer)",
+			"create unique index oidc_grants_account_client_idx on oidc_grants (account_id, client_id)",
+			"create table oidc_identities (provider text not null, subject text not null, account_id text not null, email text, claims text not null, linked_at integer not null, primary key (provider, subject))",
+			"create table oidc_replay (namespace text not null, value text not null, expires_at integer not null, primary key (namespace, value))"
+		]
+	},
+	{
+		id: "0002_credentials",
+		statements: [
+			"create table oidc_credentials (account_id text primary key, username text not null, password_hash text not null, claims text not null, totp_secret text, totp_confirmed_at integer, recovery_codes text, failed_attempts integer not null default 0, locked_until integer, created_at integer not null, updated_at integer not null)",
+			"create unique index oidc_credentials_username_idx on oidc_credentials (username)",
+			"create index oidc_identities_account_idx on oidc_identities (account_id)",
+			"create index oidc_replay_expiry_idx on oidc_replay (expires_at)"
+		]
+	},
+	{
+		id: "0003_realms",
+		statements: ["create table oidc_realms (id text primary key, display_name text, enabled integer not null, settings text not null, created_at integer not null, updated_at integer not null)"]
+	},
+	{
+		id: "0004_indexes",
+		statements: [
+			"create index oidc_artifacts_client_idx on oidc_artifacts (client_id)",
+			"create index oidc_grants_client_idx on oidc_grants (client_id)",
+			"create index oidc_sessions_expiry_idx on oidc_sessions (expires_at)"
+		]
+	},
+	{
+		id: "0005_families",
+		statements: ["alter table oidc_artifacts add column family_id text", "create index oidc_artifacts_family_idx on oidc_artifacts (family_id)"]
+	}
+];
+// src/postgres-schema.ts
+const millis = customType({
+	dataType: () => "bigint",
+	toDriver: (value) => value.getTime(),
+	fromDriver: (value) => new Date(Number(value))
+});
+const json = customType({
+	dataType: () => "text",
+	toDriver: (value) => JSON.stringify(value),
+	fromDriver: (value) => JSON.parse(value)
+});
+const flag = customType({
+	dataType: () => "integer",
+	toDriver: (value) => value ? 1 : 0,
+	fromDriver: (value) => Boolean(value)
+});
+/**
+* The oidcraft tables for Postgres, in `schema` or in the search path when it is omitted. A factory,
+* because Drizzle fixes a table's schema when the table is defined: a realm with a schema of its own
+* (G-6) needs tables of its own. Pass the result as `drizzleAdapter`'s `tables`.
+*/
+const postgresTables = (schema) => {
+	const table = schema ? pgSchema(schema).table.bind(pgSchema(schema)) : pgTable;
+	return {
+		clients: table("oidc_clients", {
+			clientId: text$1("client_id").primaryKey(),
+			data: json("data").notNull(),
+			createdAt: millis("created_at").notNull(),
+			updatedAt: millis("updated_at").notNull()
+		}),
+		artifacts: table("oidc_artifacts", {
+			kind: text$1("kind").notNull(),
+			id: text$1("id").notNull(),
+			clientId: text$1("client_id").notNull(),
+			accountId: text$1("account_id"),
+			grantId: text$1("grant_id"),
+			familyId: text$1("family_id"),
+			userCode: text$1("user_code"),
+			payload: json("payload").notNull(),
+			consumedAt: millis("consumed_at"),
+			expiresAt: millis("expires_at").notNull()
+		}, (t) => [
+			primaryKey$1({ columns: [t.kind, t.id] }),
+			index$1("oidc_artifacts_grant_idx").on(t.grantId),
+			index$1("oidc_artifacts_user_code_idx").on(t.userCode),
+			index$1("oidc_artifacts_expiry_idx").on(t.expiresAt),
+			index$1("oidc_artifacts_client_idx").on(t.clientId),
+			index$1("oidc_artifacts_family_idx").on(t.familyId)
+		]),
+		sessions: table("oidc_sessions", {
+			id: text$1("id").primaryKey(),
+			accountId: text$1("account_id").notNull(),
+			authTime: millis("auth_time").notNull(),
+			acr: text$1("acr"),
+			amr: json("amr"),
+			idp: text$1("idp"),
+			upstreamSessionId: text$1("upstream_session_id"),
+			clients: json("clients").notNull(),
+			expiresAt: millis("expires_at").notNull()
+		}, (t) => [
+			index$1("oidc_sessions_account_idx").on(t.accountId),
+			index$1("oidc_sessions_upstream_idx").on(t.idp, t.upstreamSessionId),
+			index$1("oidc_sessions_expiry_idx").on(t.expiresAt)
+		]),
+		grants: table("oidc_grants", {
+			id: text$1("id").primaryKey(),
+			accountId: text$1("account_id").notNull(),
+			clientId: text$1("client_id").notNull(),
+			scopes: json("scopes").notNull(),
+			claims: json("claims").notNull(),
+			resources: json("resources").notNull(),
+			createdAt: millis("created_at").notNull(),
+			expiresAt: millis("expires_at")
+		}, (t) => [uniqueIndex$1("oidc_grants_account_client_idx").on(t.accountId, t.clientId), index$1("oidc_grants_client_idx").on(t.clientId)]),
+		identities: table("oidc_identities", {
+			provider: text$1("provider").notNull(),
+			subject: text$1("subject").notNull(),
+			accountId: text$1("account_id").notNull(),
+			email: text$1("email"),
+			claims: json("claims").notNull(),
+			linkedAt: millis("linked_at").notNull()
+		}, (t) => [primaryKey$1({ columns: [t.provider, t.subject] }), index$1("oidc_identities_account_idx").on(t.accountId)]),
+		replay: table("oidc_replay", {
+			namespace: text$1("namespace").notNull(),
+			value: text$1("value").notNull(),
+			expiresAt: millis("expires_at").notNull()
+		}, (t) => [primaryKey$1({ columns: [t.namespace, t.value] }), index$1("oidc_replay_expiry_idx").on(t.expiresAt)]),
+		credentials: table("oidc_credentials", {
+			accountId: text$1("account_id").primaryKey(),
+			username: text$1("username").notNull(),
+			passwordHash: text$1("password_hash").notNull(),
+			claims: json("claims").notNull(),
+			totpSecret: text$1("totp_secret"),
+			totpConfirmedAt: millis("totp_confirmed_at"),
+			recoveryCodes: json("recovery_codes"),
+			failedAttempts: integer$1("failed_attempts").notNull().default(0),
+			lockedUntil: millis("locked_until"),
+			createdAt: millis("created_at").notNull(),
+			updatedAt: millis("updated_at").notNull()
+		}, (t) => [uniqueIndex$1("oidc_credentials_username_idx").on(t.username)]),
+		realms: table("oidc_realms", {
+			id: text$1("id").primaryKey(),
+			displayName: text$1("display_name"),
+			enabled: flag("enabled").notNull(),
+			settings: json("settings").notNull(),
+			createdAt: millis("created_at").notNull(),
+			updatedAt: millis("updated_at").notNull()
+		})
+	};
+};
+// src/index.ts
+const now = () => /* @__PURE__ */ new Date();
+/** FR-T5: enforced by the query, so a missed prune still cannot serve an expired row. */
+const live = (column) => gt(column, now());
+const drizzleAdapter = (options) => {
+	const db = options.db;
+	const { clients, artifacts, sessions, grants, identities, replay, credentials, realms } = options.tables ?? schema;
+	const toArtifact = (row) => ({
+		id: row.id,
+		kind: row.kind,
+		clientId: row.clientId,
+		...row.accountId && { accountId: row.accountId },
+		...row.grantId && { grantId: row.grantId },
+		...row.familyId && { familyId: row.familyId },
+		payload: row.payload,
+		...row.consumedAt && { consumedAt: row.consumedAt },
+		expiresAt: row.expiresAt
+	});
+	const toSession = (row) => ({
+		id: row.id,
+		accountId: row.accountId,
+		authTime: row.authTime,
+		...row.acr && { acr: row.acr },
+		...row.amr ? { amr: row.amr } : {},
+		...row.idp && { idp: row.idp },
+		...row.upstreamSessionId && { upstreamSessionId: row.upstreamSessionId },
+		clients: row.clients,
+		expiresAt: row.expiresAt
+	});
+	const toGrant = (row) => ({
+		id: row.id,
+		accountId: row.accountId,
+		clientId: row.clientId,
+		scopes: row.scopes,
+		claims: row.claims,
+		resources: row.resources,
+		createdAt: row.createdAt,
+		...row.expiresAt && { expiresAt: row.expiresAt }
+	});
+	return {
+		clients: {
+			async find(clientId) {
+				const [row] = await db.select().from(clients).where(eq(clients.clientId, clientId)).limit(1);
+				return row ? {
+					...row.data,
+					createdAt: row.createdAt,
+					updatedAt: row.updatedAt
+				} : void 0;
+			},
+			async upsert(client) {
+				await db.insert(clients).values({
+					clientId: client.clientId,
+					data: client,
+					createdAt: client.createdAt,
+					updatedAt: client.updatedAt
+				}).onConflictDoUpdate({
+					target: clients.clientId,
+					set: {
+						data: client,
+						updatedAt: client.updatedAt
+					}
+				});
+			},
+			async destroy(clientId) {
+				await db.delete(clients).where(eq(clients.clientId, clientId));
+			},
+			async list(cursor, limit) {
+				const ordered = db.select().from(clients).where(cursor === void 0 ? void 0 : gt(clients.clientId, cursor)).orderBy(clients.clientId);
+				const rows = await (limit === void 0 ? ordered : ordered.limit(limit + 1));
+				const more = limit !== void 0 && rows.length > limit;
+				const shown = more ? rows.slice(0, limit) : rows;
+				return {
+					clients: shown.map((row) => ({
+						...row.data,
+						createdAt: row.createdAt,
+						updatedAt: row.updatedAt
+					})),
+					...more && { cursor: shown.at(-1)?.clientId }
+				};
+			}
+		},
+		artifacts: {
+			async upsert(artifact) {
+				const row = {
+					kind: artifact.kind,
+					id: artifact.id,
+					clientId: artifact.clientId,
+					accountId: artifact.accountId ?? null,
+					grantId: artifact.grantId ?? null,
+					familyId: artifact.familyId ?? null,
+					userCode: artifact.payload.userCode ?? null,
+					payload: artifact.payload,
+					consumedAt: artifact.consumedAt ?? null,
+					expiresAt: artifact.expiresAt
+				};
+				await db.insert(artifacts).values(row).onConflictDoUpdate({
+					target: [artifacts.kind, artifacts.id],
+					set: {
+						...row,
+						consumedAt: void 0
+					}
+				});
+			},
+			async find(kind, id) {
+				const [row] = await db.select().from(artifacts).where(and(eq(artifacts.kind, kind), eq(artifacts.id, id), live(artifacts.expiresAt))).limit(1);
+				return row ? toArtifact(row) : void 0;
+			},
+			async findByUserCode(userCode) {
+				const [row] = await db.select().from(artifacts).where(and(eq(artifacts.userCode, userCode), live(artifacts.expiresAt))).limit(1);
+				return row ? toArtifact(row) : void 0;
+			},
+			async consume(kind, id) {
+				return (await db.update(artifacts).set({ consumedAt: now() }).where(and(eq(artifacts.kind, kind), eq(artifacts.id, id), isNull(artifacts.consumedAt), live(artifacts.expiresAt))).returning({ id: artifacts.id })).length === 1;
+			},
+			async destroy(kind, id) {
+				await db.delete(artifacts).where(and(eq(artifacts.kind, kind), eq(artifacts.id, id)));
+			},
+			async revokeByGrantId(grantId) {
+				await db.delete(artifacts).where(eq(artifacts.grantId, grantId));
+			},
+			async revokeByFamilyId(familyId) {
+				await db.delete(artifacts).where(eq(artifacts.familyId, familyId));
+			},
+			async revokeByClientId(clientId) {
+				await db.delete(artifacts).where(eq(artifacts.clientId, clientId));
+			},
+			async prune(before, limit) {
+				const doomed = await db.select({
+					kind: artifacts.kind,
+					id: artifacts.id
+				}).from(artifacts).where(lte(artifacts.expiresAt, before)).limit(limit);
+				for (const row of doomed) await db.delete(artifacts).where(and(eq(artifacts.kind, row.kind), eq(artifacts.id, row.id)));
+				return doomed.length;
+			}
+		},
+		sessions: {
+			async find(id) {
+				const [row] = await db.select().from(sessions).where(and(eq(sessions.id, id), gt(sessions.expiresAt, now()))).limit(1);
+				return row ? toSession(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.select().from(sessions).where(and(eq(sessions.accountId, accountId), gt(sessions.expiresAt, now())))).map(toSession);
+			},
+			async findByUpstreamSession(provider, upstreamSessionId) {
+				return (await db.select().from(sessions).where(and(eq(sessions.idp, provider), eq(sessions.upstreamSessionId, upstreamSessionId), gt(sessions.expiresAt, now())))).map(toSession);
+			},
+			async upsert(session) {
+				const row = {
+					id: session.id,
+					accountId: session.accountId,
+					authTime: session.authTime,
+					acr: session.acr ?? null,
+					amr: session.amr ?? null,
+					idp: session.idp ?? null,
+					upstreamSessionId: session.upstreamSessionId ?? null,
+					clients: session.clients,
+					expiresAt: session.expiresAt
+				};
+				await db.insert(sessions).values(row).onConflictDoUpdate({
+					target: sessions.id,
+					set: row
+				});
+			},
+			async addClient(id, clientId) {
+				for (let attempt = 0; attempt < 64; attempt++) {
+					const [row] = await db.select({ clients: sessions.clients }).from(sessions).where(eq(sessions.id, id)).limit(1);
+					if (!row) return;
+					const current = row.clients;
+					if (current.includes(clientId)) return;
+					if ((await db.update(sessions).set({ clients: [...current, clientId] }).where(and(eq(sessions.id, id), eq(sessions.clients, current))).returning({ id: sessions.id })).length) return;
+				}
+				throw new Error(`session ${id} kept changing; its client list could not be updated`);
+			},
+			async destroy(id) {
+				await db.delete(sessions).where(eq(sessions.id, id));
+			},
+			async prune(before, limit) {
+				const doomed = await db.select({ id: sessions.id }).from(sessions).where(lte(sessions.expiresAt, before)).limit(limit);
+				for (const row of doomed) await db.delete(sessions).where(and(eq(sessions.id, row.id), lte(sessions.expiresAt, before)));
+				return doomed.length;
+			}
+		},
+		grants: {
+			async find(id) {
+				const [row] = await db.select().from(grants).where(eq(grants.id, id)).limit(1);
+				return row ? toGrant(row) : void 0;
+			},
+			async findByAccountAndClient(accountId, clientId) {
+				const [row] = await db.select().from(grants).where(and(eq(grants.accountId, accountId), eq(grants.clientId, clientId))).limit(1);
+				return row ? toGrant(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.select().from(grants).where(eq(grants.accountId, accountId))).map(toGrant);
+			},
+			async upsert(grant) {
+				const row = {
+					id: grant.id,
+					accountId: grant.accountId,
+					clientId: grant.clientId,
+					scopes: grant.scopes,
+					claims: grant.claims,
+					resources: grant.resources,
+					createdAt: grant.createdAt,
+					expiresAt: grant.expiresAt ?? null
+				};
+				const { id: _id, createdAt: _createdAt, ...changed } = row;
+				await db.insert(grants).values(row).onConflictDoUpdate({
+					target: [grants.accountId, grants.clientId],
+					set: changed
+				});
+			},
+			async destroy(id) {
+				await db.delete(grants).where(eq(grants.id, id));
+			},
+			async destroyByClientId(clientId) {
+				await db.delete(grants).where(eq(grants.clientId, clientId));
+			}
+		},
+		accounts: options.accounts ?? noAccounts,
+		keys: options.keys,
+		replay: {
+			async claim(namespace, value, ttl) {
+				const expiresAt = new Date(Date.now() + ttl * 1e3);
+				return (await db.insert(replay).values({
+					namespace,
+					value,
+					expiresAt
+				}).onConflictDoUpdate({
+					target: [replay.namespace, replay.value],
+					set: { expiresAt },
+					setWhere: lte(replay.expiresAt, now())
+				}).returning({ value: replay.value })).length === 1;
+			},
+			async prune(before, limit) {
+				const doomed = await db.select({
+					namespace: replay.namespace,
+					value: replay.value
+				}).from(replay).where(lte(replay.expiresAt, before)).limit(limit);
+				for (const row of doomed) await db.delete(replay).where(and(eq(replay.namespace, row.namespace), eq(replay.value, row.value), lte(replay.expiresAt, before)));
+				return doomed.length;
+			}
+		},
+		credentials: {
+			async find(accountId) {
+				const [row] = await db.select().from(credentials).where(eq(credentials.accountId, accountId)).limit(1);
+				return row ? toCredential(row) : void 0;
+			},
+			async findByUsername(username) {
+				const [row] = await db.select().from(credentials).where(eq(credentials.username, username)).limit(1);
+				return row ? toCredential(row) : void 0;
+			},
+			async create(credential) {
+				return (await db.insert(credentials).values(credentialRow(credential)).onConflictDoNothing().returning({ id: credentials.accountId })).length === 1;
+			},
+			async upsert(credential) {
+				const row = credentialRow(credential);
+				await db.insert(credentials).values(row).onConflictDoUpdate({
+					target: credentials.accountId,
+					set: row
+				});
+			},
+			async destroy(accountId) {
+				await db.delete(credentials).where(eq(credentials.accountId, accountId));
+			}
+		},
+		realms: {
+			async find(id) {
+				const [row] = await db.select().from(realms).where(eq(realms.id, id)).limit(1);
+				return row ? toRealm(row) : void 0;
+			},
+			async list() {
+				return (await db.select().from(realms)).map(toRealm);
+			},
+			async create(realm) {
+				return (await db.insert(realms).values(realmRow(realm)).onConflictDoNothing().returning({ id: realms.id })).length === 1;
+			},
+			async upsert(realm) {
+				const row = realmRow(realm);
+				await db.insert(realms).values(row).onConflictDoUpdate({
+					target: realms.id,
+					set: row
+				});
+			},
+			async destroy(id) {
+				await db.delete(realms).where(eq(realms.id, id));
+			}
+		},
+		identities: {
+			async find(provider, subject) {
+				const [row] = await db.select().from(identities).where(and(eq(identities.provider, provider), eq(identities.subject, subject))).limit(1);
+				return row ? toIdentity(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.select().from(identities).where(eq(identities.accountId, accountId))).map(toIdentity);
+			},
+			async upsert(identity) {
+				const row = {
+					provider: identity.provider,
+					subject: identity.subject,
+					accountId: identity.accountId,
+					email: identity.email ?? null,
+					claims: identity.claims,
+					linkedAt: identity.linkedAt
+				};
+				await db.insert(identities).values(row).onConflictDoUpdate({
+					target: [identities.provider, identities.subject],
+					set: row
+				});
+			},
+			async destroy(provider, subject) {
+				await db.delete(identities).where(and(eq(identities.provider, provider), eq(identities.subject, subject)));
+			}
+		}
+	};
+};
+const credentialRow = (credential) => ({
+	accountId: credential.accountId,
+	username: credential.username,
+	passwordHash: credential.passwordHash,
+	claims: credential.claims,
+	totpSecret: credential.totp?.secret ?? null,
+	totpConfirmedAt: credential.totp?.confirmedAt ?? null,
+	recoveryCodes: credential.recoveryCodes ?? null,
+	failedAttempts: credential.failedAttempts,
+	lockedUntil: credential.lockedUntil ?? null,
+	createdAt: credential.createdAt,
+	updatedAt: credential.updatedAt
+});
+const toCredential = (row) => ({
+	accountId: row.accountId,
+	username: row.username,
+	passwordHash: row.passwordHash,
+	claims: row.claims,
+	...row.totpSecret && { totp: {
+		secret: row.totpSecret,
+		...row.totpConfirmedAt && { confirmedAt: row.totpConfirmedAt }
+	} },
+	...row.recoveryCodes ? { recoveryCodes: row.recoveryCodes } : {},
+	failedAttempts: row.failedAttempts,
+	...row.lockedUntil && { lockedUntil: row.lockedUntil },
+	createdAt: row.createdAt,
+	updatedAt: row.updatedAt
+});
+const realmRow = (realm) => ({
+	id: realm.id,
+	displayName: realm.displayName ?? null,
+	enabled: realm.enabled,
+	settings: realm.settings,
+	createdAt: realm.createdAt,
+	updatedAt: realm.updatedAt
+});
+const toRealm = (row) => ({
+	id: row.id,
+	...row.displayName && { displayName: row.displayName },
+	enabled: row.enabled,
+	settings: row.settings,
+	createdAt: row.createdAt,
+	updatedAt: row.updatedAt
+});
+const toIdentity = (row) => ({
+	accountId: row.accountId,
+	provider: row.provider,
+	subject: row.subject,
+	...row.email && { email: row.email },
+	claims: row.claims,
+	linkedAt: row.linkedAt
+});
+export { POSTGRES_MIGRATIONS, SQLITE_MIGRATIONS, artifacts, clients, credentials, drizzleAdapter, grants, identities, postgresTables, realms, replay, schema, sessions };