@oidcraft/kysely 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Florian Chiș
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,27 @@
-# Temporary Holding Version
+# @oidcraft/kysely
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A [Kysely](https://kysely.dev) storage adapter for `@oidcraft/provider`, on SQLite or Postgres.
+
+```sh
+bun add @oidcraft/kysely @oidcraft/adapter kysely
+```
+
+```ts
+import { staticKeyStore } from '@oidcraft/adapter'
+import { kyselyAdapter } from '@oidcraft/kysely'
+
+const adapter = kyselyAdapter({ db, keys: staticKeyStore(keys) }) // db: Kysely<OidcraftDatabase>
+```
+
+Table names are unqualified, so pick a Postgres schema with the search path or `db.withSchema(...)`.
+
+The schema ships as migrations, `SQLITE_MIGRATIONS` and `POSTGRES_MIGRATIONS` — the same tables as
+the other SQL adapters, so one database works with any of them — which you run with your own tooling
+before you deploy. The adapter never
+creates or alters a table at startup.
+
+It returns a `FullAdapter`, so it satisfies every `@oidcraft/provider` entry point: brokering, local
+accounts and realms included. It passes the shared suite in `@oidcraft/adapter/conformance`, on
+SQLite and Postgres.
+
+See the [storage guide](https://github.com/Fl0r14n/oidcraft/blob/main/apps/docs/guide/adapters.md).

package/dist/index.d.mts

@@ -0,0 +1,117 @@
+import { AccountStore, FullAdapter, KeyStore } from "@oidcraft/adapter";
+import { ColumnType, Generated, Kysely } from "kysely";
+/** Milliseconds since the epoch: SQLite has no date type. Postgres keeps them in `bigint`, which it reads back as a string. */
+type Millis = ColumnType<number | string, number, number>;
+export type ClientsTable = {
+  client_id: string;
+  data: string;
+  created_at: Millis;
+  updated_at: Millis;
+};
+export type ArtifactsTable = {
+  kind: string;
+  id: string;
+  client_id: string;
+  account_id: string | null;
+  grant_id: string | null;
+  family_id: string | null;
+  user_code: string | null;
+  payload: string;
+  consumed_at: Millis | null;
+  expires_at: Millis;
+};
+export type SessionsTable = {
+  id: string;
+  account_id: string;
+  auth_time: Millis;
+  acr: string | null;
+  amr: string | null;
+  idp: string | null;
+  upstream_session_id: string | null;
+  clients: string;
+  expires_at: Millis;
+};
+export type GrantsTable = {
+  id: string;
+  account_id: string;
+  client_id: string;
+  scopes: string;
+  claims: string;
+  resources: string;
+  created_at: Millis;
+  expires_at: Millis | null;
+};
+export type IdentitiesTable = {
+  provider: string;
+  subject: string;
+  account_id: string;
+  email: string | null;
+  claims: string;
+  linked_at: Millis;
+};
+export type ReplayTable = {
+  namespace: string;
+  value: string;
+  expires_at: Millis;
+};
+export type CredentialsTable = {
+  account_id: string;
+  username: string;
+  password_hash: string;
+  claims: string;
+  totp_secret: string | null;
+  totp_confirmed_at: Millis | null;
+  recovery_codes: string | null;
+  failed_attempts: number;
+  locked_until: Millis | null;
+  created_at: Millis;
+  updated_at: Millis;
+};
+export type RealmsTable = {
+  id: string;
+  display_name: string | null;
+  /** 0 or 1: SQLite has no boolean. */
+  enabled: number;
+  settings: string;
+  created_at: Millis;
+  updated_at: Millis;
+};
+export type OidcraftDatabase = {
+  oidc_clients: ClientsTable;
+  oidc_artifacts: ArtifactsTable;
+  oidc_sessions: SessionsTable;
+  oidc_grants: GrantsTable;
+  oidc_identities: IdentitiesTable;
+  oidc_replay: ReplayTable;
+  oidc_credentials: CredentialsTable;
+  oidc_realms: RealmsTable;
+};
+type Migration = {
+  id: string;
+  statements: string[];
+};
+/**
+ * The same tables as `SQLITE_MIGRATIONS`, with the same ids, for Postgres (FR-A4). Milliseconds are
+ * `bigint` and JSON stays `text`, so every adapter reads and writes exactly what it does on SQLite.
+ * Table names are unqualified: they land in whatever schema the host migrates into, which is how a
+ * realm gets a schema of its own in one database (G-6).
+ */
+export declare const POSTGRES_MIGRATIONS: Migration[];
+/**
+ * The SQLite schema every SQL adapter queries, as ordered migrations the host applies with its own
+ * tooling. The library never runs them: a library that migrates on import migrates during a rolling
+ * deploy, from several processes at once (ARCHITECTURE.md §4.2, FR-A4).
+ */
+export declare const SQLITE_MIGRATIONS: Migration[];
+export type KyselyAdapterOptions = {
+  db: Kysely<OidcraftDatabase>;
+  keys: KeyStore;
+  /** Omitted, every account lookup misses: the host composes one in later, as `@oidcraft/provider/accounts` does. */
+  accounts?: AccountStore;
+};
+/**
+ * The same contract as the Drizzle adapter, on a query builder rather than an ORM (FR-A4). Both run
+ * the one conformance suite, which is what makes "interchangeable" checkable rather than asserted.
+ */
+export declare const kyselyAdapter: (options: KyselyAdapterOptions) => FullAdapter;
+export type { Generated, Migration };

package/dist/index.mjs

@@ -0,0 +1,458 @@
+import { noAccounts } from "@oidcraft/adapter";
+// ../sql/dist/rows.mjs
+/** Never `new Date` on the raw value: a string there is read as a date, not as milliseconds. */
+const at = (millis) => new Date(Number(millis));
+const json = (value) => JSON.stringify(value);
+const parse = (value) => JSON.parse(value);
+const clientRow = (client) => ({
+	client_id: client.clientId,
+	data: json(client),
+	created_at: client.createdAt.getTime(),
+	updated_at: client.updatedAt.getTime()
+});
+const toClient = (row) => ({
+	...parse(row.data),
+	createdAt: at(row.created_at),
+	updatedAt: at(row.updated_at)
+});
+/** `user_code` is lifted out of the payload so a device's code is found by index (FR-C7). */
+const artifactRow = (artifact) => ({
+	kind: artifact.kind,
+	id: artifact.id,
+	client_id: artifact.clientId,
+	account_id: artifact.accountId ?? null,
+	grant_id: artifact.grantId ?? null,
+	family_id: artifact.familyId ?? null,
+	user_code: artifact.payload.userCode ?? null,
+	payload: json(artifact.payload),
+	consumed_at: artifact.consumedAt ? artifact.consumedAt.getTime() : null,
+	expires_at: artifact.expiresAt.getTime()
+});
+const toArtifact = (row) => ({
+	id: row.id,
+	kind: row.kind,
+	clientId: row.client_id,
+	...row.account_id && { accountId: row.account_id },
+	...row.grant_id && { grantId: row.grant_id },
+	...row.family_id && { familyId: row.family_id },
+	payload: parse(row.payload),
+	...row.consumed_at && { consumedAt: at(row.consumed_at) },
+	expiresAt: at(row.expires_at)
+});
+const sessionRow = (session) => ({
+	id: session.id,
+	account_id: session.accountId,
+	auth_time: session.authTime.getTime(),
+	acr: session.acr ?? null,
+	amr: session.amr ? json(session.amr) : null,
+	idp: session.idp ?? null,
+	upstream_session_id: session.upstreamSessionId ?? null,
+	clients: json(session.clients),
+	expires_at: session.expiresAt.getTime()
+});
+const toSession = (row) => ({
+	id: row.id,
+	accountId: row.account_id,
+	authTime: at(row.auth_time),
+	...row.acr && { acr: row.acr },
+	...row.amr ? { amr: parse(row.amr) } : {},
+	...row.idp && { idp: row.idp },
+	...row.upstream_session_id && { upstreamSessionId: row.upstream_session_id },
+	clients: parse(row.clients),
+	expiresAt: at(row.expires_at)
+});
+const grantRow = (grant) => ({
+	id: grant.id,
+	account_id: grant.accountId,
+	client_id: grant.clientId,
+	scopes: json(grant.scopes),
+	claims: json(grant.claims),
+	resources: json(grant.resources),
+	created_at: grant.createdAt.getTime(),
+	expires_at: grant.expiresAt ? grant.expiresAt.getTime() : null
+});
+const toGrant = (row) => ({
+	id: row.id,
+	accountId: row.account_id,
+	clientId: row.client_id,
+	scopes: parse(row.scopes),
+	claims: parse(row.claims),
+	resources: parse(row.resources),
+	createdAt: at(row.created_at),
+	...row.expires_at && { expiresAt: at(row.expires_at) }
+});
+const identityRow = (identity) => ({
+	provider: identity.provider,
+	subject: identity.subject,
+	account_id: identity.accountId,
+	email: identity.email ?? null,
+	claims: json(identity.claims),
+	linked_at: identity.linkedAt.getTime()
+});
+const toIdentity = (row) => ({
+	accountId: row.account_id,
+	provider: row.provider,
+	subject: row.subject,
+	...row.email && { email: row.email },
+	claims: parse(row.claims),
+	linkedAt: at(row.linked_at)
+});
+const credentialRow = (credential) => ({
+	account_id: credential.accountId,
+	username: credential.username,
+	password_hash: credential.passwordHash,
+	claims: json(credential.claims),
+	totp_secret: credential.totp?.secret ?? null,
+	totp_confirmed_at: credential.totp?.confirmedAt?.getTime() ?? null,
+	recovery_codes: credential.recoveryCodes ? json(credential.recoveryCodes) : null,
+	failed_attempts: credential.failedAttempts,
+	locked_until: credential.lockedUntil?.getTime() ?? null,
+	created_at: credential.createdAt.getTime(),
+	updated_at: credential.updatedAt.getTime()
+});
+const toCredential = (row) => ({
+	accountId: row.account_id,
+	username: row.username,
+	passwordHash: row.password_hash,
+	claims: parse(row.claims),
+	...row.totp_secret && { totp: {
+		secret: row.totp_secret,
+		...row.totp_confirmed_at && { confirmedAt: at(row.totp_confirmed_at) }
+	} },
+	...row.recovery_codes ? { recoveryCodes: parse(row.recovery_codes) } : {},
+	failedAttempts: Number(row.failed_attempts),
+	...row.locked_until && { lockedUntil: at(row.locked_until) },
+	createdAt: at(row.created_at),
+	updatedAt: at(row.updated_at)
+});
+const realmRow = (realm) => ({
+	id: realm.id,
+	display_name: realm.displayName ?? null,
+	enabled: realm.enabled ? 1 : 0,
+	settings: json(realm.settings),
+	created_at: realm.createdAt.getTime(),
+	updated_at: realm.updatedAt.getTime()
+});
+const toRealm = (row) => ({
+	id: row.id,
+	...row.display_name && { displayName: row.display_name },
+	enabled: Boolean(Number(row.enabled)),
+	settings: parse(row.settings),
+	createdAt: at(row.created_at),
+	updatedAt: at(row.updated_at)
+});
+// ../sql/dist/postgres.mjs
+/**
+* The same tables as `SQLITE_MIGRATIONS`, with the same ids, for Postgres (FR-A4). Milliseconds are
+* `bigint` and JSON stays `text`, so every adapter reads and writes exactly what it does on SQLite.
+* Table names are unqualified: they land in whatever schema the host migrates into, which is how a
+* realm gets a schema of its own in one database (G-6).
+*/
+const POSTGRES_MIGRATIONS = [
+	{
+		id: "0001_init",
+		statements: [
+			"create table oidc_clients (client_id text primary key, data text not null, created_at bigint not null, updated_at bigint not null)",
+			"create table oidc_artifacts (kind text not null, id text not null, client_id text not null, account_id text, grant_id text, user_code text, payload text not null, consumed_at bigint, expires_at bigint not null, primary key (kind, id))",
+			"create index oidc_artifacts_grant_idx on oidc_artifacts (grant_id)",
+			"create index oidc_artifacts_user_code_idx on oidc_artifacts (user_code)",
+			"create index oidc_artifacts_expiry_idx on oidc_artifacts (expires_at)",
+			"create table oidc_sessions (id text primary key, account_id text not null, auth_time bigint not null, acr text, amr text, idp text, upstream_session_id text, clients text not null, expires_at bigint not null)",
+			"create index oidc_sessions_account_idx on oidc_sessions (account_id)",
+			"create index oidc_sessions_upstream_idx on oidc_sessions (idp, upstream_session_id)",
+			"create table oidc_grants (id text primary key, account_id text not null, client_id text not null, scopes text not null, claims text not null, resources text not null, created_at bigint not null, expires_at bigint)",
+			"create unique index oidc_grants_account_client_idx on oidc_grants (account_id, client_id)",
+			"create table oidc_identities (provider text not null, subject text not null, account_id text not null, email text, claims text not null, linked_at bigint not null, primary key (provider, subject))",
+			"create table oidc_replay (namespace text not null, value text not null, expires_at bigint not null, primary key (namespace, value))"
+		]
+	},
+	{
+		id: "0002_credentials",
+		statements: [
+			"create table oidc_credentials (account_id text primary key, username text not null, password_hash text not null, claims text not null, totp_secret text, totp_confirmed_at bigint, recovery_codes text, failed_attempts integer not null default 0, locked_until bigint, created_at bigint not null, updated_at bigint not null)",
+			"create unique index oidc_credentials_username_idx on oidc_credentials (username)",
+			"create index oidc_identities_account_idx on oidc_identities (account_id)",
+			"create index oidc_replay_expiry_idx on oidc_replay (expires_at)"
+		]
+	},
+	{
+		id: "0003_realms",
+		statements: ["create table oidc_realms (id text primary key, display_name text, enabled integer not null, settings text not null, created_at bigint not null, updated_at bigint not null)"]
+	},
+	{
+		id: "0004_indexes",
+		statements: [
+			"create index oidc_artifacts_client_idx on oidc_artifacts (client_id)",
+			"create index oidc_grants_client_idx on oidc_grants (client_id)",
+			"create index oidc_sessions_expiry_idx on oidc_sessions (expires_at)"
+		]
+	},
+	{
+		id: "0005_families",
+		statements: ["alter table oidc_artifacts add column family_id text", "create index oidc_artifacts_family_idx on oidc_artifacts (family_id)"]
+	}
+];
+// ../sql/dist/sqlite.mjs
+/**
+* The SQLite schema every SQL adapter queries, as ordered migrations the host applies with its own
+* tooling. The library never runs them: a library that migrates on import migrates during a rolling
+* deploy, from several processes at once (ARCHITECTURE.md §4.2, FR-A4).
+*/
+const SQLITE_MIGRATIONS = [
+	{
+		id: "0001_init",
+		statements: [
+			"create table oidc_clients (client_id text primary key, data text not null, created_at integer not null, updated_at integer not null)",
+			"create table oidc_artifacts (kind text not null, id text not null, client_id text not null, account_id text, grant_id text, user_code text, payload text not null, consumed_at integer, expires_at integer not null, primary key (kind, id))",
+			"create index oidc_artifacts_grant_idx on oidc_artifacts (grant_id)",
+			"create index oidc_artifacts_user_code_idx on oidc_artifacts (user_code)",
+			"create index oidc_artifacts_expiry_idx on oidc_artifacts (expires_at)",
+			"create table oidc_sessions (id text primary key, account_id text not null, auth_time integer not null, acr text, amr text, idp text, upstream_session_id text, clients text not null, expires_at integer not null)",
+			"create index oidc_sessions_account_idx on oidc_sessions (account_id)",
+			"create index oidc_sessions_upstream_idx on oidc_sessions (idp, upstream_session_id)",
+			"create table oidc_grants (id text primary key, account_id text not null, client_id text not null, scopes text not null, claims text not null, resources text not null, created_at integer not null, expires_at integer)",
+			"create unique index oidc_grants_account_client_idx on oidc_grants (account_id, client_id)",
+			"create table oidc_identities (provider text not null, subject text not null, account_id text not null, email text, claims text not null, linked_at integer not null, primary key (provider, subject))",
+			"create table oidc_replay (namespace text not null, value text not null, expires_at integer not null, primary key (namespace, value))"
+		]
+	},
+	{
+		id: "0002_credentials",
+		statements: [
+			"create table oidc_credentials (account_id text primary key, username text not null, password_hash text not null, claims text not null, totp_secret text, totp_confirmed_at integer, recovery_codes text, failed_attempts integer not null default 0, locked_until integer, created_at integer not null, updated_at integer not null)",
+			"create unique index oidc_credentials_username_idx on oidc_credentials (username)",
+			"create index oidc_identities_account_idx on oidc_identities (account_id)",
+			"create index oidc_replay_expiry_idx on oidc_replay (expires_at)"
+		]
+	},
+	{
+		id: "0003_realms",
+		statements: ["create table oidc_realms (id text primary key, display_name text, enabled integer not null, settings text not null, created_at integer not null, updated_at integer not null)"]
+	},
+	{
+		id: "0004_indexes",
+		statements: [
+			"create index oidc_artifacts_client_idx on oidc_artifacts (client_id)",
+			"create index oidc_grants_client_idx on oidc_grants (client_id)",
+			"create index oidc_sessions_expiry_idx on oidc_sessions (expires_at)"
+		]
+	},
+	{
+		id: "0005_families",
+		statements: ["alter table oidc_artifacts add column family_id text", "create index oidc_artifacts_family_idx on oidc_artifacts (family_id)"]
+	}
+];
+// src/index.ts
+const now = () => Date.now();
+/**
+* The same contract as the Drizzle adapter, on a query builder rather than an ORM (FR-A4). Both run
+* the one conformance suite, which is what makes "interchangeable" checkable rather than asserted.
+*/
+const kyselyAdapter = (options) => {
+	const { db } = options;
+	const artifacts = {
+		async upsert(artifact) {
+			const row = artifactRow(artifact);
+			await db.insertInto("oidc_artifacts").values(row).onConflict((conflict) => conflict.columns(["kind", "id"]).doUpdateSet({
+				...row,
+				consumed_at: void 0
+			})).execute();
+		},
+		async find(kind, id) {
+			const row = await db.selectFrom("oidc_artifacts").selectAll().where("kind", "=", kind).where("id", "=", id).where("expires_at", ">", now()).executeTakeFirst();
+			return row ? toArtifact(row) : void 0;
+		},
+		async findByUserCode(userCode) {
+			const row = await db.selectFrom("oidc_artifacts").selectAll().where("user_code", "=", userCode).where("expires_at", ">", now()).executeTakeFirst();
+			return row ? toArtifact(row) : void 0;
+		},
+		async consume(kind, id) {
+			return await db.updateTable("oidc_artifacts").set({ consumed_at: now() }).where("kind", "=", kind).where("id", "=", id).where("consumed_at", "is", null).where("expires_at", ">", now()).returning("id").executeTakeFirst() !== void 0;
+		},
+		async destroy(kind, id) {
+			await db.deleteFrom("oidc_artifacts").where("kind", "=", kind).where("id", "=", id).execute();
+		},
+		async revokeByGrantId(grantId) {
+			await db.deleteFrom("oidc_artifacts").where("grant_id", "=", grantId).execute();
+		},
+		async revokeByFamilyId(familyId) {
+			await db.deleteFrom("oidc_artifacts").where("family_id", "=", familyId).execute();
+		},
+		async revokeByClientId(clientId) {
+			await db.deleteFrom("oidc_artifacts").where("client_id", "=", clientId).execute();
+		},
+		async prune(before, limit) {
+			const doomed = await db.selectFrom("oidc_artifacts").select(["kind", "id"]).where("expires_at", "<=", before.getTime()).limit(limit).execute();
+			for (const row of doomed) await artifacts.destroy(row.kind, row.id);
+			return doomed.length;
+		}
+	};
+	return {
+		clients: {
+			async find(clientId) {
+				const row = await db.selectFrom("oidc_clients").selectAll().where("client_id", "=", clientId).executeTakeFirst();
+				if (!row) return void 0;
+				return toClient(row);
+			},
+			async upsert(client) {
+				const row = clientRow(client);
+				const { data, updated_at } = row;
+				await db.insertInto("oidc_clients").values(row).onConflict((conflict) => conflict.column("client_id").doUpdateSet({
+					data,
+					updated_at
+				})).execute();
+			},
+			async destroy(clientId) {
+				await db.deleteFrom("oidc_clients").where("client_id", "=", clientId).execute();
+			},
+			async list(cursor, limit) {
+				let query = db.selectFrom("oidc_clients").selectAll().orderBy("client_id");
+				if (cursor !== void 0) query = query.where("client_id", ">", cursor);
+				const rows = await (limit === void 0 ? query : query.limit(limit + 1)).execute();
+				const more = limit !== void 0 && rows.length > limit;
+				const shown = more ? rows.slice(0, limit) : rows;
+				return {
+					clients: shown.map(toClient),
+					...more && { cursor: shown.at(-1)?.client_id }
+				};
+			}
+		},
+		artifacts,
+		sessions: {
+			async find(id) {
+				const row = await db.selectFrom("oidc_sessions").selectAll().where("id", "=", id).where("expires_at", ">", now()).executeTakeFirst();
+				return row ? toSession(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.selectFrom("oidc_sessions").selectAll().where("account_id", "=", accountId).where("expires_at", ">", now()).execute()).map(toSession);
+			},
+			async findByUpstreamSession(provider, upstreamSessionId) {
+				return (await db.selectFrom("oidc_sessions").selectAll().where("idp", "=", provider).where("upstream_session_id", "=", upstreamSessionId).where("expires_at", ">", now()).execute()).map(toSession);
+			},
+			async upsert(session) {
+				const row = sessionRow(session);
+				await db.insertInto("oidc_sessions").values(row).onConflict((conflict) => conflict.column("id").doUpdateSet(row)).execute();
+			},
+			async addClient(id, clientId) {
+				for (let attempt = 0; attempt < 64; attempt++) {
+					const row = await db.selectFrom("oidc_sessions").select("clients").where("id", "=", id).executeTakeFirst();
+					if (!row) return;
+					const current = JSON.parse(row.clients);
+					if (current.includes(clientId)) return;
+					const result = await db.updateTable("oidc_sessions").set({ clients: json([...current, clientId]) }).where("id", "=", id).where("clients", "=", row.clients).executeTakeFirst();
+					if (Number(result.numUpdatedRows) > 0) return;
+				}
+				throw new Error(`session ${id} kept changing; its client list could not be updated`);
+			},
+			async destroy(id) {
+				await db.deleteFrom("oidc_sessions").where("id", "=", id).execute();
+			},
+			prune: { async prune(before, limit) {
+				const doomed = await db.selectFrom("oidc_sessions").select("id").where("expires_at", "<=", before.getTime()).limit(limit).execute();
+				if (doomed.length) await db.deleteFrom("oidc_sessions").where("id", "in", doomed.map((row) => row.id)).where("expires_at", "<=", before.getTime()).execute();
+				return doomed.length;
+			} }.prune
+		},
+		grants: {
+			async find(id) {
+				const row = await db.selectFrom("oidc_grants").selectAll().where("id", "=", id).executeTakeFirst();
+				return row ? toGrant(row) : void 0;
+			},
+			async findByAccountAndClient(accountId, clientId) {
+				const row = await db.selectFrom("oidc_grants").selectAll().where("account_id", "=", accountId).where("client_id", "=", clientId).executeTakeFirst();
+				return row ? toGrant(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.selectFrom("oidc_grants").selectAll().where("account_id", "=", accountId).execute()).map(toGrant);
+			},
+			async upsert(grant) {
+				const row = grantRow(grant);
+				await db.insertInto("oidc_grants").values(row).onConflict((conflict) => conflict.columns(["account_id", "client_id"]).doUpdateSet({
+					scopes: row.scopes,
+					claims: row.claims,
+					resources: row.resources,
+					expires_at: row.expires_at
+				})).execute();
+			},
+			async destroy(id) {
+				await db.deleteFrom("oidc_grants").where("id", "=", id).execute();
+			},
+			async destroyByClientId(clientId) {
+				await db.deleteFrom("oidc_grants").where("client_id", "=", clientId).execute();
+			}
+		},
+		accounts: options.accounts ?? noAccounts,
+		credentials: {
+			async find(accountId) {
+				const row = await db.selectFrom("oidc_credentials").selectAll().where("account_id", "=", accountId).executeTakeFirst();
+				return row ? toCredential(row) : void 0;
+			},
+			async findByUsername(username) {
+				const row = await db.selectFrom("oidc_credentials").selectAll().where("username", "=", username).executeTakeFirst();
+				return row ? toCredential(row) : void 0;
+			},
+			async create(credential) {
+				return await db.insertInto("oidc_credentials").values(credentialRow(credential)).onConflict((conflict) => conflict.doNothing()).returning("account_id").executeTakeFirst() !== void 0;
+			},
+			async upsert(credential) {
+				const row = credentialRow(credential);
+				await db.insertInto("oidc_credentials").values(row).onConflict((conflict) => conflict.column("account_id").doUpdateSet(row)).execute();
+			},
+			async destroy(accountId) {
+				await db.deleteFrom("oidc_credentials").where("account_id", "=", accountId).execute();
+			}
+		},
+		realms: {
+			async find(id) {
+				const row = await db.selectFrom("oidc_realms").selectAll().where("id", "=", id).executeTakeFirst();
+				return row ? toRealm(row) : void 0;
+			},
+			async list() {
+				return (await db.selectFrom("oidc_realms").selectAll().execute()).map(toRealm);
+			},
+			async create(realm) {
+				return await db.insertInto("oidc_realms").values(realmRow(realm)).onConflict((conflict) => conflict.doNothing()).returning("id").executeTakeFirst() !== void 0;
+			},
+			async upsert(realm) {
+				const row = realmRow(realm);
+				await db.insertInto("oidc_realms").values(row).onConflict((conflict) => conflict.column("id").doUpdateSet(row)).execute();
+			},
+			async destroy(id) {
+				await db.deleteFrom("oidc_realms").where("id", "=", id).execute();
+			}
+		},
+		keys: options.keys,
+		replay: {
+			async claim(namespace, value, ttl) {
+				const expires_at = now() + ttl * 1e3;
+				return await db.insertInto("oidc_replay").values({
+					namespace,
+					value,
+					expires_at
+				}).onConflict((conflict) => conflict.columns(["namespace", "value"]).doUpdateSet({ expires_at }).where("oidc_replay.expires_at", "<=", now())).returning("value").executeTakeFirst() !== void 0;
+			},
+			prune: { async prune(before, limit) {
+				const doomed = await db.selectFrom("oidc_replay").select(["namespace", "value"]).where("expires_at", "<=", before.getTime()).limit(limit).execute();
+				for (const row of doomed) await db.deleteFrom("oidc_replay").where("namespace", "=", row.namespace).where("value", "=", row.value).where("expires_at", "<=", before.getTime()).execute();
+				return doomed.length;
+			} }.prune
+		},
+		identities: {
+			async find(provider, subject) {
+				const row = await db.selectFrom("oidc_identities").selectAll().where("provider", "=", provider).where("subject", "=", subject).executeTakeFirst();
+				return row ? toIdentity(row) : void 0;
+			},
+			async listForAccount(accountId) {
+				return (await db.selectFrom("oidc_identities").selectAll().where("account_id", "=", accountId).execute()).map(toIdentity);
+			},
+			async upsert(identity) {
+				const row = identityRow(identity);
+				await db.insertInto("oidc_identities").values(row).onConflict((conflict) => conflict.columns(["provider", "subject"]).doUpdateSet(row)).execute();
+			},
+			async destroy(provider, subject) {
+				await db.deleteFrom("oidc_identities").where("provider", "=", provider).where("subject", "=", subject).execute();
+			}
+		}
+	};
+};
+export { POSTGRES_MIGRATIONS, SQLITE_MIGRATIONS, kyselyAdapter };

package/package.json

@@ -1,6 +1,61 @@
 {
   "name": "@oidcraft/kysely",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "A Kysely storage adapter for @oidcraft/provider, on Postgres or SQLite.",
+  "license": "MIT",
+  "author": "Fl0r14n <florian.chis@gmail.com>",
+  "homepage": "https://github.com/Fl0r14n/oidcraft/tree/main/packages/kysely",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Fl0r14n/oidcraft",
+    "directory": "packages/kysely"
+  },
+  "keywords": [
+    "oidc",
+    "openid",
+    "oauth2",
+    "authorization-server",
+    "oidcraft",
+    "storage",
+    "adapter",
+    "kysely"
+  ],
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsdown && bun run verify:entries",
+    "prepublishOnly": "bun run build",
+    "test": "bun test",
+    "typecheck": "bun check",
+    "verify:entries": "bun run verify-entries.ts"
+  },
+  "peerDependencies": {
+    "@oidcraft/adapter": "^0.2.0",
+    "kysely": ">=0.28"
+  },
+  "devDependencies": {
+    "@oidcraft/adapter": "^0.2.0",
+    "@oidcraft/sql": "0.0.0",
+    "@types/pg": "^8.23.1",
+    "kysely": "^0.29.8",
+    "kysely-bun-sqlite": "^0.4.0",
+    "pg": "^8.23.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=24.7"
+  }
+}