create-authhero 0.47.3 → 0.48.1

package/dist/create-authhero.js

@@ -30,7 +30,7 @@ var c = new e(), l = {
 					decrypt: "node --env-file=.env scripts/decrypt-field.mjs"
 				},
 				dependencies: {
-					"@authhero/kysely-adapter": a,
+					"@authhero/drizzle": a,
 					...i && { "@authhero/admin": a },
 					"@authhero/widget": a,
 					"@hono/swagger-ui": "^0.6.0",
@@ -38,8 +38,8 @@ var c = new e(), l = {
 					"@hono/node-server": "latest",
 					authhero: a,
 					"better-sqlite3": "latest",
+					"drizzle-orm": "^0.44.0",
 					hono: "^4.12.0",
-					kysely: "latest",
 					...t && { "@authhero/multi-tenancy": a },
 					...n && { bcryptjs: "latest" }
 				},
@@ -441,9 +441,10 @@ function d(e, t = !1, n = "authhero-local", r) {
     }
   }
 ` : "";
-	return `import { SqliteDialect, Kysely } from "kysely";
-import Database from "better-sqlite3";
-import createAdapters from "@authhero/kysely-adapter";
+	return `import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import createAdapters from "@authhero/drizzle";
+import * as schema from "@authhero/drizzle/schema/sqlite";
 import { seed, createEncryptedDataAdapter, loadEncryptionKey${t ? ", USERNAME_PASSWORD_PROVIDER" : ""} } from "authhero";
 
 interface ExtraClient {
@@ -454,6 +455,9 @@ interface ExtraClient {
   allowed_logout_urls?: string[];
   web_origins?: string[];
   auth0_conformant?: boolean;
+  oidc_logout?: {
+    backchannel_logout_urls?: string[];
+  };
 }
 
 function parseFlag(name: string): string | undefined {
@@ -493,11 +497,8 @@ async function main() {
     ? JSON.parse(userProfileJson)
     : {};
 
-  const dialect = new SqliteDialect({
-    database: new Database("db.sqlite"),
-  });
-
-  const db = new Kysely<any>({ dialect });
+  const sqlite = new Database("db.sqlite");
+  const db = drizzle(sqlite, { schema });
   let adapters = createAdapters(db);
 
   // Match the server: encrypt seeded secrets at rest when a key is configured.
@@ -535,6 +536,7 @@ async function main() {
       ...(c.auth0_conformant !== undefined && {
         auth0_conformant: c.auth0_conformant,
       }),
+      ...(c.oidc_logout !== undefined && { oidc_logout: c.oidc_logout }),
     });
     console.log(\`✅ Created client "\${c.client_id}"\`);
   }
@@ -544,7 +546,7 @@ async function main() {
     console.log(\`✅ Updated profile of user "\${seedResult.username}"\`);
   }
 ${f}
-  await db.destroy();
+  sqlite.close();
 }
 
 main().catch((err) => {
@@ -1011,7 +1013,7 @@ c.version("1.0.0").description("Create a new AuthHero project").argument("[proje
 		]
 	}])).setupType;
 	let h;
-	h = m === "cloudflare-control-plane" ? !0 : m === "proxy" || m === "cloudflare-wfp-dispatcher" || m === "cloudflare-wfp-tenant" ? !1 : i.multiTenant === void 0 ? o ? !1 : (await t.prompt([{
+	h = m === "cloudflare-control-plane" ? !0 : m === "proxy" || m === "cloudflare-wfp-dispatcher" || m === "cloudflare-wfp-tenant" ? !1 : i.multiTenant === void 0 ? !o && (await t.prompt([{
 		type: "confirm",
 		name: "multiTenant",
 		message: "Would you like to enable multi-tenant mode?",
@@ -1125,7 +1127,7 @@ ENCRYPTION_KEY=${s()}
 				}])).shouldMigrate, n && (console.log("\n🔄 Running migrations...\n"), await x(`${e} run migrate`, p));
 			}
 			let n;
-			n = i.skipStart || o ? !1 : (await t.prompt([{
+			n = !i.skipStart && !o && (await t.prompt([{
 				type: "confirm",
 				name: "shouldStart",
 				message: "Would you like to start the development server?",

package/dist/local/src/index.ts

@@ -1,8 +1,8 @@
 import { serve } from "@hono/node-server";
-import { SqliteDialect } from "kysely";
-import { Kysely } from "kysely";
 import Database from "better-sqlite3";
-import createAdapters from "@authhero/kysely-adapter";
+import { drizzle, BetterSQLite3Database } from "drizzle-orm/better-sqlite3";
+import createAdapters from "@authhero/drizzle";
+import * as schema from "@authhero/drizzle/schema/sqlite";
 import { createEncryptedDataAdapter, loadEncryptionKey } from "authhero";
 import createApp from "./app";
 import fs from "fs";
@@ -85,12 +85,9 @@ function ensureCertificates() {
 }
 
 // Initialize SQLite database
-let db: Kysely<any>;
+let db: BetterSQLite3Database<typeof schema>;
 try {
-  const dialect = new SqliteDialect({
-    database: new Database("db.sqlite"),
-  });
-  db = new Kysely<any>({ dialect });
+  db = drizzle(new Database("db.sqlite"), { schema });
 } catch (error) {
   console.error("❌ Failed to initialize database:");
   console.error(

package/dist/local/src/migrate.ts

@@ -1,25 +1,26 @@
-import { SqliteDialect, Kysely } from "kysely";
 import Database from "better-sqlite3";
-import { migrateToLatest } from "@authhero/kysely-adapter";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
 
-async function migrate() {
-  const dialect = new SqliteDialect({
-    database: new Database("db.sqlite"),
-  });
+// Migrations are pre-generated and shipped with the @authhero/drizzle package.
+// The schema is managed by AuthHero — do not generate your own migrations.
+const migrationsFolder = "node_modules/@authhero/drizzle/drizzle";
 
-  const db = new Kysely<any>({ dialect });
+function migrateDb() {
+  const sqlite = new Database("db.sqlite");
+  const db = drizzle(sqlite);
 
   console.log("Running migrations...");
 
   try {
-    await migrateToLatest(db, true);
+    migrate(db, { migrationsFolder });
     console.log("✅ All migrations completed successfully");
   } catch (error) {
     console.error("Migration failed:", error);
     process.exit(1);
   } finally {
-    await db.destroy();
+    sqlite.close();
   }
 }
 
-migrate();
+migrateDb();

package/dist/proxy/README.md

@@ -29,34 +29,35 @@ export const proxyConfig: StaticProxyAdapterOptions = {
 
 The proxy reads its routes through a `ProxyDataAdapter`. Three implementations are common:
 
-| Adapter | Best for | Notes |
-| --- | --- | --- |
-| **Static** (default) | Local dev, small fixed deployments | Routes baked into the worker bundle; re-deploy to change them. |
-| **Database** | Same-process or co-located deployments | Reads directly from the proxy_routes table that authhero writes to. |
+| Adapter                   | Best for                                           | Notes                                                                      |
+| ------------------------- | -------------------------------------------------- | -------------------------------------------------------------------------- |
+| **Static** (default)      | Local dev, small fixed deployments                 | Routes baked into the worker bundle; re-deploy to change them.             |
+| **Database**              | Same-process or co-located deployments             | Reads directly from the proxy_routes table that authhero writes to.        |
 | **HTTP / management API** | Geographically distributed proxies, hosted Workers | Calls `/api/v2/proxy-routes` on your authhero server with a service token. |
 
 The authhero server exposes the management API (`/api/v2/proxy-routes`) and creates the underlying table automatically once the standard adapter migrations have run — see the `local` template's [src/index.ts](../local/src/index.ts).
 
-### Database-backed (Kysely)
+### Database-backed (Drizzle)
 
-Add the adapter and your Kysely driver, then swap the data line:
+Add the adapter and drizzle-orm, then swap the data line:
 
 ```bash
-npm install @authhero/kysely-adapter kysely
+npm install @authhero/drizzle drizzle-orm
 ```
 
 ```ts
-import { Kysely } from "kysely";
+import { drizzle } from "drizzle-orm/d1";
 import { createProxyApp } from "@authhero/proxy";
-import { createProxyDataAdapter } from "@authhero/kysely-adapter";
+import { createProxyDataAdapter } from "@authhero/drizzle";
+import * as schema from "@authhero/drizzle/schema/sqlite";
 
-const db = new Kysely({ dialect: /* your dialect */ });
+const db = drizzle(env.AUTH_DB, { schema });
 const app = createProxyApp({
   data: createProxyDataAdapter(db),
 });
 ```
 
-Cloudflare Workers can't open SQLite files, so on Workers this path means D1, Hyperdrive, or a remote MySQL/Postgres. For a local Node process, `better-sqlite3` pointing at the same `db.sqlite` your authhero server uses works out of the box.
+On Cloudflare Workers this reads from the same D1 database your authhero worker uses. For a local Node process, use `drizzle-orm/better-sqlite3` pointing at the same `db.sqlite` your authhero server uses. (If your routes live in MySQL/Postgres, `@authhero/kysely-adapter` exposes the same `createProxyDataAdapter` for Kysely dialects.)
 
 ### HTTP-backed (management API)
 
@@ -87,7 +88,7 @@ interface Env {
 
 function createHttpProxyAdapter(env: Env): ProxyDataAdapter {
   const headers = {
-    "authorization": `Bearer ${env.AUTHHERO_SERVICE_TOKEN}`,
+    authorization: `Bearer ${env.AUTHHERO_SERVICE_TOKEN}`,
     "tenant-id": env.AUTHHERO_TENANT_ID,
   };
 
@@ -101,16 +102,29 @@ function createHttpProxyAdapter(env: Env): ProxyDataAdapter {
     // The proxy data plane only needs resolveHost; the CRUD methods on
     // proxyRoutes stay unused (writes always go through authhero directly).
     proxyRoutes: {
-      list: () => { throw new Error("read-only proxy adapter"); },
-      get: () => { throw new Error("read-only proxy adapter"); },
-      create: () => { throw new Error("read-only proxy adapter"); },
-      update: () => { throw new Error("read-only proxy adapter"); },
-      remove: () => { throw new Error("read-only proxy adapter"); },
+      list: () => {
+        throw new Error("read-only proxy adapter");
+      },
+      get: () => {
+        throw new Error("read-only proxy adapter");
+      },
+      create: () => {
+        throw new Error("read-only proxy adapter");
+      },
+      update: () => {
+        throw new Error("read-only proxy adapter");
+      },
+      remove: () => {
+        throw new Error("read-only proxy adapter");
+      },
     },
     async resolveHost(host): Promise<ResolvedHost | null> {
-      const domains = await api<{ custom_domains: Array<{
-        custom_domain_id: string; domain: string;
-      }> }>("/api/v2/custom-domains");
+      const domains = await api<{
+        custom_domains: Array<{
+          custom_domain_id: string;
+          domain: string;
+        }>;
+      }>("/api/v2/custom-domains");
       const match = domains.custom_domains.find((d) => d.domain === host);
       if (!match) return null;
 

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "0.47.3",
+  "version": "0.48.1",
   "type": "module",
   "main": "dist/create-authhero.js",
   "bin": {