@0x0501/mystack 0.0.0-stage → 0.1.0-bootstrap.0

package/assets/generate-auth-schema.mjs

@@ -0,0 +1,25 @@
+import { spawn } from "node:child_process";
+import { readFile, rm, writeFile } from "node:fs/promises";
+const temporary = "src/lib/.mystack-auth.ts";
+let source = (await readFile("src/lib/auth.ts", "utf8"))
+	.replace('import { waitUntil } from "cloudflare:workers";', 'const waitUntil = (promise: Promise<unknown>) => { void promise; };')
+	.replaceAll("import.meta.env", '({ DEV: true, VITE_GITHUB_CLIENT_ID: undefined })');
+// The offline generator reads plugin metadata without a connected database.
+// Runtime auth keeps schema validation enabled.
+source = source.includes("\t\tadvanced: {\n")
+	? source.replace("\t\tadvanced: {\n", "\t\tadvanced: {\n\t\t\tdatabase: { validateSchema: false },\n")
+	: source.replace("\t\ttelemetry: { enabled: false },", "\t\ttelemetry: { enabled: false },\n\t\tadvanced: { database: { validateSchema: false } },");
+source += "\nexport const auth = createAuth({} as unknown as Database);\n";
+await writeFile(temporary, source, { flag: "wx" });
+try {
+	await new Promise((resolve, reject) => {
+		const child = spawn("bun", ["x", "auth@1.7.3", "generate", "--config", temporary, "--output", "./src/db/auth.schema.ts", "--yes"], { stdio: "inherit" });
+		child.on("error", reject);
+		child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`Auth schema generation failed (${code})`)));
+	});
+	await new Promise((resolve, reject) => {
+		const child = spawn("bun", ["x", "biome", "check", "--write", "src/db/auth.schema.ts"], { stdio: "inherit" });
+		child.on("error", reject);
+		child.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`Auth schema formatting failed (${code})`)));
+	});
+} finally { await rm(temporary, { force: true }); }

package/assets/platform.sqlite.schema.ts

@@ -0,0 +1,46 @@
+import { sql } from "drizzle-orm";
+import { index, integer, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
+import { user } from "./auth.sqlite.schema";
+
+export type JsonValue = string | number | boolean | null | { [key: string]: JsonValue } | JsonValue[];
+const createdAt = () => integer("created_at", { mode: "timestamp_ms" }).default(sql`(unixepoch('subsec') * 1000)`).notNull();
+const updatedAt = () => integer("updated_at", { mode: "timestamp_ms" }).default(sql`(unixepoch('subsec') * 1000)`).$onUpdate(() => new Date()).notNull();
+export const systemConfig = sqliteTable("system_config", {
+	key: text("key").primaryKey(),
+	value: text("value", { mode: "json" }).$type<JsonValue>().notNull(),
+	updatedAt: updatedAt(),
+});
+export const adminAction = sqliteTable("admin_action", {
+	id: text("id").primaryKey(),
+	actorId: text("actor_id").references(() => user.id, { onDelete: "set null" }),
+	action: text("action").notNull(),
+	targetType: text("target_type"),
+	targetId: text("target_id"),
+	detail: text("detail", { mode: "json" }).$type<JsonValue>(),
+	createdAt: createdAt(),
+}, (table) => [index("admin_action_created_idx").on(table.createdAt)]);
+export const purchase = sqliteTable("purchase", {
+	id: text("id").primaryKey(),
+	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+	provider: text("provider").notNull(),
+	externalId: text("external_id").notNull(),
+	amount: text("amount").notNull(),
+	currency: text("currency").notNull().default("usd"),
+	status: text("status").notNull().default("pending"),
+	metadata: text("metadata", { mode: "json" }).$type<JsonValue>(),
+	paidAt: integer("paid_at", { mode: "timestamp_ms" }),
+	fulfillmentKey: text("fulfillment_key"),
+	createdAt: createdAt(),
+	updatedAt: updatedAt(),
+}, (table) => [uniqueIndex("purchase_provider_external_uq").on(table.provider, table.externalId), index("purchase_userId_idx").on(table.userId)]);
+// Durable paid events. D1 commits this row in the same batch as the paid flip.
+// Product-specific fulfillment consumes these events with purchaseId as its
+// idempotency key; no arbitrary async callback pretends to be a D1 transaction.
+export const purchaseDelivery = sqliteTable("purchase_delivery", {
+	purchaseId: text("purchase_id").primaryKey().references(() => purchase.id, { onDelete: "cascade" }),
+	createdAt: createdAt(),
+	processedAt: integer("processed_at", { mode: "timestamp_ms" }),
+});
+export type SystemConfigRow = typeof systemConfig.$inferSelect;
+export type AdminActionRow = typeof adminAction.$inferSelect;
+export type PurchaseRow = typeof purchase.$inferSelect;

package/assets/polar-checkout.ts

@@ -0,0 +1,10 @@
+async function createPolarCheckout(input: { userId: string; userEmail: string; amount: number; currency: string }): Promise<{ externalId: string; url: string }> {
+	const { createPolar } = await import("@polar-sh/sdk/2026-10");
+	if (!env.POLAR_ACCESS_TOKEN || !env.POLAR_PRODUCT_ID) throw new Error("Polar is not configured.");
+	const polar = createPolar({ accessToken: env.POLAR_ACCESS_TOKEN, environment: env.POLAR_SANDBOX ? "sandbox" : "production" });
+	const checkout = await polar.checkouts.create({ products: [env.POLAR_PRODUCT_ID], customer_email: input.userEmail, external_customer_id: input.userId, success_url: `${env.APP_ORIGIN}/dashboard?checkout=success`, return_url: `${env.APP_ORIGIN}/dashboard?checkout=cancel` });
+	// The configured catalog price must match the local purchase ledger. Do not
+	// issue a pending purchase with an invented price for a fixed-price product.
+	if (checkout.amount !== input.amount || checkout.currency.toLowerCase() !== input.currency.toLowerCase()) throw new Error("Polar product price must match the demo purchase price and currency.");
+	return { externalId: checkout.id, url: checkout.url };
+}

package/assets/polar-route.ts

@@ -0,0 +1,19 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { withRlsService } from "@/db/helper";
+import { env } from "@/env";
+import { webhookBodyLimitMiddleware } from "@/middlewares/body-limit";
+import { databaseMiddleware } from "@/middlewares/database";
+import { handlePolarWebhook } from "@/services/polar";
+import { methodNotAllowed } from "@/utils/api-error";
+export const Route = createFileRoute("/api/webhooks/polar")({
+	server: { handlers: ({ createHandlers }) => createHandlers({
+		GET: { handler: () => methodNotAllowed("POST") },
+		POST: { middleware: [databaseMiddleware, webhookBodyLimitMiddleware], handler: async ({ request, context }) => {
+			const secret = env.POLAR_WEBHOOK_SECRET;
+			if (!secret) return Response.json({ error: "not_configured" }, { status: 503 });
+			const headers = Object.fromEntries(request.headers.entries());
+			const result = await withRlsService(context.db, (db) => handlePolarWebhook(db, { rawBody: context.rawBody, headers, secret }));
+			return Response.json({ result }, { status: result === "invalid_signature" || result === "invalid_payload" ? 400 : 200 });
+		} },
+	}) },
+});

package/assets/polar.test.ts

@@ -0,0 +1,30 @@
+import { createHmac } from "node:crypto";
+import { beforeEach, expect, test, vi } from "vitest";
+import type { Database } from "@/db";
+import { handlePolarWebhook } from "@/services/polar";
+import { markPurchasePaid } from "@/services/purchase";
+vi.mock("@/services/purchase", () => ({ markPurchasePaid: vi.fn() }));
+const db = {} as Database;
+const secret = "whsec_test-signing-secret";
+function signed(rawBody: string) {
+	const id = "test-event";
+	const timestamp = String(Math.floor(Date.now() / 1000));
+	const signature = createHmac("sha256", secret).update(`${id}.${timestamp}.${rawBody}`).digest("base64");
+	return { "webhook-id": id, "webhook-timestamp": timestamp, "webhook-signature": `v1,${signature}` };
+}
+beforeEach(() => vi.clearAllMocks());
+test("invalid signatures never reach the purchase ledger", async () => {
+	expect(await handlePolarWebhook(db, { rawBody: "{}", headers: {}, secret })).toBe("invalid_signature");
+	expect(markPurchasePaid).not.toHaveBeenCalled();
+});
+test("verified paid events map the checkout id and subtotal to the ledger", async () => {
+	vi.mocked(markPurchasePaid).mockResolvedValue({ status: "not_found" });
+	const rawBody = JSON.stringify({ type: "order.paid", timestamp: new Date().toISOString(), data: { checkout_id: "checkout-1", subtotal_amount: 500 } });
+	expect(await handlePolarWebhook(db, { rawBody, headers: signed(rawBody), secret })).toBe("unknown_order");
+	expect(markPurchasePaid).toHaveBeenCalledWith(db, { provider: "polar", externalId: "checkout-1", reportedAmount: 500 });
+});
+test("a signed malformed payload is refused without ledger effects", async () => {
+	const rawBody = "{invalid-json";
+	expect(await handlePolarWebhook(db, { rawBody, headers: signed(rawBody), secret })).toBe("invalid_payload");
+	expect(markPurchasePaid).not.toHaveBeenCalled();
+});

package/assets/polar.ts

@@ -0,0 +1,12 @@
+import { webhooks } from "@polar-sh/sdk/2026-10";
+import type { Database } from "@/db";
+import { markPurchasePaid } from "./purchase";
+export async function handlePolarWebhook(db: Database, input: { rawBody: string; headers: Record<string, string>; secret: string }) {
+	let event: Awaited<ReturnType<typeof webhooks.validateEvent>>;
+	try { event = await webhooks.validateEvent(input.rawBody, input.headers, input.secret); }
+	catch (error) { if (error instanceof webhooks.PolarWebhookVerificationError) return "invalid_signature"; if (error instanceof webhooks.PolarWebhookError) return "invalid_payload"; throw error; }
+	if (event.type !== "order.paid") return "ignored";
+	if (!event.data.checkout_id) return "unknown_order";
+	const result = await markPurchasePaid(db, { provider: "polar", externalId: event.data.checkout_id, reportedAmount: event.data.subtotal_amount });
+	return result.status === "not_found" ? "unknown_order" : result.status;
+}

package/assets/purchase.bun-sqlite.ts

@@ -0,0 +1,38 @@
+import { and, eq } from "drizzle-orm";
+import type { Database } from "@/db";
+import { purchaseDelivery, purchase as purchaseTable } from "@/db/schema";
+export type PurchaseProvider = "stripe" | "creem" | "nowpayments";
+export type PurchaseStatus = "pending" | "paid" | "failed";
+export type Purchase = { id: string; userId: string; provider: PurchaseProvider; externalId: string; amount: number; currency: string; status: PurchaseStatus; paidAt: Date | null };
+export type MarkPurchasePaidResult =
+	| { status: "fulfilled" | "already_paid" | "not_pending" | "amount_mismatch"; purchase: Purchase }
+	| { status: "not_found" };
+function rowToPurchase(row: typeof purchaseTable.$inferSelect): Purchase {
+	if (!/^\d+$/.test(row.amount) || !Number.isSafeInteger(Number(row.amount))) throw new Error("Invalid purchase amount.");
+	return { id: row.id, userId: row.userId, provider: row.provider as PurchaseProvider, externalId: row.externalId, amount: Number(row.amount), currency: row.currency, status: row.status as PurchaseStatus, paidAt: row.paidAt };
+}
+export async function markPurchasePaid(db: Database, input: { provider: PurchaseProvider; externalId: string; reportedAmount?: number }): Promise<MarkPurchasePaidResult> {
+	const where = and(eq(purchaseTable.provider, input.provider), eq(purchaseTable.externalId, input.externalId));
+	const [existing] = await db.select().from(purchaseTable).where(where).limit(1);
+	if (!existing) return { status: "not_found" };
+	const purchase = rowToPurchase(existing);
+	if (purchase.status === "paid") return { status: "already_paid", purchase };
+	if (purchase.status !== "pending") return { status: "not_pending", purchase };
+	if (input.reportedAmount !== undefined && purchase.amount !== input.reportedAmount) return { status: "amount_mismatch", purchase };
+	const claim = crypto.randomUUID();
+	const now = new Date();
+	// The paid flip and delivery event commit together in a synchronous transaction.
+	const flipped = db.transaction((tx) => {
+		const row = tx.update(purchaseTable).set({ status: "paid", paidAt: now, fulfillmentKey: claim }).where(and(where, eq(purchaseTable.status, "pending"))).returning().get();
+		if (row) tx.insert(purchaseDelivery).values({ purchaseId: row.id, createdAt: now }).run();
+		return row;
+	}, { behavior: "immediate" });
+	if (flipped) return { status: "fulfilled", purchase: rowToPurchase(flipped) };
+	const [again] = await db.select().from(purchaseTable).where(where).limit(1);
+	return { status: again?.status === "paid" ? "already_paid" : "not_pending", purchase: again ? rowToPurchase(again) : purchase };
+}
+export async function createPendingPurchase(db: Database, input: { userId: string; provider: PurchaseProvider; externalId: string; amount: number; currency?: string }): Promise<{ purchaseId: string }> {
+	const id = crypto.randomUUID();
+	await db.insert(purchaseTable).values({ id, userId: input.userId, provider: input.provider, externalId: input.externalId, amount: String(input.amount), currency: input.currency ?? "usd", status: "pending" });
+	return { purchaseId: id };
+}

package/assets/purchase.sqlite.ts

@@ -0,0 +1,39 @@
+import { and, eq, sql } from "drizzle-orm";
+import type { Database } from "@/db";
+import { purchaseDelivery, purchase as purchaseTable } from "@/db/schema";
+export type PurchaseProvider = "stripe" | "creem" | "nowpayments";
+export type PurchaseStatus = "pending" | "paid" | "failed";
+export type Purchase = { id: string; userId: string; provider: PurchaseProvider; externalId: string; amount: number; currency: string; status: PurchaseStatus; paidAt: Date | null };
+export type MarkPurchasePaidResult =
+	| { status: "fulfilled" | "already_paid" | "not_pending" | "amount_mismatch"; purchase: Purchase }
+	| { status: "not_found" };
+function rowToPurchase(row: typeof purchaseTable.$inferSelect): Purchase {
+	if (!/^\d+$/.test(row.amount) || !Number.isSafeInteger(Number(row.amount))) throw new Error("Invalid purchase amount.");
+	return { id: row.id, userId: row.userId, provider: row.provider as PurchaseProvider, externalId: row.externalId, amount: Number(row.amount), currency: row.currency, status: row.status as PurchaseStatus, paidAt: row.paidAt };
+}
+export async function markPurchasePaid(db: Database, input: { provider: PurchaseProvider; externalId: string; reportedAmount?: number }): Promise<MarkPurchasePaidResult> {
+	const where = and(eq(purchaseTable.provider, input.provider), eq(purchaseTable.externalId, input.externalId));
+	const [existing] = await db.select().from(purchaseTable).where(where).limit(1);
+	if (!existing) return { status: "not_found" };
+	const purchase = rowToPurchase(existing);
+	if (purchase.status === "paid") return { status: "already_paid", purchase };
+	if (purchase.status !== "pending") return { status: "not_pending", purchase };
+	if (input.reportedAmount !== undefined && purchase.amount !== input.reportedAmount) return { status: "amount_mismatch", purchase };
+	const claim = crypto.randomUUID();
+	const now = new Date();
+	// SQLite driver batches are atomic. Only the invocation that flips this pending row
+	// owns the claim and can insert the durable delivery event. A failed insert
+	// rolls back the flip, so the webhook's retry can try again safely.
+	const [flipped] = await db.batch([
+		db.update(purchaseTable).set({ status: "paid", paidAt: now, fulfillmentKey: claim }).where(and(where, eq(purchaseTable.status, "pending"))).returning(),
+		db.insert(purchaseDelivery).select(sql`SELECT id, ${now.getTime()}, NULL FROM purchase WHERE id = ${existing.id} AND fulfillment_key = ${claim}`),
+	]);
+	if (flipped[0]) return { status: "fulfilled", purchase: rowToPurchase(flipped[0]) };
+	const [again] = await db.select().from(purchaseTable).where(where).limit(1);
+	return { status: again?.status === "paid" ? "already_paid" : "not_pending", purchase: again ? rowToPurchase(again) : purchase };
+}
+export async function createPendingPurchase(db: Database, input: { userId: string; provider: PurchaseProvider; externalId: string; amount: number; currency?: string }): Promise<{ purchaseId: string }> {
+	const id = crypto.randomUUID();
+	await db.insert(purchaseTable).values({ id, userId: input.userId, provider: input.provider, externalId: input.externalId, amount: String(input.amount), currency: input.currency ?? "usd", status: "pending" });
+	return { purchaseId: id };
+}

package/assets/sqlite-migrations/0000_thin_phalanx.sql

@@ -0,0 +1,295 @@
+CREATE TABLE `account` (
+	`id` text PRIMARY KEY NOT NULL,
+	`account_id` text NOT NULL,
+	`provider_id` text NOT NULL,
+	`user_id` text NOT NULL,
+	`access_token` text,
+	`refresh_token` text,
+	`id_token` text,
+	`access_token_expires_at` integer,
+	`refresh_token_expires_at` integer,
+	`scope` text,
+	`password` text,
+	`created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL,
+	`updated_at` integer NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `account_userId_idx` ON `account` (`user_id`);--> statement-breakpoint
+CREATE TABLE `jwks` (
+	`id` text PRIMARY KEY NOT NULL,
+	`public_key` text NOT NULL,
+	`private_key` text NOT NULL,
+	`created_at` integer NOT NULL,
+	`expires_at` integer,
+	`alg` text,
+	`crv` text
+);
+--> statement-breakpoint
+CREATE TABLE `oauth_access_token` (
+	`id` text PRIMARY KEY NOT NULL,
+	`token` text NOT NULL,
+	`client_id` text NOT NULL,
+	`session_id` text,
+	`user_id` text,
+	`reference_id` text,
+	`authorization_code_id` text,
+	`resources` text,
+	`requested_user_info_claims` text,
+	`refresh_id` text,
+	`expires_at` integer NOT NULL,
+	`created_at` integer NOT NULL,
+	`revoked` integer,
+	`confirmation` text,
+	`scopes` text NOT NULL,
+	FOREIGN KEY (`client_id`) REFERENCES `oauth_client`(`client_id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`session_id`) REFERENCES `session`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`refresh_id`) REFERENCES `oauth_refresh_token`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauth_access_token_token_unique` ON `oauth_access_token` (`token`);--> statement-breakpoint
+CREATE INDEX `oauthAccessToken_clientId_idx` ON `oauth_access_token` (`client_id`);--> statement-breakpoint
+CREATE INDEX `oauthAccessToken_sessionId_idx` ON `oauth_access_token` (`session_id`);--> statement-breakpoint
+CREATE INDEX `oauthAccessToken_userId_idx` ON `oauth_access_token` (`user_id`);--> statement-breakpoint
+CREATE INDEX `oauthAccessToken_authorizationCodeId_idx` ON `oauth_access_token` (`authorization_code_id`);--> statement-breakpoint
+CREATE INDEX `oauthAccessToken_refreshId_idx` ON `oauth_access_token` (`refresh_id`);--> statement-breakpoint
+CREATE TABLE `oauth_client` (
+	`id` text PRIMARY KEY NOT NULL,
+	`client_id` text NOT NULL,
+	`client_secret` text,
+	`client_discovery_id` text,
+	`disabled` integer DEFAULT false,
+	`skip_consent` integer,
+	`enable_end_session` integer,
+	`subject_type` text,
+	`scopes` text,
+	`client_credentials_scopes` text DEFAULT '[]',
+	`user_id` text,
+	`created_at` integer,
+	`updated_at` integer,
+	`name` text,
+	`uri` text,
+	`icon` text,
+	`contacts` text,
+	`tos` text,
+	`policy` text,
+	`software_id` text,
+	`software_version` text,
+	`software_statement` text,
+	`redirect_uris` text NOT NULL,
+	`post_logout_redirect_uris` text,
+	`backchannel_logout_uri` text,
+	`backchannel_logout_session_required` integer,
+	`token_endpoint_auth_method` text,
+	`application_type` text,
+	`jwks` text,
+	`jwks_uri` text,
+	`grant_types` text,
+	`response_types` text,
+	`require_pkce` integer,
+	`dpop_bound_access_tokens` integer DEFAULT false,
+	`reference_id` text,
+	`metadata` text,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauth_client_client_id_unique` ON `oauth_client` (`client_id`);--> statement-breakpoint
+CREATE INDEX `oauthClient_userId_idx` ON `oauth_client` (`user_id`);--> statement-breakpoint
+CREATE TABLE `oauth_client_assertion` (
+	`id` text PRIMARY KEY NOT NULL,
+	`expires_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `oauth_client_resource` (
+	`id` text PRIMARY KEY NOT NULL,
+	`client_id` text NOT NULL,
+	`resource_id` text NOT NULL,
+	`metadata` text,
+	`created_at` integer,
+	FOREIGN KEY (`client_id`) REFERENCES `oauth_client`(`client_id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`resource_id`) REFERENCES `oauth_resource`(`identifier`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauthClientResource_clientId_resourceId_uidx` ON `oauth_client_resource` (`client_id`,`resource_id`);--> statement-breakpoint
+CREATE INDEX `oauthClientResource_clientId_idx` ON `oauth_client_resource` (`client_id`);--> statement-breakpoint
+CREATE INDEX `oauthClientResource_resourceId_idx` ON `oauth_client_resource` (`resource_id`);--> statement-breakpoint
+CREATE TABLE `oauth_consent` (
+	`id` text PRIMARY KEY NOT NULL,
+	`client_id` text NOT NULL,
+	`user_id` text,
+	`reference_id` text,
+	`resources` text,
+	`requested_user_info_claims` text,
+	`scopes` text NOT NULL,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL,
+	FOREIGN KEY (`client_id`) REFERENCES `oauth_client`(`client_id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `oauthConsent_clientId_idx` ON `oauth_consent` (`client_id`);--> statement-breakpoint
+CREATE INDEX `oauthConsent_userId_idx` ON `oauth_consent` (`user_id`);--> statement-breakpoint
+CREATE TABLE `oauth_refresh_token` (
+	`id` text PRIMARY KEY NOT NULL,
+	`token` text NOT NULL,
+	`client_id` text NOT NULL,
+	`session_id` text,
+	`user_id` text NOT NULL,
+	`reference_id` text,
+	`authorization_code_id` text,
+	`resources` text,
+	`requested_user_info_claims` text,
+	`expires_at` integer NOT NULL,
+	`created_at` integer NOT NULL,
+	`revoked` integer,
+	`rotated_at` integer,
+	`rotation_replay_response` text,
+	`rotation_replay_expires_at` integer,
+	`auth_time` integer,
+	`confirmation` text,
+	`scopes` text NOT NULL,
+	FOREIGN KEY (`client_id`) REFERENCES `oauth_client`(`client_id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`session_id`) REFERENCES `session`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauth_refresh_token_token_unique` ON `oauth_refresh_token` (`token`);--> statement-breakpoint
+CREATE INDEX `oauthRefreshToken_clientId_idx` ON `oauth_refresh_token` (`client_id`);--> statement-breakpoint
+CREATE INDEX `oauthRefreshToken_sessionId_idx` ON `oauth_refresh_token` (`session_id`);--> statement-breakpoint
+CREATE INDEX `oauthRefreshToken_userId_idx` ON `oauth_refresh_token` (`user_id`);--> statement-breakpoint
+CREATE INDEX `oauthRefreshToken_authorizationCodeId_idx` ON `oauth_refresh_token` (`authorization_code_id`);--> statement-breakpoint
+CREATE TABLE `oauth_resource` (
+	`id` text PRIMARY KEY NOT NULL,
+	`identifier` text NOT NULL,
+	`name` text NOT NULL,
+	`access_token_ttl` integer,
+	`refresh_token_ttl` integer,
+	`signing_algorithm` text,
+	`signing_key_id` text,
+	`allowed_scopes` text,
+	`custom_claims` text,
+	`dpop_bound_access_tokens_required` integer DEFAULT false,
+	`disabled` integer DEFAULT false,
+	`created_at` integer,
+	`updated_at` integer,
+	`policy_version` integer DEFAULT 1,
+	`metadata` text
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `oauth_resource_identifier_unique` ON `oauth_resource` (`identifier`);--> statement-breakpoint
+CREATE TABLE `passkey` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text,
+	`public_key` text NOT NULL,
+	`user_id` text NOT NULL,
+	`credential_id` text NOT NULL,
+	`counter` integer NOT NULL,
+	`device_type` text NOT NULL,
+	`backed_up` integer NOT NULL,
+	`transports` text,
+	`created_at` integer,
+	`aaguid` text,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `passkey_userId_idx` ON `passkey` (`user_id`);--> statement-breakpoint
+CREATE INDEX `passkey_credentialID_idx` ON `passkey` (`credential_id`);--> statement-breakpoint
+CREATE TABLE `session` (
+	`id` text PRIMARY KEY NOT NULL,
+	`expires_at` integer NOT NULL,
+	`token` text NOT NULL,
+	`created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL,
+	`updated_at` integer NOT NULL,
+	`ip_address` text,
+	`user_agent` text,
+	`user_id` text NOT NULL,
+	`impersonated_by` text,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `session_token_unique` ON `session` (`token`);--> statement-breakpoint
+CREATE INDEX `session_userId_idx` ON `session` (`user_id`);--> statement-breakpoint
+CREATE TABLE `two_factor` (
+	`id` text PRIMARY KEY NOT NULL,
+	`secret` text NOT NULL,
+	`backup_codes` text NOT NULL,
+	`user_id` text NOT NULL,
+	`verified` integer DEFAULT true,
+	`failed_verification_count` integer DEFAULT 0,
+	`locked_until` integer,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `twoFactor_secret_idx` ON `two_factor` (`secret`);--> statement-breakpoint
+CREATE INDEX `twoFactor_userId_idx` ON `two_factor` (`user_id`);--> statement-breakpoint
+CREATE TABLE `user` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`email` text NOT NULL,
+	`email_verified` integer DEFAULT false NOT NULL,
+	`image` text,
+	`created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL,
+	`updated_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL,
+	`role` text,
+	`banned` integer DEFAULT false,
+	`ban_reason` text,
+	`ban_expires` integer,
+	`two_factor_enabled` integer DEFAULT false,
+	`tokens_revoked_at` integer,
+	`locale` text
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `user_email_unique` ON `user` (`email`);--> statement-breakpoint
+CREATE TABLE `verification` (
+	`id` text PRIMARY KEY NOT NULL,
+	`identifier` text NOT NULL,
+	`value` text NOT NULL,
+	`expires_at` integer NOT NULL,
+	`created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL,
+	`updated_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `verification_identifier_idx` ON `verification` (`identifier`);--> statement-breakpoint
+CREATE TABLE `admin_action` (
+	`id` text PRIMARY KEY NOT NULL,
+	`actor_id` text,
+	`action` text NOT NULL,
+	`target_type` text,
+	`target_id` text,
+	`detail` text,
+	`created_at` integer DEFAULT (unixepoch('subsec') * 1000) NOT NULL,
+	FOREIGN KEY (`actor_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+CREATE INDEX `admin_action_created_idx` ON `admin_action` (`created_at`);--> statement-breakpoint
+CREATE TABLE `purchase` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`provider` text NOT NULL,
+	`external_id` text NOT NULL,
+	`amount` text NOT NULL,
+	`currency` text DEFAULT 'usd' NOT NULL,
+	`status` text DEFAULT 'pending' NOT NULL,
+	`metadata` text,
+	`paid_at` integer,
+	`fulfillment_key` text,
+	`created_at` integer DEFAULT (unixepoch('subsec') * 1000) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch('subsec') * 1000) NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `purchase_provider_external_uq` ON `purchase` (`provider`,`external_id`);--> statement-breakpoint
+CREATE INDEX `purchase_userId_idx` ON `purchase` (`user_id`);--> statement-breakpoint
+CREATE TABLE `purchase_delivery` (
+	`purchase_id` text PRIMARY KEY NOT NULL,
+	`created_at` integer DEFAULT (unixepoch('subsec') * 1000) NOT NULL,
+	`processed_at` integer,
+	FOREIGN KEY (`purchase_id`) REFERENCES `purchase`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE TABLE `system_config` (
+	`key` text PRIMARY KEY NOT NULL,
+	`value` text NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch('subsec') * 1000) NOT NULL
+);