@absolutejs/auth 0.34.0 → 0.35.0

package/dist/cli/migrate.js

@@ -0,0 +1,2719 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/adaptive/postgresStores.ts
+import { and, desc, eq } from "drizzle-orm";
+import {
+  bigint,
+  boolean,
+  doublePrecision,
+  pgTable,
+  primaryKey,
+  varchar
+} from "drizzle-orm/pg-core";
+
+// src/stores/postgres.ts
+import { neon } from "@neondatabase/serverless";
+import { drizzle } from "drizzle-orm/neon-http";
+
+// src/adaptive/postgresStores.ts
+var ID_LENGTH = 255;
+var knownDevicesTable = pgTable("auth_known_devices", {
+  device_id: varchar("device_id", { length: ID_LENGTH }).notNull(),
+  first_seen_at_ms: bigint("first_seen_at_ms", {
+    mode: "number"
+  }).notNull(),
+  label: varchar("label", { length: ID_LENGTH }),
+  last_seen_at_ms: bigint("last_seen_at_ms", {
+    mode: "number"
+  }).notNull(),
+  trusted: boolean("trusted").notNull().default(false),
+  user_id: varchar("user_id", { length: ID_LENGTH }).notNull()
+}, (table) => [primaryKey({ columns: [table.user_id, table.device_id] })]);
+var loginHistoryTable = pgTable("auth_login_history", {
+  attempt_id: varchar("attempt_id", { length: ID_LENGTH }).primaryKey(),
+  country: varchar("country", { length: ID_LENGTH }),
+  device_id: varchar("device_id", { length: ID_LENGTH }).notNull(),
+  ip_address: varchar("ip_address", { length: ID_LENGTH }),
+  latitude: doublePrecision("latitude"),
+  longitude: doublePrecision("longitude"),
+  outcome: varchar("outcome", { length: ID_LENGTH }).notNull(),
+  timestamp_ms: bigint("timestamp_ms", { mode: "number" }).notNull(),
+  user_id: varchar("user_id", { length: ID_LENGTH }).notNull()
+});
+
+// src/apikeys/postgresStores.ts
+import { desc as desc2, eq as eq2, lt } from "drizzle-orm";
+import { bigint as bigint2, pgTable as pgTable2, text, varchar as varchar2 } from "drizzle-orm/pg-core";
+var ID_LENGTH2 = 255;
+var accessTokensTable = pgTable2("auth_access_tokens", {
+  client_id: varchar2("client_id", { length: ID_LENGTH2 }).notNull(),
+  created_at_ms: bigint2("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint2("expires_at_ms", { mode: "number" }).notNull(),
+  hashed_token: varchar2("hashed_token", { length: ID_LENGTH2 }).notNull(),
+  owner_id: varchar2("owner_id", { length: ID_LENGTH2 }),
+  scopes: text("scopes").array().notNull(),
+  token_id: varchar2("token_id", { length: ID_LENGTH2 }).primaryKey()
+});
+var apiClientsTable = pgTable2("auth_api_clients", {
+  client_id: varchar2("client_id", { length: ID_LENGTH2 }).primaryKey(),
+  created_at_ms: bigint2("created_at_ms", { mode: "number" }).notNull(),
+  hashed_secret: varchar2("hashed_secret", { length: ID_LENGTH2 }).notNull(),
+  name: varchar2("name", { length: ID_LENGTH2 }).notNull(),
+  owner_id: varchar2("owner_id", { length: ID_LENGTH2 }),
+  scopes: text("scopes").array().notNull()
+});
+var apiKeysTable = pgTable2("auth_api_keys", {
+  created_at_ms: bigint2("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint2("expires_at_ms", { mode: "number" }),
+  hashed_key: varchar2("hashed_key", { length: ID_LENGTH2 }).notNull(),
+  key_id: varchar2("key_id", { length: ID_LENGTH2 }).primaryKey(),
+  last_used_at_ms: bigint2("last_used_at_ms", { mode: "number" }),
+  name: varchar2("name", { length: ID_LENGTH2 }).notNull(),
+  owner_id: varchar2("owner_id", { length: ID_LENGTH2 }),
+  prefix: varchar2("prefix", { length: ID_LENGTH2 }).notNull(),
+  scopes: text("scopes").array().notNull()
+});
+
+// src/audit/postgresAuditStore.ts
+import { desc as desc3, eq as eq3, lt as lt2 } from "drizzle-orm";
+import { bigint as bigint3, jsonb, pgTable as pgTable3, varchar as varchar3 } from "drizzle-orm/pg-core";
+var ID_LENGTH3 = 255;
+var IP_LENGTH = 64;
+var TYPE_LENGTH = 64;
+var auditEventsTable = pgTable3("auth_audit_events", {
+  at_ms: bigint3("at_ms", { mode: "number" }).notNull(),
+  id: varchar3("id", { length: ID_LENGTH3 }).primaryKey(),
+  ip: varchar3("ip", { length: IP_LENGTH }),
+  metadata_json: jsonb("metadata_json").$type(),
+  organization_id: varchar3("organization_id", { length: ID_LENGTH3 }),
+  type: varchar3("type", { length: TYPE_LENGTH }).notNull(),
+  user_id: varchar3("user_id", { length: ID_LENGTH3 })
+});
+
+// src/credentials/postgresCredentialStore.ts
+import { eq as eq4 } from "drizzle-orm";
+import { bigint as bigint4, boolean as boolean2, pgTable as pgTable4, text as text2, varchar as varchar4 } from "drizzle-orm/pg-core";
+var EMAIL_LENGTH = 320;
+var ID_LENGTH4 = 255;
+var STATUS_LENGTH = 32;
+var TOKEN_HASH_LENGTH = 255;
+var credentialsTable = pgTable4("auth_credentials", {
+  created_at_ms: bigint4("created_at_ms", { mode: "number" }).notNull(),
+  email: varchar4("email", { length: EMAIL_LENGTH }).primaryKey(),
+  email_verified: boolean2("email_verified").notNull().default(false),
+  organization_id: varchar4("organization_id", { length: ID_LENGTH4 }),
+  password_hash: text2("password_hash").notNull(),
+  status: varchar4("status", { length: STATUS_LENGTH }).notNull().default("active"),
+  updated_at_ms: bigint4("updated_at_ms", { mode: "number" }).notNull(),
+  user_id: varchar4("user_id", { length: ID_LENGTH4 })
+});
+var createTokenTable = (name) => pgTable4(name, {
+  email: varchar4("email", { length: EMAIL_LENGTH }).notNull(),
+  expires_at_ms: bigint4("expires_at_ms", { mode: "number" }).notNull(),
+  token_hash: varchar4("token_hash", {
+    length: TOKEN_HASH_LENGTH
+  }).primaryKey()
+});
+var credentialResetTokensTable = createTokenTable("auth_credential_reset_tokens");
+var credentialVerificationTokensTable = createTokenTable("auth_credential_verification_tokens");
+
+// src/fga/postgresStores.ts
+import { and as and2, eq as eq5 } from "drizzle-orm";
+import { pgTable as pgTable5, varchar as varchar5 } from "drizzle-orm/pg-core";
+var ID_LENGTH5 = 255;
+var warrantsTable = pgTable5("auth_fga_warrants", {
+  id: varchar5("id", { length: ID_LENGTH5 }).primaryKey(),
+  relation: varchar5("relation", { length: ID_LENGTH5 }).notNull(),
+  resource_id: varchar5("resource_id", { length: ID_LENGTH5 }).notNull(),
+  resource_type: varchar5("resource_type", { length: ID_LENGTH5 }).notNull(),
+  subject_id: varchar5("subject_id", { length: ID_LENGTH5 }).notNull(),
+  subject_relation: varchar5("subject_relation", { length: ID_LENGTH5 }),
+  subject_type: varchar5("subject_type", { length: ID_LENGTH5 }).notNull()
+});
+
+// src/linkedProviders/neonStores.ts
+import { neon as neon2 } from "@neondatabase/serverless";
+import { desc as desc4, eq as eq6 } from "drizzle-orm";
+import { drizzle as drizzle2 } from "drizzle-orm/neon-http";
+import {
+  jsonb as jsonb2,
+  pgTable as pgTable6,
+  text as text3,
+  timestamp,
+  varchar as varchar6
+} from "drizzle-orm/pg-core";
+
+// node_modules/citra/dist/index.js
+var NUM_GENERATOR_BYTES = 32;
+var anilistProfileQuery = `query {
+  Viewer {
+    id
+    name
+    about
+    avatar {
+      large
+      medium
+    }
+    bannerImage
+    siteUrl
+    createdAt
+    updatedAt
+    donatorTier
+    donatorBadge
+    unreadNotificationCount
+    options {
+      titleLanguage
+      displayAdultContent
+      airingNotifications
+      profileColor
+      activityMergeTime
+      staffNameLanguage
+    }
+    mediaListOptions {
+      scoreFormat
+      rowOrder
+      animeList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+      mangaList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+    }
+    statistics {
+      anime {
+        count
+        meanScore
+        minutesWatched
+        episodesWatched
+      }
+      manga {
+        count
+        meanScore
+        chaptersRead
+        volumesRead
+      }
+    }
+    favourites {
+      anime {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      manga {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      characters {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      staff {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      studios {
+        nodes {
+          id
+          name
+          siteUrl
+        }
+      }
+    }
+    isFollower
+    isFollowing
+  }
+}`;
+var defineProviders = (providers) => providers;
+var providers = defineProviders({
+  "42": {
+    authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.intra.42.fr/v2/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.intra.42.fr/oauth/token"
+    }
+  },
+  amazoncognito: {
+    authorizationUrl: "https://${domain}/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/userInfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/token`
+    }
+  },
+  anilist: {
+    authorizationUrl: "https://anilist.co/api/v2/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: anilistProfileQuery
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://graphql.anilist.co"
+    },
+    scopeRequired: false,
+    subject: ["data", "Viewer", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://anilist.co/api/v2/oauth/token"
+    }
+  },
+  apple: {
+    authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://appleid.apple.com/auth/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://appleid.apple.com/auth/token"
+    }
+  },
+  atlassian: {
+    authorizationUrl: "https://auth.atlassian.com/authorize",
+    createAuthorizationURLSearchParams: {
+      audience: "api.atlassian.com"
+    },
+    email: ["email"],
+    fullName: ["name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["picture"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.atlassian.com/me"
+    },
+    scopeRequired: true,
+    subject: ["account_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.atlassian.com/oauth/token"
+    }
+  },
+  attio: {
+    authorizationUrl: "https://app.attio.com/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.attio.com/v2/self"
+    },
+    scopeRequired: true,
+    subject: ["workspace_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://app.attio.com/oauth/token"
+    }
+  },
+  auth0: {
+    authorizationUrl: (config) => `https://${config.domain}/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth/token`
+    }
+  },
+  authentik: {
+    authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.baseURL}/api/v3/user/`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.baseURL}/oauth/token`
+    }
+  },
+  autodesk: {
+    authorizationUrl: "https://developer.api.autodesk.com/authentication/v2/authorize",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.userprofile.autodesk.com/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://developer.api.autodesk.com/authentication/v2/token"
+    }
+  },
+  battlenet: {
+    authorizationUrl: "https://oauth.battle.net/authorize",
+    isOIDC: true,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth.battle.net/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.battle.net/token"
+    }
+  },
+  bitbucket: {
+    authorizationUrl: "https://bitbucket.org/site/oauth2/authorize",
+    fullName: ["display_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["links", "avatar", "href"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.bitbucket.org/2.0/user"
+    },
+    scopeRequired: false,
+    subject: ["uuid"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://bitbucket.org/site/oauth2/access_token"
+    }
+  },
+  box: {
+    authorizationUrl: "https://account.box.com/api/oauth2/authorize",
+    email: ["login"],
+    fullName: ["name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.box.com/2.0/users/me"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://api.box.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.box.com/oauth2/token"
+    }
+  },
+  bungie: {
+    authorizationUrl: "https://www.bungie.net/en/OAuth/Authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: {
+        "X-API-Key": "<YOUR_API_KEY>"
+      },
+      method: "GET",
+      url: "https://www.bungie.net/Platform/User/GetCurrentBungieNetUser"
+    },
+    scopeRequired: false,
+    subject: ["Response", "membershipId"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.bungie.net/Platform/App/OAuth/token"
+    }
+  },
+  close: {
+    authorizationUrl: "https://app.close.com/oauth2/authorize/",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.close.com/api/v1/me/"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.close.com/oauth2/token/"
+    }
+  },
+  coinbase: {
+    authorizationUrl: "https://www.coinbase.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.coinbase.com/v2/user"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.coinbase.com/oauth/token"
+    }
+  },
+  discord: {
+    authorizationUrl: "https://discord.com/api/oauth2/authorize",
+    email: ["email"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["avatar"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://discord.com/api/users/@me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://discord.com/api/oauth2/token"
+    }
+  },
+  donationalerts: {
+    authorizationUrl: "https://www.donationalerts.com/oauth/authorize",
+    email: ["data", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["data", "avatar"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.donationalerts.com/api/v1/user/oauth"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.donationalerts.com/oauth/token"
+    }
+  },
+  dribbble: {
+    authorizationUrl: "https://dribbble.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.dribbble.com/v2/user"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://dribbble.com/oauth/token"
+    }
+  },
+  dropbox: {
+    authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
+    email: ["email"],
+    familyName: ["name", "surname"],
+    fullName: ["name", "display_name"],
+    givenName: ["name", "given_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.dropboxapi.com/2/auth/token/revoke"
+    },
+    scopeRequired: false,
+    subject: ["account_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.dropboxapi.com/oauth2/token"
+    }
+  },
+  epicgames: {
+    authorizationUrl: "https://www.epicgames.com/id/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.epicgames.dev/epic/oauth/v2/userInfo"
+    },
+    scopeRequired: false,
+    subject: ["account_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.epicgames.dev/epic/oauth/v1/token"
+    }
+  },
+  etsy: {
+    authorizationUrl: "https://www.etsy.com/oauth/connect",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openapi.etsy.com/v3/application/users/me"
+    },
+    scopeRequired: false,
+    subject: ["results", "0", "user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.etsy.com/v3/public/oauth/token"
+    }
+  },
+  facebook: {
+    authorizationUrl: "https://www.facebook.com/v16.0/dialog/oauth",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: false,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      searchParams: [["fields", "id,name,email,picture"]],
+      url: "https://graph.facebook.com/me"
+    },
+    scopeRequired: false,
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"],
+      profile: ["id"]
+    },
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://graph.facebook.com/v16.0/oauth/access_token"
+    }
+  },
+  figma: {
+    authorizationUrl: "https://www.figma.com/oauth",
+    email: ["email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["img_url"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.figma.com/v1/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.figma.com/v1/oauth/token"
+    }
+  },
+  gitea: {
+    authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/user`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/login/oauth/access_token`
+    }
+  },
+  github: {
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    email: ["email"],
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.github.com/user"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://github.com/login/oauth/access_token"
+    }
+  },
+  gitlab: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    email: ["email"],
+    fullName: ["name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://gitlab.com/api/v4/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  gohighlevel: {
+    authorizationUrl: "https://marketplace.gohighlevel.com/oauth/chooselocation",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://services.leadconnectorhq.com/users/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://services.leadconnectorhq.com/oauth/token"
+    }
+  },
+  google: {
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openidconnect.googleapis.com/v1/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://oauth2.googleapis.com/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"],
+      profile: ["sub"]
+    },
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth2.googleapis.com/token"
+    }
+  },
+  hubspot: {
+    authorizationUrl: "https://app.hubspot.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.hubapi.com/oauth/v1/access-tokens/me"
+    },
+    scopeRequired: true,
+    subject: ["hub_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.hubapi.com/oauth/v1/token"
+    }
+  },
+  intuit: {
+    authorizationUrl: "https://appcenter.intuit.com/connect/oauth2",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => config.environment === "production" ? "https://accounts.platform.intuit.com/v1/openid_connect/userinfo" : "https://sandbox-accounts.platform.intuit.com/v1/openid_connect/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      headers: (config) => ({
+        Authorization: `Basic ${encodeBase64(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://developer.api.intuit.com/v2/oauth2/tokens/revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer"
+    }
+  },
+  kakao: {
+    authorizationUrl: "https://kauth.kakao.com/oauth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://kapi.kakao.com/v2/user/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://kauth.kakao.com/oauth/token"
+    }
+  },
+  keycloak: {
+    authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.kick.com/v1/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/token`
+    }
+  },
+  kick: {
+    authorizationUrl: "https://id.kick.com/oauth/authorize",
+    email: ["data", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["data", "profile_picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.kick.com/public/v1/users"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://id.kick.com/oauth/revoke"
+    },
+    scopeRequired: true,
+    subject: ["data", "user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://id.kick.com/oauth/token"
+    }
+  },
+  lichess: {
+    authorizationUrl: "https://lichess.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://lichess.org/api/account"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://lichess.org/api/token"
+    }
+  },
+  line: {
+    authorizationUrl: "https://access.line.me/oauth2/v2.1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.line.me/v2/profile"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.line.me/oauth2/v2.1/token"
+    }
+  },
+  linear: {
+    authorizationUrl: "https://linear.app/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { viewer { id name } }`
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.linear.app/graphql"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.linear.app/oauth/revoke"
+    },
+    scopeRequired: false,
+    subject: ["data", "viewer", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.linear.app/oauth/token"
+    }
+  },
+  linkedin: {
+    authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.linkedin.com/v2/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.linkedin.com/oauth/v2/accessToken"
+    }
+  },
+  mastodon: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["avatar"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/accounts/verify_credentials`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  mercadolibre: {
+    authorizationUrl: "https://auth.mercadolibre.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.mercadolibre.com/users/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.mercadolibre.com/oauth/token"
+    }
+  },
+  mercadopago: {
+    authorizationUrl: "https://auth.mercadopago.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.mercadopago.com/v1/users/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.mercadopago.com/oauth/token"
+    }
+  },
+  microsoftentraid: {
+    authorizationUrl: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/openid/userinfo`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/token`
+    }
+  },
+  monday: {
+    authorizationUrl: "https://auth.monday.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: "query { me { id name email } }"
+      },
+      encoding: "application/json",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.monday.com/v2"
+    },
+    scopeRequired: true,
+    subject: ["data", "me", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.monday.com/oauth2/token"
+    }
+  },
+  myanimelist: {
+    authorizationUrl: "https://myanimelist.net/v1/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "plain",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.myanimelist.net/v2/users/@me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://myanimelist.net/v1/oauth2/token"
+    }
+  },
+  naver: {
+    authorizationUrl: "https://nid.naver.com/oauth2.0/authorize",
+    email: ["response", "email"],
+    fullName: ["response", "name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["response", "profile_image"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openapi.naver.com/v1/nid/me"
+    },
+    scopeRequired: false,
+    subject: ["response", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://nid.naver.com/oauth2.0/token"
+    }
+  },
+  notion: {
+    authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
+    email: ["bot", "owner", "user", "person", "email"],
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["bot", "owner", "user", "avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      },
+      method: "GET",
+      url: "https://api.notion.com/v1/users/me"
+    },
+    scopeRequired: false,
+    subject: ["bot", "owner", "user", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.notion.com/v1/oauth/token"
+    }
+  },
+  okta: {
+    authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/revoke`
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/token`
+    }
+  },
+  osu: {
+    authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://osu.ppy.sh/api/v2/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://osu.ppy.sh/oauth/token"
+    }
+  },
+  patreon: {
+    authorizationUrl: "https://www.patreon.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.patreon.com/api/oauth2/v2/identity"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.patreon.com/api/oauth2/token"
+    }
+  },
+  pipedrive: {
+    authorizationUrl: "https://oauth.pipedrive.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.pipedrive.com/v1/users/me"
+    },
+    scopeRequired: true,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.pipedrive.com/oauth/token"
+    }
+  },
+  polar: {
+    authorizationUrl: "https://polar.sh/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.polar.sh/v1/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://api.polar.sh/v1/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.polar.sh/v1/oauth2/token"
+    }
+  },
+  polaraccesslink: {
+    authorizationUrl: "https://flow.polar.com/oauth2/authorization",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/me"
+    },
+    scopeRequired: false,
+    subject: ["x_user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://polarremote.com/v2/oauth2/token"
+    }
+  },
+  polarteampro: {
+    authorizationUrl: "https://auth.polar.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/<USER_ID>"
+    },
+    scopeRequired: false,
+    subject: ["x_user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.polar.com/oauth/token"
+    }
+  },
+  reddit: {
+    authorizationUrl: "https://www.reddit.com/api/v1/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth.reddit.com/api/v1/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      encoding: "application/json",
+      url: "https://www.reddit.com/api/v1/revoke_token"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.reddit.com/api/v1/access_token"
+    }
+  },
+  roblox: {
+    authorizationUrl: "https://apis.roblox.com/oauth/v1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://apis.roblox.com/oauth/v1/userinfo"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://apis.roblox.com/oauth/v1/token"
+    }
+  },
+  salesforce: {
+    authorizationUrl: "https://login.salesforce.com/services/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://login.salesforce.com/services/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://login.salesforce.com/services/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://login.salesforce.com/services/oauth2/token"
+    }
+  },
+  shikimori: {
+    authorizationUrl: "https://shikimori.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://shikimori.one/api/users/whoami"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://shikimori.org/oauth/token"
+    }
+  },
+  slack: {
+    authorizationUrl: "https://slack.com/openid/connect/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://slack.com/api/users.identity"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://slack.com/api/auth.revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://slack.com/api/openid.connect.token"
+    }
+  },
+  spotify: {
+    authorizationUrl: "https://accounts.spotify.com/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.spotify.com/v1/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://accounts.spotify.com/api/token"
+    }
+  },
+  startgg: {
+    authorizationUrl: "https://start.gg/oauth/authorize",
+    email: ["data", "currentUser", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { currentUser { id slug email player { gamerTag } } }`
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.start.gg/gql/alpha"
+    },
+    scopeRequired: false,
+    subject: ["data", "currentUser", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.start.gg/oauth/access_token"
+    }
+  },
+  strava: {
+    authorizationUrl: "https://www.strava.com/oauth/authorize",
+    familyName: ["lastname"],
+    givenName: ["firstname"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["profile"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.strava.com/api/v3/athlete"
+    },
+    revocationRequest: {
+      authIn: "query",
+      body: new URLSearchParams({
+        token_type_hint: "access_token"
+      }),
+      encoding: "application/json",
+      tokenParamName: "access_token",
+      url: "https://www.strava.com/oauth/deauthorize"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.strava.com/oauth/token"
+    }
+  },
+  synology: {
+    authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/webman/sso/SSOUserInfo.cgi?client_id=${config.clientId}&access_token=${config.accessToken}`
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/webman/sso/SSOAccessToken.cgi?client_id=${config.clientId}&client_secret=${config.clientSecret}`
+    }
+  },
+  tiktok: {
+    authorizationUrl: "https://www.tiktok.com/v2/auth/authorize",
+    createAuthorizationURLSearchParams: (config) => ({
+      client_key: config.clientId
+    }),
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://open.douyin.com/oauth/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://open.tiktokapis.com/v2/oauth/revoke/"
+    },
+    scopeRequired: false,
+    subject: ["data", "open_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://open.tiktokapis.com/v2/oauth/token/"
+    }
+  },
+  tiltify: {
+    authorizationUrl: "https://v5api.tiltify.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://v5api.tiltify.com/api/public/current-user"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://v5api.tiltify.com/oauth/token"
+    }
+  },
+  tumblr: {
+    authorizationUrl: "https://www.tumblr.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.tumblr.com/v2/user/info"
+    },
+    scopeRequired: false,
+    subject: ["response", "user", "name"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.tumblr.com/v2/oauth2/token"
+    }
+  },
+  twitch: {
+    authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      method: "GET",
+      url: "https://api.twitch.tv/helix/users"
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      tokenParamName: "token",
+      url: "https://id.twitch.tv/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://id.twitch.tv/oauth2/token"
+    }
+  },
+  twitter: {
+    authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.twitter.com/2/users/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.twitter.com/2/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.twitter.com/2/oauth2/token"
+    }
+  },
+  vk: {
+    authorizationUrl: "https://oauth.vk.com/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.vk.com/method/users.get"
+    },
+    scopeRequired: false,
+    subject: ["response", "0", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.vk.com/access_token"
+    }
+  },
+  withings: {
+    authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: async (config) => {
+        const props = await getWithingsProps(config);
+        if (props === undefined)
+          throw new Error("Failed to get Withings search properties");
+        const { nonce, hashedSignature } = props;
+        return [
+          ["action", "getuser"],
+          ["nonce", nonce],
+          ["client_id", config.clientId],
+          ["signature", hashedSignature]
+        ];
+      },
+      encoding: "application/x-www-form-urlencoded",
+      method: "POST",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    refreshAccessTokenBody: {
+      action: "requesttoken"
+    },
+    revocationRequest: {
+      authIn: "header",
+      body: async (config) => {
+        const props = await getWithingsProps(config);
+        if (!props)
+          throw new Error("Failed to get Withings props");
+        const { nonce, hashedSignature } = props;
+        return [
+          ["action", "revoke"],
+          ["client_id", config.clientId],
+          ["nonce", nonce],
+          ["signature", hashedSignature]
+        ];
+      },
+      encoding: "application/x-www-form-urlencoded",
+      method: "POST",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    scopeRequired: true,
+    subject: ["userid"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    validateAuthorizationCodeBody: {
+      action: "requesttoken"
+    }
+  },
+  workos: {
+    authorizationUrl: (config) => `https://${config.domain}/oauth2/authorize`,
+    createAuthorizationURLSearchParams: () => {
+      const nonce = crypto.randomUUID();
+      return {
+        nonce
+      };
+    },
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "POST",
+      url: (config) => `https://${config.domain}/oauth2/userinfo`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/token`
+    }
+  },
+  yahoo: {
+    authorizationUrl: "https://api.login.yahoo.com/oauth2/request_auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.login.yahoo.com/openid/v1/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.login.yahoo.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.login.yahoo.com/oauth2/get_token"
+    }
+  },
+  yandex: {
+    authorizationUrl: "https://oauth.yandex.com/authorize",
+    createAuthorizationURLSearchParams: {
+      device_id: crypto.randomUUID(),
+      device_name: `${navigator.platform ?? "Unknown"} \u2014 ${(navigator.userAgent.split(")")[0] || "").split("(").pop() || "Unknown"}`
+    },
+    email: ["default_email"],
+    familyName: ["last_name"],
+    fullName: ["real_name"],
+    givenName: ["first_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://login.yandex.ru/info"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "access_token",
+      url: "https://oauth.yandex.com/revoke_token"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.yandex.com/token"
+    }
+  },
+  zoho: {
+    authorizationUrl: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/auth`,
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/user/info`
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/token/revoke`
+    },
+    scopeRequired: true,
+    subject: ["ZUID"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/token`
+    }
+  },
+  zoom: {
+    authorizationUrl: "https://zoom.us/oauth/authorize",
+    email: ["email"],
+    familyName: ["last_name"],
+    givenName: ["first_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["pic_url"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.zoom.us/v2/users/me"
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      headers: (config) => ({
+        Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://zoom.us/oauth/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://zoom.us/oauth/token"
+    }
+  }
+});
+var isOIDCProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.isOIDC;
+};
+var isPKCEProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.PKCEMethod !== undefined;
+};
+var isRefreshableProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.isRefreshable;
+};
+var isRevocableProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.revocationRequest !== undefined;
+};
+var isScopeRequiredProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.scopeRequired;
+};
+var isValidProviderOption = (option) => Object.hasOwn(providers, option);
+var encodeBase64 = (input) => {
+  let raw;
+  if (typeof input === "string") {
+    raw = input;
+  } else {
+    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+    raw = bytes.reduce((acc, byte) => acc + String.fromCharCode(byte), "");
+  }
+  return btoa(raw);
+};
+var getWithingsProps = async (config) => {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = `getnonce,${config.clientId},${timestamp}`;
+  const hashedSignature = await hmacSha256(signature, config.clientSecret);
+  const nonceUrl = new URL("https://wbsapi.withings.net/v2/signature");
+  nonceUrl.searchParams.set("action", "getnonce");
+  nonceUrl.searchParams.set("client_id", config.clientId);
+  nonceUrl.searchParams.set("timestamp", timestamp.toString());
+  nonceUrl.searchParams.set("signature", hashedSignature);
+  const nonceTarget = nonceUrl.toString();
+  const nonceResponse = await fetch(nonceTarget, {
+    ...h2IfHttps(nonceTarget),
+    method: "POST"
+  });
+  const nonceData = await nonceResponse.json();
+  if (nonceData.status === 0) {
+    return {
+      hashedSignature,
+      nonce: nonceData.body.nonce
+    };
+  }
+  return;
+};
+var h2IfHttps = (url) => {
+  const init = url.startsWith("https://") ? { protocol: "http2" } : {};
+  return init;
+};
+var hmacSha256 = async (message, secret) => {
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const sigBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+var createRandomBase64UrlGenerator = (length) => () => {
+  const buffer = crypto.getRandomValues(new Uint8Array(length));
+  return base64Url(buffer);
+};
+var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);
+var pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);
+var providerOptions = Object.keys(providers).filter(isValidProviderOption);
+var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);
+var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
+var scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);
+
+// src/linkedProviders/neonStores.ts
+var linkedProviderBindingsTable = pgTable6("linked_provider_bindings", {
+  available_scopes: jsonb2("available_scopes").$type().notNull().default([]),
+  capabilities: jsonb2("capabilities").$type().default([]),
+  connector_provider: varchar6("connector_provider", { length: 64 }).notNull(),
+  created_at: timestamp("created_at").notNull().defaultNow(),
+  email: varchar6("email", { length: 320 }),
+  external_account_id: varchar6("external_account_id", {
+    length: 255
+  }).notNull(),
+  external_account_type: varchar6("external_account_type", {
+    length: 64
+  }).notNull(),
+  grant_id: varchar6("grant_id", { length: 255 }).notNull(),
+  id: varchar6("id", { length: 255 }).primaryKey(),
+  label: varchar6("label", { length: 255 }),
+  metadata: jsonb2("metadata").$type().default({}),
+  status: varchar6("status", { length: 64 }).$type().notNull(),
+  updated_at: timestamp("updated_at").notNull().defaultNow(),
+  username: varchar6("username", { length: 255 })
+});
+var linkedProviderGrantsTable = pgTable6("linked_provider_grants", {
+  access_token_ciphertext: text3("access_token_ciphertext"),
+  auth_provider_key: varchar6("auth_provider_key", { length: 64 }).notNull(),
+  created_at: timestamp("created_at").notNull().defaultNow(),
+  expires_at: timestamp("expires_at"),
+  granted_scopes: jsonb2("granted_scopes").$type().notNull().default([]),
+  id: varchar6("id", { length: 255 }).primaryKey(),
+  last_refresh_error: text3("last_refresh_error"),
+  last_refreshed_at: timestamp("last_refreshed_at"),
+  metadata: jsonb2("metadata").$type().default({}),
+  owner_ref: varchar6("owner_ref", { length: 255 }).notNull(),
+  provider_family: varchar6("provider_family", { length: 64 }).notNull(),
+  provider_subject: varchar6("provider_subject", { length: 255 }).notNull(),
+  refresh_token_ciphertext: text3("refresh_token_ciphertext"),
+  status: varchar6("status", { length: 64 }).$type().notNull(),
+  token_type: varchar6("token_type", { length: 64 }),
+  updated_at: timestamp("updated_at").notNull().defaultNow()
+});
+
+// src/lockout/postgresLockoutStore.ts
+import { eq as eq7 } from "drizzle-orm";
+import { bigint as bigint5, integer, pgTable as pgTable7, varchar as varchar7 } from "drizzle-orm/pg-core";
+var KEY_LENGTH = 320;
+var lockoutsTable = pgTable7("auth_lockouts", {
+  failed_attempts: integer("failed_attempts").notNull().default(0),
+  key: varchar7("key", { length: KEY_LENGTH }).primaryKey(),
+  locked_until_ms: bigint5("locked_until_ms", { mode: "number" }),
+  window_started_at_ms: bigint5("window_started_at_ms", {
+    mode: "number"
+  }).notNull()
+});
+
+// src/mfa/postgresMfaStore.ts
+import { eq as eq8 } from "drizzle-orm";
+import {
+  bigint as bigint6,
+  boolean as boolean3,
+  jsonb as jsonb3,
+  pgTable as pgTable8,
+  text as text4,
+  varchar as varchar8
+} from "drizzle-orm/pg-core";
+var ID_LENGTH6 = 255;
+var mfaEnrollmentsTable = pgTable8("auth_mfa_enrollments", {
+  backup_code_hashes: jsonb3("backup_code_hashes").$type().notNull().default([]),
+  created_at_ms: bigint6("created_at_ms", { mode: "number" }).notNull(),
+  last_used_at_ms: bigint6("last_used_at_ms", { mode: "number" }),
+  totp_secret_ciphertext: text4("totp_secret_ciphertext"),
+  totp_verified: boolean3("totp_verified").notNull().default(false),
+  updated_at_ms: bigint6("updated_at_ms", { mode: "number" }).notNull(),
+  user_id: varchar8("user_id", { length: ID_LENGTH6 }).primaryKey()
+});
+
+// src/oidc/postgresStores.ts
+import { and as and3, desc as desc5, eq as eq9, gt, lt as lt3 } from "drizzle-orm";
+import {
+  bigint as bigint7,
+  boolean as boolean4,
+  jsonb as jsonb4,
+  pgTable as pgTable9,
+  text as text5,
+  varchar as varchar9
+} from "drizzle-orm/pg-core";
+var URL_LENGTH = 2048;
+var ID_LENGTH7 = 255;
+var oauthClientAssertionJtisTable = pgTable9("auth_oauth_client_assertion_jtis", {
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).notNull(),
+  composite_key: varchar9("composite_key", {
+    length: ID_LENGTH7
+  }).primaryKey(),
+  expires_at_ms: bigint7("expires_at_ms", { mode: "number" }).notNull(),
+  jti: varchar9("jti", { length: ID_LENGTH7 }).notNull()
+});
+var oauthClientRegistrationTokensTable = pgTable9("auth_oauth_client_registration_tokens", {
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
+  token_hash: varchar9("token_hash", { length: ID_LENGTH7 }).primaryKey()
+});
+var oauthClientsTable = pgTable9("auth_oauth_clients", {
+  backchannel_logout_uri: varchar9("backchannel_logout_uri", {
+    length: URL_LENGTH
+  }),
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).primaryKey(),
+  hashed_secret: varchar9("hashed_secret", { length: ID_LENGTH7 }),
+  jwks_json: jsonb4("jwks_json").$type(),
+  jwks_uri: varchar9("jwks_uri", { length: URL_LENGTH }),
+  name: varchar9("name", { length: ID_LENGTH7 }).notNull(),
+  post_logout_redirect_uris: text5("post_logout_redirect_uris").array(),
+  redirect_uris: text5("redirect_uris").array().notNull(),
+  require_pushed_authorization_requests: boolean4("require_pushed_authorization_requests"),
+  require_signed_request_object: boolean4("require_signed_request_object"),
+  scopes: text5("scopes").array().notNull()
+});
+var oauthCodesTable = pgTable9("auth_oauth_codes", {
+  acr: varchar9("acr", { length: ID_LENGTH7 }),
+  claims_json: jsonb4("claims_json").$type(),
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).notNull(),
+  code_challenge: varchar9("code_challenge", { length: ID_LENGTH7 }).notNull(),
+  code_hash: varchar9("code_hash", { length: ID_LENGTH7 }).primaryKey(),
+  created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
+  dpop_jkt: varchar9("dpop_jkt", { length: ID_LENGTH7 }),
+  expires_at_ms: bigint7("expires_at_ms", { mode: "number" }).notNull(),
+  nonce: varchar9("nonce", { length: ID_LENGTH7 }),
+  redirect_uri: varchar9("redirect_uri", { length: ID_LENGTH7 }).notNull(),
+  scopes: text5("scopes").array().notNull(),
+  user_id: varchar9("user_id", { length: ID_LENGTH7 }).notNull()
+});
+var oauthDeviceAuthorizationsTable = pgTable9("auth_oauth_device_authorizations", {
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
+  device_code_hash: varchar9("device_code_hash", {
+    length: ID_LENGTH7
+  }).primaryKey(),
+  expires_at_ms: bigint7("expires_at_ms", { mode: "number" }).notNull(),
+  interval_seconds: bigint7("interval_seconds", { mode: "number" }).notNull(),
+  scopes: text5("scopes").array().notNull(),
+  status: varchar9("status", { length: 16 }).notNull(),
+  user_code: varchar9("user_code", { length: 16 }).notNull().unique(),
+  user_sub: varchar9("user_sub", { length: ID_LENGTH7 })
+});
+var oauthInitialAccessTokensTable = pgTable9("auth_oauth_initial_access_tokens", {
+  token_hash: varchar9("token_hash", { length: ID_LENGTH7 }).primaryKey()
+});
+var oauthLogoutDeliveriesTable = pgTable9("auth_oauth_logout_deliveries", {
+  attempts: bigint7("attempts", { mode: "number" }).notNull(),
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
+  endpoint_url: varchar9("endpoint_url", { length: URL_LENGTH }).notNull(),
+  id: varchar9("id", { length: ID_LENGTH7 }).primaryKey(),
+  last_error: text5("last_error"),
+  last_status: bigint7("last_status", { mode: "number" }),
+  logout_token: text5("logout_token").notNull(),
+  user_id: varchar9("user_id", { length: ID_LENGTH7 }).notNull()
+});
+var oauthPushedAuthorizationRequestsTable = pgTable9("auth_oauth_pushed_authorization_requests", {
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint7("expires_at_ms", { mode: "number" }).notNull(),
+  params_json: jsonb4("params_json").$type().notNull(),
+  request_uri_hash: varchar9("request_uri_hash", {
+    length: ID_LENGTH7
+  }).primaryKey()
+});
+var oauthRefreshTokensTable = pgTable9("auth_oauth_refresh_tokens", {
+  acr: varchar9("acr", { length: ID_LENGTH7 }),
+  claims_json: jsonb4("claims_json").$type(),
+  client_id: varchar9("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint7("created_at_ms", { mode: "number" }).notNull(),
+  dpop_jkt: varchar9("dpop_jkt", { length: ID_LENGTH7 }),
+  expires_at_ms: bigint7("expires_at_ms", { mode: "number" }).notNull(),
+  scopes: text5("scopes").array().notNull(),
+  token_hash: varchar9("token_hash", { length: ID_LENGTH7 }).primaryKey(),
+  user_id: varchar9("user_id", { length: ID_LENGTH7 }).notNull()
+});
+
+// src/organizations/postgresOrganizationStore.ts
+import { and as and4, eq as eq10 } from "drizzle-orm";
+import {
+  bigint as bigint8,
+  jsonb as jsonb5,
+  pgTable as pgTable10,
+  primaryKey as primaryKey2,
+  varchar as varchar10
+} from "drizzle-orm/pg-core";
+var ID_LENGTH8 = 255;
+var NAME_LENGTH = 255;
+var STATE_LENGTH = 16;
+var organizationInvitationsTable = pgTable10("auth_organization_invitations", {
+  accepted_at_ms: bigint8("accepted_at_ms", { mode: "number" }),
+  created_at_ms: bigint8("created_at_ms", { mode: "number" }).notNull(),
+  email: varchar10("email", { length: ID_LENGTH8 }).notNull(),
+  expires_at_ms: bigint8("expires_at_ms", { mode: "number" }).notNull(),
+  invitation_id: varchar10("invitation_id", {
+    length: ID_LENGTH8
+  }).primaryKey(),
+  inviter_user_id: varchar10("inviter_user_id", { length: ID_LENGTH8 }),
+  organization_id: varchar10("organization_id", {
+    length: ID_LENGTH8
+  }).notNull(),
+  roles: jsonb5("roles").$type().notNull().default([]),
+  state: varchar10("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
+  token_hash: varchar10("token_hash", { length: ID_LENGTH8 }).notNull().unique()
+});
+var organizationMembershipsTable = pgTable10("auth_organization_memberships", {
+  created_at_ms: bigint8("created_at_ms", { mode: "number" }).notNull(),
+  organization_id: varchar10("organization_id", {
+    length: ID_LENGTH8
+  }).notNull(),
+  roles: jsonb5("roles").$type().notNull().default([]),
+  status: varchar10("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
+  updated_at_ms: bigint8("updated_at_ms", { mode: "number" }).notNull(),
+  user_id: varchar10("user_id", { length: ID_LENGTH8 }).notNull()
+}, (table) => [primaryKey2({ columns: [table.organization_id, table.user_id] })]);
+var organizationsTable = pgTable10("auth_organizations", {
+  created_at_ms: bigint8("created_at_ms", { mode: "number" }).notNull(),
+  metadata: jsonb5("metadata").$type(),
+  name: varchar10("name", { length: NAME_LENGTH }).notNull(),
+  organization_id: varchar10("organization_id", {
+    length: ID_LENGTH8
+  }).primaryKey(),
+  updated_at_ms: bigint8("updated_at_ms", { mode: "number" }).notNull()
+});
+
+// src/passwordless/postgresPasswordlessTokenStore.ts
+import { eq as eq11 } from "drizzle-orm";
+import { bigint as bigint9, pgTable as pgTable11, varchar as varchar11 } from "drizzle-orm/pg-core";
+var ID_LENGTH9 = 255;
+var passwordlessTokensTable = pgTable11("auth_passwordless_tokens", {
+  email: varchar11("email", { length: ID_LENGTH9 }).notNull(),
+  expires_at_ms: bigint9("expires_at_ms", { mode: "number" }).notNull(),
+  token_hash: varchar11("token_hash", { length: ID_LENGTH9 }).primaryKey()
+});
+
+// src/portal/postgresSetupSessionStore.ts
+import { eq as eq12 } from "drizzle-orm";
+import { bigint as bigint10, jsonb as jsonb6, pgTable as pgTable12, varchar as varchar12 } from "drizzle-orm/pg-core";
+var ID_LENGTH10 = 255;
+var setupSessionsTable = pgTable12("auth_setup_sessions", {
+  capabilities: jsonb6("capabilities").$type().notNull().default([]),
+  created_at_ms: bigint10("created_at_ms", { mode: "number" }).notNull(),
+  created_by: varchar12("created_by", { length: ID_LENGTH10 }),
+  expires_at_ms: bigint10("expires_at_ms", { mode: "number" }).notNull(),
+  organization_id: varchar12("organization_id", {
+    length: ID_LENGTH10
+  }).notNull(),
+  setup_session_id: varchar12("setup_session_id", {
+    length: ID_LENGTH10
+  }).primaryKey(),
+  token_hash: varchar12("token_hash", { length: ID_LENGTH10 }).notNull().unique()
+});
+
+// src/roles/postgresRoleStore.ts
+import { and as and5, eq as eq13 } from "drizzle-orm";
+import {
+  bigint as bigint11,
+  jsonb as jsonb7,
+  pgTable as pgTable13,
+  primaryKey as primaryKey3,
+  varchar as varchar13
+} from "drizzle-orm/pg-core";
+var ID_LENGTH11 = 255;
+var SLUG_LENGTH = 128;
+var GLOBAL_SCOPE = "";
+var rolesTable = pgTable13("auth_roles", {
+  created_at_ms: bigint11("created_at_ms", { mode: "number" }).notNull(),
+  organization_id: varchar13("organization_id", { length: ID_LENGTH11 }).notNull().default(GLOBAL_SCOPE),
+  permissions: jsonb7("permissions").$type().notNull().default([]),
+  slug: varchar13("slug", { length: SLUG_LENGTH }).notNull(),
+  updated_at_ms: bigint11("updated_at_ms", { mode: "number" }).notNull()
+}, (table) => [primaryKey3({ columns: [table.organization_id, table.slug] })]);
+
+// src/scim/postgresScimTokenStore.ts
+import { desc as desc6, eq as eq14 } from "drizzle-orm";
+import { bigint as bigint12, pgTable as pgTable14, varchar as varchar14 } from "drizzle-orm/pg-core";
+var ID_LENGTH12 = 255;
+var scimTokensTable = pgTable14("auth_scim_tokens", {
+  created_at_ms: bigint12("created_at_ms", { mode: "number" }).notNull(),
+  hashed_token: varchar14("hashed_token", { length: ID_LENGTH12 }).notNull(),
+  last_used_at_ms: bigint12("last_used_at_ms", { mode: "number" }),
+  organization_id: varchar14("organization_id", {
+    length: ID_LENGTH12
+  }).notNull(),
+  token_id: varchar14("token_id", { length: ID_LENGTH12 }).primaryKey()
+});
+
+// src/session/neonStore.ts
+import { neon as neon3 } from "@neondatabase/serverless";
+import { eq as eq15 } from "drizzle-orm";
+import { drizzle as drizzle3 } from "drizzle-orm/neon-http";
+import {
+  bigint as bigint13,
+  jsonb as jsonb8,
+  pgTable as pgTable15,
+  text as text6,
+  timestamp as timestamp2,
+  varchar as varchar15
+} from "drizzle-orm/pg-core";
+var authSessionsTable = pgTable15("auth_sessions", {
+  access_token: text6("access_token"),
+  authenticated_at_ms: bigint13("authenticated_at_ms", { mode: "number" }),
+  created_at: timestamp2("created_at").notNull().defaultNow(),
+  expires_at_ms: bigint13("expires_at_ms", { mode: "number" }).notNull(),
+  id: varchar15("id", { length: 255 }).primaryKey(),
+  refresh_token: text6("refresh_token"),
+  updated_at: timestamp2("updated_at").notNull().defaultNow(),
+  user_json: jsonb8("user_json").$type().notNull()
+});
+var authUnregisteredSessionsTable = pgTable15("auth_unregistered_sessions", {
+  access_token: text6("access_token"),
+  created_at: timestamp2("created_at").notNull().defaultNow(),
+  expires_at_ms: bigint13("expires_at_ms", { mode: "number" }).notNull(),
+  id: varchar15("id", { length: 255 }).primaryKey(),
+  refresh_token: text6("refresh_token"),
+  session_information_json: jsonb8("session_information_json").$type(),
+  updated_at: timestamp2("updated_at").notNull().defaultNow(),
+  user_identity_json: jsonb8("user_identity_json").$type()
+});
+
+// src/sso/postgresSamlServiceProviderStore.ts
+import { eq as eq16 } from "drizzle-orm";
+import { bigint as bigint14, pgTable as pgTable16, text as text7, varchar as varchar16 } from "drizzle-orm/pg-core";
+var ID_LENGTH13 = 255;
+var URL_LENGTH2 = 2048;
+var samlServiceProvidersTable = pgTable16("auth_saml_service_providers", {
+  acs_url: varchar16("acs_url", { length: URL_LENGTH2 }).notNull(),
+  created_at_ms: bigint14("created_at_ms", { mode: "number" }).notNull(),
+  entity_id: varchar16("entity_id", { length: URL_LENGTH2 }).primaryKey(),
+  name_id_format: varchar16("name_id_format", { length: ID_LENGTH13 }),
+  signing_cert: text7("signing_cert"),
+  updated_at_ms: bigint14("updated_at_ms", { mode: "number" }).notNull()
+});
+
+// src/sso/postgresSsoConnectionStore.ts
+import { and as and6, desc as desc7, eq as eq17 } from "drizzle-orm";
+import { bigint as bigint15, boolean as boolean5, jsonb as jsonb9, pgTable as pgTable17, varchar as varchar17 } from "drizzle-orm/pg-core";
+var ID_LENGTH14 = 255;
+var TYPE_LENGTH2 = 16;
+var ssoConnectionsTable = pgTable17("auth_sso_connections", {
+  config: jsonb9("config").$type().notNull(),
+  connection_id: varchar17("connection_id", { length: ID_LENGTH14 }).primaryKey(),
+  created_at_ms: bigint15("created_at_ms", { mode: "number" }).notNull(),
+  enabled: boolean5("enabled").notNull().default(true),
+  organization_id: varchar17("organization_id", {
+    length: ID_LENGTH14
+  }).notNull(),
+  type: varchar17("type", { length: TYPE_LENGTH2 }).$type().notNull(),
+  updated_at_ms: bigint15("updated_at_ms", { mode: "number" }).notNull()
+});
+
+// src/vault/postgresVaultStore.ts
+import { and as and7, eq as eq18 } from "drizzle-orm";
+import { bigint as bigint16, pgTable as pgTable18, primaryKey as primaryKey4, text as text8, varchar as varchar18 } from "drizzle-orm/pg-core";
+var ID_LENGTH15 = 255;
+var vaultEntriesTable = pgTable18("auth_vault_entries", {
+  created_at_ms: bigint16("created_at_ms", { mode: "number" }).notNull(),
+  encrypted_value: text8("encrypted_value").notNull(),
+  name: varchar18("name", { length: ID_LENGTH15 }).notNull(),
+  owner_id: varchar18("owner_id", { length: ID_LENGTH15 }).notNull(),
+  updated_at_ms: bigint16("updated_at_ms", { mode: "number" }).notNull()
+}, (table) => ({ pk: primaryKey4({ columns: [table.owner_id, table.name] }) }));
+
+// src/webauthn/postgresWebAuthnCredentialStore.ts
+import { eq as eq19 } from "drizzle-orm";
+import {
+  bigint as bigint17,
+  boolean as boolean6,
+  jsonb as jsonb10,
+  pgTable as pgTable19,
+  text as text9,
+  varchar as varchar19
+} from "drizzle-orm/pg-core";
+var ID_LENGTH16 = 255;
+var DEVICE_TYPE_LENGTH = 32;
+var webauthnCredentialsTable = pgTable19("auth_webauthn_credentials", {
+  backed_up: boolean6("backed_up"),
+  counter: bigint17("counter", { mode: "number" }).notNull().default(0),
+  created_at_ms: bigint17("created_at_ms", { mode: "number" }).notNull(),
+  credential_id: varchar19("credential_id", { length: ID_LENGTH16 }).primaryKey(),
+  device_type: varchar19("device_type", { length: DEVICE_TYPE_LENGTH }),
+  last_used_at_ms: bigint17("last_used_at_ms", { mode: "number" }),
+  public_key: text9("public_key").notNull(),
+  transports: jsonb10("transports").$type(),
+  user_id: varchar19("user_id", { length: ID_LENGTH16 }).notNull()
+});
+
+// src/webhooks/postgresStore.ts
+import { desc as desc8, eq as eq20 } from "drizzle-orm";
+import { bigint as bigint18, jsonb as jsonb11, pgTable as pgTable20, text as text10, varchar as varchar20 } from "drizzle-orm/pg-core";
+var ID_LENGTH17 = 255;
+var URL_LENGTH3 = 2048;
+var webhookDeliveriesTable = pgTable20("auth_webhook_deliveries", {
+  attempts: bigint18("attempts", { mode: "number" }).notNull(),
+  created_at_ms: bigint18("created_at_ms", { mode: "number" }).notNull(),
+  endpoint_url: varchar20("endpoint_url", { length: URL_LENGTH3 }).notNull(),
+  envelope_id: varchar20("envelope_id", { length: ID_LENGTH17 }).primaryKey(),
+  envelope_json: jsonb11("envelope_json").$type().notNull(),
+  last_error: text10("last_error"),
+  last_status: bigint18("last_status", { mode: "number" })
+});
+
+// src/migrations/generate.ts
+import { is, SQL } from "drizzle-orm";
+import {
+  getTableConfig
+} from "drizzle-orm/pg-core";
+var renderChunk = (chunk) => {
+  if (chunk === null || typeof chunk !== "object")
+    return String(chunk);
+  const value = Reflect.get(chunk, "value");
+  if (Array.isArray(value))
+    return value.map((part) => String(part)).join("");
+  return "";
+};
+var formatSqlTemplate = (value) => value.queryChunks.map(renderChunk).join("");
+var formatDefault = (value) => {
+  if (value === null || value === undefined)
+    return "NULL";
+  if (is(value, SQL))
+    return formatSqlTemplate(value);
+  if (typeof value === "string")
+    return `'${value.replace(/'/gu, "''")}'`;
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number")
+    return String(value);
+  if (Array.isArray(value) || typeof value === "object") {
+    return `'${JSON.stringify(value)}'::jsonb`;
+  }
+  return String(value);
+};
+var columnSql = (column) => {
+  const parts = [`"${column.name}"`, column.getSQLType()];
+  if (column.primary)
+    parts.push("PRIMARY KEY");
+  if (column.notNull && !column.primary)
+    parts.push("NOT NULL");
+  if (column.hasDefault && column.default !== undefined) {
+    parts.push(`DEFAULT ${formatDefault(column.default)}`);
+  }
+  if (column.isUnique)
+    parts.push("UNIQUE");
+  return parts.join(" ");
+};
+var compositePkLine = (compositePk) => `PRIMARY KEY (${compositePk.map((column) => `"${column.name}"`).join(", ")})`;
+var tableToCreateSql = (table) => {
+  const cfg = getTableConfig(table);
+  const columnLines = cfg.columns.map(columnSql);
+  const singlePk = cfg.columns.find((column) => column.primary);
+  const compositePk = cfg.primaryKeys[0]?.columns ?? [];
+  const lines = singlePk === undefined && compositePk.length > 0 ? [...columnLines, compositePkLine(compositePk)] : columnLines;
+  const body = lines.map((line) => `	${line}`).join(`,
+`);
+  return `CREATE TABLE IF NOT EXISTS "${cfg.name}" (
+${body}
+);`;
+};
+var tablesToInitSql = (tables) => tables.map(tableToCreateSql).join(`
+
+`);
+
+// src/migrations/runner.ts
+import { Pool } from "@neondatabase/serverless";
+var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
+	"id" text PRIMARY KEY,
+	"applied_at_ms" bigint NOT NULL
+);`;
+var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
+var allBlockNames = () => Object.keys(blockMigrations);
+var applyOne = async (pool, id, sql, log) => {
+  await pool.query(sql);
+  await pool.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
+  log(`apply  ${id}`);
+};
+var runOne = async (pool, id, sql, applied, result, log) => {
+  if (applied.has(id)) {
+    result.skipped.push(id);
+    log(`skip   ${id}`);
+    return;
+  }
+  await applyOne(pool, id, sql, log);
+  result.applied.push(id);
+};
+var runMigrations = async ({
+  blocks,
+  databaseUrl,
+  log = console.log
+}) => {
+  const pool = new Pool({ connectionString: databaseUrl });
+  const result = { applied: [], skipped: [] };
+  try {
+    await pool.query(JOURNAL_DDL);
+    const journal = await pool.query(`SELECT "id" FROM "auth_migrations"`);
+    const applied = new Set(journal.rows.filter(isJournalRow).map((row) => row.id));
+    const selected = blocks ?? allBlockNames();
+    const flat = selected.flatMap((block) => blockMigrations[block].migrations.map((migration) => ({
+      id: `${block}/${migration.id}`,
+      sql: migration.sql
+    })));
+    await flat.reduce(async (prior, item) => {
+      await prior;
+      return runOne(pool, item.id, item.sql, applied, result, log);
+    }, Promise.resolve());
+  } finally {
+    await pool.end();
+  }
+  return result;
+};
+
+// src/migrations/index.ts
+var initMigration = (block, tables) => ({
+  block,
+  migrations: [{ id: "0001_init", sql: tablesToInitSql(tables) }]
+});
+var blockMigrations = {
+  adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
+  apikeys: initMigration("apikeys", [
+    accessTokensTable,
+    apiClientsTable,
+    apiKeysTable
+  ]),
+  audit: initMigration("audit", [auditEventsTable]),
+  credentials: initMigration("credentials", [
+    credentialsTable,
+    credentialResetTokensTable,
+    credentialVerificationTokensTable
+  ]),
+  fga: initMigration("fga", [warrantsTable]),
+  linkedProviders: initMigration("linkedProviders", [
+    linkedProviderBindingsTable,
+    linkedProviderGrantsTable
+  ]),
+  lockout: initMigration("lockout", [lockoutsTable]),
+  mfa: initMigration("mfa", [mfaEnrollmentsTable]),
+  oidc: initMigration("oidc", [
+    oauthClientAssertionJtisTable,
+    oauthClientRegistrationTokensTable,
+    oauthClientsTable,
+    oauthCodesTable,
+    oauthDeviceAuthorizationsTable,
+    oauthInitialAccessTokensTable,
+    oauthLogoutDeliveriesTable,
+    oauthPushedAuthorizationRequestsTable,
+    oauthRefreshTokensTable
+  ]),
+  organizations: initMigration("organizations", [
+    organizationsTable,
+    organizationMembershipsTable,
+    organizationInvitationsTable
+  ]),
+  passwordless: initMigration("passwordless", [passwordlessTokensTable]),
+  portal: initMigration("portal", [setupSessionsTable]),
+  roles: initMigration("roles", [rolesTable]),
+  scim: initMigration("scim", [scimTokensTable]),
+  sessions: initMigration("sessions", [
+    authSessionsTable,
+    authUnregisteredSessionsTable
+  ]),
+  sso: initMigration("sso", [ssoConnectionsTable, samlServiceProvidersTable]),
+  vault: initMigration("vault", [vaultEntriesTable]),
+  webauthn: initMigration("webauthn", [webauthnCredentialsTable]),
+  webhooks: initMigration("webhooks", [webhookDeliveriesTable])
+};
+
+// src/cli/migrate.ts
+var USAGE = `Usage:
+  bunx absolute-auth migrate --db <url> [--blocks block1,block2,...]
+
+Options:
+  --db, --database-url    Postgres connection string (falls back to DATABASE_URL env)
+  --blocks                Comma-separated subset of blocks to apply (default: all)
+  --help                  Print this message
+
+Available blocks: ${Object.keys(blockMigrations).sort().join(", ")}
+`;
+var consumeFlag = (parsed, flag, args) => {
+  if (flag === "--help" || flag === "-h") {
+    parsed.help = true;
+  } else if (flag === "--db" || flag === "--database-url") {
+    parsed.databaseUrl = args.shift();
+  } else if (flag === "--blocks") {
+    const list = args.shift() ?? "";
+    parsed.blocks = list.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0).map((entry) => entry);
+  }
+};
+var parseArgs = (argv) => {
+  const parsed = {
+    blocks: undefined,
+    databaseUrl: undefined,
+    help: false
+  };
+  const args = [...argv];
+  while (args.length > 0) {
+    consumeFlag(parsed, args.shift(), args);
+  }
+  return parsed;
+};
+var die = (message) => {
+  process.stderr.write(`error: ${message}
+
+`);
+  process.stderr.write(USAGE);
+  process.exit(1);
+};
+var main = async () => {
+  const positional = process.argv.slice(2);
+  if (positional[0] === "migrate")
+    positional.shift();
+  const { blocks, databaseUrl, help } = parseArgs(positional);
+  if (help) {
+    process.stdout.write(USAGE);
+    return;
+  }
+  const resolved = databaseUrl ?? process.env["DATABASE_URL"];
+  if (resolved === undefined || resolved.length === 0) {
+    die("a Postgres URL is required (--db or DATABASE_URL)");
+    return;
+  }
+  const unknown = blocks?.filter((block) => !(block in blockMigrations)) ?? [];
+  if (unknown.length > 0) {
+    die(`unknown block(s): ${unknown.join(", ")}`);
+    return;
+  }
+  const result = await runMigrations({ blocks, databaseUrl: resolved });
+  process.stdout.write(`
+${result.applied.length} migration(s) applied, ${result.skipped.length} skipped.
+`);
+};
+await main();
+
+//# debugId=562323D9670B702364756E2164756E21
+//# sourceMappingURL=migrate.js.map