@absolutejs/auth 0.45.0 → 0.45.1

package/dist/organizations/postgresOrganizationStore.d.ts

@@ -1,4 +1,4 @@
-import { type AnyPgDatabase } from '../stores/postgres';
+import { type AnyPgDatabase, type PgQueryResultHKT } from '../stores/postgres';
 import type { InvitationState, MembershipStatus, OrganizationStore } from './types';
 export declare const organizationInvitationsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_organization_invitations";
@@ -409,4 +409,4 @@ export declare const organizationsTable: import("drizzle-orm/pg-core").PgTableWi
     dialect: "pg";
 }>;
 export declare const createNeonOrganizationStore: (databaseUrl: string) => OrganizationStore;
-export declare const createPostgresOrganizationStore: (db: AnyPgDatabase) => OrganizationStore;
+export declare const createPostgresOrganizationStore: <Q extends PgQueryResultHKT>(db: AnyPgDatabase<Q>) => OrganizationStore;

package/dist/plugins/index.js.map

@@ -5,12 +5,12 @@
     "import { resolveMx } from 'node:dns/promises';\n\n// Email deliverability validation for sign-up — format, disposable-domain block, and an\n// optional MX check. A starter disposable list ships built-in; extend it with your own.\n\nexport type EmailValidationResult = {\n\tok: boolean;\n\treason?: 'disposable' | 'invalid_format' | 'no_mx';\n};\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/u;\n\nconst DISPOSABLE_DOMAINS = new Set([\n\t'10minutemail.com',\n\t'fakeinbox.com',\n\t'getnada.com',\n\t'guerrillamail.com',\n\t'mailinator.com',\n\t'maildrop.cc',\n\t'sharklasers.com',\n\t'temp-mail.org',\n\t'tempmail.com',\n\t'throwaway.email',\n\t'trashmail.com',\n\t'yopmail.com'\n]);\n\nconst domainOf = (email: string) =>\n\temail.slice(email.lastIndexOf('@') + 1).toLowerCase();\n\nconst hasMxRecord = async (domain: string) => {\n\ttry {\n\t\treturn (await resolveMx(domain)).length > 0;\n\t} catch {\n\t\treturn false;\n\t}\n};\n\n// Whether an email's domain is a known disposable/temporary provider (built-in list plus any\n// `extraDomains` you pass).\nexport const isDisposableEmail = (\n\temail: string,\n\textraDomains?: Iterable<string>\n) => {\n\tconst domain = domainOf(email);\n\n\treturn (\n\t\tDISPOSABLE_DOMAINS.has(domain) ||\n\t\t(extraDomains !== undefined && new Set(extraDomains).has(domain))\n\t);\n};\n\n// Validate an email for sign-up. With `checkMx`, also confirms the domain has MX records\n// (a network lookup). Wire it into your register flow before creating the user.\nexport const validateEmailDeliverability = async (\n\temail: string,\n\toptions?: { checkMx?: boolean; disposableDomains?: Iterable<string> }\n): Promise<EmailValidationResult> => {\n\tconst normalized = email.trim().toLowerCase();\n\tif (!EMAIL_PATTERN.test(normalized)) {\n\t\treturn { ok: false, reason: 'invalid_format' };\n\t}\n\tif (isDisposableEmail(normalized, options?.disposableDomains)) {\n\t\treturn { ok: false, reason: 'disposable' };\n\t}\n\tif (\n\t\toptions?.checkMx === true &&\n\t\t!(await hasMxRecord(domainOf(normalized)))\n\t) {\n\t\treturn { ok: false, reason: 'no_mx' };\n\t}\n\n\treturn { ok: true };\n};\n",
     "// Tiny wrapper around the existing `isDisposableEmail` so it slots into the\n// CredentialsConfig.onCreateCredentialUser hook chain. Composes with whatever else the\n// consumer is doing in onCreateCredentialUser — call this first, fall through on pass.\n//\n// ~10 lines; mostly here as a concrete demonstration that \"plugin\" = \"named function\".\n\nimport { isDisposableEmail } from '../credentials/emailValidation';\n\nexport type DenyDisposableEmailDecision =\n\t| { allow: false; reason: string }\n\t| { allow: true };\n\nexport const denyDisposableEmailPlugin = async (\n\temail: string\n): Promise<DenyDisposableEmailDecision> => {\n\tconst trimmed = email.trim().toLowerCase();\n\tif (await isDisposableEmail(trimmed)) {\n\t\treturn { allow: false, reason: 'disposable_email' };\n\t}\n\n\treturn { allow: true };\n};\n",
     "// Discord webhook plugin — same shape as slackAlert, slightly different payload.\n// ~20 lines; copy + modify if you want embeds, mentions, etc.\n\nimport type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';\n\nexport type DiscordAlertOptions = {\n\tevents?: readonly AuditEventType[];\n\tformatContent?: (event: AuditEvent) => string;\n\twebhookUrl: string;\n};\n\nconst defaultContent = (event: AuditEvent) => {\n\tconst when = new Date(event.at).toISOString();\n\tconst who = event.userId ?? event.ip ?? 'unknown';\n\n\treturn `🔐 **${event.type}** — ${who} at ${when}`;\n};\n\nexport const discordAlertPlugin = ({\n\tevents,\n\tformatContent = defaultContent,\n\twebhookUrl\n}: DiscordAlertOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (events !== undefined && !events.includes(event.type)) return;\n\t\tawait fetch(webhookUrl, {\n\t\t\tbody: JSON.stringify({ content: formatContent(event) }),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n",
-    "// Geo-block plugin — gate credential login on the request's country (from\n// `x-client-country` or `cf-ipcountry`). Pair with `isMfaRequired` (force MFA in\n// blocked countries) OR fail closed by throwing in your own login handler.\n//\n// ~25 lines; one Set lookup.\n\nconst readCountry = (headers: Record<string, string | undefined>) =>\n\theaders['x-client-country']?.toUpperCase() ??\n\theaders['cf-ipcountry']?.toUpperCase();\n\nexport type GeoBlockOptions =\n\t| { allowCountries: readonly string[]; denyCountries?: never }\n\t| { allowCountries?: never; denyCountries: readonly string[] };\n\n// Returns `true` when the request should be BLOCKED (i.e. the user is in a deny-listed\n// country, or not in the allow-list). The consumer uses the return to either force\n// MFA via `isMfaRequired` or to reject the login outright.\nexport const geoBlockPlugin = (options: GeoBlockOptions) => {\n\tconst allow =\n\t\toptions.allowCountries === undefined\n\t\t\t? undefined\n\t\t\t: new Set(options.allowCountries.map((country) => country.toUpperCase()));\n\tconst deny =\n\t\toptions.denyCountries === undefined\n\t\t\t? undefined\n\t\t\t: new Set(options.denyCountries.map((country) => country.toUpperCase()));\n\n\treturn (headers: Record<string, string | undefined>) => {\n\t\tconst country = readCountry(headers);\n\t\tif (country === undefined) return false;\n\t\tif (deny !== undefined) return deny.has(country);\n\t\tif (allow !== undefined) return !allow.has(country);\n\n\t\treturn false;\n\t};\n};\n",
+    "// Geo-block plugin — gate credential login on the request's country (from\n// `x-client-country` or `cf-ipcountry`). Pair with `isMfaRequired` (force MFA in\n// blocked countries) OR fail closed by throwing in your own login handler.\n//\n// ~25 lines; one Set lookup.\n\nconst readCountry = (headers: Record<string, string | undefined>) =>\n\theaders['x-client-country']?.toUpperCase() ??\n\theaders['cf-ipcountry']?.toUpperCase();\n\nexport type GeoBlockOptions =\n\t| { allowCountries: readonly string[]; denyCountries?: never }\n\t| { allowCountries?: never; denyCountries: readonly string[] };\n\n// Returns `true` when the request should be BLOCKED (i.e. the user is in a deny-listed\n// country, or not in the allow-list). The consumer uses the return to either force\n// MFA via `isMfaRequired` or to reject the login outright.\nexport const geoBlockPlugin = (options: GeoBlockOptions) => {\n\tconst allow =\n\t\toptions.allowCountries === undefined\n\t\t\t? undefined\n\t\t\t: new Set(\n\t\t\t\t\toptions.allowCountries.map((country) =>\n\t\t\t\t\t\tcountry.toUpperCase()\n\t\t\t\t\t)\n\t\t\t\t);\n\tconst deny =\n\t\toptions.denyCountries === undefined\n\t\t\t? undefined\n\t\t\t: new Set(\n\t\t\t\t\toptions.denyCountries.map((country) =>\n\t\t\t\t\t\tcountry.toUpperCase()\n\t\t\t\t\t)\n\t\t\t\t);\n\n\treturn (headers: Record<string, string | undefined>) => {\n\t\tconst country = readCountry(headers);\n\t\tif (country === undefined) return false;\n\t\tif (deny !== undefined) return deny.has(country);\n\t\tif (allow !== undefined) return !allow.has(country);\n\n\t\treturn false;\n\t};\n};\n",
     "// PagerDuty Events API v2 plugin. Posts a trigger event to a PagerDuty service —\n// pair with security-critical audit events (credentials_login_failed, mfa_challenge_failed,\n// impersonation_started) by passing `events: [...]`. Severity defaults to 'warning' but\n// most consumers wire 'critical' for these.\n//\n// Get a routing key from a PagerDuty integration: Service → Integrations → +Add → Events API v2.\n\nimport type { AuditEventType, AuditSink } from '../audit/types';\n\nconst PAGERDUTY_EVENTS_URL = 'https://events.pagerduty.com/v2/enqueue';\n\nexport type PagerDutySeverity = 'critical' | 'error' | 'info' | 'warning';\n\nexport type PagerDutyAlertOptions = {\n\tevents?: readonly AuditEventType[];\n\troutingKey: string;\n\tseverity?: PagerDutySeverity;\n\t// Optional source identifier (e.g. your service name) for grouping in PagerDuty.\n\tsource?: string;\n};\n\nexport const pagerdutyAlertPlugin = ({\n\tevents,\n\troutingKey,\n\tseverity = 'warning',\n\tsource = 'absolutejs-auth'\n}: PagerDutyAlertOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (events !== undefined && !events.includes(event.type)) return;\n\t\tawait fetch(PAGERDUTY_EVENTS_URL, {\n\t\t\tbody: JSON.stringify({\n\t\t\t\tevent_action: 'trigger',\n\t\t\t\tpayload: {\n\t\t\t\t\tcustom_details: event.metadata ?? {},\n\t\t\t\t\tseverity,\n\t\t\t\t\tsource,\n\t\t\t\t\tsummary: `auth event: ${event.type} (user=${event.userId ?? 'unknown'})`,\n\t\t\t\t\ttimestamp: new Date(event.at).toISOString()\n\t\t\t\t},\n\t\t\t\trouting_key: routingKey\n\t\t\t}),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n",
     "// PostHog server-side identify. Pair with audit events that have a `userId` (register,\n// credentials_login, oauth_login, …) to push the user to PostHog with their\n// email/properties so server-side events tie back to the right person.\n//\n// ~25 lines; one POST per event. Drop into the audit chain via composition or use as\n// an `AuditSink` directly.\n\nimport type { AuditEvent, AuditSink } from '../audit/types';\n\nexport type PosthogIdentifyOptions = {\n\thost?: string; // defaults to PostHog Cloud US\n\tprojectApiKey: string;\n\t// Pull the properties to send from the audit event metadata + your own enrichment.\n\tproperties?: (event: AuditEvent) => Record<string, unknown>;\n};\n\nconst DEFAULT_HOST = 'https://us.i.posthog.com';\n\nexport const posthogIdentifyPlugin = ({\n\thost = DEFAULT_HOST,\n\tprojectApiKey,\n\tproperties = (event) => ({ ...(event.metadata ?? {}) })\n}: PosthogIdentifyOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (event.userId === undefined) return;\n\t\tawait fetch(`${host}/capture/`, {\n\t\t\tbody: JSON.stringify({\n\t\t\t\tapi_key: projectApiKey,\n\t\t\t\tdistinct_id: event.userId,\n\t\t\t\tevent: '$identify',\n\t\t\t\tproperties: {\n\t\t\t\t\t$set: properties(event),\n\t\t\t\t\t$set_once: { first_seen_event: event.type }\n\t\t\t\t},\n\t\t\t\ttimestamp: new Date(event.at).toISOString()\n\t\t\t}),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n",
     "// Slack webhook plugin. Pair with `audit.onAuditEvent` OR drop into the audit chain\n// (it's a valid `AuditSink`) to post a one-line summary of chosen audit events to a\n// Slack channel webhook. Fire-and-forget, ~30 lines — copy + modify if you want a\n// different message shape.\n\nimport type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';\n\nexport type SlackAlertOptions = {\n\t// Optional event-type allow-list. Without it, EVERY event posts — typically you\n\t// want to filter to security-relevant events like login failures + MFA failures.\n\tevents?: readonly AuditEventType[];\n\t// Build the Slack message body from the event. Default is one short line; override\n\t// to use Block Kit, attachments, mentions, etc.\n\tformatMessage?: (event: AuditEvent) => string;\n\twebhookUrl: string;\n};\n\nconst defaultFormat = (event: AuditEvent) => {\n\tconst when = new Date(event.at).toISOString();\n\tconst who = event.userId ?? event.ip ?? 'unknown';\n\n\treturn `🔐 *${event.type}* — ${who} at ${when}`;\n};\n\nexport const slackAlertPlugin = ({\n\tevents,\n\tformatMessage = defaultFormat,\n\twebhookUrl\n}: SlackAlertOptions): AuditSink => ({\n\tappend: async (event) => {\n\t\tif (events !== undefined && !events.includes(event.type)) return;\n\t\tawait fetch(webhookUrl, {\n\t\t\tbody: JSON.stringify({ text: formatMessage(event) }),\n\t\t\theaders: { 'content-type': 'application/json' },\n\t\t\tmethod: 'POST'\n\t\t}).catch(() => undefined);\n\t}\n});\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA;AAUA,IAAM,gBAAgB;AAEtB,IAAM,qBAAqB,IAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,IAAM,WAAW,CAAC,UACjB,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,YAAY;AAErD,IAAM,cAAc,OAAO,WAAmB;AAAA,EAC7C,IAAI;AAAA,IACH,QAAQ,MAAM,UAAU,MAAM,GAAG,SAAS;AAAA,IACzC,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAMF,IAAM,oBAAoB,CAChC,OACA,iBACI;AAAA,EACJ,MAAM,SAAS,SAAS,KAAK;AAAA,EAE7B,OACC,mBAAmB,IAAI,MAAM,KAC5B,iBAAiB,aAAa,IAAI,IAAI,YAAY,EAAE,IAAI,MAAM;AAAA;AAM1D,IAAM,8BAA8B,OAC1C,OACA,YACoC;AAAA,EACpC,MAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAAA,EAC5C,IAAI,CAAC,cAAc,KAAK,UAAU,GAAG;AAAA,IACpC,OAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,EAC9C;AAAA,EACA,IAAI,kBAAkB,YAAY,SAAS,iBAAiB,GAAG;AAAA,IAC9D,OAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC1C;AAAA,EACA,IACC,SAAS,YAAY,QACrB,CAAE,MAAM,YAAY,SAAS,UAAU,CAAC,GACvC;AAAA,IACD,OAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ;AAAA,EACrC;AAAA,EAEA,OAAO,EAAE,IAAI,KAAK;AAAA;;;AC5DZ,IAAM,4BAA4B,OACxC,UAC0C;AAAA,EAC1C,MAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AAAA,EACzC,IAAI,MAAM,kBAAkB,OAAO,GAAG;AAAA,IACrC,OAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACnD;AAAA,EAEA,OAAO,EAAE,OAAO,KAAK;AAAA;;ACTtB,IAAM,iBAAiB,CAAC,UAAsB;AAAA,EAC7C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,kBAAO,MAAM,iBAAY,UAAU;AAAA;AAGpC,IAAM,qBAAqB;AAAA,EACjC;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACsC;AAAA,EACtC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AAAA,MACtD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACzBA,IAAM,cAAc,CAAC,YACpB,QAAQ,qBAAqB,YAAY,KACzC,QAAQ,iBAAiB,YAAY;AAS/B,IAAM,iBAAiB,CAAC,YAA6B;AAAA,EAC3D,MAAM,QACL,QAAQ,mBAAmB,YACxB,YACA,IAAI,IAAI,QAAQ,eAAe,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAC1E,MAAM,OACL,QAAQ,kBAAkB,YACvB,YACA,IAAI,IAAI,QAAQ,cAAc,IAAI,CAAC,YAAY,QAAQ,YAAY,CAAC,CAAC;AAAA,EAEzE,OAAO,CAAC,YAAgD;AAAA,IACvD,MAAM,UAAU,YAAY,OAAO;AAAA,IACnC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAClC,IAAI,SAAS;AAAA,MAAW,OAAO,KAAK,IAAI,OAAO;AAAA,IAC/C,IAAI,UAAU;AAAA,MAAW,OAAO,CAAC,MAAM,IAAI,OAAO;AAAA,IAElD,OAAO;AAAA;AAAA;;ACxBT,IAAM,uBAAuB;AAYtB,IAAM,uBAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,SAAS;AAAA,OAC+B;AAAA,EACxC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,sBAAsB;AAAA,MACjC,MAAM,KAAK,UAAU;AAAA,QACpB,cAAc;AAAA,QACd,SAAS;AAAA,UACR,gBAAgB,MAAM,YAAY,CAAC;AAAA,UACnC;AAAA,UACA;AAAA,UACA,SAAS,eAAe,MAAM,cAAc,MAAM,UAAU;AAAA,UAC5D,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,QAC3C;AAAA,QACA,aAAa;AAAA,MACd,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;AC7BA,IAAM,eAAe;AAEd,IAAM,wBAAwB;AAAA,EACpC,OAAO;AAAA,EACP;AAAA,EACA,aAAa,CAAC,WAAW,KAAM,MAAM,YAAY,CAAC,EAAG;AAAA,OACZ;AAAA,EACzC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,MAAM,WAAW;AAAA,MAAW;AAAA,IAChC,MAAM,MAAM,GAAG,iBAAiB;AAAA,MAC/B,MAAM,KAAK,UAAU;AAAA,QACpB,SAAS;AAAA,QACT,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,QACP,YAAY;AAAA,UACX,MAAM,WAAW,KAAK;AAAA,UACtB,WAAW,EAAE,kBAAkB,MAAM,KAAK;AAAA,QAC3C;AAAA,QACA,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,MAC3C,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACvBA,IAAM,gBAAgB,CAAC,UAAsB;AAAA,EAC5C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,iBAAM,MAAM,gBAAW,UAAU;AAAA;AAGlC,IAAM,mBAAmB;AAAA,EAC/B;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACoC;AAAA,EACpC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,KAAK,EAAE,CAAC;AAAA,MACnD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA;AAUA,IAAM,gBAAgB;AAEtB,IAAM,qBAAqB,IAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,IAAM,WAAW,CAAC,UACjB,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,YAAY;AAErD,IAAM,cAAc,OAAO,WAAmB;AAAA,EAC7C,IAAI;AAAA,IACH,QAAQ,MAAM,UAAU,MAAM,GAAG,SAAS;AAAA,IACzC,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAMF,IAAM,oBAAoB,CAChC,OACA,iBACI;AAAA,EACJ,MAAM,SAAS,SAAS,KAAK;AAAA,EAE7B,OACC,mBAAmB,IAAI,MAAM,KAC5B,iBAAiB,aAAa,IAAI,IAAI,YAAY,EAAE,IAAI,MAAM;AAAA;AAM1D,IAAM,8BAA8B,OAC1C,OACA,YACoC;AAAA,EACpC,MAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAAA,EAC5C,IAAI,CAAC,cAAc,KAAK,UAAU,GAAG;AAAA,IACpC,OAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,EAC9C;AAAA,EACA,IAAI,kBAAkB,YAAY,SAAS,iBAAiB,GAAG;AAAA,IAC9D,OAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC1C;AAAA,EACA,IACC,SAAS,YAAY,QACrB,CAAE,MAAM,YAAY,SAAS,UAAU,CAAC,GACvC;AAAA,IACD,OAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ;AAAA,EACrC;AAAA,EAEA,OAAO,EAAE,IAAI,KAAK;AAAA;;;AC5DZ,IAAM,4BAA4B,OACxC,UAC0C;AAAA,EAC1C,MAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AAAA,EACzC,IAAI,MAAM,kBAAkB,OAAO,GAAG;AAAA,IACrC,OAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAAA,EACnD;AAAA,EAEA,OAAO,EAAE,OAAO,KAAK;AAAA;;ACTtB,IAAM,iBAAiB,CAAC,UAAsB;AAAA,EAC7C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,kBAAO,MAAM,iBAAY,UAAU;AAAA;AAGpC,IAAM,qBAAqB;AAAA,EACjC;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACsC;AAAA,EACtC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,SAAS,cAAc,KAAK,EAAE,CAAC;AAAA,MACtD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACzBA,IAAM,cAAc,CAAC,YACpB,QAAQ,qBAAqB,YAAY,KACzC,QAAQ,iBAAiB,YAAY;AAS/B,IAAM,iBAAiB,CAAC,YAA6B;AAAA,EAC3D,MAAM,QACL,QAAQ,mBAAmB,YACxB,YACA,IAAI,IACJ,QAAQ,eAAe,IAAI,CAAC,YAC3B,QAAQ,YAAY,CACrB,CACD;AAAA,EACH,MAAM,OACL,QAAQ,kBAAkB,YACvB,YACA,IAAI,IACJ,QAAQ,cAAc,IAAI,CAAC,YAC1B,QAAQ,YAAY,CACrB,CACD;AAAA,EAEH,OAAO,CAAC,YAAgD;AAAA,IACvD,MAAM,UAAU,YAAY,OAAO;AAAA,IACnC,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAClC,IAAI,SAAS;AAAA,MAAW,OAAO,KAAK,IAAI,OAAO;AAAA,IAC/C,IAAI,UAAU;AAAA,MAAW,OAAO,CAAC,MAAM,IAAI,OAAO;AAAA,IAElD,OAAO;AAAA;AAAA;;AChCT,IAAM,uBAAuB;AAYtB,IAAM,uBAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,SAAS;AAAA,OAC+B;AAAA,EACxC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,sBAAsB;AAAA,MACjC,MAAM,KAAK,UAAU;AAAA,QACpB,cAAc;AAAA,QACd,SAAS;AAAA,UACR,gBAAgB,MAAM,YAAY,CAAC;AAAA,UACnC;AAAA,UACA;AAAA,UACA,SAAS,eAAe,MAAM,cAAc,MAAM,UAAU;AAAA,UAC5D,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,QAC3C;AAAA,QACA,aAAa;AAAA,MACd,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;AC7BA,IAAM,eAAe;AAEd,IAAM,wBAAwB;AAAA,EACpC,OAAO;AAAA,EACP;AAAA,EACA,aAAa,CAAC,WAAW,KAAM,MAAM,YAAY,CAAC,EAAG;AAAA,OACZ;AAAA,EACzC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,MAAM,WAAW;AAAA,MAAW;AAAA,IAChC,MAAM,MAAM,GAAG,iBAAiB;AAAA,MAC/B,MAAM,KAAK,UAAU;AAAA,QACpB,SAAS;AAAA,QACT,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,QACP,YAAY;AAAA,UACX,MAAM,WAAW,KAAK;AAAA,UACtB,WAAW,EAAE,kBAAkB,MAAM,KAAK;AAAA,QAC3C;AAAA,QACA,WAAW,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,MAC3C,CAAC;AAAA,MACD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;;ACvBA,IAAM,gBAAgB,CAAC,UAAsB;AAAA,EAC5C,MAAM,OAAO,IAAI,KAAK,MAAM,EAAE,EAAE,YAAY;AAAA,EAC5C,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM;AAAA,EAExC,OAAO,iBAAM,MAAM,gBAAW,UAAU;AAAA;AAGlC,IAAM,mBAAmB;AAAA,EAC/B;AAAA,EACA,gBAAgB;AAAA,EAChB;AAAA,OACoC;AAAA,EACpC,QAAQ,OAAO,UAAU;AAAA,IACxB,IAAI,WAAW,aAAa,CAAC,OAAO,SAAS,MAAM,IAAI;AAAA,MAAG;AAAA,IAC1D,MAAM,MAAM,YAAY;AAAA,MACvB,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,KAAK,EAAE,CAAC;AAAA,MACnD,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,IACT,CAAC,EAAE,MAAM,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA;AAE1B;",
   "debugId": "A678C9E5494B63D064756E2164756E21",
   "names": []
 }

package/dist/portal/postgresSetupSessionStore.d.ts

@@ -1,4 +1,4 @@
-import { type AnyPgDatabase } from '../stores/postgres';
+import { type AnyPgDatabase, type PgQueryResultHKT } from '../stores/postgres';
 import type { SetupCapability, SetupSessionStore } from './types';
 export declare const setupSessionsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_setup_sessions";
@@ -137,4 +137,4 @@ export declare const setupSessionsTable: import("drizzle-orm/pg-core").PgTableWi
     dialect: "pg";
 }>;
 export declare const createNeonSetupSessionStore: (databaseUrl: string) => SetupSessionStore;
-export declare const createPostgresSetupSessionStore: (db: AnyPgDatabase) => SetupSessionStore;
+export declare const createPostgresSetupSessionStore: <Q extends PgQueryResultHKT>(db: AnyPgDatabase<Q>) => SetupSessionStore;

package/dist/scim/postgresScimTokenStore.d.ts

@@ -1,4 +1,4 @@
-import { type AnyPgDatabase } from '../stores/postgres';
+import { type AnyPgDatabase, type PgQueryResultHKT } from '../stores/postgres';
 import type { ScimTokenStore } from './types';
 export declare const scimTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_scim_tokens";
@@ -99,4 +99,4 @@ export declare const scimTokensTable: import("drizzle-orm/pg-core").PgTableWithC
     dialect: "pg";
 }>;
 export declare const createNeonScimTokenStore: (databaseUrl: string) => ScimTokenStore;
-export declare const createPostgresScimTokenStore: (db: AnyPgDatabase) => ScimTokenStore;
+export declare const createPostgresScimTokenStore: <Q extends PgQueryResultHKT>(db: AnyPgDatabase<Q>) => ScimTokenStore;

package/dist/sso/postgresSsoConnectionStore.d.ts

@@ -1,4 +1,4 @@
-import { type AnyPgDatabase } from '../stores/postgres';
+import { type AnyPgDatabase, type PgQueryResultHKT } from '../stores/postgres';
 import type { OidcConnectionConfig, SamlConnectionConfig, SSOConnectionStore, SSOConnectionType } from './types';
 export declare const ssoConnectionsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_sso_connections";
@@ -136,4 +136,4 @@ export declare const ssoConnectionsTable: import("drizzle-orm/pg-core").PgTableW
     dialect: "pg";
 }>;
 export declare const createNeonSsoConnectionStore: (databaseUrl: string) => SSOConnectionStore;
-export declare const createPostgresSsoConnectionStore: (db: AnyPgDatabase) => SSOConnectionStore;
+export declare const createPostgresSsoConnectionStore: <Q extends PgQueryResultHKT>(db: AnyPgDatabase<Q>) => SSOConnectionStore;

package/dist/stores/postgres.d.ts

@@ -1,5 +1,6 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-export type AnyPgDatabase = PgDatabase<PgQueryResultHKT>;
+export type AnyPgDatabase<Q extends PgQueryResultHKT = PgQueryResultHKT> = PgDatabase<Q>;
+export type { PgQueryResultHKT } from 'drizzle-orm/pg-core';
 export declare const createNeonDatabase: (databaseUrl: string) => import("drizzle-orm/neon-http").NeonHttpDatabase<Record<string, never>> & {
     $client: import("@neondatabase/serverless").NeonQueryFunction<false, false>;
 };

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.45.0",
+	"version": "0.45.1",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -10,7 +10,7 @@
 	"bin": {
 		"absolute-auth": "./dist/cli/migrate.js"
 	},
-	"license": "CC BY-NC 4.0",
+	"license": "BSL-1.1",
 	"author": "Alex Kahn",
 	"scripts": {
 		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts src/providers/index.ts --root src --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && tsc --emitDeclarationOnly --project tsconfig.json && chmod +x dist/cli/migrate.js",