@authhero/kysely-adapter 11.20.0 → 11.21.0

package/dist/types/migrate/migrations/2026-04-29T10:00:00_hooks_metadata.d.ts

@@ -1,13 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Adds `metadata` to `hooks` — a JSON-serialised property bag with two
- * well-known keys:
- *
- *   - `inheritable: true` — control-plane sync surfaces the hook to sub-tenants
- *   - template options, e.g. `copy_user_metadata: true` for `account-linking`
- *
- * Everything else is opaque.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-05T10:00:00_refresh_tokens_rotation.d.ts

@@ -1,22 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Adds the columns needed for Auth0-style refresh-token rotation and at-rest
- * hashing. All columns are nullable so legacy (pre-rotation) rows continue to
- * resolve via the `id`-only lookup path during the back-compat window.
- *
- *   - `token_lookup`: plaintext lookup slice extracted from the wire token
- *     (`rt_<lookup>.<secret>`); indexed for the refresh-grant path.
- *   - `token_hash`: SHA-256 hex of the secret part of the wire token.
- *   - `family_id`: root token id of a rotation chain. Used to revoke an
- *     entire family on reuse detection or admin revocation.
- *   - `rotated_to`: most recently issued child id (debug/traceability).
- *   - `rotated_at_ts`: time of the *first* rotation; anchors the leeway
- *     window so siblings minted within it don't extend exposure.
- *
- * Each addColumn / dropColumn is its own ALTER TABLE statement because
- * SQLite (and some MySQL configurations) don't accept multiple ADD COLUMN
- * clauses in a single ALTER TABLE.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-05T20:00:00_organization_connections.d.ts

@@ -1,10 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Junction table linking organizations to tenant-level connections, mirroring
- * Auth0's `/api/v2/organizations/{id}/enabled_connections`. Uniqueness is on
- * (tenant_id, organization_id, connection_id) — a connection can be enabled
- * once per org, with per-org policy flags.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-06T10:00:00_log_streams.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-06T11:00:00_tenants_attack_protection.d.ts

@@ -1,10 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Adds a nullable JSON column on `tenants` that stores Auth0's
- * /api/v2/attack-protection sub-resources (breached_password_detection,
- * brute_force_protection, suspicious_ip_throttling). Singleton per tenant —
- * no separate table.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-06T12:00:00_tenants_default_client_id.d.ts

@@ -1,12 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Adds a nullable `default_client_id` on `tenants`. Used as the anchor client
- * for tenant-level flows that aren't tied to a specific application — most
- * notably `/connect/start` DCR consent. Roughly analogous to Auth0's Default
- * App / Global Client. No FK: callers tolerate a stale id by falling back to
- * the first available client, which keeps a brand-new tenant with zero
- * clients able to bootstrap its first integration via DCR.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-09T00:00:00_email_templates.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-10T10:00:00_create_action_versions.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-11T10:00:00_branding_dark_mode.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-12T10:00:00_create_action_executions.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-12T11:00:00_client_disable_sign_ups.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-13T10:00:00_move_disable_signup_to_connection.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-13T11:00:00_actions_is_system_inherit.d.ts

@@ -1,16 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Add `is_system` and `inherit` flags to `actions`.
- *
- *   - `is_system = 1` marks an action on the control-plane tenant as a
- *     shared template that other tenants can opt into.
- *   - `inherit = 1` on a non-control-plane tenant's action row turns it
- *     into a stub: at execute time the code-hook loader reads `code` from
- *     the control-plane system action whose `name` matches this row's
- *     `name`. Local `secrets` still apply on top (local-first then
- *     upstream-fallback) so customers can configure per-tenant credentials
- *     without forking the code.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-13T12:00:00_collapse_auth0_source_into_db_connection.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(): Promise<void>;

package/dist/types/migrate/migrations/2026-05-14T10:00:00_migration_sources.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-26T00:00:00_create_proxy_routes.d.ts

@@ -1,3 +0,0 @@
-import { Kysely } from "kysely";
-export declare function up(db: Kysely<unknown>): Promise<void>;
-export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/types/migrate/migrations/2026-05-28T00:00:00_proxy_routes_v2.d.ts

@@ -1,3 +0,0 @@
-import { Kysely } from "kysely";
-export declare function up(db: Kysely<unknown>): Promise<void>;
-export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/types/migrate/migrations/2026-06-04T10:00:00_widen_user_permissions_resource_server_identifier.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-06-04T11:00:00_create_grants.d.ts

@@ -1,3 +0,0 @@
-import { Kysely } from "kysely";
-export declare function up(db: Kysely<unknown>): Promise<void>;
-export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/types/migrate/migrations/2026-06-04T11:01:00_default_first_party_true.d.ts

@@ -1,3 +0,0 @@
-import { Kysely } from "kysely";
-export declare function up(db: Kysely<unknown>): Promise<void>;
-export declare function down(_db: Kysely<unknown>): Promise<void>;

package/dist/types/migrate/migrations/2026-06-06T12:00:00_tenant_deployment_fields.d.ts

@@ -1,11 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Adds tenant-level provisioning / deployment metadata so a tenant row can
- * describe whether it runs on the shared authhero deployment or as its own
- * worker in a Cloudflare dispatch namespace, and what bundle / storage
- * backing it uses. `deployment_type` and `provisioning_state` get DB
- * defaults so existing rows land as `shared` / `ready` with no app change.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-06-27T12:00:00_tenant_database_version.d.ts

@@ -1,11 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Adds `database_version` to the tenant row so the control plane can record the
- * schema version (the latest migration applied) the deployed WFP tenant worker
- * targets. Together with `worker_version` and `bundle_configuration` this lets
- * the control plane detect drift and drive upgrades. Nullable — shared tenants
- * and pre-existing WFP tenants land as `null` until their next (re)provision.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-06-30T12:00:00_user_activity_and_user_column_cleanup.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-07-02T12:00:00_drop_user_activity_columns_from_users.d.ts

@@ -1,14 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-/**
- * Contract phase of the user_activity split (issue #1003): the counters were
- * backfilled into `user_activity` and all reads/writes have been cut over, so
- * the legacy `users` columns can go. Requires the backfill script to have run
- * against the environment first — dropping the columns discards any values
- * that were never copied.
- *
- * Plain DROP COLUMN works on both dialects (SQLite ≥3.35 / D1 / MySQL); none
- * of these columns are indexed.
- */
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/2026-07-04T12:00:00_tenant_operations.d.ts

@@ -1,9 +0,0 @@
-import { Kysely } from "kysely";
-/**
- * Durable tenant lifecycle operations with append-only history, plus fleet
- * rollouts (issue #1026). `tenant_operations` intentionally has no FK to
- * `tenants`: the log must survive tenant deletion and `tenant_id` is NULL
- * for fleet-level operations.
- */
-export declare function up(db: Kysely<unknown>): Promise<void>;
-export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/types/migrate/migrations/2026-07-16T10:00:00_control_plane_comm_keys.d.ts

@@ -1,28 +0,0 @@
-import { Kysely } from "kysely";
-/**
- * Registry of per-tenant control-plane-communication PUBLIC keys (issue #1139).
- *
- * Each WFP tenant shard is provisioned a dedicated keypair: the private half
- * becomes the shard's `CONTROL_PLANE_COMM_KEY` secret and signs only its
- * write-through calls (custom domains, tenant members) — never the tenant's
- * user tokens. The public half lives here so the control plane's verifier
- * resolves it locally, with no reach back to the shard.
- *
- * A table rather than KV: the control plane must verify a shard's token
- * immediately after provisioning, and an eventually-consistent store yields
- * transient `unknown kid` failures inside the propagation window.
- *
- * `kid` is the primary key — verification resolves a key by `kid` and rotation
- * mints a new one, so several live rows per tenant are expected (a token signed
- * with the prior key must still verify during a swap).
- *
- * No FK to `tenants`, for the same reason as `tenant_operations`: cleanup is a
- * deprovision concern, and an orphaned public key is inert — it can only verify
- * a token whose private half nothing holds.
- *
- * `public_jwk` holds the full JWK JSON including `kid` + `alg`
- * (`crypto.subtle.exportKey("jwk")` omits both, so the producer must stamp
- * them; the verifier matches on `kid` and rejects on `alg` mismatch).
- */
-export declare function up(db: Kysely<unknown>): Promise<void>;
-export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/types/migrate/migrations/2026-07-16T12:00:00_codes_expires_at_ts.d.ts

@@ -1,4 +0,0 @@
-import { Kysely } from "kysely";
-import { Database } from "../../src/db";
-export declare function up(db: Kysely<Database>): Promise<void>;
-export declare function down(db: Kysely<Database>): Promise<void>;