@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/database/migrations/mysql/1784289540000-CamelCaseAttributes.d.ts

@@ -0,0 +1,12 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Plan 073 data migration. Database identifiers remain snake_case; values which
+ * encode management/entity property names move to camelCase. Built-in policy
+ * data is intentionally excluded — the provisioner overwrites it on every boot.
+ */
+export declare class CamelCaseAttributes1784289540000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1784289540000-CamelCaseAttributes.d.ts.map

package/dist/adapters/database/migrations/mysql/1784289540000-CamelCaseAttributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784289540000-CamelCaseAttributes.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1784289540000-CamelCaseAttributes.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAyC/D;;;;GAIG;AACH,qBAAa,gCAAiC,YAAW,kBAAkB;IACvE,IAAI,SAAsC;IAE7B,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAK7D"}

package/dist/adapters/database/migrations/mysql/1784289540000-CamelCaseAttributes.mjs

@@ -0,0 +1,42 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { camelCase, snakeCase } from "change-case";
+//#region src/adapters/database/migrations/mysql/1784289540000-CamelCaseAttributes.ts
+/**
+* Rewrite every distinct property-name key in `valueColumn` through `transform`.
+* These columns hold entity property names set by authup (identity-provider
+* attribute keys / targets, user-attribute names), so a blanket transform is
+* correct. The unique `(owner, value)` index means a rename can collide with an
+* already-migrated row; the source duplicate is removed first to keep the
+* update constraint-safe.
+*/ async function renameKeys(queryRunner, table, ownerColumn, valueColumn, transform) {
+	const rows = await queryRunner.query(`SELECT DISTINCT \`${valueColumn}\` AS \`value\` FROM \`${table}\` WHERE \`${valueColumn}\` IS NOT NULL`);
+	for (const { value } of rows) {
+		const next = transform(value);
+		if (next === value) continue;
+		await queryRunner.query(`DELETE \`source\` FROM \`${table}\` AS \`source\` INNER JOIN \`${table}\` AS \`target\` ON \`source\`.\`${ownerColumn}\` = \`target\`.\`${ownerColumn}\` WHERE \`source\`.\`${valueColumn}\` = ? AND \`target\`.\`${valueColumn}\` = ?`, [value, next]);
+		await queryRunner.query(`UPDATE \`${table}\` SET \`${valueColumn}\` = ? WHERE \`${valueColumn}\` = ?`, [next, value]);
+	}
+}
+/**
+* Plan 073 data migration. Database identifiers remain snake_case; values which
+* encode management/entity property names move to camelCase. Built-in policy
+* data is intentionally excluded — the provisioner overwrites it on every boot.
+*/ var CamelCaseAttributes1784289540000 = class {
+	name = "CamelCaseAttributes1784289540000";
+	async up(queryRunner) {
+		await renameKeys(queryRunner, "auth_identity_provider_attributes", "provider_id", "name", camelCase);
+		await renameKeys(queryRunner, "auth_identity_provider_attribute_mappings", "provider_id", "target_name", camelCase);
+		await renameKeys(queryRunner, "auth_user_attributes", "user_id", "name", camelCase);
+	}
+	async down(queryRunner) {
+		await renameKeys(queryRunner, "auth_user_attributes", "user_id", "name", snakeCase);
+		await renameKeys(queryRunner, "auth_identity_provider_attribute_mappings", "provider_id", "target_name", snakeCase);
+		await renameKeys(queryRunner, "auth_identity_provider_attributes", "provider_id", "name", snakeCase);
+	}
+};
+//#endregion
+export { CamelCaseAttributes1784289540000 };
+
+//# sourceMappingURL=1784289540000-CamelCaseAttributes.mjs.map

package/dist/adapters/database/migrations/mysql/1784289540000-CamelCaseAttributes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784289540000-CamelCaseAttributes.mjs","names":["camelCase","snakeCase","renameKeys","queryRunner","table","ownerColumn","valueColumn","transform","rows","query","value","next","CamelCaseAttributes1784289540000","name","up","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1784289540000-CamelCaseAttributes.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { camelCase, snakeCase } from 'change-case';\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Rewrite every distinct property-name key in `valueColumn` through `transform`.\n * These columns hold entity property names set by authup (identity-provider\n * attribute keys / targets, user-attribute names), so a blanket transform is\n * correct. The unique `(owner, value)` index means a rename can collide with an\n * already-migrated row; the source duplicate is removed first to keep the\n * update constraint-safe.\n */\nasync function renameKeys(\n    queryRunner: QueryRunner,\n    table: string,\n    ownerColumn: string,\n    valueColumn: string,\n    transform: (value: string) => string,\n): Promise<void> {\n    const rows: { value: string }[] = await queryRunner.query(\n        `SELECT DISTINCT \\`${valueColumn}\\` AS \\`value\\` FROM \\`${table}\\` WHERE \\`${valueColumn}\\` IS NOT NULL`,\n    );\n\n    for (const { value } of rows) {\n        const next = transform(value);\n        if (next === value) {\n            continue;\n        }\n\n        await queryRunner.query(\n            `DELETE \\`source\\` FROM \\`${table}\\` AS \\`source\\` ` +\n            `INNER JOIN \\`${table}\\` AS \\`target\\` ON \\`source\\`.\\`${ownerColumn}\\` = \\`target\\`.\\`${ownerColumn}\\` ` +\n            `WHERE \\`source\\`.\\`${valueColumn}\\` = ? AND \\`target\\`.\\`${valueColumn}\\` = ?`,\n            [value, next],\n        );\n\n        await queryRunner.query(\n            `UPDATE \\`${table}\\` SET \\`${valueColumn}\\` = ? WHERE \\`${valueColumn}\\` = ?`,\n            [next, value],\n        );\n    }\n}\n\n/**\n * Plan 073 data migration. Database identifiers remain snake_case; values which\n * encode management/entity property names move to camelCase. Built-in policy\n * data is intentionally excluded — the provisioner overwrites it on every boot.\n */\nexport class CamelCaseAttributes1784289540000 implements MigrationInterface {\n    name = 'CamelCaseAttributes1784289540000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await renameKeys(queryRunner, 'auth_identity_provider_attributes', 'provider_id', 'name', camelCase);\n        await renameKeys(queryRunner, 'auth_identity_provider_attribute_mappings', 'provider_id', 'target_name', camelCase);\n        await renameKeys(queryRunner, 'auth_user_attributes', 'user_id', 'name', camelCase);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await renameKeys(queryRunner, 'auth_user_attributes', 'user_id', 'name', snakeCase);\n        await renameKeys(queryRunner, 'auth_identity_provider_attribute_mappings', 'provider_id', 'target_name', snakeCase);\n        await renameKeys(queryRunner, 'auth_identity_provider_attributes', 'provider_id', 'name', snakeCase);\n    }\n}\n"],"mappings":";;;;;;;;;;;;GAkBA,eAAeE,WACXC,aACAC,OACAC,aACAC,aACAC,WAAoC;CAEpC,MAAMC,OAA4B,MAAML,YAAYM,MAChD,qBAAqBH,YAAY,yBAAyBF,MAAM,aAAaE,YAAY,eAAe;CAG5G,KAAK,MAAM,EAAEI,WAAWF,MAAM;EAC1B,MAAMG,OAAOJ,UAAUG,KAAAA;EACvB,IAAIC,SAASD,OACT;EAGJ,MAAMP,YAAYM,MACd,4BAA4BL,MAAM,gCAClBA,MAAM,mCAAmCC,YAAY,oBAAoBA,YAAY,wBAC/EC,YAAY,0BAA0BA,YAAY,SACxE,CAACI,OAAOC,IAAAA,CAAK;EAGjB,MAAMR,YAAYM,MACd,YAAYL,MAAM,WAAWE,YAAY,iBAAiBA,YAAY,SACtE,CAACK,MAAMD,KAAAA,CAAM;CAErB;AACJ;;;;;GAOA,IAAaE,mCAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGX,aAAyC;EACrD,MAAMD,WAAWC,aAAa,qCAAqC,eAAe,QAAQH,SAAAA;EAC1F,MAAME,WAAWC,aAAa,6CAA6C,eAAe,eAAeH,SAAAA;EACzG,MAAME,WAAWC,aAAa,wBAAwB,WAAW,QAAQH,SAAAA;CAC7E;CAEA,MAAae,KAAKZ,aAAyC;EACvD,MAAMD,WAAWC,aAAa,wBAAwB,WAAW,QAAQF,SAAAA;EACzE,MAAMC,WAAWC,aAAa,6CAA6C,eAAe,eAAeF,SAAAA;EACzG,MAAMC,WAAWC,aAAa,qCAAqC,eAAe,QAAQF,SAAAA;CAC9F;AACJ"}

package/dist/adapters/database/migrations/mysql/1784460916000-RemoveRobots.d.ts

@@ -0,0 +1,18 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Drops the robot entity: auth_robots, auth_robot_roles,
+ * auth_robot_permissions, auth_sessions.robot_id and the dangling robot
+ * FKs on the legacy auth_refresh_tokens / auth_authorization_codes
+ * tables. Robots are superseded by clients (client_credentials grant);
+ * robot rows and their role/permission bindings are NOT migrated onto
+ * clients — recreate machine identities as clients by hand.
+ *
+ * down() recreates the pre-removal schema shape, constraint names
+ * included, so the older migrations' down() paths keep working.
+ */
+export declare class RemoveRobots1784460916000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1784460916000-RemoveRobots.d.ts.map

package/dist/adapters/database/migrations/mysql/1784460916000-RemoveRobots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784460916000-RemoveRobots.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1784460916000-RemoveRobots.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAChE,IAAI,SAA+B;IAEtB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAqH7D"}

package/dist/adapters/database/migrations/mysql/1784460916000-RemoveRobots.mjs

@@ -0,0 +1,161 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1784460916000-RemoveRobots.ts
+/**
+* Drops the robot entity: auth_robots, auth_robot_roles,
+* auth_robot_permissions, auth_sessions.robot_id and the dangling robot
+* FKs on the legacy auth_refresh_tokens / auth_authorization_codes
+* tables. Robots are superseded by clients (client_credentials grant);
+* robot rows and their role/permission bindings are NOT migrated onto
+* clients — recreate machine identities as clients by hand.
+*
+* down() recreates the pre-removal schema shape, constraint names
+* included, so the older migrations' down() paths keep working.
+*/ var RemoveRobots1784460916000 = class {
+	name = "RemoveRobots1784460916000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP FOREIGN KEY \`FK_46b30e5d8e5d5de58d454f53f8c\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`robot_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_refresh_tokens\` DROP FOREIGN KEY \`FK_6be38b6dbd4ce86ca3d17494ca9\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_authorization_codes\` DROP FOREIGN KEY \`FK_32619f36922f433e27affc169e4\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_robot_permissions\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_robot_roles\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_robots\`
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE \`auth_robots\` (
+                \`id\` varchar(36) NOT NULL,
+                \`secret\` varchar(256) NOT NULL,
+                \`name\` varchar(128) NOT NULL,
+                \`description\` text NULL,
+                \`active\` tinyint NOT NULL DEFAULT 1,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`user_id\` varchar(255) NULL,
+                \`realm_id\` varchar(255) NOT NULL,
+                \`display_name\` varchar(256) NULL,
+                \`client_id\` varchar(255) NULL,
+                INDEX \`IDX_9c99802f3f360718344180c3f6\` (\`realm_id\`),
+                UNIQUE INDEX \`IDX_f89cc2abf1d7e284a7d6cd59c1\` (\`name\`, \`realm_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            CREATE INDEX \`IDX_91942a5962da3b91175eeaa2db\` ON \`auth_robots\` (\`client_id\`)
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_robot_roles\` (
+                \`id\` varchar(36) NOT NULL,
+                \`role_id\` varchar(255) NOT NULL,
+                \`role_realm_id\` varchar(255) NULL,
+                \`robot_id\` varchar(255) NOT NULL,
+                \`robot_realm_id\` varchar(255) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`client_id\` varchar(36) NULL,
+                UNIQUE INDEX \`IDX_515b3dc84ba9bec42bd0e92cbd\` (\`role_id\`, \`robot_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_robot_permissions\` (
+                \`id\` varchar(36) NOT NULL,
+                \`robot_id\` varchar(255) NOT NULL,
+                \`robot_realm_id\` varchar(255) NULL,
+                \`permission_id\` varchar(255) NOT NULL,
+                \`permission_realm_id\` varchar(255) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`policy_id\` varchar(255) NULL,
+                \`realm_scope\` varchar(50) NOT NULL DEFAULT 'own',
+                UNIQUE INDEX \`IDX_0c2284272043ed8aba6689306b\` (\`permission_id\`, \`robot_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robots\`
+            ADD CONSTRAINT \`FK_b6d73e3026e15c0af6c41ef8139\` FOREIGN KEY (\`user_id\`) REFERENCES \`auth_users\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robots\`
+            ADD CONSTRAINT \`FK_9c99802f3f360718344180c3f68\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robots\`
+            ADD CONSTRAINT \`FK_91942a5962da3b91175eeaa2db1\` FOREIGN KEY (\`client_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_roles\`
+            ADD CONSTRAINT \`FK_2256b04cbdb1e16e5144e14750b\` FOREIGN KEY (\`role_id\`) REFERENCES \`auth_roles\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_roles\`
+            ADD CONSTRAINT \`FK_28146c7babddcad18116dabfa9e\` FOREIGN KEY (\`role_realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_roles\`
+            ADD CONSTRAINT \`FK_a4904e9c921294c80f75a0c3e02\` FOREIGN KEY (\`client_id\`) REFERENCES \`auth_robots\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_roles\`
+            ADD CONSTRAINT \`FK_21994ec834c710276cce38c779d\` FOREIGN KEY (\`robot_realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_permissions\`
+            ADD CONSTRAINT \`FK_5af2884572a617e2532410f8221\` FOREIGN KEY (\`robot_id\`) REFERENCES \`auth_robots\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_permissions\`
+            ADD CONSTRAINT \`FK_d52ab826ee04e008624df74cdc8\` FOREIGN KEY (\`robot_realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_permissions\`
+            ADD CONSTRAINT \`FK_b29fe901137f6944ecaf98fcb5a\` FOREIGN KEY (\`permission_id\`) REFERENCES \`auth_permissions\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_permissions\`
+            ADD CONSTRAINT \`FK_1cacb8af1791a5303d30cbf8590\` FOREIGN KEY (\`permission_realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_robot_permissions\`
+            ADD CONSTRAINT \`FK_0786e0bee54b581c62d79a8cec7\` FOREIGN KEY (\`policy_id\`) REFERENCES \`auth_policies\`(\`id\`) ON DELETE
+            SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\`
+            ADD \`robot_id\` varchar(255) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\`
+            ADD CONSTRAINT \`FK_46b30e5d8e5d5de58d454f53f8c\` FOREIGN KEY (\`robot_id\`) REFERENCES \`auth_robots\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_refresh_tokens\`
+            ADD CONSTRAINT \`FK_6be38b6dbd4ce86ca3d17494ca9\` FOREIGN KEY (\`robot_id\`) REFERENCES \`auth_robots\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_authorization_codes\`
+            ADD CONSTRAINT \`FK_32619f36922f433e27affc169e4\` FOREIGN KEY (\`robot_id\`) REFERENCES \`auth_robots\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+	}
+};
+//#endregion
+export { RemoveRobots1784460916000 };
+
+//# sourceMappingURL=1784460916000-RemoveRobots.mjs.map

package/dist/adapters/database/migrations/mysql/1784460916000-RemoveRobots.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1784460916000-RemoveRobots.mjs","names":["RemoveRobots1784460916000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1784460916000-RemoveRobots.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Drops the robot entity: auth_robots, auth_robot_roles,\n * auth_robot_permissions, auth_sessions.robot_id and the dangling robot\n * FKs on the legacy auth_refresh_tokens / auth_authorization_codes\n * tables. Robots are superseded by clients (client_credentials grant);\n * robot rows and their role/permission bindings are NOT migrated onto\n * clients — recreate machine identities as clients by hand.\n *\n * down() recreates the pre-removal schema shape, constraint names\n * included, so the older migrations' down() paths keep working.\n */\nexport class RemoveRobots1784460916000 implements MigrationInterface {\n    name = 'RemoveRobots1784460916000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP FOREIGN KEY \\`FK_46b30e5d8e5d5de58d454f53f8c\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`robot_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_refresh_tokens\\` DROP FOREIGN KEY \\`FK_6be38b6dbd4ce86ca3d17494ca9\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_authorization_codes\\` DROP FOREIGN KEY \\`FK_32619f36922f433e27affc169e4\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_robot_permissions\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_robot_roles\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_robots\\`\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_robots\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`secret\\` varchar(256) NOT NULL,\n                \\`name\\` varchar(128) NOT NULL,\n                \\`description\\` text NULL,\n                \\`active\\` tinyint NOT NULL DEFAULT 1,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`user_id\\` varchar(255) NULL,\n                \\`realm_id\\` varchar(255) NOT NULL,\n                \\`display_name\\` varchar(256) NULL,\n                \\`client_id\\` varchar(255) NULL,\n                INDEX \\`IDX_9c99802f3f360718344180c3f6\\` (\\`realm_id\\`),\n                UNIQUE INDEX \\`IDX_f89cc2abf1d7e284a7d6cd59c1\\` (\\`name\\`, \\`realm_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n        await queryRunner.query(`\n            CREATE INDEX \\`IDX_91942a5962da3b91175eeaa2db\\` ON \\`auth_robots\\` (\\`client_id\\`)\n        `);\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_robot_roles\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`role_id\\` varchar(255) NOT NULL,\n                \\`role_realm_id\\` varchar(255) NULL,\n                \\`robot_id\\` varchar(255) NOT NULL,\n                \\`robot_realm_id\\` varchar(255) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`client_id\\` varchar(36) NULL,\n                UNIQUE INDEX \\`IDX_515b3dc84ba9bec42bd0e92cbd\\` (\\`role_id\\`, \\`robot_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_robot_permissions\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`robot_id\\` varchar(255) NOT NULL,\n                \\`robot_realm_id\\` varchar(255) NULL,\n                \\`permission_id\\` varchar(255) NOT NULL,\n                \\`permission_realm_id\\` varchar(255) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`policy_id\\` varchar(255) NULL,\n                \\`realm_scope\\` varchar(50) NOT NULL DEFAULT 'own',\n                UNIQUE INDEX \\`IDX_0c2284272043ed8aba6689306b\\` (\\`permission_id\\`, \\`robot_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robots\\`\n            ADD CONSTRAINT \\`FK_b6d73e3026e15c0af6c41ef8139\\` FOREIGN KEY (\\`user_id\\`) REFERENCES \\`auth_users\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robots\\`\n            ADD CONSTRAINT \\`FK_9c99802f3f360718344180c3f68\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robots\\`\n            ADD CONSTRAINT \\`FK_91942a5962da3b91175eeaa2db1\\` FOREIGN KEY (\\`client_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_roles\\`\n            ADD CONSTRAINT \\`FK_2256b04cbdb1e16e5144e14750b\\` FOREIGN KEY (\\`role_id\\`) REFERENCES \\`auth_roles\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_roles\\`\n            ADD CONSTRAINT \\`FK_28146c7babddcad18116dabfa9e\\` FOREIGN KEY (\\`role_realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_roles\\`\n            ADD CONSTRAINT \\`FK_a4904e9c921294c80f75a0c3e02\\` FOREIGN KEY (\\`client_id\\`) REFERENCES \\`auth_robots\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_roles\\`\n            ADD CONSTRAINT \\`FK_21994ec834c710276cce38c779d\\` FOREIGN KEY (\\`robot_realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_permissions\\`\n            ADD CONSTRAINT \\`FK_5af2884572a617e2532410f8221\\` FOREIGN KEY (\\`robot_id\\`) REFERENCES \\`auth_robots\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_permissions\\`\n            ADD CONSTRAINT \\`FK_d52ab826ee04e008624df74cdc8\\` FOREIGN KEY (\\`robot_realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_permissions\\`\n            ADD CONSTRAINT \\`FK_b29fe901137f6944ecaf98fcb5a\\` FOREIGN KEY (\\`permission_id\\`) REFERENCES \\`auth_permissions\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_permissions\\`\n            ADD CONSTRAINT \\`FK_1cacb8af1791a5303d30cbf8590\\` FOREIGN KEY (\\`permission_realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_robot_permissions\\`\n            ADD CONSTRAINT \\`FK_0786e0bee54b581c62d79a8cec7\\` FOREIGN KEY (\\`policy_id\\`) REFERENCES \\`auth_policies\\`(\\`id\\`) ON DELETE\n            SET NULL ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\`\n            ADD \\`robot_id\\` varchar(255) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\`\n            ADD CONSTRAINT \\`FK_46b30e5d8e5d5de58d454f53f8c\\` FOREIGN KEY (\\`robot_id\\`) REFERENCES \\`auth_robots\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_refresh_tokens\\`\n            ADD CONSTRAINT \\`FK_6be38b6dbd4ce86ca3d17494ca9\\` FOREIGN KEY (\\`robot_id\\`) REFERENCES \\`auth_robots\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_authorization_codes\\`\n            ADD CONSTRAINT \\`FK_32619f36922f433e27affc169e4\\` FOREIGN KEY (\\`robot_id\\`) REFERENCES \\`auth_robots\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;GAoBA,IAAaA,4BAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;;SAiBvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;SAavB;EACD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;SAcvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;;SAIvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;CACL;AACJ"}

package/dist/adapters/database/migrations/postgres/1783769340000-Default.d.ts

@@ -0,0 +1,50 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Security event log (plan 057), MFA — authenticator devices (plan 049) +
+ * auth-method claims (plan 050), application access policy (plan 052) +
+ * persisted consent (plan 055), realm key store (plans 069 + 071) and
+ * RFC 8705 client authentication (plan 072).
+ *
+ * - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+ *   by design: a row must survive deletion of the realm/actor/client it
+ *   references. Retention is per-row (`expires_at`, stamped at write from
+ *   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+ *   event-cleaner component (plan 057).
+ * - Adds auth_user_authenticators: polymorphic second-factor device rows
+ *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+ *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+ *   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+ * - Adds auth_sessions.mfa_at: instant the subject last passed a
+ *   second-factor challenge for the session (plan 049).
+ * - Adds auth_sessions.auth_method: how the subject authenticated
+ *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+ * - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+ *   (ON DELETE SET NULL) — the policy that must pass for an identity to
+ *   authorize against the client (null = default-allow; plan 052).
+ * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+ *   a subject has approved at POST /authorize. Union/keep (missing tokens
+ *   only, never deleted on re-approval); built_in clients keep zero rows;
+ *   expires_at is dormant (always null in Stage 1) but honored by the
+ *   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+ *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+ *   plan 055).
+ * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+ *   generalizes auth_keys into the per-realm key store. enc rows hold the
+ *   realm's auto-generated symmetric at-rest encryption key (oct) that the
+ *   MFA seed cipher rides; existing rows default to sig (plan 069).
+ * - Adds auth_keys.name (canonical identifier, backfilled from id),
+ *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+ *   auth_keys.certificate (PEM chain, Stage B) — key management API
+ *   (plan 071 Stage A).
+ * - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+ *   RFC 8705 PKI client authentication (plan 071 Stage C).
+ * - Replaces auth_clients.is_confidential with auth_method
+ *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+ *   client authentication and sender-constrained tokens (plan 072).
+ */
+export declare class Default1783769340000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1783769340000-Default.d.ts.map

package/dist/adapters/database/migrations/postgres/1783769340000-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1783769340000-Default.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA0L3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CA2G7D"}

package/dist/adapters/database/migrations/postgres/1783769340000-Default.mjs

@@ -0,0 +1,310 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1783769340000-Default.ts
+/**
+* Security event log (plan 057), MFA — authenticator devices (plan 049) +
+* auth-method claims (plan 050), application access policy (plan 052) +
+* persisted consent (plan 055), realm key store (plans 069 + 071) and
+* RFC 8705 client authentication (plan 072).
+*
+* - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+*   by design: a row must survive deletion of the realm/actor/client it
+*   references. Retention is per-row (`expires_at`, stamped at write from
+*   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+*   event-cleaner component (plan 057).
+* - Adds auth_user_authenticators: polymorphic second-factor device rows
+*   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+*   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+*   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+* - Adds auth_sessions.mfa_at: instant the subject last passed a
+*   second-factor challenge for the session (plan 049).
+* - Adds auth_sessions.auth_method: how the subject authenticated
+*   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+* - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+*   (ON DELETE SET NULL) — the policy that must pass for an identity to
+*   authorize against the client (null = default-allow; plan 052).
+* - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+*   a subject has approved at POST /authorize. Union/keep (missing tokens
+*   only, never deleted on re-approval); built_in clients keep zero rows;
+*   expires_at is dormant (always null in Stage 1) but honored by the
+*   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+*   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+*   plan 055).
+* - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+*   generalizes auth_keys into the per-realm key store. enc rows hold the
+*   realm's auto-generated symmetric at-rest encryption key (oct) that the
+*   MFA seed cipher rides; existing rows default to sig (plan 069).
+* - Adds auth_keys.name (canonical identifier, backfilled from id),
+*   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+*   auth_keys.certificate (PEM chain, Stage B) — key management API
+*   (plan 071 Stage A).
+* - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+*   RFC 8705 PKI client authentication (plan 071 Stage C).
+* - Replaces auth_clients.is_confidential with auth_method
+*   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+*   client authentication and sender-constrained tokens (plan 072).
+*/ var Default1783769340000 = class {
+	name = "Default1783769340000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE "auth_events" (
+                "id" uuid NOT NULL,
+                "scope" character varying(64) NOT NULL,
+                "name" character varying(64) NOT NULL,
+                "ref_type" character varying(64),
+                "ref_id" character varying(64),
+                "client_id" uuid,
+                "actor_type" character varying(16),
+                "actor_id" uuid,
+                "actor_name" character varying(128),
+                "request_path" character varying(256),
+                "request_method" character varying(10),
+                "request_ip_address" character varying(45),
+                "request_user_agent" character varying(512),
+                "realm_id" uuid,
+                "data" text,
+                "expiring" boolean NOT NULL DEFAULT false,
+                "expires_at" character varying(28),
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                CONSTRAINT "PK_auth_events" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_name_scope\" ON \"auth_events\" (\"name\", \"scope\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_ref_type_ref_id\" ON \"auth_events\" (\"ref_type\", \"ref_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_client_id\" ON \"auth_events\" (\"client_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_actor_id\" ON \"auth_events\" (\"actor_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_actor_name\" ON \"auth_events\" (\"actor_name\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_request_ip_address\" ON \"auth_events\" (\"request_ip_address\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_realm_id\" ON \"auth_events\" (\"realm_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_expiring\" ON \"auth_events\" (\"expiring\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_expires_at\" ON \"auth_events\" (\"expires_at\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_events_created_at\" ON \"auth_events\" (\"created_at\")");
+		await queryRunner.query(`
+            CREATE TABLE "auth_user_authenticators" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "kind" character varying(16) NOT NULL,
+                "name" character varying(128),
+                "secret" text,
+                "parameters" text,
+                "codes" text,
+                "confirmed" boolean NOT NULL DEFAULT false,
+                "last_used_at" character varying(28),
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "user_id" uuid NOT NULL,
+                "realm_id" uuid NOT NULL,
+                CONSTRAINT "PK_auth_user_authenticators" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_user_authenticators_kind\" ON \"auth_user_authenticators\" (\"kind\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_user_authenticators_user_id\" ON \"auth_user_authenticators\" (\"user_id\")");
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators"
+            ADD CONSTRAINT "FK_auth_user_authenticators_user_id" FOREIGN KEY ("user_id") REFERENCES "auth_users"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators"
+            ADD CONSTRAINT "FK_auth_user_authenticators_realm_id" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" ADD "mfa_at" character varying(28)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" ADD "auth_method" character varying(16)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "access_policy_id" uuid
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients"
+            ADD CONSTRAINT "FK_auth_clients_access_policy_id" FOREIGN KEY ("access_policy_id") REFERENCES "auth_policies"("id") ON DELETE SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_consents" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "sub" character varying(64) NOT NULL,
+                "sub_kind" character varying(64) NOT NULL,
+                "scope" character varying(128) NOT NULL,
+                "expires_at" character varying(28),
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "client_id" uuid NOT NULL,
+                "realm_id" uuid NOT NULL,
+                "user_id" uuid,
+                CONSTRAINT "UQ_auth_consents_subject_scope" UNIQUE ("client_id", "sub", "sub_kind", "scope"),
+                CONSTRAINT "PK_auth_consents" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_sub\" ON \"auth_consents\" (\"sub\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_client_id\" ON \"auth_consents\" (\"client_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_realm_id\" ON \"auth_consents\" (\"realm_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_consents_user_id\" ON \"auth_consents\" (\"user_id\")");
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents"
+            ADD CONSTRAINT "FK_auth_consents_client_id" FOREIGN KEY ("client_id") REFERENCES "auth_clients"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents"
+            ADD CONSTRAINT "FK_auth_consents_realm_id" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents"
+            ADD CONSTRAINT "FK_auth_consents_user_id" FOREIGN KEY ("user_id") REFERENCES "auth_users"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "use" character varying(64) NOT NULL DEFAULT 'sig'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "name" character varying(128)
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_keys" SET "name" = "id"::text
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "name" SET NOT NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys"
+            ADD CONSTRAINT "UQ_auth_keys_name_realm_id" UNIQUE ("name", "realm_id")
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "status" character varying(64) NOT NULL DEFAULT 'active'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ADD "certificate" text
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "decryption_key" TYPE text
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "encryption_key" TYPE text
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_trust_anchors" (
+                "id" uuid NOT NULL DEFAULT uuid_generate_v4(),
+                "name" character varying(128) NOT NULL,
+                "certificate" text NOT NULL,
+                "enabled" boolean NOT NULL DEFAULT true,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "updated_at" TIMESTAMP NOT NULL DEFAULT now(),
+                "realm_id" uuid NOT NULL,
+                CONSTRAINT "UQ_auth_trust_anchors_name_realm_id" UNIQUE ("name", "realm_id"),
+                CONSTRAINT "PK_auth_trust_anchors" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_trust_anchors_realm_id\" ON \"auth_trust_anchors\" (\"realm_id\")");
+		await queryRunner.query(`
+            ALTER TABLE "auth_trust_anchors"
+            ADD CONSTRAINT "FK_auth_trust_anchors_realm_id" FOREIGN KEY ("realm_id") REFERENCES "auth_realms"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "auth_method" character varying(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_clients" SET "auth_method" = 'secret' WHERE "is_confidential" = true
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "token_binding_method" character varying(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "is_confidential"
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "is_confidential" boolean NOT NULL DEFAULT false
+        `);
+		await queryRunner.query(`
+            UPDATE "auth_clients" SET "is_confidential" = true WHERE "auth_method" <> 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "token_binding_method"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "auth_method"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_trust_anchors" DROP CONSTRAINT "FK_auth_trust_anchors_realm_id"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_trust_anchors_realm_id\"");
+		await queryRunner.query(`
+            DROP TABLE "auth_trust_anchors"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "encryption_key" TYPE character varying(4096)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" ALTER COLUMN "decryption_key" TYPE character varying(4096)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "certificate"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "status"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP CONSTRAINT "UQ_auth_keys_name_realm_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "name"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_keys" DROP COLUMN "use"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents" DROP CONSTRAINT "FK_auth_consents_user_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents" DROP CONSTRAINT "FK_auth_consents_realm_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_consents" DROP CONSTRAINT "FK_auth_consents_client_id"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_user_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_realm_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_client_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_consents_sub\"");
+		await queryRunner.query(`
+            DROP TABLE "auth_consents"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP CONSTRAINT "FK_auth_clients_access_policy_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "access_policy_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP COLUMN "auth_method"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" DROP COLUMN "mfa_at"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators" DROP CONSTRAINT "FK_auth_user_authenticators_realm_id"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_user_authenticators" DROP CONSTRAINT "FK_auth_user_authenticators_user_id"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_user_authenticators_user_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_user_authenticators_kind\"");
+		await queryRunner.query(`
+            DROP TABLE "auth_user_authenticators"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_created_at\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_expires_at\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_expiring\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_realm_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_request_ip_address\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_actor_name\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_actor_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_client_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_ref_type_ref_id\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_events_name_scope\"");
+		await queryRunner.query("DROP TABLE \"auth_events\"");
+	}
+};
+//#endregion
+export { Default1783769340000 };
+
+//# sourceMappingURL=1783769340000-Default.mjs.map