@celsoft/platform 0.3.0 → 0.5.0

package/dist/schema.js

@@ -0,0 +1,129 @@
+import { sql } from "drizzle-orm";
+import { boolean, index, integer, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+// Better Auth's tables, with its core, admin and organization fields, transcribed from
+// getAuthTables() in the installed version; schema.test.ts fails when they drift apart.
+// Property keys stay camelCase because the Drizzle adapter matches Better Auth's field names
+// against them; column names are snake_case like the rest of an app's tables.
+// Every id is a UUIDv7 filled by Postgres 18, so ids sort by creation time and are never
+// supplied by code. An id is not a secret: anything unguessable gets its own token.
+export const id = () => uuid("id").primaryKey().default(sql `uuidv7()`);
+export const timestamps = () => ({
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});
+export const user = pgTable("user", {
+    id: id(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").notNull().default(false),
+    image: text("image"),
+    role: text("role"),
+    banned: boolean("banned").default(false),
+    banReason: text("ban_reason"),
+    banExpires: timestamp("ban_expires", { withTimezone: true }),
+    ...timestamps(),
+});
+export const session = pgTable("session", {
+    id: id(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    token: text("token").notNull().unique(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: uuid("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    impersonatedBy: uuid("impersonated_by"),
+    activeOrganizationId: uuid("active_organization_id"),
+    activeTeamId: uuid("active_team_id"),
+    ...timestamps(),
+}, (t) => [index("session_user_id_idx").on(t.userId)]);
+export const account = pgTable("account", {
+    id: id(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: uuid("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at", { withTimezone: true }),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at", { withTimezone: true }),
+    scope: text("scope"),
+    password: text("password"),
+    ...timestamps(),
+}, (t) => [index("account_user_id_idx").on(t.userId)]);
+export const verification = pgTable("verification", {
+    id: id(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    ...timestamps(),
+}, (t) => [index("verification_identifier_idx").on(t.identifier)]);
+// Organization tables exist whenever auth is on, so turning organizations off and on again
+// only hides and restores routes; no migration ever drops their data.
+export const organization = pgTable("organization", {
+    id: id(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull().unique(),
+    logo: text("logo"),
+    metadata: text("metadata"),
+    ...timestamps(),
+});
+export const member = pgTable("member", {
+    id: id(),
+    organizationId: uuid("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    userId: uuid("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    role: text("role").notNull().default("member"),
+    ...timestamps(),
+}, (t) => [index("member_organization_id_idx").on(t.organizationId), index("member_user_id_idx").on(t.userId)]);
+export const invitation = pgTable("invitation", {
+    id: id(),
+    organizationId: uuid("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    role: text("role"),
+    teamId: uuid("team_id"),
+    status: text("status").notNull().default("pending"),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    inviterId: uuid("inviter_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    ...timestamps(),
+}, (t) => [index("invitation_organization_id_idx").on(t.organizationId), index("invitation_email_idx").on(t.email)]);
+export const team = pgTable("team", {
+    id: id(),
+    name: text("name").notNull(),
+    memberCount: integer("member_count").notNull().default(0),
+    organizationId: uuid("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    ...timestamps(),
+}, (t) => [index("team_organization_id_idx").on(t.organizationId)]);
+export const teamMember = pgTable("team_member", {
+    id: id(),
+    teamId: uuid("team_id")
+        .notNull()
+        .references(() => team.id, { onDelete: "cascade" }),
+    userId: uuid("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    membershipKey: text("membership_key").unique(),
+    ...timestamps(),
+}, (t) => [index("team_member_team_id_idx").on(t.teamId), index("team_member_user_id_idx").on(t.userId)]);
+// The owner's one-time recovery code, stored hashed; using it deletes the row, and the next
+// sign-in issues a fresh one.
+export const ownerRecovery = pgTable("owner_recovery", {
+    userId: uuid("user_id")
+        .primaryKey()
+        .references(() => user.id, { onDelete: "cascade" }),
+    codeHash: text("code_hash").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+});
+export const authSchema = { user, session, account, verification, organization, member, invitation, team, teamMember };
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE9F,uFAAuF;AACvF,wFAAwF;AACxF,6FAA6F;AAC7F,8EAA8E;AAE9E,yFAAyF;AACzF,oFAAoF;AACpF,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,UAAU,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC;IAC/B,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACjF,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CAClF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE;IAClC,EAAE,EAAE,EAAE,EAAE;IACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,UAAU,EAAE,SAAS,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,GAAG,UAAU,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,EAAE,EAAE;IACR,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,oBAAoB,EAAE,IAAI,CAAC,wBAAwB,CAAC;IACpD,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACpC,GAAG,UAAU,EAAE;CAChB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,EAAE,EAAE;IACR,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,oBAAoB,EAAE,SAAS,CAAC,yBAAyB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAClF,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,GAAG,UAAU,EAAE;CAChB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,EAAE,EAAE;IACR,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,GAAG,UAAU,EAAE;CAChB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;AAEF,2FAA2F;AAC3F,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,EAAE;IAClD,EAAE,EAAE,EAAE,EAAE;IACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACrC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,GAAG,UAAU,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAC3B,QAAQ,EACR;IACE,EAAE,EAAE,EAAE,EAAE;IACR,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACpC,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,GAAG,UAAU,EAAE;CAChB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC5G,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAC/B,YAAY,EACZ;IACE,EAAE,EAAE,EAAE,EAAE;IACR,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACpC,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnD,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;SAC1B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,GAAG,UAAU,EAAE;CAChB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACjH,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,MAAM,EACN;IACE,EAAE,EAAE,EAAE,EAAE;IACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACpC,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7D,GAAG,UAAU,EAAE;CAChB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAC/B,aAAa,EACb;IACE,EAAE,EAAE,EAAE,EAAE;IACR,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE;IAC9C,GAAG,UAAU,EAAE;CAChB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACtG,CAAC;AAEF,4FAA4F;AAC5F,8BAA8B;AAC9B,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,EAAE;IACrD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,UAAU,EAAE;SACZ,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CAClF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC"}

package/dist/target.d.ts

@@ -9,6 +9,8 @@ export interface Names {
     worker: string;
     hyperdrive: string;
     neonBranch: string | undefined;
+    bucket: string;
+    filesPrefix: string;
 }
 export declare function names(config: Config, target: Target): Names;
 export declare function previewHostname(worker: string, zoneName: string): string;

package/dist/target.js

@@ -1,9 +1,16 @@
+// Prod gets its own bucket; previews share one, each under its PR's folder.
 export function names(config, target) {
     if (target.kind === "prod") {
-        return { worker: config.name, hyperdrive: config.name, neonBranch: undefined };
+        return { worker: config.name, hyperdrive: config.name, neonBranch: undefined, bucket: `${config.name}-files`, filesPrefix: "" };
     }
     const suffix = `pr-${target.pr}`;
-    return { worker: `${config.name}-${suffix}`, hyperdrive: `${config.name}-${suffix}`, neonBranch: suffix };
+    return {
+        worker: `${config.name}-${suffix}`,
+        hyperdrive: `${config.name}-${suffix}`,
+        neonBranch: suffix,
+        bucket: `${config.name}-previews`,
+        filesPrefix: `${suffix}/`,
+    };
 }
 export function previewHostname(worker, zoneName) {
     return `${worker}.${zoneName}`;

package/dist/target.js.map

@@ -1 +1 @@
-{"version":3,"file":"target.js","sourceRoot":"","sources":["../src/target.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,MAAc;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB;IAC9D,OAAO,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,aAAqB;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../src/target.ts"],"names":[],"mappings":"AAYA,4EAA4E;AAC5E,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,MAAc;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAClI,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;IACjC,OAAO;QACL,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE;QAClC,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE;QACtC,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,WAAW;QACjC,WAAW,EAAE,GAAG,MAAM,GAAG;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB;IAC9D,OAAO,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,aAAqB;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC"}

package/dist/workflow.js

@@ -19,11 +19,17 @@ on:
   push:
     branches: [main]
   pull_request:
-    types: [opened, synchronize, reopened, closed]
+    types: [opened, synchronize, reopened]
+  # GitHub can skip a pull_request run for a close; pull_request_target needs no merge commit, so it always runs.
+  pull_request_target: # zizmor: ignore[dangerous-triggers] the job runs only for this repo's own pull requests
+    types: [closed]
+  # Once a day, remove any preview whose pull request is closed but was never cleaned up.
+  schedule:
+    - cron: "17 6 * * *"
 
 concurrency:
-  group: platform-\${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: \${{ github.event_name == 'pull_request' }}
+  group: platform-\${{ github.event.pull_request.number || (github.event_name == 'schedule' && 'sweep') || github.ref }}
+  cancel-in-progress: \${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
 
 permissions:
   contents: read
@@ -31,11 +37,15 @@ permissions:
 
 jobs:
   platform:
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    if: github.event_name == 'push' || github.event_name == 'schedule' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     environment: \${{ github.event_name == 'push' && 'production' || 'preview' }}
     steps:
-      - uses: actions/checkout@v5${setupPnpm}
+      # A close cleans up with the pull request's own last commit, which knows everything its preview made.
+      - uses: actions/checkout@v5
+        with:
+          ref: \${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || '' }}
+          persist-credentials: false${setupPnpm}
       - uses: actions/setup-node@v5
         with:
           node-version: 24

package/dist/workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAW9D,2FAA2F;AAC3F,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAiB;IAC1F,MAAM,OAAO,GAAG,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxF,MAAM,IAAI,GAAG,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,8BAA8B,CAAC;IAClG,MAAM,SAAS,GAAG,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,gBAAgB,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,MAAM,EAAE,CAAC;IACxF,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,kBAAkB,IAAI,KAAK,CAAC;QACjF,kHAAkH;QAClH,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,kBAAkB,IAAI,KAAK,CAAC;QACnF,mCAAmC;KACpC,CAAC;IAEF,OAAO;;;;;;;;;;;;;;;;;;;;;;;mCAuB0B,SAAS;;;;mBAIzB,cAAc;eAClB,OAAO;eACP,IAAI,GAAG,gBAAgB;;EAEpC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CAClD,CAAC;AACF,CAAC"}
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAW9D,2FAA2F;AAC3F,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAiB;IAC1F,MAAM,OAAO,GAAG,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxF,MAAM,IAAI,GAAG,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,8BAA8B,CAAC;IAClG,MAAM,SAAS,GAAG,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,gBAAgB,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,MAAM,EAAE,CAAC;IACxF,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,kBAAkB,IAAI,KAAK,CAAC;QACjF,kHAAkH;QAClH,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,kBAAkB,IAAI,KAAK,CAAC;QACnF,mCAAmC;KACpC,CAAC;IAEF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAiC6B,SAAS;;;;mBAI5B,cAAc;eAClB,OAAO;eACP,IAAI,GAAG,gBAAgB;;EAEpC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CAClD,CAAC;AACF,CAAC"}

package/dist/wrangler-config.d.ts

@@ -6,5 +6,11 @@ export interface WranglerInput {
     accountId: string;
     hyperdriveId: string | undefined;
     vars: Record<string, string>;
+    bucket?: string | undefined;
 }
-export declare function wranglerConfig({ config, worker, hostname, accountId, hyperdriveId, vars }: WranglerInput): object;
+export declare const AUTH_LIMIT: {
+    readonly limit: 10;
+    readonly period: 60;
+};
+export declare function wranglerConfig({ config, worker, hostname, accountId, hyperdriveId, vars, bucket }: WranglerInput): object;
+export declare function namespaceId(worker: string): string;

package/dist/wrangler-config.js

@@ -1,4 +1,8 @@
-export function wranglerConfig({ config, worker, hostname, accountId, hyperdriveId, vars }) {
+import { createHash } from "node:crypto";
+import { SCREEN_PATHS } from "./runtime/screens.js";
+export const AUTH_LIMIT = { limit: 10, period: 60 };
+export function wranglerConfig({ config, worker, hostname, accountId, hyperdriveId, vars, bucket }) {
+    const auth = config.auth;
     return {
         name: worker,
         account_id: accountId,
@@ -8,11 +12,17 @@ export function wranglerConfig({ config, worker, hostname, accountId, hyperdrive
         workers_dev: false,
         routes: [{ pattern: hostname, custom_domain: true }],
         observability: { enabled: true },
-        vars,
+        vars: { ...vars, APP_NAME: config.name, ...(auth && { AUTH_ORGANIZATIONS: auth.organizations ? "on" : "off" }) },
         ...(config.frontend && {
-            assets: { directory: config.frontend, not_found_handling: "single-page-application", run_worker_first: ["/api/*"] },
+            assets: { directory: config.frontend, not_found_handling: "single-page-application", run_worker_first: ["/api/*", ...(auth ? SCREEN_PATHS : [])] },
         }),
         ...(hyperdriveId && { hyperdrive: [{ binding: "DB", id: hyperdriveId }] }),
+        ...(bucket && { r2_buckets: [{ binding: "FILES", bucket_name: bucket }] }),
+        ...(auth && { ratelimits: [{ name: "AUTH_LIMIT", namespace_id: namespaceId(worker), simple: AUTH_LIMIT }] }),
     };
 }
+// Rate limit namespaces are account-wide integers, so each Worker gets its own from its name.
+export function namespaceId(worker) {
+    return String(1000 + (createHash("sha256").update(worker).digest().readUInt32BE(0) % 2_000_000_000));
+}
 //# sourceMappingURL=wrangler-config.js.map

package/dist/wrangler-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrangler-config.js","sourceRoot":"","sources":["../src/wrangler-config.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAiB;IACvG,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;QAC5C,mBAAmB,EAAE,CAAC,eAAe,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACpD,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAChC,IAAI;QACJ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI;YACrB,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE;SACpH,CAAC;QACF,GAAG,CAAC,YAAY,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"wrangler-config.js","sourceRoot":"","sources":["../src/wrangler-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAYpD,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAW,CAAC;AAE7D,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAiB;IAC/G,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;QAC5C,mBAAmB,EAAE,CAAC,eAAe,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACpD,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAChC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE;QAChH,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI;YACrB,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;SACnJ,CAAC;QACF,GAAG,CAAC,YAAY,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;KAC7G,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;AACvG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celsoft/platform",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Deploy apps to Cloudflare Workers with Neon Postgres, prod on push and a preview per pull request",
   "license": "MIT",
   "repository": {
@@ -17,7 +17,8 @@
     "platform": "./dist/cli.js"
   },
   "exports": {
-    ".": "./dist/runtime/index.js"
+    ".": "./dist/runtime/index.js",
+    "./schema": "./dist/schema.js"
   },
   "files": [
     "dist",
@@ -30,14 +31,19 @@
     "@neondatabase/api-client": "^2.7.3",
     "better-auth": "^1.7.12",
     "cloudflare": "^7.3.0",
+    "drizzle-kit": "^0",
     "jsonc-parser": "^3.3.1",
     "pg": "^8.23.1",
-    "postgres": "^3.4.9",
     "wrangler": "^4.152.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {
+    "@cloudflare/workers-types": "^5.20261023.1",
     "@types/pg": "^8.23.1",
-    "typescript": "7.0.2"
+    "typescript": "7.0.2",
+    "drizzle-orm": "^0.45.4"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "^0"
   }
 }

package/schema.json

@@ -5,10 +5,6 @@
     "$schema": {
       "type": "string"
     },
-    "version": {
-      "type": "number",
-      "const": 1
-    },
     "name": {
       "type": "string",
       "anyOf": [
@@ -65,16 +61,10 @@
               "pattern": "^\\$\\{[A-Z][A-Z0-9_]*\\}$"
             }
           ]
-        },
-        "migrate": {
-          "type": "string",
-          "minLength": 1,
-          "description": "Command that runs migrations against $DATABASE_URL"
         }
       },
       "required": [
-        "neonProject",
-        "migrate"
+        "neonProject"
       ],
       "additionalProperties": false
     },
@@ -84,8 +74,28 @@
       "type": "boolean"
     },
     "auth": {
-      "default": false,
       "description": "Sign-up and login with email and password; needs database and email",
+      "default": false,
+      "anyOf": [
+        {
+          "type": "boolean"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "organizations": {
+              "default": false,
+              "description": "Organizations with members, roles, invitations and teams",
+              "type": "boolean"
+            }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "files": {
+      "default": false,
+      "description": "Object storage in an R2 bucket, organized in folders",
       "type": "boolean"
     },
     "secrets": {
@@ -105,7 +115,6 @@
     }
   },
   "required": [
-    "version",
     "name",
     "hostname",
     "worker",