@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/index.js

@@ -1,12 +1,37 @@
 export const packageName = "@effect-auth/core";
+export * from "./ApiKey.js";
 export * from "./AuditLog.js";
+export * from "./AuthConfig.js";
 export * from "./AuthFlow.js";
+export * from "./AuthKernel.js";
 export * from "./Challenge.js";
 export * from "./Crypto.js";
+export * from "./DomainVerification.js";
+export * from "./EmailOtp.js";
+export * from "./EmailVerification.js";
 export * from "./Identifiers.js";
+export * from "./IncidentAction.js";
+export * from "./Jwt.js";
+export * from "./LoginApproval.js";
+export * from "./LoginNotification.js";
+export * from "./LoginRisk.js";
+export * from "./MachineAuth.js";
+export * from "./Mailer.js";
+export * from "./MagicLink.js";
+export * from "./OAuth.js";
+export * from "./Password.js";
+export * from "./Passkey.js";
 export * from "./Policy.js";
 export * from "./Privacy.js";
+export * from "./RecoveryCode.js";
+export * from "./RefreshToken.js";
+export * from "./Retention.js";
 export * from "./Sessions.js";
+export * from "./SecurityTimeline.js";
 export * from "./Storage.js";
+export * from "./StepUp.js";
+export * from "./Totp.js";
+export * from "./TrustedDevice.js";
 export * from "./WaitUntil.js";
+export * from "./Webhook.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,mBAA4B,CAAA;AAEvD,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,mBAA4B,CAAC;AAExD,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/dist/internal/RateLimitDurableObject.d.ts

@@ -0,0 +1,32 @@
+import { Effect, Layer } from "effect";
+import { RateLimiter as PersistenceRateLimiter } from "effect/unstable/persistence";
+export interface RateLimitDurableObjectFixedWindowInput {
+    readonly tokens: number;
+    readonly refillMillis: number;
+    readonly limit: number | undefined;
+}
+export interface RateLimitDurableObjectTokenBucketInput {
+    readonly tokens: number;
+    readonly limit: number;
+    readonly refillMillis: number;
+    readonly allowOverflow: boolean;
+}
+export interface RateLimitDurableObjectStorage {
+    readonly get: <T = unknown>(key: string) => Effect.Effect<T | undefined, unknown>;
+    readonly put: <T>(key: string, value: T) => Effect.Effect<void, unknown>;
+    readonly transaction: <A>(body: (transaction: RateLimitDurableObjectStorage) => Effect.Effect<A, unknown>) => Effect.Effect<A, unknown>;
+}
+export interface RateLimitDurableObjectApi {
+    readonly fixedWindow: (input: RateLimitDurableObjectFixedWindowInput) => Effect.Effect<readonly [count: number, ttl: number], unknown>;
+    readonly tokenBucket: (input: RateLimitDurableObjectTokenBucketInput) => Effect.Effect<number, unknown>;
+}
+export interface RateLimitDurableObjectNamespace {
+    readonly getByName: (name: string) => RateLimitDurableObjectApi;
+}
+export interface RateLimitDurableObjectStoreOptions {
+    readonly namespace: RateLimitDurableObjectNamespace;
+    readonly prefix?: string;
+}
+export declare const makeRateLimitDurableObjectApi: (storage: RateLimitDurableObjectStorage) => RateLimitDurableObjectApi;
+export declare const makeRateLimitDurableObjectStoreLayer: (options: RateLimitDurableObjectStoreOptions) => Layer.Layer<PersistenceRateLimiter.RateLimiterStore>;
+//# sourceMappingURL=RateLimitDurableObject.d.ts.map

package/dist/internal/RateLimitDurableObject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitDurableObject.d.ts","sourceRoot":"","sources":["../../src/internal/RateLimitDurableObject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACxD,OAAO,EAAE,WAAW,IAAI,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAEpF,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,EACxB,GAAG,EAAE,MAAM,KACR,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EACtB,IAAI,EAAE,CACJ,WAAW,EAAE,6BAA6B,KACvC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,sCAAsC,KAC1C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,sCAAsC,KAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,yBAAyB,CAAC;CACjE;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,SAAS,EAAE,+BAA+B,CAAC;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA4BD,eAAO,MAAM,6BAA6B,GACxC,SAAS,6BAA6B,KACrC,yBA+DD,CAAC;AAEH,eAAO,MAAM,oCAAoC,GAC/C,SAAS,kCAAkC,KAC1C,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,gBAAgB,CA2BrD,CAAC"}

package/dist/internal/RateLimitDurableObject.js

@@ -0,0 +1,80 @@
+import { Clock, Duration, Effect, Layer } from "effect";
+import { RateLimiter as PersistenceRateLimiter } from "effect/unstable/persistence";
+const fixedWindowKey = "fixed-window";
+const tokenBucketKey = "token-bucket";
+const nonZeroMillis = (millis) => Math.max(1, millis);
+const storeError = (operation, cause) => new PersistenceRateLimiter.RateLimiterError({
+    reason: new PersistenceRateLimiter.RateLimitStoreError({
+        message: `Cloudflare Durable Object rate limit store failed during ${operation}`,
+        cause,
+    }),
+});
+export const makeRateLimitDurableObjectApi = (storage) => ({
+    fixedWindow: (input) => storage.transaction((transaction) => Effect.gen(function* () {
+        const now = yield* Clock.currentTimeMillis;
+        const refillMillis = nonZeroMillis(input.refillMillis);
+        let counter = yield* transaction.get(fixedWindowKey);
+        if (!counter || counter.expiresAt <= now) {
+            counter = { count: 0, expiresAt: now };
+        }
+        const nextCount = counter.count + input.tokens;
+        const currentTtl = Math.max(0, counter.expiresAt - now);
+        if (input.limit !== undefined && nextCount > input.limit) {
+            return [nextCount, currentTtl];
+        }
+        const next = {
+            count: nextCount,
+            expiresAt: counter.expiresAt + refillMillis * input.tokens,
+        };
+        yield* transaction.put(fixedWindowKey, next);
+        return [next.count, Math.max(0, next.expiresAt - now)];
+    })),
+    tokenBucket: (input) => storage.transaction((transaction) => Effect.gen(function* () {
+        const now = yield* Clock.currentTimeMillis;
+        const refillMillis = nonZeroMillis(input.refillMillis);
+        let bucket = yield* transaction.get(tokenBucketKey);
+        if (!bucket) {
+            bucket = { tokens: input.limit, lastRefill: now };
+        }
+        else {
+            const elapsed = now - bucket.lastRefill;
+            const tokensToAdd = Math.floor(elapsed / refillMillis);
+            if (tokensToAdd > 0) {
+                bucket = {
+                    tokens: Math.min(input.limit, bucket.tokens + tokensToAdd),
+                    lastRefill: bucket.lastRefill + tokensToAdd * refillMillis,
+                };
+            }
+        }
+        const remaining = bucket.tokens - input.tokens;
+        if (input.allowOverflow || remaining >= 0) {
+            yield* transaction.put(tokenBucketKey, {
+                tokens: remaining,
+                lastRefill: bucket.lastRefill,
+            });
+        }
+        return remaining;
+    })),
+});
+export const makeRateLimitDurableObjectStoreLayer = (options) => {
+    const prefix = options.prefix ?? "effect-auth:rate-limit:";
+    const object = (key) => options.namespace.getByName(`${prefix}${key}`);
+    return Layer.sync(PersistenceRateLimiter.RateLimiterStore, () => PersistenceRateLimiter.RateLimiterStore.of({
+        fixedWindow: (input) => object(input.key)
+            .fixedWindow({
+            tokens: input.tokens,
+            refillMillis: Duration.toMillis(input.refillRate),
+            limit: input.limit,
+        })
+            .pipe(Effect.mapError((cause) => storeError("fixedWindow", cause))),
+        tokenBucket: (input) => object(input.key)
+            .tokenBucket({
+            tokens: input.tokens,
+            limit: input.limit,
+            refillMillis: Duration.toMillis(input.refillRate),
+            allowOverflow: input.allowOverflow,
+        })
+            .pipe(Effect.mapError((cause) => storeError("tokenBucket", cause))),
+    }));
+};
+//# sourceMappingURL=RateLimitDurableObject.js.map

package/dist/internal/RateLimitDurableObject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitDurableObject.js","sourceRoot":"","sources":["../../src/internal/RateLimitDurableObject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACxD,OAAO,EAAE,WAAW,IAAI,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAuDpF,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAEtE,MAAM,UAAU,GAAG,CACjB,SAAiB,EACjB,KAAc,EAC2B,EAAE,CAC3C,IAAI,sBAAsB,CAAC,gBAAgB,CAAC;IAC1C,MAAM,EAAE,IAAI,sBAAsB,CAAC,mBAAmB,CAAC;QACrD,OAAO,EAAE,4DAA4D,SAAS,EAAE;QAChF,KAAK;KACN,CAAC;CACH,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,OAAsC,EACX,EAAE,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE,CAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAmB,cAAc,CAAC,CAAC;QAEvE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACzC,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAExD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YACzD,OAAO,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC,MAAM;SAC3D,CAAC;QAEF,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAE7C,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,CAAU,CAAC;IAClE,CAAC,CAAC,CACH;IAEH,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE,CAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAmB,cAAc,CAAC,CAAC;QAEtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;YACxC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC;YAEvD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,GAAG;oBACP,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC;oBAC1D,UAAU,EAAE,MAAM,CAAC,UAAU,GAAG,WAAW,GAAG,YAAY;iBAC3D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAE/C,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CACH;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,OAA2C,EACW,EAAE;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,yBAAyB,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;IAEjD,OAAO,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAC9D,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;aACd,WAAW,CAAC;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;YACjD,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;QAEvE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;aACd,WAAW,CAAC;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;YACjD,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;KACxE,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/migrations/0002_auth_password.sql

@@ -0,0 +1,25 @@
+create table if not exists auth_user (
+  id text primary key,
+  email text not null,
+  email_verified integer not null,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_user_email_idx on auth_user (email);
+
+create table if not exists auth_credential (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at integer not null,
+  updated_at integer not null,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_credential_user_id_idx on auth_credential (user_id);
+create unique index if not exists auth_credential_user_type_idx on auth_credential (user_id, type);

package/migrations/0003_auth_login_approval_review.sql

@@ -0,0 +1,22 @@
+create table if not exists auth_login_approval_review (
+  approval_challenge_id text primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required integer not null,
+  status text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  reviewed_at integer,
+  reviewed_by text,
+  denied_reason text,
+  risk text,
+  metadata text,
+  review_metadata text
+);
+
+create index if not exists auth_login_approval_review_flow_id_idx on auth_login_approval_review (flow_id);
+create index if not exists auth_login_approval_review_user_id_idx on auth_login_approval_review (user_id);
+create index if not exists auth_login_approval_review_status_expires_at_idx on auth_login_approval_review (status, expires_at);

package/migrations/0004_auth_trusted_device.sql

@@ -0,0 +1,12 @@
+create table if not exists auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at integer not null,
+  last_seen_at integer not null,
+  expires_at integer not null,
+  metadata text,
+  primary key (user_id, token_hash)
+);
+
+create index if not exists auth_trusted_device_user_id_idx on auth_trusted_device (user_id);
+create index if not exists auth_trusted_device_expires_at_idx on auth_trusted_device (expires_at);

package/migrations/0005_auth_passkey.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_passkey_credential (
+  id text primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count integer not null,
+  transports text,
+  backed_up integer,
+  created_at integer not null,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_passkey_credential_credential_id_idx on auth_passkey_credential (credential_id);
+create index if not exists auth_passkey_credential_user_id_idx on auth_passkey_credential (user_id);
+create index if not exists auth_passkey_credential_revoked_at_idx on auth_passkey_credential (revoked_at);

package/migrations/0006_auth_totp_factor.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_totp_factor (
+  id text primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at integer not null,
+  confirmed_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index if not exists auth_totp_factor_confirmed_at_idx on auth_totp_factor (confirmed_at);
+create index if not exists auth_totp_factor_revoked_at_idx on auth_totp_factor (revoked_at);

package/migrations/0007_auth_recovery_code.sql

@@ -0,0 +1,13 @@
+create table if not exists auth_recovery_code (
+  id text primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at integer not null,
+  used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index if not exists auth_recovery_code_used_at_idx on auth_recovery_code (used_at);
+create index if not exists auth_recovery_code_revoked_at_idx on auth_recovery_code (revoked_at);

package/migrations/0008_auth_api_key.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_api_key (
+  id text primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes text not null,
+  created_at integer not null,
+  expires_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_api_key_prefix_idx on auth_api_key (prefix);
+create index if not exists auth_api_key_user_id_idx on auth_api_key (user_id);
+create index if not exists auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index if not exists auth_api_key_revoked_at_idx on auth_api_key (revoked_at);

package/migrations/0009_auth_refresh_token.sql

@@ -0,0 +1,21 @@
+create table if not exists auth_refresh_token (
+  id text primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  last_used_at integer,
+  rotated_at integer,
+  replaced_by_id text,
+  revoked_at integer,
+  reuse_detected_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_refresh_token_secret_hash_idx on auth_refresh_token (secret_hash);
+create index if not exists auth_refresh_token_family_id_idx on auth_refresh_token (family_id);
+create index if not exists auth_refresh_token_user_id_idx on auth_refresh_token (user_id);
+create index if not exists auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+create index if not exists auth_refresh_token_rotated_at_idx on auth_refresh_token (rotated_at);
+create index if not exists auth_refresh_token_revoked_at_idx on auth_refresh_token (revoked_at);

package/migrations/0010_auth_jwt_revocation.sql

@@ -0,0 +1,8 @@
+create table if not exists auth_jwt_revocation (
+  jwt_id text primary key,
+  revoked_at integer not null,
+  expires_at integer,
+  reason text
+);
+
+create index if not exists auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);

package/migrations/0011_auth_oauth_account.sql

@@ -0,0 +1,16 @@
+create table if not exists auth_oauth_account (
+  id text primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified integer,
+  created_at integer not null,
+  updated_at integer not null,
+  unlinked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_oauth_account_provider_account_idx on auth_oauth_account (provider_id, provider_account_id);
+create index if not exists auth_oauth_account_user_id_idx on auth_oauth_account (user_id);
+create index if not exists auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);

package/migrations/0012_auth_oauth_provider_token_vault.sql

@@ -0,0 +1,20 @@
+create table if not exists auth_oauth_provider_token_vault (
+  account_id text primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes text,
+  expires_at integer,
+  updated_at integer not null,
+  revoked_at integer,
+  revocation_reason text
+);
+
+create index if not exists auth_oauth_provider_token_vault_user_id_idx on auth_oauth_provider_token_vault (user_id);
+create index if not exists auth_oauth_provider_token_vault_provider_account_idx on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index if not exists auth_oauth_provider_token_vault_expires_at_idx on auth_oauth_provider_token_vault (expires_at);
+create index if not exists auth_oauth_provider_token_vault_revoked_at_idx on auth_oauth_provider_token_vault (revoked_at);

package/migrations/0013_auth_security_timeline.sql

@@ -0,0 +1,16 @@
+create table if not exists auth_security_timeline (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at integer not null,
+  summary text not null,
+  actor text,
+  request text,
+  metadata text
+);
+
+create index if not exists auth_security_timeline_user_occurred_at_idx on auth_security_timeline (user_id, occurred_at);
+create index if not exists auth_security_timeline_type_idx on auth_security_timeline (type);
+create index if not exists auth_security_timeline_category_idx on auth_security_timeline (category);

package/migrations/0014_auth_webhook_outbox.sql

@@ -0,0 +1,16 @@
+create table if not exists auth_webhook_outbox (
+  id text primary key,
+  endpoint_key text not null,
+  event text not null,
+  status text not null,
+  attempts integer not null,
+  next_attempt_at integer not null,
+  created_at integer not null,
+  updated_at integer not null,
+  delivered_at integer,
+  last_error text
+);
+
+create index if not exists auth_webhook_outbox_due_idx on auth_webhook_outbox (next_attempt_at, status);
+create index if not exists auth_webhook_outbox_endpoint_due_idx on auth_webhook_outbox (endpoint_key, next_attempt_at);
+create index if not exists auth_webhook_outbox_status_idx on auth_webhook_outbox (status);

package/migrations/0015_auth_webhook_replay.sql

@@ -0,0 +1,7 @@
+create table if not exists auth_webhook_replay (
+  id text primary key,
+  expires_at integer not null,
+  created_at integer not null
+);
+
+create index if not exists auth_webhook_replay_expires_at_idx on auth_webhook_replay (expires_at);

package/migrations/0016_auth_login_risk_history.sql

@@ -0,0 +1,23 @@
+create table if not exists auth_login_risk_history (
+  id text primary key,
+  user_id text not null,
+  occurred_at integer not null,
+  outcome text not null,
+  method text not null,
+  amr text not null,
+  aal text not null,
+  device_status text not null,
+  device_key text,
+  location_key text,
+  country text,
+  region text,
+  latitude_micro integer,
+  longitude_micro integer,
+  risk_level text,
+  created_at integer not null
+);
+
+create index if not exists auth_login_risk_history_user_occurred_at_idx on auth_login_risk_history (user_id, occurred_at);
+create index if not exists auth_login_risk_history_user_device_key_idx on auth_login_risk_history (user_id, device_key);
+create index if not exists auth_login_risk_history_user_location_key_idx on auth_login_risk_history (user_id, location_key);
+create index if not exists auth_login_risk_history_occurred_at_idx on auth_login_risk_history (occurred_at);

package/migrations/0017_auth_audit_log.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_audit_log (
+  id text,
+  type text not null,
+  user_id text,
+  actor_user_id text,
+  occurred_at integer not null,
+  request_ip_hash text,
+  request_user_agent_hash text,
+  event text not null,
+  created_at integer not null
+);
+
+create index if not exists auth_audit_log_id_idx on auth_audit_log (id);
+create index if not exists auth_audit_log_user_occurred_at_idx on auth_audit_log (user_id, occurred_at);
+create index if not exists auth_audit_log_actor_user_occurred_at_idx on auth_audit_log (actor_user_id, occurred_at);
+create index if not exists auth_audit_log_type_occurred_at_idx on auth_audit_log (type, occurred_at);
+create index if not exists auth_audit_log_occurred_at_idx on auth_audit_log (occurred_at);

package/migrations/0018_auth_domain_verification.sql

@@ -0,0 +1,18 @@
+create table if not exists auth_domain_verification (
+  id text primary key,
+  owner_id text not null,
+  domain text not null,
+  proof_method text not null,
+  proof_token text not null,
+  status text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  verified_at integer,
+  revoked_at integer,
+  last_checked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_domain_verification_owner_domain_idx on auth_domain_verification (owner_id, domain);
+create index if not exists auth_domain_verification_domain_idx on auth_domain_verification (domain);
+create index if not exists auth_domain_verification_status_expires_at_idx on auth_domain_verification (status, expires_at);

package/migrations/0019_auth_oauth_authorization_code.sql

@@ -0,0 +1,17 @@
+create table if not exists auth_oauth_authorization_code (
+  code_hash text primary key,
+  client_id text not null,
+  subject text not null,
+  redirect_uri text not null,
+  scopes text not null,
+  code_challenge text,
+  code_challenge_method text,
+  issued_at integer not null,
+  expires_at integer not null,
+  consumed_at integer,
+  metadata text
+);
+
+create index if not exists auth_oauth_authorization_code_client_expires_at_idx on auth_oauth_authorization_code (client_id, expires_at);
+create index if not exists auth_oauth_authorization_code_expires_at_idx on auth_oauth_authorization_code (expires_at);
+create index if not exists auth_oauth_authorization_code_consumed_at_idx on auth_oauth_authorization_code (consumed_at);

package/migrations/0020_auth_oauth_provider_mode_token.sql

@@ -0,0 +1,24 @@
+create table if not exists auth_oauth_provider_mode_token (
+  token_hash text primary key,
+  token_type text not null,
+  client_id text not null,
+  subject text not null,
+  scopes text not null,
+  issued_at integer not null,
+  expires_at integer not null,
+  issuer text,
+  audience text,
+  jwt_id text,
+  revoked_at integer,
+  revocation_reason text,
+  rotated_at integer,
+  replaced_by_token_hash text,
+  metadata text
+);
+
+create index if not exists auth_oauth_provider_mode_token_client_expires_at_idx on auth_oauth_provider_mode_token (client_id, expires_at);
+create index if not exists auth_oauth_provider_mode_token_subject_idx on auth_oauth_provider_mode_token (subject);
+create index if not exists auth_oauth_provider_mode_token_expires_at_idx on auth_oauth_provider_mode_token (expires_at);
+create index if not exists auth_oauth_provider_mode_token_revoked_at_idx on auth_oauth_provider_mode_token (revoked_at);
+create index if not exists auth_oauth_provider_mode_token_rotated_at_idx on auth_oauth_provider_mode_token (rotated_at);
+create index if not exists auth_oauth_provider_mode_token_jwt_id_idx on auth_oauth_provider_mode_token (jwt_id);

package/migrations/0021_auth_oauth_client_secret.sql

@@ -0,0 +1,14 @@
+create table if not exists auth_oauth_client_secret (
+  prefix text primary key,
+  client_id text not null,
+  secret_hash text not null,
+  authentication_methods text not null,
+  created_at integer not null,
+  expires_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create index if not exists auth_oauth_client_secret_client_prefix_idx on auth_oauth_client_secret (client_id, prefix);
+create index if not exists auth_oauth_client_secret_client_id_idx on auth_oauth_client_secret (client_id);

package/migrations/0022_auth_oauth_client.sql

@@ -0,0 +1,15 @@
+create table if not exists auth_oauth_client (
+  id text primary key,
+  type text not null,
+  status text not null,
+  name text,
+  redirect_uris text not null,
+  allowed_grant_types text not null,
+  allowed_response_types text not null,
+  allowed_scopes text,
+  created_at integer,
+  updated_at integer,
+  metadata text
+);
+
+create index if not exists auth_oauth_client_status_idx on auth_oauth_client (status);

package/migrations/0023_auth_oauth_consent.sql

@@ -0,0 +1,15 @@
+create table if not exists auth_oauth_consent (
+  id text primary key,
+  user_id text not null,
+  client_id text not null,
+  scopes text not null,
+  granted_at integer not null,
+  expires_at integer,
+  revoked_at integer,
+  metadata text
+);
+
+create unique index if not exists auth_oauth_consent_user_client_idx on auth_oauth_consent (user_id, client_id);
+create index if not exists auth_oauth_consent_user_id_idx on auth_oauth_consent (user_id);
+create index if not exists auth_oauth_consent_expires_at_idx on auth_oauth_consent (expires_at);
+create index if not exists auth_oauth_consent_revoked_at_idx on auth_oauth_consent (revoked_at);