@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/PostgresStorageMigrations.js

@@ -0,0 +1,620 @@
+export const postgresAuthStorageMigration001 = {
+    id: "0001_auth_core",
+    sql: `create table auth_user (
+  id text constraint auth_user_pkey primary key,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  metadata jsonb
+);
+
+create table auth_user_identity (
+  id text constraint auth_user_identity_pkey primary key,
+  user_id text not null,
+  scope_type text not null,
+  scope_id text not null,
+  kind text not null,
+  value text not null,
+  normalized_value text not null,
+  verified_at bigint,
+  is_primary_login boolean not null default false,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  replaced_by_id text,
+  metadata jsonb
+);
+create unique index auth_user_identity_active_value_idx
+  on auth_user_identity (scope_type, scope_id, kind, normalized_value)
+  where revoked_at is null;
+create unique index auth_user_identity_active_primary_idx
+  on auth_user_identity (user_id) where revoked_at is null and is_primary_login;
+create index auth_user_identity_user_id_idx on auth_user_identity (user_id);
+create index auth_user_identity_replaced_by_id_idx on auth_user_identity (replaced_by_id);
+
+create table auth_credential (
+  id text constraint auth_credential_pkey primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_credential_user_type_key unique (user_id, type)
+);
+create index auth_credential_user_id_idx on auth_credential (user_id);
+
+create table auth_session (
+  id text constraint auth_session_pkey primary key,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  auth_time bigint not null,
+  authentication_events jsonb not null,
+  aal text not null,
+  amr jsonb not null,
+  claims jsonb,
+  mfa_verified_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  last_seen_at bigint,
+  rotated_at bigint
+);
+create index auth_session_user_id_idx on auth_session (user_id);
+create index auth_session_expires_at_idx on auth_session (expires_at);
+
+create table auth_verification (
+  id text constraint auth_verification_pkey primary key,
+  type text not null,
+  subject text not null,
+  secret_hash text,
+  created_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  consumed_at bigint
+);
+create index auth_verification_type_subject_idx on auth_verification (type, subject);
+create index auth_verification_expires_at_idx on auth_verification (expires_at);`,
+};
+export const postgresAuthStorageMigration002 = {
+    id: "0002_auth_security_oauth",
+    sql: `create table auth_totp_factor (
+  id text constraint auth_totp_factor_pkey primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at bigint not null,
+  confirmed_at bigint,
+  last_used_at bigint,
+  last_accepted_counter bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index auth_totp_factor_active_idx on auth_totp_factor (user_id, created_at, id)
+  where revoked_at is null and confirmed_at is not null;
+
+create table auth_recovery_code (
+  id text constraint auth_recovery_code_pkey primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at bigint not null,
+  used_at bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index auth_recovery_code_active_idx on auth_recovery_code (user_id, created_at, id)
+  where used_at is null and revoked_at is null;
+
+create table auth_refresh_token (
+  id text constraint auth_refresh_token_pkey primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  last_used_at bigint,
+  rotated_at bigint,
+  replaced_by_id text,
+  revoked_at bigint,
+  reuse_detected_at bigint,
+  metadata jsonb,
+  constraint auth_refresh_token_secret_hash_key unique (secret_hash)
+);
+create index auth_refresh_token_family_id_idx on auth_refresh_token (family_id, created_at, id);
+create index auth_refresh_token_user_id_idx on auth_refresh_token (user_id, created_at, id);
+create index auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+
+create table auth_oauth_account (
+  id text constraint auth_oauth_account_pkey primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified boolean,
+  created_at bigint not null,
+  updated_at bigint not null,
+  unlinked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_account_provider_account_key unique (provider_id, provider_account_id)
+);
+create index auth_oauth_account_user_id_idx on auth_oauth_account (user_id, created_at, id);
+create index auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);`,
+};
+export const postgresAuthStorageMigration003 = {
+    id: "0003_auth_credentials_tokens",
+    sql: `create table auth_passkey_credential (
+  id text constraint auth_passkey_credential_pkey primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count bigint not null,
+  transports jsonb,
+  backed_up boolean,
+  created_at bigint not null,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_passkey_credential_credential_id_key unique (credential_id)
+);
+create index auth_passkey_credential_user_id_idx
+  on auth_passkey_credential (user_id, created_at, id);
+create index auth_passkey_credential_revoked_at_idx
+  on auth_passkey_credential (revoked_at);
+
+create table auth_api_key (
+  id text constraint auth_api_key_pkey primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_api_key_prefix_key unique (prefix)
+);
+create index auth_api_key_user_id_idx on auth_api_key (user_id, created_at, id);
+create index auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index auth_api_key_revoked_at_idx on auth_api_key (revoked_at);
+
+create table auth_jwt_revocation (
+  jwt_id text constraint auth_jwt_revocation_pkey primary key,
+  revoked_at bigint not null,
+  expires_at bigint,
+  reason text
+);
+create index auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);`,
+};
+export const postgresAuthStorageMigration004 = {
+    id: "0004_auth_security_history",
+    sql: `create table auth_audit_log (
+  storage_id bigint generated always as identity constraint auth_audit_log_pkey primary key,
+  id text,
+  type text not null,
+  user_id text,
+  actor_user_id text,
+  occurred_at bigint not null,
+  request_ip_hash text,
+  request_user_agent_hash text,
+  event jsonb not null,
+  created_at bigint not null
+);
+create index auth_audit_log_id_idx on auth_audit_log (id);
+create index auth_audit_log_user_occurred_at_idx
+  on auth_audit_log (user_id, occurred_at, id);
+create index auth_audit_log_actor_user_occurred_at_idx
+  on auth_audit_log (actor_user_id, occurred_at, id);
+create index auth_audit_log_type_occurred_at_idx
+  on auth_audit_log (type, occurred_at, id);
+create index auth_audit_log_occurred_at_idx
+  on auth_audit_log (occurred_at, id);
+
+create table auth_login_approval_review (
+  approval_challenge_id text constraint auth_login_approval_review_pkey primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required boolean not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  reviewed_at bigint,
+  reviewed_by text,
+  denied_reason text,
+  risk jsonb,
+  metadata jsonb,
+  review_metadata jsonb,
+  constraint auth_login_approval_review_session_binding_check
+    check (session_binding in ('originating-device', 'approval-device', 'none')),
+  constraint auth_login_approval_review_status_check
+    check (status in ('pending', 'approved', 'denied'))
+);
+create index auth_login_approval_review_flow_id_idx
+  on auth_login_approval_review (flow_id);
+create index auth_login_approval_review_user_id_idx
+  on auth_login_approval_review (user_id);
+create index auth_login_approval_review_status_expires_at_idx
+  on auth_login_approval_review (status, expires_at);
+
+create table auth_login_risk_history (
+  id text constraint auth_login_risk_history_pkey primary key,
+  user_id text not null,
+  occurred_at bigint not null,
+  outcome text not null,
+  method text not null,
+  amr jsonb not null,
+  aal text not null,
+  device_status text not null,
+  device_key text,
+  location_key text,
+  country text,
+  region text,
+  latitude_micro bigint,
+  longitude_micro bigint,
+  risk_level text,
+  created_at bigint not null,
+  constraint auth_login_risk_history_outcome_check
+    check (outcome in ('success', 'failure')),
+  constraint auth_login_risk_history_aal_check
+    check (aal in ('aal1', 'aal2', 'aal3')),
+  constraint auth_login_risk_history_device_status_check
+    check (device_status in ('known', 'new', 'unknown')),
+  constraint auth_login_risk_history_risk_level_check
+    check (risk_level is null or risk_level in ('unknown', 'low', 'medium', 'high', 'critical')),
+  constraint auth_login_risk_history_latitude_check
+    check (latitude_micro is null or latitude_micro between -90000000 and 90000000),
+  constraint auth_login_risk_history_longitude_check
+    check (longitude_micro is null or longitude_micro between -180000000 and 180000000)
+);
+create index auth_login_risk_history_user_occurred_at_idx
+  on auth_login_risk_history (user_id, occurred_at, id);
+create index auth_login_risk_history_user_device_key_idx
+  on auth_login_risk_history (user_id, device_key);
+create index auth_login_risk_history_user_location_key_idx
+  on auth_login_risk_history (user_id, location_key);
+create index auth_login_risk_history_occurred_at_idx
+  on auth_login_risk_history (occurred_at, id);
+
+create table auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at bigint not null,
+  last_seen_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  constraint auth_trusted_device_pkey primary key (user_id, token_hash)
+);
+create index auth_trusted_device_user_id_idx
+  on auth_trusted_device (user_id, last_seen_at, token_hash);
+create index auth_trusted_device_expires_at_idx
+  on auth_trusted_device (expires_at);`,
+};
+export const postgresAuthStorageMigration005 = {
+    id: "0005_auth_webhooks",
+    sql: `create table auth_webhook_outbox (
+  id text constraint auth_webhook_outbox_pkey primary key,
+  endpoint_key text not null,
+  event jsonb not null,
+  status text not null,
+  attempts integer not null,
+  next_attempt_at bigint not null,
+  created_at bigint not null,
+  updated_at bigint not null,
+  delivered_at bigint,
+  last_error text,
+  constraint auth_webhook_outbox_status_check
+    check (status in ('pending', 'failed', 'delivered', 'dead_lettered')),
+  constraint auth_webhook_outbox_attempts_check check (attempts >= 0)
+);
+create index auth_webhook_outbox_due_idx
+  on auth_webhook_outbox (next_attempt_at, status);
+create index auth_webhook_outbox_endpoint_due_idx
+  on auth_webhook_outbox (endpoint_key, next_attempt_at);
+create index auth_webhook_outbox_status_idx
+  on auth_webhook_outbox (status);
+
+create table auth_webhook_replay (
+  id text constraint auth_webhook_replay_pkey primary key,
+  expires_at bigint not null,
+  created_at bigint not null
+);
+create index auth_webhook_replay_expires_at_idx
+  on auth_webhook_replay (expires_at);`,
+};
+export const postgresAuthStorageMigration006 = {
+    id: "0006_auth_domain_timeline",
+    sql: `create table auth_domain_verification (
+  id text constraint auth_domain_verification_pkey primary key,
+  owner_id text not null,
+  domain text not null,
+  proof_method text not null,
+  proof_token text not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  verified_at bigint,
+  revoked_at bigint,
+  last_checked_at bigint,
+  metadata jsonb,
+  constraint auth_domain_verification_owner_domain_key unique (owner_id, domain),
+  constraint auth_domain_verification_proof_method_check
+    check (proof_method in ('dns-txt', 'http-file', 'meta-tag')),
+  constraint auth_domain_verification_status_check
+    check (status in ('pending', 'verified', 'revoked'))
+);
+create index auth_domain_verification_domain_idx
+  on auth_domain_verification (domain);
+create index auth_domain_verification_status_expires_at_idx
+  on auth_domain_verification (status, expires_at);
+create index auth_domain_verification_owner_created_at_idx
+  on auth_domain_verification (owner_id, created_at, id collate "C");
+
+create table auth_security_timeline (
+  id text constraint auth_security_timeline_pkey primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at bigint not null,
+  summary text not null,
+  actor jsonb,
+  request jsonb,
+  metadata jsonb,
+  constraint auth_security_timeline_category_check
+    check (category in ('api_key', 'auth', 'authorization', 'incident', 'identity', 'jwt', 'mfa', 'oauth', 'policy', 'refresh_token', 'risk', 'session')),
+  constraint auth_security_timeline_severity_check
+    check (severity in ('info', 'warning', 'critical'))
+);
+create index auth_security_timeline_user_occurred_at_idx
+  on auth_security_timeline (user_id, occurred_at, id collate "C");
+create index auth_security_timeline_occurred_at_idx
+  on auth_security_timeline (occurred_at, id collate "C");
+create index auth_security_timeline_user_type_idx
+  on auth_security_timeline (user_id, type, occurred_at, id collate "C");
+create index auth_security_timeline_user_category_idx
+  on auth_security_timeline (user_id, category, occurred_at, id collate "C");`,
+};
+export const postgresAuthStorageMigration007 = {
+    id: "0007_auth_oauth_clients",
+    sql: `create table auth_oauth_client (
+  id text constraint auth_oauth_client_pkey primary key,
+  type text not null,
+  status text not null,
+  name text,
+  redirect_uris jsonb not null,
+  allowed_grant_types jsonb not null,
+  allowed_response_types jsonb not null,
+  allowed_scopes jsonb,
+  created_at bigint,
+  updated_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_type_check
+    check (type in ('public', 'confidential')),
+  constraint auth_oauth_client_status_check
+    check (status in ('active', 'disabled')),
+  constraint auth_oauth_client_redirect_uris_check
+    check (jsonb_typeof(redirect_uris) = 'array' and not jsonb_path_exists(redirect_uris, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_client_allowed_grant_types_check
+    check (jsonb_typeof(allowed_grant_types) = 'array' and not jsonb_path_exists(allowed_grant_types, '$[*] ? (@.type() != "string" || (@ != "authorization_code" && @ != "refresh_token" && @ != "client_credentials"))')),
+  constraint auth_oauth_client_allowed_response_types_check
+    check (jsonb_typeof(allowed_response_types) = 'array' and not jsonb_path_exists(allowed_response_types, '$[*] ? (@.type() != "string" || @ != "code")')),
+  constraint auth_oauth_client_allowed_scopes_check
+    check (allowed_scopes is null or (jsonb_typeof(allowed_scopes) = 'array' and not jsonb_path_exists(allowed_scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_client_status_idx
+  on auth_oauth_client (status, id collate "C");
+
+create table auth_oauth_consent (
+  user_id text not null,
+  client_id text not null,
+  scopes jsonb not null,
+  granted_at bigint not null,
+  expires_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_consent_user_client_key unique (user_id, client_id),
+  constraint auth_oauth_consent_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")'))
+);
+create index auth_oauth_consent_user_id_idx
+  on auth_oauth_consent (user_id, granted_at, client_id collate "C");
+create index auth_oauth_consent_expires_at_idx
+  on auth_oauth_consent (expires_at);
+create index auth_oauth_consent_revoked_at_idx
+  on auth_oauth_consent (revoked_at);
+
+create table auth_oauth_authorization_code (
+  code_hash text constraint auth_oauth_authorization_code_pkey primary key,
+  client_id text not null,
+  subject text not null,
+  redirect_uri text not null,
+  scopes jsonb not null,
+  code_challenge text,
+  code_challenge_method text,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  consumed_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_authorization_code_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_authorization_code_challenge_method_check
+    check (code_challenge_method is null or code_challenge_method = 'S256')
+);
+create index auth_oauth_authorization_code_client_expires_at_idx
+  on auth_oauth_authorization_code (client_id, expires_at);
+create index auth_oauth_authorization_code_expires_at_idx
+  on auth_oauth_authorization_code (expires_at);
+create index auth_oauth_authorization_code_consumed_at_idx
+  on auth_oauth_authorization_code (consumed_at);
+
+create table auth_oauth_client_secret (
+  prefix text collate "C" not null,
+  client_id text not null,
+  secret_hash text not null,
+  authentication_methods jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_secret_pkey primary key (client_id, prefix),
+  constraint auth_oauth_client_secret_authentication_methods_check
+    check (jsonb_typeof(authentication_methods) = 'array' and not jsonb_path_exists(authentication_methods, '$[*] ? (@.type() != "string" || (@ != "client_secret_basic" && @ != "client_secret_post"))'))
+);`,
+};
+export const postgresAuthStorageMigration008 = {
+    id: "0008_auth_oauth_tokens",
+    sql: `create table auth_oauth_provider_mode_token (
+  token_hash text constraint auth_oauth_provider_mode_token_pkey primary key,
+  token_type text not null,
+  client_id text not null,
+  subject text not null,
+  scopes jsonb not null,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  issuer text,
+  audience jsonb,
+  jwt_id text,
+  revoked_at bigint,
+  revocation_reason text,
+  rotated_at bigint,
+  replaced_by_token_hash text,
+  metadata jsonb,
+  constraint auth_oauth_provider_mode_token_type_check
+    check (token_type in ('access_token', 'refresh_token')),
+  constraint auth_oauth_provider_mode_token_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_provider_mode_token_audience_check
+    check (audience is null or jsonb_typeof(audience) = 'string' or (jsonb_typeof(audience) = 'array' and not jsonb_path_exists(audience, '$[*] ? (@.type() != "string")'))),
+  constraint auth_oauth_provider_mode_token_metadata_check
+    check (metadata is null or jsonb_typeof(metadata) = 'object')
+);
+create index auth_oauth_provider_mode_token_client_expires_at_idx
+  on auth_oauth_provider_mode_token (client_id, expires_at);
+create index auth_oauth_provider_mode_token_subject_idx
+  on auth_oauth_provider_mode_token (subject);
+create index auth_oauth_provider_mode_token_expires_at_idx
+  on auth_oauth_provider_mode_token (expires_at);
+create index auth_oauth_provider_mode_token_revoked_at_idx
+  on auth_oauth_provider_mode_token (revoked_at);
+create index auth_oauth_provider_mode_token_rotated_at_idx
+  on auth_oauth_provider_mode_token (rotated_at);
+create index auth_oauth_provider_mode_token_jwt_id_idx
+  on auth_oauth_provider_mode_token (jwt_id);
+
+create table auth_oauth_provider_token_vault (
+  account_id text constraint auth_oauth_provider_token_vault_pkey primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes jsonb,
+  expires_at bigint,
+  updated_at bigint not null,
+  revoked_at bigint,
+  revocation_reason text,
+  constraint auth_oauth_provider_token_vault_scopes_check
+    check (scopes is null or (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_provider_token_vault_user_id_idx
+  on auth_oauth_provider_token_vault (user_id);
+create index auth_oauth_provider_token_vault_provider_account_idx
+  on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index auth_oauth_provider_token_vault_expires_at_idx
+  on auth_oauth_provider_token_vault (expires_at);
+create index auth_oauth_provider_token_vault_revoked_at_idx
+  on auth_oauth_provider_token_vault (revoked_at);`,
+};
+export const postgresAuthStorageMigration009 = {
+    id: "0009_auth_permissions",
+    sql: `create table auth_permission_definition (
+  id text collate "C" constraint auth_permission_definition_pkey primary key,
+  description text,
+  scope_type_present boolean not null,
+  scope_type text not null,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  deleted_at bigint
+);
+create index auth_permission_definition_status_idx
+  on auth_permission_definition (disabled_at, deleted_at, id);
+
+create table auth_role_definition (
+  id text constraint auth_role_definition_pkey primary key,
+  description text,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  deleted_at bigint
+);
+create index auth_role_definition_status_idx
+  on auth_role_definition (disabled_at, deleted_at, id collate "C");
+
+create table auth_permission_grant (
+  subject_type text not null,
+  subject_id text not null,
+  permission_id text not null,
+  scope_type text not null,
+  scope_id_present boolean not null,
+  scope_id text not null,
+  expires_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  constraint auth_permission_grant_pkey primary key
+    (subject_type, subject_id, permission_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_permission_grant_check_idx
+  on auth_permission_grant (subject_type, subject_id, permission_id, revoked_at, expires_at);
+
+create table auth_role_grant (
+  subject_type text not null,
+  subject_id text not null,
+  role_id text not null,
+  scope_type text not null,
+  scope_id_present boolean not null,
+  scope_id text not null,
+  expires_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  constraint auth_role_grant_pkey primary key
+    (subject_type, subject_id, role_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_role_grant_check_idx
+  on auth_role_grant (subject_type, subject_id, role_id, revoked_at, expires_at);
+
+create table auth_role_permission (
+  role_id text not null,
+  permission_id text not null,
+  scope_type_present boolean not null,
+  scope_type text not null,
+  constraint auth_role_permission_pkey primary key
+    (role_id, permission_id, scope_type_present, scope_type)
+);
+create index auth_role_permission_check_idx
+  on auth_role_permission (permission_id, role_id, scope_type_present, scope_type);`,
+};
+export const postgresAuthStorageMigrations = [
+    postgresAuthStorageMigration001,
+    postgresAuthStorageMigration002,
+    postgresAuthStorageMigration003,
+    postgresAuthStorageMigration004,
+    postgresAuthStorageMigration005,
+    postgresAuthStorageMigration006,
+    postgresAuthStorageMigration007,
+    postgresAuthStorageMigration008,
+    postgresAuthStorageMigration009,
+];
+//# sourceMappingURL=PostgresStorageMigrations.js.map

package/dist/PostgresStorageMigrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresStorageMigrations.js","sourceRoot":"","sources":["../src/PostgresStorageMigrations.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,gBAAgB;IACpB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iFA4E0E;CAChF,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,0BAA0B;IAC9B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFAgE8E;CACpF,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,8BAA8B;IAClC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFA0C8E;CACpF,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,4BAA4B;IAChC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAsGgC;CACtC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,oBAAoB;IACxB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCA4BgC;CACtC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,2BAA2B;IAC/B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8EAiDuE;CAC7E,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,yBAAyB;IAC7B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFJ;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,wBAAwB;IAC5B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDA8D4C;CAClD,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC3E,EAAE,EAAE,uBAAuB;IAC3B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oFAiE6E;CACnF,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;CACvB,CAAC"}

package/dist/Privacy.d.ts

@@ -22,9 +22,6 @@ export interface PrivacyService {
 declare const Privacy_base: Context.ServiceClass<Privacy, "auth/Privacy", PrivacyService>;
 export declare class Privacy extends Privacy_base {
 }
-export declare namespace Privacy {
-    const make: (service: PrivacyService) => PrivacyService;
-}
 export interface PrivacyOptions {
     readonly secret: CryptoKey;
     readonly normalizeEmail?: (email: Email) => string;

package/dist/Privacy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Privacy.d.ts","sourceRoot":"","sources":["../src/Privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EAAqB,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,SAAS,GAAG,iBAAiB,CAAC;;;;AAE5E,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7E,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,CACtB,SAAS,EAAE,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;CACjD;;AAED,qBAAa,OAAQ,SAAQ,YAE5B;CAAG;AAEJ,yBAAiB,OAAO,CAAC;IAChB,MAAM,IAAI,GAAI,SAAS,cAAc,KAAG,cAC1B,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAmDD,eAAO,MAAM,eAAe,GAC1B,cAAc,mBAAmB,KAChC,cA6CF,CAAC;AAEF,wBAAgB,WAAW,CACzB,OAAO,EAAE,cAAc,GACtB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACvC,wBAAgB,WAAW,IAAI,KAAK,CAAC,KAAK,CACxC,OAAO,EACP,KAAK,EACL,MAAM,GAAG,WAAW,CACrB,CAAC;AAoBF,eAAO,MAAM,eAAe,oCAO3B,CAAC"}
+{"version":3,"file":"Privacy.d.ts","sourceRoot":"","sources":["../src/Privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EAAqB,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,SAAS,GAAG,iBAAiB,CAAC;;;;AAE5E,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAEL,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC7E,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,CACtB,SAAS,EAAE,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;CACjD;;AAED,qBAAa,OAAQ,SAAQ,YAE5B;CAAG;AAEJ,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAmDD,eAAO,MAAM,eAAe,iBACZ,mBAAmB,KAChC,cA6CF,CAAC;AAEF,wBAAgB,WAAW,CACzB,OAAO,EAAE,cAAc,GACtB,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACvC,wBAAgB,WAAW,IAAI,KAAK,CAAC,KAAK,CACxC,OAAO,EACP,KAAK,EACL,MAAM,GAAG,WAAW,CACrB,CAAC;AAoBF,eAAO,MAAM,eAAe,oCAO3B,CAAC"}

package/dist/Privacy.js

@@ -6,9 +6,6 @@ export class PrivacyError extends Data.TaggedError("PrivacyError") {
 }
 export class Privacy extends Context.Service()("auth/Privacy") {
 }
-(function (Privacy) {
-    Privacy.make = (service) => Privacy.of(service);
-})(Privacy || (Privacy = {}));
 const hmacNamespace = "auth.privacy.v1";
 const normalizeEmail = (email) => String(email).trim().toLowerCase();
 const normalizeIp = (ip) => String(ip).trim();
@@ -35,7 +32,7 @@ export const makeHmacPrivacy = (dependencies) => {
     const emailNormalizer = dependencies.normalizeEmail ?? normalizeEmail;
     const ipNormalizer = dependencies.normalizeIp ?? normalizeIp;
     const userAgentNormalizer = dependencies.normalizeUserAgent ?? normalizeUserAgent;
-    return Privacy.make({
+    return Privacy.of({
         emailHash: Effect.fn("auth.privacy.email_hash")(function* (email) {
             const normalized = yield* normalizeInput("email-hash", emailNormalizer, email);
             return yield* hmacHash(dependencies, "email-hash", "email", normalized, EmailHash);
@@ -64,7 +61,7 @@ export function PrivacyLive(options) {
         });
     }));
 }
-export const PrivacyTestLive = Layer.succeed(Privacy)(Privacy.make({
+export const PrivacyTestLive = Layer.succeed(Privacy)(Privacy.of({
     emailHash: (email) => Effect.succeed(EmailHash(`test:email:${email}`)),
     ipHash: (ip) => Effect.succeed(IpHash(`test:ip:${ip}`)),
     userAgentHash: (userAgent) => Effect.succeed(UserAgentHash(`test:user-agent:${userAgent}`)),