@flow-industries/id 0.26.3 → 0.26.4

package/README.md

@@ -23,6 +23,33 @@ partially migrated schema.
 
 ### AT Protocol identity
 
+Consumers discover the signed-in user's current PDS through
+`await flow.atproto.resolve({ freshness: "cached" })`. Use `"refresh"` after an
+endpoint or authorization failure, and call `flow.atproto.invalidate()` after
+identity or migration events. Flow account switches, logout and the first-party
+linking helpers invalidate automatically. Invalidation forces the next request
+to refresh. Discovery uses the configured Auth host, cookie or Flow bearer
+session, and canonical user ID; it never provisions an account.
+
+The result includes the DID, verified display handle (or null), current PDS
+origin, hosting ownership, lifecycle and authorization status. DID documents
+are authoritative for the endpoint. No OAuth tokens or private keys are
+returned. `connected` indicates an unexpired stored grant whose audience and
+issuer match public resource metadata; it does not prove that a remote grant
+has not since been revoked. Writes must obtain fresh AT OAuth authorization,
+and must not forward old credentials to a migrated host or replay mutations
+with unknown outcomes. `AtprotoRequestError.code` distinguishes sign-in,
+missing identity, pending or failed provisioning, account changes, unsupported
+DID methods, invalid identity and unavailable resolution.
+
+`ATPROTO_MANAGED_PDS_ORIGINS` is an optional comma-separated list of public
+HTTPS PDS origins owned by Flow, used only to classify current hosting.
+`ATPROTO_RESOLUTION_TTL_MS` enables a server metadata cache keyed by DID and
+mapping version, bounded to five minutes; unset or invalid values disable
+caching. Authorization status is checked separately on each request. A cached
+authorization failure forces one fresh DID resolution. Public discovery works
+without OAuth credential configuration and reports `reconnect_required`.
+
 Bluesky and other AT Protocol accounts can sign in to Flow ID or connect to an
 existing account. Flow user IDs remain stable; the provider DID identifies the
 connection. New accounts do not need an email, passkey, or wallet to enroll.
@@ -223,3 +250,14 @@ still need complete request/response descriptions and generated client coverage
 before the full HTTP contract work is complete.
 
 Server deployments may set `FLOW_ID_API_URL` to a trusted internal HTTP(S) origin for API and JWKS requests, or pass `apiUrl` to server session/verification helpers. `issuerUrl` remains the public JWT issuer and browser navigation origin. The transport URL must contain no credentials, path, query, or fragment.
+
+PDS discovery requires explicit nonnegative integer budgets in
+`ATPROTO_RESOLUTION_USER_HOURLY_CAP` and
+`ATPROTO_RESOLUTION_GLOBAL_HOURLY_CAP`. Unset, invalid or zero budgets refuse
+outbound discovery with HTTP 429 and retryable `RESOLUTION_UNAVAILABLE`. Every discovery
+request, including cached reads and forced refreshes, consumes durable
+per-user and fleet-wide hourly admission before any provider request. Failed
+outbound attempts retain admission consumption; counters use the existing
+bounded verification retention and canonical account erasure mechanism.
+These caps bound request admission across replicas; operators must choose
+budgets appropriate to replica count, outbound latency and capacity.

package/contracts/v1/sdk-exports.json

@@ -92,6 +92,31 @@
         "type": false,
         "value": true
       },
+      {
+        "name": "AtprotoApi",
+        "type": true,
+        "value": false
+      },
+      {
+        "name": "AtprotoRequestError",
+        "type": true,
+        "value": true
+      },
+      {
+        "name": "AtprotoResolution",
+        "type": true,
+        "value": false
+      },
+      {
+        "name": "AtprotoResolutionFailure",
+        "type": true,
+        "value": false
+      },
+      {
+        "name": "AtprotoResolveOptions",
+        "type": true,
+        "value": false
+      },
       {
         "name": "BrowserAccount",
         "type": true,
@@ -142,6 +167,11 @@
         "type": false,
         "value": true
       },
+      {
+        "name": "createAtprotoApi",
+        "type": false,
+        "value": true
+      },
       {
         "name": "createDialogHost",
         "type": false,

package/dist/sdk/caller.d.ts

@@ -0,0 +1,29 @@
+import type { AppDb } from "./db/handle";
+import type { SessionUser } from "./types";
+/**
+ * Caller-identity core, shared by the dialog-facing routes and the tests. Takes
+ * the drizzle handle as a parameter (postgres-js in the server, PGlite in
+ * tests) instead of importing the singleton, which requires DATABASE_URL at
+ * import time. The singleton-bound entry point is `resolveCaller` in
+ * `routes/caller.ts`.
+ */
+/**
+ * The user behind a dialog request, and the better-auth session row that
+ * authenticated it — null when the caller presented an access JWT instead,
+ * since a bearer holds no session row.
+ */
+/** The session row as callers read it: opaque beyond the fields session-view names. */
+export type CallerSession = {
+    id: string;
+    audience?: string | null;
+};
+export type Caller = {
+    user: SessionUser;
+    session: CallerSession | null;
+};
+/**
+ * Reads the user a verified bearer's `sub` names, in the shape better-auth puts
+ * on `session.user`. Null when the subject no longer exists — a token for a
+ * deleted account is unauthorized, not a caller with an empty profile.
+ */
+export declare function loadCallerUser(dbi: AppDb, userId: string): Promise<SessionUser | null>;

package/dist/sdk/caller.js

@@ -0,0 +1,37 @@
+import { eq } from "drizzle-orm";
+import * as schema from "./db/schema";
+import { sessionUserOf } from "./session-view";
+/**
+ * The columns better-auth puts on `session.user` (base fields plus the
+ * configured `additionalFields`), so a bearer-authenticated caller reads back
+ * the same user shape a cookie-authenticated one does. `sessionEpoch` is
+ * deliberately absent: it is an internal revocation lever, not profile data.
+ */
+const USER_COLUMNS = {
+    id: schema.user.id,
+    name: schema.user.name,
+    username: schema.user.username,
+    email: schema.user.email,
+    emailVerified: schema.user.emailVerified,
+    image: schema.user.image,
+    bio: schema.user.bio,
+    isGuest: schema.user.isGuest,
+    role: schema.user.role,
+    walletAddress: schema.user.walletAddress,
+    subscribedToNews: schema.user.subscribedToNews,
+    createdAt: schema.user.createdAt,
+    updatedAt: schema.user.updatedAt,
+};
+/**
+ * Reads the user a verified bearer's `sub` names, in the shape better-auth puts
+ * on `session.user`. Null when the subject no longer exists — a token for a
+ * deleted account is unauthorized, not a caller with an empty profile.
+ */
+export async function loadCallerUser(dbi, userId) {
+    const [user] = await dbi
+        .select(USER_COLUMNS)
+        .from(schema.user)
+        .where(eq(schema.user.id, userId))
+        .limit(1);
+    return user ? sessionUserOf(user) : null;
+}

package/dist/sdk/client/atproto-resolver.d.ts

@@ -0,0 +1,8 @@
+import type { AtprotoApi, AtprotoResolutionFailure } from "../types/atproto";
+export declare class AtprotoRequestError extends Error {
+    readonly code: AtprotoResolutionFailure;
+    readonly retryable: boolean;
+    constructor(code: AtprotoResolutionFailure, retryable?: boolean);
+}
+/** Identity changes and migration completion should invalidate before another discovery. */
+export declare function createAtprotoApi(host: string, getToken: () => Promise<string | null>, getUserId: () => string | null): AtprotoApi;

package/dist/sdk/client/atproto-resolver.js

@@ -0,0 +1,87 @@
+import { z } from "zod";
+const failureSchema = z.enum([
+    "SIGN_IN_REQUIRED",
+    "NO_AT_IDENTITY",
+    "PROVISIONING_PENDING",
+    "PROVISIONING_FAILED",
+    "ACCOUNT_CHANGED",
+    "UNSUPPORTED_DID_METHOD",
+    "IDENTITY_INVALID",
+    "RESOLUTION_UNAVAILABLE",
+]);
+const resolutionSchema = z.object({
+    flowUserId: z.string(),
+    did: z.string(),
+    handle: z.string().nullable(),
+    pdsUrl: z.url(),
+    hosting: z.enum(["flow", "external"]),
+    lifecycle: z.enum(["active", "suspended", "migrated", "deletion_pending"]),
+    authorization: z.enum(["connected", "reconnect_required"]),
+    resolvedAt: z.iso.datetime(),
+    expiresAt: z.iso.datetime(),
+    identityVersion: z.string(),
+});
+export class AtprotoRequestError extends Error {
+    code;
+    retryable;
+    constructor(code, retryable = false) {
+        super(code);
+        this.code = code;
+        this.retryable = retryable;
+        this.name = "AtprotoRequestError";
+    }
+}
+/** Identity changes and migration completion should invalidate before another discovery. */
+export function createAtprotoApi(host, getToken, getUserId) {
+    let generation = 0;
+    let dirty = false;
+    return {
+        invalidate() {
+            generation++;
+            dirty = true;
+        },
+        async resolve(options = {}) {
+            options.signal?.throwIfAborted();
+            const userId = getUserId();
+            if (!userId)
+                throw new AtprotoRequestError("SIGN_IN_REQUIRED");
+            const requestGeneration = generation;
+            const unchanged = () => {
+                if (generation !== requestGeneration || getUserId() !== userId)
+                    throw new AtprotoRequestError("ACCOUNT_CHANGED");
+            };
+            const token = await getToken();
+            unchanged();
+            const headers = new Headers({ "X-Flow-User-Id": userId });
+            if (token)
+                headers.set("Authorization", `Bearer ${token}`);
+            let response;
+            try {
+                response = await fetch(`${host}/api/atproto/resolve?freshness=${dirty ? "refresh" : (options.freshness ?? "cached")}`, { headers, credentials: "include", signal: options.signal });
+            }
+            catch {
+                options.signal?.throwIfAborted();
+                unchanged();
+                throw new AtprotoRequestError("RESOLUTION_UNAVAILABLE", true);
+            }
+            unchanged();
+            const body = await response.json().catch(() => null);
+            options.signal?.throwIfAborted();
+            unchanged();
+            if (!response.ok) {
+                const parsed = z.object({ code: failureSchema }).safeParse(body);
+                const code = parsed.success
+                    ? parsed.data.code
+                    : "RESOLUTION_UNAVAILABLE";
+                throw new AtprotoRequestError(code, ["RESOLUTION_UNAVAILABLE", "PROVISIONING_PENDING"].includes(code));
+            }
+            const parsed = resolutionSchema.safeParse(body);
+            if (!parsed.success)
+                throw new AtprotoRequestError("IDENTITY_INVALID");
+            if (parsed.data.flowUserId !== userId)
+                throw new AtprotoRequestError("ACCOUNT_CHANGED");
+            dirty = false;
+            return parsed.data;
+        },
+    };
+}

package/dist/sdk/client/atproto.js

@@ -1,3 +1,4 @@
+import { getFlow } from "./create-flow";
 async function readResponse(response) {
     const body = await response.json();
     if (!response.ok)
@@ -17,6 +18,7 @@ export async function unlinkAtproto(expectedUserId) {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ expectedUserId }),
     }));
+    getFlow()?.atproto.invalidate();
 }
 const completionKey = "flow.atproto.completion";
 export async function connectAtproto(request, signal) {
@@ -30,6 +32,7 @@ export async function connectAtproto(request, signal) {
     }));
     signal.throwIfAborted();
     sessionStorage.setItem(completionKey, result.completionToken);
+    getFlow()?.atproto.invalidate();
     window.location.assign(result.url);
 }
 let completion = null;
@@ -44,6 +47,11 @@ export function completeAtproto() {
         credentials: "include",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ completionToken }),
-    }).then((readResponse));
+    })
+        .then((readResponse))
+        .then((result) => {
+        getFlow()?.atproto.invalidate();
+        return result;
+    });
     return completion;
 }

package/dist/sdk/client/create-flow.js

@@ -1,6 +1,7 @@
 import { BROWSER_FLOW_TTL_MS } from "../browser-contract";
 import { DEFAULT_SESSION_PATH, isLocalHostname, resolveIdHost, } from "../id-host";
 import { isExpiring } from "../token-expiry";
+import { createAtprotoApi } from "./atproto-resolver";
 import { createDialogHost } from "./dialog-host";
 import { idb } from "./idb";
 import { createRoomsApi } from "./rooms";
@@ -510,6 +511,14 @@ export function createFlow(options = {}) {
     };
     window.addEventListener("focus", refreshOnFocus);
     document.addEventListener("visibilitychange", refreshOnFocus);
+    const atproto = createAtprotoApi(host, getToken, () => store.getSnapshot().user?.id ?? null);
+    let resolverUserId = store.getSnapshot().user?.id ?? null;
+    store.subscribe((state) => {
+        const userId = state.user?.id ?? null;
+        if (userId !== resolverUserId)
+            atproto.invalidate();
+        resolverUserId = userId;
+    });
     const flow = {
         get user() {
             return store.getSnapshot().user;
@@ -541,6 +550,7 @@ export function createFlow(options = {}) {
         getToken,
         mintAudience,
         rooms: createRoomsApi(host, getToken),
+        atproto,
         signMessage: async (args) => {
             const mod = await import("./signing");
             return mod.signMessage(buildSigningContext(), args);

package/dist/sdk/client/index.d.ts

@@ -1,7 +1,8 @@
 export { defaultIdHost, isLocalHostname } from "../id-host";
-export type { AccessKeyOptions, ActionCatalogEntry, ActionCatalogResponse, ActionCurve, ActionEventRequest, ActionEventResponse, ActionSubjectRef, ActionSurface, ActionsApi, ActionTransitionKind, ActiveAction, ActiveActionResponse, ActiveSessionConflict, AdditionalSession, Address, BrowserAccount, BrowserAccounts, CatalogFieldRef, ClockAnchor, ConnectCapabilities, ConnectResponse, CreateFlowOptions, CreateStudySubjectInput, CurrentAction, DialogHost, FinishActionRequest, FinishActionResponse, FinishedSummary, Flow, FlowCredential, FlowSessionState, FlowState, FlowUser, FlowWidgetHandle, FlowWidgetName, FocusApi, FocusPhase, FocusSessionEvent, FocusSessionState, ListStudySessionsOptions, ListStudySubjectsOptions, LoginOptions, MarkNotificationsReadInput, MethodName, MountFlowWidgetOptions, MountProfileOptions, NotificationCounts, NotificationEntry, NotificationPage, NotificationReadResult, NotificationRefusal, OpenProfileOptions, ProfileButtonHandle, ProfilePosition, RoomMemberEntry, Session, StartActionInput, StartActionResponse, StartActionResult, StartFocusRequest, StudyApi, StudyCatalog, StudyCategory, StudyCategoryTotals, StudyField, StudyRange, StudySearchHit, StudySessionEntry, StudySessionPage, StudySubject, StudySubjectList, StudySubjectRefusal, StudySubjectRemovalResponse, StudySubjectResponse, StudySubjectTotals, StudySummary, SwitchAccountOptions, UpdateStudySubjectInput, UserActionSurface, XpEstimateContext, XpMode, } from "../types";
+export type { AccessKeyOptions, ActionCatalogEntry, ActionCatalogResponse, ActionCurve, ActionEventRequest, ActionEventResponse, ActionSubjectRef, ActionSurface, ActionsApi, ActionTransitionKind, ActiveAction, ActiveActionResponse, ActiveSessionConflict, AdditionalSession, Address, AtprotoApi, AtprotoResolution, AtprotoResolutionFailure, AtprotoResolveOptions, BrowserAccount, BrowserAccounts, CatalogFieldRef, ClockAnchor, ConnectCapabilities, ConnectResponse, CreateFlowOptions, CreateStudySubjectInput, CurrentAction, DialogHost, FinishActionRequest, FinishActionResponse, FinishedSummary, Flow, FlowCredential, FlowSessionState, FlowState, FlowUser, FlowWidgetHandle, FlowWidgetName, FocusApi, FocusPhase, FocusSessionEvent, FocusSessionState, ListStudySessionsOptions, ListStudySubjectsOptions, LoginOptions, MarkNotificationsReadInput, MethodName, MountFlowWidgetOptions, MountProfileOptions, NotificationCounts, NotificationEntry, NotificationPage, NotificationReadResult, NotificationRefusal, OpenProfileOptions, ProfileButtonHandle, ProfilePosition, RoomMemberEntry, Session, StartActionInput, StartActionResponse, StartActionResult, StartFocusRequest, StudyApi, StudyCatalog, StudyCategory, StudyCategoryTotals, StudyField, StudyRange, StudySearchHit, StudySessionEntry, StudySessionPage, StudySubject, StudySubjectList, StudySubjectRefusal, StudySubjectRemovalResponse, StudySubjectResponse, StudySubjectTotals, StudySummary, SwitchAccountOptions, UpdateStudySubjectInput, UserActionSurface, XpEstimateContext, XpMode, } from "../types";
 export { consistencyCurve, estimateActionXp, FLOW_SCORE_MAX, flowMultiplier, } from "../xp/curve";
 export { ActionsRequestError, createActionsApi, isActiveSessionConflict, } from "./actions";
+export { AtprotoRequestError, createAtprotoApi } from "./atproto-resolver";
 export { createFlow, getFlow, requireFlow, resetFlow } from "./create-flow";
 export { createDialogHost } from "./dialog-host";
 export { createFlowWidget } from "./flow-widget";

package/dist/sdk/client/index.js

@@ -1,6 +1,7 @@
 export { defaultIdHost, isLocalHostname } from "../id-host";
 export { consistencyCurve, estimateActionXp, FLOW_SCORE_MAX, flowMultiplier, } from "../xp/curve";
 export { ActionsRequestError, createActionsApi, isActiveSessionConflict, } from "./actions";
+export { AtprotoRequestError, createAtprotoApi } from "./atproto-resolver";
 export { createFlow, getFlow, requireFlow, resetFlow } from "./create-flow";
 export { createDialogHost } from "./dialog-host";
 export { createFlowWidget } from "./flow-widget";

package/dist/sdk/client/static-flow.js

@@ -1,4 +1,5 @@
 import { resolveIdHost } from "../id-host";
+import { createAtprotoApi } from "./atproto-resolver";
 import { createRoomsApi } from "./rooms";
 function unavailable(method) {
     throw new Error(`flow.${method} is not available on a static Flow — it renders ` +
@@ -55,6 +56,7 @@ export function createStaticFlow(state, options = {}) {
         getToken,
         mintAudience: async () => null,
         rooms: createRoomsApi(host, getToken),
+        atproto: createAtprotoApi(host, getToken, () => snapshot.user?.id ?? null),
         signMessage: () => unavailable("signMessage"),
         signTypedData: () => unavailable("signTypedData"),
         sendTransaction: () => unavailable("sendTransaction"),

package/dist/sdk/db/invitations.d.ts

@@ -0,0 +1,310 @@
+export declare const signupPolicy: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "signup_policy";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "signup_policy";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        invitationOnly: import("drizzle-orm/pg-core").PgColumn<{
+            name: "invitation_only";
+            tableName: "signup_policy";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_by";
+            tableName: "signup_policy";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "signup_policy";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const invitation: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "invitation";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "invitation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        codeHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "code_hash";
+            tableName: "invitation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        inviterId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "inviter_id";
+            tableName: "invitation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by";
+            tableName: "invitation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        maxUses: import("drizzle-orm/pg-core").PgColumn<{
+            name: "max_uses";
+            tableName: "invitation";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        usedCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "used_count";
+            tableName: "invitation";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "invitation";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "invitation";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: "invitation";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const invitationRedemption: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "invitation_redemption";
+    schema: undefined;
+    columns: {
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "invitation_redemption";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        invitationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "invitation_id";
+            tableName: "invitation_redemption";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        inviterId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "inviter_id";
+            tableName: "invitation_redemption";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        redeemedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "redeemed_at";
+            tableName: "invitation_redemption";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;