@logto/schemas 1.42.0 → 1.44.0

package/alterations/1.43.0-1785393731-add-oidc-model-instances-account-id-partial-index.ts

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    // Add index to optimize revoking access tokens and refresh tokens by accountId.
+    // See the index comment in tables/oidc_model_instances.sql for the predicate rationale.
+    await pool.query(sql`
+      create index concurrently oidc_model_instances__model_name_payload_account_id_partial
+        on oidc_model_instances (tenant_id, model_name, (payload->>'accountId'))
+        where payload ? 'accountId';
+    `);
+
+    // Collect expression statistics right away instead of waiting for autovacuum.
+    await pool.query(sql`
+      analyze oidc_model_instances;
+    `);
+  },
+  up: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently oidc_model_instances__model_name_payload_account_id_partial;
+    `);
+  },
+  down: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785481546-add-tenant-aware-scope-indexes.ts

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    await pool.query(sql`
+      create unique index concurrently scopes__tenant_id_id
+        on scopes (tenant_id, id);
+    `);
+
+    await pool.query(sql`
+      create unique index concurrently organization_scopes__tenant_id_id
+        on organization_scopes (tenant_id, id);
+    `);
+  },
+  up: async () => {
+    // The indexes must be created outside of a transaction.
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists organization_scopes__tenant_id_id;
+    `);
+    await pool.query(sql`
+      drop index concurrently if exists scopes__tenant_id_id;
+    `);
+  },
+  down: async () => {
+    // The indexes must be dropped outside of a transaction.
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785488115-add-cimd-permission-ceiling-tables.ts

@@ -0,0 +1,77 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+/**
+ * Add the tenant-level permission ceiling tables for client ID metadata document (CIMD) clients.
+ * The ceiling is tenant-wide because CIMD clients are unregistered and have no per-client record
+ * to attach configuration to. The tables reference the tenant and scope tables directly (not the
+ * CIMD config row), so disabling CIMD does not wipe the permission settings.
+ * Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not
+ * expressible.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table cimd_user_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        user_scope varchar(64) not null,
+        primary key (tenant_id, user_scope)
+      );
+    `);
+    await applyTableRls(pool, 'cimd_user_scopes');
+
+    await pool.query(sql`
+      create table cimd_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_resource_scopes');
+
+    await pool.query(sql`
+      create table cimd_organization_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        organization_scope_id varchar(21) not null,
+        primary key (tenant_id, organization_scope_id),
+        foreign key (tenant_id, organization_scope_id)
+          references organization_scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_organization_scopes');
+
+    await pool.query(sql`
+      create table cimd_organization_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_organization_resource_scopes');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'cimd_organization_resource_scopes');
+    await dropTableRls(pool, 'cimd_organization_scopes');
+    await dropTableRls(pool, 'cimd_resource_scopes');
+    await dropTableRls(pool, 'cimd_user_scopes');
+    await pool.query(sql`
+      drop table cimd_organization_resource_scopes;
+      drop table cimd_organization_scopes;
+      drop table cimd_resource_scopes;
+      drop table cimd_user_scopes;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785722831-add-oidc-session-extensions-account-id-index.ts

@@ -0,0 +1,27 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    // Add index to optimize deleting session extensions by accountId, including the
+    // cascades from the users table. See the index comment in tables/oidc_session_extensions.sql.
+    await pool.query(sql`
+      create index concurrently oidc_session_extensions__account_id
+        on oidc_session_extensions (account_id);
+    `);
+  },
+  up: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently oidc_session_extensions__account_id;
+    `);
+  },
+  down: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785835991-add-cimd-client-identifier-columns.ts

@@ -0,0 +1,31 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * Registered application IDs (21 chars, referencing `applications`) and CIMD (client ID metadata
+ * document) client identifier URLs are different value spaces, so each gets its own column instead
+ * of sharing one.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table users
+        add column cimd_client_id varchar(2048);
+
+      alter table oidc_session_extensions
+        add column cimd_client_id varchar(2048);
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table users
+        drop column cimd_client_id;
+
+      alter table oidc_session_extensions
+        drop column cimd_client_id;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786325989-add-cimd-grant-organizations-table.ts

@@ -0,0 +1,54 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+/**
+ * Add the grant-scoped organization authorization table for client ID metadata document (CIMD)
+ * clients. CIMD clients are unregistered URL identities with no deletion lifecycle and
+ * transferable ownership, so organization access follows the single authorization instead of a
+ * long-lived cross-grant relation: rows cascade away with the Grant row (revocation hard-deletes
+ * it) and with the user's organization membership.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table cimd_grant_organizations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        grant_id varchar(128) not null,
+        grant_model_name varchar(64) not null default 'Grant',
+        organization_id varchar(21) not null,
+        user_id varchar(21) not null,
+        primary key (tenant_id, grant_id, organization_id),
+        constraint cimd_grant_organizations__grant_model_name
+          check (grant_model_name = 'Grant'),
+        foreign key (tenant_id, grant_model_name, grant_id)
+          references oidc_model_instances (tenant_id, model_name, id)
+          on update cascade on delete cascade,
+        foreign key (tenant_id, organization_id, user_id)
+          references organization_user_relations (tenant_id, organization_id, user_id)
+          on update cascade on delete cascade
+      );
+    `);
+    /**
+     * Backs the membership FK's cascade lookup; the PK leaves `organization_id` outside its
+     * usable prefix. The table is created empty in this transaction, so a plain (non-concurrent)
+     * index build is free.
+     */
+    await pool.query(sql`
+      create index cimd_grant_organizations__organization_id_user_id
+        on cimd_grant_organizations (tenant_id, organization_id, user_id);
+    `);
+    await applyTableRls(pool, 'cimd_grant_organizations');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'cimd_grant_organizations');
+    await pool.query(sql`
+      drop table cimd_grant_organizations;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786333495-add-trusted-devices.ts

@@ -0,0 +1,57 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table trusted_devices (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        id varchar(21) not null,
+        user_id varchar(12) not null
+          references users (id) on update cascade on delete cascade,
+        secret_hash bytea not null,
+        user_agent text,
+        ip text,
+        country varchar(16),
+        city text,
+        created_at timestamptz not null default(now()),
+        last_used_at timestamptz not null default(now()),
+        expires_at timestamptz not null,
+        primary key (id)
+      );
+
+      create index trusted_devices__tenant_user_expires_at
+        on trusted_devices (tenant_id, user_id, expires_at);
+
+      create index trusted_devices__tenant_expires_at
+        on trusted_devices (tenant_id, expires_at);
+
+      alter table sign_in_experiences
+        add column trusted_device jsonb not null default '{}'::jsonb;
+
+      alter table organizations
+        add column is_trusted_device_allowed boolean not null default true;
+    `);
+
+    await applyTableRls(pool, 'trusted_devices');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'trusted_devices');
+
+    await pool.query(sql`
+      drop table trusted_devices;
+
+      alter table sign_in_experiences
+        drop column trusted_device;
+
+      alter table organizations
+        drop column is_trusted_device_allowed;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786373004-tighten-cimd-grant-organizations-pkey.ts

@@ -0,0 +1,28 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * Tighten the `cimd_grant_organizations` primary key to `(tenant_id, grant_id)` so the schema
+ * itself enforces the at-most-one-organization-per-grant invariant that token issuance relies on,
+ * instead of leaving it to the consent flow's composition. The table is dev-feature-gated and
+ * empty in every environment, so swapping the constraint needs no data migration.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id);
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id, organization_id);
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786414712-add-service-logs-email-indexes.ts

@@ -0,0 +1,34 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    await pool.query(sql`
+      create index concurrently service_logs__email__tenant_id__created_at__id
+        on service_logs (tenant_id, created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+    await pool.query(sql`
+      create index concurrently service_logs__email__tenant_id__recipient__created_at__id
+        on service_logs (tenant_id, lower(payload->'data'->>'to'), created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+  },
+  up: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently service_logs__email__tenant_id__recipient__created_at__id;
+    `);
+    await pool.query(sql`
+      drop index concurrently service_logs__email__tenant_id__created_at__id;
+    `);
+  },
+  down: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786431364-add-cimd-grant-client-snapshots-table.ts

@@ -0,0 +1,43 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+/**
+ * Add the per-grant client display snapshot table for client ID metadata document (CIMD) clients.
+ * CIMD clients are unregistered URL identities without an `applications` row, and an unvetted
+ * client can rewrite its hosted document at any time — so the grant list renders the snapshot
+ * captured at consent instead of refetching the document. Rows cascade away with the Grant row.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table cimd_grant_client_snapshots (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        grant_id varchar(128) not null,
+        grant_model_name varchar(64) not null default 'Grant',
+        client_id varchar(2048) not null,
+        name varchar(256),
+        logo_uri varchar(2048),
+        created_at timestamptz not null default(now()),
+        primary key (tenant_id, grant_id),
+        constraint cimd_grant_client_snapshots__grant_model_name
+          check (grant_model_name = 'Grant'),
+        foreign key (tenant_id, grant_model_name, grant_id)
+          references oidc_model_instances (tenant_id, model_name, id)
+          on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_grant_client_snapshots');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'cimd_grant_client_snapshots');
+    await pool.query(sql`
+      drop table cimd_grant_client_snapshots;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.44.0-1788946735-add-saml-authn-request-config.ts

@@ -0,0 +1,18 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table saml_application_configs add column authn_request_config jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table saml_application_configs drop column authn_request_config;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.44.0-1789000000-extend-user-id-length.ts

@@ -0,0 +1,61 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * Widen `users.id` and every column that references it to varchar(128).
+ *
+ * Users migrated from other identity providers may carry over their original IDs, which are
+ * often longer than the 12 or 21 characters previously allowed.
+ */
+
+type Column = [table: string, column: string, originalLength: 12 | 21];
+
+const columns: Column[] = [
+  ['users', 'id', 12],
+  ['user_sign_in_countries', 'user_id', 12],
+  ['user_geo_locations', 'user_id', 12],
+  ['trusted_devices', 'user_id', 12],
+  ['user_sso_identities', 'user_id', 12],
+  ['oidc_session_extensions', 'account_id', 12],
+  ['users_roles', 'user_id', 21],
+  ['organization_user_relations', 'user_id', 21],
+  ['organization_role_user_relations', 'user_id', 21],
+  ['organization_invitations', 'inviter_id', 21],
+  ['organization_invitations', 'accepted_user_id', 21],
+  ['subject_tokens', 'user_id', 21],
+  ['verification_statuses', 'user_id', 21],
+  ['verification_records', 'user_id', 21],
+  ['secrets', 'user_id', 21],
+  ['personal_access_tokens', 'user_id', 21],
+  ['application_access_control_user_relations', 'user_id', 21],
+  ['application_user_consent_organizations', 'user_id', 21],
+  ['cimd_grant_organizations', 'user_id', 21],
+  ['daily_active_users', 'user_id', 21],
+  ['aggregated_daily_active_users', 'user_id', 21],
+];
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    for (const [table, column] of columns) {
+      // eslint-disable-next-line no-await-in-loop -- DDL statements must run sequentially
+      await pool.query(sql`
+        alter table ${sql.identifier([table])}
+        alter column ${sql.identifier([column])} type varchar(128)
+      `);
+    }
+  },
+  down: async (pool) => {
+    // Shrinking fails if any existing value is longer than the original limit; there is no
+    // safe way to truncate an ID, so let Postgres reject the rollback in that case.
+    for (const [table, column, originalLength] of columns) {
+      // eslint-disable-next-line no-await-in-loop -- DDL statements must run sequentially
+      await pool.query(sql`
+        alter table ${sql.identifier([table])}
+        alter column ${sql.identifier([column])} type varchar(${sql.raw(String(originalLength))})
+      `);
+    }
+  },
+};
+
+export default alteration;

package/alterations-js/1.43.0-1785393731-add-oidc-model-instances-account-id-partial-index.js

@@ -0,0 +1,28 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        // Add index to optimize revoking access tokens and refresh tokens by accountId.
+        // See the index comment in tables/oidc_model_instances.sql for the predicate rationale.
+        await pool.query(sql `
+      create index concurrently oidc_model_instances__model_name_payload_account_id_partial
+        on oidc_model_instances (tenant_id, model_name, (payload->>'accountId'))
+        where payload ? 'accountId';
+    `);
+        // Collect expression statistics right away instead of waiting for autovacuum.
+        await pool.query(sql `
+      analyze oidc_model_instances;
+    `);
+    },
+    up: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently oidc_model_instances__model_name_payload_account_id_partial;
+    `);
+    },
+    down: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1785481546-add-tenant-aware-scope-indexes.js

@@ -0,0 +1,28 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        await pool.query(sql `
+      create unique index concurrently scopes__tenant_id_id
+        on scopes (tenant_id, id);
+    `);
+        await pool.query(sql `
+      create unique index concurrently organization_scopes__tenant_id_id
+        on organization_scopes (tenant_id, id);
+    `);
+    },
+    up: async () => {
+        // The indexes must be created outside of a transaction.
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists organization_scopes__tenant_id_id;
+    `);
+        await pool.query(sql `
+      drop index concurrently if exists scopes__tenant_id_id;
+    `);
+    },
+    down: async () => {
+        // The indexes must be dropped outside of a transaction.
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1785488115-add-cimd-permission-ceiling-tables.js

@@ -0,0 +1,69 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+/**
+ * Add the tenant-level permission ceiling tables for client ID metadata document (CIMD) clients.
+ * The ceiling is tenant-wide because CIMD clients are unregistered and have no per-client record
+ * to attach configuration to. The tables reference the tenant and scope tables directly (not the
+ * CIMD config row), so disabling CIMD does not wipe the permission settings.
+ * Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not
+ * expressible.
+ */
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table cimd_user_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        user_scope varchar(64) not null,
+        primary key (tenant_id, user_scope)
+      );
+    `);
+        await applyTableRls(pool, 'cimd_user_scopes');
+        await pool.query(sql `
+      create table cimd_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_resource_scopes');
+        await pool.query(sql `
+      create table cimd_organization_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        organization_scope_id varchar(21) not null,
+        primary key (tenant_id, organization_scope_id),
+        foreign key (tenant_id, organization_scope_id)
+          references organization_scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_organization_scopes');
+        await pool.query(sql `
+      create table cimd_organization_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+        await applyTableRls(pool, 'cimd_organization_resource_scopes');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'cimd_organization_resource_scopes');
+        await dropTableRls(pool, 'cimd_organization_scopes');
+        await dropTableRls(pool, 'cimd_resource_scopes');
+        await dropTableRls(pool, 'cimd_user_scopes');
+        await pool.query(sql `
+      drop table cimd_organization_resource_scopes;
+      drop table cimd_organization_scopes;
+      drop table cimd_resource_scopes;
+      drop table cimd_user_scopes;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1785722831-add-oidc-session-extensions-account-id-index.js

@@ -0,0 +1,23 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        // Add index to optimize deleting session extensions by accountId, including the
+        // cascades from the users table. See the index comment in tables/oidc_session_extensions.sql.
+        await pool.query(sql `
+      create index concurrently oidc_session_extensions__account_id
+        on oidc_session_extensions (account_id);
+    `);
+    },
+    up: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently oidc_session_extensions__account_id;
+    `);
+    },
+    down: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+    },
+};
+export default alteration;