@protobase/server 0.47.1 → 0.49.0

package/dist/better-auth/saml-plugin.js

@@ -0,0 +1,36 @@
+import { samlEntityId } from "./saml-sign-in.js";
+import { sso } from "@better-auth/sso";
+//#region src/better-auth/saml-plugin.ts
+/** The provider as one of the SSO plugin's configured providers (`defaultSSO`). */
+const defaultSsoEntry = (provider, baseURL) => {
+	const { idp, attributes = {} } = provider;
+	const mapping = Object.fromEntries(Object.entries(attributes).filter(([, name]) => name !== void 0));
+	return {
+		providerId: provider.id,
+		domain: provider.domains.join(","),
+		samlConfig: {
+			issuer: samlEntityId(baseURL, provider.id),
+			entryPoint: "ssoUrl" in idp ? idp.ssoUrl : "",
+			idpMetadata: "metadata" in idp ? { metadata: idp.metadata } : {
+				entityID: idp.entityId,
+				cert: idp.certificate
+			},
+			...Object.keys(mapping).length > 0 && { mapping }
+		}
+	};
+};
+/**
+* Better Auth's SSO plugin with the configured providers. Their domains are trusted, so an address there links to the
+* account that has it; organizations are not assigned by provider, and nobody registers providers.
+*/
+const samlPlugin = (providers, baseURL) => {
+	const { schema: _schema, ...plugin } = sso({
+		defaultSSO: providers.map((provider) => defaultSsoEntry(provider, baseURL)),
+		domainVerification: { enabled: true },
+		organizationProvisioning: { disabled: true },
+		providersLimit: 0
+	});
+	return plugin;
+};
+//#endregion
+export { defaultSsoEntry, samlPlugin };

package/dist/better-auth/saml-sign-in.d.ts

@@ -1,4 +1,3 @@
-import "@better-auth/sso";
 //#region src/better-auth/saml-sign-in.d.ts
 /**
  * A SAML 2.0 identity provider people of the app sign in with, for example the company's Okta, Entra ID or Google
@@ -34,4 +33,31 @@ export type SamlProvider = {
 export type SsoOptions = {
   saml: SamlProvider[];
 };
+/**
+ * The providers with their defaults filled in: the name `SSO`, and the domains trimmed and lowercased. A malformed id,
+ * an id used twice or by another sign-in provider (`takenIds`), no domains or a domain that is not a host name, and IdP
+ * settings that are missing or not a URL are errors.
+ */
+export declare const resolveSamlProviders: (saml: SamlProvider[], takenIds: string[]) => {
+  name: string;
+  domains: string[];
+  /** The id: the button's `?sign-in=` link, the provider's paths and the namespace of its accounts. Lowercase letters, digits or "-". */
+  id: string;
+  /** The provider's metadata XML, or its entity ID, sign-in URL and signing certificate(s) (PEM; several while one rotates). */
+  idp: {
+    metadata: string;
+  } | {
+    entityId: string;
+    ssoUrl: string;
+    certificate: string | string[];
+  };
+  /** The assertion's attribute names, when they are not `email`, `givenName`, `surname` and `displayName`. */
+  attributes?: {
+    email?: string;
+    name?: string;
+    firstName?: string;
+    lastName?: string;
+  };
+}[];
+export type ResolvedSamlProvider = ReturnType<typeof resolveSamlProviders>[number];
 //#endregion

package/dist/better-auth/saml-sign-in.js

@@ -1,7 +1,6 @@
 import { authBasePath } from "./auth-base-path.js";
 import { providerIdPattern } from "./platform-sign-in.js";
 import { APIError, createAuthMiddleware } from "better-auth/api";
-import { sso } from "@better-auth/sso";
 //#region src/better-auth/saml-sign-in.ts
 const domainPattern = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
 const checkIdp = (id, idp) => {
@@ -37,37 +36,6 @@ const resolveSamlProviders = (saml, takenIds) => {
 };
 /** The app's SP entity ID for a provider: its metadata URL on `baseURL`, the same on every origin. */
 const samlEntityId = (baseURL, id) => `${baseURL.replace(/\/$/, "")}${authBasePath}/sso/saml2/sp/metadata?providerId=${encodeURIComponent(id)}`;
-/** The provider as one of the SSO plugin's configured providers (`defaultSSO`). */
-const defaultSsoEntry = (provider, baseURL) => {
-	const { idp, attributes = {} } = provider;
-	const mapping = Object.fromEntries(Object.entries(attributes).filter(([, name]) => name !== void 0));
-	return {
-		providerId: provider.id,
-		domain: provider.domains.join(","),
-		samlConfig: {
-			issuer: samlEntityId(baseURL, provider.id),
-			entryPoint: "ssoUrl" in idp ? idp.ssoUrl : "",
-			idpMetadata: "metadata" in idp ? { metadata: idp.metadata } : {
-				entityID: idp.entityId,
-				cert: idp.certificate
-			},
-			...Object.keys(mapping).length > 0 && { mapping }
-		}
-	};
-};
-/**
-* Better Auth's SSO plugin with the configured providers. Their domains are trusted, so an address there links to the
-* account that has it; organizations are not assigned by provider, and nobody registers providers.
-*/
-const samlPlugin = (providers, baseURL) => {
-	const { schema: _schema, ...plugin } = sso({
-		defaultSSO: providers.map((provider) => defaultSsoEntry(provider, baseURL)),
-		domainVerification: { enabled: true },
-		organizationProvisioning: { disabled: true },
-		providersLimit: 0
-	});
-	return plugin;
-};
 /** The SSO plugin's endpoints for providers kept in its table, and its OIDC callback, which Protobase does not serve. */
 const samlDisabledPaths = [
 	"/sso/register",
@@ -130,4 +98,4 @@ const emailInDomains = (email, domains) => {
 	return domains.some((allowed) => domain === allowed || domain.endsWith(`.${allowed}`));
 };
 //#endregion
-export { defaultSsoEntry, emailInDomains, isSamlPath, resolveSamlProviders, samlDisabledPaths, samlEntityId, samlGuardPlugin, samlPlugin, samlRefusal };
+export { emailInDomains, isSamlPath, resolveSamlProviders, samlDisabledPaths, samlEntityId, samlGuardPlugin, samlRefusal };

package/dist/better-auth/store/adoption.js

@@ -0,0 +1,87 @@
+import { ddl } from "./ddl.js";
+import { migrationNames } from "./migrations/migration.js";
+import { storeMigrations } from "./migrations/index.js";
+import { recordMigrations } from "./migrations-table.js";
+import { statementsSql } from "./migration-sql.js";
+import { sql } from "kysely";
+//#region src/better-auth/store/adoption.ts
+const key = ({ table, column }) => `${table}.${column}`;
+const columnsIn = async (db, schema) => (await sql`select table_name as "table", column_name as "column", udt_name as "type" from information_schema.columns
+      where table_schema = ${schema === void 0 ? sql`current_schema()` : schema} order by table_name, ordinal_position`.execute(db)).rows;
+const scratchSchema = "protobase_auth_adoption";
+/** For each migration, the columns it makes: every one runs in a scratch schema, in a transaction that is rolled back. */
+const madeColumns = async (db, names) => {
+	const tx = await db.startTransaction().execute();
+	const run = async () => {
+		await sql`create schema ${sql.id(scratchSchema)}`.execute(tx);
+		const scratch = migrationNames({
+			...names,
+			schema: scratchSchema
+		});
+		const made = [];
+		let before = [];
+		for (const migration of storeMigrations) {
+			for (const statement of migration.statements(scratch)) await statement.execute(tx);
+			const after = await columnsIn(tx, scratchSchema);
+			made.push(after.filter((column) => !before.some((earlier) => key(earlier) === key(column))));
+			before = after;
+		}
+		return made;
+	};
+	return run().finally(() => tx.rollback().execute());
+};
+/** Whether the store has any table of the migrations besides the user table, which may be another system's. */
+const storeHasTables = async (db, names) => {
+	const tables = new Set((await columnsIn(db, names.schema)).map((column) => column.table));
+	return storeMigrations.some((migration) => migration.tables.some((table) => tables.has(table)));
+};
+/** Which migrations the store matches and which it still needs; a migration it matches only partly is an error. */
+const planAdoption = async (db, names) => {
+	const made = await madeColumns(db, names);
+	const found = new Map((await columnsIn(db, names.schema)).map((column) => [key(column), column.type]));
+	const adoption = {
+		adopted: [],
+		pending: []
+	};
+	const problems = [];
+	storeMigrations.forEach((migration, i) => {
+		const columns = made[i];
+		const there = columns.filter((column) => found.has(key(column)));
+		if (there.length === 0) return void adoption.pending.push(migration);
+		const missing = columns.filter((column) => !found.has(key(column))).map((column) => `lacks ${key(column)}`);
+		const otherType = there.filter((column) => found.get(key(column)) !== column.type).map((column) => `has ${key(column)} as ${found.get(key(column))}, not ${column.type}`);
+		if (missing.length === 0 && otherType.length === 0) return void adoption.adopted.push({
+			migration,
+			columns
+		});
+		problems.push(`${migration.version} ${migration.name} ${[...missing, ...otherType].join(", ")}`);
+	});
+	if (problems.length > 0) throw new Error(`The auth store an earlier Protobase made matches none of its migrations' versions: ${problems.join("; ")}. Bring it to the schema of Protobase 0.47 first, with that version's \`protobase auth migration\`, then run this again.`);
+	return adoption;
+};
+/**
+* The SQL that records the adopted migrations as applied, once it finds every column they make with its type; it
+* stops the migration, naming what it lacks, on a database that differs from the one it was written from.
+*/
+const adoptionSql = (names, adopted) => {
+	const expected = adopted.flatMap(({ columns }) => columns).map(({ table, column, type }) => ddl`(${sql.lit(table)}, ${sql.lit(column)}, ${sql.lit(type)})`);
+	const schema = names.schema === void 0 ? sql`current_schema()` : sql.lit(names.schema);
+	const check = ddl`do $adopt$
+declare
+  missing text;
+begin
+  select string_agg(expected.table_name || '.' || expected.column_name, ', ' order by expected.table_name, expected.column_name) into missing
+  from (values ${sql.join(expected, sql`,\n    `)}) as expected (table_name, column_name, udt_name)
+  where not exists (
+    select from information_schema.columns found
+    where found.table_schema = ${schema} and found.table_name = expected.table_name and found.column_name = expected.column_name and found.udt_name = expected.udt_name
+  );
+  if missing is not null then
+    raise exception 'The auth store does not match the migrations this file adopts: it lacks %, or has them as other types', missing;
+  end if;
+end
+$adopt$`;
+	return `-- The auth store an earlier Protobase made, without a record of its migrations, adopted: ${adopted.map(({ migration }) => `${migration.version} ${migration.name}`).join(", ")}\n-- recorded as applied, once every table and column they make is there.\n${statementsSql([check, recordMigrations(names, adopted.map(({ migration }) => migration))])}`;
+};
+//#endregion
+export { adoptionSql, planAdoption, storeHasTables };

package/dist/better-auth/store/ddl.js

@@ -0,0 +1,18 @@
+import { DummyDriver, Kysely, PostgresAdapter, PostgresIntrospector, PostgresQueryCompiler, sql } from "kysely";
+//#region src/better-auth/store/ddl.ts
+/** A fragment of SQL whose strings are identifiers: `ddl\`create table ${'user'} (...)\`` is `create table "user" (...)`. */
+const ddl = (strings, ...parts) => sql(strings, ...parts.map((part) => typeof part === "string" ? sql.id(part) : part));
+const compiler = new Kysely({ dialect: {
+	createAdapter: () => new PostgresAdapter(),
+	createDriver: () => new DummyDriver(),
+	createIntrospector: (db) => new PostgresIntrospector(db),
+	createQueryCompiler: () => new PostgresQueryCompiler()
+} });
+/** The text of a fragment. One that holds a parameter, a value given as neither identifier nor `sql.lit`, is an error. */
+const ddlText = (fragment) => {
+	const { sql: text, parameters } = fragment.compile(compiler);
+	if (parameters.length > 0) throw new Error(`A migration statement has no parameters; give each value with sql.lit: ${text}`);
+	return text;
+};
+//#endregion
+export { ddl, ddlText };

package/dist/better-auth/store/drift.d.ts

@@ -0,0 +1,9 @@
+import { AdminAuth } from "../create-auth.js";
+//#region src/better-auth/store/drift.d.ts
+/**
+ * What Better Auth, with the features the app turns on, finds the store lacks or has otherwise: tables, `table.column`s,
+ * indexes and its other findings; none when the store matches. It compares the database's tables, so only
+ * `protobase dev` runs it, on the developer's machine: a deploy reads the record of migrations instead (`checkAuthSchema`).
+ */
+export declare const authSchemaDrift: (auth: AdminAuth) => Promise<string[]>;
+//#endregion

package/dist/better-auth/store/drift.js

@@ -0,0 +1,18 @@
+import { getMigrations } from "better-auth/db/migration";
+//#region src/better-auth/store/drift.ts
+/**
+* What Better Auth, with the features the app turns on, finds the store lacks or has otherwise: tables, `table.column`s,
+* indexes and its other findings; none when the store matches. It compares the database's tables, so only
+* `protobase dev` runs it, on the developer's machine: a deploy reads the record of migrations instead (`checkAuthSchema`).
+*/
+const authSchemaDrift = async (auth) => {
+	const { toBeCreated, toBeAdded, toBeAddedIndexes, schemaProblems } = await getMigrations(auth.options, { throwOnUnsafe: false });
+	return [
+		...toBeCreated.map(({ table }) => `lacks the table ${table}`),
+		...toBeAdded.flatMap(({ table, fields }) => Object.keys(fields).map((field) => `lacks the column ${table}.${field}`)),
+		...toBeAddedIndexes.map(({ name }) => `lacks the index ${name}`),
+		...schemaProblems
+	];
+};
+//#endregion
+export { authSchemaDrift };

package/dist/better-auth/store/migration-sql.js

@@ -0,0 +1,15 @@
+import { ddl, ddlText } from "./ddl.js";
+import { migrationNames } from "./migrations/migration.js";
+import { createMigrationsTable, recordMigrations } from "./migrations-table.js";
+//#region src/better-auth/store/migration-sql.ts
+/** The statements as SQL text. */
+const statementsSql = (statements) => statements.map((statement) => `${ddlText(statement)};`).join("\n\n");
+/** A migration's statements, then the row that records it, under a comment naming it. */
+const migrationSql = (names, migration) => `-- ${migration.version} ${migration.name}: ${migration.title}.\n${statementsSql([...migration.statements(migrationNames(names)), recordMigrations(names, [migration])])}`;
+/** The migrations table, for a store that has none yet, in the store's schema, made when it is missing. */
+const migrationsTableSql = (names) => {
+	const schema = names.schema === void 0 ? [] : [ddl`create schema if not exists ${names.schema}`];
+	return `-- The record of the auth store's migrations.\n${statementsSql([...schema, createMigrationsTable(names)])}`;
+};
+//#endregion
+export { migrationSql, migrationsTableSql, statementsSql };

package/dist/better-auth/store/migrations/001-core.js

@@ -0,0 +1,80 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/001-core.ts
+/** Sign-in itself: users, with their roles and bans, sessions, accounts, codes and the token signing keys. */
+const core = {
+	version: 1,
+	name: "core",
+	title: "Better Auth's users, sessions, accounts, verifications and signing keys",
+	tables: [
+		"session",
+		"account",
+		"verification",
+		"jwks"
+	],
+	statements: ({ table, user, userColumn: column, metadata, id, idRef }) => [
+		ddl`create table if not exists ${user} (id ${id} primary key)`,
+		ddl`alter table ${user}
+  add column if not exists ${column("name")} text not null,
+  add column if not exists ${column("email")} text not null unique,
+  add column if not exists ${column("email_verified")} boolean not null,
+  add column if not exists ${column("image")} text,
+  add column if not exists ${column("created_at")} timestamptz default current_timestamp not null,
+  add column if not exists ${column("updated_at")} timestamptz default current_timestamp not null,
+  add column if not exists ${column("role")} text,
+  add column if not exists ${column("banned")} boolean,
+  add column if not exists ${column("ban_reason")} text,
+  add column if not exists ${column("ban_expires")} timestamptz,
+  add column if not exists ${column("last_role")} text,
+  add column if not exists ${column("email_confirmed_at")} timestamptz`,
+		...metadata ? [ddl`alter table ${user} add column if not exists ${metadata} jsonb`] : [],
+		ddl`create table ${table("session")} (
+  id ${id} primary key,
+  expires_at timestamptz not null,
+  token text not null unique,
+  created_at timestamptz default current_timestamp not null,
+  updated_at timestamptz not null,
+  ip_address text,
+  user_agent text,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  impersonated_by text,
+  active_role text
+)`,
+		ddl`create index session_user_id_idx on ${table("session")} (user_id)`,
+		ddl`create table ${table("account")} (
+  id ${id} primary key,
+  account_id text not null,
+  provider_id text not null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  access_token text,
+  refresh_token text,
+  id_token text,
+  access_token_expires_at timestamptz,
+  refresh_token_expires_at timestamptz,
+  scope text,
+  password text,
+  created_at timestamptz default current_timestamp not null,
+  updated_at timestamptz not null
+)`,
+		ddl`create index account_user_id_idx on ${table("account")} (user_id)`,
+		ddl`create table ${table("verification")} (
+  id ${id} primary key,
+  identifier text not null,
+  value text not null,
+  expires_at timestamptz not null,
+  created_at timestamptz default current_timestamp not null,
+  updated_at timestamptz default current_timestamp not null
+)`,
+		ddl`create index verification_identifier_idx on ${table("verification")} (identifier)`,
+		ddl`create table ${table("jwks")} (
+  id ${id} primary key,
+  public_key text not null,
+  private_key text not null,
+  created_at timestamptz not null,
+  expires_at timestamptz,
+  alg text,
+  crv text
+)`
+	]
+};
+//#endregion
+export { core };

package/dist/better-auth/store/migrations/002-two-factor.js

@@ -0,0 +1,25 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/002-two-factor.ts
+/** Two-step sign-in: each user's authenticator secret and backup codes. */
+const twoFactor = {
+	version: 2,
+	name: "two_factor",
+	title: "The authenticator secrets and backup codes of two-step sign-in",
+	tables: ["two_factor"],
+	statements: ({ table, user, userColumn: column, id, idRef }) => [
+		ddl`alter table ${user} add column if not exists ${column("two_factor_enabled")} boolean`,
+		ddl`create table ${table("two_factor")} (
+  id ${id} primary key,
+  secret text not null,
+  backup_codes text not null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  verified boolean,
+  failed_verification_count integer,
+  locked_until timestamptz
+)`,
+		ddl`create index two_factor_secret_idx on ${table("two_factor")} (secret)`,
+		ddl`create index two_factor_user_id_idx on ${table("two_factor")} (user_id)`
+	]
+};
+//#endregion
+export { twoFactor };

package/dist/better-auth/store/migrations/003-passkeys.js

@@ -0,0 +1,29 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/003-passkeys.ts
+/** Passkeys, each with the RP ID it was made for. */
+const passkeys = {
+	version: 3,
+	name: "passkeys",
+	title: "The users' passkeys",
+	tables: ["passkey"],
+	statements: ({ table, user, id, idRef }) => [
+		ddl`create table ${table("passkey")} (
+  id ${id} primary key,
+  name text,
+  public_key text not null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  credential_id text not null,
+  counter integer not null,
+  device_type text not null,
+  backed_up boolean not null,
+  transports text,
+  created_at timestamptz,
+  aaguid text,
+  rp_id text
+)`,
+		ddl`create index passkey_user_id_idx on ${table("passkey")} (user_id)`,
+		ddl`create index passkey_credential_id_idx on ${table("passkey")} (credential_id)`
+	]
+};
+//#endregion
+export { passkeys };

package/dist/better-auth/store/migrations/004-sign-in-policy.js

@@ -0,0 +1,22 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/004-sign-in-policy.ts
+/** The sign-in policy admins save, each save a row of its own. */
+const signInPolicy = {
+	version: 4,
+	name: "sign_in_policy",
+	title: "The sign-in policies admins saved",
+	tables: ["sign_in_policy"],
+	statements: ({ table, id }) => [ddl`create table ${table("sign_in_policy")} (
+  id ${id} primary key,
+  password text not null,
+  email_code text not null,
+  passkey text not null,
+  two_factor text not null,
+  staff_access text not null,
+  platform_sign_in text not null,
+  created_at timestamptz not null,
+  created_by text
+)`]
+};
+//#endregion
+export { signInPolicy };

package/dist/better-auth/store/migrations/005-staff-sign-in.js

@@ -0,0 +1,25 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/005-staff-sign-in.ts
+/** The log of the operator's staff signing in as the app's people. */
+const staffSignIn = {
+	version: 5,
+	name: "staff_sign_in",
+	title: "The log of staff sign-ins as the app's people",
+	tables: ["staff_sign_in"],
+	statements: ({ table, id }) => [ddl`create table ${table("staff_sign_in")} (
+  id ${id} primary key,
+  user_id text not null,
+  user_email text not null,
+  staff text not null,
+  staff_name text,
+  staff_subject text not null,
+  issuer text not null,
+  reason text not null,
+  session_id text not null,
+  started_at timestamptz not null,
+  expires_at timestamptz not null,
+  ended_at timestamptz
+)`]
+};
+//#endregion
+export { staffSignIn };

package/dist/better-auth/store/migrations/006-organizations.js

@@ -0,0 +1,50 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/006-organizations.ts
+/** Organizations, their members and invitations, and the organization each user and session works in. */
+const organizations = {
+	version: 6,
+	name: "organizations",
+	title: "Organizations, their members and their invitations",
+	tables: [
+		"organization",
+		"member",
+		"invitation"
+	],
+	statements: ({ table, user, userColumn: column, id, idRef }) => [
+		ddl`alter table ${user} add column if not exists ${column("last_organization_id")} text`,
+		ddl`alter table ${table("session")} add column active_organization_id text`,
+		ddl`create table ${table("organization")} (
+  id ${id} primary key,
+  name text not null,
+  slug text not null unique,
+  logo text,
+  created_at timestamptz not null,
+  metadata text
+)`,
+		ddl`create table ${table("member")} (
+  id ${id} primary key,
+  organization_id ${idRef} not null references ${table("organization")} (id) on delete cascade,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  role text not null,
+  created_at timestamptz not null,
+  app_roles jsonb
+)`,
+		ddl`create index member_organization_id_idx on ${table("member")} (organization_id)`,
+		ddl`create index member_user_id_idx on ${table("member")} (user_id)`,
+		ddl`create table ${table("invitation")} (
+  id ${id} primary key,
+  organization_id ${idRef} not null references ${table("organization")} (id) on delete cascade,
+  email text not null,
+  role text,
+  status text not null,
+  expires_at timestamptz not null,
+  created_at timestamptz default current_timestamp not null,
+  inviter_id ${idRef} not null references ${user} (id) on delete cascade,
+  app_roles jsonb
+)`,
+		ddl`create index invitation_organization_id_idx on ${table("invitation")} (organization_id)`,
+		ddl`create index invitation_email_idx on ${table("invitation")} (email)`
+	]
+};
+//#endregion
+export { organizations };

package/dist/better-auth/store/migrations/007-mcp.js

@@ -0,0 +1,150 @@
+import { ddl } from "../ddl.js";
+//#region src/better-auth/store/migrations/007-mcp.ts
+/** The OAuth provider MCP clients sign in through: its clients, resources, tokens and consents. */
+const mcp = {
+	version: 7,
+	name: "mcp",
+	title: "The clients, resources, tokens and consents of the OAuth provider for MCP",
+	tables: [
+		"oauth_client",
+		"oauth_resource",
+		"oauth_client_resource",
+		"oauth_refresh_token",
+		"oauth_access_token",
+		"oauth_consent",
+		"oauth_client_assertion"
+	],
+	statements: ({ table, user, id, idRef }) => [
+		ddl`create table ${table("oauth_client")} (
+  id ${id} primary key,
+  client_id text not null unique,
+  client_secret text,
+  client_discovery_id text,
+  disabled boolean,
+  skip_consent boolean,
+  enable_end_session boolean,
+  subject_type text,
+  scopes jsonb,
+  client_credentials_scopes jsonb,
+  user_id ${idRef} references ${user} (id) on delete cascade,
+  created_at timestamptz,
+  updated_at timestamptz,
+  name text,
+  uri text,
+  icon text,
+  contacts jsonb,
+  tos text,
+  policy text,
+  software_id text,
+  software_version text,
+  software_statement text,
+  redirect_uris jsonb not null,
+  post_logout_redirect_uris jsonb,
+  backchannel_logout_uri text,
+  backchannel_logout_session_required boolean,
+  token_endpoint_auth_method text,
+  application_type text,
+  jwks text,
+  jwks_uri text,
+  grant_types jsonb,
+  response_types jsonb,
+  require_pkce boolean,
+  dpop_bound_access_tokens boolean,
+  reference_id text,
+  metadata jsonb
+)`,
+		ddl`create index oauth_client_user_id_idx on ${table("oauth_client")} (user_id)`,
+		ddl`create table ${table("oauth_resource")} (
+  id ${id} primary key,
+  identifier text not null unique,
+  name text not null,
+  access_token_ttl integer,
+  refresh_token_ttl integer,
+  signing_algorithm text,
+  signing_key_id text,
+  allowed_scopes jsonb,
+  custom_claims jsonb,
+  dpop_bound_access_tokens_required boolean,
+  disabled boolean,
+  created_at timestamptz,
+  updated_at timestamptz,
+  policy_version integer,
+  metadata jsonb
+)`,
+		ddl`create table ${table("oauth_client_resource")} (
+  id ${id} primary key,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  resource_id text not null references ${table("oauth_resource")} (identifier) on delete cascade,
+  metadata jsonb,
+  created_at timestamptz
+)`,
+		ddl`create index oauth_client_resource_client_id_idx on ${table("oauth_client_resource")} (client_id)`,
+		ddl`create index oauth_client_resource_resource_id_idx on ${table("oauth_client_resource")} (resource_id)`,
+		ddl`create unique index oauth_client_resource_client_id_resource_id_uidx on ${table("oauth_client_resource")} (client_id, resource_id)`,
+		ddl`create table ${table("oauth_refresh_token")} (
+  id ${id} primary key,
+  token text not null unique,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  session_id ${idRef} references ${table("session")} (id) on delete set null,
+  user_id ${idRef} not null references ${user} (id) on delete cascade,
+  reference_id text,
+  authorization_code_id text,
+  resources jsonb,
+  requested_user_info_claims jsonb,
+  expires_at timestamptz not null,
+  created_at timestamptz not null,
+  revoked timestamptz,
+  rotated_at timestamptz,
+  rotation_replay_response text,
+  rotation_replay_expires_at timestamptz,
+  auth_time timestamptz,
+  confirmation jsonb,
+  scopes jsonb not null
+)`,
+		ddl`create index oauth_refresh_token_client_id_idx on ${table("oauth_refresh_token")} (client_id)`,
+		ddl`create index oauth_refresh_token_session_id_idx on ${table("oauth_refresh_token")} (session_id)`,
+		ddl`create index oauth_refresh_token_user_id_idx on ${table("oauth_refresh_token")} (user_id)`,
+		ddl`create index oauth_refresh_token_authorization_code_id_idx on ${table("oauth_refresh_token")} (authorization_code_id)`,
+		ddl`create table ${table("oauth_access_token")} (
+  id ${id} primary key,
+  token text not null unique,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  session_id ${idRef} references ${table("session")} (id) on delete set null,
+  user_id ${idRef} references ${user} (id) on delete cascade,
+  reference_id text,
+  authorization_code_id text,
+  resources jsonb,
+  requested_user_info_claims jsonb,
+  refresh_id ${idRef} references ${table("oauth_refresh_token")} (id) on delete cascade,
+  expires_at timestamptz not null,
+  created_at timestamptz not null,
+  revoked timestamptz,
+  confirmation jsonb,
+  scopes jsonb not null
+)`,
+		ddl`create index oauth_access_token_client_id_idx on ${table("oauth_access_token")} (client_id)`,
+		ddl`create index oauth_access_token_session_id_idx on ${table("oauth_access_token")} (session_id)`,
+		ddl`create index oauth_access_token_user_id_idx on ${table("oauth_access_token")} (user_id)`,
+		ddl`create index oauth_access_token_authorization_code_id_idx on ${table("oauth_access_token")} (authorization_code_id)`,
+		ddl`create index oauth_access_token_refresh_id_idx on ${table("oauth_access_token")} (refresh_id)`,
+		ddl`create table ${table("oauth_consent")} (
+  id ${id} primary key,
+  client_id text not null references ${table("oauth_client")} (client_id) on delete cascade,
+  user_id ${idRef} references ${user} (id) on delete cascade,
+  reference_id text,
+  resources jsonb,
+  requested_user_info_claims jsonb,
+  scopes jsonb not null,
+  created_at timestamptz not null,
+  updated_at timestamptz not null
+)`,
+		ddl`create index oauth_consent_client_id_idx on ${table("oauth_consent")} (client_id)`,
+		ddl`create index oauth_consent_user_id_idx on ${table("oauth_consent")} (user_id)`,
+		ddl`create table ${table("oauth_client_assertion")} (
+  id ${id} primary key,
+  expires_at timestamptz not null
+)`
+	]
+};
+//#endregion
+export { mcp };