@revealui/db 0.2.0 → 0.3.0

package/dist/schema/oauth-accounts.d.ts

@@ -0,0 +1,205 @@
+/**
+ * OAuth Accounts table — linked provider identities per user
+ *
+ * Stores the mapping between local users and their OAuth provider accounts.
+ * Supports multiple providers per user (Google, GitHub, Vercel, etc.).
+ * Follows the same pattern as user_api_keys: separate table instead of
+ * nullable columns on users to avoid table bloat.
+ */
+export declare const oauthAccounts: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "oauth_accounts";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "oauth_accounts";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "oauth_accounts";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "oauth_accounts";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_user_id";
+            tableName: "oauth_accounts";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerEmail: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_email";
+            tableName: "oauth_accounts";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_name";
+            tableName: "oauth_accounts";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        providerAvatarUrl: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider_avatar_url";
+            tableName: "oauth_accounts";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "oauth_accounts";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "oauth_accounts";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deleted_at";
+            tableName: "oauth_accounts";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        anonymizedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "anonymized_at";
+            tableName: "oauth_accounts";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type OauthAccount = typeof oauthAccounts.$inferSelect;
+export type NewOauthAccount = typeof oauthAccounts.$inferInsert;
+//# sourceMappingURL=oauth-accounts.d.ts.map

package/dist/schema/oauth-accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-accounts.d.ts","sourceRoot":"","sources":["../../src/schema/oauth-accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCzB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC"}

package/dist/schema/oauth-accounts.js

@@ -0,0 +1,35 @@
+/**
+ * OAuth Accounts table — linked provider identities per user
+ *
+ * Stores the mapping between local users and their OAuth provider accounts.
+ * Supports multiple providers per user (Google, GitHub, Vercel, etc.).
+ * Follows the same pattern as user_api_keys: separate table instead of
+ * nullable columns on users to avoid table bloat.
+ */
+import { index, pgTable, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
+import { users } from './users.js';
+export const oauthAccounts = pgTable('oauth_accounts', {
+    id: text('id').primaryKey(),
+    // Owner
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    // Provider identity
+    provider: text('provider').notNull(), // 'google' | 'github' | 'vercel'
+    providerUserId: text('provider_user_id').notNull(),
+    providerEmail: text('provider_email'),
+    providerName: text('provider_name'),
+    providerAvatarUrl: text('provider_avatar_url'),
+    // Timestamps
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+    // Soft-delete: null = active, timestamp = when unlinked
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+    // GDPR anonymization: null = not anonymized, timestamp = when PII (providerEmail/Name/AvatarUrl) was wiped
+    anonymizedAt: timestamp('anonymized_at', { withTimezone: true }),
+}, (t) => [
+    uniqueIndex('oauth_accounts_provider_user_idx').on(t.provider, t.providerUserId),
+    index('oauth_accounts_user_id_idx').on(t.userId),
+    index('oauth_accounts_deleted_at_idx').on(t.deletedAt),
+]);
+//# sourceMappingURL=oauth-accounts.js.map

package/dist/schema/oauth-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-accounts.js","sourceRoot":"","sources":["../../src/schema/oauth-accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAClC,gBAAgB,EAChB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAE3B,QAAQ;IACR,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAEtD,oBAAoB;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,iCAAiC;IACvE,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE;IAClD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACrC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAE9C,aAAa;IACb,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACjF,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAEjF,wDAAwD;IACxD,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAE1D,2GAA2G;IAC3G,YAAY,EAAE,SAAS,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CACjE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC;IAChF,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CACvD,CACF,CAAC"}

package/dist/schema/pages.d.ts

@@ -42,6 +42,23 @@ export declare const pages: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        version: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version";
+            tableName: "pages";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         siteId: import("drizzle-orm/pg-core").PgColumn<{
             name: "site_id";
             tableName: "pages";
@@ -316,6 +333,23 @@ export declare const pages: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        deletedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deleted_at";
+            tableName: "pages";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;

package/dist/schema/pages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/schema/pages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0ChB,CAAA;AAMF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyBxB,CAAA;AAMF,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAC/C,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA"}
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/schema/pages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DjB,CAAC;AAMF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BzB,CAAC;AAMF,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAC7C,MAAM,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC"}

package/dist/schema/pages.js

@@ -4,7 +4,7 @@
  * These tables store page content and hierarchies.
  * The schema structure mirrors the Zod schemas in @revealui/contracts/entities.
  */
-import { integer, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
+import { index, integer, jsonb, pgTable, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
 import { sites } from './sites.js';
 import { users } from './users.js';
 // =============================================================================
@@ -15,11 +15,13 @@ export const pages = pgTable('pages', {
     id: text('id').primaryKey(),
     // Schema versioning for migrations
     schemaVersion: text('schema_version').notNull().default('1'),
+    // Optimistic locking — incremented on each update, checked to detect concurrent edits
+    version: integer('version').notNull().default(1),
     // Relationships
     siteId: text('site_id')
         .notNull()
         .references(() => sites.id, { onDelete: 'cascade' }),
-    parentId: text('parent_id'),
+    parentId: text('parent_id').references(() => pages.id, { onDelete: 'cascade' }),
     templateId: text('template_id'),
     // Basic info
     title: text('title').notNull(),
@@ -42,7 +44,15 @@ export const pages = pgTable('pages', {
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
     updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
     publishedAt: timestamp('published_at', { withTimezone: true }),
-});
+    // Soft-delete: null = active, timestamp = when deleted
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+}, (table) => [
+    index('pages_parent_id_idx').on(table.parentId),
+    index('pages_site_id_idx').on(table.siteId),
+    index('pages_site_status_idx').on(table.siteId, table.status),
+    uniqueIndex('pages_slug_site_id_idx').on(table.slug, table.siteId),
+    index('pages_deleted_at_idx').on(table.deletedAt),
+]);
 // =============================================================================
 // Page Revisions Table (for version history)
 // =============================================================================
@@ -66,5 +76,5 @@ export const pageRevisions = pgTable('page_revisions', {
     changeDescription: text('change_description'),
     // Timestamps
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-});
+}, (table) => [index('page_revisions_page_id_idx').on(table.pageId)]);
 //# sourceMappingURL=pages.js.map

package/dist/schema/pages.js.map

@@ -1 +1 @@
-{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/schema/pages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAElC,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE;IACpC,qBAAqB;IACrB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAE3B,mCAAmC;IACnC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAE5D,gBAAgB;IAChB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAE/B,aAAa;IACb,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAE5B,gDAAgD;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAEjD,+CAA+C;IAC/C,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,2BAA2B;IAC3B,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;IAEjB,oBAAoB;IACpB,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,8BAA8B;IAC9B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;IAEnB,aAAa;IACb,WAAW,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAE9D,aAAa;IACb,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACjF,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACjF,WAAW,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC/D,CAAC,CAAA;AAEF,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,EAAE;IACrD,qBAAqB;IACrB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAE3B,gBAAgB;IAChB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;QACvD,QAAQ,EAAE,UAAU;KACrB,CAAC;IAEF,8CAA8C;IAC9C,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IAEpD,yBAAyB;IACzB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;IAEjB,gCAAgC;IAChC,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAE7C,aAAa;IACb,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAClF,CAAC,CAAA"}
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/schema/pages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEnG,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAC1B,OAAO,EACP;IACE,qBAAqB;IACrB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAE3B,mCAAmC;IACnC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAE5D,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD,gBAAgB;IAChB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,GAAgB,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5F,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAE/B,aAAa;IACb,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAE5B,gDAAgD;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAEjD,+CAA+C;IAC/C,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,2BAA2B;IAC3B,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;IAEjB,oBAAoB;IACpB,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,8BAA8B;IAC9B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;IAEnB,aAAa;IACb,WAAW,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAE9D,aAAa;IACb,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACjF,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACjF,WAAW,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAE9D,uDAAuD;IACvD,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC3D,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC/C,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3C,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;IAC7D,WAAW,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;IAClE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAClD,CACF,CAAC;AAEF,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAClC,gBAAgB,EAChB;IACE,qBAAqB;IACrB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAE3B,gBAAgB;IAChB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;QACvD,QAAQ,EAAE,UAAU;KACrB,CAAC;IAEF,8CAA8C;IAC9C,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IAEpD,yBAAyB;IACzB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;IAEjB,gCAAgC;IAChC,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAE7C,aAAa;IACb,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAClF,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAClE,CAAC"}

package/dist/schema/passkeys.d.ts

@@ -0,0 +1,208 @@
+/**
+ * Passkeys table
+ *
+ * Stores WebAuthn/FIDO2 passkey credentials for passwordless authentication.
+ * Each user can register multiple passkeys (e.g., fingerprint, security key, phone).
+ * Credential IDs and public keys are stored per the WebAuthn specification.
+ */
+export declare const passkeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "passkeys";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "passkeys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "passkeys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_id";
+            tableName: "passkeys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        publicKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "public_key";
+            tableName: "passkeys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Buffer<ArrayBufferLike>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+        }>;
+        counter: import("drizzle-orm/pg-core").PgColumn<{
+            name: "counter";
+            tableName: "passkeys";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        transports: import("drizzle-orm/pg-core").PgColumn<{
+            name: "transports";
+            tableName: "passkeys";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        aaguid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "aaguid";
+            tableName: "passkeys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deviceName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "device_name";
+            tableName: "passkeys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        backedUp: import("drizzle-orm/pg-core").PgColumn<{
+            name: "backed_up";
+            tableName: "passkeys";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "passkeys";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_used_at";
+            tableName: "passkeys";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type Passkey = typeof passkeys.$inferSelect;
+export type NewPasskey = typeof passkeys.$inferInsert;
+//# sourceMappingURL=passkeys.d.ts.map

package/dist/schema/passkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../src/schema/passkeys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsCpB,CAAC;AAMF,MAAM,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC"}

package/dist/schema/passkeys.js

@@ -0,0 +1,47 @@
+/**
+ * Passkeys table
+ *
+ * Stores WebAuthn/FIDO2 passkey credentials for passwordless authentication.
+ * Each user can register multiple passkeys (e.g., fingerprint, security key, phone).
+ * Credential IDs and public keys are stored per the WebAuthn specification.
+ */
+import { boolean, customType, index, integer, jsonb, pgTable, text, timestamp, uniqueIndex, } from 'drizzle-orm/pg-core';
+import { users } from './users.js';
+// =============================================================================
+// Custom Types
+// =============================================================================
+const bytea = customType({
+    dataType() {
+        return 'bytea';
+    },
+});
+// =============================================================================
+// Passkeys Table
+// =============================================================================
+export const passkeys = pgTable('passkeys', {
+    id: text('id').primaryKey(),
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    // WebAuthn credential ID (base64url-encoded by convention)
+    credentialId: text('credential_id').notNull(),
+    // COSE public key (binary)
+    publicKey: bytea('public_key').notNull(),
+    // Signature counter for clone detection
+    counter: integer('counter').notNull().default(0),
+    // Allowed transports (e.g., "usb", "ble", "nfc", "internal")
+    transports: jsonb('transports').$type(),
+    // Authenticator Attestation GUID (identifies authenticator model)
+    aaguid: text('aaguid'),
+    // User-assigned friendly name (e.g., "MacBook Pro Touch ID")
+    deviceName: text('device_name'),
+    // Whether the credential is backed up (e.g., iCloud Keychain, Google Password Manager)
+    backedUp: boolean('backed_up').default(false).notNull(),
+    // Timestamps
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
+}, (table) => [
+    index('passkeys_user_id_idx').on(table.userId),
+    uniqueIndex('passkeys_credential_id_idx').on(table.credentialId),
+]);
+//# sourceMappingURL=passkeys.js.map

package/dist/schema/passkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.js","sourceRoot":"","sources":["../../src/schema/passkeys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,OAAO,EACP,UAAU,EACV,KAAK,EACL,OAAO,EACP,KAAK,EACL,OAAO,EACP,IAAI,EACJ,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,KAAK,GAAG,UAAU,CAAmB;IACzC,QAAQ;QACN,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC;AAEH,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAC7B,UAAU,EACV;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAE3B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAEtD,2DAA2D;IAC3D,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAE7C,2BAA2B;IAC3B,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAExC,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,EAAY;IAEjD,kEAAkE;IAClE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IAEtB,6DAA6D;IAC7D,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAE/B,uFAAuF;IACvF,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAEvD,aAAa;IACb,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACjF,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC9D,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IAC9C,WAAW,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;CACjE,CACF,CAAC"}

package/dist/schema/password-reset-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-tokens.d.ts","sourceRoot":"","sources":["../../src/schema/password-reset-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc9B,CAAA;AAMF,MAAM,MAAM,kBAAkB,GAAG,OAAO,mBAAmB,CAAC,YAAY,CAAA;AACxE,MAAM,MAAM,qBAAqB,GAAG,OAAO,mBAAmB,CAAC,YAAY,CAAA"}
+{"version":3,"file":"password-reset-tokens.d.ts","sourceRoot":"","sources":["../../src/schema/password-reset-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqB/B,CAAC;AAMF,MAAM,MAAM,kBAAkB,GAAG,OAAO,mBAAmB,CAAC,YAAY,CAAC;AACzE,MAAM,MAAM,qBAAqB,GAAG,OAAO,mBAAmB,CAAC,YAAY,CAAC"}

package/dist/schema/password-reset-tokens.js

@@ -6,7 +6,7 @@
  * Token values are stored as HMAC-SHA256 hashes with a per-token salt
  * for protection against rainbow table attacks on DB breach.
  */
-import { pgTable, text, timestamp } from 'drizzle-orm/pg-core';
+import { index, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
 import { users } from './users.js';
 // =============================================================================
 // Password Reset Tokens Table
@@ -22,5 +22,8 @@ export const passwordResetTokens = pgTable('password_reset_tokens', {
     expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
     usedAt: timestamp('used_at', { withTimezone: true }),
     createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-});
+}, (table) => [
+    // R5-H6: Index for cleanup queries that scan by expiry
+    index('password_reset_tokens_expires_at_idx').on(table.expiresAt),
+]);
 //# sourceMappingURL=password-reset-tokens.js.map