@tinyrack/issuary-server 0.20.0

package/dist/middleware/session.js

@@ -0,0 +1,185 @@
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
+import { createMiddleware } from 'hono/factory';
+import { decrypt, encrypt } from "../lib/crypto.js";
+const DEFAULT_MAX_REMEMBERED_ACCOUNTS = 5;
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+function resolveRememberedAccountsOptions(options) {
+    return {
+        enabled: options?.enabled ?? true,
+        maxAccounts: options?.maxAccounts ?? DEFAULT_MAX_REMEMBERED_ACCOUNTS,
+        ttlMs: options?.ttlMs,
+    };
+}
+function pruneRememberedAccounts(accounts, options) {
+    const ttlSeconds = options.ttlMs === undefined ? undefined : Math.floor(options.ttlMs / 1000);
+    const freshAccounts = ttlSeconds === undefined
+        ? accounts
+        : accounts.filter((account) => nowSeconds() - account.last_used_at <= ttlSeconds);
+    return freshAccounts.slice(-options.maxAccounts);
+}
+export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOptions) {
+    const rememberedOptions = resolveRememberedAccountsOptions(rememberedAccountsOptions);
+    return createMiddleware(async (c, next) => {
+        const cookieValue = getCookie(c, 'session');
+        let sessionData = {};
+        if (cookieValue) {
+            const decrypted = await decrypt(cookieValue, cookieSecret);
+            if (decrypted) {
+                try {
+                    // Cast is acceptable: we encrypt/decrypt our own
+                    // SessionData, so the parsed shape is trusted.
+                    sessionData = JSON.parse(decrypted);
+                }
+                catch {
+                    sessionData = {};
+                }
+            }
+        }
+        let changed = false;
+        const data = new Proxy(sessionData, {
+            set(target, prop, value) {
+                changed = true;
+                return Reflect.set(target, prop, value);
+            },
+            deleteProperty(target, prop) {
+                changed = true;
+                return Reflect.deleteProperty(target, prop);
+            },
+        });
+        if (!rememberedOptions.enabled) {
+            if (data.accounts !== undefined) {
+                delete data.accounts;
+            }
+        }
+        else if (data.accounts) {
+            const prunedAccounts = pruneRememberedAccounts(data.accounts, rememberedOptions);
+            if (prunedAccounts.length !== data.accounts.length) {
+                data.accounts = prunedAccounts;
+            }
+        }
+        c.set('session', {
+            get(key) {
+                return data[key];
+            },
+            set(key, value) {
+                data[key] = value;
+            },
+            delete() {
+                for (const key of Object.keys(data)) {
+                    Reflect.deleteProperty(data, key);
+                }
+            },
+            setUserSession(userSub, authenticatedAt) {
+                const authTime = authenticatedAt ?? nowSeconds();
+                const reauthenticationRequestFingerprint = data.reauthentication?.request_fingerprint;
+                delete data.pending2FAUser;
+                delete data.pending2FASetup;
+                delete data.oauth;
+                delete data.passkey_challenge;
+                data.user = {
+                    sub: userSub,
+                    authenticated_at: authTime,
+                };
+                data.reauthentication = {
+                    sub: userSub,
+                    authenticated_at: authTime,
+                };
+                if (reauthenticationRequestFingerprint) {
+                    data.reauthentication.request_fingerprint =
+                        reauthenticationRequestFingerprint;
+                }
+                if (rememberedOptions.enabled) {
+                    const existingAccounts = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions);
+                    data.accounts = [
+                        ...existingAccounts.filter((account) => account.sub !== userSub),
+                        {
+                            sub: userSub,
+                            authenticated_at: authTime,
+                            last_used_at: authTime,
+                        },
+                    ].slice(-rememberedOptions.maxAccounts);
+                }
+                else {
+                    delete data.accounts;
+                }
+            },
+            selectUserSession(userSub) {
+                if (!rememberedOptions.enabled) {
+                    return false;
+                }
+                const account = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions).find((entry) => entry.sub === userSub);
+                if (!account) {
+                    return false;
+                }
+                delete data.pending2FAUser;
+                delete data.pending2FASetup;
+                delete data.oauth;
+                delete data.passkey_challenge;
+                data.user = {
+                    sub: account.sub,
+                    authenticated_at: account.authenticated_at,
+                };
+                delete data.reauthentication;
+                data.accounts = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions).map((entry) => entry.sub === userSub
+                    ? { ...entry, last_used_at: nowSeconds() }
+                    : entry);
+                return true;
+            },
+            removeRememberedUserSession(userSub) {
+                if (data.user?.sub === userSub) {
+                    return false;
+                }
+                if (!rememberedOptions.enabled) {
+                    return false;
+                }
+                const existingAccounts = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions);
+                const nextAccounts = existingAccounts.filter((account) => account.sub !== userSub);
+                if (nextAccounts.length === existingAccounts.length) {
+                    return false;
+                }
+                data.accounts = nextAccounts;
+                return true;
+            },
+            setPending2FASession(userSub, authenticatedAt) {
+                delete data.pending2FASetup;
+                delete data.oauth;
+                delete data.passkey_challenge;
+                data.pending2FAUser = {
+                    sub: userSub,
+                    authenticated_at: authenticatedAt ?? nowSeconds(),
+                };
+            },
+            setPending2FASetupSession(userSub) {
+                delete data.pending2FAUser;
+                delete data.oauth;
+                delete data.passkey_challenge;
+                data.pending2FASetup = { sub: userSub };
+            },
+            clearAuthSessions() {
+                delete data.user;
+                delete data.reauthentication;
+                delete data.pending2FAUser;
+                delete data.pending2FASetup;
+            },
+        });
+        await next();
+        if (changed) {
+            const hasData = Object.values(sessionData).some((v) => v !== undefined);
+            if (hasData) {
+                const encrypted = await encrypt(JSON.stringify(sessionData), cookieSecret);
+                setCookie(c, 'session', encrypted, {
+                    path: '/',
+                    httpOnly: true,
+                    secure: isSecure,
+                    sameSite: 'Lax',
+                });
+            }
+            else {
+                deleteCookie(c, 'session', { path: '/' });
+            }
+        }
+    });
+}
+//# sourceMappingURL=session.js.map

package/dist/middleware/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAQ1C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAQD,SAAS,gCAAgC,CACvC,OAA8C;IAE9C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;QACjC,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,+BAA+B;QACpE,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA0B,EAC1B,OAA4D;IAE5D,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,MAAM,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAC/D,CAAC;IACR,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAsGD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,QAAiB,EACjB,yBAAqD;IAErD,MAAM,iBAAiB,GAAG,gCAAgC,CACxD,yBAAyB,CAC1B,CAAC;IACF,OAAO,gBAAgB,CAAa,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,WAAW,GAAgB,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,iDAAiD;oBACjD,+CAA+C;oBAC/C,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,CAAC,MAAM,EAAE,IAAI;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,uBAAuB,CAC5C,IAAI,CAAC,QAAQ,EACb,iBAAiB,CAClB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACjC,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,GAAG,CAA8B,GAAM;gBACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAA8B,GAAM,EAAE,KAAqB;gBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,MAAM;gBACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAe,EAAE,eAAwB;gBACtD,MAAM,QAAQ,GAAG,eAAe,IAAI,UAAU,EAAE,CAAC;gBACjD,MAAM,kCAAkC,GACtC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;gBAC7C,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,CAAC,gBAAgB,GAAG;oBACtB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,kCAAkC,EAAE,CAAC;oBACvC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB;wBACvC,kCAAkC,CAAC;gBACvC,CAAC;gBACD,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;oBACF,IAAI,CAAC,QAAQ,GAAG;wBACd,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;wBAChE;4BACE,GAAG,EAAE,OAAO;4BACZ,gBAAgB,EAAE,QAAQ;4BAC1B,YAAY,EAAE,QAAQ;yBACvB;qBACF,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,OAAe;gBAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC;gBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,GAAG,KAAK,OAAO;oBACnB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE;oBAC1C,CAAC,CAAC,KAAK,CACV,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,2BAA2B,CAAC,OAAe;gBACzC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;gBACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CACrC,CAAC;gBACF,IAAI,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,oBAAoB,CAAC,OAAe,EAAE,eAAwB;gBAC5D,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,cAAc,GAAG;oBACpB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,UAAU,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,yBAAyB,CAAC,OAAe;gBACvC,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,iBAAiB;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;YAC9B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,YAAY,CACb,CAAC;gBACF,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;oBACjC,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/trusted-proxy-guard.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Creates a trusted proxy guard middleware.
+ * Only applies IP filtering when trust_proxy is
+ * string or array.
+ */
+export declare function trustedProxyGuard(trustProxy: boolean | number | string | string[]): import("hono").MiddlewareHandler<any, string, {}, Response>;
+//# sourceMappingURL=trusted-proxy-guard.d.ts.map

package/dist/middleware/trusted-proxy-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-proxy-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/trusted-proxy-guard.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,+DAuCjD"}

package/dist/middleware/trusted-proxy-guard.js

@@ -0,0 +1,34 @@
+import { createMiddleware } from 'hono/factory';
+import { isTrustedProxy } from "../lib/ip-utils.js";
+import { e } from "../schemas/error.js";
+/**
+ * Creates a trusted proxy guard middleware.
+ * Only applies IP filtering when trust_proxy is
+ * string or array.
+ */
+export function trustedProxyGuard(trustProxy) {
+    const requiresFiltering = typeof trustProxy === 'string' || Array.isArray(trustProxy);
+    if (!requiresFiltering) {
+        // No filtering needed, pass through
+        return createMiddleware(async (_c, next) => {
+            await next();
+        });
+    }
+    return createMiddleware(async (c, next) => {
+        // Access raw Node.js socket for remote address
+        // @hono/node-server provides connInfo via env
+        const connInfo = c.env?.connInfo;
+        const remoteAddress = connInfo?.remote?.address ??
+            // Fallback: try to get from raw node request
+            c.env?.incoming?.socket?.remoteAddress;
+        if (!remoteAddress) {
+            throw new e.UntrustedProxy.Error();
+        }
+        const isTrusted = isTrustedProxy(remoteAddress, trustProxy);
+        if (!isTrusted) {
+            throw new e.UntrustedProxy.Error();
+        }
+        await next();
+    });
+}
+//# sourceMappingURL=trusted-proxy-guard.js.map

package/dist/middleware/trusted-proxy-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-proxy-guard.js","sourceRoot":"","sources":["../../src/middleware/trusted-proxy-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAgD;IAEhD,MAAM,iBAAiB,GACrB,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,oCAAoC;QACpC,OAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;YACzC,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,+CAA+C;QAC/C,8CAA8C;QAC9C,MAAM,QAAQ,GAAI,CAAC,CAAC,GAA+B,EAAE,QAAQ,CAAC;QAC9D,MAAM,aAAa,GACjB,QAAQ,EAAE,MAAM,EAAE,OAAO;YACzB,6CAA6C;YAE3C,CAAC,CAAC,GAKH,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAE5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/migrations/postgres/Migration20260509171036_initial.d.ts

@@ -0,0 +1,5 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260509171036_initial extends Migration {
+    up(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260509171036_initial.d.ts.map

package/dist/migrations/postgres/Migration20260509171036_initial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260509171036_initial.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260509171036_initial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,+BAAgC,SAAQ,SAAS;IACnD,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CA6tBpC"}

package/dist/migrations/postgres/Migration20260509171036_initial.js

@@ -0,0 +1,246 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260509171036_initial extends Migration {
+    up() {
+        this.addSql(`create table "bootstrap_state" ("id" varchar(255) not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "value" varchar(255) not null, primary key ("id"));`);
+        this.addSql(`comment on table "bootstrap_state" is 'Runtime bootstrap metadata';`);
+        this.addSql(`comment on column "bootstrap_state"."id" is 'Bootstrap metadata key';`);
+        this.addSql(`comment on column "bootstrap_state"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "bootstrap_state"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "bootstrap_state"."value" is 'Bootstrap metadata value';`);
+        this.addSql(`create table "jwt_key" ("kid" varchar(255) not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "private_key" text not null, "public_key" text not null, "algorithm" varchar(255) not null default 'RS256', "status" text not null default 'next', "activated_at" timestamptz null, "deactivated_at" timestamptz null, "retired_at" timestamptz null, "expires_at" timestamptz null, primary key ("kid"));`);
+        this.addSql(`comment on table "jwt_key" is 'RSA key pairs for JWT signing (RS256)';`);
+        this.addSql(`comment on column "jwt_key"."kid" is 'Key ID for JWT header (kid claim)';`);
+        this.addSql(`comment on column "jwt_key"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "jwt_key"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "jwt_key"."private_key" is 'RSA private key in PEM format';`);
+        this.addSql(`comment on column "jwt_key"."public_key" is 'RSA public key in PEM format';`);
+        this.addSql(`comment on column "jwt_key"."algorithm" is 'JWT signing algorithm (RS256)';`);
+        this.addSql(`comment on column "jwt_key"."status" is 'Key status: next, active, previous, retired';`);
+        this.addSql(`comment on column "jwt_key"."activated_at" is 'When the key was activated for signing';`);
+        this.addSql(`comment on column "jwt_key"."deactivated_at" is 'When the key was deactivated from signing';`);
+        this.addSql(`comment on column "jwt_key"."retired_at" is 'When the key was fully retired';`);
+        this.addSql(`comment on column "jwt_key"."expires_at" is 'Scheduled expiration for automatic rotation';`);
+        this.addSql(`create index "jwt_key_status_idx" on "jwt_key" ("status");`);
+        this.addSql(`alter table "jwt_key" add constraint "jwt_key_status_check" check ("status" in ('next', 'active', 'previous', 'retired'));`);
+        this.addSql(`create table "oauth_client" ("id" varchar(255) not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "client_id" varchar(255) not null, "client_secret_hash" varchar(255) null, "name" varchar(255) not null, "grant_types" jsonb not null default '[]', "response_types" jsonb not null default '[]', "scopes" jsonb not null default '[]', "redirect_uris" jsonb not null default '[]', "enabled" boolean not null default true, "managed_by" varchar(255) not null default 'database', "logo_uri" varchar(255) null, primary key ("id"));`);
+        this.addSql(`comment on table "oauth_client" is 'Registered OAuth clients';`);
+        this.addSql(`comment on column "oauth_client"."id" is 'Config/internal client identifier';`);
+        this.addSql(`comment on column "oauth_client"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "oauth_client"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "oauth_client"."client_id" is 'Public client identifier';`);
+        this.addSql(`comment on column "oauth_client"."client_secret_hash" is 'Hash of the client secret (null for public clients using PKCE)';`);
+        this.addSql(`comment on column "oauth_client"."name" is 'Human-readable name of the OAuth client';`);
+        this.addSql(`comment on column "oauth_client"."grant_types" is 'Allowed OAuth grant types for the client';`);
+        this.addSql(`comment on column "oauth_client"."response_types" is 'Allowed OAuth response types for the client';`);
+        this.addSql(`comment on column "oauth_client"."scopes" is 'Allowed OAuth scopes for the client';`);
+        this.addSql(`comment on column "oauth_client"."redirect_uris" is 'Registered redirect URIs for the client';`);
+        this.addSql(`comment on column "oauth_client"."enabled" is 'Whether the OAuth client is enabled';`);
+        this.addSql(`comment on column "oauth_client"."managed_by" is 'Data source: config (from YAML) or database (runtime created)';`);
+        this.addSql(`comment on column "oauth_client"."logo_uri" is 'Logo URI for the OAuth client';`);
+        this.addSql(`create index "client_client_id_unique" on "oauth_client" ("client_id");`);
+        this.addSql(`create table "pending_oauth_registration" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "token" varchar(255) not null, "provider_id" varchar(255) not null, "access_token" text not null, "refresh_token" text null, "expires_in" int null, "token_type" varchar(255) not null, "user_info" jsonb not null, "return_url" varchar(255) null, "expires_at" timestamptz not null, primary key ("id"));`);
+        this.addSql(`comment on table "pending_oauth_registration" is 'Server-side store for pending OAuth registrations awaiting terms consent';`);
+        this.addSql(`comment on column "pending_oauth_registration"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "pending_oauth_registration"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "pending_oauth_registration"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "pending_oauth_registration"."token" is 'Unique lookup token stored in the session cookie';`);
+        this.addSql(`comment on column "pending_oauth_registration"."provider_id" is 'OAuth provider identifier';`);
+        this.addSql(`comment on column "pending_oauth_registration"."access_token" is 'OAuth access token from the provider';`);
+        this.addSql(`comment on column "pending_oauth_registration"."refresh_token" is 'OAuth refresh token from the provider';`);
+        this.addSql(`comment on column "pending_oauth_registration"."expires_in" is 'Token expiration duration in seconds';`);
+        this.addSql(`comment on column "pending_oauth_registration"."token_type" is 'OAuth token type (e.g. Bearer)';`);
+        this.addSql(`comment on column "pending_oauth_registration"."user_info" is 'Normalized user info from the OAuth provider';`);
+        this.addSql(`comment on column "pending_oauth_registration"."return_url" is 'URL to redirect to after registration completes';`);
+        this.addSql(`comment on column "pending_oauth_registration"."expires_at" is 'Absolute expiry timestamp for this pending registration';`);
+        this.addSql(`alter table "pending_oauth_registration" add constraint "pending_oauth_registration_token_unique" unique ("token");`);
+        this.addSql(`create index "pending_oauth_reg_token_idx" on "pending_oauth_registration" ("token");`);
+        this.addSql(`create index "pending_oauth_reg_expires_at_idx" on "pending_oauth_registration" ("expires_at");`);
+        this.addSql(`create table "terms" ("id" varchar(255) not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "required" boolean not null default true, "consent_mode" varchar(255) not null default 'explicit', "version" varchar(255) not null, "managed_by" varchar(255) not null default 'database', primary key ("id"));`);
+        this.addSql(`comment on table "terms" is 'Terms of service definitions';`);
+        this.addSql(`comment on column "terms"."id" is 'Unique identifier (e.g., "tos", "privacy")';`);
+        this.addSql(`comment on column "terms"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "terms"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "terms"."required" is 'Whether agreement is mandatory';`);
+        this.addSql(`comment on column "terms"."consent_mode" is 'Consent mode: explicit (checkbox) or implicit (auto-agree)';`);
+        this.addSql(`comment on column "terms"."version" is 'Version string (e.g., "1.0.0")';`);
+        this.addSql(`comment on column "terms"."managed_by" is 'Data source: config or database';`);
+        this.addSql(`create table "terms_content" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "terms_id" varchar(255) not null, "lang" varchar(255) not null, "title" varchar(255) not null, "type" varchar(255) not null default 'link', "content" text not null, primary key ("id"));`);
+        this.addSql(`comment on table "terms_content" is 'Localized content for terms';`);
+        this.addSql(`comment on column "terms_content"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "terms_content"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "terms_content"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "terms_content"."terms_id" is 'Reference to the terms';`);
+        this.addSql(`comment on column "terms_content"."lang" is 'Language code (e.g., "en", "ko", "ja")';`);
+        this.addSql(`comment on column "terms_content"."title" is 'Display title';`);
+        this.addSql(`comment on column "terms_content"."type" is 'Content type: link or text';`);
+        this.addSql(`comment on column "terms_content"."content" is 'Content value (URL if type=link, text if type=text)';`);
+        this.addSql(`alter table "terms_content" add constraint "terms_content_terms_lang_unique" unique ("terms_id", "lang");`);
+        this.addSql(`create table "user" ("sub" varchar(255) not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "email" varchar(255) not null, "email_verified" boolean not null default false, "password_hash" varchar(255) null, "managed_by" varchar(255) not null default 'database', "role" varchar(255) not null default 'user', "deleted_at" timestamptz null, primary key ("sub"));`);
+        this.addSql(`comment on table "user" is 'Registered users';`);
+        this.addSql(`comment on column "user"."sub" is 'Subject identifier';`);
+        this.addSql(`comment on column "user"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "user"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "user"."email" is 'User email address';`);
+        this.addSql(`comment on column "user"."email_verified" is 'Whether the user''s email has been verified';`);
+        this.addSql(`comment on column "user"."password_hash" is 'Hashed password for local authentication';`);
+        this.addSql(`comment on column "user"."managed_by" is 'Data source: config (from YAML) or database (runtime created)';`);
+        this.addSql(`comment on column "user"."role" is 'User role: user or admin';`);
+        this.addSql(`comment on column "user"."deleted_at" is 'Timestamp when the user requested account deletion (soft delete)';`);
+        this.addSql(`create index "user_email_unique" on "user" ("email");`);
+        this.addSql(`create index "user_deleted_at_idx" on "user" ("deleted_at");`);
+        this.addSql(`create table "user_consent" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "client_id" varchar(255) not null, "scopes" jsonb not null default '[]', "granted_at" timestamptz not null, "revoked_at" timestamptz null, primary key ("id"));`);
+        this.addSql(`comment on table "user_consent" is 'User consent decisions for OAuth clients';`);
+        this.addSql(`comment on column "user_consent"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "user_consent"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "user_consent"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "user_consent"."user_sub" is 'Reference to the user who granted consent';`);
+        this.addSql(`comment on column "user_consent"."client_id" is 'Reference to the OAuth client that received consent';`);
+        this.addSql(`comment on column "user_consent"."scopes" is 'List of scopes the user has consented to';`);
+        this.addSql(`comment on column "user_consent"."granted_at" is 'Timestamp when consent was first granted';`);
+        this.addSql(`comment on column "user_consent"."revoked_at" is 'Timestamp when consent was revoked (null if active)';`);
+        this.addSql(`create index "user_consent_user_sub_index" on "user_consent" ("user_sub");`);
+        this.addSql(`create index "user_consent_client_id_index" on "user_consent" ("client_id");`);
+        this.addSql(`alter table "user_consent" add constraint "user_consent_unique" unique ("user_sub", "client_id");`);
+        this.addSql(`create table "revoked_tokens" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "jti" varchar(255) not null, "token_type" text not null, "client_id" varchar(255) not null, "user_sub" varchar(255) not null, "expires_at" timestamptz not null, "revoked_at" timestamptz not null, primary key ("id"));`);
+        this.addSql(`comment on table "revoked_tokens" is 'Revoked OAuth tokens for invalidation before expiry';`);
+        this.addSql(`comment on column "revoked_tokens"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "revoked_tokens"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "revoked_tokens"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "revoked_tokens"."jti" is 'JWT ID (jti claim) of the revoked token';`);
+        this.addSql(`comment on column "revoked_tokens"."token_type" is 'Type of the revoked token (access_token or refresh_token)';`);
+        this.addSql(`comment on column "revoked_tokens"."client_id" is 'Reference to the OAuth client that the token was issued to';`);
+        this.addSql(`comment on column "revoked_tokens"."user_sub" is 'Reference to the user (subject) that the token was issued for';`);
+        this.addSql(`comment on column "revoked_tokens"."expires_at" is 'Original expiration time of the token. Used for cleanup of expired entries.';`);
+        this.addSql(`comment on column "revoked_tokens"."revoked_at" is 'Timestamp when the token was revoked';`);
+        this.addSql(`alter table "revoked_tokens" add constraint "revoked_tokens_jti_unique" unique ("jti");`);
+        this.addSql(`create index "revoked_token_jti_idx" on "revoked_tokens" ("jti");`);
+        this.addSql(`create index "revoked_token_client_user_idx" on "revoked_tokens" ("client_id", "user_sub");`);
+        this.addSql(`create index "revoked_token_expires_at_idx" on "revoked_tokens" ("expires_at");`);
+        this.addSql(`alter table "revoked_tokens" add constraint "revoked_tokens_token_type_check" check ("token_type" in ('access_token', 'refresh_token'));`);
+        this.addSql(`create table "password_reset" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "token" varchar(255) not null, "expires_at" timestamptz not null, "used" boolean not null default false, "used_at" timestamptz null, primary key ("id"));`);
+        this.addSql(`comment on table "password_reset" is 'Password reset tokens for user password recovery';`);
+        this.addSql(`comment on column "password_reset"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "password_reset"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "password_reset"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "password_reset"."user_sub" is 'Reference to the user';`);
+        this.addSql(`comment on column "password_reset"."token" is 'Unique password reset token';`);
+        this.addSql(`comment on column "password_reset"."expires_at" is 'Token expiration timestamp';`);
+        this.addSql(`comment on column "password_reset"."used" is 'Whether the token has been used';`);
+        this.addSql(`comment on column "password_reset"."used_at" is 'Timestamp when the token was used';`);
+        this.addSql(`create index "password_reset_user_sub_idx" on "password_reset" ("user_sub");`);
+        this.addSql(`create index "password_reset_token_idx" on "password_reset" ("token");`);
+        this.addSql(`create table "oauth_code" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "code_hash" varchar(255) not null, "client_id" varchar(255) not null, "user_sub" varchar(255) not null, "redirect_uri" varchar(255) null, "scope" jsonb not null default '[]', "nonce" varchar(255) not null, "code_challenge" varchar(255) not null, "code_challenge_method" text not null default 'S256', "expired_at" timestamptz not null, "consumed_at" timestamptz null, "auth_time" int null, primary key ("id"));`);
+        this.addSql(`comment on table "oauth_code" is 'Issued OAuth authorization codes';`);
+        this.addSql(`comment on column "oauth_code"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "oauth_code"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "oauth_code"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "oauth_code"."code_hash" is 'Hash of the issued authorization code';`);
+        this.addSql(`comment on column "oauth_code"."client_id" is 'Reference to the OAuth client that requested the code';`);
+        this.addSql(`comment on column "oauth_code"."user_sub" is 'Reference to the resource owner (user)';`);
+        this.addSql(`comment on column "oauth_code"."redirect_uri" is 'Redirect URI used during the authorization request';`);
+        this.addSql(`comment on column "oauth_code"."scope" is 'Scopes granted by the authorization code';`);
+        this.addSql(`comment on column "oauth_code"."nonce" is 'Nonce value associated with the authorization request';`);
+        this.addSql(`comment on column "oauth_code"."code_challenge" is 'PKCE code challenge value';`);
+        this.addSql(`comment on column "oauth_code"."code_challenge_method" is 'PKCE code challenge method';`);
+        this.addSql(`comment on column "oauth_code"."expired_at" is 'Absolute expiry timestamp for the code';`);
+        this.addSql(`comment on column "oauth_code"."consumed_at" is 'Timestamp when the code was redeemed';`);
+        this.addSql(`comment on column "oauth_code"."auth_time" is 'Time when the End-User authentication occurred (Unix timestamp). Used for auth_time claim in ID Token (OIDC Core 1.0 §2)';`);
+        this.addSql(`alter table "oauth_code" add constraint "oauth_code_code_hash_unique" unique ("code_hash");`);
+        this.addSql(`create index "auth_code_hash_idx" on "oauth_code" ("code_hash");`);
+        this.addSql(`create index "oauth_code_client_consumed_idx" on "oauth_code" ("client_id", "consumed_at");`);
+        this.addSql(`create index "oauth_code_expired_at_idx" on "oauth_code" ("expired_at");`);
+        this.addSql(`alter table "oauth_code" add constraint "oauth_code_code_challenge_method_check" check ("code_challenge_method" in ('S256', 'plain'));`);
+        this.addSql(`create table "email_verification" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "token" varchar(255) not null, "expires_at" timestamptz not null, "verified" boolean not null default false, "verified_at" timestamptz null, primary key ("id"));`);
+        this.addSql(`comment on table "email_verification" is 'Email verification tokens for user registration';`);
+        this.addSql(`comment on column "email_verification"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "email_verification"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "email_verification"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "email_verification"."user_sub" is 'Reference to the user';`);
+        this.addSql(`comment on column "email_verification"."token" is 'Unique verification token';`);
+        this.addSql(`comment on column "email_verification"."expires_at" is 'Token expiration timestamp';`);
+        this.addSql(`comment on column "email_verification"."verified" is 'Whether the token has been used';`);
+        this.addSql(`comment on column "email_verification"."verified_at" is 'Timestamp when the email was verified';`);
+        this.addSql(`create index "email_verification_user_sub_idx" on "email_verification" ("user_sub");`);
+        this.addSql(`create index "email_verification_token_idx" on "email_verification" ("token");`);
+        this.addSql(`create table "user_oauth" ("id" bigserial primary key, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "provider_name" varchar(255) not null, "provider_user_id" varchar(255) not null, "access_token" varchar(255) not null, "refresh_token" varchar(255) not null, "expires_at" timestamptz null);`);
+        this.addSql(`comment on table "user_oauth" is 'OAuth accounts linked to users';`);
+        this.addSql(`comment on column "user_oauth"."id" is 'Primary key as auto-incrementing bigint';`);
+        this.addSql(`comment on column "user_oauth"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "user_oauth"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "user_oauth"."user_sub" is 'Reference to the user';`);
+        this.addSql(`comment on column "user_oauth"."provider_name" is 'Name of the OAuth provider (e.g., google, facebook)';`);
+        this.addSql(`comment on column "user_oauth"."provider_user_id" is 'Unique user ID from the OAuth provider';`);
+        this.addSql(`comment on column "user_oauth"."access_token" is 'OAuth access token';`);
+        this.addSql(`comment on column "user_oauth"."refresh_token" is 'OAuth refresh token';`);
+        this.addSql(`comment on column "user_oauth"."expires_at" is 'Access token expiry timestamp';`);
+        this.addSql(`create index "user_oauth_user_sub_idx" on "user_oauth" ("user_sub");`);
+        this.addSql(`create index "user_oauth_user_provider_idx" on "user_oauth" ("user_sub", "provider_name");`);
+        this.addSql(`alter table "user_oauth" add constraint "user_oauth_provider_unique" unique ("provider_name", "provider_user_id");`);
+        this.addSql(`create table "user_passkey" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "credential_id" varchar(255) not null, "public_key" text not null, "counter" int not null default 0, "device_type" varchar(255) not null default 'singleDevice', "backed_up" boolean not null default false, "transports" jsonb null, "name" varchar(255) null, "aaguid" varchar(255) null, primary key ("id"));`);
+        this.addSql(`comment on table "user_passkey" is 'User passkeys for WebAuthn authentication';`);
+        this.addSql(`comment on column "user_passkey"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "user_passkey"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "user_passkey"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "user_passkey"."user_sub" is 'Reference to the user';`);
+        this.addSql(`comment on column "user_passkey"."credential_id" is 'WebAuthn credential ID (base64url encoded)';`);
+        this.addSql(`comment on column "user_passkey"."public_key" is 'Public key (base64url encoded)';`);
+        this.addSql(`comment on column "user_passkey"."counter" is 'Signature counter for replay attack prevention';`);
+        this.addSql(`comment on column "user_passkey"."device_type" is 'Credential device type: singleDevice or multiDevice';`);
+        this.addSql(`comment on column "user_passkey"."backed_up" is 'Whether the credential is backed up (synced passkey)';`);
+        this.addSql(`comment on column "user_passkey"."transports" is 'Supported authenticator transports (usb, ble, nfc, internal, etc)';`);
+        this.addSql(`comment on column "user_passkey"."name" is 'User-defined name for the passkey';`);
+        this.addSql(`comment on column "user_passkey"."aaguid" is 'Authenticator Attestation GUID for device identification';`);
+        this.addSql(`create index "user_passkey_user_sub_idx" on "user_passkey" ("user_sub");`);
+        this.addSql(`create index "user_passkey_credential_id_unique" on "user_passkey" ("credential_id");`);
+        this.addSql(`create table "user_terms_consent" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "terms_id" varchar(255) not null, "terms_version" varchar(255) not null, "agreed" boolean not null, "consent_type" varchar(255) not null, "agreed_at" timestamptz not null, primary key ("id"));`);
+        this.addSql(`comment on table "user_terms_consent" is 'User consent records for terms of service';`);
+        this.addSql(`comment on column "user_terms_consent"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "user_terms_consent"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "user_terms_consent"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "user_terms_consent"."user_sub" is 'Reference to the user who gave consent';`);
+        this.addSql(`comment on column "user_terms_consent"."terms_id" is 'Reference to the terms';`);
+        this.addSql(`comment on column "user_terms_consent"."terms_version" is 'Version of the term that was agreed to';`);
+        this.addSql(`comment on column "user_terms_consent"."agreed" is 'Whether the user agreed to the term';`);
+        this.addSql(`comment on column "user_terms_consent"."consent_type" is 'How consent was obtained: explicit (checkbox) or implicit';`);
+        this.addSql(`comment on column "user_terms_consent"."agreed_at" is 'Timestamp when consent was given';`);
+        this.addSql(`create index "user_terms_consent_user_sub_index" on "user_terms_consent" ("user_sub");`);
+        this.addSql(`create index "user_terms_consent_terms_id_index" on "user_terms_consent" ("terms_id");`);
+        this.addSql(`create index "user_terms_consent_user_terms_index" on "user_terms_consent" ("user_sub", "terms_id");`);
+        this.addSql(`create table "user_totp" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "secret" varchar(255) not null, "verified" boolean not null default false, "recovery_confirmed" boolean not null default false, primary key ("id"));`);
+        this.addSql(`comment on table "user_totp" is 'User TOTP secrets for two-factor authentication';`);
+        this.addSql(`comment on column "user_totp"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "user_totp"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "user_totp"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "user_totp"."user_sub" is 'Reference to the user';`);
+        this.addSql(`comment on column "user_totp"."secret" is 'TOTP secret key (base32 encoded)';`);
+        this.addSql(`comment on column "user_totp"."verified" is 'Whether the TOTP setup has been verified';`);
+        this.addSql(`comment on column "user_totp"."recovery_confirmed" is 'Whether the user has confirmed saving recovery codes';`);
+        this.addSql(`alter table "user_totp" add constraint "user_totp_user_unique" unique ("user_sub");`);
+        this.addSql(`create table "user_totp_recovery_code" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "user_sub" varchar(255) not null, "code_hash" varchar(255) not null, "used" boolean not null default false, "used_at" timestamptz null, primary key ("id"));`);
+        this.addSql(`comment on table "user_totp_recovery_code" is 'One-time recovery codes for TOTP two-factor authentication';`);
+        this.addSql(`comment on column "user_totp_recovery_code"."id" is 'Primary key as UUID';`);
+        this.addSql(`comment on column "user_totp_recovery_code"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "user_totp_recovery_code"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "user_totp_recovery_code"."user_sub" is 'Reference to the user';`);
+        this.addSql(`comment on column "user_totp_recovery_code"."code_hash" is 'Versioned recovery code hash';`);
+        this.addSql(`comment on column "user_totp_recovery_code"."used" is 'Whether this recovery code has been used';`);
+        this.addSql(`comment on column "user_totp_recovery_code"."used_at" is 'Timestamp when this recovery code was used';`);
+        this.addSql(`create index "user_totp_recovery_code_user_sub_idx" on "user_totp_recovery_code" ("user_sub");`);
+        this.addSql(`alter table "terms_content" add constraint "terms_content_terms_id_foreign" foreign key ("terms_id") references "terms" ("id") on delete cascade;`);
+        this.addSql(`alter table "user_consent" add constraint "user_consent_user_sub_foreign" foreign key ("user_sub") references "user" ("sub");`);
+        this.addSql(`alter table "user_consent" add constraint "user_consent_client_id_foreign" foreign key ("client_id") references "oauth_client" ("id");`);
+        this.addSql(`alter table "revoked_tokens" add constraint "revoked_tokens_client_id_foreign" foreign key ("client_id") references "oauth_client" ("id");`);
+        this.addSql(`alter table "revoked_tokens" add constraint "revoked_tokens_user_sub_foreign" foreign key ("user_sub") references "user" ("sub");`);
+        this.addSql(`alter table "password_reset" add constraint "password_reset_user_sub_foreign" foreign key ("user_sub") references "user" ("sub");`);
+        this.addSql(`alter table "oauth_code" add constraint "oauth_code_client_id_foreign" foreign key ("client_id") references "oauth_client" ("id");`);
+        this.addSql(`alter table "oauth_code" add constraint "oauth_code_user_sub_foreign" foreign key ("user_sub") references "user" ("sub");`);
+        this.addSql(`alter table "email_verification" add constraint "email_verification_user_sub_foreign" foreign key ("user_sub") references "user" ("sub");`);
+        this.addSql(`alter table "user_oauth" add constraint "user_oauth_user_sub_foreign" foreign key ("user_sub") references "user" ("sub");`);
+        this.addSql(`alter table "user_passkey" add constraint "user_passkey_user_sub_foreign" foreign key ("user_sub") references "user" ("sub") on delete cascade;`);
+        this.addSql(`alter table "user_terms_consent" add constraint "user_terms_consent_user_sub_foreign" foreign key ("user_sub") references "user" ("sub") on delete cascade;`);
+        this.addSql(`alter table "user_terms_consent" add constraint "user_terms_consent_terms_id_foreign" foreign key ("terms_id") references "terms" ("id") on delete cascade;`);
+        this.addSql(`alter table "user_totp" add constraint "user_totp_user_sub_foreign" foreign key ("user_sub") references "user" ("sub") on delete cascade;`);
+        this.addSql(`alter table "user_totp_recovery_code" add constraint "user_totp_recovery_code_user_sub_foreign" foreign key ("user_sub") references "user" ("sub") on delete cascade;`);
+    }
+}
+//# sourceMappingURL=Migration20260509171036_initial.js.map

package/dist/migrations/postgres/Migration20260509171036_initial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260509171036_initial.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260509171036_initial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,+BAAgC,SAAQ,SAAS;IACnD,EAAE;QACT,IAAI,CAAC,MAAM,CACT,uLAAuL,CACxL,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qEAAqE,CACtE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uEAAuE,CACxE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mGAAmG,CACpG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4EAA4E,CAC7E,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,uaAAua,CACxa,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wEAAwE,CACzE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2EAA2E,CAC5E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6EAA6E,CAC9E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6EAA6E,CAC9E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CACT,4HAA4H,CAC7H,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,wiBAAwiB,CACziB,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6EAA6E,CAC9E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4HAA4H,CAC7H,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+FAA+F,CAChG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qGAAqG,CACtG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mHAAmH,CACpH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yEAAyE,CAC1E,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,kbAAkb,CACnb,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8HAA8H,CAC/H,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+GAA+G,CAChH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4GAA4G,CAC7G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+GAA+G,CAChH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mHAAmH,CACpH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2HAA2H,CAC5H,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qHAAqH,CACtH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,yUAAyU,CAC1U,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2EAA2E,CAC5E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2GAA2G,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0EAA0E,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,mTAAmT,CACpT,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oEAAoE,CACrE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kEAAkE,CACnE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2EAA2E,CAC5E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+DAA+D,CAChE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2EAA2E,CAC5E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uGAAuG,CACxG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2GAA2G,CAC5G,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,qYAAqY,CACtY,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CACT,mFAAmF,CACpF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2GAA2G,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAE5E,IAAI,CAAC,MAAM,CACT,0TAA0T,CAC3T,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gFAAgF,CACjF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iEAAiE,CAClE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0FAA0F,CAC3F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4EAA4E,CAC7E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mGAAmG,CACpG,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,mVAAmV,CACpV,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iHAAiH,CAClH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iHAAiH,CAClH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mHAAmH,CACpH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mIAAmI,CACpI,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0IAA0I,CAC3I,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,sTAAsT,CACvT,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0FAA0F,CAC3F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2EAA2E,CAC5E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kFAAkF,CACnF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wEAAwE,CACzE,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,ghBAAghB,CACjhB,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sEAAsE,CACvE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+DAA+D,CAChE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oGAAoG,CACrG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0FAA0F,CAC3F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2KAA2K,CAC5K,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kEAAkE,CACnE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0EAA0E,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wIAAwI,CACzI,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,kUAAkU,CACnU,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uEAAuE,CACxE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sGAAsG,CACvG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gFAAgF,CACjF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gFAAgF,CACjF,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,8VAA8V,CAC/V,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oEAAoE,CACrE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mFAAmF,CACpF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uEAAuE,CACxE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wEAAwE,CACzE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0EAA0E,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sEAAsE,CACvE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oHAAoH,CACrH,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,2cAA2c,CAC5c,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iEAAiE,CAClE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yEAAyE,CAC1E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mGAAmG,CACpG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0EAA0E,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,iWAAiW,CAClW,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uEAAuE,CACxE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sGAAsG,CACvG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gFAAgF,CACjF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qGAAqG,CACtG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sGAAsG,CACvG,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,4SAA4S,CAC7S,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sEAAsE,CACvE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+GAA+G,CAChH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,gSAAgS,CACjS,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6GAA6G,CAC9G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4EAA4E,CAC7E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sGAAsG,CACvG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2GAA2G,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mGAAmG,CACpG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,mJAAmJ,CACpJ,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,+HAA+H,CAChI,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wIAAwI,CACzI,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,4IAA4I,CAC7I,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mIAAmI,CACpI,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,mIAAmI,CACpI,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,oIAAoI,CACrI,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2HAA2H,CAC5H,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,2IAA2I,CAC5I,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,2HAA2H,CAC5H,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,iJAAiJ,CAClJ,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,6JAA6J,CAC9J,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6JAA6J,CAC9J,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,2IAA2I,CAC5I,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,uKAAuK,CACxK,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/postgres/Migration20260512120000_add_scheduler_jobs.d.ts

@@ -0,0 +1,5 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260512120000_add_scheduler_jobs extends Migration {
+    up(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260512120000_add_scheduler_jobs.d.ts.map

package/dist/migrations/postgres/Migration20260512120000_add_scheduler_jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260512120000_add_scheduler_jobs.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260512120000_add_scheduler_jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,0CAA2C,SAAQ,SAAS;IAC9D,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CA6BpC"}

package/dist/migrations/postgres/Migration20260512120000_add_scheduler_jobs.js

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260512120000_add_scheduler_jobs extends Migration {
+    up() {
+        this.addSql(`create table "scheduled_jobs" ("id" varchar(255) not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "name" varchar(255) not null, "enabled" boolean not null default true, "cron" varchar(255) not null, "next_run_at" timestamptz null, "last_run_at" timestamptz null, "last_success_at" timestamptz null, "last_error_at" timestamptz null, "last_error" text null, "locked_by" varchar(255) null, "locked_until" timestamptz null, "run_count" int not null default 0 check ("run_count" >= 0), "failure_count" int not null default 0 check ("failure_count" >= 0), primary key ("id"));`);
+        this.addSql(`comment on table "scheduled_jobs" is 'Persistent scheduler jobs and leases';`);
+        this.addSql(`create index "scheduled_jobs_enabled_next_run_at_idx" on "scheduled_jobs" ("enabled", "next_run_at");`);
+        this.addSql(`create index "scheduled_jobs_locked_until_idx" on "scheduled_jobs" ("locked_until");`);
+        this.addSql(`create table "background_jobs" ("id" varchar(255) not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "job_id" varchar(255) not null, "payload" text not null, "status" varchar(255) not null default 'pending' check ("status" in ('pending', 'running', 'succeeded', 'failed')), "available_at" timestamptz not null, "locked_by" varchar(255) null, "locked_until" timestamptz null, "attempt_count" int not null default 0 check ("attempt_count" >= 0), "max_attempts" int not null default 3 check ("max_attempts" > 0), "last_error" text null, "completed_at" timestamptz null, primary key ("id"));`);
+        this.addSql(`comment on table "background_jobs" is 'Durable background job queue';`);
+        this.addSql(`create index "background_jobs_status_available_at_idx" on "background_jobs" ("status", "available_at");`);
+        this.addSql(`create index "background_jobs_locked_until_idx" on "background_jobs" ("locked_until");`);
+        this.addSql(`create index "background_jobs_job_id_idx" on "background_jobs" ("job_id");`);
+    }
+}
+//# sourceMappingURL=Migration20260512120000_add_scheduler_jobs.js.map

package/dist/migrations/postgres/Migration20260512120000_add_scheduler_jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260512120000_add_scheduler_jobs.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260512120000_add_scheduler_jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,0CAA2C,SAAQ,SAAS;IAC9D,EAAE;QACT,IAAI,CAAC,MAAM,CACT,4lBAA4lB,CAC7lB,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uGAAuG,CACxG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0mBAA0mB,CAC3mB,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uEAAuE,CACxE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yGAAyG,CAC1G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4EAA4E,CAC7E,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/postgres/Migration20260619075007.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260619075007 extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260619075007.d.ts.map

package/dist/migrations/postgres/Migration20260619075007.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260619075007.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260619075007.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,uBAAwB,SAAQ,SAAS;IAC3C,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAsJ1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CA0CtC"}