@tinyrack/issuary-server 0.31.0 → 0.32.2

package/dist/migrations/postgres/Migration20260910120000_api_security.js

@@ -0,0 +1,20 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910120000_api_security extends Migration {
+    async up() {
+        this.addSql(`alter table "user" add column "token_epoch" varchar(255) null;`);
+        this.addSql(`create table "auth_budget" ("id" varchar(255) not null primary key, "attempts" integer not null, "expires_at" timestamptz not null);`);
+        this.addSql(`create index "auth_budget_expires_at_index" on "auth_budget" ("expires_at");`);
+        this.addSql(`alter table "user_totp" add column "last_used_step" integer null;`);
+        this.addSql(`alter table "user" add column "sessions_invalidated_at" timestamptz null;`);
+        this.addSql(`create table "browser_session" ("id" varchar(255) not null primary key, "data" jsonb not null, "revision" integer not null default 0, "expires_at" timestamptz not null);`);
+        this.addSql(`create index "browser_session_expires_at_index" on "browser_session" ("expires_at");`);
+    }
+    async down() {
+        this.addSql(`alter table "user" drop column "token_epoch";`);
+        this.addSql(`drop table "auth_budget";`);
+        this.addSql(`alter table "user_totp" drop column "last_used_step";`);
+        this.addSql(`drop table "browser_session";`);
+        this.addSql(`alter table "user" drop column "sessions_invalidated_at";`);
+    }
+}
+//# sourceMappingURL=Migration20260910120000_api_security.js.map

package/dist/migrations/postgres/Migration20260910120000_api_security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910120000_api_security.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910120000_api_security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,oCAAqC,SAAQ,SAAS;IACxD,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sIAAsI,CACvI,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2EAA2E,CAC5E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2KAA2K,CAC5K,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/migrations/postgres/Migration20260910160000_security_followup.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910160000_security_followup extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration20260910160000_security_followup.d.ts.map

package/dist/migrations/postgres/Migration20260910160000_security_followup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910160000_security_followup.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910160000_security_followup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,qBAAa,yCAA0C,SAAQ,SAAS;IACvD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CA4BjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnC;CACF"}

package/dist/migrations/postgres/Migration20260910160000_security_followup.js

@@ -0,0 +1,23 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910160000_security_followup extends Migration {
+    async up() {
+        // Invalidate pending browser flows and sessions regardless of clock skew.
+        this.addSql(`delete from "browser_session";`);
+        this.addSql(`alter table "user" add column "security_revision" integer not null default 0;`);
+        this.addSql(`create table "oauth_grant" ("id" varchar(255) primary key, "user_sub" varchar(255) not null, "client_id" varchar(255) not null, "current_refresh_jti" varchar(255) null, "revoked_at" timestamptz null, "expires_at" timestamptz not null, "revision" integer not null default 0);`);
+        this.addSql(`create index "oauth_grant_expires_at_index" on "oauth_grant" ("expires_at");`);
+        this.addSql(`create index "oauth_grant_user_sub_client_id_index" on "oauth_grant" ("user_sub", "client_id");`);
+        this.addSql(`alter table "oauth_code" add column "grant_id" varchar(255) null;`);
+        this.addSql(`alter table "oauth_device_code" add column "grant_id" varchar(255) null;`);
+        this.addSql(`update "user" set "token_epoch" = gen_random_uuid()::text, "sessions_invalidated_at" = CURRENT_TIMESTAMP;`);
+        this.addSql(`update "oauth_code" set "expired_at" = CURRENT_TIMESTAMP;`);
+        this.addSql(`update "oauth_device_code" set "expires_at" = CURRENT_TIMESTAMP;`);
+    }
+    async down() {
+        this.addSql(`alter table "user" drop column "security_revision";`);
+        this.addSql(`alter table "oauth_code" drop column "grant_id";`);
+        this.addSql(`alter table "oauth_device_code" drop column "grant_id";`);
+        this.addSql(`drop table "oauth_grant";`);
+    }
+}
+//# sourceMappingURL=Migration20260910160000_security_followup.js.map

package/dist/migrations/postgres/Migration20260910160000_security_followup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910160000_security_followup.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910160000_security_followup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,MAAM,OAAO,yCAA0C,SAAQ,SAAS;IAC7D,KAAK,CAAC,EAAE;QACf,0EAA0E;QAC1E,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oRAAoR,CACrR,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0EAA0E,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2GAA2G,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,qDAAqD,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/migrations/postgres/Migration20260910200000_authentication_epoch.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910200000_authentication_epoch extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration20260910200000_authentication_epoch.d.ts.map

package/dist/migrations/postgres/Migration20260910200000_authentication_epoch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910200000_authentication_epoch.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910200000_authentication_epoch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,4CAA6C,SAAQ,SAAS;IAC1D,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CA6BjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CASnC;CACF"}

package/dist/migrations/postgres/Migration20260910200000_authentication_epoch.js

@@ -0,0 +1,28 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910200000_authentication_epoch extends Migration {
+    async up() {
+        this.addSql(`delete from "browser_session";`);
+        this.addSql(`delete from "email_verification";`);
+        this.addSql(`delete from "password_reset";`);
+        this.addSql(`delete from "oauth_code";`);
+        this.addSql(`delete from "oauth_device_code";`);
+        this.addSql(`delete from "pending_oauth_registration";`);
+        this.addSql(`update "background_jobs" set "status" = 'failed', "payload" = 'null', "locked_by" = null, "locked_until" = null, "last_error" = 'AUTHENTICATION_EPOCH_TRANSITION', "completed_at" = CURRENT_TIMESTAMP where "job_id" = 'security.mail';`);
+        this.addSql(`update "user" set "token_epoch" = gen_random_uuid()::text, "sessions_invalidated_at" = CURRENT_TIMESTAMP;`);
+        this.addSql(`alter table "user" alter column "token_epoch" set not null;`);
+        this.addSql(`alter table "email_verification" add column "user_epoch" varchar(255) not null;`);
+        this.addSql(`alter table "password_reset" add column "user_epoch" varchar(255) not null;`);
+        this.addSql(`alter table "oauth_code" add column "user_epoch" varchar(255) not null;`);
+        this.addSql(`alter table "oauth_device_code" add column "user_epoch" varchar(255) null;`);
+        this.addSql(`alter table "pending_oauth_registration" add column "consumed_at" timestamptz null;`);
+    }
+    async down() {
+        this.addSql(`alter table "user" alter column "token_epoch" drop not null;`);
+        this.addSql(`alter table "email_verification" drop column "user_epoch";`);
+        this.addSql(`alter table "password_reset" drop column "user_epoch";`);
+        this.addSql(`alter table "oauth_code" drop column "user_epoch";`);
+        this.addSql(`alter table "oauth_device_code" drop column "user_epoch";`);
+        this.addSql(`alter table "pending_oauth_registration" drop column "consumed_at";`);
+    }
+}
+//# sourceMappingURL=Migration20260910200000_authentication_epoch.js.map

package/dist/migrations/postgres/Migration20260910200000_authentication_epoch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910200000_authentication_epoch.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910200000_authentication_epoch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,4CAA6C,SAAQ,SAAS;IAChE,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CACT,yOAAyO,CAC1O,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2GAA2G,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6EAA6E,CAC9E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yEAAyE,CAC1E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4EAA4E,CAC7E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CACT,qEAAqE,CACtE,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/postgres/Migration20260910220000_flow_revocation.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910220000_flow_revocation extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration20260910220000_flow_revocation.d.ts.map

package/dist/migrations/postgres/Migration20260910220000_flow_revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910220000_flow_revocation.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910220000_flow_revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,uCAAwC,SAAQ,SAAS;IACrD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAsBjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnC;CACF"}

package/dist/migrations/postgres/Migration20260910220000_flow_revocation.js

@@ -0,0 +1,19 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910220000_flow_revocation extends Migration {
+    async up() {
+        this.addSql(`alter table "email_verification" add column "revoked_at" timestamptz null default null;`);
+        this.addSql(`update "email_verification" set "revoked_at" = CURRENT_TIMESTAMP where "verified" = false;`);
+        this.addSql(`alter table "password_reset" add column "revoked_at" timestamptz null default null;`);
+        this.addSql(`update "password_reset" set "revoked_at" = CURRENT_TIMESTAMP where "used" = false;`);
+        this.addSql(`alter table "oauth_code" add column "client_epoch" varchar(255) not null default '';`);
+        this.addSql(`alter table "oauth_device_code" add column "client_epoch" varchar(255) not null default '';`);
+        this.addSql(`update "background_jobs" set "status" = 'failed', "payload" = 'null', "locked_by" = null, "locked_until" = null, "last_error" = 'FLOW_REVOCATION_TRANSITION', "completed_at" = CURRENT_TIMESTAMP where "job_id" = 'security.mail' and "status" in ('pending', 'running');`);
+    }
+    async down() {
+        this.addSql(`alter table "email_verification" drop column "revoked_at";`);
+        this.addSql(`alter table "password_reset" drop column "revoked_at";`);
+        this.addSql(`alter table "oauth_code" drop column "client_epoch";`);
+        this.addSql(`alter table "oauth_device_code" drop column "client_epoch";`);
+    }
+}
+//# sourceMappingURL=Migration20260910220000_flow_revocation.js.map

package/dist/migrations/postgres/Migration20260910220000_flow_revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910220000_flow_revocation.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910220000_flow_revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,uCAAwC,SAAQ,SAAS;IAC3D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2QAA2Q,CAC5Q,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/migrations/postgres/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAavF,eAAO,MAAM,mBAAmB,4CAa/B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAiBvF,eAAO,MAAM,mBAAmB,4CAiB/B,CAAC"}

package/dist/migrations/postgres/index.js

@@ -10,6 +10,10 @@ import { Migration20260825110000_add_password_reset_required } from './Migration
 import { Migration20260825140000_drop_password_reset_required } from './Migration20260825140000_drop_password_reset_required.js';
 import { Migration20260827090000_archive_terms } from './Migration20260827090000_archive_terms.js';
 import { Migration20260904090000_add_oauth_client_lifecycle } from './Migration20260904090000_add_oauth_client_lifecycle.js';
+import { Migration20260910120000_api_security } from './Migration20260910120000_api_security.js';
+import { Migration20260910160000_security_followup } from './Migration20260910160000_security_followup.js';
+import { Migration20260910200000_authentication_epoch } from './Migration20260910200000_authentication_epoch.js';
+import { Migration20260910220000_flow_revocation } from './Migration20260910220000_flow_revocation.js';
 export const POSTGRES_MIGRATIONS = [
     Migration20260509171036_initial,
     Migration20260512120000_add_scheduler_jobs,
@@ -23,5 +27,9 @@ export const POSTGRES_MIGRATIONS = [
     Migration20260825140000_drop_password_reset_required,
     Migration20260827090000_archive_terms,
     Migration20260904090000_add_oauth_client_lifecycle,
+    Migration20260910120000_api_security,
+    Migration20260910160000_security_followup,
+    Migration20260910200000_authentication_epoch,
+    Migration20260910220000_flow_revocation,
 ];
 //# sourceMappingURL=index.js.map

package/dist/migrations/postgres/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AACzI,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,oDAAoD,EAAE,MAAM,2DAA2D,CAAC;AACjI,OAAO,EAAE,qCAAqC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAE7H,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;IACxD,mDAAmD;IACnD,oDAAoD;IACpD,qCAAqC;IACrC,kDAAkD;CACnD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AACzI,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,oDAAoD,EAAE,MAAM,2DAA2D,CAAC;AACjI,OAAO,EAAE,qCAAqC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,gDAAgD,CAAC;AAC3G,OAAO,EAAE,4CAA4C,EAAE,MAAM,mDAAmD,CAAC;AACjH,OAAO,EAAE,uCAAuC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;IACxD,mDAAmD;IACnD,oDAAoD;IACpD,qCAAqC;IACrC,kDAAkD;IAClD,oCAAoC;IACpC,yCAAyC;IACzC,4CAA4C;IAC5C,uCAAuC;CACxC,CAAC"}

package/dist/migrations/sqlite/Migration20260910120000_api_security.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910120000_api_security extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration20260910120000_api_security.d.ts.map

package/dist/migrations/sqlite/Migration20260910120000_api_security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910120000_api_security.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910120000_api_security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,oCAAqC,SAAQ,SAAS;IAClD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAsBjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAMnC;CACF"}

package/dist/migrations/sqlite/Migration20260910120000_api_security.js

@@ -0,0 +1,20 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910120000_api_security extends Migration {
+    async up() {
+        this.addSql(`alter table "user" add column "token_epoch" varchar(255) null;`);
+        this.addSql(`create table "auth_budget" ("id" varchar(255) not null primary key, "attempts" integer not null, "expires_at" datetime not null);`);
+        this.addSql(`create index "auth_budget_expires_at_index" on "auth_budget" ("expires_at");`);
+        this.addSql(`alter table "user_totp" add column "last_used_step" integer null;`);
+        this.addSql(`alter table "user" add column "sessions_invalidated_at" datetime null;`);
+        this.addSql(`create table "browser_session" ("id" varchar(255) not null primary key, "data" json not null, "revision" integer not null default 0, "expires_at" datetime not null);`);
+        this.addSql(`create index "browser_session_expires_at_index" on "browser_session" ("expires_at");`);
+    }
+    async down() {
+        this.addSql(`alter table "user" drop column "token_epoch";`);
+        this.addSql(`drop table "auth_budget";`);
+        this.addSql(`alter table "user_totp" drop column "last_used_step";`);
+        this.addSql(`drop table "browser_session";`);
+        this.addSql(`alter table "user" drop column "sessions_invalidated_at";`);
+    }
+}
+//# sourceMappingURL=Migration20260910120000_api_security.js.map

package/dist/migrations/sqlite/Migration20260910120000_api_security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910120000_api_security.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910120000_api_security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,oCAAqC,SAAQ,SAAS;IACxD,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mIAAmI,CACpI,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wEAAwE,CACzE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uKAAuK,CACxK,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/migrations/sqlite/Migration20260910160000_security_followup.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910160000_security_followup extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration20260910160000_security_followup.d.ts.map

package/dist/migrations/sqlite/Migration20260910160000_security_followup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910160000_security_followup.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910160000_security_followup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,qBAAa,yCAA0C,SAAQ,SAAS;IACvD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CA0BjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnC;CACF"}

package/dist/migrations/sqlite/Migration20260910160000_security_followup.js

@@ -0,0 +1,23 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910160000_security_followup extends Migration {
+    async up() {
+        // Invalidate pending browser flows and sessions regardless of clock skew.
+        this.addSql(`delete from "browser_session";`);
+        this.addSql(`alter table "user" add column "security_revision" integer not null default 0;`);
+        this.addSql(`create table "oauth_grant" ("id" text not null primary key, "user_sub" text not null, "client_id" text not null, "current_refresh_jti" text null, "revoked_at" datetime null, "expires_at" datetime not null, "revision" integer not null default 0);`);
+        this.addSql(`create index "oauth_grant_expires_at_index" on "oauth_grant" ("expires_at");`);
+        this.addSql(`create index "oauth_grant_user_sub_client_id_index" on "oauth_grant" ("user_sub", "client_id");`);
+        this.addSql(`alter table "oauth_code" add column "grant_id" text null;`);
+        this.addSql(`alter table "oauth_device_code" add column "grant_id" text null;`);
+        this.addSql(`update "user" set "token_epoch" = lower(hex(randomblob(16))), "sessions_invalidated_at" = CURRENT_TIMESTAMP;`);
+        this.addSql(`update "oauth_code" set "expired_at" = CURRENT_TIMESTAMP;`);
+        this.addSql(`update "oauth_device_code" set "expires_at" = CURRENT_TIMESTAMP;`);
+    }
+    async down() {
+        this.addSql(`alter table "user" drop column "security_revision";`);
+        this.addSql(`alter table "oauth_code" drop column "grant_id";`);
+        this.addSql(`alter table "oauth_device_code" drop column "grant_id";`);
+        this.addSql(`drop table "oauth_grant";`);
+    }
+}
+//# sourceMappingURL=Migration20260910160000_security_followup.js.map

package/dist/migrations/sqlite/Migration20260910160000_security_followup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910160000_security_followup.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910160000_security_followup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,MAAM,OAAO,yCAA0C,SAAQ,SAAS;IAC7D,KAAK,CAAC,EAAE;QACf,0EAA0E;QAC1E,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uPAAuP,CACxP,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CACT,kEAAkE,CACnE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,qDAAqD,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/migrations/sqlite/Migration20260910200000_authentication_epoch.d.ts

@@ -0,0 +1,8 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910200000_authentication_epoch extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+    private preserveUserDependents;
+    private restoreUserDependents;
+}
+//# sourceMappingURL=Migration20260910200000_authentication_epoch.d.ts.map

package/dist/migrations/sqlite/Migration20260910200000_authentication_epoch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910200000_authentication_epoch.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910200000_authentication_epoch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,4CAA6C,SAAQ,SAAS;IAC1D,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAwCjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAoBnC;IAED,OAAO,CAAC,sBAAsB;IAiB9B,OAAO,CAAC,qBAAqB;CAsB9B"}

package/dist/migrations/sqlite/Migration20260910200000_authentication_epoch.js

@@ -0,0 +1,72 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910200000_authentication_epoch extends Migration {
+    async up() {
+        this.addSql(`delete from "browser_session";`);
+        this.addSql(`delete from "email_verification";`);
+        this.addSql(`delete from "password_reset";`);
+        this.addSql(`delete from "oauth_code";`);
+        this.addSql(`delete from "oauth_device_code";`);
+        this.addSql(`delete from "pending_oauth_registration";`);
+        this.addSql(`update "background_jobs" set "status" = 'failed', "payload" = 'null', "locked_by" = null, "locked_until" = null, "last_error" = 'AUTHENTICATION_EPOCH_TRANSITION', "completed_at" = CURRENT_TIMESTAMP where "job_id" = 'security.mail';`);
+        this.addSql(`update "user" set "token_epoch" = lower(hex(randomblob(16))), "sessions_invalidated_at" = CURRENT_TIMESTAMP;`);
+        this.preserveUserDependents();
+        this.addSql(`create table "user_epoch_transition" ("sub" text not null primary key, "created_at" datetime not null, "updated_at" datetime not null, "email" text not null, "email_verified" integer not null default false, "password_hash" text null, "managed_by" text not null default 'database', "role" text not null default 'user', "deleted_at" datetime null, "token_epoch" text not null, "sessions_invalidated_at" datetime null, "security_revision" integer not null default 0);`);
+        this.addSql(`insert into "user_epoch_transition" ("sub","created_at","updated_at","email","email_verified","password_hash","managed_by","role","deleted_at","token_epoch","sessions_invalidated_at","security_revision") select "sub","created_at","updated_at","email","email_verified","password_hash","managed_by","role","deleted_at","token_epoch","sessions_invalidated_at","security_revision" from "user";`);
+        this.addSql(`drop table "user";`);
+        this.addSql(`alter table "user_epoch_transition" rename to "user";`);
+        this.addSql(`create unique index "user_email_unique" on "user" ("email");`);
+        this.addSql(`create index "user_deleted_at_idx" on "user" ("deleted_at");`);
+        this.restoreUserDependents();
+        this.addSql(`alter table "email_verification" add column "user_epoch" text not null;`);
+        this.addSql(`alter table "password_reset" add column "user_epoch" text not null;`);
+        this.addSql(`alter table "oauth_code" add column "user_epoch" text not null;`);
+        this.addSql(`alter table "oauth_device_code" add column "user_epoch" text null;`);
+        this.addSql(`alter table "pending_oauth_registration" add column "consumed_at" datetime null;`);
+    }
+    async down() {
+        this.preserveUserDependents();
+        this.addSql(`create table "user_epoch_transition" ("sub" text not null primary key, "created_at" datetime not null, "updated_at" datetime not null, "email" text not null, "email_verified" integer not null default false, "password_hash" text null, "managed_by" text not null default 'database', "role" text not null default 'user', "deleted_at" datetime null, "token_epoch" text null, "sessions_invalidated_at" datetime null, "security_revision" integer not null default 0);`);
+        this.addSql(`insert into "user_epoch_transition" ("sub","created_at","updated_at","email","email_verified","password_hash","managed_by","role","deleted_at","token_epoch","sessions_invalidated_at","security_revision") select "sub","created_at","updated_at","email","email_verified","password_hash","managed_by","role","deleted_at","token_epoch","sessions_invalidated_at","security_revision" from "user";`);
+        this.addSql(`drop table "user";`);
+        this.addSql(`alter table "user_epoch_transition" rename to "user";`);
+        this.addSql(`create unique index "user_email_unique" on "user" ("email");`);
+        this.addSql(`create index "user_deleted_at_idx" on "user" ("deleted_at");`);
+        this.restoreUserDependents();
+        this.addSql(`alter table "email_verification" drop column "user_epoch";`);
+        this.addSql(`alter table "password_reset" drop column "user_epoch";`);
+        this.addSql(`alter table "oauth_code" drop column "user_epoch";`);
+        this.addSql(`alter table "oauth_device_code" drop column "user_epoch";`);
+        this.addSql(`alter table "pending_oauth_registration" drop column "consumed_at";`);
+    }
+    preserveUserDependents() {
+        // foreign_keys cannot be disabled within the migrator transaction.
+        // Preserve cascading children and check the final graph before resetting
+        // SQLite's deferred DROP TABLE constraint counters.
+        this.addSql('pragma defer_foreign_keys = on;');
+        for (const table of [
+            'user_passkey',
+            'user_totp',
+            'user_totp_recovery_code',
+            'user_terms_consent',
+        ]) {
+            this.addSql(`create temp table "epoch_saved_${table}" as select * from "${table}";`);
+        }
+    }
+    restoreUserDependents() {
+        for (const table of [
+            'user_passkey',
+            'user_totp',
+            'user_totp_recovery_code',
+            'user_terms_consent',
+        ]) {
+            this.addSql(`delete from "${table}";`);
+            this.addSql(`insert into "${table}" select * from "epoch_saved_${table}";`);
+            this.addSql(`drop table "epoch_saved_${table}";`);
+        }
+        this.addSql('create temp table epoch_foreign_key_check (valid integer not null check (valid = 1));');
+        this.addSql('insert into epoch_foreign_key_check select case when count(*) = 0 then 1 else 0 end from pragma_foreign_key_check;');
+        this.addSql('drop table epoch_foreign_key_check;');
+        this.addSql('pragma defer_foreign_keys = off;');
+    }
+}
+//# sourceMappingURL=Migration20260910200000_authentication_epoch.js.map

package/dist/migrations/sqlite/Migration20260910200000_authentication_epoch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910200000_authentication_epoch.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910200000_authentication_epoch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,4CAA6C,SAAQ,SAAS;IAChE,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CACT,yOAAyO,CAC1O,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CACT,kdAAkd,CACnd,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uYAAuY,CACxY,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CACT,yEAAyE,CAC1E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qEAAqE,CACtE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iEAAiE,CAClE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oEAAoE,CACrE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CACT,8cAA8c,CAC/c,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uYAAuY,CACxY,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CACT,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAEO,sBAAsB;QAC5B,mEAAmE;QACnE,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI;YAClB,cAAc;YACd,WAAW;YACX,yBAAyB;YACzB,oBAAoB;SACrB,EAAE,CAAC;YACF,IAAI,CAAC,MAAM,CACT,kCAAkC,KAAK,uBAAuB,KAAK,IAAI,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB;QAC3B,KAAK,MAAM,KAAK,IAAI;YAClB,cAAc;YACd,WAAW;YACX,yBAAyB;YACzB,oBAAoB;SACrB,EAAE,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CACT,gBAAgB,KAAK,gCAAgC,KAAK,IAAI,CAC/D,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,2BAA2B,KAAK,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oHAAoH,CACrH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;CACF"}

package/dist/migrations/sqlite/Migration20260910220000_flow_revocation.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910220000_flow_revocation extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration20260910220000_flow_revocation.d.ts.map

package/dist/migrations/sqlite/Migration20260910220000_flow_revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910220000_flow_revocation.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910220000_flow_revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,uCAAwC,SAAQ,SAAS;IACrD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAsBjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnC;CACF"}

package/dist/migrations/sqlite/Migration20260910220000_flow_revocation.js

@@ -0,0 +1,19 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260910220000_flow_revocation extends Migration {
+    async up() {
+        this.addSql(`alter table "email_verification" add column "revoked_at" datetime null default null;`);
+        this.addSql(`update "email_verification" set "revoked_at" = (cast(strftime('%s', 'now') as integer) * 1000) where "verified" = 0;`);
+        this.addSql(`alter table "password_reset" add column "revoked_at" datetime null default null;`);
+        this.addSql(`update "password_reset" set "revoked_at" = (cast(strftime('%s', 'now') as integer) * 1000) where "used" = 0;`);
+        this.addSql(`alter table "oauth_code" add column "client_epoch" varchar(255) not null default '';`);
+        this.addSql(`alter table "oauth_device_code" add column "client_epoch" varchar(255) not null default '';`);
+        this.addSql(`update "background_jobs" set "status" = 'failed', "payload" = 'null', "locked_by" = null, "locked_until" = null, "last_error" = 'FLOW_REVOCATION_TRANSITION', "completed_at" = (cast(strftime('%s', 'now') as integer) * 1000) where "job_id" = 'security.mail' and "status" in ('pending', 'running');`);
+    }
+    async down() {
+        this.addSql(`alter table "email_verification" drop column "revoked_at";`);
+        this.addSql(`alter table "password_reset" drop column "revoked_at";`);
+        this.addSql(`alter table "oauth_code" drop column "client_epoch";`);
+        this.addSql(`alter table "oauth_device_code" drop column "client_epoch";`);
+    }
+}
+//# sourceMappingURL=Migration20260910220000_flow_revocation.js.map

package/dist/migrations/sqlite/Migration20260910220000_flow_revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910220000_flow_revocation.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260910220000_flow_revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,uCAAwC,SAAQ,SAAS;IAC3D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sHAAsH,CACvH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kFAAkF,CACnF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,ySAAyS,CAC1S,CAAC;IACJ,CAAC;IACQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/migrations/sqlite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAavF,eAAO,MAAM,iBAAiB,4CAa7B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAiBvF,eAAO,MAAM,iBAAiB,4CAiB7B,CAAC"}

package/dist/migrations/sqlite/index.js

@@ -10,6 +10,10 @@ import { Migration20260825110000_add_password_reset_required } from './Migration
 import { Migration20260825140000_drop_password_reset_required } from './Migration20260825140000_drop_password_reset_required.js';
 import { Migration20260827090000_archive_terms } from './Migration20260827090000_archive_terms.js';
 import { Migration20260904090000_add_oauth_client_lifecycle } from './Migration20260904090000_add_oauth_client_lifecycle.js';
+import { Migration20260910120000_api_security } from './Migration20260910120000_api_security.js';
+import { Migration20260910160000_security_followup } from './Migration20260910160000_security_followup.js';
+import { Migration20260910200000_authentication_epoch } from './Migration20260910200000_authentication_epoch.js';
+import { Migration20260910220000_flow_revocation } from './Migration20260910220000_flow_revocation.js';
 export const SQLITE_MIGRATIONS = [
     Migration20260509171226_initial,
     Migration20260512120000_add_scheduler_jobs,
@@ -23,5 +27,9 @@ export const SQLITE_MIGRATIONS = [
     Migration20260825140000_drop_password_reset_required,
     Migration20260827090000_archive_terms,
     Migration20260904090000_add_oauth_client_lifecycle,
+    Migration20260910120000_api_security,
+    Migration20260910160000_security_followup,
+    Migration20260910200000_authentication_epoch,
+    Migration20260910220000_flow_revocation,
 ];
 //# sourceMappingURL=index.js.map

package/dist/migrations/sqlite/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AACzI,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,oDAAoD,EAAE,MAAM,2DAA2D,CAAC;AACjI,OAAO,EAAE,qCAAqC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAE7H,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;IACxD,mDAAmD;IACnD,oDAAoD;IACpD,qCAAqC;IACrC,kDAAkD;CACnD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AACzI,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,oDAAoD,EAAE,MAAM,2DAA2D,CAAC;AACjI,OAAO,EAAE,qCAAqC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,oCAAoC,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,gDAAgD,CAAC;AAC3G,OAAO,EAAE,4CAA4C,EAAE,MAAM,mDAAmD,CAAC;AACjH,OAAO,EAAE,uCAAuC,EAAE,MAAM,8CAA8C,CAAC;AAEvG,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;IACxD,mDAAmD;IACnD,oDAAoD;IACpD,qCAAqC;IACrC,kDAAkD;IAClD,oCAAoC;IACpC,yCAAyC;IACzC,4CAA4C;IAC5C,uCAAuC;CACxC,CAAC"}

package/dist/repositories/email-verification.repository.d.ts

@@ -7,6 +7,7 @@ export declare class EmailVerificationRepository extends EntityRepository<IEmail
      */
     generateToken(params: {
         userSub: string;
+        userEpoch: string;
         expiresInHours?: number;
     }): Promise<IEmailVerificationEntity>;
     /**

package/dist/repositories/email-verification.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/email-verification.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAO,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,qBAAa,2BAA4B,SAAQ,gBAAgB,CAAC,wBAAwB,CAAC;IACzF;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAwBpC;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAsBzE;CACF"}
+{"version":3,"file":"email-verification.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/email-verification.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAO,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,qBAAa,2BAA4B,SAAQ,gBAAgB,CAAC,wBAAwB,CAAC;IACzF;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAyBpC;IAED;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAQzE;CACF"}

package/dist/repositories/email-verification.repository.js

@@ -9,15 +9,14 @@ export class EmailVerificationRepository extends EntityRepository {
         const token = crypto.randomUUID();
         const expiresInHours = params.expiresInHours || 24;
         const expiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000);
-        const previousTokens = await this.find({
+        await this.nativeUpdate({
             user: ref(UserEntity, params.userSub),
             verified: false,
-        });
-        for (const prevToken of previousTokens) {
-            prevToken.expiresAt = new Date(); // Expire immediately
-        }
+            revoked_at: null,
+        }, { revoked_at: new Date() });
         const entity = this.create({
             user: params.userSub,
+            user_epoch: params.userEpoch,
             token,
             expiresAt,
         });
@@ -29,19 +28,11 @@ export class EmailVerificationRepository extends EntityRepository {
      * @returns The verified entity with user populated, or null if invalid
      */
     async verifyToken(token) {
-        const entity = await this.findOne({ token, verified: false }, { populate: ['user'] });
-        if (!entity) {
-            return null;
-        }
-        // Check if expired
-        if (entity.expiresAt < new Date()) {
+        const now = new Date();
+        const changed = await this.nativeUpdate({ token, verified: false, revoked_at: null, expiresAt: { $gt: now } }, { verified: true, verifiedAt: now });
+        if (changed !== 1)
             return null;
-        }
-        // Mark as verified
-        entity.verified = true;
-        entity.verifiedAt = new Date();
-        await this.getEntityManager().flush();
-        return entity;
+        return this.findOne({ token }, { populate: ['user'], refresh: true });
     }
 }
 //# sourceMappingURL=email-verification.repository.js.map

package/dist/repositories/email-verification.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.repository.js","sourceRoot":"","sources":["../../src/repositories/email-verification.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,OAAO,2BAA4B,SAAQ,gBAA0C;IACzF;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEzE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YACrC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC;YACrC,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;YACvC,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,qBAAqB;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAC1B,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CACvB,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB;QACnB,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB;QACnB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAE/B,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,CAAC;QAEtC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"email-verification.repository.js","sourceRoot":"","sources":["../../src/repositories/email-verification.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,OAAO,2BAA4B,SAAQ,gBAA0C;IACzF;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAInB;QACC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,YAAY,CACrB;YACE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC;YACrC,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;SACjB,EACD,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAC3B,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EACrE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CACpC,CAAC;QACF,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/repositories/oauth-code.repository.d.ts

@@ -3,7 +3,9 @@ import type { IOAuthCodeEntity, OAuthCodeChallengeMethods } from '../entities/oa
 export declare class OAuthCodeRepository extends EntityRepository<IOAuthCodeEntity> {
     createAuthorizationCode(params: {
         clientId: string;
+        clientEpoch?: string;
         userSub: string;
+        userEpoch?: string;
         codeHash: string;
         redirectUri: string;
         scope: string[];

package/dist/repositories/oauth-code.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAE1C,qBAAa,mBAAoB,SAAQ,gBAAgB,CAAC,gBAAgB,CAAC;IACnE,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;QAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,wEAAwE;QACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5B;IAEK,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAMlC;IAEK,wBAAwB,CAAC,MAAM,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBnC;CACF"}
+{"version":3,"file":"oauth-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAG1C,qBAAa,mBAAoB,SAAQ,gBAAgB,CAAC,gBAAgB,CAAC;IACnE,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;QAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,wEAAwE;QACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgC5B;IAEK,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAMlC;IAEK,wBAAwB,CAAC,MAAM,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBnC;CACF"}

package/dist/repositories/oauth-code.repository.js

@@ -1,11 +1,19 @@
 import { EntityRepository } from '@mikro-orm/core';
+import { OAuthClientEntitySchema } from '../entities/oauth-client.entity.js';
+import { UserEntity } from '../entities/user.entity.js';
 export class OAuthCodeRepository extends EntityRepository {
     async createAuthorizationCode(params) {
         const expiresInSeconds = params.expiresInSeconds || 600;
         const expiredAt = new Date(Date.now() + expiresInSeconds * 1000);
+        const user = await this.getEntityManager().findOneOrFail(UserEntity, {
+            sub: params.userSub,
+        });
+        const client = await this.getEntityManager().findOneOrFail(OAuthClientEntitySchema, { id: params.clientId });
         const entity = this.create({
             client: params.clientId,
+            client_epoch: params.clientEpoch ?? client.tokenEpoch ?? '',
             user: params.userSub,
+            user_epoch: params.userEpoch ?? user.token_epoch,
             codeHash: params.codeHash,
             redirectUri: params.redirectUri,
             scope: params.scope,

package/dist/repositories/oauth-code.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-code.repository.js","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAMnD,MAAM,OAAO,mBAAoB,SAAQ,gBAAkC;IACzE,KAAK,CAAC,uBAAuB,CAAC,MAY7B;QACC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,MAAM;YACzD,SAAS;YACT,4EAA4E;YAC5E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAEtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iCAAiC,CACrC,QAAgB,EAChB,QAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAI9B;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;SACtC,EACD,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"oauth-code.repository.js","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAK7E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,OAAO,mBAAoB,SAAQ,gBAAkC;IACzE,KAAK,CAAC,uBAAuB,CAAC,MAc7B;QACC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE;YACnE,GAAG,EAAE,MAAM,CAAC,OAAO;SACpB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CACxD,uBAAuB,EACvB,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CACxB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,YAAY,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE;YAC3D,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW;YAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,MAAM;YACzD,SAAS;YACT,4EAA4E;YAC5E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAEtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iCAAiC,CACrC,QAAgB,EAChB,QAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAI9B;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;SACtC,EACD,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/repositories/oauth-device-code.repository.d.ts

@@ -2,8 +2,10 @@ import { EntityRepository } from '@mikro-orm/core';
 import type { IOAuthDeviceCodeEntity } from '../entities/oauth-device-code.entity.ts';
 export type PendingDevicePollResult = 'authorization_pending' | 'slow_down';
 export declare class OAuthDeviceCodeRepository extends EntityRepository<IOAuthDeviceCodeEntity> {
+    private withCurrentClient;
     createDeviceAuthorization(params: {
         clientId: string;
+        clientEpoch?: string;
         deviceCodeHash: string;
         userCodeHash: string;
         scope: string[];
@@ -13,6 +15,7 @@ export declare class OAuthDeviceCodeRepository extends EntityRepository<IOAuthDe
     approvePendingByUserCodeHash(params: {
         userCodeHash: string;
         userSub: string;
+        userEpoch?: string;
         approvedAt: Date;
     }): Promise<IOAuthDeviceCodeEntity | null>;
     denyPendingByUserCodeHash(params: {