appos 0.3.2-0 → 0.3.3-0

package/dist/exports/cli/api/auth-schema.mjs

@@ -1 +1,373 @@
-import{sql as e}from"drizzle-orm";import{pgTable as t}from"drizzle-orm/pg-core";function n(){let n=t(`accounts`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),accessToken:t.text(`access_token`),accessTokenExpiresAt:t.timestamp(`access_token_expires_at`,{mode:`string`,withTimezone:!0}),accountId:t.text(`account_id`).notNull(),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),idToken:t.text(`id_token`),providerId:t.text(`provider_id`).notNull(),password:t.text(`password`),userId:t.text(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),refreshToken:t.text(`refresh_token`),refreshTokenExpiresAt:t.timestamp(`refresh_token_expires_at`,{mode:`string`,withTimezone:!0}),scope:t.text(`scope`),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull()}),e=>[]),r=t(`api_keys`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),name:t.text(`name`),enabled:t.boolean(`enabled`).default(!0),expiresAt:t.timestamp(`expires_at`,{mode:`string`,withTimezone:!0}),key:t.text(`key`).notNull(),lastRefillAt:t.timestamp(`last_refill_at`,{mode:`string`,withTimezone:!0}),lastRequest:t.timestamp(`last_request`,{mode:`string`,withTimezone:!0}),lastUsedAt:t.timestamp(`last_used_at`,{mode:`string`,withTimezone:!0}),metadata:t.text(`metadata`),permissions:t.text(`permissions`),prefix:t.text(`prefix`),rateLimitEnabled:t.boolean(`rate_limit_enabled`).default(!0),rateLimitTimeWindow:t.integer(`rate_limit_time_window`).default(864e5),rateLimitMax:t.integer(`rate_limit_max`).default(10),refillInterval:t.integer(`refill_interval`),refillAmount:t.integer(`refill_amount`),requestCount:t.integer(`request_count`),remaining:t.integer(`remaining`),start:t.text(`start`),userId:t.text(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull()}),e=>[]),i=t(`invitations`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),email:t.text(`email`).notNull(),expiresAt:t.timestamp(`expires_at`,{mode:`string`,withTimezone:!0}).notNull(),inviterId:t.text(`inviter_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),organizationId:t.text(`organization_id`).notNull().references(()=>o.id,{onDelete:`cascade`}),role:t.text(`role`),status:t.text(`status`).default(`pending`).notNull(),teamId:t.text(`team_id`),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull()}),e=>[]),a=t(`members`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),organizationId:t.text(`organization_id`).notNull().references(()=>o.id,{onDelete:`cascade`}),role:t.text(`role`).default(`member`).notNull(),userId:t.text(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull()}),e=>[]),o=t(`organizations`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),name:t.text(`name`).notNull(),slug:t.text(`slug`).unique(),logo:t.text(`logo`),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),metadata:t.text(`metadata`)}),e=>[]),s=t(`sessions`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),activeOrganizationId:t.text(`active_organization_id`).references(()=>o.id,{onDelete:`set null`}),activeTeamId:t.text(`active_team_id`),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),expiresAt:t.timestamp(`expires_at`,{mode:`string`,withTimezone:!0}).notNull(),impersonatedBy:t.text(`impersonated_by`).references(()=>l.id,{onDelete:`set null`}),ipAddress:t.text(`ip_address`),token:t.text(`token`).notNull().unique(),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),userAgent:t.text(`user_agent`),userId:t.text(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`})}),e=>[]),c=t(`sso_providers`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),domain:t.text(`domain`).notNull(),issuer:t.text(`issuer`).notNull(),oidcConfig:t.text(`oidc_config`),organizationId:t.text(`organization_id`).references(()=>o.id,{onDelete:`cascade`}),providerId:t.text(`provider_id`).notNull().unique(),samlConfig:t.text(`saml_config`),userId:t.text(`user_id`).references(()=>l.id,{onDelete:`cascade`})}),e=>[]),l=t(`users`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),banExpires:t.timestamp(`ban_expires`,{mode:`string`,withTimezone:!0}),banReason:t.text(`ban_reason`),banned:t.boolean(`banned`).default(!1),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),displayUsername:t.text(`display_username`),email:t.text(`email`).notNull().unique(),emailVerified:t.boolean(`email_verified`).default(!1).notNull(),image:t.text(`image`),isAnonymous:t.boolean(`is_anonymous`),lastLoginMethod:t.text(`last_login_method`),name:t.text(`name`).notNull(),phoneNumber:t.text(`phone_number`).unique(),phoneNumberVerified:t.boolean(`phone_number_verified`),role:t.text(`role`),twoFactorEnabled:t.boolean(`two_factor_enabled`).default(!1),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),username:t.text(`username`).unique()}),e=>[]),u=t(`teams`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),name:t.text(`name`).notNull(),organizationId:t.text(`organization_id`).notNull().references(()=>o.id,{onDelete:`cascade`}),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull()}),e=>[]),d=t(`team_members`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),teamId:t.text(`team_id`).notNull().references(()=>u.id,{onDelete:`cascade`}),userId:t.text(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull()}),e=>[]),f=t(`two_factors`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),secret:t.text(`secret`).notNull(),backupCodes:t.text(`backup_codes`).notNull(),userId:t.text(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`})}),e=>[]),p=t(`verifications`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),expiresAt:t.timestamp(`expires_at`,{mode:`string`,withTimezone:!0}).notNull(),identifier:t.text(`identifier`).notNull(),updatedAt:t.timestamp(`updated_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull(),value:t.text(`value`).notNull()}),e=>[]);return{tables:{accounts:n,apiKeys:r,auditLogs:t(`audit_logs`,t=>({id:t.text(`id`).primaryKey().default(e`uuidv7()`),tableName:t.text(`table_name`),action:t.text(`action`).notNull(),customAction:t.text(`custom_action`),oldData:t.jsonb(`old_data`),newData:t.jsonb(`new_data`),metadata:t.jsonb(`metadata`),organizationId:t.text(`organization_id`).references(()=>o.id,{onDelete:`set null`}),userId:t.text(`user_id`).references(()=>l.id,{onDelete:`set null`}),sessionId:t.text(`session_id`).references(()=>s.id,{onDelete:`set null`}),requestId:t.text(`request_id`),createdAt:t.timestamp(`created_at`,{mode:`string`,withTimezone:!0}).default(e`NOW()`).notNull()}),e=>[]),invitations:i,members:a,organizations:o,sessions:s,ssoProviders:c,teams:u,teamMembers:d,twoFactors:f,users:l,verifications:p},relations:e=>({users:{sessions:e.many.sessions({from:e.users.id,to:e.sessions.userId}),accounts:e.many.accounts({from:e.users.id,to:e.accounts.userId}),apiKeys:e.many.apiKeys({from:e.users.id,to:e.apiKeys.userId}),memberships:e.many.members({from:e.users.id,to:e.members.userId}),invitations:e.many.invitations({from:e.users.id,to:e.invitations.inviterId}),ssoProvider:e.one.ssoProviders({from:e.users.id,to:e.ssoProviders.userId}),twoFactor:e.one.twoFactors({from:e.users.id,to:e.twoFactors.userId})},sessions:{user:e.one.users({from:e.sessions.userId,to:e.users.id})},accounts:{user:e.one.users({from:e.accounts.userId,to:e.users.id})},apiKeys:{user:e.one.users({from:e.apiKeys.userId,to:e.users.id})},organizations:{members:e.many.members({from:e.organizations.id,to:e.members.organizationId}),invitations:e.many.invitations({from:e.organizations.id,to:e.invitations.organizationId}),teams:e.many.teams({from:e.organizations.id,to:e.teams.organizationId})},members:{organization:e.one.organizations({from:e.members.organizationId,to:e.organizations.id}),user:e.one.users({from:e.members.userId,to:e.users.id})},invitations:{organization:e.one.organizations({from:e.invitations.organizationId,to:e.organizations.id}),inviter:e.one.users({from:e.invitations.inviterId,to:e.users.id})},teams:{organization:e.one.organizations({from:e.teams.organizationId,to:e.organizations.id})},ssoProviders:{user:e.one.users({from:e.ssoProviders.userId,to:e.users.id})},verifications:{},twoFactors:{user:e.one.users({from:e.twoFactors.userId,to:e.users.id})},auditLogs:{organization:e.one.organizations({from:e.auditLogs.organizationId,to:e.organizations.id}),user:e.one.users({from:e.auditLogs.userId,to:e.users.id}),session:e.one.sessions({from:e.auditLogs.sessionId,to:e.sessions.id})}})}}export{n as defineAuthSchema};
+import { sql } from "drizzle-orm";
+import { pgTable } from "drizzle-orm/pg-core";
+
+//#region src/api/auth-schema.ts
+/**
+* Defines the authentication schema for the application.
+*
+* @returns An object containing the schema and relations for the authentication tables.
+*/
+function defineAuthSchema() {
+	const accounts = pgTable("accounts", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		accessToken: t.text("access_token"),
+		accessTokenExpiresAt: t.timestamp("access_token_expires_at", {
+			mode: "string",
+			withTimezone: true
+		}),
+		accountId: t.text("account_id").notNull(),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		idToken: t.text("id_token"),
+		providerId: t.text("provider_id").notNull(),
+		password: t.text("password"),
+		userId: t.text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		refreshToken: t.text("refresh_token"),
+		refreshTokenExpiresAt: t.timestamp("refresh_token_expires_at", {
+			mode: "string",
+			withTimezone: true
+		}),
+		scope: t.text("scope"),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull()
+	}), (t) => []);
+	const apiKeys = pgTable("api_keys", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		name: t.text("name"),
+		enabled: t.boolean("enabled").default(true),
+		expiresAt: t.timestamp("expires_at", {
+			mode: "string",
+			withTimezone: true
+		}),
+		key: t.text("key").notNull(),
+		lastRefillAt: t.timestamp("last_refill_at", {
+			mode: "string",
+			withTimezone: true
+		}),
+		lastRequest: t.timestamp("last_request", {
+			mode: "string",
+			withTimezone: true
+		}),
+		lastUsedAt: t.timestamp("last_used_at", {
+			mode: "string",
+			withTimezone: true
+		}),
+		metadata: t.text("metadata"),
+		permissions: t.text("permissions"),
+		prefix: t.text("prefix"),
+		rateLimitEnabled: t.boolean("rate_limit_enabled").default(true),
+		rateLimitTimeWindow: t.integer("rate_limit_time_window").default(864e5),
+		rateLimitMax: t.integer("rate_limit_max").default(10),
+		refillInterval: t.integer("refill_interval"),
+		refillAmount: t.integer("refill_amount"),
+		requestCount: t.integer("request_count"),
+		remaining: t.integer("remaining"),
+		start: t.text("start"),
+		userId: t.text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull()
+	}), (t) => []);
+	const invitations = pgTable("invitations", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		email: t.text("email").notNull(),
+		expiresAt: t.timestamp("expires_at", {
+			mode: "string",
+			withTimezone: true
+		}).notNull(),
+		inviterId: t.text("inviter_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		organizationId: t.text("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+		role: t.text("role"),
+		status: t.text("status").default("pending").notNull(),
+		teamId: t.text("team_id"),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull()
+	}), (t) => []);
+	const members = pgTable("members", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		organizationId: t.text("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+		role: t.text("role").default("member").notNull(),
+		userId: t.text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull()
+	}), (t) => []);
+	const organizations = pgTable("organizations", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		name: t.text("name").notNull(),
+		slug: t.text("slug").unique(),
+		logo: t.text("logo"),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		metadata: t.text("metadata")
+	}), (t) => []);
+	const sessions = pgTable("sessions", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		activeOrganizationId: t.text("active_organization_id").references(() => organizations.id, { onDelete: "set null" }),
+		activeTeamId: t.text("active_team_id"),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		expiresAt: t.timestamp("expires_at", {
+			mode: "string",
+			withTimezone: true
+		}).notNull(),
+		impersonatedBy: t.text("impersonated_by").references(() => users.id, { onDelete: "set null" }),
+		ipAddress: t.text("ip_address"),
+		token: t.text("token").notNull().unique(),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		userAgent: t.text("user_agent"),
+		userId: t.text("user_id").notNull().references(() => users.id, { onDelete: "cascade" })
+	}), (t) => []);
+	const ssoProviders = pgTable("sso_providers", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		domain: t.text("domain").notNull(),
+		issuer: t.text("issuer").notNull(),
+		oidcConfig: t.text("oidc_config"),
+		organizationId: t.text("organization_id").references(() => organizations.id, { onDelete: "cascade" }),
+		providerId: t.text("provider_id").notNull().unique(),
+		samlConfig: t.text("saml_config"),
+		userId: t.text("user_id").references(() => users.id, { onDelete: "cascade" })
+	}), (t) => []);
+	const users = pgTable("users", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		banExpires: t.timestamp("ban_expires", {
+			mode: "string",
+			withTimezone: true
+		}),
+		banReason: t.text("ban_reason"),
+		banned: t.boolean("banned").default(false),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		displayUsername: t.text("display_username"),
+		email: t.text("email").notNull().unique(),
+		emailVerified: t.boolean("email_verified").default(false).notNull(),
+		image: t.text("image"),
+		isAnonymous: t.boolean("is_anonymous"),
+		lastLoginMethod: t.text("last_login_method"),
+		name: t.text("name").notNull(),
+		phoneNumber: t.text("phone_number").unique(),
+		phoneNumberVerified: t.boolean("phone_number_verified"),
+		role: t.text("role"),
+		twoFactorEnabled: t.boolean("two_factor_enabled").default(false),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		username: t.text("username").unique()
+	}), (t) => []);
+	const teams = pgTable("teams", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		name: t.text("name").notNull(),
+		organizationId: t.text("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull()
+	}), (t) => []);
+	const teamMembers = pgTable("team_members", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		teamId: t.text("team_id").notNull().references(() => teams.id, { onDelete: "cascade" }),
+		userId: t.text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull()
+	}), (t) => []);
+	const twoFactors = pgTable("two_factors", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		secret: t.text("secret").notNull(),
+		backupCodes: t.text("backup_codes").notNull(),
+		userId: t.text("user_id").notNull().references(() => users.id, { onDelete: "cascade" })
+	}), (t) => []);
+	const verifications = pgTable("verifications", (t) => ({
+		id: t.text("id").primaryKey().default(sql`uuidv7()`),
+		createdAt: t.timestamp("created_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		expiresAt: t.timestamp("expires_at", {
+			mode: "string",
+			withTimezone: true
+		}).notNull(),
+		identifier: t.text("identifier").notNull(),
+		updatedAt: t.timestamp("updated_at", {
+			mode: "string",
+			withTimezone: true
+		}).default(sql`NOW()`).notNull(),
+		value: t.text("value").notNull()
+	}), (t) => []);
+	return {
+		tables: {
+			accounts,
+			apiKeys,
+			auditLogs: pgTable("audit_logs", (t) => ({
+				id: t.text("id").primaryKey().default(sql`uuidv7()`),
+				tableName: t.text("table_name"),
+				action: t.text("action").notNull(),
+				customAction: t.text("custom_action"),
+				oldData: t.jsonb("old_data"),
+				newData: t.jsonb("new_data"),
+				metadata: t.jsonb("metadata"),
+				organizationId: t.text("organization_id").references(() => organizations.id, { onDelete: "set null" }),
+				userId: t.text("user_id").references(() => users.id, { onDelete: "set null" }),
+				sessionId: t.text("session_id").references(() => sessions.id, { onDelete: "set null" }),
+				requestId: t.text("request_id"),
+				createdAt: t.timestamp("created_at", {
+					mode: "string",
+					withTimezone: true
+				}).default(sql`NOW()`).notNull()
+			}), (t) => []),
+			invitations,
+			members,
+			organizations,
+			sessions,
+			ssoProviders,
+			teams,
+			teamMembers,
+			twoFactors,
+			users,
+			verifications
+		},
+		relations: (r) => ({
+			users: {
+				sessions: r.many.sessions({
+					from: r.users.id,
+					to: r.sessions.userId
+				}),
+				accounts: r.many.accounts({
+					from: r.users.id,
+					to: r.accounts.userId
+				}),
+				apiKeys: r.many.apiKeys({
+					from: r.users.id,
+					to: r.apiKeys.userId
+				}),
+				memberships: r.many.members({
+					from: r.users.id,
+					to: r.members.userId
+				}),
+				invitations: r.many.invitations({
+					from: r.users.id,
+					to: r.invitations.inviterId
+				}),
+				ssoProvider: r.one.ssoProviders({
+					from: r.users.id,
+					to: r.ssoProviders.userId
+				}),
+				twoFactor: r.one.twoFactors({
+					from: r.users.id,
+					to: r.twoFactors.userId
+				})
+			},
+			sessions: { user: r.one.users({
+				from: r.sessions.userId,
+				to: r.users.id
+			}) },
+			accounts: { user: r.one.users({
+				from: r.accounts.userId,
+				to: r.users.id
+			}) },
+			apiKeys: { user: r.one.users({
+				from: r.apiKeys.userId,
+				to: r.users.id
+			}) },
+			organizations: {
+				members: r.many.members({
+					from: r.organizations.id,
+					to: r.members.organizationId
+				}),
+				invitations: r.many.invitations({
+					from: r.organizations.id,
+					to: r.invitations.organizationId
+				}),
+				teams: r.many.teams({
+					from: r.organizations.id,
+					to: r.teams.organizationId
+				})
+			},
+			members: {
+				organization: r.one.organizations({
+					from: r.members.organizationId,
+					to: r.organizations.id
+				}),
+				user: r.one.users({
+					from: r.members.userId,
+					to: r.users.id
+				})
+			},
+			invitations: {
+				organization: r.one.organizations({
+					from: r.invitations.organizationId,
+					to: r.organizations.id
+				}),
+				inviter: r.one.users({
+					from: r.invitations.inviterId,
+					to: r.users.id
+				})
+			},
+			teams: { organization: r.one.organizations({
+				from: r.teams.organizationId,
+				to: r.organizations.id
+			}) },
+			ssoProviders: { user: r.one.users({
+				from: r.ssoProviders.userId,
+				to: r.users.id
+			}) },
+			verifications: {},
+			twoFactors: { user: r.one.users({
+				from: r.twoFactors.userId,
+				to: r.users.id
+			}) },
+			auditLogs: {
+				organization: r.one.organizations({
+					from: r.auditLogs.organizationId,
+					to: r.organizations.id
+				}),
+				user: r.one.users({
+					from: r.auditLogs.userId,
+					to: r.users.id
+				}),
+				session: r.one.sessions({
+					from: r.auditLogs.sessionId,
+					to: r.sessions.id
+				})
+			}
+		})
+	};
+}
+
+//#endregion
+export { defineAuthSchema };

package/dist/exports/cli/api/auth.d.mts

@@ -347,6 +347,10 @@ type DefineAuthOptions<T extends AuthConfig, TDb = unknown> = {
    * Hooks for email sending and OTP delivery.
    */
   hooks: RequiredHooks<T>;
+  /**
+   * Secret key for signing tokens and cookies.
+   */
+  secret: string;
   /**
    * Session configuration.
    */

package/dist/exports/cli/api/cache.d.mts

@@ -1,5 +1,5 @@
 import { Logger } from "./logger.mjs";
-import * as keyv0 from "keyv";
+import * as _keyv_redis0 from "@keyv/redis";
 import { KeyvRedisOptions } from "@keyv/redis";
 
 //#region src/api/cache.d.ts
@@ -39,6 +39,6 @@ declare function defineCache({
   url,
   logger,
   options
-}: DefineCacheOptions): keyv0.Keyv<any>;
+}: DefineCacheOptions): _keyv_redis0.Keyv<any>;
 //#endregion
 export { Cache };

package/dist/exports/cli/api/event.mjs

@@ -1 +1,126 @@
-import"../constants.mjs";import"./redis.mjs";import{join as e}from"node:path";import{z as t}from"zod";import"es-toolkit";function n(e){let t=null,n=null;return{inputSchema:e.input,get name(){return n},register(e,r){t=e,n=r},async emit(r){if(!t||!n)throw Error(`Event not registered. Ensure the worker is started before emitting events.`);let i=e.input.parse(r),a={container:t,input:i};await e.run(a),t.eventBus.publish(n,i).catch(e=>{t.logger.error({err:e,event:n},`Redis publish failed`)})},async subscribe(r){if(!t||!n)throw Error(`Event not registered. Ensure the worker is started before subscribing.`);return t.eventBus.subscribe(n,async i=>{let a=e.input.parse(i),o={container:t,input:a};try{await r(o)}catch(e){t.logger.error({err:e,event:n},`Event subscription handler error`)}})}}}const r=n({input:t.object({action:t.enum([`INSERT`,`UPDATE`,`DELETE`]),newData:t.record(t.string(),t.unknown()).nullable(),oldData:t.record(t.string(),t.unknown()).nullable(),organizationId:t.string().nullable(),tableName:t.string(),timestamp:t.string(),userId:t.string().nullable()}),async run(){}});export{r as dbChangesEvent};
+import "../constants.mjs";
+import "./redis.mjs";
+import { join } from "node:path";
+import { z } from "zod";
+import "es-toolkit";
+
+//#region src/api/event.ts
+/**
+* Defines a type-safe event with in-memory and Redis pub/sub support.
+*
+* Algorithm:
+* 1. Define event with input schema and in-memory run handler
+* 2. On emit(): validate input, run in-memory handler, publish to Redis (fire-and-forget)
+* 3. .subscribe() creates Redis subscription for tRPC/SSE/WebSocket handlers
+*
+* @example
+* ```typescript
+* // api/events/order-status.ts
+* export default defineEvent({
+*   input: z.object({
+*     orderId: z.string(),
+*     status: z.enum(["pending", "shipped", "delivered"]),
+*   }),
+*   async run(ctx) {
+*     ctx.container.logger.info(`Order ${ctx.input.orderId} is ${ctx.input.status}`);
+*   },
+* });
+*
+* // Emit from anywhere
+* await orderStatus.emit({ orderId: "123", status: "shipped" });
+*
+* // Subscribe (e.g., in tRPC router)
+* const unsubscribe = await orderStatus.subscribe(async (ctx) => {
+*   // Push to client via SSE/WebSocket
+* });
+* // Cleanup when client disconnects
+* unsubscribe();
+* ```
+*/
+function defineEvent(options) {
+	let container = null;
+	let eventName = null;
+	return {
+		inputSchema: options.input,
+		get name() {
+			return eventName;
+		},
+		register(c, name) {
+			container = c;
+			eventName = name;
+		},
+		async emit(input) {
+			if (!container || !eventName) throw new Error("Event not registered. Ensure the worker is started before emitting events.");
+			const validated = options.input.parse(input);
+			const ctx = {
+				container,
+				input: validated
+			};
+			await options.run(ctx);
+			container.eventBus.publish(eventName, validated).catch((err) => {
+				container.logger.error({
+					err,
+					event: eventName
+				}, "Redis publish failed");
+			});
+		},
+		async subscribe(handler) {
+			if (!container || !eventName) throw new Error("Event not registered. Ensure the worker is started before subscribing.");
+			return container.eventBus.subscribe(eventName, async (message) => {
+				const validated = options.input.parse(message);
+				const ctx = {
+					container,
+					input: validated
+				};
+				try {
+					await handler(ctx);
+				} catch (err) {
+					container.logger.error({
+						err,
+						event: eventName
+					}, "Event subscription handler error");
+				}
+			});
+		}
+	};
+}
+/**
+* Input schema for dbChangesEvent.
+*/
+const dbChangeInputSchema = z.object({
+	action: z.enum([
+		"INSERT",
+		"UPDATE",
+		"DELETE"
+	]),
+	newData: z.record(z.string(), z.unknown()).nullable(),
+	oldData: z.record(z.string(), z.unknown()).nullable(),
+	organizationId: z.string().nullable(),
+	tableName: z.string(),
+	timestamp: z.string(),
+	userId: z.string().nullable()
+});
+/**
+* Built-in event for database changes.
+* Emitted by trackDbChanges workflow.
+*
+* @example
+* ```typescript
+* // Subscribe to DB changes (e.g., in tRPC subscription)
+* import { dbChangesEvent } from "appos/api";
+*
+* const unsubscribe = await dbChangesEvent.subscribe(async (ctx) => {
+*   wsServer.publish("db-changes", JSON.stringify(ctx.input));
+* });
+*
+* // Cleanup when done
+* unsubscribe();
+* ```
+*/
+const dbChangesEvent = defineEvent({
+	input: dbChangeInputSchema,
+	async run() {}
+});
+
+//#endregion
+export { dbChangesEvent };

package/dist/exports/cli/api/redis.mjs

@@ -1 +1,3 @@
-import"redis";export{};
+import "redis";
+
+export {  };

package/dist/exports/cli/api/workflow.mjs

@@ -1 +1,135 @@
-import"../constants.mjs";import{join as e}from"node:path";import"es-toolkit";function t(e){let t=null,n=null,r=null,i=null,a=async i=>{if(!t||!r)throw Error(`Workflow "${n}" not registered`);let a=r,o=a.workflowID;if(!o)throw Error(`DBOS.workflowID is not available in this context`);let s={container:t,workflowId:o,input:i,step:(e,t)=>a.runStep(t,{name:e})};return e.run(s)};return{inputSchema:e.input,get name(){return n},register(o,s,c){t=o,n=s,r=c,i=c.registerWorkflow(a,{name:s,...e.config})},async start(t){if(!i||!n||!r)throw Error(`Workflow not registered. Ensure the worker is started before triggering workflows.`);let a=e.input.parse(t),o=await r.startWorkflow(i)(a);return{workflowId:o.workflowID,getStatus:()=>o.getStatus(),getResult:()=>o.getResult()}}}}function n(e){let t=null,n=null,r=null,i=async(i,a)=>{if(!t||!r)throw Error(`Workflow "${n}" not registered`);let o=r,s=o.workflowID;if(!s)throw Error(`DBOS.workflowID is not available in this context`);let c={container:t,workflowId:s,scheduledTime:i,step:(e,t)=>o.runStep(t,{name:e})};return e.run(c)};return{crontab:e.crontab,get name(){return n},register(a,o,s){t=a,n=o,r=s,s.registerScheduled(s.registerWorkflow(i,{name:o}),{crontab:e.crontab})}}}export{n as defineScheduledWorkflow,t as defineWorkflow};
+import "../constants.mjs";
+import { join } from "node:path";
+import "es-toolkit";
+
+//#region src/api/workflow.ts
+/**
+* Defines a durable workflow that can be triggered with type-safe input.
+*
+* Workflows are:
+* - Durable: Automatically resume after crashes or restarts
+* - Type-safe: Input and output types are inferred from the schema
+* - Container-aware: Access to db, mailer, logger via ctx.container
+*
+* @example
+* ```typescript
+* // api/workflows/send-welcome-email.ts
+* export default defineWorkflow({
+*   input: z.object({
+*     userId: z.string(),
+*     email: z.string().email(),
+*   }),
+*   async run(ctx) {
+*     const user = await ctx.container.db.primary.query.users.findFirst({
+*       where: eq(users.id, ctx.input.userId),
+*     });
+*
+*     await ctx.container.mailer.send({
+*       to: ctx.input.email,
+*       subject: "Welcome!",
+*     });
+*
+*     return { sent: true };
+*   },
+* });
+*
+* // Triggering from a route:
+* import sendWelcomeEmail from "#api/workflows/send-welcome-email.ts";
+* const handle = await sendWelcomeEmail.start({ userId: "123", email: "..." });
+* ```
+*/
+function defineWorkflow(options) {
+	let container = null;
+	let workflowName = null;
+	let dbosInstance = null;
+	let registeredFn = null;
+	const workflowFn = async (input) => {
+		if (!container || !dbosInstance) throw new Error(`Workflow "${workflowName}" not registered`);
+		const dbos = dbosInstance;
+		const workflowId = dbos.workflowID;
+		if (!workflowId) throw new Error("DBOS.workflowID is not available in this context");
+		const ctx = {
+			container,
+			workflowId,
+			input,
+			step: (name, fn) => dbos.runStep(fn, { name })
+		};
+		return options.run(ctx);
+	};
+	return {
+		inputSchema: options.input,
+		get name() {
+			return workflowName;
+		},
+		register(c, name, dbos) {
+			container = c;
+			workflowName = name;
+			dbosInstance = dbos;
+			registeredFn = dbos.registerWorkflow(workflowFn, {
+				name,
+				...options.config
+			});
+		},
+		async start(input) {
+			if (!registeredFn || !workflowName || !dbosInstance) throw new Error("Workflow not registered. Ensure the worker is started before triggering workflows.");
+			const validated = options.input.parse(input);
+			const handle = await dbosInstance.startWorkflow(registeredFn)(validated);
+			return {
+				workflowId: handle.workflowID,
+				getStatus: () => handle.getStatus(),
+				getResult: () => handle.getResult()
+			};
+		}
+	};
+}
+/**
+* Defines a scheduled workflow that runs on a cron schedule.
+*
+* @example
+* ```typescript
+* // api/workflows/daily-report.ts
+* export default defineScheduledWorkflow({
+*   crontab: "0 9 * * *", // 9am daily
+*   async run(ctx) {
+*     const stats = await ctx.container.db.primary.query.stats.findMany();
+*     await ctx.container.mailer.send({
+*       to: "team@company.com",
+*       subject: `Daily Report - ${ctx.scheduledTime.toDateString()}`,
+*     });
+*   },
+* });
+* ```
+*/
+function defineScheduledWorkflow(options) {
+	let container = null;
+	let workflowName = null;
+	let dbosInstance = null;
+	const workflowFn = async (scheduledTime, _startTime) => {
+		if (!container || !dbosInstance) throw new Error(`Workflow "${workflowName}" not registered`);
+		const dbos = dbosInstance;
+		const workflowId = dbos.workflowID;
+		if (!workflowId) throw new Error("DBOS.workflowID is not available in this context");
+		const ctx = {
+			container,
+			workflowId,
+			scheduledTime,
+			step: (name, fn) => dbos.runStep(fn, { name })
+		};
+		return options.run(ctx);
+	};
+	return {
+		crontab: options.crontab,
+		get name() {
+			return workflowName;
+		},
+		register(c, name, dbos) {
+			container = c;
+			workflowName = name;
+			dbosInstance = dbos;
+			dbos.registerScheduled(dbos.registerWorkflow(workflowFn, { name }), { crontab: options.crontab });
+		}
+	};
+}
+
+//#endregion
+export { defineScheduledWorkflow, defineWorkflow };