create-bubbles 0.1.20 → 0.1.23

package/template-vp-monorepo-react-nestjs/.vite-hooks/commit-msg

@@ -1 +1,2 @@
+#!/bin/bash
 vp dlx commitlint --edit "$1"

package/template-vp-monorepo-react-nestjs/.vite-hooks/pre-commit

@@ -1 +1,2 @@
-vp staged
+#!/bin/bash
+# vp staged

package/template-vp-monorepo-react-nestjs/.vscode/settings.json

@@ -0,0 +1,26 @@
+{
+  "eslint.enable": false,
+  "prettier.enable": false,
+  "biome.enabled": false,
+  // "npm.scriptRunner": "vp",
+  "editor.defaultFormatter": "oxc.oxc-vscode",
+  "[javascript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "[javascriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "[typescript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "oxc.fmt.configPath": "./vite.config.ts",
+  "editor.formatOnSave": true,
+  "editor.formatOnSaveMode": "file",
+  "editor.codeActionsOnSave": {
+    "source.organizeImports": "always",
+    "source.fixAll.oxc": "always"
+  }
+}

package/template-vp-monorepo-react-nestjs/AGENTS.md

@@ -0,0 +1,16 @@
+<!--VITE PLUS START-->
+
+# Using Vite+, the Unified Toolchain for the Web
+
+This project is using Vite+, a unified toolchain built on top of Vite, Rolldown, Vitest, tsdown, Oxlint, Oxfmt, and Vite Task. Vite+ wraps runtime management, package management, and frontend tooling in a single global CLI called `vp`. Vite+ is distinct from Vite, and it invokes Vite through `vp dev` and `vp build`. Run `vp help` to print a list of commands and `vp <command> --help` for information about a specific command.
+
+Docs are local at `node_modules/vite-plus/docs` or online at https://viteplus.dev/guide/.
+
+## Review Checklist
+
+- [ ] Run `vp install` after pulling remote changes and before getting started.
+- [ ] Run `vp check` and `vp test` to format, lint, type check and test changes.
+- [ ] Check if there are `vite.config.ts` tasks or `package.json` scripts necessary for validation, run via `vp run <script>`.
+- [ ] If setup, runtime, or package-manager behavior looks wrong, run `vp env doctor` and include its output when asking for help.
+
+<!--VITE PLUS END-->

package/template-vp-monorepo-react-nestjs/README.md

@@ -13,13 +13,13 @@ vp run ready
 - Run the tests:
 
 ```bash
-vp run test -r
+vp run -r test
 ```
 
 - Build the monorepo:
 
 ```bash
-vp run build -r
+vp run -r build
 ```
 
 - Run the development server:

package/template-vp-monorepo-react-nestjs/apps/server/.env.development

@@ -0,0 +1,61 @@
+NODE_ENV=development
+JWT_SECRET=development_jwt_secret_change_me
+
+DATABASE_URL=postgresql://postgres:ml@localhost:5432/postgres
+DB_HOST=localhost
+DB_PORT=5432
+DB_DATABASE=postgres
+DB_USERNAME=postgres
+DB_PASSWORD=ml
+
+LLM_API_URL=https://api-inference.modelscope.cn/v1
+LLM_API_MODEL=deepseek-ai/DeepSeek-V3.2  
+##ZhipuAI/GLM-5.1
+LLM_API_KEY=ms-6c0d8bc9-ed99-4515-81f3-db1341fe9e76
+
+
+# Redis
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=ml
+REDIS_DB=0
+
+
+# JWT的签名密钥 服务器签发access token 使用它签名 整整token shi
+JWT_ACCESS_SECRET=oM1FmlgA-tpflskKz5jZRYf2-_QK-aPhjtboFYaqTtlqB4RNgWUFNsp3irMUUdJF
+# JWT 的签发者，对应 JWT 中的 iss 字段：
+JWT_ISSUER=bubbles-auth
+# 验证 Token 时，服务器会检查它是不是由 bubbles-auth 签发的。它是标识符，不是密码。 JWT 的目标使用者，对应 aud 字段
+# 表示这个 Token 是给 bubbles-api 使用的，避免一个系统签发的 JWT 被误用到另一个系统。
+JWT_AUDIENCE=bubbles-api
+# Access Token 的有效时间：
+JWT_ACCESS_TTL_SECONDS=600
+# JWT 时间校验的允许误差：
+JWT_CLOCK_TOLERANCE_SECONDS=30
+
+
+# Refresh Token 的服务端“椒值”，通常用于计算哈希：
+REFRESH_TOKEN_PEPPER=ON-ECMSvcmjVryktpp-1BLpDl3r7Sl63-GXyy1uto2_1AbqCbNOndIfdtuBVe1o_
+# Refresh Token 的有效时间： 30 天
+REFRESH_TOKEN_TTL_SECONDS=2592000
+# 保存 Refresh Token 的 Cookie 名称，浏览器中大致是：
+# 生产环境如果使用 __Host- 安全前缀，可以改成： __Host-refresh_token
+# REFRESH_COOKIE_PATH=/
+# REFRESH_COOKIE_SECURE=true
+# 并且不能设置 Domain。
+REFRESH_COOKIE_NAME=refresh_token
+# Cookie 只会自动发送给 /auth 路径下的接口 这样可以减少 Refresh Token 暴露给无关接口的机会。
+REFRESH_COOKIE_PATH=/auth
+# 表示这个 Cookie 不强制要求 HTTPS，适合本地 HTTP 开发
+REFRESH_COOKIE_SECURE=false
+
+# 认证状态在当前服务进程的本地内存中缓存
+# 例如服务器查到“用户正常、会话有效”，可以缓存 30 秒，避免每个请求都查询数据库或 Redis。
+# 本地缓存意味着每个 NestJS 实例都有自己的缓存，所以还需要下面的失效通知机制。
+AUTH_LOCAL_CACHE_TTL_MS=30000
+
+# 
+AUTH_TOMBSTONE_TTL_SECONDS=900
+
+# 当修改密码或者踢人的时候通过这个通道 通知用户失效
+AUTH_EVENT_CHANNEL=auth-state:invalidate

package/template-vp-monorepo-react-nestjs/apps/server/.env.production

@@ -0,0 +1,20 @@
+NODE_ENV=production
+JWT_SECRET=production_jwt_secret_change_me
+
+DATABASE_URL=postgresql://postgres:ml@localhost:5432/postgres
+DB_HOST=localhost
+DB_PORT=5432
+DB_DATABASE=postgres
+DB_USERNAME=postgres
+DB_PASSWORD=ml
+
+LLM_API_URL=https://api-inference.modelscope.cn/v1
+LLM_API_MODEL=deepseek-ai/DeepSeek-V4-Pro
+LLM_API_KEY=ms-6c0d8bc9-ed99-4515-81f3-db1341fe9e76
+
+
+# Redis
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=ml
+REDIS_DB=0

package/template-vp-monorepo-react-nestjs/apps/server/README.md

@@ -0,0 +1,3 @@
+# 生成模块
+
+nest g res modules/xxx

package/template-vp-monorepo-react-nestjs/apps/server/drizzle.config.ts

@@ -0,0 +1,15 @@
+import { config } from 'dotenv'
+import { defineConfig } from 'drizzle-kit'
+
+config({
+  path: '.env.development',
+})
+
+export default defineConfig({
+  schema: './src/database/schema.ts',
+  out: './drizzle',
+  dialect: 'postgresql',
+  dbCredentials: {
+    url: process.env.DATABASE_URL!,
+  },
+})

package/template-vp-monorepo-react-nestjs/apps/server/nest-cli.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/nest-cli",
+  "collection": "@nestjs/schematics",
+  "sourceRoot": "src",
+  "compilerOptions": {
+    "deleteOutDir": true
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "server",
+  "version": "0.0.1",
+  "private": true,
+  "description": "",
+  "license": "UNLICENSED",
+  "author": "",
+  "scripts": {
+    "build": "nest build",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "dev": "nest start --watch",
+    "debug": "nest start --debug --watch",
+    "build:preview": "node dist/main",
+    "db:push": "drizzle-kit push",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:studio": "drizzle-kit studio"
+  },
+  "dependencies": {
+    "@fastify/cookie": "catalog:",
+    "@nestjs-modules/ioredis": "catalog:",
+    "@nestjs/common": "catalog:",
+    "@nestjs/config": "catalog:",
+    "@nestjs/core": "catalog:",
+    "@nestjs/jwt": "catalog:",
+    "@nestjs/mapped-types": "catalog:",
+    "@nestjs/platform-fastify": "catalog:",
+    "argon2": "catalog:",
+    "drizzle-orm": "catalog:",
+    "drizzle-zod": "catalog:",
+    "fastify": "5.8.5",
+    "ioredis": "catalog:",
+    "nestjs-zod": "catalog:",
+    "pg": "catalog:",
+    "reflect-metadata": "catalog:",
+    "rxjs": "catalog:",
+    "zod": "catalog:"
+  },
+  "devDependencies": {
+    "@fastify/static": "catalog:",
+    "@nestjs/cli": "catalog:",
+    "@nestjs/schematics": "catalog:",
+    "@nestjs/swagger": "catalog:",
+    "@nestjs/testing": "catalog:",
+    "@types/express": "catalog:",
+    "@types/node": "catalog:node24",
+    "cross-env": "catalog:",
+    "dotenv": "catalog:",
+    "drizzle-kit": "catalog:",
+    "globals": "catalog:",
+    "source-map-support": "catalog:",
+    "ts-loader": "catalog:",
+    "ts-node": "catalog:",
+    "tsconfig-paths": "catalog:",
+    "typescript": "catalog:"
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/app.controller.ts

@@ -0,0 +1,12 @@
+import { Controller, Get } from '@nestjs/common'
+import { AppService } from './app.service'
+
+@Controller()
+export class AppController {
+  constructor(private readonly appService: AppService) {}
+
+  @Get()
+  getHello(): string {
+    return this.appService.getHello()
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/app.module.ts

@@ -0,0 +1,58 @@
+import { Module } from '@nestjs/common'
+import { AppController } from './app.controller'
+import { AppService } from './app.service'
+import { ConfigModule, ConfigService } from '@nestjs/config'
+import { appConfig, databaseConfig, llmConfig, redisConfig, authConfig } from '@/config'
+import { ResponseInterceptor } from '@/common/interceptors/transform'
+import { APP_INTERCEPTOR, APP_PIPE } from '@nestjs/core'
+import { RedisModule } from '@nestjs-modules/ioredis'
+import { TestRedisModule } from './modules/test/redis/redis.module'
+import { DatabaseModule } from './database/db.module'
+import { TestDbModule } from './modules/test/db/db.module'
+import { ZodSerializerInterceptor, ZodValidationPipe } from 'nestjs-zod'
+
+const nodeEnv = process.env.NODE_ENV ?? 'development'
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({
+      isGlobal: true,
+      envFilePath: [`.env.${nodeEnv}.local`, '.env.local', `.env.${nodeEnv}`, '.env'],
+      load: [appConfig, databaseConfig, llmConfig, redisConfig, authConfig],
+    }),
+    DatabaseModule,
+    RedisModule.forRootAsync({
+      inject: [ConfigService],
+      useFactory: (config) => ({
+        type: 'single',
+        options: {
+          host: config.get('redis.host'),
+          port: config.get('redis.port'),
+          password: config.get('redis.password'),
+          db: config.get('redis.db'),
+        },
+      }),
+    }),
+    TestRedisModule,
+    TestDbModule,
+  ],
+  controllers: [AppController],
+  providers: [
+    AppService,
+    {
+      provide: APP_INTERCEPTOR,
+      useClass: ResponseInterceptor,
+    },
+    // ZOD 全局校验管道
+    {
+      provide: APP_PIPE,
+      useClass: ZodValidationPipe,
+    },
+    // 相应序列化拦截器（让相应也走Zod 防泄漏字段）
+    {
+      provide: APP_INTERCEPTOR,
+      useClass: ZodSerializerInterceptor,
+    },
+  ],
+})
+export class AppModule {}

package/template-vp-monorepo-react-nestjs/apps/server/src/app.service.ts

@@ -0,0 +1,8 @@
+import { Injectable } from '@nestjs/common'
+
+@Injectable()
+export class AppService {
+  getHello(): string {
+    return 'Hello World!'
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/common/constants/decorator.ts

@@ -0,0 +1,2 @@
+/** 跳过响应成功的包装 */
+export const BYPASS_KEY = Symbol('__bypass_key__')

package/template-vp-monorepo-react-nestjs/apps/server/src/common/constants/response.ts

@@ -0,0 +1,15 @@
+export const RESPONSE_SUCCESS_CODE = 200
+
+export const RESPONSE_SUCCESS_MSG = 'success'
+
+/**
+ * @description  contentType
+ */
+export enum ContentTypeEnum {
+  // json
+  JSON = 'application/json;charset=UTF-8',
+  // form-data qs
+  FORM_URLENCODED = 'application/x-www-form-urlencoded;charset=UTF-8',
+  // form-data  upload
+  FORM_DATA = 'multipart/form-data;charset=UTF-8',
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/common/decorators/bypass.ts

@@ -0,0 +1,12 @@
+/**
+ * @description 跳过响应成功的包装
+ */
+
+import { SetMetadata } from '@nestjs/common'
+
+import { BYPASS_KEY } from '../constants/decorator'
+
+/**
+ * 当不需要转换成基础返回格式时添加该装饰器
+ */
+export const Bypass = () => SetMetadata(BYPASS_KEY, true)

package/template-vp-monorepo-react-nestjs/apps/server/src/common/interceptors/transform.ts

@@ -0,0 +1,34 @@
+import {
+  CallHandler,
+  ExecutionContext,
+  HttpStatus,
+  Injectable,
+  NestInterceptor,
+} from '@nestjs/common'
+import { Reflector } from '@nestjs/core'
+import { map } from 'rxjs'
+
+import { BYPASS_KEY } from '../constants/decorator'
+import { ResOp } from '../model/response'
+
+@Injectable()
+export class ResponseInterceptor<T> implements NestInterceptor<T> {
+  constructor(private readonly reflector: Reflector) {}
+
+  intercept(context: ExecutionContext, next: CallHandler<T>) {
+    const skip = this.reflector.getAllAndOverride<boolean>(BYPASS_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ])
+
+    if (skip) {
+      return next.handle()
+    }
+
+    return next.handle().pipe(
+      map((data) => {
+        return new ResOp(HttpStatus.OK, data ?? null)
+      }),
+    )
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/common/model/response.ts

@@ -0,0 +1,23 @@
+import { RESPONSE_SUCCESS_CODE, RESPONSE_SUCCESS_MSG } from '@/common/constants/response'
+
+export class ResOp<T = any> {
+  data?: T
+
+  code: number
+
+  message: string
+
+  constructor(code: number, data: T, message = RESPONSE_SUCCESS_MSG) {
+    this.code = code
+    this.data = data
+    this.message = message
+  }
+
+  static success<T>(data?: T, message?: string) {
+    return new ResOp(RESPONSE_SUCCESS_CODE, data, message)
+  }
+
+  static error(code: number, message) {
+    return new ResOp(code, {}, message)
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/config/app.config.ts

@@ -0,0 +1,6 @@
+import { registerAs } from '@nestjs/config'
+
+export default registerAs('app', () => ({
+  port: Number.parseInt(process.env.PORT ?? '3000', 10),
+  env: process.env.NODE_ENV ?? 'development',
+}))

package/template-vp-monorepo-react-nestjs/apps/server/src/config/auth.config.ts

@@ -0,0 +1,64 @@
+import { registerAs } from '@nestjs/config'
+
+export interface AuthConfig {
+  accessSecret: string
+  issuer: string
+  audience: string
+  accessTtlSeconds: number
+  refreshTtlSeconds: number
+  refreshPepper: string
+  clockToleranceSeconds: number
+  localCacheTtlMs: number
+  tombstoneTtlSeconds: number
+  cookieName: string
+  cookiePath: string
+  cookieSecure: boolean
+  cookieDomain?: string
+  eventChannel: string
+}
+
+function requireSecret(name: string) {
+  const value = process.env[name]?.trim()
+
+  if (!value || value.length < 32) {
+    throw new Error(name + ' 必须配置，并且至少 32 个字符')
+  }
+
+  return value
+}
+
+function positiveInt(name: string, fallback: number) {
+  const raw = process.env[name]
+
+  if (!raw) {
+    return fallback
+  }
+
+  const value = Number.parseInt(raw, 10)
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(name + ' 必须是正整数')
+  }
+
+  return value
+}
+
+export default registerAs(
+  'auth',
+  (): AuthConfig => ({
+    accessSecret: requireSecret('JWT_ACCESS_SECRET'),
+    issuer: process.env.JWT_ISSUER ?? 'bubbles-auth',
+    audience: process.env.JWT_AUDIENCE ?? 'bubbles-api',
+    accessTtlSeconds: positiveInt('JWT_ACCESS_TTL_SECONDS', 10 * 60),
+    refreshTtlSeconds: positiveInt('REFRESH_TOKEN_TTL_SECONDS', 30 * 24 * 60 * 60),
+    refreshPepper: requireSecret('REFRESH_TOKEN_PEPPER'),
+    clockToleranceSeconds: positiveInt('JWT_CLOCK_TOLERANCE_SECONDS', 30),
+    localCacheTtlMs: positiveInt('AUTH_LOCAL_CACHE_TTL_MS', 30_000),
+    tombstoneTtlSeconds: positiveInt('AUTH_TOMBSTONE_TTL_SECONDS', 15 * 60),
+    cookieName: process.env.REFRESH_COOKIE_NAME ?? 'refresh_token',
+    cookiePath: process.env.REFRESH_COOKIE_PATH ?? '/auth',
+    cookieSecure:
+      process.env.REFRESH_COOKIE_SECURE === 'true' || process.env.NODE_ENV === 'production',
+    cookieDomain: process.env.REFRESH_COOKIE_DOMAIN,
+    eventChannel: process.env.AUTH_EVENT_CHANNEL ?? 'auth-state:invalidate',
+  }),
+)

package/template-vp-monorepo-react-nestjs/apps/server/src/config/database.config.ts

@@ -0,0 +1,10 @@
+import { registerAs } from '@nestjs/config'
+
+export default registerAs('database', () => ({
+  url: process.env.DATABASE_URL,
+  host: process.env.DB_HOST ?? 'localhost',
+  port: Number.parseInt(process.env.DB_PORT ?? '5432', 10),
+  database: process.env.DB_DATABASE ?? 'postgres',
+  username: process.env.DB_USERNAME ?? 'postgres',
+  password: process.env.DB_PASSWORD,
+}))

package/template-vp-monorepo-react-nestjs/apps/server/src/config/index.ts

@@ -0,0 +1,5 @@
+export { default as appConfig } from './app.config'
+export { default as databaseConfig } from './database.config'
+export { default as llmConfig } from './llm.config'
+export { default as redisConfig } from './redis.config'
+export { default as authConfig } from './auth.config'

package/template-vp-monorepo-react-nestjs/apps/server/src/config/llm.config.ts

@@ -0,0 +1,7 @@
+import { registerAs } from '@nestjs/config'
+
+export default registerAs('llm', () => ({
+  url: process.env.LLM_API_URL,
+  model: process.env.LLM_API_MODEL,
+  apiKey: process.env.LLM_API_KEY,
+}))

package/template-vp-monorepo-react-nestjs/apps/server/src/config/redis.config.ts

@@ -0,0 +1,18 @@
+import { registerAs } from '@nestjs/config'
+
+export interface RedisConfig {
+  host: string
+  port: number
+  password?: string
+  db: number
+}
+
+export default registerAs(
+  'redis',
+  (): RedisConfig => ({
+    host: process.env.REDIS_HOST ?? 'localhost',
+    port: Number.parseInt(process.env.REDIS_PORT ?? '6379', 10),
+    password: process.env.REDIS_PASSWORD || undefined,
+    db: Number.parseInt(process.env.REDIS_DB ?? '0', 10),
+  }),
+)

package/template-vp-monorepo-react-nestjs/apps/server/src/database/db.module.ts

@@ -0,0 +1,32 @@
+import { Global, Module } from '@nestjs/common'
+import { drizzle, NodePgDatabase } from 'drizzle-orm/node-postgres'
+import * as schema from '@/database/schema'
+import { ConfigService } from '@nestjs/config'
+import { Pool } from 'pg'
+
+export const DRIZZLE = Symbol('DRIZZLE_DB')
+
+export type DrizzleDB = NodePgDatabase<typeof schema>
+
+@Global()
+@Module({
+  providers: [
+    {
+      provide: DRIZZLE,
+      inject: [ConfigService],
+      useFactory: (config: ConfigService) => {
+        const pool = new Pool({
+          host: config.get<string>('database.host'),
+          port: config.get<number>('database.port'),
+          database: config.get<string>('database.database'),
+          user: config.get<string>('database.username'),
+          password: config.get<string>('database.password'),
+        })
+
+        return drizzle(pool, { schema })
+      },
+    },
+  ],
+  exports: [DRIZZLE],
+})
+export class DatabaseModule {}

package/template-vp-monorepo-react-nestjs/apps/server/src/database/schema.ts

@@ -0,0 +1,73 @@
+import {
+  index,
+  integer,
+  pgEnum,
+  pgTable,
+  serial,
+  timestamp,
+  uuid,
+  varchar,
+} from 'drizzle-orm/pg-core'
+
+export const userStatusEnum = pgEnum('user_status', ['active', 'locked', 'disabled'])
+
+export const authSessionStatusEnum = pgEnum('auth_session_status', ['active', 'revoked'])
+
+export const refreshFamilyStatusEnum = pgEnum('refresh_family_status', [
+  'active',
+  'revoked',
+  'compromised',
+])
+
+export const refreshTokenStatusEnum = pgEnum('refresh_token_status', [
+  'active',
+  'consumed',
+  'revoked',
+])
+
+export const users = pgTable('users', {
+  id: serial('id').primaryKey(),
+  name: varchar('name', { length: 100 }).notNull(),
+  email: varchar('email', { length: 255 }).notNull().unique(),
+  // 第一阶段先允许 null，旧账号完成密码回填后再改成 notNull
+  passwordHash: varchar('password_hash', { length: 255 }), // .notNull(),
+
+  status: userStatusEnum('status').default('active').notNull(),
+  authEpoch: integer('auth_epoch').default(1).notNull(),
+  passwordChangeAt: timestamp('password_change_at', {
+    withTimezone: true,
+  }),
+
+  createdAt: timestamp('create_at').defaultNow().notNull(),
+  updatedAt: timestamp('update_at', { withTimezone: true }).defaultNow().notNull(),
+})
+
+export const authSessions = pgTable(
+  'auth_sessions',
+  {
+    id: uuid('id').defaultRandom().primaryKey(),
+    userId: integer('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'restrict' }),
+    version: integer('version').default(1).notNull(),
+    status: authSessionStatusEnum('status').default('active').notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    revokeReason: varchar('revoke_reason', { length: 100 }),
+    ip: varchar('ip', { length: 64 }),
+    userAgent: varchar('user_agent', { length: 500 }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [
+    index('auth_sessions_user_id_idx').on(table.userId),
+    index('auth_sessions_user_status_idx').on(table.userId, table.status),
+  ],
+)
+
+export const refreshTokenFamilies = pgTable('refresh_token_families', {
+  id: uuid('id').defaultRandom().primaryKey(),
+  sessionId: uuid('session_id')
+    .notNull()
+    .references(() => authSessions.id, { onDelete: 'restrict' }),
+})