handoff-app 2.0.0-2 → 2.0.0-3

package/dist/registry/db/schema.js

@@ -23,7 +23,7 @@
  *   storage of large/binary assets (a content-reference field) rather than assuming inline content.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registrySchema = exports.assetBlobs = exports.assets = exports.assetCollections = exports.tokenArtifacts = exports.tokenSets = exports.buildMetadata = exports.docsArtifacts = exports.pageFiles = exports.pages = exports.patternFiles = exports.patterns = exports.componentFiles = exports.components = void 0;
+exports.registrySchema = exports.registryAuthRateLimits = exports.registryDeviceAuthorizations = exports.registryAccessTokens = exports.registryAuthActionTokens = exports.registryInstallations = exports.registryUsers = exports.assetBlobs = exports.assets = exports.assetCollections = exports.tokenArtifacts = exports.tokenSets = exports.buildMetadata = exports.docsArtifacts = exports.pageFiles = exports.pages = exports.patternFiles = exports.patterns = exports.componentFiles = exports.components = void 0;
 const drizzle_orm_1 = require("drizzle-orm");
 const pg_core_1 = require("drizzle-orm/pg-core");
 /**
@@ -329,6 +329,125 @@ exports.assetBlobs = (0, pg_core_1.pgTable)('asset_blobs', {
     size: (0, pg_core_1.integer)('size').notNull(),
     createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true }).notNull().defaultNow(),
 });
+/**
+ * Registry users. Browser sessions carry the id and auth version, while protected requests re-read
+ * this row so role/status changes take effect without waiting for a cookie to expire.
+ */
+exports.registryUsers = (0, pg_core_1.pgTable)('registry_users', {
+    id: (0, pg_core_1.text)('id')
+        .primaryKey()
+        .$defaultFn(() => crypto.randomUUID()),
+    email: (0, pg_core_1.text)('email').notNull(),
+    name: (0, pg_core_1.text)('name'),
+    image: (0, pg_core_1.text)('image'),
+    role: (0, pg_core_1.text)('role').$type().notNull().default('member'),
+    status: (0, pg_core_1.text)('status').$type().notNull().default('invited'),
+    passwordHash: (0, pg_core_1.text)('password_hash'),
+    emailVerifiedAt: (0, pg_core_1.timestamp)('email_verified_at', { withTimezone: true }),
+    authVersion: (0, pg_core_1.integer)('auth_version').notNull().default(1),
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: (0, pg_core_1.timestamp)('updated_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    (0, pg_core_1.uniqueIndex)('registry_users_normalized_email_idx').on((0, drizzle_orm_1.sql) `lower(btrim(${table.email}))`),
+    (0, pg_core_1.index)('registry_users_status_role_idx').on(table.status, table.role),
+    (0, pg_core_1.check)('registry_users_email_normalized', (0, drizzle_orm_1.sql) `${table.email} = lower(btrim(${table.email}))`),
+    (0, pg_core_1.check)('registry_users_role_valid', (0, drizzle_orm_1.sql) `${table.role} in ('admin', 'member')`),
+    (0, pg_core_1.check)('registry_users_status_valid', (0, drizzle_orm_1.sql) `${table.status} in ('invited', 'active', 'deactivated')`),
+    (0, pg_core_1.check)('registry_users_auth_version_positive', (0, drizzle_orm_1.sql) `${table.authVersion} > 0`),
+]);
+/**
+ * Permanent one-row installation marker. There is deliberately no reset path: deleting or
+ * deactivating users must never reopen the public first-visitor installer.
+ */
+exports.registryInstallations = (0, pg_core_1.pgTable)('registry_installations', {
+    id: (0, pg_core_1.text)('id').primaryKey().default('default'),
+    status: (0, pg_core_1.text)('status').notNull().default('installed'),
+    schemaVersion: (0, pg_core_1.integer)('schema_version').notNull(),
+    initialAdminUserId: (0, pg_core_1.text)('initial_admin_user_id')
+        .notNull()
+        .references(() => exports.registryUsers.id, { onDelete: 'restrict' }),
+    installedAt: (0, pg_core_1.timestamp)('installed_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    (0, pg_core_1.check)('registry_installations_singleton', (0, drizzle_orm_1.sql) `${table.id} = 'default'`),
+    (0, pg_core_1.check)('registry_installations_status_valid', (0, drizzle_orm_1.sql) `${table.status} = 'installed'`),
+    (0, pg_core_1.check)('registry_installations_schema_version_positive', (0, drizzle_orm_1.sql) `${table.schemaVersion} > 0`),
+]);
+/** Hash-only invitation and password-reset secrets. */
+exports.registryAuthActionTokens = (0, pg_core_1.pgTable)('registry_auth_action_tokens', {
+    id: (0, pg_core_1.text)('id')
+        .primaryKey()
+        .$defaultFn(() => crypto.randomUUID()),
+    userId: (0, pg_core_1.text)('user_id')
+        .notNull()
+        .references(() => exports.registryUsers.id, { onDelete: 'cascade' }),
+    purpose: (0, pg_core_1.text)('purpose').$type().notNull(),
+    tokenHash: (0, pg_core_1.text)('token_hash').notNull(),
+    expiresAt: (0, pg_core_1.timestamp)('expires_at', { withTimezone: true }).notNull(),
+    usedAt: (0, pg_core_1.timestamp)('used_at', { withTimezone: true }),
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    (0, pg_core_1.uniqueIndex)('registry_auth_action_tokens_hash_idx').on(table.tokenHash),
+    (0, pg_core_1.index)('registry_auth_action_tokens_user_purpose_idx').on(table.userId, table.purpose),
+    (0, pg_core_1.check)('registry_auth_action_tokens_purpose_valid', (0, drizzle_orm_1.sql) `${table.purpose} in ('invite', 'password_reset')`),
+]);
+/** Revocable, hash-only registry API credentials owned by one user. */
+exports.registryAccessTokens = (0, pg_core_1.pgTable)('registry_access_tokens', {
+    /** Public lookup id embedded in the opaque token; not itself a credential. */
+    id: (0, pg_core_1.text)('id').primaryKey(),
+    userId: (0, pg_core_1.text)('user_id')
+        .notNull()
+        .references(() => exports.registryUsers.id, { onDelete: 'cascade' }),
+    name: (0, pg_core_1.text)('name').notNull(),
+    secretHash: (0, pg_core_1.text)('secret_hash').notNull(),
+    scopes: (0, pg_core_1.jsonb)('scopes').$type().notNull(),
+    expiresAt: (0, pg_core_1.timestamp)('expires_at', { withTimezone: true }).notNull(),
+    lastUsedAt: (0, pg_core_1.timestamp)('last_used_at', { withTimezone: true }),
+    revokedAt: (0, pg_core_1.timestamp)('revoked_at', { withTimezone: true }),
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    (0, pg_core_1.index)('registry_access_tokens_user_idx').on(table.userId),
+    (0, pg_core_1.index)('registry_access_tokens_expires_idx').on(table.expiresAt),
+    (0, pg_core_1.check)('registry_access_tokens_name_not_blank', (0, drizzle_orm_1.sql) `length(btrim(${table.name})) > 0`),
+    (0, pg_core_1.check)('registry_access_tokens_scopes_array', (0, drizzle_orm_1.sql) `jsonb_typeof(${table.scopes}) = 'array'`),
+]);
+/** Short-lived authorization used by `handoff-app login`. Plaintext device codes are never stored. */
+exports.registryDeviceAuthorizations = (0, pg_core_1.pgTable)('registry_device_authorizations', {
+    id: (0, pg_core_1.text)('id')
+        .primaryKey()
+        .$defaultFn(() => crypto.randomUUID()),
+    deviceCodeHash: (0, pg_core_1.text)('device_code_hash').notNull(),
+    userCode: (0, pg_core_1.text)('user_code').notNull(),
+    status: (0, pg_core_1.text)('status').$type().notNull().default('pending'),
+    userId: (0, pg_core_1.text)('user_id').references(() => exports.registryUsers.id, { onDelete: 'set null' }),
+    scopes: (0, pg_core_1.jsonb)('scopes').$type().notNull(),
+    expiresAt: (0, pg_core_1.timestamp)('expires_at', { withTimezone: true }).notNull(),
+    approvedAt: (0, pg_core_1.timestamp)('approved_at', { withTimezone: true }),
+    consumedAt: (0, pg_core_1.timestamp)('consumed_at', { withTimezone: true }),
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    (0, pg_core_1.uniqueIndex)('registry_device_authorizations_device_hash_idx').on(table.deviceCodeHash),
+    (0, pg_core_1.uniqueIndex)('registry_device_authorizations_user_code_idx').on(table.userCode),
+    (0, pg_core_1.index)('registry_device_authorizations_expires_idx').on(table.expiresAt),
+    (0, pg_core_1.check)('registry_device_authorizations_status_valid', (0, drizzle_orm_1.sql) `${table.status} in ('pending', 'approved', 'denied', 'consumed')`),
+    (0, pg_core_1.check)('registry_device_authorizations_scopes_array', (0, drizzle_orm_1.sql) `jsonb_typeof(${table.scopes}) = 'array'`),
+]);
+/**
+ * Fixed-window throttling counters. Callers pass a hash of the identifying value so raw emails and
+ * IP addresses are not retained.
+ */
+exports.registryAuthRateLimits = (0, pg_core_1.pgTable)('registry_auth_rate_limits', {
+    bucket: (0, pg_core_1.text)('bucket').$type().notNull(),
+    identifierHash: (0, pg_core_1.text)('identifier_hash').notNull(),
+    windowStartedAt: (0, pg_core_1.timestamp)('window_started_at', { withTimezone: true }).notNull(),
+    attempts: (0, pg_core_1.integer)('attempts').notNull().default(1),
+    expiresAt: (0, pg_core_1.timestamp)('expires_at', { withTimezone: true }).notNull(),
+    updatedAt: (0, pg_core_1.timestamp)('updated_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    (0, pg_core_1.primaryKey)({ columns: [table.bucket, table.identifierHash, table.windowStartedAt] }),
+    (0, pg_core_1.index)('registry_auth_rate_limits_expires_idx').on(table.expiresAt),
+    (0, pg_core_1.check)('registry_auth_rate_limits_bucket_valid', (0, drizzle_orm_1.sql) `${table.bucket} in ('login', 'password_reset', 'device')`),
+    (0, pg_core_1.check)('registry_auth_rate_limits_attempts_positive', (0, drizzle_orm_1.sql) `${table.attempts} > 0`),
+]);
 /** All registry tables, for typed Drizzle clients and migration tooling. */
 exports.registrySchema = {
     components: exports.components,
@@ -344,4 +463,10 @@ exports.registrySchema = {
     assetCollections: exports.assetCollections,
     assets: exports.assets,
     assetBlobs: exports.assetBlobs,
+    registryUsers: exports.registryUsers,
+    registryInstallations: exports.registryInstallations,
+    registryAuthActionTokens: exports.registryAuthActionTokens,
+    registryAccessTokens: exports.registryAccessTokens,
+    registryDeviceAuthorizations: exports.registryDeviceAuthorizations,
+    registryAuthRateLimits: exports.registryAuthRateLimits,
 };

package/dist/registry/publish/assets.js

@@ -50,7 +50,7 @@ const toManifestEntry = (asset) => {
  * throws at the end if any collection failed.
  */
 const publishAssets = (handoff, collection) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, index_1.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, index_1.resolveConnectionOrThrow)(handoff);
     if (collection && !(0, sets_1.isAssetCollection)(collection)) {
         throw new index_1.PublishError(`Unknown asset collection "${collection}". Supported collections: ${sets_1.ASSET_COLLECTIONS.join(', ')}.`);
     }

package/dist/registry/publish/errors.js

@@ -7,10 +7,10 @@ const describeUploadFailure = (error, registryUrl, rejectedPayload) => {
     switch (error.code) {
         case 'runtime_mode_conflict':
             return `The registry at ${registryUrl} is not running in registry mode, so it cannot accept publishes: ${error.message}`;
-        case 'token_not_configured':
-            return `The registry at ${registryUrl} has no management token configured, so it is rejecting mutations: ${error.message}`;
         case 'unauthorized':
-            return `The registry rejected the access token (401). Check the configured access token matches the registry's token.`;
+            return `The registry rejected the access token (401). Run \`handoff-app login --url ${registryUrl}\` again, or replace the user-issued CI token.`;
+        case 'forbidden':
+            return `The registry token does not have permission to publish (403). Sign in as an administrator and authorize a token with registry:write access.`;
         case 'bad_request':
             return `The registry rejected the ${rejectedPayload} (400): ${error.message}`;
         default:

package/dist/registry/publish/index.d.ts

@@ -19,7 +19,7 @@ export declare class PublishError extends Error {
  * hosts do not publish) and a resolved registry URL + access token. Throws an actionable
  * {@link PublishError} naming the exact misconfiguration.
  */
-export declare const resolveConnectionOrThrow: (handoff: Handoff) => import("../connection").ResolvedRegistryConnection;
+export declare const resolveConnectionOrThrow: (handoff: Handoff) => Promise<import("../connection").ResolvedRegistryConnection>;
 /**
  * Publish a single component, pattern, or page from a connected workspace. Components and patterns
  * receive a targeted build, while pages are packaged directly from their source.

package/dist/registry/publish/index.js

@@ -45,24 +45,24 @@ exports.PublishError = PublishError;
  * hosts do not publish) and a resolved registry URL + access token. Throws an actionable
  * {@link PublishError} naming the exact misconfiguration.
  */
-const resolveConnectionOrThrow = (handoff) => {
+const resolveConnectionOrThrow = (handoff) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b, _c;
     const mode = (_c = (_b = (_a = handoff.config) === null || _a === void 0 ? void 0 : _a.runtime) === null || _b === void 0 ? void 0 : _b.mode) !== null && _c !== void 0 ? _c : 'workspace';
     if (mode !== 'workspace') {
         throw new PublishError(`publish is only available from a connected workspace (runtime.mode: "workspace"); this project is "${mode}". ` +
             'A registry host stores and serves what was published to it; it does not publish.');
     }
-    const connection = (0, connection_1.resolveRegistryConnection)(handoff.config);
+    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath);
     if (!connection.url) {
-        throw new PublishError(`No registry URL is configured. Set runtime.registryConnection.url, or the "${connection.urlEnv}" environment variable, ` +
-            'to the base URL of the registry to publish to.');
+        throw new PublishError(`No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+            `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to publish to.`);
     }
     if (!connection.accessToken) {
-        throw new PublishError(`No registry access token is configured. Set the "${connection.accessTokenEnv}" environment variable to the ` +
-            "registry's bearer token to authorize publishing.");
+        throw new PublishError(`No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
+            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`);
     }
     return connection;
-};
+});
 exports.resolveConnectionOrThrow = resolveConnectionOrThrow;
 /** Run the smallest build that guarantees the selected entity's artifacts are current. */
 const runTargetedBuild = (handoff, kind, id) => __awaiter(void 0, void 0, void 0, function* () {
@@ -105,7 +105,7 @@ const runTargetedBuild = (handoff, kind, id) => __awaiter(void 0, void 0, void 0
  * receive a targeted build, while pages are packaged directly from their source.
  */
 const publishEntity = (handoff, kind, id) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, exports.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, exports.resolveConnectionOrThrow)(handoff);
     logger_1.Logger.info(kind === 'page' ? `Preparing page "${id}" for publish…` : `Building ${kind} "${id}" for publish…`);
     yield runTargetedBuild(handoff, kind, id);
     const pkg = yield (0, package_1.buildPublishPackage)(handoff, kind, id);
@@ -154,7 +154,7 @@ const listWorkspaceEntityIds = (handoff, kind) => __awaiter(void 0, void 0, void
  * collected and never aborts the rest; the run throws at the end if any entity failed.
  */
 const publishEntities = (handoff, kind) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, exports.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, exports.resolveConnectionOrThrow)(handoff);
     logger_1.Logger.info(`Building ${kind}s for publish…`);
     yield runBulkBuild(handoff, kind);
     const ids = yield listWorkspaceEntityIds(handoff, kind);

package/dist/registry/publish/tokens.js

@@ -59,7 +59,7 @@ const buildTokenSetPackage = (handoff, set) => __awaiter(void 0, void 0, void 0,
  * committed atomically server-side); the run throws at the end if any set failed.
  */
 const publishTokens = (handoff, setId) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, index_1.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, index_1.resolveConnectionOrThrow)(handoff);
     logger_1.Logger.info(setId ? `Building tokens to publish "${setId}"…` : 'Building tokens for publish…');
     yield handoff.fetch();
     const allSets = yield handoff.store.tokens.listSets();

package/dist/types/config.d.ts

@@ -136,7 +136,10 @@ export interface HandoffRuntimeConfig {
     registry?: {
         /** Name of the env var holding the database URL. @default "DATABASE_URL" */
         databaseUrlEnv?: string;
-        /** Name of the env var holding the registry API token. @default "HANDOFF_REGISTRY_API_TOKEN" */
+        /**
+         * @deprecated Fixed registry secrets are no longer authorized. This option remains parseable
+         * only so existing configuration files do not break.
+         */
         apiTokenEnv?: string;
         database?: {
             /**

package/docs/cli.md

@@ -58,6 +58,10 @@ Commands:
 
   db:migrate [opts] - Runs registry database migrations (Drizzle / PostgreSQL). Reads the project config and database env vars, applies the package-owned migration set, and runs independently of `build`.
 
+  login --url <registry-url> - Authorizes this workspace in the browser and stores a revocable token in `.handoff/cli-auth.json`.
+
+  logout [--url <registry-url>] - Revokes the saved token when possible, then removes the local credential.
+
   make
     make:template <component> <state> [opts] - Creates a new template
     make:page <component> <state> [opts] - Creates a new page

package/drizzle/0005_add_registry_auth.sql

@@ -0,0 +1,95 @@
+CREATE TABLE "registry_access_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"name" text NOT NULL,
+	"secret_hash" text NOT NULL,
+	"scopes" jsonb NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"last_used_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "registry_access_tokens_name_not_blank" CHECK (length(btrim("registry_access_tokens"."name")) > 0),
+	CONSTRAINT "registry_access_tokens_scopes_array" CHECK (jsonb_typeof("registry_access_tokens"."scopes") = 'array')
+);
+--> statement-breakpoint
+CREATE TABLE "registry_auth_action_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"purpose" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"used_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "registry_auth_action_tokens_purpose_valid" CHECK ("registry_auth_action_tokens"."purpose" in ('invite', 'password_reset'))
+);
+--> statement-breakpoint
+CREATE TABLE "registry_auth_rate_limits" (
+	"bucket" text NOT NULL,
+	"identifier_hash" text NOT NULL,
+	"window_started_at" timestamp with time zone NOT NULL,
+	"attempts" integer DEFAULT 1 NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "registry_auth_rate_limits_bucket_identifier_hash_window_started_at_pk" PRIMARY KEY("bucket","identifier_hash","window_started_at"),
+	CONSTRAINT "registry_auth_rate_limits_bucket_valid" CHECK ("registry_auth_rate_limits"."bucket" in ('login', 'password_reset', 'device')),
+	CONSTRAINT "registry_auth_rate_limits_attempts_positive" CHECK ("registry_auth_rate_limits"."attempts" > 0)
+);
+--> statement-breakpoint
+CREATE TABLE "registry_device_authorizations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"device_code_hash" text NOT NULL,
+	"user_code" text NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"user_id" text,
+	"scopes" jsonb NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"approved_at" timestamp with time zone,
+	"consumed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "registry_device_authorizations_status_valid" CHECK ("registry_device_authorizations"."status" in ('pending', 'approved', 'denied', 'consumed')),
+	CONSTRAINT "registry_device_authorizations_scopes_array" CHECK (jsonb_typeof("registry_device_authorizations"."scopes") = 'array')
+);
+--> statement-breakpoint
+CREATE TABLE "registry_installations" (
+	"id" text PRIMARY KEY DEFAULT 'default' NOT NULL,
+	"status" text DEFAULT 'installed' NOT NULL,
+	"schema_version" integer NOT NULL,
+	"initial_admin_user_id" text NOT NULL,
+	"installed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "registry_installations_singleton" CHECK ("registry_installations"."id" = 'default'),
+	CONSTRAINT "registry_installations_status_valid" CHECK ("registry_installations"."status" = 'installed'),
+	CONSTRAINT "registry_installations_schema_version_positive" CHECK ("registry_installations"."schema_version" > 0)
+);
+--> statement-breakpoint
+CREATE TABLE "registry_users" (
+	"id" text PRIMARY KEY NOT NULL,
+	"email" text NOT NULL,
+	"name" text,
+	"image" text,
+	"role" text DEFAULT 'member' NOT NULL,
+	"status" text DEFAULT 'invited' NOT NULL,
+	"password_hash" text,
+	"email_verified_at" timestamp with time zone,
+	"auth_version" integer DEFAULT 1 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "registry_users_email_normalized" CHECK ("registry_users"."email" = lower(btrim("registry_users"."email"))),
+	CONSTRAINT "registry_users_role_valid" CHECK ("registry_users"."role" in ('admin', 'member')),
+	CONSTRAINT "registry_users_status_valid" CHECK ("registry_users"."status" in ('invited', 'active', 'deactivated')),
+	CONSTRAINT "registry_users_auth_version_positive" CHECK ("registry_users"."auth_version" > 0)
+);
+--> statement-breakpoint
+ALTER TABLE "registry_access_tokens" ADD CONSTRAINT "registry_access_tokens_user_id_registry_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."registry_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "registry_auth_action_tokens" ADD CONSTRAINT "registry_auth_action_tokens_user_id_registry_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."registry_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "registry_device_authorizations" ADD CONSTRAINT "registry_device_authorizations_user_id_registry_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."registry_users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "registry_installations" ADD CONSTRAINT "registry_installations_initial_admin_user_id_registry_users_id_fk" FOREIGN KEY ("initial_admin_user_id") REFERENCES "public"."registry_users"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "registry_access_tokens_user_idx" ON "registry_access_tokens" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "registry_access_tokens_expires_idx" ON "registry_access_tokens" USING btree ("expires_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "registry_auth_action_tokens_hash_idx" ON "registry_auth_action_tokens" USING btree ("token_hash");--> statement-breakpoint
+CREATE INDEX "registry_auth_action_tokens_user_purpose_idx" ON "registry_auth_action_tokens" USING btree ("user_id","purpose");--> statement-breakpoint
+CREATE INDEX "registry_auth_rate_limits_expires_idx" ON "registry_auth_rate_limits" USING btree ("expires_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "registry_device_authorizations_device_hash_idx" ON "registry_device_authorizations" USING btree ("device_code_hash");--> statement-breakpoint
+CREATE UNIQUE INDEX "registry_device_authorizations_user_code_idx" ON "registry_device_authorizations" USING btree ("user_code");--> statement-breakpoint
+CREATE INDEX "registry_device_authorizations_expires_idx" ON "registry_device_authorizations" USING btree ("expires_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "registry_users_normalized_email_idx" ON "registry_users" USING btree (lower(btrim("email")));--> statement-breakpoint
+CREATE INDEX "registry_users_status_role_idx" ON "registry_users" USING btree ("status","role");