@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/adapters/database/index.mjs

@@ -11,6 +11,11 @@ import "./subscriber/index.mjs";
 import { CachePrefix } from "./domains/constants.mjs";
 import { RealmSubscriber } from "./domains/realm/subscriber.mjs";
 import { KeyEntity } from "./domains/key/entity.mjs";
+import { PolicyEntity } from "./domains/policy/entity.mjs";
+import { PolicyAttributeEntity } from "./domains/policy-attribute/entity.mjs";
+import { PolicyAttributeSubscriber } from "./domains/policy-attribute/subscriber.mjs";
+import { PolicyRepository } from "./domains/policy/repository.mjs";
+import { PolicySubscriber } from "./domains/policy/subscriber.mjs";
 import { ClientEntity } from "./domains/client/entity.mjs";
 import { ClientSubscriber } from "./domains/client/subscriber.mjs";
 import { RoleEntity } from "./domains/role/entity.mjs";
@@ -21,27 +26,25 @@ import { ClientRoleEntity } from "./domains/client-role/entity.mjs";
 import { ClientRoleSubscriber } from "./domains/client-role/subscriber.mjs";
 import { PermissionEntity } from "./domains/permission/entity.mjs";
 import { PermissionSubscriber } from "./domains/permission/subscriber.mjs";
-import { PolicyEntity } from "./domains/policy/entity.mjs";
-import { PolicyAttributeEntity } from "./domains/policy-attribute/entity.mjs";
-import { PolicyAttributeSubscriber } from "./domains/policy-attribute/subscriber.mjs";
-import { PolicyRepository } from "./domains/policy/repository.mjs";
-import { PolicySubscriber } from "./domains/policy/subscriber.mjs";
 import { ClientPermissionEntity } from "./domains/client-permission/entity.mjs";
 import { ClientPermissionSubscriber } from "./domains/client-permission/subscriber.mjs";
 import { ScopeEntity } from "./domains/scope/entity.mjs";
 import { ScopeSubscriber } from "./domains/scope/subscriber.mjs";
 import { ClientScopeEntity } from "./domains/client-scope/entity.mjs";
 import { ClientScopeSubscriber } from "./domains/client-scope/subscriber.mjs";
-import { IdentityProviderEntity } from "./domains/identity-provider/entity.mjs";
-import { IdentityProviderAttributeEntity } from "./domains/identity-provider-attribute/entity.mjs";
-import { IdentityProviderAttributeSubscriber } from "./domains/identity-provider-attribute/subscriber.mjs";
-import { IdentityProviderRepository } from "./domains/identity-provider/repository.mjs";
-import { IdentityProviderSubscriber } from "./domains/identity-provider/subscriber.mjs";
 import { UserEntity } from "./domains/user/entity.mjs";
 import { UserAttributeEntity } from "./domains/user-attribute/entity.mjs";
 import { UserAttributeSubscriber } from "./domains/user-attribute/subscriber.mjs";
 import { UserRepository } from "./domains/user/repository.mjs";
 import { UserSubscriber } from "./domains/user/subscriber.mjs";
+import { ConsentEntity } from "./domains/consent/entity.mjs";
+import { ConsentEntitySubscriber } from "./domains/consent/subscriber.mjs";
+import { EventEntity } from "./domains/event/entity.mjs";
+import { IdentityProviderEntity } from "./domains/identity-provider/entity.mjs";
+import { IdentityProviderAttributeEntity } from "./domains/identity-provider-attribute/entity.mjs";
+import { IdentityProviderAttributeSubscriber } from "./domains/identity-provider-attribute/subscriber.mjs";
+import { IdentityProviderRepository } from "./domains/identity-provider/repository.mjs";
+import { IdentityProviderSubscriber } from "./domains/identity-provider/subscriber.mjs";
 import { IdentityProviderAccountEntity } from "./domains/identity-provider-account/entity.mjs";
 import { IdentityProviderAccountSubscriber } from "./domains/identity-provider-account/subscriber.mjs";
 import { IdentityProviderAttributeMappingEntity } from "./domains/identity-provider-attribute-mapping/entity.mjs";
@@ -51,6 +54,8 @@ import { IdentityProviderRoleSubscriber } from "./domains/identity-provider-role
 import { RobotEntity } from "./domains/robot/entity.mjs";
 import { RobotSubscriber } from "./domains/robot/subscriber.mjs";
 import { SessionEntity } from "./domains/session/entity.mjs";
+import { SessionTokenEntity } from "./domains/session-token/entity.mjs";
+import { TrustAnchorEntity } from "./domains/trust-anchor/entity.mjs";
 import { PermissionPolicyEntity } from "./domains/permission-policy/entity.mjs";
 import { RobotPermissionEntity } from "./domains/robot-permission/entity.mjs";
 import { RobotPermissionSubscriber } from "./domains/robot-permission/subscriber.mjs";
@@ -59,6 +64,7 @@ import { RobotRoleSubscriber } from "./domains/robot-role/subscriber.mjs";
 import { RoleAttributeSubscriber } from "./domains/role-attribute/subscriber.mjs";
 import { RolePermissionEntity } from "./domains/role-permission/entity.mjs";
 import { RolePermissionSubscriber } from "./domains/role-permission/subscriber.mjs";
+import { UserAuthenticatorEntity } from "./domains/user-authenticator/entity.mjs";
 import { UserPermissionEntity } from "./domains/user-permission/entity.mjs";
 import { UserPermissionSubscriber } from "./domains/user-permission/subscriber.mjs";
 import { UserRoleEntity } from "./domains/user-role/entity.mjs";
@@ -69,5 +75,6 @@ import "./cache/index.mjs";
 import { DataSourceOptionsBuilder } from "./data-source/options/module.mjs";
 import "./data-source/index.mjs";
 import { DatabaseConflictError } from "./errors/conflict.mjs";
+import { getDatabaseDriverErrorCode, isUniqueConstraintDatabaseError } from "./errors/driver.mjs";
 import "./errors/index.mjs";
-export { CachePrefix, ClientEntity, ClientPermissionEntity, ClientPermissionSubscriber, ClientRoleEntity, ClientRoleSubscriber, ClientScopeEntity, ClientScopeSubscriber, ClientSubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseQueryResultCache, EntitySubscriber, IdentityProviderAccountEntity, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeSubscriber, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderRepository, IdentityProviderRoleMappingEntity, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, KeyEntity, PermissionEntity, PermissionPolicyEntity, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyEntity, PolicyRepository, PolicySubscriber, RealmEntity, RealmRepository, RealmSubscriber, RobotEntity, RobotPermissionEntity, RobotPermissionSubscriber, RobotRoleEntity, RobotRoleSubscriber, RobotSubscriber, RoleAttributeEntity, RoleAttributeSubscriber, RoleEntity, RolePermissionEntity, RolePermissionSubscriber, RoleRepository, RoleSubscriber, ScopeEntity, ScopeSubscriber, SessionEntity, UserAttributeEntity, UserAttributeSubscriber, UserEntity, UserPermissionEntity, UserPermissionSubscriber, UserRepository, UserRoleEntity, UserRoleSubscriber, UserSubscriber, buildEntityDestinations, dateToISOStringTransformer, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment };
+export { CachePrefix, ClientEntity, ClientPermissionEntity, ClientPermissionSubscriber, ClientRoleEntity, ClientRoleSubscriber, ClientScopeEntity, ClientScopeSubscriber, ClientSubscriber, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseQueryResultCache, EntitySubscriber, EventEntity, IdentityProviderAccountEntity, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeSubscriber, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderRepository, IdentityProviderRoleMappingEntity, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, KeyEntity, PermissionEntity, PermissionPolicyEntity, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyEntity, PolicyRepository, PolicySubscriber, RealmEntity, RealmRepository, RealmSubscriber, RobotEntity, RobotPermissionEntity, RobotPermissionSubscriber, RobotRoleEntity, RobotRoleSubscriber, RobotSubscriber, RoleAttributeEntity, RoleAttributeSubscriber, RoleEntity, RolePermissionEntity, RolePermissionSubscriber, RoleRepository, RoleSubscriber, ScopeEntity, ScopeSubscriber, SessionEntity, SessionTokenEntity, TrustAnchorEntity, UserAttributeEntity, UserAttributeSubscriber, UserAuthenticatorEntity, UserEntity, UserPermissionEntity, UserPermissionSubscriber, UserRepository, UserRoleEntity, UserRoleSubscriber, UserSubscriber, buildEntityDestinations, dateToISOStringTransformer, getDatabaseDriverErrorCode, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError };

package/dist/adapters/database/migrations/mysql/1783325495597-Default.d.ts

@@ -0,0 +1,28 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Refresh token rotation + replay detection (plan 016).
+ *
+ * - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was
+ *   IPv4-only, a latent truncation bug).
+ * - Adds auth_session_tokens: one durable row per issued access/refresh token,
+ *   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for
+ *   refresh-token validity (consume/replay/revoke); the cache stays the
+ *   verification fast-path.
+ *
+ * BREAKING: at deploy the table is empty, so every in-flight refresh token has
+ * no row and its first refresh returns invalid_grant — active users
+ * re-authenticate once (hard cutover, RT horizon 3 days).
+ *
+ * down() narrows ip_address back to 15, which fails if any IPv6 value was
+ * stored (best-effort, per the 1779300000000 precedent).
+ *
+ * Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated
+ * OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.
+ * Folded into this still-unreleased migration rather than a new file.
+ */
+export declare class Default1783325495597 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1783325495597-Default.d.ts.map

package/dist/adapters/database/migrations/mysql/1783325495597-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783325495597-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1783325495597-Default.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB7D"}

package/dist/adapters/database/migrations/mysql/1783325495597-Default.mjs

@@ -0,0 +1,85 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1783325495597-Default.ts
+/**
+* Refresh token rotation + replay detection (plan 016).
+*
+* - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was
+*   IPv4-only, a latent truncation bug).
+* - Adds auth_session_tokens: one durable row per issued access/refresh token,
+*   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for
+*   refresh-token validity (consume/replay/revoke); the cache stays the
+*   verification fast-path.
+*
+* BREAKING: at deploy the table is empty, so every in-flight refresh token has
+* no row and its first refresh returns invalid_grant — active users
+* re-authenticate once (hard cutover, RT horizon 3 days).
+*
+* down() narrows ip_address back to 15, which fails if any IPv6 value was
+* stored (best-effort, per the 1779300000000 precedent).
+*
+* Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated
+* OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.
+* Folded into this still-unreleased migration rather than a new file.
+*/ var Default1783325495597 = class {
+	name = "Default1783325495597";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` MODIFY \`ip_address\` varchar(45) NOT NULL
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_session_tokens\` (
+                \`id\` varchar(36) NOT NULL,
+                \`session_id\` varchar(36) NOT NULL,
+                \`kind\` varchar(16) NOT NULL,
+                \`parent_id\` varchar(36) NULL,
+                \`refresh_token_id\` varchar(36) NULL,
+                \`ip_address\` varchar(45) NOT NULL,
+                \`user_agent\` varchar(512) NOT NULL,
+                \`consumed_at\` varchar(28) NULL,
+                \`revoked_at\` varchar(28) NULL,
+                \`expires_at\` varchar(28) NOT NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                INDEX \`IDX_auth_session_tokens_session_id\` (\`session_id\`),
+                INDEX \`IDX_auth_session_tokens_kind\` (\`kind\`),
+                INDEX \`IDX_auth_session_tokens_expires_at\` (\`expires_at\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_session_tokens\`
+            ADD CONSTRAINT \`FK_auth_session_tokens_session_id\` FOREIGN KEY (\`session_id\`) REFERENCES \`auth_sessions\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`post_logout_redirect_uri\` text NULL
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`post_logout_redirect_uri\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_session_tokens\` DROP FOREIGN KEY \`FK_auth_session_tokens_session_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_session_tokens_expires_at\` ON \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_session_tokens_kind\` ON \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_session_tokens_session_id\` ON \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` MODIFY \`ip_address\` varchar(15) NOT NULL
+        `);
+	}
+};
+//#endregion
+export { Default1783325495597 };
+
+//# sourceMappingURL=1783325495597-Default.mjs.map

package/dist/adapters/database/migrations/mysql/1783325495597-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783325495597-Default.mjs","names":["Default1783325495597","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1783325495597-Default.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Refresh token rotation + replay detection (plan 016).\n *\n * - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was\n *   IPv4-only, a latent truncation bug).\n * - Adds auth_session_tokens: one durable row per issued access/refresh token,\n *   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for\n *   refresh-token validity (consume/replay/revoke); the cache stays the\n *   verification fast-path.\n *\n * BREAKING: at deploy the table is empty, so every in-flight refresh token has\n * no row and its first refresh returns invalid_grant — active users\n * re-authenticate once (hard cutover, RT horizon 3 days).\n *\n * down() narrows ip_address back to 15, which fails if any IPv6 value was\n * stored (best-effort, per the 1779300000000 precedent).\n *\n * Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated\n * OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.\n * Folded into this still-unreleased migration rather than a new file.\n */\nexport class Default1783325495597 implements MigrationInterface {\n    name = 'Default1783325495597';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` MODIFY \\`ip_address\\` varchar(45) NOT NULL\n        `);\n\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_session_tokens\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`session_id\\` varchar(36) NOT NULL,\n                \\`kind\\` varchar(16) NOT NULL,\n                \\`parent_id\\` varchar(36) NULL,\n                \\`refresh_token_id\\` varchar(36) NULL,\n                \\`ip_address\\` varchar(45) NOT NULL,\n                \\`user_agent\\` varchar(512) NOT NULL,\n                \\`consumed_at\\` varchar(28) NULL,\n                \\`revoked_at\\` varchar(28) NULL,\n                \\`expires_at\\` varchar(28) NOT NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                INDEX \\`IDX_auth_session_tokens_session_id\\` (\\`session_id\\`),\n                INDEX \\`IDX_auth_session_tokens_kind\\` (\\`kind\\`),\n                INDEX \\`IDX_auth_session_tokens_expires_at\\` (\\`expires_at\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_session_tokens\\`\n            ADD CONSTRAINT \\`FK_auth_session_tokens_session_id\\` FOREIGN KEY (\\`session_id\\`) REFERENCES \\`auth_sessions\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // Dedicated post-logout redirect allow-list for OIDC RP-Initiated\n        // Logout (plan 042) — no longer conflated with the login redirect_uri.\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`post_logout_redirect_uri\\` text NULL\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`post_logout_redirect_uri\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_session_tokens\\` DROP FOREIGN KEY \\`FK_auth_session_tokens_session_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_session_tokens_expires_at\\` ON \\`auth_session_tokens\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_session_tokens_kind\\` ON \\`auth_session_tokens\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_session_tokens_session_id\\` ON \\`auth_session_tokens\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_session_tokens\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` MODIFY \\`ip_address\\` varchar(15) NOT NULL\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;GAuBA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;SAkBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EAID,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;CACL;AACJ"}

package/dist/adapters/database/migrations/mysql/1783769340000-Default.d.ts

@@ -0,0 +1,50 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Security event log (plan 057), MFA — authenticator devices (plan 049) +
+ * auth-method claims (plan 050), application access policy (plan 052) +
+ * persisted consent (plan 055), realm key store (plans 069 + 071) and
+ * RFC 8705 client authentication (plan 072).
+ *
+ * - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+ *   by design: a row must survive deletion of the realm/actor/client it
+ *   references. Retention is per-row (`expires_at`, stamped at write from
+ *   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+ *   event-cleaner component (plan 057).
+ * - Adds auth_user_authenticators: polymorphic second-factor device rows
+ *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+ *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+ *   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+ * - Adds auth_sessions.mfa_at: instant the subject last passed a
+ *   second-factor challenge for the session (plan 049).
+ * - Adds auth_sessions.auth_method: how the subject authenticated
+ *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+ * - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+ *   (ON DELETE SET NULL) — the policy that must pass for an identity to
+ *   authorize against the client (null = default-allow; plan 052).
+ * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+ *   a subject has approved at POST /authorize. Union/keep (missing tokens
+ *   only, never deleted on re-approval); built_in clients keep zero rows;
+ *   expires_at is dormant (always null in Stage 1) but honored by the
+ *   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+ *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+ *   plan 055).
+ * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+ *   generalizes auth_keys into the per-realm key store. enc rows hold the
+ *   realm's auto-generated symmetric at-rest encryption key (oct) that the
+ *   MFA seed cipher rides; existing rows default to sig (plan 069).
+ * - Adds auth_keys.name (canonical identifier, backfilled from id),
+ *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+ *   auth_keys.certificate (PEM chain, Stage B) — key management API
+ *   (plan 071 Stage A).
+ * - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+ *   RFC 8705 PKI client authentication (plan 071 Stage C).
+ * - Replaces auth_clients.is_confidential with auth_method
+ *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+ *   client authentication and sender-constrained tokens (plan 072).
+ */
+export declare class Default1783769340000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1783769340000-Default.d.ts.map

package/dist/adapters/database/migrations/mysql/1783769340000-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1783769340000-Default.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA0L3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAqH7D"}

package/dist/adapters/database/migrations/mysql/1783769340000-Default.mjs

@@ -0,0 +1,320 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1783769340000-Default.ts
+/**
+* Security event log (plan 057), MFA — authenticator devices (plan 049) +
+* auth-method claims (plan 050), application access policy (plan 052) +
+* persisted consent (plan 055), realm key store (plans 069 + 071) and
+* RFC 8705 client authentication (plan 072).
+*
+* - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+*   by design: a row must survive deletion of the realm/actor/client it
+*   references. Retention is per-row (`expires_at`, stamped at write from
+*   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+*   event-cleaner component (plan 057).
+* - Adds auth_user_authenticators: polymorphic second-factor device rows
+*   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+*   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+*   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+* - Adds auth_sessions.mfa_at: instant the subject last passed a
+*   second-factor challenge for the session (plan 049).
+* - Adds auth_sessions.auth_method: how the subject authenticated
+*   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+* - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+*   (ON DELETE SET NULL) — the policy that must pass for an identity to
+*   authorize against the client (null = default-allow; plan 052).
+* - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+*   a subject has approved at POST /authorize. Union/keep (missing tokens
+*   only, never deleted on re-approval); built_in clients keep zero rows;
+*   expires_at is dormant (always null in Stage 1) but honored by the
+*   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+*   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+*   plan 055).
+* - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+*   generalizes auth_keys into the per-realm key store. enc rows hold the
+*   realm's auto-generated symmetric at-rest encryption key (oct) that the
+*   MFA seed cipher rides; existing rows default to sig (plan 069).
+* - Adds auth_keys.name (canonical identifier, backfilled from id),
+*   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+*   auth_keys.certificate (PEM chain, Stage B) — key management API
+*   (plan 071 Stage A).
+* - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+*   RFC 8705 PKI client authentication (plan 071 Stage C).
+* - Replaces auth_clients.is_confidential with auth_method
+*   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+*   client authentication and sender-constrained tokens (plan 072).
+*/ var Default1783769340000 = class {
+	name = "Default1783769340000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE \`auth_events\` (
+                \`id\` varchar(36) NOT NULL,
+                \`scope\` varchar(64) NOT NULL,
+                \`name\` varchar(64) NOT NULL,
+                \`ref_type\` varchar(64) NULL,
+                \`ref_id\` varchar(64) NULL,
+                \`client_id\` varchar(36) NULL,
+                \`actor_type\` varchar(16) NULL,
+                \`actor_id\` varchar(36) NULL,
+                \`actor_name\` varchar(128) NULL,
+                \`request_path\` varchar(256) NULL,
+                \`request_method\` varchar(10) NULL,
+                \`request_ip_address\` varchar(45) NULL,
+                \`request_user_agent\` varchar(512) NULL,
+                \`realm_id\` varchar(36) NULL,
+                \`data\` text NULL,
+                \`expiring\` tinyint NOT NULL DEFAULT 0,
+                \`expires_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                INDEX \`IDX_auth_events_name_scope\` (\`name\`, \`scope\`),
+                INDEX \`IDX_auth_events_ref_type_ref_id\` (\`ref_type\`, \`ref_id\`),
+                INDEX \`IDX_auth_events_client_id\` (\`client_id\`),
+                INDEX \`IDX_auth_events_actor_id\` (\`actor_id\`),
+                INDEX \`IDX_auth_events_actor_name\` (\`actor_name\`),
+                INDEX \`IDX_auth_events_request_ip_address\` (\`request_ip_address\`),
+                INDEX \`IDX_auth_events_realm_id\` (\`realm_id\`),
+                INDEX \`IDX_auth_events_expiring\` (\`expiring\`),
+                INDEX \`IDX_auth_events_expires_at\` (\`expires_at\`),
+                INDEX \`IDX_auth_events_created_at\` (\`created_at\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_user_authenticators\` (
+                \`id\` varchar(36) NOT NULL,
+                \`kind\` varchar(16) NOT NULL,
+                \`name\` varchar(128) NULL,
+                \`secret\` text NULL,
+                \`parameters\` text NULL,
+                \`codes\` text NULL,
+                \`confirmed\` tinyint NOT NULL DEFAULT 0,
+                \`last_used_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`user_id\` varchar(36) NOT NULL,
+                \`realm_id\` varchar(36) NOT NULL,
+                INDEX \`IDX_auth_user_authenticators_kind\` (\`kind\`),
+                INDEX \`IDX_auth_user_authenticators_user_id\` (\`user_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\`
+            ADD CONSTRAINT \`FK_auth_user_authenticators_user_id\` FOREIGN KEY (\`user_id\`) REFERENCES \`auth_users\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\`
+            ADD CONSTRAINT \`FK_auth_user_authenticators_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` ADD \`mfa_at\` varchar(28) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` ADD \`auth_method\` varchar(16) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`access_policy_id\` varchar(36) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\`
+            ADD CONSTRAINT \`FK_auth_clients_access_policy_id\` FOREIGN KEY (\`access_policy_id\`) REFERENCES \`auth_policies\`(\`id\`) ON DELETE SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_consents\` (
+                \`id\` varchar(36) NOT NULL,
+                \`sub\` varchar(64) NOT NULL,
+                \`sub_kind\` varchar(64) NOT NULL,
+                \`scope\` varchar(128) NOT NULL,
+                \`expires_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`client_id\` varchar(36) NOT NULL,
+                \`realm_id\` varchar(36) NOT NULL,
+                \`user_id\` varchar(36) NULL,
+                INDEX \`IDX_auth_consents_sub\` (\`sub\`),
+                INDEX \`IDX_auth_consents_client_id\` (\`client_id\`),
+                INDEX \`IDX_auth_consents_realm_id\` (\`realm_id\`),
+                INDEX \`IDX_auth_consents_user_id\` (\`user_id\`),
+                UNIQUE INDEX \`UQ_auth_consents_subject_scope\` (\`client_id\`, \`sub\`, \`sub_kind\`, \`scope\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_client_id\` FOREIGN KEY (\`client_id\`) REFERENCES \`auth_clients\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_user_id\` FOREIGN KEY (\`user_id\`) REFERENCES \`auth_users\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`use\` varchar(64) NOT NULL DEFAULT 'sig'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`name\` varchar(128) NULL
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_keys\` SET \`name\` = \`id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`name\` varchar(128) NOT NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\`
+            ADD UNIQUE INDEX \`UQ_auth_keys_name_realm_id\` (\`name\`, \`realm_id\`)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`status\` varchar(64) NOT NULL DEFAULT 'active'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`certificate\` text NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`decryption_key\` text NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`encryption_key\` text NULL
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_trust_anchors\` (
+                \`id\` varchar(36) NOT NULL,
+                \`name\` varchar(128) NOT NULL,
+                \`certificate\` text NOT NULL,
+                \`enabled\` tinyint NOT NULL DEFAULT 1,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`realm_id\` varchar(36) NOT NULL,
+                INDEX \`IDX_auth_trust_anchors_realm_id\` (\`realm_id\`),
+                UNIQUE INDEX \`UQ_auth_trust_anchors_name_realm_id\` (\`name\`, \`realm_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_trust_anchors\`
+            ADD CONSTRAINT \`FK_auth_trust_anchors_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`auth_method\` varchar(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_clients\` SET \`auth_method\` = 'secret' WHERE \`is_confidential\` = 1
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`token_binding_method\` varchar(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`is_confidential\`
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`is_confidential\` tinyint NOT NULL DEFAULT 0
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_clients\` SET \`is_confidential\` = 1 WHERE \`auth_method\` <> 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`token_binding_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`auth_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_trust_anchors\` DROP FOREIGN KEY \`FK_auth_trust_anchors_realm_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`UQ_auth_trust_anchors_name_realm_id\` ON \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_trust_anchors_realm_id\` ON \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`encryption_key\` varchar(4096) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`decryption_key\` varchar(4096) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`certificate\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`status\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP INDEX \`UQ_auth_keys_name_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`name\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`use\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_user_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_client_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`UQ_auth_consents_subject_scope\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_user_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_realm_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_client_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_sub\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP FOREIGN KEY \`FK_auth_clients_access_policy_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`access_policy_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`auth_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`mfa_at\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\` DROP FOREIGN KEY \`FK_auth_user_authenticators_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\` DROP FOREIGN KEY \`FK_auth_user_authenticators_user_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_user_authenticators_user_id\` ON \`auth_user_authenticators\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_user_authenticators_kind\` ON \`auth_user_authenticators\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_user_authenticators\`
+        `);
+		await queryRunner.query("DROP TABLE `auth_events`");
+	}
+};
+//#endregion
+export { Default1783769340000 };
+
+//# sourceMappingURL=1783769340000-Default.mjs.map

package/dist/adapters/database/migrations/mysql/1783769340000-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.mjs","names":["Default1783769340000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1783769340000-Default.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Security event log (plan 057), MFA — authenticator devices (plan 049) +\n * auth-method claims (plan 050), application access policy (plan 052) +\n * persisted consent (plan 055), realm key store (plans 069 + 071) and\n * RFC 8705 client authentication (plan 072).\n *\n * - Adds auth_events: append-only, PII-stripped security audit log. No FKs\n *   by design: a row must survive deletion of the realm/actor/client it\n *   references. Retention is per-row (`expires_at`, stamped at write from\n *   `eventLogRetentionDays`; NULL = keep forever) and swept by the\n *   event-cleaner component (plan 057).\n * - Adds auth_user_authenticators: polymorphic second-factor device rows\n *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed\n *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.\n *   FKs to auth_users / auth_realms (ON DELETE CASCADE).\n * - Adds auth_sessions.mfa_at: instant the subject last passed a\n *   second-factor challenge for the session (plan 049).\n * - Adds auth_sessions.auth_method: how the subject authenticated\n *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.\n * - Adds auth_clients.access_policy_id: nullable FK to auth_policies\n *   (ON DELETE SET NULL) — the policy that must pass for an identity to\n *   authorize against the client (null = default-allow; plan 052).\n * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)\n *   a subject has approved at POST /authorize. Union/keep (missing tokens\n *   only, never deleted on re-approval); built_in clients keep zero rows;\n *   expires_at is dormant (always null in Stage 1) but honored by the\n *   covering check. FKs to auth_clients / auth_realms and a nullable user_id\n *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;\n *   plan 055).\n * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —\n *   generalizes auth_keys into the per-realm key store. enc rows hold the\n *   realm's auto-generated symmetric at-rest encryption key (oct) that the\n *   MFA seed cipher rides; existing rows default to sig (plan 069).\n * - Adds auth_keys.name (canonical identifier, backfilled from id),\n *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant\n *   auth_keys.certificate (PEM chain, Stage B) — key management API\n *   (plan 071 Stage A).\n * - Adds auth_trust_anchors: realm-scoped public CA certificates used by\n *   RFC 8705 PKI client authentication (plan 071 Stage C).\n * - Replaces auth_clients.is_confidential with auth_method\n *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705\n *   client authentication and sender-constrained tokens (plan 072).\n */\nexport class Default1783769340000 implements MigrationInterface {\n    name = 'Default1783769340000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        // security event log (plan 057)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_events\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`scope\\` varchar(64) NOT NULL,\n                \\`name\\` varchar(64) NOT NULL,\n                \\`ref_type\\` varchar(64) NULL,\n                \\`ref_id\\` varchar(64) NULL,\n                \\`client_id\\` varchar(36) NULL,\n                \\`actor_type\\` varchar(16) NULL,\n                \\`actor_id\\` varchar(36) NULL,\n                \\`actor_name\\` varchar(128) NULL,\n                \\`request_path\\` varchar(256) NULL,\n                \\`request_method\\` varchar(10) NULL,\n                \\`request_ip_address\\` varchar(45) NULL,\n                \\`request_user_agent\\` varchar(512) NULL,\n                \\`realm_id\\` varchar(36) NULL,\n                \\`data\\` text NULL,\n                \\`expiring\\` tinyint NOT NULL DEFAULT 0,\n                \\`expires_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                INDEX \\`IDX_auth_events_name_scope\\` (\\`name\\`, \\`scope\\`),\n                INDEX \\`IDX_auth_events_ref_type_ref_id\\` (\\`ref_type\\`, \\`ref_id\\`),\n                INDEX \\`IDX_auth_events_client_id\\` (\\`client_id\\`),\n                INDEX \\`IDX_auth_events_actor_id\\` (\\`actor_id\\`),\n                INDEX \\`IDX_auth_events_actor_name\\` (\\`actor_name\\`),\n                INDEX \\`IDX_auth_events_request_ip_address\\` (\\`request_ip_address\\`),\n                INDEX \\`IDX_auth_events_realm_id\\` (\\`realm_id\\`),\n                INDEX \\`IDX_auth_events_expiring\\` (\\`expiring\\`),\n                INDEX \\`IDX_auth_events_expires_at\\` (\\`expires_at\\`),\n                INDEX \\`IDX_auth_events_created_at\\` (\\`created_at\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        // MFA authenticator devices (plan 049)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_user_authenticators\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`kind\\` varchar(16) NOT NULL,\n                \\`name\\` varchar(128) NULL,\n                \\`secret\\` text NULL,\n                \\`parameters\\` text NULL,\n                \\`codes\\` text NULL,\n                \\`confirmed\\` tinyint NOT NULL DEFAULT 0,\n                \\`last_used_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`user_id\\` varchar(36) NOT NULL,\n                \\`realm_id\\` varchar(36) NOT NULL,\n                INDEX \\`IDX_auth_user_authenticators_kind\\` (\\`kind\\`),\n                INDEX \\`IDX_auth_user_authenticators_user_id\\` (\\`user_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\`\n            ADD CONSTRAINT \\`FK_auth_user_authenticators_user_id\\` FOREIGN KEY (\\`user_id\\`) REFERENCES \\`auth_users\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\`\n            ADD CONSTRAINT \\`FK_auth_user_authenticators_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` ADD \\`mfa_at\\` varchar(28) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` ADD \\`auth_method\\` varchar(16) NULL\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`access_policy_id\\` varchar(36) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\`\n            ADD CONSTRAINT \\`FK_auth_clients_access_policy_id\\` FOREIGN KEY (\\`access_policy_id\\`) REFERENCES \\`auth_policies\\`(\\`id\\`) ON DELETE SET NULL ON UPDATE NO ACTION\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_consents\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`sub\\` varchar(64) NOT NULL,\n                \\`sub_kind\\` varchar(64) NOT NULL,\n                \\`scope\\` varchar(128) NOT NULL,\n                \\`expires_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`client_id\\` varchar(36) NOT NULL,\n                \\`realm_id\\` varchar(36) NOT NULL,\n                \\`user_id\\` varchar(36) NULL,\n                INDEX \\`IDX_auth_consents_sub\\` (\\`sub\\`),\n                INDEX \\`IDX_auth_consents_client_id\\` (\\`client_id\\`),\n                INDEX \\`IDX_auth_consents_realm_id\\` (\\`realm_id\\`),\n                INDEX \\`IDX_auth_consents_user_id\\` (\\`user_id\\`),\n                UNIQUE INDEX \\`UQ_auth_consents_subject_scope\\` (\\`client_id\\`, \\`sub\\`, \\`sub_kind\\`, \\`scope\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_client_id\\` FOREIGN KEY (\\`client_id\\`) REFERENCES \\`auth_clients\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_user_id\\` FOREIGN KEY (\\`user_id\\`) REFERENCES \\`auth_users\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`use\\` varchar(64) NOT NULL DEFAULT 'sig'\n        `);\n\n        // key management API (plan 071 Stage A)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`name\\` varchar(128) NULL\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_keys\\` SET \\`name\\` = \\`id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`name\\` varchar(128) NOT NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\`\n            ADD UNIQUE INDEX \\`UQ_auth_keys_name_realm_id\\` (\\`name\\`, \\`realm_id\\`)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`status\\` varchar(64) NOT NULL DEFAULT 'active'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`certificate\\` text NULL\n        `);\n        // Widen the key-material columns: an imported RSA-4096 private key\n        // wrapped under a SECRETS_ENCRYPTION_KEY exceeds varchar(4096).\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`decryption_key\\` text NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`encryption_key\\` text NULL\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_trust_anchors\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`name\\` varchar(128) NOT NULL,\n                \\`certificate\\` text NOT NULL,\n                \\`enabled\\` tinyint NOT NULL DEFAULT 1,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`realm_id\\` varchar(36) NOT NULL,\n                INDEX \\`IDX_auth_trust_anchors_realm_id\\` (\\`realm_id\\`),\n                UNIQUE INDEX \\`UQ_auth_trust_anchors_name_realm_id\\` (\\`name\\`, \\`realm_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_trust_anchors\\`\n            ADD CONSTRAINT \\`FK_auth_trust_anchors_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`auth_method\\` varchar(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_clients\\` SET \\`auth_method\\` = 'secret' WHERE \\`is_confidential\\` = 1\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`token_binding_method\\` varchar(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`is_confidential\\`\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`is_confidential\\` tinyint NOT NULL DEFAULT 0\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_clients\\` SET \\`is_confidential\\` = 1 WHERE \\`auth_method\\` <> 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`token_binding_method\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`auth_method\\`\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_trust_anchors\\` DROP FOREIGN KEY \\`FK_auth_trust_anchors_realm_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`UQ_auth_trust_anchors_name_realm_id\\` ON \\`auth_trust_anchors\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_trust_anchors_realm_id\\` ON \\`auth_trust_anchors\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_trust_anchors\\`\n        `);\n\n        // key management API (plan 071 Stage A) — reverse last-in-first-out\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`encryption_key\\` varchar(4096) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`decryption_key\\` varchar(4096) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`certificate\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`status\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP INDEX \\`UQ_auth_keys_name_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`name\\`\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`use\\`\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_user_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_client_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`UQ_auth_consents_subject_scope\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_user_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_realm_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_client_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_sub\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_consents\\`\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP FOREIGN KEY \\`FK_auth_clients_access_policy_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`access_policy_id\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`auth_method\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`mfa_at\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\` DROP FOREIGN KEY \\`FK_auth_user_authenticators_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\` DROP FOREIGN KEY \\`FK_auth_user_authenticators_user_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_user_authenticators_user_id\\` ON \\`auth_user_authenticators\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_user_authenticators_kind\\` ON \\`auth_user_authenticators\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_user_authenticators\\`\n        `);\n\n        // security event log (plan 057)\n        await queryRunner.query('DROP TABLE `auth_events`');\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EAErD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAgCvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;SAkBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;SAmBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;SAavB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EAEvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM,0BAAA;CAC5B;AACJ"}