@bajustone/fortress 1.0.0-rc.1

package/dist/drizzle/pg.cjs

@@ -0,0 +1,481 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/drizzle/pg/index.ts
+var pg_exports = {};
+__export(pg_exports, {
+  fortressPgSchema: () => fortressPgSchema
+});
+module.exports = __toCommonJS(pg_exports);
+
+// src/drizzle/pg/schema.ts
+var import_drizzle_orm = require("drizzle-orm");
+var import_pg_core = require("drizzle-orm/pg-core");
+var schemaVersion = (0, import_pg_core.pgTable)("fortress_schema_version", {
+  id: (0, import_pg_core.integer)("id").primaryKey().default(1),
+  version: (0, import_pg_core.integer)("version").notNull(),
+  appliedAt: (0, import_pg_core.timestamp)("applied_at", { withTimezone: true }).notNull().defaultNow()
+});
+var users = (0, import_pg_core.pgTable)("fortress_user", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }).notNull().unique(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  passwordHash: (0, import_pg_core.text)("password_hash"),
+  isActive: (0, import_pg_core.boolean)("is_active").notNull().default(true),
+  emailVerified: (0, import_pg_core.boolean)("email_verified").notNull().default(false),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.uniqueIndex)("user_email_ci_unique").on(import_drizzle_orm.sql`lower(${table.email})`)
+]);
+var loginIdentifiers = (0, import_pg_core.pgTable)("fortress_login_identifier", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  type: (0, import_pg_core.varchar)("type", { length: 20 }).notNull(),
+  // 'email' | 'phone' | 'username'
+  value: (0, import_pg_core.varchar)("value", { length: 255 }).notNull().unique()
+}, (table) => [
+  (0, import_pg_core.uniqueIndex)("login_identifier_email_ci_unique").on(import_drizzle_orm.sql`lower(${table.value})`).where(import_drizzle_orm.sql`${table.type} = 'email'`)
+]);
+var refreshTokens = (0, import_pg_core.pgTable)("fortress_refresh_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: (0, import_pg_core.varchar)("token_hash", { length: 64 }).notNull().unique(),
+  tokenFamily: (0, import_pg_core.varchar)("token_family", { length: 64 }).notNull(),
+  familyCreatedAt: (0, import_pg_core.timestamp)("family_created_at", { withTimezone: true }).notNull().defaultNow(),
+  successorTokenHash: (0, import_pg_core.varchar)("successor_token_hash", { length: 64 }),
+  rotatedAt: (0, import_pg_core.timestamp)("rotated_at", { withTimezone: true }),
+  isRevoked: (0, import_pg_core.boolean)("is_revoked").notNull().default(false),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: (0, import_pg_core.varchar)("ip_address", { length: 45 }),
+  userAgent: (0, import_pg_core.text)("user_agent"),
+  deviceName: (0, import_pg_core.text)("device_name"),
+  lastActiveAt: (0, import_pg_core.timestamp)("last_active_at", { withTimezone: true }),
+  fingerprintHash: (0, import_pg_core.varchar)("fingerprint_hash", { length: 64 }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.index)("refresh_token_family_idx").on(table.tokenFamily),
+  (0, import_pg_core.index)("refresh_token_user_idx").on(table.userId)
+]);
+var authContinuations = (0, import_pg_core.pgTable)("fortress_auth_continuation", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: (0, import_pg_core.varchar)("token_hash", { length: 64 }).notNull().unique(),
+  reason: (0, import_pg_core.varchar)("reason", { length: 32 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  consumedAt: (0, import_pg_core.timestamp)("consumed_at", { withTimezone: true }),
+  failedAttempts: (0, import_pg_core.integer)("failed_attempts").notNull().default(0),
+  lastFailedAt: (0, import_pg_core.timestamp)("last_failed_at", { withTimezone: true }),
+  invalidatedAt: (0, import_pg_core.timestamp)("invalidated_at", { withTimezone: true }),
+  maxAttempts: (0, import_pg_core.integer)("max_attempts").notNull().default(5),
+  cooldownSeconds: (0, import_pg_core.integer)("cooldown_seconds").notNull().default(1),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.index)("auth_continuation_failure_idx").on(table.userId, table.reason, table.lastFailedAt)
+]);
+var groups = (0, import_pg_core.pgTable)("fortress_group", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).notNull().unique(),
+  description: (0, import_pg_core.text)("description")
+});
+var groupUsers = (0, import_pg_core.pgTable)(
+  "fortress_group_user",
+  {
+    groupId: (0, import_pg_core.integer)("group_id").notNull().references(() => groups.id, { onDelete: "cascade" }),
+    userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" })
+  },
+  (table) => [(0, import_pg_core.primaryKey)({ columns: [table.groupId, table.userId] })]
+);
+var serviceAccounts = (0, import_pg_core.pgTable)("fortress_service_account", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).notNull().unique(),
+  displayName: (0, import_pg_core.varchar)("display_name", { length: 255 }),
+  description: (0, import_pg_core.text)("description"),
+  isActive: (0, import_pg_core.boolean)("is_active").notNull().default(true),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var resources = (0, import_pg_core.pgTable)("fortress_resource", {
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).primaryKey(),
+  description: (0, import_pg_core.text)("description")
+});
+var permissions = (0, import_pg_core.pgTable)("fortress_permission", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  resource: (0, import_pg_core.varchar)("resource", { length: 100 }).notNull().references(() => resources.name, { onDelete: "cascade" }),
+  action: (0, import_pg_core.varchar)("action", { length: 100 }).notNull(),
+  effect: (0, import_pg_core.varchar)("effect", { length: 10 }).notNull().default("ALLOW"),
+  // 'ALLOW' | 'DENY'
+  conditions: (0, import_pg_core.jsonb)("conditions"),
+  // PermissionCondition[] as JSONB
+  description: (0, import_pg_core.text)("description")
+}, (table) => [
+  // M8 fix — same split-index pattern as role/direct-permission bindings
+  // so concurrent findOrCreatePermission can't insert duplicate rows when
+  // conditions is NULL (a plain UNIQUE treats NULLs as distinct).
+  (0, import_pg_core.uniqueIndex)("uniq_permission_no_conditions").on(table.resource, table.action, table.effect).where(import_drizzle_orm.sql`${table.conditions} is null`),
+  (0, import_pg_core.uniqueIndex)("uniq_permission_with_conditions").on(table.resource, table.action, table.effect, table.conditions).where(import_drizzle_orm.sql`${table.conditions} is not null`)
+]);
+var roles = (0, import_pg_core.pgTable)("fortress_role", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).notNull().unique(),
+  description: (0, import_pg_core.text)("description"),
+  isSystem: (0, import_pg_core.boolean)("is_system").notNull().default(false)
+});
+var rolePermissions = (0, import_pg_core.pgTable)(
+  "fortress_role_permission",
+  {
+    roleId: (0, import_pg_core.integer)("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+    permissionId: (0, import_pg_core.integer)("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" })
+  },
+  (table) => [(0, import_pg_core.primaryKey)({ columns: [table.roleId, table.permissionId] })]
+);
+var roleBindings = (0, import_pg_core.pgTable)("fortress_role_binding", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  roleId: (0, import_pg_core.integer)("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+  subjectType: (0, import_pg_core.varchar)("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: (0, import_pg_core.integer)("subject_id").notNull(),
+  tenantId: (0, import_pg_core.varchar)("tenant_id", { length: 100 })
+}, (table) => [
+  (0, import_pg_core.unique)().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  (0, import_pg_core.uniqueIndex)("uniq_role_binding_global").on(table.roleId, table.subjectType, table.subjectId).where(import_drizzle_orm.sql`${table.tenantId} is null`),
+  (0, import_pg_core.uniqueIndex)("uniq_role_binding_tenant").on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(import_drizzle_orm.sql`${table.tenantId} is not null`),
+  (0, import_pg_core.index)("role_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var directPermissionBindings = (0, import_pg_core.pgTable)("fortress_direct_permission_binding", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  permissionId: (0, import_pg_core.integer)("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" }),
+  subjectType: (0, import_pg_core.varchar)("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: (0, import_pg_core.integer)("subject_id").notNull(),
+  tenantId: (0, import_pg_core.varchar)("tenant_id", { length: 100 })
+}, (table) => [
+  (0, import_pg_core.unique)().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  (0, import_pg_core.uniqueIndex)("uniq_direct_permission_binding_global").on(table.permissionId, table.subjectType, table.subjectId).where(import_drizzle_orm.sql`${table.tenantId} is null`),
+  (0, import_pg_core.uniqueIndex)("uniq_direct_permission_binding_tenant").on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(import_drizzle_orm.sql`${table.tenantId} is not null`),
+  (0, import_pg_core.index)("direct_permission_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var emailVerificationTokens = (0, import_pg_core.pgTable)("fortress_email_verification_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  token: (0, import_pg_core.text)("token").notNull(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("email_verification_token_token_idx").on(table.token)]);
+var magicLinkTokens = (0, import_pg_core.pgTable)("fortress_magic_link_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }).notNull(),
+  token: (0, import_pg_core.varchar)("token", { length: 64 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("magic_link_token_token_idx").on(table.token)]);
+var apiKeys = (0, import_pg_core.pgTable)("fortress_api_key", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  subjectType: (0, import_pg_core.varchar)("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: (0, import_pg_core.integer)("subject_id").notNull(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  keyHash: (0, import_pg_core.varchar)("key_hash", { length: 64 }).notNull().unique(),
+  keyPrefix: (0, import_pg_core.varchar)("key_prefix", { length: 20 }).notNull(),
+  scopes: (0, import_pg_core.text)("scopes"),
+  // JSON array of "resource:action" strings
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }),
+  lastUsedAt: (0, import_pg_core.timestamp)("last_used_at", { withTimezone: true }),
+  isRevoked: (0, import_pg_core.boolean)("is_revoked").notNull().default(false),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("api_key_subject_idx").on(table.subjectType, table.subjectId)]);
+var twoFactorSecrets = (0, import_pg_core.pgTable)("fortress_two_factor_secret", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().unique().references(() => users.id, { onDelete: "cascade" }),
+  secret: (0, import_pg_core.text)("secret").notNull(),
+  // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: (0, import_pg_core.boolean)("is_enabled").notNull().default(false),
+  lastUsedCounter: (0, import_pg_core.integer)("last_used_counter"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var backupCodes = (0, import_pg_core.pgTable)("fortress_backup_code", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  codeHash: (0, import_pg_core.text)("code_hash").notNull(),
+  isUsed: (0, import_pg_core.boolean)("is_used").notNull().default(false),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("backup_code_user_idx").on(table.userId)]);
+var trustedDevices = (0, import_pg_core.pgTable)("fortress_trusted_device", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: (0, import_pg_core.varchar)("device_hash", { length: 64 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  lastUsedAt: (0, import_pg_core.timestamp)("last_used_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("trusted_device_user_idx").on(table.userId)]);
+var socialAccounts = (0, import_pg_core.pgTable)("fortress_social_account", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  provider: (0, import_pg_core.varchar)("provider", { length: 50 }).notNull(),
+  providerAccountId: (0, import_pg_core.varchar)("provider_account_id", { length: 255 }).notNull(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }),
+  accessToken: (0, import_pg_core.text)("access_token"),
+  // Encrypted
+  refreshToken: (0, import_pg_core.text)("refresh_token"),
+  // Encrypted
+  tokenExpiresAt: (0, import_pg_core.timestamp)("token_expires_at", { withTimezone: true }),
+  profile: (0, import_pg_core.jsonb)("profile"),
+  // JSON
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.unique)().on(table.userId, table.provider),
+  (0, import_pg_core.unique)().on(table.provider, table.providerAccountId)
+]);
+var tenants = (0, import_pg_core.pgTable)("fortress_tenant", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  taxId: (0, import_pg_core.varchar)("tax_id", { length: 100 }).notNull().unique(),
+  description: (0, import_pg_core.text)("description"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var tenantUsers = (0, import_pg_core.pgTable)(
+  "fortress_tenant_user",
+  {
+    tenantId: (0, import_pg_core.integer)("tenant_id").notNull().references(() => tenants.id, { onDelete: "cascade" }),
+    userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    isDefault: (0, import_pg_core.boolean)("is_default").notNull().default(false)
+  },
+  (table) => [
+    (0, import_pg_core.primaryKey)({ columns: [table.tenantId, table.userId] }),
+    (0, import_pg_core.uniqueIndex)("fortress_tenant_user_one_default_idx").on(table.userId).where(import_drizzle_orm.sql`${table.isDefault} = true`)
+  ]
+);
+var oauthClients = (0, import_pg_core.pgTable)("fortress_oauth_client", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull().unique(),
+  clientSecretHash: (0, import_pg_core.text)("client_secret_hash").notNull(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  redirectUris: (0, import_pg_core.text)("redirect_uris").notNull(),
+  // JSON array
+  grantTypes: (0, import_pg_core.text)("grant_types").notNull(),
+  // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: (0, import_pg_core.text)("allowed_scopes"),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: (0, import_pg_core.text)("token_endpoint_auth_method"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAuthorizationCodes = (0, import_pg_core.pgTable)("fortress_oauth_authorization_code", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  code: (0, import_pg_core.varchar)("code", { length: 255 }).notNull().unique(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  userId: (0, import_pg_core.integer)("user_id").notNull(),
+  redirectUri: (0, import_pg_core.text)("redirect_uri").notNull(),
+  scope: (0, import_pg_core.text)("scope"),
+  codeChallenge: (0, import_pg_core.text)("code_challenge"),
+  codeChallengeMethod: (0, import_pg_core.varchar)("code_challenge_method", { length: 10 }),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: (0, import_pg_core.text)("nonce"),
+  authTime: (0, import_pg_core.integer)("auth_time"),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAccessTokens = (0, import_pg_core.pgTable)("fortress_oauth_access_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  token: (0, import_pg_core.varchar)("token", { length: 255 }).notNull().unique(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  userId: (0, import_pg_core.integer)("user_id"),
+  scope: (0, import_pg_core.text)("scope"),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthRefreshTokens = (0, import_pg_core.pgTable)("fortress_oauth_refresh_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  token: (0, import_pg_core.varchar)("token", { length: 255 }).notNull().unique(),
+  familyId: (0, import_pg_core.varchar)("family_id", { length: 64 }).notNull(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  userId: (0, import_pg_core.integer)("user_id").notNull(),
+  scope: (0, import_pg_core.text)("scope"),
+  issuedAt: (0, import_pg_core.timestamp)("issued_at", { withTimezone: true }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  parentId: (0, import_pg_core.integer)("parent_id"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthPendingFlows = (0, import_pg_core.pgTable)("fortress_oauth_pending_flow", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  flowId: (0, import_pg_core.text)("flow_id").notNull().unique(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  redirectUri: (0, import_pg_core.text)("redirect_uri").notNull(),
+  scope: (0, import_pg_core.text)("scope"),
+  state: (0, import_pg_core.varchar)("state", { length: 255 }).notNull(),
+  codeChallenge: (0, import_pg_core.text)("code_challenge"),
+  codeChallengeMethod: (0, import_pg_core.varchar)("code_challenge_method", { length: 10 }),
+  nonce: (0, import_pg_core.text)("nonce"),
+  // H6 fix: subject the flow is bound to (TOFU-claimed on first
+  // authenticated touch).
+  userId: (0, import_pg_core.integer)("user_id"),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthSigningKeys = (0, import_pg_core.pgTable)("fortress_oauth_signing_key", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  kid: (0, import_pg_core.varchar)("kid", { length: 64 }).notNull().unique(),
+  alg: (0, import_pg_core.varchar)("alg", { length: 16 }).notNull(),
+  publicJwk: (0, import_pg_core.text)("public_jwk").notNull(),
+  privateJwk: (0, import_pg_core.text)("private_jwk").notNull(),
+  rotatedAt: (0, import_pg_core.timestamp)("rotated_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var userScopeAssignments = (0, import_pg_core.pgTable)("fortress_user_scope_assignment", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  scopeName: (0, import_pg_core.varchar)("scope_name", { length: 100 }).notNull(),
+  scopeValue: (0, import_pg_core.varchar)("scope_value", { length: 255 }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var accountLockouts = (0, import_pg_core.pgTable)("fortress_account_lockout", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  identifier: (0, import_pg_core.varchar)("identifier", { length: 255 }).notNull().unique(),
+  failedAttempts: (0, import_pg_core.integer)("failed_attempts").notNull().default(0),
+  lastFailedAt: (0, import_pg_core.timestamp)("last_failed_at", { withTimezone: true }),
+  lockedUntil: (0, import_pg_core.timestamp)("locked_until", { withTimezone: true }),
+  lockoutCount: (0, import_pg_core.integer)("lockout_count").notNull().default(0),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var auditLogs = (0, import_pg_core.pgTable)("fortress_audit_log", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  timestamp: (0, import_pg_core.timestamp)("timestamp", { withTimezone: true }).notNull().defaultNow(),
+  eventType: (0, import_pg_core.varchar)("event_type", { length: 100 }).notNull(),
+  actorId: (0, import_pg_core.integer)("actor_id"),
+  actorType: (0, import_pg_core.varchar)("actor_type", { length: 20 }).notNull().default("USER"),
+  targetId: (0, import_pg_core.integer)("target_id"),
+  targetType: (0, import_pg_core.varchar)("target_type", { length: 50 }),
+  ipAddress: (0, import_pg_core.varchar)("ip_address", { length: 45 }),
+  userAgent: (0, import_pg_core.text)("user_agent"),
+  outcome: (0, import_pg_core.varchar)("outcome", { length: 20 }).notNull().default("SUCCESS"),
+  metadata: (0, import_pg_core.jsonb)("metadata"),
+  previousHash: (0, import_pg_core.text)("previous_hash"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("audit_log_timestamp_idx").on(table.timestamp)]);
+var auditChainState = (0, import_pg_core.pgTable)("fortress_audit_chain_state", {
+  id: (0, import_pg_core.integer)("id").primaryKey(),
+  lastHash: (0, import_pg_core.varchar)("last_hash", { length: 64 }),
+  entryCount: (0, import_pg_core.integer)("entry_count").notNull(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookEndpoints = (0, import_pg_core.pgTable)("fortress_webhook_endpoint", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  url: (0, import_pg_core.text)("url").notNull(),
+  events: (0, import_pg_core.text)("events").notNull(),
+  // JSON array
+  secret: (0, import_pg_core.text)("secret").notNull(),
+  isActive: (0, import_pg_core.boolean)("is_active").notNull().default(true),
+  deactivatedReason: (0, import_pg_core.text)("deactivated_reason"),
+  consecutiveFailures: (0, import_pg_core.integer)("consecutive_failures").notNull().default(0),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookDeliveries = (0, import_pg_core.pgTable)("fortress_webhook_delivery", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  endpointId: (0, import_pg_core.integer)("endpoint_id").notNull().references(() => webhookEndpoints.id, { onDelete: "cascade" }),
+  eventType: (0, import_pg_core.varchar)("event_type", { length: 100 }).notNull(),
+  payload: (0, import_pg_core.text)("payload").notNull(),
+  // JSON
+  status: (0, import_pg_core.varchar)("status", { length: 20 }).notNull().default("pending"),
+  // pending | success | failed
+  attempts: (0, import_pg_core.integer)("attempts").notNull().default(0),
+  idempotencyKey: (0, import_pg_core.text)("idempotency_key"),
+  lastAttemptAt: (0, import_pg_core.timestamp)("last_attempt_at", { withTimezone: true }),
+  nextRetryAt: (0, import_pg_core.timestamp)("next_retry_at", { withTimezone: true }),
+  responseStatus: (0, import_pg_core.integer)("response_status"),
+  responseBody: (0, import_pg_core.text)("response_body"),
+  errorKind: (0, import_pg_core.text)("error_kind"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.uniqueIndex)("uniq_webhook_delivery_idempotency").on(table.endpointId, table.idempotencyKey).where(import_drizzle_orm.sql`${table.idempotencyKey} is not null`),
+  (0, import_pg_core.index)("webhook_delivery_retry_idx").on(table.status, table.nextRetryAt)
+]);
+var webauthnCredentials = (0, import_pg_core.pgTable)("fortress_webauthn_credential", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  credentialId: (0, import_pg_core.text)("credential_id").notNull().unique(),
+  publicKey: (0, import_pg_core.text)("public_key").notNull(),
+  counter: (0, import_pg_core.integer)("counter").notNull().default(0),
+  deviceType: (0, import_pg_core.varchar)("device_type", { length: 20 }).notNull(),
+  backedUp: (0, import_pg_core.boolean)("backed_up").notNull().default(false),
+  transports: (0, import_pg_core.text)("transports"),
+  // JSON array
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webauthnChallenges = (0, import_pg_core.pgTable)("fortress_webauthn_challenge", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  challenge: (0, import_pg_core.text)("challenge").notNull().unique(),
+  userId: (0, import_pg_core.integer)("user_id"),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var fortressPgSchema = {
+  schemaVersion,
+  users,
+  loginIdentifiers,
+  refreshTokens,
+  authContinuations,
+  groups,
+  groupUsers,
+  serviceAccounts,
+  resources,
+  permissions,
+  roles,
+  rolePermissions,
+  roleBindings,
+  directPermissionBindings,
+  emailVerificationTokens,
+  magicLinkTokens,
+  apiKeys,
+  twoFactorSecrets,
+  backupCodes,
+  trustedDevices,
+  socialAccounts,
+  tenants,
+  tenantUsers,
+  oauthClients,
+  oauthAuthorizationCodes,
+  oauthAccessTokens,
+  oauthRefreshTokens,
+  oauthPendingFlows,
+  oauthSigningKeys,
+  userScopeAssignments,
+  accountLockouts,
+  auditLogs,
+  auditChainState,
+  webhookEndpoints,
+  webhookDeliveries,
+  webauthnCredentials,
+  webauthnChallenges
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  fortressPgSchema
+});

package/dist/drizzle/pg.d.cts

@@ -0,0 +1,15 @@
+import { AnyPgTable } from 'drizzle-orm/pg-core';
+
+/**
+ * Aggregate of every Drizzle PostgreSQL table fortress uses.
+ *
+ * Typed as `Record<string, AnyPgTable>` so JSR can statically resolve
+ * the public API without recursing through Drizzle's complex generic
+ * column types. The fortress drizzle adapter accesses tables generically,
+ * so column-level inference is not needed internally. Consumers who need
+ * column-level types should declare their own typed Drizzle schema and
+ * pass it via `createDrizzleAdapter(db, { tables })`.
+ */
+declare const fortressPgSchema: Record<string, AnyPgTable>;
+
+export { fortressPgSchema };

package/dist/drizzle/pg.d.ts

@@ -0,0 +1,15 @@
+import { AnyPgTable } from 'drizzle-orm/pg-core';
+
+/**
+ * Aggregate of every Drizzle PostgreSQL table fortress uses.
+ *
+ * Typed as `Record<string, AnyPgTable>` so JSR can statically resolve
+ * the public API without recursing through Drizzle's complex generic
+ * column types. The fortress drizzle adapter accesses tables generically,
+ * so column-level inference is not needed internally. Consumers who need
+ * column-level types should declare their own typed Drizzle schema and
+ * pass it via `createDrizzleAdapter(db, { tables })`.
+ */
+declare const fortressPgSchema: Record<string, AnyPgTable>;
+
+export { fortressPgSchema };