@bajustone/fortress 1.0.0-rc.1

package/dist/drizzle.cjs

@@ -0,0 +1,1442 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/drizzle/index.ts
+var drizzle_exports = {};
+__export(drizzle_exports, {
+  createDrizzleAdapter: () => createDrizzleAdapter,
+  findSqlstate: () => findSqlstate,
+  fortressPgSchema: () => fortressPgSchema,
+  fortressSchema: () => fortressSchema,
+  rethrowDbError: () => rethrowDbError
+});
+module.exports = __toCommonJS(drizzle_exports);
+
+// src/drizzle/adapter.ts
+var import_node_async_hooks = require("async_hooks");
+var import_drizzle_orm3 = require("drizzle-orm");
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/drizzle/pg-error-map.ts
+var MAX_CAUSE_DEPTH = 6;
+var SQLSTATE_PATTERN = /^[0-9A-Z]{5}$/;
+var PG_SQLSTATE_MAP = {
+  "23505": (cause) => Errors.conflict("Resource already exists", { cause }),
+  "23503": (cause) => Errors.unprocessable("Referenced resource does not exist", { cause }),
+  "23502": (_cause) => Errors.badRequest("Required field is missing"),
+  "23514": (cause) => Errors.unprocessable("Constraint check failed", { cause }),
+  "40001": (cause) => Errors.conflict("Serialization failure, retry the request", { cause }),
+  "40P01": (cause) => Errors.conflict("Deadlock detected, retry the request", { cause }),
+  "57014": (cause) => Errors.serviceUnavailable("Query canceled", { cause })
+};
+var SQLITE_CONSTRAINT_MAP = [
+  {
+    match: /SQLITE_CONSTRAINT_(?:UNIQUE|PRIMARYKEY)|UNIQUE constraint failed/i,
+    factory: (cause) => Errors.conflict("Resource already exists", { cause })
+  },
+  {
+    match: /SQLITE_CONSTRAINT_FOREIGNKEY|FOREIGN KEY constraint failed/i,
+    factory: (cause) => Errors.unprocessable("Referenced resource does not exist", { cause })
+  },
+  {
+    match: /SQLITE_CONSTRAINT_NOTNULL|NOT NULL constraint failed/i,
+    factory: (_cause) => Errors.badRequest("Required field is missing")
+  }
+];
+function mapSqliteConstraint(err) {
+  let current = err;
+  for (let i = 0; i < MAX_CAUSE_DEPTH; i++) {
+    if (current === null || typeof current !== "object")
+      return null;
+    const coded = current;
+    const code = typeof coded.code === "string" ? coded.code : "";
+    const message = typeof coded.message === "string" ? coded.message : "";
+    const haystack = `${code} ${message}`;
+    for (const { match, factory } of SQLITE_CONSTRAINT_MAP) {
+      if (match.test(haystack))
+        return factory(err);
+    }
+    current = coded.cause;
+  }
+  return null;
+}
+function findSqlstate(err) {
+  let current = err;
+  for (let i = 0; i < MAX_CAUSE_DEPTH; i++) {
+    if (current === null || typeof current !== "object")
+      return null;
+    const candidate = current.code;
+    if (typeof candidate === "string" && SQLSTATE_PATTERN.test(candidate))
+      return candidate;
+    current = current.cause;
+  }
+  return null;
+}
+function rethrowDbError(err, dialect) {
+  if (dialect === "pg") {
+    const sqlstate = findSqlstate(err);
+    const factory = sqlstate ? PG_SQLSTATE_MAP[sqlstate] : void 0;
+    if (factory)
+      throw factory(err);
+    throw err;
+  }
+  if (dialect === "sqlite") {
+    const mapped = mapSqliteConstraint(err);
+    if (mapped)
+      throw mapped;
+    throw err;
+  }
+  throw err;
+}
+
+// src/drizzle/pg/schema.ts
+var import_drizzle_orm = require("drizzle-orm");
+var import_pg_core = require("drizzle-orm/pg-core");
+var schemaVersion = (0, import_pg_core.pgTable)("fortress_schema_version", {
+  id: (0, import_pg_core.integer)("id").primaryKey().default(1),
+  version: (0, import_pg_core.integer)("version").notNull(),
+  appliedAt: (0, import_pg_core.timestamp)("applied_at", { withTimezone: true }).notNull().defaultNow()
+});
+var users = (0, import_pg_core.pgTable)("fortress_user", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }).notNull().unique(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  passwordHash: (0, import_pg_core.text)("password_hash"),
+  isActive: (0, import_pg_core.boolean)("is_active").notNull().default(true),
+  emailVerified: (0, import_pg_core.boolean)("email_verified").notNull().default(false),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.uniqueIndex)("user_email_ci_unique").on(import_drizzle_orm.sql`lower(${table.email})`)
+]);
+var loginIdentifiers = (0, import_pg_core.pgTable)("fortress_login_identifier", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  type: (0, import_pg_core.varchar)("type", { length: 20 }).notNull(),
+  // 'email' | 'phone' | 'username'
+  value: (0, import_pg_core.varchar)("value", { length: 255 }).notNull().unique()
+}, (table) => [
+  (0, import_pg_core.uniqueIndex)("login_identifier_email_ci_unique").on(import_drizzle_orm.sql`lower(${table.value})`).where(import_drizzle_orm.sql`${table.type} = 'email'`)
+]);
+var refreshTokens = (0, import_pg_core.pgTable)("fortress_refresh_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: (0, import_pg_core.varchar)("token_hash", { length: 64 }).notNull().unique(),
+  tokenFamily: (0, import_pg_core.varchar)("token_family", { length: 64 }).notNull(),
+  familyCreatedAt: (0, import_pg_core.timestamp)("family_created_at", { withTimezone: true }).notNull().defaultNow(),
+  successorTokenHash: (0, import_pg_core.varchar)("successor_token_hash", { length: 64 }),
+  rotatedAt: (0, import_pg_core.timestamp)("rotated_at", { withTimezone: true }),
+  isRevoked: (0, import_pg_core.boolean)("is_revoked").notNull().default(false),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: (0, import_pg_core.varchar)("ip_address", { length: 45 }),
+  userAgent: (0, import_pg_core.text)("user_agent"),
+  deviceName: (0, import_pg_core.text)("device_name"),
+  lastActiveAt: (0, import_pg_core.timestamp)("last_active_at", { withTimezone: true }),
+  fingerprintHash: (0, import_pg_core.varchar)("fingerprint_hash", { length: 64 }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.index)("refresh_token_family_idx").on(table.tokenFamily),
+  (0, import_pg_core.index)("refresh_token_user_idx").on(table.userId)
+]);
+var authContinuations = (0, import_pg_core.pgTable)("fortress_auth_continuation", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: (0, import_pg_core.varchar)("token_hash", { length: 64 }).notNull().unique(),
+  reason: (0, import_pg_core.varchar)("reason", { length: 32 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  consumedAt: (0, import_pg_core.timestamp)("consumed_at", { withTimezone: true }),
+  failedAttempts: (0, import_pg_core.integer)("failed_attempts").notNull().default(0),
+  lastFailedAt: (0, import_pg_core.timestamp)("last_failed_at", { withTimezone: true }),
+  invalidatedAt: (0, import_pg_core.timestamp)("invalidated_at", { withTimezone: true }),
+  maxAttempts: (0, import_pg_core.integer)("max_attempts").notNull().default(5),
+  cooldownSeconds: (0, import_pg_core.integer)("cooldown_seconds").notNull().default(1),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.index)("auth_continuation_failure_idx").on(table.userId, table.reason, table.lastFailedAt)
+]);
+var groups = (0, import_pg_core.pgTable)("fortress_group", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).notNull().unique(),
+  description: (0, import_pg_core.text)("description")
+});
+var groupUsers = (0, import_pg_core.pgTable)(
+  "fortress_group_user",
+  {
+    groupId: (0, import_pg_core.integer)("group_id").notNull().references(() => groups.id, { onDelete: "cascade" }),
+    userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" })
+  },
+  (table) => [(0, import_pg_core.primaryKey)({ columns: [table.groupId, table.userId] })]
+);
+var serviceAccounts = (0, import_pg_core.pgTable)("fortress_service_account", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).notNull().unique(),
+  displayName: (0, import_pg_core.varchar)("display_name", { length: 255 }),
+  description: (0, import_pg_core.text)("description"),
+  isActive: (0, import_pg_core.boolean)("is_active").notNull().default(true),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var resources = (0, import_pg_core.pgTable)("fortress_resource", {
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).primaryKey(),
+  description: (0, import_pg_core.text)("description")
+});
+var permissions = (0, import_pg_core.pgTable)("fortress_permission", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  resource: (0, import_pg_core.varchar)("resource", { length: 100 }).notNull().references(() => resources.name, { onDelete: "cascade" }),
+  action: (0, import_pg_core.varchar)("action", { length: 100 }).notNull(),
+  effect: (0, import_pg_core.varchar)("effect", { length: 10 }).notNull().default("ALLOW"),
+  // 'ALLOW' | 'DENY'
+  conditions: (0, import_pg_core.jsonb)("conditions"),
+  // PermissionCondition[] as JSONB
+  description: (0, import_pg_core.text)("description")
+}, (table) => [
+  // M8 fix — same split-index pattern as role/direct-permission bindings
+  // so concurrent findOrCreatePermission can't insert duplicate rows when
+  // conditions is NULL (a plain UNIQUE treats NULLs as distinct).
+  (0, import_pg_core.uniqueIndex)("uniq_permission_no_conditions").on(table.resource, table.action, table.effect).where(import_drizzle_orm.sql`${table.conditions} is null`),
+  (0, import_pg_core.uniqueIndex)("uniq_permission_with_conditions").on(table.resource, table.action, table.effect, table.conditions).where(import_drizzle_orm.sql`${table.conditions} is not null`)
+]);
+var roles = (0, import_pg_core.pgTable)("fortress_role", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 100 }).notNull().unique(),
+  description: (0, import_pg_core.text)("description"),
+  isSystem: (0, import_pg_core.boolean)("is_system").notNull().default(false)
+});
+var rolePermissions = (0, import_pg_core.pgTable)(
+  "fortress_role_permission",
+  {
+    roleId: (0, import_pg_core.integer)("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+    permissionId: (0, import_pg_core.integer)("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" })
+  },
+  (table) => [(0, import_pg_core.primaryKey)({ columns: [table.roleId, table.permissionId] })]
+);
+var roleBindings = (0, import_pg_core.pgTable)("fortress_role_binding", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  roleId: (0, import_pg_core.integer)("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+  subjectType: (0, import_pg_core.varchar)("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: (0, import_pg_core.integer)("subject_id").notNull(),
+  tenantId: (0, import_pg_core.varchar)("tenant_id", { length: 100 })
+}, (table) => [
+  (0, import_pg_core.unique)().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  (0, import_pg_core.uniqueIndex)("uniq_role_binding_global").on(table.roleId, table.subjectType, table.subjectId).where(import_drizzle_orm.sql`${table.tenantId} is null`),
+  (0, import_pg_core.uniqueIndex)("uniq_role_binding_tenant").on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(import_drizzle_orm.sql`${table.tenantId} is not null`),
+  (0, import_pg_core.index)("role_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var directPermissionBindings = (0, import_pg_core.pgTable)("fortress_direct_permission_binding", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  permissionId: (0, import_pg_core.integer)("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" }),
+  subjectType: (0, import_pg_core.varchar)("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: (0, import_pg_core.integer)("subject_id").notNull(),
+  tenantId: (0, import_pg_core.varchar)("tenant_id", { length: 100 })
+}, (table) => [
+  (0, import_pg_core.unique)().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  (0, import_pg_core.uniqueIndex)("uniq_direct_permission_binding_global").on(table.permissionId, table.subjectType, table.subjectId).where(import_drizzle_orm.sql`${table.tenantId} is null`),
+  (0, import_pg_core.uniqueIndex)("uniq_direct_permission_binding_tenant").on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(import_drizzle_orm.sql`${table.tenantId} is not null`),
+  (0, import_pg_core.index)("direct_permission_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var emailVerificationTokens = (0, import_pg_core.pgTable)("fortress_email_verification_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  token: (0, import_pg_core.text)("token").notNull(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("email_verification_token_token_idx").on(table.token)]);
+var magicLinkTokens = (0, import_pg_core.pgTable)("fortress_magic_link_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }).notNull(),
+  token: (0, import_pg_core.varchar)("token", { length: 64 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("magic_link_token_token_idx").on(table.token)]);
+var apiKeys = (0, import_pg_core.pgTable)("fortress_api_key", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  subjectType: (0, import_pg_core.varchar)("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: (0, import_pg_core.integer)("subject_id").notNull(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  keyHash: (0, import_pg_core.varchar)("key_hash", { length: 64 }).notNull().unique(),
+  keyPrefix: (0, import_pg_core.varchar)("key_prefix", { length: 20 }).notNull(),
+  scopes: (0, import_pg_core.text)("scopes"),
+  // JSON array of "resource:action" strings
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }),
+  lastUsedAt: (0, import_pg_core.timestamp)("last_used_at", { withTimezone: true }),
+  isRevoked: (0, import_pg_core.boolean)("is_revoked").notNull().default(false),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("api_key_subject_idx").on(table.subjectType, table.subjectId)]);
+var twoFactorSecrets = (0, import_pg_core.pgTable)("fortress_two_factor_secret", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().unique().references(() => users.id, { onDelete: "cascade" }),
+  secret: (0, import_pg_core.text)("secret").notNull(),
+  // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: (0, import_pg_core.boolean)("is_enabled").notNull().default(false),
+  lastUsedCounter: (0, import_pg_core.integer)("last_used_counter"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var backupCodes = (0, import_pg_core.pgTable)("fortress_backup_code", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  codeHash: (0, import_pg_core.text)("code_hash").notNull(),
+  isUsed: (0, import_pg_core.boolean)("is_used").notNull().default(false),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("backup_code_user_idx").on(table.userId)]);
+var trustedDevices = (0, import_pg_core.pgTable)("fortress_trusted_device", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: (0, import_pg_core.varchar)("device_hash", { length: 64 }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  lastUsedAt: (0, import_pg_core.timestamp)("last_used_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("trusted_device_user_idx").on(table.userId)]);
+var socialAccounts = (0, import_pg_core.pgTable)("fortress_social_account", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  provider: (0, import_pg_core.varchar)("provider", { length: 50 }).notNull(),
+  providerAccountId: (0, import_pg_core.varchar)("provider_account_id", { length: 255 }).notNull(),
+  email: (0, import_pg_core.varchar)("email", { length: 255 }),
+  accessToken: (0, import_pg_core.text)("access_token"),
+  // Encrypted
+  refreshToken: (0, import_pg_core.text)("refresh_token"),
+  // Encrypted
+  tokenExpiresAt: (0, import_pg_core.timestamp)("token_expires_at", { withTimezone: true }),
+  profile: (0, import_pg_core.jsonb)("profile"),
+  // JSON
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.unique)().on(table.userId, table.provider),
+  (0, import_pg_core.unique)().on(table.provider, table.providerAccountId)
+]);
+var tenants = (0, import_pg_core.pgTable)("fortress_tenant", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  taxId: (0, import_pg_core.varchar)("tax_id", { length: 100 }).notNull().unique(),
+  description: (0, import_pg_core.text)("description"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var tenantUsers = (0, import_pg_core.pgTable)(
+  "fortress_tenant_user",
+  {
+    tenantId: (0, import_pg_core.integer)("tenant_id").notNull().references(() => tenants.id, { onDelete: "cascade" }),
+    userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    isDefault: (0, import_pg_core.boolean)("is_default").notNull().default(false)
+  },
+  (table) => [
+    (0, import_pg_core.primaryKey)({ columns: [table.tenantId, table.userId] }),
+    (0, import_pg_core.uniqueIndex)("fortress_tenant_user_one_default_idx").on(table.userId).where(import_drizzle_orm.sql`${table.isDefault} = true`)
+  ]
+);
+var oauthClients = (0, import_pg_core.pgTable)("fortress_oauth_client", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull().unique(),
+  clientSecretHash: (0, import_pg_core.text)("client_secret_hash").notNull(),
+  name: (0, import_pg_core.varchar)("name", { length: 255 }).notNull(),
+  redirectUris: (0, import_pg_core.text)("redirect_uris").notNull(),
+  // JSON array
+  grantTypes: (0, import_pg_core.text)("grant_types").notNull(),
+  // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: (0, import_pg_core.text)("allowed_scopes"),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: (0, import_pg_core.text)("token_endpoint_auth_method"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAuthorizationCodes = (0, import_pg_core.pgTable)("fortress_oauth_authorization_code", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  code: (0, import_pg_core.varchar)("code", { length: 255 }).notNull().unique(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  userId: (0, import_pg_core.integer)("user_id").notNull(),
+  redirectUri: (0, import_pg_core.text)("redirect_uri").notNull(),
+  scope: (0, import_pg_core.text)("scope"),
+  codeChallenge: (0, import_pg_core.text)("code_challenge"),
+  codeChallengeMethod: (0, import_pg_core.varchar)("code_challenge_method", { length: 10 }),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: (0, import_pg_core.text)("nonce"),
+  authTime: (0, import_pg_core.integer)("auth_time"),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAccessTokens = (0, import_pg_core.pgTable)("fortress_oauth_access_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  token: (0, import_pg_core.varchar)("token", { length: 255 }).notNull().unique(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  userId: (0, import_pg_core.integer)("user_id"),
+  scope: (0, import_pg_core.text)("scope"),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthRefreshTokens = (0, import_pg_core.pgTable)("fortress_oauth_refresh_token", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  token: (0, import_pg_core.varchar)("token", { length: 255 }).notNull().unique(),
+  familyId: (0, import_pg_core.varchar)("family_id", { length: 64 }).notNull(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  userId: (0, import_pg_core.integer)("user_id").notNull(),
+  scope: (0, import_pg_core.text)("scope"),
+  issuedAt: (0, import_pg_core.timestamp)("issued_at", { withTimezone: true }).notNull(),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  parentId: (0, import_pg_core.integer)("parent_id"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthPendingFlows = (0, import_pg_core.pgTable)("fortress_oauth_pending_flow", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  flowId: (0, import_pg_core.text)("flow_id").notNull().unique(),
+  clientId: (0, import_pg_core.varchar)("client_id", { length: 255 }).notNull(),
+  redirectUri: (0, import_pg_core.text)("redirect_uri").notNull(),
+  scope: (0, import_pg_core.text)("scope"),
+  state: (0, import_pg_core.varchar)("state", { length: 255 }).notNull(),
+  codeChallenge: (0, import_pg_core.text)("code_challenge"),
+  codeChallengeMethod: (0, import_pg_core.varchar)("code_challenge_method", { length: 10 }),
+  nonce: (0, import_pg_core.text)("nonce"),
+  // H6 fix: subject the flow is bound to (TOFU-claimed on first
+  // authenticated touch).
+  userId: (0, import_pg_core.integer)("user_id"),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: (0, import_pg_core.timestamp)("used_at", { withTimezone: true }),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthSigningKeys = (0, import_pg_core.pgTable)("fortress_oauth_signing_key", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  kid: (0, import_pg_core.varchar)("kid", { length: 64 }).notNull().unique(),
+  alg: (0, import_pg_core.varchar)("alg", { length: 16 }).notNull(),
+  publicJwk: (0, import_pg_core.text)("public_jwk").notNull(),
+  privateJwk: (0, import_pg_core.text)("private_jwk").notNull(),
+  rotatedAt: (0, import_pg_core.timestamp)("rotated_at", { withTimezone: true }),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var userScopeAssignments = (0, import_pg_core.pgTable)("fortress_user_scope_assignment", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  scopeName: (0, import_pg_core.varchar)("scope_name", { length: 100 }).notNull(),
+  scopeValue: (0, import_pg_core.varchar)("scope_value", { length: 255 }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var accountLockouts = (0, import_pg_core.pgTable)("fortress_account_lockout", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  identifier: (0, import_pg_core.varchar)("identifier", { length: 255 }).notNull().unique(),
+  failedAttempts: (0, import_pg_core.integer)("failed_attempts").notNull().default(0),
+  lastFailedAt: (0, import_pg_core.timestamp)("last_failed_at", { withTimezone: true }),
+  lockedUntil: (0, import_pg_core.timestamp)("locked_until", { withTimezone: true }),
+  lockoutCount: (0, import_pg_core.integer)("lockout_count").notNull().default(0),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var auditLogs = (0, import_pg_core.pgTable)("fortress_audit_log", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  timestamp: (0, import_pg_core.timestamp)("timestamp", { withTimezone: true }).notNull().defaultNow(),
+  eventType: (0, import_pg_core.varchar)("event_type", { length: 100 }).notNull(),
+  actorId: (0, import_pg_core.integer)("actor_id"),
+  actorType: (0, import_pg_core.varchar)("actor_type", { length: 20 }).notNull().default("USER"),
+  targetId: (0, import_pg_core.integer)("target_id"),
+  targetType: (0, import_pg_core.varchar)("target_type", { length: 50 }),
+  ipAddress: (0, import_pg_core.varchar)("ip_address", { length: 45 }),
+  userAgent: (0, import_pg_core.text)("user_agent"),
+  outcome: (0, import_pg_core.varchar)("outcome", { length: 20 }).notNull().default("SUCCESS"),
+  metadata: (0, import_pg_core.jsonb)("metadata"),
+  previousHash: (0, import_pg_core.text)("previous_hash"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [(0, import_pg_core.index)("audit_log_timestamp_idx").on(table.timestamp)]);
+var auditChainState = (0, import_pg_core.pgTable)("fortress_audit_chain_state", {
+  id: (0, import_pg_core.integer)("id").primaryKey(),
+  lastHash: (0, import_pg_core.varchar)("last_hash", { length: 64 }),
+  entryCount: (0, import_pg_core.integer)("entry_count").notNull(),
+  updatedAt: (0, import_pg_core.timestamp)("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookEndpoints = (0, import_pg_core.pgTable)("fortress_webhook_endpoint", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  url: (0, import_pg_core.text)("url").notNull(),
+  events: (0, import_pg_core.text)("events").notNull(),
+  // JSON array
+  secret: (0, import_pg_core.text)("secret").notNull(),
+  isActive: (0, import_pg_core.boolean)("is_active").notNull().default(true),
+  deactivatedReason: (0, import_pg_core.text)("deactivated_reason"),
+  consecutiveFailures: (0, import_pg_core.integer)("consecutive_failures").notNull().default(0),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookDeliveries = (0, import_pg_core.pgTable)("fortress_webhook_delivery", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  endpointId: (0, import_pg_core.integer)("endpoint_id").notNull().references(() => webhookEndpoints.id, { onDelete: "cascade" }),
+  eventType: (0, import_pg_core.varchar)("event_type", { length: 100 }).notNull(),
+  payload: (0, import_pg_core.text)("payload").notNull(),
+  // JSON
+  status: (0, import_pg_core.varchar)("status", { length: 20 }).notNull().default("pending"),
+  // pending | success | failed
+  attempts: (0, import_pg_core.integer)("attempts").notNull().default(0),
+  idempotencyKey: (0, import_pg_core.text)("idempotency_key"),
+  lastAttemptAt: (0, import_pg_core.timestamp)("last_attempt_at", { withTimezone: true }),
+  nextRetryAt: (0, import_pg_core.timestamp)("next_retry_at", { withTimezone: true }),
+  responseStatus: (0, import_pg_core.integer)("response_status"),
+  responseBody: (0, import_pg_core.text)("response_body"),
+  errorKind: (0, import_pg_core.text)("error_kind"),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  (0, import_pg_core.uniqueIndex)("uniq_webhook_delivery_idempotency").on(table.endpointId, table.idempotencyKey).where(import_drizzle_orm.sql`${table.idempotencyKey} is not null`),
+  (0, import_pg_core.index)("webhook_delivery_retry_idx").on(table.status, table.nextRetryAt)
+]);
+var webauthnCredentials = (0, import_pg_core.pgTable)("fortress_webauthn_credential", {
+  id: (0, import_pg_core.serial)("id").primaryKey(),
+  userId: (0, import_pg_core.integer)("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  credentialId: (0, import_pg_core.text)("credential_id").notNull().unique(),
+  publicKey: (0, import_pg_core.text)("public_key").notNull(),
+  counter: (0, import_pg_core.integer)("counter").notNull().default(0),
+  deviceType: (0, import_pg_core.varchar)("device_type", { length: 20 }).notNull(),
+  backedUp: (0, import_pg_core.boolean)("backed_up").notNull().default(false),
+  transports: (0, import_pg_core.text)("transports"),
+  // JSON array
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webauthnChallenges = (0, import_pg_core.pgTable)("fortress_webauthn_challenge", {
+  id: (0, import_pg_core.bigserial)("id", { mode: "number" }).primaryKey(),
+  challenge: (0, import_pg_core.text)("challenge").notNull().unique(),
+  userId: (0, import_pg_core.integer)("user_id"),
+  expiresAt: (0, import_pg_core.timestamp)("expires_at", { withTimezone: true }).notNull(),
+  createdAt: (0, import_pg_core.timestamp)("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var fortressPgSchema = {
+  schemaVersion,
+  users,
+  loginIdentifiers,
+  refreshTokens,
+  authContinuations,
+  groups,
+  groupUsers,
+  serviceAccounts,
+  resources,
+  permissions,
+  roles,
+  rolePermissions,
+  roleBindings,
+  directPermissionBindings,
+  emailVerificationTokens,
+  magicLinkTokens,
+  apiKeys,
+  twoFactorSecrets,
+  backupCodes,
+  trustedDevices,
+  socialAccounts,
+  tenants,
+  tenantUsers,
+  oauthClients,
+  oauthAuthorizationCodes,
+  oauthAccessTokens,
+  oauthRefreshTokens,
+  oauthPendingFlows,
+  oauthSigningKeys,
+  userScopeAssignments,
+  accountLockouts,
+  auditLogs,
+  auditChainState,
+  webhookEndpoints,
+  webhookDeliveries,
+  webauthnCredentials,
+  webauthnChallenges
+};
+
+// src/drizzle/schema.ts
+var import_drizzle_orm2 = require("drizzle-orm");
+var import_sqlite_core = require("drizzle-orm/sqlite-core");
+var schemaVersion2 = (0, import_sqlite_core.sqliteTable)("fortress_schema_version", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey().default(1),
+  version: (0, import_sqlite_core.integer)("version").notNull(),
+  appliedAt: (0, import_sqlite_core.integer)("applied_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var users2 = (0, import_sqlite_core.sqliteTable)("fortress_user", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  email: (0, import_sqlite_core.text)("email").notNull().unique(),
+  name: (0, import_sqlite_core.text)("name").notNull(),
+  passwordHash: (0, import_sqlite_core.text)("password_hash"),
+  isActive: (0, import_sqlite_core.integer)("is_active", { mode: "boolean" }).notNull().default(true),
+  emailVerified: (0, import_sqlite_core.integer)("email_verified", { mode: "boolean" }).notNull().default(false),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: (0, import_sqlite_core.integer)("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  (0, import_sqlite_core.uniqueIndex)("user_email_ci_unique").on(import_drizzle_orm2.sql`${table.email} COLLATE NOCASE`)
+]);
+var loginIdentifiers2 = (0, import_sqlite_core.sqliteTable)("fortress_login_identifier", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  type: (0, import_sqlite_core.text)("type").notNull(),
+  // 'email' | 'phone' | 'username'
+  value: (0, import_sqlite_core.text)("value").notNull().unique()
+}, (table) => [
+  (0, import_sqlite_core.uniqueIndex)("login_identifier_email_ci_unique").on(import_drizzle_orm2.sql`${table.value} COLLATE NOCASE`).where(import_drizzle_orm2.sql`${table.type} = 'email'`)
+]);
+var refreshTokens2 = (0, import_sqlite_core.sqliteTable)("fortress_refresh_token", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  tokenHash: (0, import_sqlite_core.text)("token_hash").notNull().unique(),
+  tokenFamily: (0, import_sqlite_core.text)("token_family").notNull(),
+  familyCreatedAt: (0, import_sqlite_core.integer)("family_created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  successorTokenHash: (0, import_sqlite_core.text)("successor_token_hash"),
+  rotatedAt: (0, import_sqlite_core.integer)("rotated_at", { mode: "timestamp" }),
+  isRevoked: (0, import_sqlite_core.integer)("is_revoked", { mode: "boolean" }).notNull().default(false),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  ipAddress: (0, import_sqlite_core.text)("ip_address"),
+  userAgent: (0, import_sqlite_core.text)("user_agent"),
+  deviceName: (0, import_sqlite_core.text)("device_name"),
+  lastActiveAt: (0, import_sqlite_core.integer)("last_active_at", { mode: "timestamp" }),
+  fingerprintHash: (0, import_sqlite_core.text)("fingerprint_hash"),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  (0, import_sqlite_core.index)("refresh_token_family_idx").on(table.tokenFamily),
+  (0, import_sqlite_core.index)("refresh_token_user_idx").on(table.userId)
+]);
+var authContinuations2 = (0, import_sqlite_core.sqliteTable)("fortress_auth_continuation", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  tokenHash: (0, import_sqlite_core.text)("token_hash").notNull().unique(),
+  reason: (0, import_sqlite_core.text)("reason").notNull(),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  consumedAt: (0, import_sqlite_core.integer)("consumed_at", { mode: "timestamp" }),
+  failedAttempts: (0, import_sqlite_core.integer)("failed_attempts").notNull().default(0),
+  lastFailedAt: (0, import_sqlite_core.integer)("last_failed_at", { mode: "timestamp" }),
+  invalidatedAt: (0, import_sqlite_core.integer)("invalidated_at", { mode: "timestamp" }),
+  maxAttempts: (0, import_sqlite_core.integer)("max_attempts").notNull().default(5),
+  cooldownSeconds: (0, import_sqlite_core.integer)("cooldown_seconds").notNull().default(1),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  (0, import_sqlite_core.index)("auth_continuation_failure_idx").on(table.userId, table.reason, table.lastFailedAt)
+]);
+var groups2 = (0, import_sqlite_core.sqliteTable)("fortress_group", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  name: (0, import_sqlite_core.text)("name").notNull().unique(),
+  description: (0, import_sqlite_core.text)("description")
+});
+var groupUsers2 = (0, import_sqlite_core.sqliteTable)(
+  "fortress_group_user",
+  {
+    groupId: (0, import_sqlite_core.integer)("group_id").notNull().references(() => groups2.id, { onDelete: "cascade" }),
+    userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" })
+  },
+  (table) => [(0, import_sqlite_core.primaryKey)({ columns: [table.groupId, table.userId] })]
+);
+var serviceAccounts2 = (0, import_sqlite_core.sqliteTable)("fortress_service_account", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  name: (0, import_sqlite_core.text)("name").notNull().unique(),
+  displayName: (0, import_sqlite_core.text)("display_name"),
+  description: (0, import_sqlite_core.text)("description"),
+  isActive: (0, import_sqlite_core.integer)("is_active", { mode: "boolean" }).notNull().default(true),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: (0, import_sqlite_core.integer)("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var resources2 = (0, import_sqlite_core.sqliteTable)("fortress_resource", {
+  name: (0, import_sqlite_core.text)("name").primaryKey(),
+  description: (0, import_sqlite_core.text)("description")
+});
+var permissions2 = (0, import_sqlite_core.sqliteTable)("fortress_permission", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  resource: (0, import_sqlite_core.text)("resource").notNull().references(() => resources2.name, { onDelete: "cascade" }),
+  action: (0, import_sqlite_core.text)("action").notNull(),
+  effect: (0, import_sqlite_core.text)("effect").notNull().default("ALLOW"),
+  // 'ALLOW' | 'DENY'
+  conditions: (0, import_sqlite_core.text)("conditions"),
+  // JSON string of PermissionCondition[]
+  description: (0, import_sqlite_core.text)("description")
+}, (table) => [
+  // M8 fix: SQL UNIQUE treats two NULL `conditions` as distinct, so the
+  // plain unique() above lets `findOrCreatePermission` insert duplicate
+  // rows for the same (resource, action, effect, conditions=NULL) tuple
+  // under concurrency. Mirror the split-index pattern used for role /
+  // direct-permission bindings.
+  (0, import_sqlite_core.uniqueIndex)("uniq_permission_no_conditions").on(table.resource, table.action, table.effect).where(import_drizzle_orm2.sql`${table.conditions} is null`),
+  (0, import_sqlite_core.uniqueIndex)("uniq_permission_with_conditions").on(table.resource, table.action, table.effect, table.conditions).where(import_drizzle_orm2.sql`${table.conditions} is not null`)
+]);
+var roles2 = (0, import_sqlite_core.sqliteTable)("fortress_role", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  name: (0, import_sqlite_core.text)("name").notNull().unique(),
+  description: (0, import_sqlite_core.text)("description"),
+  isSystem: (0, import_sqlite_core.integer)("is_system", { mode: "boolean" }).notNull().default(false)
+});
+var rolePermissions2 = (0, import_sqlite_core.sqliteTable)(
+  "fortress_role_permission",
+  {
+    roleId: (0, import_sqlite_core.integer)("role_id").notNull().references(() => roles2.id, { onDelete: "cascade" }),
+    permissionId: (0, import_sqlite_core.integer)("permission_id").notNull().references(() => permissions2.id, { onDelete: "cascade" })
+  },
+  (table) => [(0, import_sqlite_core.primaryKey)({ columns: [table.roleId, table.permissionId] })]
+);
+var roleBindings2 = (0, import_sqlite_core.sqliteTable)("fortress_role_binding", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  roleId: (0, import_sqlite_core.integer)("role_id").notNull().references(() => roles2.id, { onDelete: "cascade" }),
+  subjectType: (0, import_sqlite_core.text)("subject_type").notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: (0, import_sqlite_core.integer)("subject_id").notNull(),
+  tenantId: (0, import_sqlite_core.text)("tenant_id")
+}, (table) => [
+  (0, import_sqlite_core.unique)().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  (0, import_sqlite_core.uniqueIndex)("uniq_role_binding_global").on(table.roleId, table.subjectType, table.subjectId).where(import_drizzle_orm2.sql`${table.tenantId} is null`),
+  (0, import_sqlite_core.uniqueIndex)("uniq_role_binding_tenant").on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(import_drizzle_orm2.sql`${table.tenantId} is not null`),
+  (0, import_sqlite_core.index)("role_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var directPermissionBindings2 = (0, import_sqlite_core.sqliteTable)("fortress_direct_permission_binding", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  permissionId: (0, import_sqlite_core.integer)("permission_id").notNull().references(() => permissions2.id, { onDelete: "cascade" }),
+  subjectType: (0, import_sqlite_core.text)("subject_type").notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: (0, import_sqlite_core.integer)("subject_id").notNull(),
+  tenantId: (0, import_sqlite_core.text)("tenant_id")
+}, (table) => [
+  (0, import_sqlite_core.unique)().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  (0, import_sqlite_core.uniqueIndex)("uniq_direct_permission_binding_global").on(table.permissionId, table.subjectType, table.subjectId).where(import_drizzle_orm2.sql`${table.tenantId} is null`),
+  (0, import_sqlite_core.uniqueIndex)("uniq_direct_permission_binding_tenant").on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(import_drizzle_orm2.sql`${table.tenantId} is not null`),
+  (0, import_sqlite_core.index)("direct_permission_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var emailVerificationTokens2 = (0, import_sqlite_core.sqliteTable)("fortress_email_verification_token", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  token: (0, import_sqlite_core.text)("token").notNull(),
+  email: (0, import_sqlite_core.text)("email").notNull(),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: (0, import_sqlite_core.integer)("used_at", { mode: "timestamp" }),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [(0, import_sqlite_core.index)("email_verification_token_token_idx").on(table.token)]);
+var magicLinkTokens2 = (0, import_sqlite_core.sqliteTable)("fortress_magic_link_token", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  email: (0, import_sqlite_core.text)("email").notNull(),
+  token: (0, import_sqlite_core.text)("token").notNull(),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: (0, import_sqlite_core.integer)("used_at", { mode: "timestamp" }),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [(0, import_sqlite_core.index)("magic_link_token_token_idx").on(table.token)]);
+var apiKeys2 = (0, import_sqlite_core.sqliteTable)("fortress_api_key", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  subjectType: (0, import_sqlite_core.text)("subject_type").notNull(),
+  // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: (0, import_sqlite_core.integer)("subject_id").notNull(),
+  name: (0, import_sqlite_core.text)("name").notNull(),
+  keyHash: (0, import_sqlite_core.text)("key_hash").notNull().unique(),
+  keyPrefix: (0, import_sqlite_core.text)("key_prefix").notNull(),
+  scopes: (0, import_sqlite_core.text)("scopes"),
+  // JSON array of "resource:action" strings
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }),
+  lastUsedAt: (0, import_sqlite_core.integer)("last_used_at", { mode: "timestamp" }),
+  isRevoked: (0, import_sqlite_core.integer)("is_revoked", { mode: "boolean" }).notNull().default(false),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [(0, import_sqlite_core.index)("api_key_subject_idx").on(table.subjectType, table.subjectId)]);
+var twoFactorSecrets2 = (0, import_sqlite_core.sqliteTable)("fortress_two_factor_secret", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().unique().references(() => users2.id, { onDelete: "cascade" }),
+  secret: (0, import_sqlite_core.text)("secret").notNull(),
+  // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: (0, import_sqlite_core.integer)("is_enabled", { mode: "boolean" }).notNull().default(false),
+  lastUsedCounter: (0, import_sqlite_core.integer)("last_used_counter"),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var backupCodes2 = (0, import_sqlite_core.sqliteTable)("fortress_backup_code", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  codeHash: (0, import_sqlite_core.text)("code_hash").notNull(),
+  isUsed: (0, import_sqlite_core.integer)("is_used", { mode: "boolean" }).notNull().default(false),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [(0, import_sqlite_core.index)("backup_code_user_idx").on(table.userId)]);
+var trustedDevices2 = (0, import_sqlite_core.sqliteTable)("fortress_trusted_device", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: (0, import_sqlite_core.text)("device_hash").notNull(),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  lastUsedAt: (0, import_sqlite_core.integer)("last_used_at", { mode: "timestamp" }).notNull(),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [(0, import_sqlite_core.index)("trusted_device_user_idx").on(table.userId)]);
+var socialAccounts2 = (0, import_sqlite_core.sqliteTable)("fortress_social_account", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  provider: (0, import_sqlite_core.text)("provider").notNull(),
+  providerAccountId: (0, import_sqlite_core.text)("provider_account_id").notNull(),
+  email: (0, import_sqlite_core.text)("email"),
+  accessToken: (0, import_sqlite_core.text)("access_token"),
+  // Encrypted
+  refreshToken: (0, import_sqlite_core.text)("refresh_token"),
+  // Encrypted
+  tokenExpiresAt: (0, import_sqlite_core.integer)("token_expires_at", { mode: "timestamp" }),
+  profile: (0, import_sqlite_core.text)("profile"),
+  // JSON
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: (0, import_sqlite_core.integer)("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  (0, import_sqlite_core.unique)().on(table.userId, table.provider),
+  (0, import_sqlite_core.unique)().on(table.provider, table.providerAccountId)
+]);
+var tenants2 = (0, import_sqlite_core.sqliteTable)("fortress_tenant", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  name: (0, import_sqlite_core.text)("name").notNull(),
+  taxId: (0, import_sqlite_core.text)("tax_id").notNull().unique(),
+  description: (0, import_sqlite_core.text)("description"),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: (0, import_sqlite_core.integer)("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var tenantUsers2 = (0, import_sqlite_core.sqliteTable)(
+  "fortress_tenant_user",
+  {
+    tenantId: (0, import_sqlite_core.integer)("tenant_id").notNull().references(() => tenants2.id, { onDelete: "cascade" }),
+    userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+    isDefault: (0, import_sqlite_core.integer)("is_default", { mode: "boolean" }).notNull().default(false)
+  },
+  (table) => [
+    (0, import_sqlite_core.primaryKey)({ columns: [table.tenantId, table.userId] }),
+    (0, import_sqlite_core.uniqueIndex)("fortress_tenant_user_one_default_idx").on(table.userId).where(import_drizzle_orm2.sql`${table.isDefault} = true`)
+  ]
+);
+var oauthClients2 = (0, import_sqlite_core.sqliteTable)("fortress_oauth_client", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  clientId: (0, import_sqlite_core.text)("client_id").notNull().unique(),
+  clientSecretHash: (0, import_sqlite_core.text)("client_secret_hash").notNull(),
+  name: (0, import_sqlite_core.text)("name").notNull(),
+  redirectUris: (0, import_sqlite_core.text)("redirect_uris").notNull(),
+  // JSON array
+  grantTypes: (0, import_sqlite_core.text)("grant_types").notNull(),
+  // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: (0, import_sqlite_core.text)("allowed_scopes"),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: (0, import_sqlite_core.text)("token_endpoint_auth_method"),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthAuthorizationCodes2 = (0, import_sqlite_core.sqliteTable)("fortress_oauth_authorization_code", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  code: (0, import_sqlite_core.text)("code").notNull().unique(),
+  clientId: (0, import_sqlite_core.text)("client_id").notNull(),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull(),
+  redirectUri: (0, import_sqlite_core.text)("redirect_uri").notNull(),
+  scope: (0, import_sqlite_core.text)("scope"),
+  codeChallenge: (0, import_sqlite_core.text)("code_challenge"),
+  codeChallengeMethod: (0, import_sqlite_core.text)("code_challenge_method"),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: (0, import_sqlite_core.text)("nonce"),
+  authTime: (0, import_sqlite_core.integer)("auth_time"),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: (0, import_sqlite_core.integer)("used_at", { mode: "timestamp" }),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthAccessTokens2 = (0, import_sqlite_core.sqliteTable)("fortress_oauth_access_token", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  token: (0, import_sqlite_core.text)("token").notNull().unique(),
+  clientId: (0, import_sqlite_core.text)("client_id").notNull(),
+  userId: (0, import_sqlite_core.integer)("user_id"),
+  scope: (0, import_sqlite_core.text)("scope"),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthRefreshTokens2 = (0, import_sqlite_core.sqliteTable)("fortress_oauth_refresh_token", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  token: (0, import_sqlite_core.text)("token").notNull().unique(),
+  familyId: (0, import_sqlite_core.text)("family_id").notNull(),
+  clientId: (0, import_sqlite_core.text)("client_id").notNull(),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull(),
+  scope: (0, import_sqlite_core.text)("scope"),
+  issuedAt: (0, import_sqlite_core.integer)("issued_at", { mode: "timestamp" }).notNull(),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: (0, import_sqlite_core.integer)("used_at", { mode: "timestamp" }),
+  parentId: (0, import_sqlite_core.integer)("parent_id"),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthPendingFlows2 = (0, import_sqlite_core.sqliteTable)("fortress_oauth_pending_flow", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  flowId: (0, import_sqlite_core.text)("flow_id").notNull().unique(),
+  clientId: (0, import_sqlite_core.text)("client_id").notNull(),
+  redirectUri: (0, import_sqlite_core.text)("redirect_uri").notNull(),
+  scope: (0, import_sqlite_core.text)("scope"),
+  state: (0, import_sqlite_core.text)("state").notNull(),
+  codeChallenge: (0, import_sqlite_core.text)("code_challenge"),
+  codeChallengeMethod: (0, import_sqlite_core.text)("code_challenge_method"),
+  nonce: (0, import_sqlite_core.text)("nonce"),
+  // H6 fix: subject the flow is bound to. Nullable for the
+  // login-redirect path which can't know the user up front — the
+  // first authenticated GetFlow / Approve claims it.
+  userId: (0, import_sqlite_core.integer)("user_id"),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: (0, import_sqlite_core.integer)("used_at", { mode: "timestamp" }),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthSigningKeys2 = (0, import_sqlite_core.sqliteTable)("fortress_oauth_signing_key", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  kid: (0, import_sqlite_core.text)("kid").notNull().unique(),
+  alg: (0, import_sqlite_core.text)("alg").notNull(),
+  publicJwk: (0, import_sqlite_core.text)("public_jwk").notNull(),
+  privateJwk: (0, import_sqlite_core.text)("private_jwk").notNull(),
+  rotatedAt: (0, import_sqlite_core.integer)("rotated_at", { mode: "timestamp" }),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var userScopeAssignments2 = (0, import_sqlite_core.sqliteTable)("fortress_user_scope_assignment", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  scopeName: (0, import_sqlite_core.text)("scope_name").notNull(),
+  scopeValue: (0, import_sqlite_core.text)("scope_value").notNull(),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var accountLockouts2 = (0, import_sqlite_core.sqliteTable)("fortress_account_lockout", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  identifier: (0, import_sqlite_core.text)("identifier").notNull().unique(),
+  failedAttempts: (0, import_sqlite_core.integer)("failed_attempts").notNull().default(0),
+  lastFailedAt: (0, import_sqlite_core.integer)("last_failed_at", { mode: "timestamp" }),
+  lockedUntil: (0, import_sqlite_core.integer)("locked_until", { mode: "timestamp" }),
+  lockoutCount: (0, import_sqlite_core.integer)("lockout_count").notNull().default(0),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var auditLogs2 = (0, import_sqlite_core.sqliteTable)("fortress_audit_log", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  timestamp: (0, import_sqlite_core.integer)("timestamp", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  eventType: (0, import_sqlite_core.text)("event_type").notNull(),
+  actorId: (0, import_sqlite_core.integer)("actor_id"),
+  actorType: (0, import_sqlite_core.text)("actor_type").notNull().default("USER"),
+  targetId: (0, import_sqlite_core.integer)("target_id"),
+  targetType: (0, import_sqlite_core.text)("target_type"),
+  ipAddress: (0, import_sqlite_core.text)("ip_address"),
+  userAgent: (0, import_sqlite_core.text)("user_agent"),
+  outcome: (0, import_sqlite_core.text)("outcome").notNull().default("SUCCESS"),
+  metadata: (0, import_sqlite_core.text)("metadata"),
+  previousHash: (0, import_sqlite_core.text)("previous_hash"),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [(0, import_sqlite_core.index)("audit_log_timestamp_idx").on(table.timestamp)]);
+var auditChainState2 = (0, import_sqlite_core.sqliteTable)("fortress_audit_chain_state", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey(),
+  lastHash: (0, import_sqlite_core.text)("last_hash"),
+  entryCount: (0, import_sqlite_core.integer)("entry_count").notNull(),
+  updatedAt: (0, import_sqlite_core.integer)("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webhookEndpoints2 = (0, import_sqlite_core.sqliteTable)("fortress_webhook_endpoint", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  url: (0, import_sqlite_core.text)("url").notNull(),
+  events: (0, import_sqlite_core.text)("events").notNull(),
+  // JSON array
+  secret: (0, import_sqlite_core.text)("secret").notNull(),
+  isActive: (0, import_sqlite_core.integer)("is_active", { mode: "boolean" }).notNull().default(true),
+  deactivatedReason: (0, import_sqlite_core.text)("deactivated_reason"),
+  consecutiveFailures: (0, import_sqlite_core.integer)("consecutive_failures").notNull().default(0),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webhookDeliveries2 = (0, import_sqlite_core.sqliteTable)("fortress_webhook_delivery", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  endpointId: (0, import_sqlite_core.integer)("endpoint_id").notNull().references(() => webhookEndpoints2.id, { onDelete: "cascade" }),
+  eventType: (0, import_sqlite_core.text)("event_type").notNull(),
+  payload: (0, import_sqlite_core.text)("payload").notNull(),
+  // JSON
+  status: (0, import_sqlite_core.text)("status").notNull().default("pending"),
+  // pending | success | failed
+  attempts: (0, import_sqlite_core.integer)("attempts").notNull().default(0),
+  idempotencyKey: (0, import_sqlite_core.text)("idempotency_key"),
+  lastAttemptAt: (0, import_sqlite_core.integer)("last_attempt_at", { mode: "timestamp" }),
+  nextRetryAt: (0, import_sqlite_core.integer)("next_retry_at", { mode: "timestamp" }),
+  responseStatus: (0, import_sqlite_core.integer)("response_status"),
+  responseBody: (0, import_sqlite_core.text)("response_body"),
+  errorKind: (0, import_sqlite_core.text)("error_kind"),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  (0, import_sqlite_core.uniqueIndex)("uniq_webhook_delivery_idempotency").on(table.endpointId, table.idempotencyKey).where(import_drizzle_orm2.sql`${table.idempotencyKey} is not null`),
+  (0, import_sqlite_core.index)("webhook_delivery_retry_idx").on(table.status, table.nextRetryAt)
+]);
+var webauthnCredentials2 = (0, import_sqlite_core.sqliteTable)("fortress_webauthn_credential", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  userId: (0, import_sqlite_core.integer)("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  credentialId: (0, import_sqlite_core.text)("credential_id").notNull().unique(),
+  publicKey: (0, import_sqlite_core.text)("public_key").notNull(),
+  counter: (0, import_sqlite_core.integer)("counter").notNull().default(0),
+  deviceType: (0, import_sqlite_core.text)("device_type").notNull(),
+  backedUp: (0, import_sqlite_core.integer)("backed_up", { mode: "boolean" }).notNull().default(false),
+  transports: (0, import_sqlite_core.text)("transports"),
+  // JSON array
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webauthnChallenges2 = (0, import_sqlite_core.sqliteTable)("fortress_webauthn_challenge", {
+  id: (0, import_sqlite_core.integer)("id").primaryKey({ autoIncrement: true }),
+  challenge: (0, import_sqlite_core.text)("challenge").notNull().unique(),
+  userId: (0, import_sqlite_core.integer)("user_id"),
+  expiresAt: (0, import_sqlite_core.integer)("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: (0, import_sqlite_core.integer)("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var fortressSchema = {
+  schemaVersion: schemaVersion2,
+  users: users2,
+  loginIdentifiers: loginIdentifiers2,
+  refreshTokens: refreshTokens2,
+  authContinuations: authContinuations2,
+  groups: groups2,
+  groupUsers: groupUsers2,
+  serviceAccounts: serviceAccounts2,
+  resources: resources2,
+  permissions: permissions2,
+  roles: roles2,
+  rolePermissions: rolePermissions2,
+  roleBindings: roleBindings2,
+  directPermissionBindings: directPermissionBindings2,
+  emailVerificationTokens: emailVerificationTokens2,
+  magicLinkTokens: magicLinkTokens2,
+  apiKeys: apiKeys2,
+  twoFactorSecrets: twoFactorSecrets2,
+  backupCodes: backupCodes2,
+  trustedDevices: trustedDevices2,
+  socialAccounts: socialAccounts2,
+  tenants: tenants2,
+  tenantUsers: tenantUsers2,
+  oauthClients: oauthClients2,
+  oauthAuthorizationCodes: oauthAuthorizationCodes2,
+  oauthAccessTokens: oauthAccessTokens2,
+  oauthRefreshTokens: oauthRefreshTokens2,
+  oauthPendingFlows: oauthPendingFlows2,
+  oauthSigningKeys: oauthSigningKeys2,
+  userScopeAssignments: userScopeAssignments2,
+  accountLockouts: accountLockouts2,
+  auditLogs: auditLogs2,
+  auditChainState: auditChainState2,
+  webhookEndpoints: webhookEndpoints2,
+  webhookDeliveries: webhookDeliveries2,
+  webauthnCredentials: webauthnCredentials2,
+  webauthnChallenges: webauthnChallenges2
+};
+
+// src/drizzle/adapter.ts
+function buildTableMap(schema) {
+  return {
+    schema_version: schema.schemaVersion,
+    user: schema.users,
+    login_identifier: schema.loginIdentifiers,
+    refresh_token: schema.refreshTokens,
+    auth_continuation: schema.authContinuations,
+    group: schema.groups,
+    group_user: schema.groupUsers,
+    service_account: schema.serviceAccounts,
+    resource: schema.resources,
+    permission: schema.permissions,
+    role: schema.roles,
+    role_permission: schema.rolePermissions,
+    role_binding: schema.roleBindings,
+    direct_permission_binding: schema.directPermissionBindings,
+    email_verification_token: schema.emailVerificationTokens,
+    magic_link_token: schema.magicLinkTokens,
+    api_key: schema.apiKeys,
+    two_factor_secret: schema.twoFactorSecrets,
+    backup_code: schema.backupCodes,
+    trusted_device: schema.trustedDevices,
+    social_account: schema.socialAccounts,
+    tenant: schema.tenants,
+    tenant_user: schema.tenantUsers,
+    oauth_client: schema.oauthClients,
+    oauth_authorization_code: schema.oauthAuthorizationCodes,
+    oauth_access_token: schema.oauthAccessTokens,
+    oauth_refresh_token: schema.oauthRefreshTokens,
+    oauth_pending_flow: schema.oauthPendingFlows,
+    oauth_signing_key: schema.oauthSigningKeys,
+    user_scope_assignment: schema.userScopeAssignments,
+    account_lockout: schema.accountLockouts,
+    audit_log: schema.auditLogs,
+    audit_chain_state: schema.auditChainState,
+    webhook_endpoint: schema.webhookEndpoints,
+    webhook_delivery: schema.webhookDeliveries,
+    webauthn_credential: schema.webauthnCredentials,
+    webauthn_challenge: schema.webauthnChallenges
+  };
+}
+var SQLITE_DEFAULT_TABLE_MAP = buildTableMap(fortressSchema);
+var PG_DEFAULT_TABLE_MAP = buildTableMap(fortressPgSchema);
+function getColumn(table, field) {
+  const columns = (0, import_drizzle_orm3.getTableColumns)(table);
+  if (columns[field])
+    return columns[field];
+  const camelCase = field.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+  if (columns[camelCase])
+    return columns[camelCase];
+  throw Errors.badRequest(`Unknown field: ${field} on table`);
+}
+function buildWhereCondition(table, where) {
+  if (where.length === 0)
+    throw Errors.badRequest("A non-empty where clause is required (empty where would match all rows)");
+  const conditions = where.map((clause) => {
+    const column = getColumn(table, clause.field);
+    switch (clause.operator) {
+      case "=":
+        return (0, import_drizzle_orm3.eq)(column, clause.value);
+      case "!=":
+        return (0, import_drizzle_orm3.ne)(column, clause.value);
+      case "in":
+        return (0, import_drizzle_orm3.inArray)(column, clause.value);
+      case "gt":
+        return (0, import_drizzle_orm3.gt)(column, clause.value);
+      case "lt":
+        return (0, import_drizzle_orm3.lt)(column, clause.value);
+      case "gte":
+        return (0, import_drizzle_orm3.gte)(column, clause.value);
+      case "lte":
+        return (0, import_drizzle_orm3.lte)(column, clause.value);
+      case "like":
+        return (0, import_drizzle_orm3.like)(column, clause.value);
+      case "isNull":
+        return (0, import_drizzle_orm3.isNull)(column);
+      default:
+        throw Errors.badRequest(`Unsupported operator: ${clause.operator}`);
+    }
+  });
+  return conditions.length === 1 ? conditions[0] : (0, import_drizzle_orm3.and)(...conditions);
+}
+function sanitizeData(data) {
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    result[key] = value === void 0 ? null : value;
+  }
+  return result;
+}
+var ID_FIELD_RE = /[a-z]Id$/;
+function isIdField(key) {
+  return key === "id" || ID_FIELD_RE.test(key);
+}
+function stringifyIds(row) {
+  if (row == null || typeof row !== "object")
+    return row;
+  if (Array.isArray(row))
+    return row.map(stringifyIds);
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (isIdField(key) && (typeof value === "number" || typeof value === "bigint")) {
+      out[key] = String(value);
+    } else if (value && typeof value === "object" && !(value instanceof Date)) {
+      out[key] = stringifyIds(value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function buildRawSql(sqlText, params = []) {
+  if (params.length === 0)
+    return import_drizzle_orm3.sql.raw(sqlText);
+  if (sqlText.includes("?")) {
+    const parts = sqlText.split("?");
+    if (parts.length - 1 !== params.length) {
+      throw Errors.badRequest(`rawQuery placeholder count (${parts.length - 1}) does not match params (${params.length})`);
+    }
+    let query = import_drizzle_orm3.sql.raw(parts[0]);
+    for (let i = 0; i < params.length; i++) {
+      query = import_drizzle_orm3.sql`${query}${params[i]}${import_drizzle_orm3.sql.raw(parts[i + 1])}`;
+    }
+    return query;
+  }
+  throw Errors.badRequest(
+    "rawQuery uses ? positional placeholders on every dialect; params were provided but no ? placeholders were found"
+  );
+}
+function normalizeRawRows(result) {
+  if (Array.isArray(result))
+    return result;
+  const rows = result?.rows;
+  if (Array.isArray(rows))
+    return rows;
+  return [];
+}
+function sqliteStatementReturnsRows(sqlText) {
+  const normalized = sqlText.trimStart().toLowerCase();
+  return normalized.startsWith("select") || normalized.startsWith("with") || normalized.startsWith("pragma") || normalized.includes(" returning ");
+}
+function createDrizzleAdapter(db, options) {
+  const dialect = options?.dialect ?? "sqlite";
+  const defaults = dialect === "pg" ? PG_DEFAULT_TABLE_MAP : SQLITE_DEFAULT_TABLE_MAP;
+  const tableMap = { ...defaults, ...options?.tables };
+  const isSqlite = dialect === "sqlite";
+  let sqliteTxChain = Promise.resolve();
+  const sqliteTxContext = new import_node_async_hooks.AsyncLocalStorage();
+  function serializeSqlite(op) {
+    if (!isSqlite || sqliteTxContext.getStore())
+      return op();
+    const result = sqliteTxChain.then(op, op);
+    sqliteTxChain = result.catch(() => void 0);
+    return result;
+  }
+  async function execOne(query) {
+    const row = isSqlite ? query.get() : (await query)[0];
+    return row === void 0 ? void 0 : stringifyIds(row);
+  }
+  async function execMany(query) {
+    const rows = isSqlite ? query.all() : await query;
+    return rows.map(stringifyIds);
+  }
+  async function execRun(query) {
+    if (isSqlite) {
+      query.run();
+      return;
+    }
+    await query;
+  }
+  function getTable(model) {
+    const table = tableMap[model];
+    if (!table) {
+      throw Errors.badRequest(`Unknown model: ${model}`);
+    }
+    return table;
+  }
+  function buildAdapter(drizzle) {
+    const self = {
+      get dialect() {
+        return dialect;
+      },
+      async create(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          try {
+            const result = await execOne(drizzle.insert(table).values(sanitizeData(params.data)).returning());
+            return result;
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async findOne(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          const result = await execOne(drizzle.select().from(table).where(condition).limit(1));
+          return result ?? null;
+        });
+      },
+      async findMany(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          let query = drizzle.select().from(table).$dynamic();
+          if (params.where && params.where.length > 0) {
+            const condition = buildWhereCondition(table, params.where);
+            query = query.where(condition);
+          }
+          if (params.sortBy) {
+            const column = getColumn(table, params.sortBy.field);
+            query = query.orderBy(
+              params.sortBy.direction === "desc" ? import_drizzle_orm3.sql`${column} desc` : import_drizzle_orm3.sql`${column} asc`
+            );
+          }
+          if (params.limit) {
+            query = query.limit(params.limit);
+          }
+          if (params.offset) {
+            query = query.offset(params.offset);
+          }
+          return execMany(query);
+        });
+      },
+      async update(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          const query = drizzle.update(table).set(sanitizeData(params.data)).where(condition).returning();
+          try {
+            if (isSqlite) {
+              const rows = query.all().map(stringifyIds);
+              return rows[0] ?? null;
+            }
+            const result = await execOne(query);
+            return result ?? null;
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async delete(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          try {
+            await execRun(drizzle.delete(table).where(condition));
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async count(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          let query = drizzle.select({ count: import_drizzle_orm3.sql`count(*)` }).from(table).$dynamic();
+          if (params.where && params.where.length > 0) {
+            const condition = buildWhereCondition(table, params.where);
+            query = query.where(condition);
+          }
+          const result = await execOne(query);
+          return Number(result?.count) || 0;
+        });
+      },
+      async rawQuery(sqlText, params) {
+        return serializeSqlite(async () => {
+          const query = buildRawSql(sqlText, params ?? []);
+          if (isSqlite) {
+            if (typeof drizzle.all === "function" && sqliteStatementReturnsRows(sqlText))
+              return normalizeRawRows(drizzle.all(query)).map(stringifyIds);
+            if (typeof drizzle.run === "function") {
+              drizzle.run(query);
+              return [];
+            }
+            if (typeof drizzle.execute === "function")
+              return normalizeRawRows(await drizzle.execute(query)).map(stringifyIds);
+            throw Errors.badRequest("rawQuery is not supported by this SQLite Drizzle driver");
+          }
+          if (typeof drizzle.execute !== "function")
+            throw Errors.badRequest("rawQuery is not supported by this Drizzle driver");
+          return normalizeRawRows(await drizzle.execute(query)).map(stringifyIds);
+        });
+      },
+      async transaction(fn) {
+        if (dialect === "sqlite") {
+          if (sqliteTxContext.getStore()) {
+            throw Errors.badRequest("Nested transactions are not supported by the SQLite Drizzle adapter");
+          }
+          const run = async () => {
+            drizzle.run(import_drizzle_orm3.sql`BEGIN IMMEDIATE`);
+            try {
+              const result2 = await sqliteTxContext.run(true, () => fn(self));
+              drizzle.run(import_drizzle_orm3.sql`COMMIT`);
+              return result2;
+            } catch (error) {
+              drizzle.run(import_drizzle_orm3.sql`ROLLBACK`);
+              throw error;
+            }
+          };
+          const result = sqliteTxChain.then(run, run);
+          sqliteTxChain = result.catch(() => void 0);
+          return result;
+        }
+        return drizzle.transaction(async (tx) => {
+          const txAdapter = buildAdapter(tx);
+          return fn(txAdapter);
+        });
+      }
+    };
+    return self;
+  }
+  return buildAdapter(db);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createDrizzleAdapter,
+  findSqlstate,
+  fortressPgSchema,
+  fortressSchema,
+  rethrowDbError
+});