@bajustone/fortress 1.0.0-rc.1

package/dist/drizzle.js

@@ -0,0 +1,1411 @@
+// src/drizzle/adapter.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { and, eq, getTableColumns, gt, gte, inArray, isNull, like, lt, lte, ne, sql as sql3 } from "drizzle-orm";
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/drizzle/pg-error-map.ts
+var MAX_CAUSE_DEPTH = 6;
+var SQLSTATE_PATTERN = /^[0-9A-Z]{5}$/;
+var PG_SQLSTATE_MAP = {
+  "23505": (cause) => Errors.conflict("Resource already exists", { cause }),
+  "23503": (cause) => Errors.unprocessable("Referenced resource does not exist", { cause }),
+  "23502": (_cause) => Errors.badRequest("Required field is missing"),
+  "23514": (cause) => Errors.unprocessable("Constraint check failed", { cause }),
+  "40001": (cause) => Errors.conflict("Serialization failure, retry the request", { cause }),
+  "40P01": (cause) => Errors.conflict("Deadlock detected, retry the request", { cause }),
+  "57014": (cause) => Errors.serviceUnavailable("Query canceled", { cause })
+};
+var SQLITE_CONSTRAINT_MAP = [
+  {
+    match: /SQLITE_CONSTRAINT_(?:UNIQUE|PRIMARYKEY)|UNIQUE constraint failed/i,
+    factory: (cause) => Errors.conflict("Resource already exists", { cause })
+  },
+  {
+    match: /SQLITE_CONSTRAINT_FOREIGNKEY|FOREIGN KEY constraint failed/i,
+    factory: (cause) => Errors.unprocessable("Referenced resource does not exist", { cause })
+  },
+  {
+    match: /SQLITE_CONSTRAINT_NOTNULL|NOT NULL constraint failed/i,
+    factory: (_cause) => Errors.badRequest("Required field is missing")
+  }
+];
+function mapSqliteConstraint(err) {
+  let current = err;
+  for (let i = 0; i < MAX_CAUSE_DEPTH; i++) {
+    if (current === null || typeof current !== "object")
+      return null;
+    const coded = current;
+    const code = typeof coded.code === "string" ? coded.code : "";
+    const message = typeof coded.message === "string" ? coded.message : "";
+    const haystack = `${code} ${message}`;
+    for (const { match, factory } of SQLITE_CONSTRAINT_MAP) {
+      if (match.test(haystack))
+        return factory(err);
+    }
+    current = coded.cause;
+  }
+  return null;
+}
+function findSqlstate(err) {
+  let current = err;
+  for (let i = 0; i < MAX_CAUSE_DEPTH; i++) {
+    if (current === null || typeof current !== "object")
+      return null;
+    const candidate = current.code;
+    if (typeof candidate === "string" && SQLSTATE_PATTERN.test(candidate))
+      return candidate;
+    current = current.cause;
+  }
+  return null;
+}
+function rethrowDbError(err, dialect) {
+  if (dialect === "pg") {
+    const sqlstate = findSqlstate(err);
+    const factory = sqlstate ? PG_SQLSTATE_MAP[sqlstate] : void 0;
+    if (factory)
+      throw factory(err);
+    throw err;
+  }
+  if (dialect === "sqlite") {
+    const mapped = mapSqliteConstraint(err);
+    if (mapped)
+      throw mapped;
+    throw err;
+  }
+  throw err;
+}
+
+// src/drizzle/pg/schema.ts
+import { sql } from "drizzle-orm";
+import { bigserial, boolean, index, integer, jsonb, pgTable, primaryKey, serial, text, timestamp, unique, uniqueIndex, varchar } from "drizzle-orm/pg-core";
+var schemaVersion = pgTable("fortress_schema_version", {
+  id: integer("id").primaryKey().default(1),
+  version: integer("version").notNull(),
+  appliedAt: timestamp("applied_at", { withTimezone: true }).notNull().defaultNow()
+});
+var users = pgTable("fortress_user", {
+  id: serial("id").primaryKey(),
+  email: varchar("email", { length: 255 }).notNull().unique(),
+  name: varchar("name", { length: 255 }).notNull(),
+  passwordHash: text("password_hash"),
+  isActive: boolean("is_active").notNull().default(true),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  uniqueIndex("user_email_ci_unique").on(sql`lower(${table.email})`)
+]);
+var loginIdentifiers = pgTable("fortress_login_identifier", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  type: varchar("type", { length: 20 }).notNull(),
+  // 'email' | 'phone' | 'username'
+  value: varchar("value", { length: 255 }).notNull().unique()
+}, (table) => [
+  uniqueIndex("login_identifier_email_ci_unique").on(sql`lower(${table.value})`).where(sql`${table.type} = 'email'`)
+]);
+var refreshTokens = pgTable("fortress_refresh_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: varchar("token_hash", { length: 64 }).notNull().unique(),
+  tokenFamily: varchar("token_family", { length: 64 }).notNull(),
+  familyCreatedAt: timestamp("family_created_at", { withTimezone: true }).notNull().defaultNow(),
+  successorTokenHash: varchar("successor_token_hash", { length: 64 }),
+  rotatedAt: timestamp("rotated_at", { withTimezone: true }),
+  isRevoked: boolean("is_revoked").notNull().default(false),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: varchar("ip_address", { length: 45 }),
+  userAgent: text("user_agent"),
+  deviceName: text("device_name"),
+  lastActiveAt: timestamp("last_active_at", { withTimezone: true }),
+  fingerprintHash: varchar("fingerprint_hash", { length: 64 }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  index("refresh_token_family_idx").on(table.tokenFamily),
+  index("refresh_token_user_idx").on(table.userId)
+]);
+var authContinuations = pgTable("fortress_auth_continuation", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: varchar("token_hash", { length: 64 }).notNull().unique(),
+  reason: varchar("reason", { length: 32 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  consumedAt: timestamp("consumed_at", { withTimezone: true }),
+  failedAttempts: integer("failed_attempts").notNull().default(0),
+  lastFailedAt: timestamp("last_failed_at", { withTimezone: true }),
+  invalidatedAt: timestamp("invalidated_at", { withTimezone: true }),
+  maxAttempts: integer("max_attempts").notNull().default(5),
+  cooldownSeconds: integer("cooldown_seconds").notNull().default(1),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  index("auth_continuation_failure_idx").on(table.userId, table.reason, table.lastFailedAt)
+]);
+var groups = pgTable("fortress_group", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 100 }).notNull().unique(),
+  description: text("description")
+});
+var groupUsers = pgTable(
+  "fortress_group_user",
+  {
+    groupId: integer("group_id").notNull().references(() => groups.id, { onDelete: "cascade" }),
+    userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey({ columns: [table.groupId, table.userId] })]
+);
+var serviceAccounts = pgTable("fortress_service_account", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 100 }).notNull().unique(),
+  displayName: varchar("display_name", { length: 255 }),
+  description: text("description"),
+  isActive: boolean("is_active").notNull().default(true),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var resources = pgTable("fortress_resource", {
+  name: varchar("name", { length: 100 }).primaryKey(),
+  description: text("description")
+});
+var permissions = pgTable("fortress_permission", {
+  id: serial("id").primaryKey(),
+  resource: varchar("resource", { length: 100 }).notNull().references(() => resources.name, { onDelete: "cascade" }),
+  action: varchar("action", { length: 100 }).notNull(),
+  effect: varchar("effect", { length: 10 }).notNull().default("ALLOW"),
+  // 'ALLOW' | 'DENY'
+  conditions: jsonb("conditions"),
+  // PermissionCondition[] as JSONB
+  description: text("description")
+}, (table) => [
+  // M8 fix — same split-index pattern as role/direct-permission bindings
+  // so concurrent findOrCreatePermission can't insert duplicate rows when
+  // conditions is NULL (a plain UNIQUE treats NULLs as distinct).
+  uniqueIndex("uniq_permission_no_conditions").on(table.resource, table.action, table.effect).where(sql`${table.conditions} is null`),
+  uniqueIndex("uniq_permission_with_conditions").on(table.resource, table.action, table.effect, table.conditions).where(sql`${table.conditions} is not null`)
+]);
+var roles = pgTable("fortress_role", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 100 }).notNull().unique(),
+  description: text("description"),
+  isSystem: boolean("is_system").notNull().default(false)
+});
+var rolePermissions = pgTable(
+  "fortress_role_permission",
+  {
+    roleId: integer("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+    permissionId: integer("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey({ columns: [table.roleId, table.permissionId] })]
+);
+var roleBindings = pgTable("fortress_role_binding", {
+  id: serial("id").primaryKey(),
+  roleId: integer("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+  subjectType: varchar("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer("subject_id").notNull(),
+  tenantId: varchar("tenant_id", { length: 100 })
+}, (table) => [
+  unique().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex("uniq_role_binding_global").on(table.roleId, table.subjectType, table.subjectId).where(sql`${table.tenantId} is null`),
+  uniqueIndex("uniq_role_binding_tenant").on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(sql`${table.tenantId} is not null`),
+  index("role_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var directPermissionBindings = pgTable("fortress_direct_permission_binding", {
+  id: serial("id").primaryKey(),
+  permissionId: integer("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" }),
+  subjectType: varchar("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer("subject_id").notNull(),
+  tenantId: varchar("tenant_id", { length: 100 })
+}, (table) => [
+  unique().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex("uniq_direct_permission_binding_global").on(table.permissionId, table.subjectType, table.subjectId).where(sql`${table.tenantId} is null`),
+  uniqueIndex("uniq_direct_permission_binding_tenant").on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(sql`${table.tenantId} is not null`),
+  index("direct_permission_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var emailVerificationTokens = pgTable("fortress_email_verification_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  token: text("token").notNull(),
+  email: varchar("email", { length: 255 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("email_verification_token_token_idx").on(table.token)]);
+var magicLinkTokens = pgTable("fortress_magic_link_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  email: varchar("email", { length: 255 }).notNull(),
+  token: varchar("token", { length: 64 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("magic_link_token_token_idx").on(table.token)]);
+var apiKeys = pgTable("fortress_api_key", {
+  id: serial("id").primaryKey(),
+  subjectType: varchar("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: integer("subject_id").notNull(),
+  name: varchar("name", { length: 255 }).notNull(),
+  keyHash: varchar("key_hash", { length: 64 }).notNull().unique(),
+  keyPrefix: varchar("key_prefix", { length: 20 }).notNull(),
+  scopes: text("scopes"),
+  // JSON array of "resource:action" strings
+  expiresAt: timestamp("expires_at", { withTimezone: true }),
+  lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+  isRevoked: boolean("is_revoked").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("api_key_subject_idx").on(table.subjectType, table.subjectId)]);
+var twoFactorSecrets = pgTable("fortress_two_factor_secret", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().unique().references(() => users.id, { onDelete: "cascade" }),
+  secret: text("secret").notNull(),
+  // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: boolean("is_enabled").notNull().default(false),
+  lastUsedCounter: integer("last_used_counter"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var backupCodes = pgTable("fortress_backup_code", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  codeHash: text("code_hash").notNull(),
+  isUsed: boolean("is_used").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("backup_code_user_idx").on(table.userId)]);
+var trustedDevices = pgTable("fortress_trusted_device", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: varchar("device_hash", { length: 64 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  lastUsedAt: timestamp("last_used_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("trusted_device_user_idx").on(table.userId)]);
+var socialAccounts = pgTable("fortress_social_account", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  provider: varchar("provider", { length: 50 }).notNull(),
+  providerAccountId: varchar("provider_account_id", { length: 255 }).notNull(),
+  email: varchar("email", { length: 255 }),
+  accessToken: text("access_token"),
+  // Encrypted
+  refreshToken: text("refresh_token"),
+  // Encrypted
+  tokenExpiresAt: timestamp("token_expires_at", { withTimezone: true }),
+  profile: jsonb("profile"),
+  // JSON
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  unique().on(table.userId, table.provider),
+  unique().on(table.provider, table.providerAccountId)
+]);
+var tenants = pgTable("fortress_tenant", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 255 }).notNull(),
+  taxId: varchar("tax_id", { length: 100 }).notNull().unique(),
+  description: text("description"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var tenantUsers = pgTable(
+  "fortress_tenant_user",
+  {
+    tenantId: integer("tenant_id").notNull().references(() => tenants.id, { onDelete: "cascade" }),
+    userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    isDefault: boolean("is_default").notNull().default(false)
+  },
+  (table) => [
+    primaryKey({ columns: [table.tenantId, table.userId] }),
+    uniqueIndex("fortress_tenant_user_one_default_idx").on(table.userId).where(sql`${table.isDefault} = true`)
+  ]
+);
+var oauthClients = pgTable("fortress_oauth_client", {
+  id: serial("id").primaryKey(),
+  clientId: varchar("client_id", { length: 255 }).notNull().unique(),
+  clientSecretHash: text("client_secret_hash").notNull(),
+  name: varchar("name", { length: 255 }).notNull(),
+  redirectUris: text("redirect_uris").notNull(),
+  // JSON array
+  grantTypes: text("grant_types").notNull(),
+  // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: text("allowed_scopes"),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAuthorizationCodes = pgTable("fortress_oauth_authorization_code", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  code: varchar("code", { length: 255 }).notNull().unique(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  userId: integer("user_id").notNull(),
+  redirectUri: text("redirect_uri").notNull(),
+  scope: text("scope"),
+  codeChallenge: text("code_challenge"),
+  codeChallengeMethod: varchar("code_challenge_method", { length: 10 }),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: text("nonce"),
+  authTime: integer("auth_time"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAccessTokens = pgTable("fortress_oauth_access_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  token: varchar("token", { length: 255 }).notNull().unique(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  userId: integer("user_id"),
+  scope: text("scope"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthRefreshTokens = pgTable("fortress_oauth_refresh_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  token: varchar("token", { length: 255 }).notNull().unique(),
+  familyId: varchar("family_id", { length: 64 }).notNull(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  userId: integer("user_id").notNull(),
+  scope: text("scope"),
+  issuedAt: timestamp("issued_at", { withTimezone: true }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  parentId: integer("parent_id"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthPendingFlows = pgTable("fortress_oauth_pending_flow", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  flowId: text("flow_id").notNull().unique(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  redirectUri: text("redirect_uri").notNull(),
+  scope: text("scope"),
+  state: varchar("state", { length: 255 }).notNull(),
+  codeChallenge: text("code_challenge"),
+  codeChallengeMethod: varchar("code_challenge_method", { length: 10 }),
+  nonce: text("nonce"),
+  // H6 fix: subject the flow is bound to (TOFU-claimed on first
+  // authenticated touch).
+  userId: integer("user_id"),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthSigningKeys = pgTable("fortress_oauth_signing_key", {
+  id: serial("id").primaryKey(),
+  kid: varchar("kid", { length: 64 }).notNull().unique(),
+  alg: varchar("alg", { length: 16 }).notNull(),
+  publicJwk: text("public_jwk").notNull(),
+  privateJwk: text("private_jwk").notNull(),
+  rotatedAt: timestamp("rotated_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var userScopeAssignments = pgTable("fortress_user_scope_assignment", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  scopeName: varchar("scope_name", { length: 100 }).notNull(),
+  scopeValue: varchar("scope_value", { length: 255 }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var accountLockouts = pgTable("fortress_account_lockout", {
+  id: serial("id").primaryKey(),
+  identifier: varchar("identifier", { length: 255 }).notNull().unique(),
+  failedAttempts: integer("failed_attempts").notNull().default(0),
+  lastFailedAt: timestamp("last_failed_at", { withTimezone: true }),
+  lockedUntil: timestamp("locked_until", { withTimezone: true }),
+  lockoutCount: integer("lockout_count").notNull().default(0),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var auditLogs = pgTable("fortress_audit_log", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  timestamp: timestamp("timestamp", { withTimezone: true }).notNull().defaultNow(),
+  eventType: varchar("event_type", { length: 100 }).notNull(),
+  actorId: integer("actor_id"),
+  actorType: varchar("actor_type", { length: 20 }).notNull().default("USER"),
+  targetId: integer("target_id"),
+  targetType: varchar("target_type", { length: 50 }),
+  ipAddress: varchar("ip_address", { length: 45 }),
+  userAgent: text("user_agent"),
+  outcome: varchar("outcome", { length: 20 }).notNull().default("SUCCESS"),
+  metadata: jsonb("metadata"),
+  previousHash: text("previous_hash"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("audit_log_timestamp_idx").on(table.timestamp)]);
+var auditChainState = pgTable("fortress_audit_chain_state", {
+  id: integer("id").primaryKey(),
+  lastHash: varchar("last_hash", { length: 64 }),
+  entryCount: integer("entry_count").notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookEndpoints = pgTable("fortress_webhook_endpoint", {
+  id: serial("id").primaryKey(),
+  url: text("url").notNull(),
+  events: text("events").notNull(),
+  // JSON array
+  secret: text("secret").notNull(),
+  isActive: boolean("is_active").notNull().default(true),
+  deactivatedReason: text("deactivated_reason"),
+  consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookDeliveries = pgTable("fortress_webhook_delivery", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  endpointId: integer("endpoint_id").notNull().references(() => webhookEndpoints.id, { onDelete: "cascade" }),
+  eventType: varchar("event_type", { length: 100 }).notNull(),
+  payload: text("payload").notNull(),
+  // JSON
+  status: varchar("status", { length: 20 }).notNull().default("pending"),
+  // pending | success | failed
+  attempts: integer("attempts").notNull().default(0),
+  idempotencyKey: text("idempotency_key"),
+  lastAttemptAt: timestamp("last_attempt_at", { withTimezone: true }),
+  nextRetryAt: timestamp("next_retry_at", { withTimezone: true }),
+  responseStatus: integer("response_status"),
+  responseBody: text("response_body"),
+  errorKind: text("error_kind"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  uniqueIndex("uniq_webhook_delivery_idempotency").on(table.endpointId, table.idempotencyKey).where(sql`${table.idempotencyKey} is not null`),
+  index("webhook_delivery_retry_idx").on(table.status, table.nextRetryAt)
+]);
+var webauthnCredentials = pgTable("fortress_webauthn_credential", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  credentialId: text("credential_id").notNull().unique(),
+  publicKey: text("public_key").notNull(),
+  counter: integer("counter").notNull().default(0),
+  deviceType: varchar("device_type", { length: 20 }).notNull(),
+  backedUp: boolean("backed_up").notNull().default(false),
+  transports: text("transports"),
+  // JSON array
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webauthnChallenges = pgTable("fortress_webauthn_challenge", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  challenge: text("challenge").notNull().unique(),
+  userId: integer("user_id"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var fortressPgSchema = {
+  schemaVersion,
+  users,
+  loginIdentifiers,
+  refreshTokens,
+  authContinuations,
+  groups,
+  groupUsers,
+  serviceAccounts,
+  resources,
+  permissions,
+  roles,
+  rolePermissions,
+  roleBindings,
+  directPermissionBindings,
+  emailVerificationTokens,
+  magicLinkTokens,
+  apiKeys,
+  twoFactorSecrets,
+  backupCodes,
+  trustedDevices,
+  socialAccounts,
+  tenants,
+  tenantUsers,
+  oauthClients,
+  oauthAuthorizationCodes,
+  oauthAccessTokens,
+  oauthRefreshTokens,
+  oauthPendingFlows,
+  oauthSigningKeys,
+  userScopeAssignments,
+  accountLockouts,
+  auditLogs,
+  auditChainState,
+  webhookEndpoints,
+  webhookDeliveries,
+  webauthnCredentials,
+  webauthnChallenges
+};
+
+// src/drizzle/schema.ts
+import { sql as sql2 } from "drizzle-orm";
+import { index as index2, integer as integer2, primaryKey as primaryKey2, sqliteTable, text as text2, unique as unique2, uniqueIndex as uniqueIndex2 } from "drizzle-orm/sqlite-core";
+var schemaVersion2 = sqliteTable("fortress_schema_version", {
+  id: integer2("id").primaryKey().default(1),
+  version: integer2("version").notNull(),
+  appliedAt: integer2("applied_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var users2 = sqliteTable("fortress_user", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  email: text2("email").notNull().unique(),
+  name: text2("name").notNull(),
+  passwordHash: text2("password_hash"),
+  isActive: integer2("is_active", { mode: "boolean" }).notNull().default(true),
+  emailVerified: integer2("email_verified", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  uniqueIndex2("user_email_ci_unique").on(sql2`${table.email} COLLATE NOCASE`)
+]);
+var loginIdentifiers2 = sqliteTable("fortress_login_identifier", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  type: text2("type").notNull(),
+  // 'email' | 'phone' | 'username'
+  value: text2("value").notNull().unique()
+}, (table) => [
+  uniqueIndex2("login_identifier_email_ci_unique").on(sql2`${table.value} COLLATE NOCASE`).where(sql2`${table.type} = 'email'`)
+]);
+var refreshTokens2 = sqliteTable("fortress_refresh_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  tokenHash: text2("token_hash").notNull().unique(),
+  tokenFamily: text2("token_family").notNull(),
+  familyCreatedAt: integer2("family_created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  successorTokenHash: text2("successor_token_hash"),
+  rotatedAt: integer2("rotated_at", { mode: "timestamp" }),
+  isRevoked: integer2("is_revoked", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  ipAddress: text2("ip_address"),
+  userAgent: text2("user_agent"),
+  deviceName: text2("device_name"),
+  lastActiveAt: integer2("last_active_at", { mode: "timestamp" }),
+  fingerprintHash: text2("fingerprint_hash"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  index2("refresh_token_family_idx").on(table.tokenFamily),
+  index2("refresh_token_user_idx").on(table.userId)
+]);
+var authContinuations2 = sqliteTable("fortress_auth_continuation", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  tokenHash: text2("token_hash").notNull().unique(),
+  reason: text2("reason").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  consumedAt: integer2("consumed_at", { mode: "timestamp" }),
+  failedAttempts: integer2("failed_attempts").notNull().default(0),
+  lastFailedAt: integer2("last_failed_at", { mode: "timestamp" }),
+  invalidatedAt: integer2("invalidated_at", { mode: "timestamp" }),
+  maxAttempts: integer2("max_attempts").notNull().default(5),
+  cooldownSeconds: integer2("cooldown_seconds").notNull().default(1),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  index2("auth_continuation_failure_idx").on(table.userId, table.reason, table.lastFailedAt)
+]);
+var groups2 = sqliteTable("fortress_group", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull().unique(),
+  description: text2("description")
+});
+var groupUsers2 = sqliteTable(
+  "fortress_group_user",
+  {
+    groupId: integer2("group_id").notNull().references(() => groups2.id, { onDelete: "cascade" }),
+    userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey2({ columns: [table.groupId, table.userId] })]
+);
+var serviceAccounts2 = sqliteTable("fortress_service_account", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull().unique(),
+  displayName: text2("display_name"),
+  description: text2("description"),
+  isActive: integer2("is_active", { mode: "boolean" }).notNull().default(true),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var resources2 = sqliteTable("fortress_resource", {
+  name: text2("name").primaryKey(),
+  description: text2("description")
+});
+var permissions2 = sqliteTable("fortress_permission", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  resource: text2("resource").notNull().references(() => resources2.name, { onDelete: "cascade" }),
+  action: text2("action").notNull(),
+  effect: text2("effect").notNull().default("ALLOW"),
+  // 'ALLOW' | 'DENY'
+  conditions: text2("conditions"),
+  // JSON string of PermissionCondition[]
+  description: text2("description")
+}, (table) => [
+  // M8 fix: SQL UNIQUE treats two NULL `conditions` as distinct, so the
+  // plain unique() above lets `findOrCreatePermission` insert duplicate
+  // rows for the same (resource, action, effect, conditions=NULL) tuple
+  // under concurrency. Mirror the split-index pattern used for role /
+  // direct-permission bindings.
+  uniqueIndex2("uniq_permission_no_conditions").on(table.resource, table.action, table.effect).where(sql2`${table.conditions} is null`),
+  uniqueIndex2("uniq_permission_with_conditions").on(table.resource, table.action, table.effect, table.conditions).where(sql2`${table.conditions} is not null`)
+]);
+var roles2 = sqliteTable("fortress_role", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull().unique(),
+  description: text2("description"),
+  isSystem: integer2("is_system", { mode: "boolean" }).notNull().default(false)
+});
+var rolePermissions2 = sqliteTable(
+  "fortress_role_permission",
+  {
+    roleId: integer2("role_id").notNull().references(() => roles2.id, { onDelete: "cascade" }),
+    permissionId: integer2("permission_id").notNull().references(() => permissions2.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey2({ columns: [table.roleId, table.permissionId] })]
+);
+var roleBindings2 = sqliteTable("fortress_role_binding", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  roleId: integer2("role_id").notNull().references(() => roles2.id, { onDelete: "cascade" }),
+  subjectType: text2("subject_type").notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer2("subject_id").notNull(),
+  tenantId: text2("tenant_id")
+}, (table) => [
+  unique2().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex2("uniq_role_binding_global").on(table.roleId, table.subjectType, table.subjectId).where(sql2`${table.tenantId} is null`),
+  uniqueIndex2("uniq_role_binding_tenant").on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(sql2`${table.tenantId} is not null`),
+  index2("role_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var directPermissionBindings2 = sqliteTable("fortress_direct_permission_binding", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  permissionId: integer2("permission_id").notNull().references(() => permissions2.id, { onDelete: "cascade" }),
+  subjectType: text2("subject_type").notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer2("subject_id").notNull(),
+  tenantId: text2("tenant_id")
+}, (table) => [
+  unique2().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex2("uniq_direct_permission_binding_global").on(table.permissionId, table.subjectType, table.subjectId).where(sql2`${table.tenantId} is null`),
+  uniqueIndex2("uniq_direct_permission_binding_tenant").on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(sql2`${table.tenantId} is not null`),
+  index2("direct_permission_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var emailVerificationTokens2 = sqliteTable("fortress_email_verification_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  token: text2("token").notNull(),
+  email: text2("email").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("email_verification_token_token_idx").on(table.token)]);
+var magicLinkTokens2 = sqliteTable("fortress_magic_link_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  email: text2("email").notNull(),
+  token: text2("token").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("magic_link_token_token_idx").on(table.token)]);
+var apiKeys2 = sqliteTable("fortress_api_key", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  subjectType: text2("subject_type").notNull(),
+  // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: integer2("subject_id").notNull(),
+  name: text2("name").notNull(),
+  keyHash: text2("key_hash").notNull().unique(),
+  keyPrefix: text2("key_prefix").notNull(),
+  scopes: text2("scopes"),
+  // JSON array of "resource:action" strings
+  expiresAt: integer2("expires_at", { mode: "timestamp" }),
+  lastUsedAt: integer2("last_used_at", { mode: "timestamp" }),
+  isRevoked: integer2("is_revoked", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("api_key_subject_idx").on(table.subjectType, table.subjectId)]);
+var twoFactorSecrets2 = sqliteTable("fortress_two_factor_secret", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().unique().references(() => users2.id, { onDelete: "cascade" }),
+  secret: text2("secret").notNull(),
+  // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: integer2("is_enabled", { mode: "boolean" }).notNull().default(false),
+  lastUsedCounter: integer2("last_used_counter"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var backupCodes2 = sqliteTable("fortress_backup_code", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  codeHash: text2("code_hash").notNull(),
+  isUsed: integer2("is_used", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("backup_code_user_idx").on(table.userId)]);
+var trustedDevices2 = sqliteTable("fortress_trusted_device", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: text2("device_hash").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  lastUsedAt: integer2("last_used_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("trusted_device_user_idx").on(table.userId)]);
+var socialAccounts2 = sqliteTable("fortress_social_account", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  provider: text2("provider").notNull(),
+  providerAccountId: text2("provider_account_id").notNull(),
+  email: text2("email"),
+  accessToken: text2("access_token"),
+  // Encrypted
+  refreshToken: text2("refresh_token"),
+  // Encrypted
+  tokenExpiresAt: integer2("token_expires_at", { mode: "timestamp" }),
+  profile: text2("profile"),
+  // JSON
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  unique2().on(table.userId, table.provider),
+  unique2().on(table.provider, table.providerAccountId)
+]);
+var tenants2 = sqliteTable("fortress_tenant", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull(),
+  taxId: text2("tax_id").notNull().unique(),
+  description: text2("description"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var tenantUsers2 = sqliteTable(
+  "fortress_tenant_user",
+  {
+    tenantId: integer2("tenant_id").notNull().references(() => tenants2.id, { onDelete: "cascade" }),
+    userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+    isDefault: integer2("is_default", { mode: "boolean" }).notNull().default(false)
+  },
+  (table) => [
+    primaryKey2({ columns: [table.tenantId, table.userId] }),
+    uniqueIndex2("fortress_tenant_user_one_default_idx").on(table.userId).where(sql2`${table.isDefault} = true`)
+  ]
+);
+var oauthClients2 = sqliteTable("fortress_oauth_client", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  clientId: text2("client_id").notNull().unique(),
+  clientSecretHash: text2("client_secret_hash").notNull(),
+  name: text2("name").notNull(),
+  redirectUris: text2("redirect_uris").notNull(),
+  // JSON array
+  grantTypes: text2("grant_types").notNull(),
+  // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: text2("allowed_scopes"),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: text2("token_endpoint_auth_method"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthAuthorizationCodes2 = sqliteTable("fortress_oauth_authorization_code", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  code: text2("code").notNull().unique(),
+  clientId: text2("client_id").notNull(),
+  userId: integer2("user_id").notNull(),
+  redirectUri: text2("redirect_uri").notNull(),
+  scope: text2("scope"),
+  codeChallenge: text2("code_challenge"),
+  codeChallengeMethod: text2("code_challenge_method"),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: text2("nonce"),
+  authTime: integer2("auth_time"),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthAccessTokens2 = sqliteTable("fortress_oauth_access_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  token: text2("token").notNull().unique(),
+  clientId: text2("client_id").notNull(),
+  userId: integer2("user_id"),
+  scope: text2("scope"),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthRefreshTokens2 = sqliteTable("fortress_oauth_refresh_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  token: text2("token").notNull().unique(),
+  familyId: text2("family_id").notNull(),
+  clientId: text2("client_id").notNull(),
+  userId: integer2("user_id").notNull(),
+  scope: text2("scope"),
+  issuedAt: integer2("issued_at", { mode: "timestamp" }).notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  parentId: integer2("parent_id"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthPendingFlows2 = sqliteTable("fortress_oauth_pending_flow", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  flowId: text2("flow_id").notNull().unique(),
+  clientId: text2("client_id").notNull(),
+  redirectUri: text2("redirect_uri").notNull(),
+  scope: text2("scope"),
+  state: text2("state").notNull(),
+  codeChallenge: text2("code_challenge"),
+  codeChallengeMethod: text2("code_challenge_method"),
+  nonce: text2("nonce"),
+  // H6 fix: subject the flow is bound to. Nullable for the
+  // login-redirect path which can't know the user up front — the
+  // first authenticated GetFlow / Approve claims it.
+  userId: integer2("user_id"),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthSigningKeys2 = sqliteTable("fortress_oauth_signing_key", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  kid: text2("kid").notNull().unique(),
+  alg: text2("alg").notNull(),
+  publicJwk: text2("public_jwk").notNull(),
+  privateJwk: text2("private_jwk").notNull(),
+  rotatedAt: integer2("rotated_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var userScopeAssignments2 = sqliteTable("fortress_user_scope_assignment", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  scopeName: text2("scope_name").notNull(),
+  scopeValue: text2("scope_value").notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var accountLockouts2 = sqliteTable("fortress_account_lockout", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  identifier: text2("identifier").notNull().unique(),
+  failedAttempts: integer2("failed_attempts").notNull().default(0),
+  lastFailedAt: integer2("last_failed_at", { mode: "timestamp" }),
+  lockedUntil: integer2("locked_until", { mode: "timestamp" }),
+  lockoutCount: integer2("lockout_count").notNull().default(0),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var auditLogs2 = sqliteTable("fortress_audit_log", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  timestamp: integer2("timestamp", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  eventType: text2("event_type").notNull(),
+  actorId: integer2("actor_id"),
+  actorType: text2("actor_type").notNull().default("USER"),
+  targetId: integer2("target_id"),
+  targetType: text2("target_type"),
+  ipAddress: text2("ip_address"),
+  userAgent: text2("user_agent"),
+  outcome: text2("outcome").notNull().default("SUCCESS"),
+  metadata: text2("metadata"),
+  previousHash: text2("previous_hash"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("audit_log_timestamp_idx").on(table.timestamp)]);
+var auditChainState2 = sqliteTable("fortress_audit_chain_state", {
+  id: integer2("id").primaryKey(),
+  lastHash: text2("last_hash"),
+  entryCount: integer2("entry_count").notNull(),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webhookEndpoints2 = sqliteTable("fortress_webhook_endpoint", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  url: text2("url").notNull(),
+  events: text2("events").notNull(),
+  // JSON array
+  secret: text2("secret").notNull(),
+  isActive: integer2("is_active", { mode: "boolean" }).notNull().default(true),
+  deactivatedReason: text2("deactivated_reason"),
+  consecutiveFailures: integer2("consecutive_failures").notNull().default(0),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webhookDeliveries2 = sqliteTable("fortress_webhook_delivery", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  endpointId: integer2("endpoint_id").notNull().references(() => webhookEndpoints2.id, { onDelete: "cascade" }),
+  eventType: text2("event_type").notNull(),
+  payload: text2("payload").notNull(),
+  // JSON
+  status: text2("status").notNull().default("pending"),
+  // pending | success | failed
+  attempts: integer2("attempts").notNull().default(0),
+  idempotencyKey: text2("idempotency_key"),
+  lastAttemptAt: integer2("last_attempt_at", { mode: "timestamp" }),
+  nextRetryAt: integer2("next_retry_at", { mode: "timestamp" }),
+  responseStatus: integer2("response_status"),
+  responseBody: text2("response_body"),
+  errorKind: text2("error_kind"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  uniqueIndex2("uniq_webhook_delivery_idempotency").on(table.endpointId, table.idempotencyKey).where(sql2`${table.idempotencyKey} is not null`),
+  index2("webhook_delivery_retry_idx").on(table.status, table.nextRetryAt)
+]);
+var webauthnCredentials2 = sqliteTable("fortress_webauthn_credential", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  credentialId: text2("credential_id").notNull().unique(),
+  publicKey: text2("public_key").notNull(),
+  counter: integer2("counter").notNull().default(0),
+  deviceType: text2("device_type").notNull(),
+  backedUp: integer2("backed_up", { mode: "boolean" }).notNull().default(false),
+  transports: text2("transports"),
+  // JSON array
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webauthnChallenges2 = sqliteTable("fortress_webauthn_challenge", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  challenge: text2("challenge").notNull().unique(),
+  userId: integer2("user_id"),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var fortressSchema = {
+  schemaVersion: schemaVersion2,
+  users: users2,
+  loginIdentifiers: loginIdentifiers2,
+  refreshTokens: refreshTokens2,
+  authContinuations: authContinuations2,
+  groups: groups2,
+  groupUsers: groupUsers2,
+  serviceAccounts: serviceAccounts2,
+  resources: resources2,
+  permissions: permissions2,
+  roles: roles2,
+  rolePermissions: rolePermissions2,
+  roleBindings: roleBindings2,
+  directPermissionBindings: directPermissionBindings2,
+  emailVerificationTokens: emailVerificationTokens2,
+  magicLinkTokens: magicLinkTokens2,
+  apiKeys: apiKeys2,
+  twoFactorSecrets: twoFactorSecrets2,
+  backupCodes: backupCodes2,
+  trustedDevices: trustedDevices2,
+  socialAccounts: socialAccounts2,
+  tenants: tenants2,
+  tenantUsers: tenantUsers2,
+  oauthClients: oauthClients2,
+  oauthAuthorizationCodes: oauthAuthorizationCodes2,
+  oauthAccessTokens: oauthAccessTokens2,
+  oauthRefreshTokens: oauthRefreshTokens2,
+  oauthPendingFlows: oauthPendingFlows2,
+  oauthSigningKeys: oauthSigningKeys2,
+  userScopeAssignments: userScopeAssignments2,
+  accountLockouts: accountLockouts2,
+  auditLogs: auditLogs2,
+  auditChainState: auditChainState2,
+  webhookEndpoints: webhookEndpoints2,
+  webhookDeliveries: webhookDeliveries2,
+  webauthnCredentials: webauthnCredentials2,
+  webauthnChallenges: webauthnChallenges2
+};
+
+// src/drizzle/adapter.ts
+function buildTableMap(schema) {
+  return {
+    schema_version: schema.schemaVersion,
+    user: schema.users,
+    login_identifier: schema.loginIdentifiers,
+    refresh_token: schema.refreshTokens,
+    auth_continuation: schema.authContinuations,
+    group: schema.groups,
+    group_user: schema.groupUsers,
+    service_account: schema.serviceAccounts,
+    resource: schema.resources,
+    permission: schema.permissions,
+    role: schema.roles,
+    role_permission: schema.rolePermissions,
+    role_binding: schema.roleBindings,
+    direct_permission_binding: schema.directPermissionBindings,
+    email_verification_token: schema.emailVerificationTokens,
+    magic_link_token: schema.magicLinkTokens,
+    api_key: schema.apiKeys,
+    two_factor_secret: schema.twoFactorSecrets,
+    backup_code: schema.backupCodes,
+    trusted_device: schema.trustedDevices,
+    social_account: schema.socialAccounts,
+    tenant: schema.tenants,
+    tenant_user: schema.tenantUsers,
+    oauth_client: schema.oauthClients,
+    oauth_authorization_code: schema.oauthAuthorizationCodes,
+    oauth_access_token: schema.oauthAccessTokens,
+    oauth_refresh_token: schema.oauthRefreshTokens,
+    oauth_pending_flow: schema.oauthPendingFlows,
+    oauth_signing_key: schema.oauthSigningKeys,
+    user_scope_assignment: schema.userScopeAssignments,
+    account_lockout: schema.accountLockouts,
+    audit_log: schema.auditLogs,
+    audit_chain_state: schema.auditChainState,
+    webhook_endpoint: schema.webhookEndpoints,
+    webhook_delivery: schema.webhookDeliveries,
+    webauthn_credential: schema.webauthnCredentials,
+    webauthn_challenge: schema.webauthnChallenges
+  };
+}
+var SQLITE_DEFAULT_TABLE_MAP = buildTableMap(fortressSchema);
+var PG_DEFAULT_TABLE_MAP = buildTableMap(fortressPgSchema);
+function getColumn(table, field) {
+  const columns = getTableColumns(table);
+  if (columns[field])
+    return columns[field];
+  const camelCase = field.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+  if (columns[camelCase])
+    return columns[camelCase];
+  throw Errors.badRequest(`Unknown field: ${field} on table`);
+}
+function buildWhereCondition(table, where) {
+  if (where.length === 0)
+    throw Errors.badRequest("A non-empty where clause is required (empty where would match all rows)");
+  const conditions = where.map((clause) => {
+    const column = getColumn(table, clause.field);
+    switch (clause.operator) {
+      case "=":
+        return eq(column, clause.value);
+      case "!=":
+        return ne(column, clause.value);
+      case "in":
+        return inArray(column, clause.value);
+      case "gt":
+        return gt(column, clause.value);
+      case "lt":
+        return lt(column, clause.value);
+      case "gte":
+        return gte(column, clause.value);
+      case "lte":
+        return lte(column, clause.value);
+      case "like":
+        return like(column, clause.value);
+      case "isNull":
+        return isNull(column);
+      default:
+        throw Errors.badRequest(`Unsupported operator: ${clause.operator}`);
+    }
+  });
+  return conditions.length === 1 ? conditions[0] : and(...conditions);
+}
+function sanitizeData(data) {
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    result[key] = value === void 0 ? null : value;
+  }
+  return result;
+}
+var ID_FIELD_RE = /[a-z]Id$/;
+function isIdField(key) {
+  return key === "id" || ID_FIELD_RE.test(key);
+}
+function stringifyIds(row) {
+  if (row == null || typeof row !== "object")
+    return row;
+  if (Array.isArray(row))
+    return row.map(stringifyIds);
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (isIdField(key) && (typeof value === "number" || typeof value === "bigint")) {
+      out[key] = String(value);
+    } else if (value && typeof value === "object" && !(value instanceof Date)) {
+      out[key] = stringifyIds(value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function buildRawSql(sqlText, params = []) {
+  if (params.length === 0)
+    return sql3.raw(sqlText);
+  if (sqlText.includes("?")) {
+    const parts = sqlText.split("?");
+    if (parts.length - 1 !== params.length) {
+      throw Errors.badRequest(`rawQuery placeholder count (${parts.length - 1}) does not match params (${params.length})`);
+    }
+    let query = sql3.raw(parts[0]);
+    for (let i = 0; i < params.length; i++) {
+      query = sql3`${query}${params[i]}${sql3.raw(parts[i + 1])}`;
+    }
+    return query;
+  }
+  throw Errors.badRequest(
+    "rawQuery uses ? positional placeholders on every dialect; params were provided but no ? placeholders were found"
+  );
+}
+function normalizeRawRows(result) {
+  if (Array.isArray(result))
+    return result;
+  const rows = result?.rows;
+  if (Array.isArray(rows))
+    return rows;
+  return [];
+}
+function sqliteStatementReturnsRows(sqlText) {
+  const normalized = sqlText.trimStart().toLowerCase();
+  return normalized.startsWith("select") || normalized.startsWith("with") || normalized.startsWith("pragma") || normalized.includes(" returning ");
+}
+function createDrizzleAdapter(db, options) {
+  const dialect = options?.dialect ?? "sqlite";
+  const defaults = dialect === "pg" ? PG_DEFAULT_TABLE_MAP : SQLITE_DEFAULT_TABLE_MAP;
+  const tableMap = { ...defaults, ...options?.tables };
+  const isSqlite = dialect === "sqlite";
+  let sqliteTxChain = Promise.resolve();
+  const sqliteTxContext = new AsyncLocalStorage();
+  function serializeSqlite(op) {
+    if (!isSqlite || sqliteTxContext.getStore())
+      return op();
+    const result = sqliteTxChain.then(op, op);
+    sqliteTxChain = result.catch(() => void 0);
+    return result;
+  }
+  async function execOne(query) {
+    const row = isSqlite ? query.get() : (await query)[0];
+    return row === void 0 ? void 0 : stringifyIds(row);
+  }
+  async function execMany(query) {
+    const rows = isSqlite ? query.all() : await query;
+    return rows.map(stringifyIds);
+  }
+  async function execRun(query) {
+    if (isSqlite) {
+      query.run();
+      return;
+    }
+    await query;
+  }
+  function getTable(model) {
+    const table = tableMap[model];
+    if (!table) {
+      throw Errors.badRequest(`Unknown model: ${model}`);
+    }
+    return table;
+  }
+  function buildAdapter(drizzle) {
+    const self = {
+      get dialect() {
+        return dialect;
+      },
+      async create(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          try {
+            const result = await execOne(drizzle.insert(table).values(sanitizeData(params.data)).returning());
+            return result;
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async findOne(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          const result = await execOne(drizzle.select().from(table).where(condition).limit(1));
+          return result ?? null;
+        });
+      },
+      async findMany(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          let query = drizzle.select().from(table).$dynamic();
+          if (params.where && params.where.length > 0) {
+            const condition = buildWhereCondition(table, params.where);
+            query = query.where(condition);
+          }
+          if (params.sortBy) {
+            const column = getColumn(table, params.sortBy.field);
+            query = query.orderBy(
+              params.sortBy.direction === "desc" ? sql3`${column} desc` : sql3`${column} asc`
+            );
+          }
+          if (params.limit) {
+            query = query.limit(params.limit);
+          }
+          if (params.offset) {
+            query = query.offset(params.offset);
+          }
+          return execMany(query);
+        });
+      },
+      async update(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          const query = drizzle.update(table).set(sanitizeData(params.data)).where(condition).returning();
+          try {
+            if (isSqlite) {
+              const rows = query.all().map(stringifyIds);
+              return rows[0] ?? null;
+            }
+            const result = await execOne(query);
+            return result ?? null;
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async delete(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          try {
+            await execRun(drizzle.delete(table).where(condition));
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async count(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          let query = drizzle.select({ count: sql3`count(*)` }).from(table).$dynamic();
+          if (params.where && params.where.length > 0) {
+            const condition = buildWhereCondition(table, params.where);
+            query = query.where(condition);
+          }
+          const result = await execOne(query);
+          return Number(result?.count) || 0;
+        });
+      },
+      async rawQuery(sqlText, params) {
+        return serializeSqlite(async () => {
+          const query = buildRawSql(sqlText, params ?? []);
+          if (isSqlite) {
+            if (typeof drizzle.all === "function" && sqliteStatementReturnsRows(sqlText))
+              return normalizeRawRows(drizzle.all(query)).map(stringifyIds);
+            if (typeof drizzle.run === "function") {
+              drizzle.run(query);
+              return [];
+            }
+            if (typeof drizzle.execute === "function")
+              return normalizeRawRows(await drizzle.execute(query)).map(stringifyIds);
+            throw Errors.badRequest("rawQuery is not supported by this SQLite Drizzle driver");
+          }
+          if (typeof drizzle.execute !== "function")
+            throw Errors.badRequest("rawQuery is not supported by this Drizzle driver");
+          return normalizeRawRows(await drizzle.execute(query)).map(stringifyIds);
+        });
+      },
+      async transaction(fn) {
+        if (dialect === "sqlite") {
+          if (sqliteTxContext.getStore()) {
+            throw Errors.badRequest("Nested transactions are not supported by the SQLite Drizzle adapter");
+          }
+          const run = async () => {
+            drizzle.run(sql3`BEGIN IMMEDIATE`);
+            try {
+              const result2 = await sqliteTxContext.run(true, () => fn(self));
+              drizzle.run(sql3`COMMIT`);
+              return result2;
+            } catch (error) {
+              drizzle.run(sql3`ROLLBACK`);
+              throw error;
+            }
+          };
+          const result = sqliteTxChain.then(run, run);
+          sqliteTxChain = result.catch(() => void 0);
+          return result;
+        }
+        return drizzle.transaction(async (tx) => {
+          const txAdapter = buildAdapter(tx);
+          return fn(txAdapter);
+        });
+      }
+    };
+    return self;
+  }
+  return buildAdapter(db);
+}
+export {
+  createDrizzleAdapter,
+  findSqlstate,
+  fortressPgSchema,
+  fortressSchema,
+  rethrowDbError
+};