@bajustone/fortress 1.0.0-rc.1

package/src/drizzle/schema.ts

@@ -0,0 +1,544 @@
+import type { AnySQLiteTable } from 'drizzle-orm/sqlite-core';
+
+import { sql } from 'drizzle-orm';
+import { index, integer, primaryKey, sqliteTable, text, unique, uniqueIndex } from 'drizzle-orm/sqlite-core';
+
+// --- Schema Versioning ---
+
+const schemaVersion = sqliteTable('fortress_schema_version', {
+  id: integer('id').primaryKey().default(1),
+  version: integer('version').notNull(),
+  appliedAt: integer('applied_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// --- Core Identity ---
+
+const users = sqliteTable('fortress_user', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  email: text('email').notNull().unique(),
+  name: text('name').notNull(),
+  passwordHash: text('password_hash'),
+  isActive: integer('is_active', { mode: 'boolean' }).notNull().default(true),
+  emailVerified: integer('email_verified', { mode: 'boolean' }).notNull().default(false),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [
+  uniqueIndex('user_email_ci_unique').on(sql`${table.email} COLLATE NOCASE`),
+]);
+
+// --- Login Identifiers ---
+
+const loginIdentifiers = sqliteTable('fortress_login_identifier', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  type: text('type').notNull(), // 'email' | 'phone' | 'username'
+  value: text('value').notNull().unique(),
+}, table => [
+  uniqueIndex('login_identifier_email_ci_unique')
+    .on(sql`${table.value} COLLATE NOCASE`)
+    .where(sql`${table.type} = 'email'`),
+]);
+
+// --- Auth ---
+
+const refreshTokens = sqliteTable('fortress_refresh_token', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  tokenHash: text('token_hash').notNull().unique(),
+  tokenFamily: text('token_family').notNull(),
+  familyCreatedAt: integer('family_created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+  successorTokenHash: text('successor_token_hash'),
+  rotatedAt: integer('rotated_at', { mode: 'timestamp' }),
+  isRevoked: integer('is_revoked', { mode: 'boolean' }).notNull().default(false),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  deviceName: text('device_name'),
+  lastActiveAt: integer('last_active_at', { mode: 'timestamp' }),
+  fingerprintHash: text('fingerprint_hash'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [
+  index('refresh_token_family_idx').on(table.tokenFamily),
+  index('refresh_token_user_idx').on(table.userId),
+]);
+
+const authContinuations = sqliteTable('fortress_auth_continuation', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  tokenHash: text('token_hash').notNull().unique(),
+  reason: text('reason').notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  consumedAt: integer('consumed_at', { mode: 'timestamp' }),
+  failedAttempts: integer('failed_attempts').notNull().default(0),
+  lastFailedAt: integer('last_failed_at', { mode: 'timestamp' }),
+  invalidatedAt: integer('invalidated_at', { mode: 'timestamp' }),
+  maxAttempts: integer('max_attempts').notNull().default(5),
+  cooldownSeconds: integer('cooldown_seconds').notNull().default(1),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [
+  index('auth_continuation_failure_idx').on(table.userId, table.reason, table.lastFailedAt),
+]);
+
+// --- IAM: Groups ---
+
+const groups = sqliteTable('fortress_group', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  name: text('name').notNull().unique(),
+  description: text('description'),
+});
+
+const groupUsers = sqliteTable(
+  'fortress_group_user',
+  {
+    groupId: integer('group_id').notNull().references(() => groups.id, { onDelete: 'cascade' }),
+    userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  },
+  table => [primaryKey({ columns: [table.groupId, table.userId] })],
+);
+
+// --- IAM: Service Accounts ---
+
+const serviceAccounts = sqliteTable('fortress_service_account', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  name: text('name').notNull().unique(),
+  displayName: text('display_name'),
+  description: text('description'),
+  isActive: integer('is_active', { mode: 'boolean' }).notNull().default(true),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// --- IAM: Resources & Permissions ---
+
+const resources = sqliteTable('fortress_resource', {
+  name: text('name').primaryKey(),
+  description: text('description'),
+});
+
+const permissions = sqliteTable('fortress_permission', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  resource: text('resource').notNull().references(() => resources.name, { onDelete: 'cascade' }),
+  action: text('action').notNull(),
+  effect: text('effect').notNull().default('ALLOW'), // 'ALLOW' | 'DENY'
+  conditions: text('conditions'), // JSON string of PermissionCondition[]
+  description: text('description'),
+}, table => [
+  // M8 fix: SQL UNIQUE treats two NULL `conditions` as distinct, so the
+  // plain unique() above lets `findOrCreatePermission` insert duplicate
+  // rows for the same (resource, action, effect, conditions=NULL) tuple
+  // under concurrency. Mirror the split-index pattern used for role /
+  // direct-permission bindings.
+  uniqueIndex('uniq_permission_no_conditions')
+    .on(table.resource, table.action, table.effect)
+    .where(sql`${table.conditions} is null`),
+  uniqueIndex('uniq_permission_with_conditions')
+    .on(table.resource, table.action, table.effect, table.conditions)
+    .where(sql`${table.conditions} is not null`),
+]);
+
+// --- IAM: Roles ---
+
+const roles = sqliteTable('fortress_role', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  name: text('name').notNull().unique(),
+  description: text('description'),
+  isSystem: integer('is_system', { mode: 'boolean' }).notNull().default(false),
+});
+
+const rolePermissions = sqliteTable(
+  'fortress_role_permission',
+  {
+    roleId: integer('role_id').notNull().references(() => roles.id, { onDelete: 'cascade' }),
+    permissionId: integer('permission_id').notNull().references(() => permissions.id, { onDelete: 'cascade' }),
+  },
+  table => [primaryKey({ columns: [table.roleId, table.permissionId] })],
+);
+
+// --- IAM: Role Bindings ---
+
+const roleBindings = sqliteTable('fortress_role_binding', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  roleId: integer('role_id').notNull().references(() => roles.id, { onDelete: 'cascade' }),
+  subjectType: text('subject_type').notNull(), // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer('subject_id').notNull(),
+  tenantId: text('tenant_id'),
+}, table => [
+  unique().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex('uniq_role_binding_global').on(table.roleId, table.subjectType, table.subjectId).where(sql`${table.tenantId} is null`),
+  uniqueIndex('uniq_role_binding_tenant').on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(sql`${table.tenantId} is not null`),
+  index('role_binding_subject_idx').on(table.subjectType, table.subjectId),
+]);
+
+// --- IAM: Direct Permission Bindings ---
+
+const directPermissionBindings = sqliteTable('fortress_direct_permission_binding', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  permissionId: integer('permission_id').notNull().references(() => permissions.id, { onDelete: 'cascade' }),
+  subjectType: text('subject_type').notNull(), // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer('subject_id').notNull(),
+  tenantId: text('tenant_id'),
+}, table => [
+  unique().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex('uniq_direct_permission_binding_global').on(table.permissionId, table.subjectType, table.subjectId).where(sql`${table.tenantId} is null`),
+  uniqueIndex('uniq_direct_permission_binding_tenant').on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(sql`${table.tenantId} is not null`),
+  index('direct_permission_binding_subject_idx').on(table.subjectType, table.subjectId),
+]);
+
+// --- Plugins: Email Verification ---
+
+const emailVerificationTokens = sqliteTable('fortress_email_verification_token', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  token: text('token').notNull(),
+  email: text('email').notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  usedAt: integer('used_at', { mode: 'timestamp' }),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [index('email_verification_token_token_idx').on(table.token)]);
+
+// --- Plugins: Magic Link ---
+
+const magicLinkTokens = sqliteTable('fortress_magic_link_token', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  email: text('email').notNull(),
+  token: text('token').notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  usedAt: integer('used_at', { mode: 'timestamp' }),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [index('magic_link_token_token_idx').on(table.token)]);
+
+// --- Plugins: API Key ---
+
+const apiKeys = sqliteTable('fortress_api_key', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  subjectType: text('subject_type').notNull(), // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: integer('subject_id').notNull(),
+  name: text('name').notNull(),
+  keyHash: text('key_hash').notNull().unique(),
+  keyPrefix: text('key_prefix').notNull(),
+  scopes: text('scopes'), // JSON array of "resource:action" strings
+  expiresAt: integer('expires_at', { mode: 'timestamp' }),
+  lastUsedAt: integer('last_used_at', { mode: 'timestamp' }),
+  isRevoked: integer('is_revoked', { mode: 'boolean' }).notNull().default(false),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [index('api_key_subject_idx').on(table.subjectType, table.subjectId)]);
+
+// --- Plugins: Two-Factor ---
+
+const twoFactorSecrets = sqliteTable('fortress_two_factor_secret', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().unique().references(() => users.id, { onDelete: 'cascade' }),
+  secret: text('secret').notNull(), // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: integer('is_enabled', { mode: 'boolean' }).notNull().default(false),
+  lastUsedCounter: integer('last_used_counter'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+const backupCodes = sqliteTable('fortress_backup_code', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  codeHash: text('code_hash').notNull(),
+  isUsed: integer('is_used', { mode: 'boolean' }).notNull().default(false),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [index('backup_code_user_idx').on(table.userId)]);
+
+const trustedDevices = sqliteTable('fortress_trusted_device', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: text('device_hash').notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  lastUsedAt: integer('last_used_at', { mode: 'timestamp' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [index('trusted_device_user_idx').on(table.userId)]);
+
+// --- Plugins: Social Login ---
+
+const socialAccounts = sqliteTable('fortress_social_account', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  provider: text('provider').notNull(),
+  providerAccountId: text('provider_account_id').notNull(),
+  email: text('email'),
+  accessToken: text('access_token'), // Encrypted
+  refreshToken: text('refresh_token'), // Encrypted
+  tokenExpiresAt: integer('token_expires_at', { mode: 'timestamp' }),
+  profile: text('profile'), // JSON
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [
+  unique().on(table.userId, table.provider),
+  unique().on(table.provider, table.providerAccountId),
+]);
+
+// --- Plugins: Tenancy ---
+
+const tenants = sqliteTable('fortress_tenant', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  name: text('name').notNull(),
+  taxId: text('tax_id').notNull().unique(),
+  description: text('description'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+const tenantUsers = sqliteTable(
+  'fortress_tenant_user',
+  {
+    tenantId: integer('tenant_id').notNull().references(() => tenants.id, { onDelete: 'cascade' }),
+    userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+    isDefault: integer('is_default', { mode: 'boolean' }).notNull().default(false),
+  },
+  table => [
+    primaryKey({ columns: [table.tenantId, table.userId] }),
+    uniqueIndex('fortress_tenant_user_one_default_idx')
+      .on(table.userId)
+      .where(sql`${table.isDefault} = true`),
+  ],
+);
+
+// --- Plugins: OAuth ---
+
+const oauthClients = sqliteTable('fortress_oauth_client', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  clientId: text('client_id').notNull().unique(),
+  clientSecretHash: text('client_secret_hash').notNull(),
+  name: text('name').notNull(),
+  redirectUris: text('redirect_uris').notNull(), // JSON array
+  grantTypes: text('grant_types').notNull(), // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: text('allowed_scopes'),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: text('token_endpoint_auth_method'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+const oauthAuthorizationCodes = sqliteTable('fortress_oauth_authorization_code', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  code: text('code').notNull().unique(),
+  clientId: text('client_id').notNull(),
+  userId: integer('user_id').notNull(),
+  redirectUri: text('redirect_uri').notNull(),
+  scope: text('scope'),
+  codeChallenge: text('code_challenge'),
+  codeChallengeMethod: text('code_challenge_method'),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: text('nonce'),
+  authTime: integer('auth_time'),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  usedAt: integer('used_at', { mode: 'timestamp' }),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+const oauthAccessTokens = sqliteTable('fortress_oauth_access_token', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  token: text('token').notNull().unique(),
+  clientId: text('client_id').notNull(),
+  userId: integer('user_id'),
+  scope: text('scope'),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// RFC 6749 §6 + RFC 9700 §2.2.2 refresh tokens with rotation.
+const oauthRefreshTokens = sqliteTable('fortress_oauth_refresh_token', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  token: text('token').notNull().unique(),
+  familyId: text('family_id').notNull(),
+  clientId: text('client_id').notNull(),
+  userId: integer('user_id').notNull(),
+  scope: text('scope'),
+  issuedAt: integer('issued_at', { mode: 'timestamp' }).notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  usedAt: integer('used_at', { mode: 'timestamp' }),
+  parentId: integer('parent_id'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+const oauthPendingFlows = sqliteTable('fortress_oauth_pending_flow', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  flowId: text('flow_id').notNull().unique(),
+  clientId: text('client_id').notNull(),
+  redirectUri: text('redirect_uri').notNull(),
+  scope: text('scope'),
+  state: text('state').notNull(),
+  codeChallenge: text('code_challenge'),
+  codeChallengeMethod: text('code_challenge_method'),
+  nonce: text('nonce'),
+  // H6 fix: subject the flow is bound to. Nullable for the
+  // login-redirect path which can't know the user up front — the
+  // first authenticated GetFlow / Approve claims it.
+  userId: integer('user_id'),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: integer('used_at', { mode: 'timestamp' }),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// OIDC Core / RFC 7517: id_token signing keys (RS256). Active key has
+// rotatedAt == null; rotated keys are kept for the JWKS verification grace
+// window.
+const oauthSigningKeys = sqliteTable('fortress_oauth_signing_key', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  kid: text('kid').notNull().unique(),
+  alg: text('alg').notNull(),
+  publicJwk: text('public_jwk').notNull(),
+  privateJwk: text('private_jwk').notNull(),
+  rotatedAt: integer('rotated_at', { mode: 'timestamp' }),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// --- Plugins: Data Isolation ---
+
+const userScopeAssignments = sqliteTable('fortress_user_scope_assignment', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  scopeName: text('scope_name').notNull(),
+  scopeValue: text('scope_value').notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// --- Plugins: Account Lockout ---
+
+const accountLockouts = sqliteTable('fortress_account_lockout', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  identifier: text('identifier').notNull().unique(),
+  failedAttempts: integer('failed_attempts').notNull().default(0),
+  lastFailedAt: integer('last_failed_at', { mode: 'timestamp' }),
+  lockedUntil: integer('locked_until', { mode: 'timestamp' }),
+  lockoutCount: integer('lockout_count').notNull().default(0),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// --- Core: Audit Log ---
+
+const auditLogs = sqliteTable('fortress_audit_log', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  timestamp: integer('timestamp', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+  eventType: text('event_type').notNull(),
+  actorId: integer('actor_id'),
+  actorType: text('actor_type').notNull().default('USER'),
+  targetId: integer('target_id'),
+  targetType: text('target_type'),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  outcome: text('outcome').notNull().default('SUCCESS'),
+  metadata: text('metadata'),
+  previousHash: text('previous_hash'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [index('audit_log_timestamp_idx').on(table.timestamp)]);
+
+const auditChainState = sqliteTable('fortress_audit_chain_state', {
+  id: integer('id').primaryKey(),
+  lastHash: text('last_hash'),
+  entryCount: integer('entry_count').notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// --- Plugins: Webhook ---
+
+const webhookEndpoints = sqliteTable('fortress_webhook_endpoint', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  url: text('url').notNull(),
+  events: text('events').notNull(), // JSON array
+  secret: text('secret').notNull(),
+  isActive: integer('is_active', { mode: 'boolean' }).notNull().default(true),
+  deactivatedReason: text('deactivated_reason'),
+  consecutiveFailures: integer('consecutive_failures').notNull().default(0),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+const webhookDeliveries = sqliteTable('fortress_webhook_delivery', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  endpointId: integer('endpoint_id').notNull().references(() => webhookEndpoints.id, { onDelete: 'cascade' }),
+  eventType: text('event_type').notNull(),
+  payload: text('payload').notNull(), // JSON
+  status: text('status').notNull().default('pending'), // pending | success | failed
+  attempts: integer('attempts').notNull().default(0),
+  idempotencyKey: text('idempotency_key'),
+  lastAttemptAt: integer('last_attempt_at', { mode: 'timestamp' }),
+  nextRetryAt: integer('next_retry_at', { mode: 'timestamp' }),
+  responseStatus: integer('response_status'),
+  responseBody: text('response_body'),
+  errorKind: text('error_kind'),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+}, table => [
+  uniqueIndex('uniq_webhook_delivery_idempotency').on(table.endpointId, table.idempotencyKey).where(sql`${table.idempotencyKey} is not null`),
+  index('webhook_delivery_retry_idx').on(table.status, table.nextRetryAt),
+]);
+
+// --- Plugins: WebAuthn ---
+
+const webauthnCredentials = sqliteTable('fortress_webauthn_credential', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  userId: integer('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  credentialId: text('credential_id').notNull().unique(),
+  publicKey: text('public_key').notNull(),
+  counter: integer('counter').notNull().default(0),
+  deviceType: text('device_type').notNull(),
+  backedUp: integer('backed_up', { mode: 'boolean' }).notNull().default(false),
+  transports: text('transports'), // JSON array
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+const webauthnChallenges = sqliteTable('fortress_webauthn_challenge', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  challenge: text('challenge').notNull().unique(),
+  userId: integer('user_id'),
+  expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+
+// --- All tables for easy iteration ---
+
+/**
+ * Aggregate of every Drizzle SQLite table fortress uses.
+ *
+ * Typed as `Record<string, AnySQLiteTable>` so JSR can statically resolve
+ * the public API without recursing through Drizzle's complex generic
+ * column types. The fortress drizzle adapter accesses tables generically,
+ * so column-level inference is not needed internally. Consumers who need
+ * column-level types should declare their own typed Drizzle schema and
+ * pass it via `createDrizzleAdapter(db, { tables })`.
+ */
+export const fortressSchema: Record<string, AnySQLiteTable> = {
+  schemaVersion,
+  users,
+  loginIdentifiers,
+  refreshTokens,
+  authContinuations,
+  groups,
+  groupUsers,
+  serviceAccounts,
+  resources,
+  permissions,
+  roles,
+  rolePermissions,
+  roleBindings,
+  directPermissionBindings,
+  emailVerificationTokens,
+  magicLinkTokens,
+  apiKeys,
+  twoFactorSecrets,
+  backupCodes,
+  trustedDevices,
+  socialAccounts,
+  tenants,
+  tenantUsers,
+  oauthClients,
+  oauthAuthorizationCodes,
+  oauthAccessTokens,
+  oauthRefreshTokens,
+  oauthPendingFlows,
+  oauthSigningKeys,
+  userScopeAssignments,
+  accountLockouts,
+  auditLogs,
+  auditChainState,
+  webhookEndpoints,
+  webhookDeliveries,
+  webauthnCredentials,
+  webauthnChallenges,
+};

package/src/drizzle/sqlite-serialization.test.ts

@@ -0,0 +1,106 @@
+/**
+ * Regression tests for finding #16: standalone (non-transaction) SQLite ops
+ * must serialize on the same async chain as `transaction()`, so a plain write
+ * issued while a transaction is mid-BEGIN…COMMIT on the single shared
+ * connection can never interleave into that open transaction and be swept away
+ * by its ROLLBACK.
+ */
+
+import type { DatabaseAdapter } from '../adapters/database';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createTestAdapter } from '../testing';
+
+/** Build a `create()` argument for a user row keyed by email. */
+function newUser(email: string): { model: string; data: Record<string, unknown> } {
+  return { model: 'user', data: { email, name: email, passwordHash: 'h', isActive: true } };
+}
+
+async function findUser(db: DatabaseAdapter, email: string): Promise<unknown> {
+  return db.findOne({ model: 'user', where: [{ field: 'email', operator: '=', value: email }] });
+}
+
+describe('sqlite non-transactional op serialization (#16)', () => {
+  let db: DatabaseAdapter;
+
+  beforeEach(() => {
+    db = createTestAdapter();
+  });
+
+  it('does not sweep a concurrent standalone write into an aborting transaction ROLLBACK', async () => {
+    // The transaction writes a row, awaits, then aborts. A standalone write is
+    // fired WHILE the transaction is open. Without serialization the standalone
+    // INSERT runs on the same connection inside the open transaction and gets
+    // rolled back.
+    const txPromise = db.transaction(async (tx) => {
+      await tx.create(newUser('tx@example.com'));
+      await new Promise(resolve => setTimeout(resolve, 40));
+      throw new Error('forced abort');
+    }).catch((err: unknown) => err);
+
+    // Wait until the transaction has actually opened (its BEGIN IMMEDIATE
+    // microtask + first insert have run) before firing the standalone. Firing
+    // it on the same tick would let better-sqlite3's synchronous INSERT
+    // autocommit BEFORE the deferred BEGIN, so it could never be swept and the
+    // test would pass even without the fix (a tautology).
+    await new Promise(resolve => setTimeout(resolve, 10));
+
+    const standalone = db.create(newUser('standalone@example.com'));
+
+    await Promise.all([txPromise, standalone]);
+
+    // The transaction's own row was rolled back…
+    expect(await findUser(db, 'tx@example.com')).toBeNull();
+    // …but the concurrent standalone write survived (it was serialized, not
+    // captured by the ROLLBACK).
+    expect(await findUser(db, 'standalone@example.com')).not.toBeNull();
+  });
+
+  it('commits a concurrent standalone write alongside a committing transaction', async () => {
+    const txPromise = db.transaction(async (tx) => {
+      await tx.create(newUser('tx-ok@example.com'));
+      await new Promise(resolve => setTimeout(resolve, 40));
+    });
+
+    // Fire the standalone while the transaction is open (see the abort test).
+    await new Promise(resolve => setTimeout(resolve, 10));
+    const standalone = db.create(newUser('standalone-ok@example.com'));
+
+    await Promise.all([txPromise, standalone]);
+
+    expect(await findUser(db, 'tx-ok@example.com')).not.toBeNull();
+    expect(await findUser(db, 'standalone-ok@example.com')).not.toBeNull();
+  });
+
+  it('runs ops inside a transaction callback without deadlocking and commits them atomically', async () => {
+    await db.transaction(async (tx) => {
+      await tx.create(newUser('nested-a@example.com'));
+      await tx.create(newUser('nested-b@example.com'));
+      // A read inside the callback must also run directly on the open tx, not
+      // queue behind it (which would deadlock).
+      const seen = await tx.findOne({ model: 'user', where: [{ field: 'email', operator: '=', value: 'nested-a@example.com' }] });
+      expect(seen).not.toBeNull();
+    });
+
+    expect(await findUser(db, 'nested-a@example.com')).not.toBeNull();
+    expect(await findUser(db, 'nested-b@example.com')).not.toBeNull();
+  });
+
+  it('rolls back every op issued inside an aborting transaction callback', async () => {
+    await db.transaction(async (tx) => {
+      await tx.create(newUser('rollback-a@example.com'));
+      await tx.create(newUser('rollback-b@example.com'));
+      throw new Error('boom');
+    }).catch(() => undefined);
+
+    expect(await findUser(db, 'rollback-a@example.com')).toBeNull();
+    expect(await findUser(db, 'rollback-b@example.com')).toBeNull();
+  });
+
+  it('serializes many concurrent standalone writes without deadlock or loss', async () => {
+    await Promise.all(
+      Array.from({ length: 12 }, (_, i) => db.create(newUser(`bulk-${i}@example.com`))),
+    );
+
+    expect(await db.count({ model: 'user' })).toBe(12);
+  });
+});