@bajustone/fortress 1.0.0-rc.1

package/dist/testing.js

@@ -0,0 +1,4264 @@
+// src/testing/index.ts
+import { createRequire } from "module";
+import { resolve } from "path";
+
+// src/core/auth/email.ts
+function normalizeEmail(email2) {
+  return email2.toLowerCase().normalize("NFC");
+}
+
+// src/core/migrations/migrations.ts
+var SQLITE_0001_UP = `
+CREATE TABLE IF NOT EXISTS fortress_schema_version (
+  id INTEGER PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+  version INTEGER NOT NULL,
+  applied_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+`.trim();
+var SQLITE_0001_DOWN = `
+DROP TABLE IF EXISTS fortress_schema_version;
+`.trim();
+var PG_0001_UP = `
+CREATE TABLE IF NOT EXISTS fortress_schema_version (
+  id integer PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+  version integer NOT NULL,
+  applied_at timestamp NOT NULL DEFAULT now()
+);
+`.trim();
+var PG_0001_DOWN = `
+DROP TABLE IF EXISTS fortress_schema_version;
+`.trim();
+var SQLITE_0002_UP = `
+CREATE TABLE IF NOT EXISTS fortress_user (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL UNIQUE,
+  name TEXT NOT NULL,
+  password_hash TEXT,
+  is_active INTEGER NOT NULL DEFAULT 1,
+  email_verified INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_login_identifier (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  type TEXT NOT NULL,
+  value TEXT NOT NULL UNIQUE
+);
+
+CREATE TABLE IF NOT EXISTS fortress_refresh_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  token_family TEXT NOT NULL,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at INTEGER NOT NULL,
+  ip_address TEXT,
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at INTEGER,
+  fingerprint_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL UNIQUE,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group_user (
+  group_id INTEGER NOT NULL REFERENCES fortress_group(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  PRIMARY KEY (group_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_service_account (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL UNIQUE,
+  display_name TEXT,
+  description TEXT,
+  is_active INTEGER NOT NULL DEFAULT 1,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_resource (
+  name TEXT PRIMARY KEY,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_permission (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  resource TEXT NOT NULL REFERENCES fortress_resource(name) ON DELETE CASCADE,
+  action TEXT NOT NULL,
+  effect TEXT NOT NULL DEFAULT 'ALLOW',
+  conditions TEXT,
+  description TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_no_conditions
+  ON fortress_permission (resource, action, effect)
+  WHERE conditions IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_with_conditions
+  ON fortress_permission (resource, action, effect, conditions)
+  WHERE conditions IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_role (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL UNIQUE,
+  description TEXT,
+  is_system INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_permission (
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  PRIMARY KEY (role_id, permission_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_binding (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  subject_type TEXT NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id TEXT,
+  UNIQUE (role_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_global
+  ON fortress_role_binding (role_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_tenant
+  ON fortress_role_binding (role_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_direct_permission_binding (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  subject_type TEXT NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id TEXT,
+  UNIQUE (permission_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_global
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_tenant
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_email_verification_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token TEXT NOT NULL,
+  email TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_magic_link_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL,
+  token TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_api_key (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  subject_type TEXT NOT NULL,
+  subject_id INTEGER NOT NULL,
+  name TEXT NOT NULL,
+  key_hash TEXT NOT NULL UNIQUE,
+  key_prefix TEXT NOT NULL,
+  scopes TEXT,
+  expires_at INTEGER,
+  last_used_at INTEGER,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+CREATE INDEX IF NOT EXISTS api_key_subject_idx ON fortress_api_key (subject_type, subject_id);
+
+CREATE TABLE IF NOT EXISTS fortress_two_factor_secret (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL UNIQUE REFERENCES fortress_user(id) ON DELETE CASCADE,
+  secret TEXT NOT NULL,
+  is_enabled INTEGER NOT NULL DEFAULT 0,
+  last_used_counter INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_backup_code (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  code_hash TEXT NOT NULL,
+  is_used INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_trusted_device (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  device_hash TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  last_used_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_social_account (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL,
+  provider_account_id TEXT NOT NULL,
+  email TEXT,
+  access_token TEXT,
+  refresh_token TEXT,
+  token_expires_at INTEGER,
+  profile TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  UNIQUE (user_id, provider),
+  UNIQUE (provider, provider_account_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL,
+  tax_id TEXT NOT NULL UNIQUE,
+  description TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant_user (
+  tenant_id INTEGER NOT NULL REFERENCES fortress_tenant(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  is_default INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (tenant_id, user_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id) WHERE is_default = 1;
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_client (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  client_id TEXT NOT NULL UNIQUE,
+  client_secret_hash TEXT NOT NULL,
+  name TEXT NOT NULL,
+  redirect_uris TEXT NOT NULL,
+  grant_types TEXT NOT NULL,
+  allowed_scopes TEXT,
+  token_endpoint_auth_method TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_authorization_code (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  code TEXT NOT NULL UNIQUE,
+  client_id TEXT NOT NULL,
+  user_id INTEGER NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  nonce TEXT,
+  auth_time INTEGER,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_access_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  token TEXT NOT NULL UNIQUE,
+  client_id TEXT NOT NULL,
+  user_id INTEGER,
+  scope TEXT,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_refresh_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  token TEXT NOT NULL UNIQUE,
+  family_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id INTEGER NOT NULL,
+  scope TEXT,
+  issued_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  parent_id INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_pending_flow (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  flow_id TEXT NOT NULL UNIQUE,
+  client_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  state TEXT NOT NULL,
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  nonce TEXT,
+  user_id INTEGER,
+  used_at INTEGER,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_signing_key (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  kid TEXT NOT NULL UNIQUE,
+  alg TEXT NOT NULL,
+  public_jwk TEXT NOT NULL,
+  private_jwk TEXT NOT NULL,
+  rotated_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_user_scope_assignment (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  scope_name TEXT NOT NULL,
+  scope_value TEXT NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_account_lockout (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  identifier TEXT NOT NULL UNIQUE,
+  failed_attempts INTEGER NOT NULL DEFAULT 0,
+  last_failed_at INTEGER,
+  locked_until INTEGER,
+  lockout_count INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_audit_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  timestamp INTEGER NOT NULL DEFAULT (unixepoch()),
+  event_type TEXT NOT NULL,
+  actor_id INTEGER,
+  actor_type TEXT NOT NULL DEFAULT 'USER',
+  target_id INTEGER,
+  target_type TEXT,
+  ip_address TEXT,
+  user_agent TEXT,
+  outcome TEXT NOT NULL DEFAULT 'SUCCESS',
+  metadata TEXT,
+  previous_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_endpoint (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  url TEXT NOT NULL,
+  events TEXT NOT NULL,
+  secret TEXT NOT NULL,
+  is_active INTEGER NOT NULL DEFAULT 1,
+  deactivated_reason TEXT,
+  consecutive_failures INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_delivery (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  endpoint_id INTEGER NOT NULL REFERENCES fortress_webhook_endpoint(id) ON DELETE CASCADE,
+  event_type TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  attempts INTEGER NOT NULL DEFAULT 0,
+  idempotency_key TEXT,
+  last_attempt_at INTEGER,
+  next_retry_at INTEGER,
+  response_status INTEGER,
+  response_body TEXT,
+  error_kind TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_webhook_delivery_idempotency
+  ON fortress_webhook_delivery (endpoint_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_credential (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  credential_id TEXT NOT NULL UNIQUE,
+  public_key TEXT NOT NULL,
+  counter INTEGER NOT NULL DEFAULT 0,
+  device_type TEXT NOT NULL,
+  backed_up INTEGER NOT NULL DEFAULT 0,
+  transports TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_challenge (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  challenge TEXT NOT NULL UNIQUE,
+  user_id INTEGER,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+`.trim();
+var SQLITE_0002_DOWN = `
+DROP TABLE IF EXISTS fortress_webauthn_challenge;
+DROP TABLE IF EXISTS fortress_webauthn_credential;
+DROP TABLE IF EXISTS fortress_webhook_delivery;
+DROP TABLE IF EXISTS fortress_webhook_endpoint;
+DROP TABLE IF EXISTS fortress_audit_log;
+DROP TABLE IF EXISTS fortress_account_lockout;
+DROP TABLE IF EXISTS fortress_user_scope_assignment;
+DROP TABLE IF EXISTS fortress_oauth_signing_key;
+DROP TABLE IF EXISTS fortress_oauth_pending_flow;
+DROP TABLE IF EXISTS fortress_oauth_refresh_token;
+DROP TABLE IF EXISTS fortress_oauth_access_token;
+DROP TABLE IF EXISTS fortress_oauth_authorization_code;
+DROP TABLE IF EXISTS fortress_oauth_client;
+DROP TABLE IF EXISTS fortress_tenant_user;
+DROP TABLE IF EXISTS fortress_tenant;
+DROP TABLE IF EXISTS fortress_social_account;
+DROP TABLE IF EXISTS fortress_trusted_device;
+DROP TABLE IF EXISTS fortress_backup_code;
+DROP TABLE IF EXISTS fortress_two_factor_secret;
+DROP TABLE IF EXISTS fortress_api_key;
+DROP TABLE IF EXISTS fortress_magic_link_token;
+DROP TABLE IF EXISTS fortress_email_verification_token;
+DROP TABLE IF EXISTS fortress_direct_permission_binding;
+DROP TABLE IF EXISTS fortress_role_binding;
+DROP TABLE IF EXISTS fortress_role_permission;
+DROP TABLE IF EXISTS fortress_role;
+DROP TABLE IF EXISTS fortress_permission;
+DROP TABLE IF EXISTS fortress_resource;
+DROP TABLE IF EXISTS fortress_service_account;
+DROP TABLE IF EXISTS fortress_group_user;
+DROP TABLE IF EXISTS fortress_group;
+DROP TABLE IF EXISTS fortress_refresh_token;
+DROP TABLE IF EXISTS fortress_login_identifier;
+DROP TABLE IF EXISTS fortress_user;
+`.trim();
+var PG_0002_UP = `
+CREATE TABLE IF NOT EXISTS fortress_user (
+  id SERIAL PRIMARY KEY,
+  email VARCHAR(255) NOT NULL UNIQUE,
+  name VARCHAR(255) NOT NULL,
+  password_hash TEXT,
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  email_verified BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_login_identifier (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  type VARCHAR(20) NOT NULL,
+  value VARCHAR(255) NOT NULL UNIQUE
+);
+
+CREATE TABLE IF NOT EXISTS fortress_refresh_token (
+  id BIGSERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash VARCHAR(64) NOT NULL UNIQUE,
+  token_family VARCHAR(64) NOT NULL,
+  is_revoked BOOLEAN NOT NULL DEFAULT false,
+  expires_at TIMESTAMP NOT NULL,
+  ip_address VARCHAR(45),
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at TIMESTAMP,
+  fingerprint_hash VARCHAR(64),
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL UNIQUE,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group_user (
+  group_id INTEGER NOT NULL REFERENCES fortress_group(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  PRIMARY KEY (group_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_service_account (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL UNIQUE,
+  display_name VARCHAR(255),
+  description TEXT,
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_resource (
+  name VARCHAR(100) PRIMARY KEY,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_permission (
+  id SERIAL PRIMARY KEY,
+  resource VARCHAR(100) NOT NULL REFERENCES fortress_resource(name) ON DELETE CASCADE,
+  action VARCHAR(100) NOT NULL,
+  effect VARCHAR(10) NOT NULL DEFAULT 'ALLOW',
+  conditions JSONB,
+  description TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_no_conditions
+  ON fortress_permission (resource, action, effect)
+  WHERE conditions IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_with_conditions
+  ON fortress_permission (resource, action, effect, conditions)
+  WHERE conditions IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_role (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL UNIQUE,
+  description TEXT,
+  is_system BOOLEAN NOT NULL DEFAULT false
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_permission (
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  PRIMARY KEY (role_id, permission_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_binding (
+  id SERIAL PRIMARY KEY,
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  subject_type VARCHAR(20) NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id VARCHAR(100),
+  UNIQUE (role_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_global
+  ON fortress_role_binding (role_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_tenant
+  ON fortress_role_binding (role_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_direct_permission_binding (
+  id SERIAL PRIMARY KEY,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  subject_type VARCHAR(20) NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id VARCHAR(100),
+  UNIQUE (permission_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_global
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_tenant
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_email_verification_token (
+  id BIGSERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token TEXT NOT NULL,
+  email VARCHAR(255) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_magic_link_token (
+  id BIGSERIAL PRIMARY KEY,
+  email VARCHAR(255) NOT NULL,
+  token VARCHAR(64) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_api_key (
+  id SERIAL PRIMARY KEY,
+  subject_type VARCHAR(20) NOT NULL,
+  subject_id INTEGER NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  key_hash VARCHAR(64) NOT NULL UNIQUE,
+  key_prefix VARCHAR(20) NOT NULL,
+  scopes TEXT,
+  expires_at TIMESTAMP,
+  last_used_at TIMESTAMP,
+  is_revoked BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS api_key_subject_idx ON fortress_api_key (subject_type, subject_id);
+
+CREATE TABLE IF NOT EXISTS fortress_two_factor_secret (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL UNIQUE REFERENCES fortress_user(id) ON DELETE CASCADE,
+  secret TEXT NOT NULL,
+  is_enabled BOOLEAN NOT NULL DEFAULT false,
+  last_used_counter INTEGER,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_backup_code (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  code_hash TEXT NOT NULL,
+  is_used BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_trusted_device (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  device_hash VARCHAR(64) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  last_used_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_social_account (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  provider VARCHAR(50) NOT NULL,
+  provider_account_id VARCHAR(255) NOT NULL,
+  email VARCHAR(255),
+  access_token TEXT,
+  refresh_token TEXT,
+  token_expires_at TIMESTAMP,
+  profile JSONB,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now(),
+  UNIQUE (user_id, provider),
+  UNIQUE (provider, provider_account_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(255) NOT NULL,
+  tax_id VARCHAR(100) NOT NULL UNIQUE,
+  description TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant_user (
+  tenant_id INTEGER NOT NULL REFERENCES fortress_tenant(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  is_default BOOLEAN NOT NULL DEFAULT false,
+  PRIMARY KEY (tenant_id, user_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id) WHERE is_default = true;
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_client (
+  id SERIAL PRIMARY KEY,
+  client_id VARCHAR(255) NOT NULL UNIQUE,
+  client_secret_hash TEXT NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  redirect_uris TEXT NOT NULL,
+  grant_types TEXT NOT NULL,
+  allowed_scopes TEXT,
+  token_endpoint_auth_method TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_authorization_code (
+  id BIGSERIAL PRIMARY KEY,
+  code VARCHAR(255) NOT NULL UNIQUE,
+  client_id VARCHAR(255) NOT NULL,
+  user_id INTEGER NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  code_challenge TEXT,
+  code_challenge_method VARCHAR(10),
+  nonce TEXT,
+  auth_time INTEGER,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_access_token (
+  id BIGSERIAL PRIMARY KEY,
+  token VARCHAR(255) NOT NULL UNIQUE,
+  client_id VARCHAR(255) NOT NULL,
+  user_id INTEGER,
+  scope TEXT,
+  expires_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_refresh_token (
+  id BIGSERIAL PRIMARY KEY,
+  token VARCHAR(255) NOT NULL UNIQUE,
+  family_id VARCHAR(64) NOT NULL,
+  client_id VARCHAR(255) NOT NULL,
+  user_id INTEGER NOT NULL,
+  scope TEXT,
+  issued_at TIMESTAMP NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  parent_id INTEGER,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_pending_flow (
+  id BIGSERIAL PRIMARY KEY,
+  flow_id TEXT NOT NULL UNIQUE,
+  client_id VARCHAR(255) NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  state VARCHAR(255) NOT NULL,
+  code_challenge TEXT,
+  code_challenge_method VARCHAR(10),
+  nonce TEXT,
+  user_id INTEGER,
+  used_at TIMESTAMP,
+  expires_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_signing_key (
+  id SERIAL PRIMARY KEY,
+  kid VARCHAR(64) NOT NULL UNIQUE,
+  alg VARCHAR(16) NOT NULL,
+  public_jwk TEXT NOT NULL,
+  private_jwk TEXT NOT NULL,
+  rotated_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_user_scope_assignment (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  scope_name VARCHAR(100) NOT NULL,
+  scope_value VARCHAR(255) NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_account_lockout (
+  id SERIAL PRIMARY KEY,
+  identifier VARCHAR(255) NOT NULL UNIQUE,
+  failed_attempts INTEGER NOT NULL DEFAULT 0,
+  last_failed_at TIMESTAMP,
+  locked_until TIMESTAMP,
+  lockout_count INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_audit_log (
+  id BIGSERIAL PRIMARY KEY,
+  timestamp TIMESTAMP NOT NULL DEFAULT now(),
+  event_type VARCHAR(100) NOT NULL,
+  actor_id INTEGER,
+  actor_type VARCHAR(20) NOT NULL DEFAULT 'USER',
+  target_id INTEGER,
+  target_type VARCHAR(50),
+  ip_address VARCHAR(45),
+  user_agent TEXT,
+  outcome VARCHAR(20) NOT NULL DEFAULT 'SUCCESS',
+  metadata JSONB,
+  previous_hash TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_endpoint (
+  id SERIAL PRIMARY KEY,
+  url TEXT NOT NULL,
+  events TEXT NOT NULL,
+  secret TEXT NOT NULL,
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  deactivated_reason TEXT,
+  consecutive_failures INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_delivery (
+  id BIGSERIAL PRIMARY KEY,
+  endpoint_id INTEGER NOT NULL REFERENCES fortress_webhook_endpoint(id) ON DELETE CASCADE,
+  event_type VARCHAR(100) NOT NULL,
+  payload TEXT NOT NULL,
+  status VARCHAR(20) NOT NULL DEFAULT 'pending',
+  attempts INTEGER NOT NULL DEFAULT 0,
+  idempotency_key TEXT,
+  last_attempt_at TIMESTAMP,
+  next_retry_at TIMESTAMP,
+  response_status INTEGER,
+  response_body TEXT,
+  error_kind TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_webhook_delivery_idempotency
+  ON fortress_webhook_delivery (endpoint_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_credential (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  credential_id TEXT NOT NULL UNIQUE,
+  public_key TEXT NOT NULL,
+  counter INTEGER NOT NULL DEFAULT 0,
+  device_type VARCHAR(20) NOT NULL,
+  backed_up BOOLEAN NOT NULL DEFAULT false,
+  transports TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_challenge (
+  id BIGSERIAL PRIMARY KEY,
+  challenge TEXT NOT NULL UNIQUE,
+  user_id INTEGER,
+  expires_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+`.trim();
+var PG_0002_DOWN = `
+DROP TABLE IF EXISTS fortress_webauthn_challenge CASCADE;
+DROP TABLE IF EXISTS fortress_webauthn_credential CASCADE;
+DROP TABLE IF EXISTS fortress_webhook_delivery CASCADE;
+DROP TABLE IF EXISTS fortress_webhook_endpoint CASCADE;
+DROP TABLE IF EXISTS fortress_audit_log CASCADE;
+DROP TABLE IF EXISTS fortress_account_lockout CASCADE;
+DROP TABLE IF EXISTS fortress_user_scope_assignment CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_signing_key CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_pending_flow CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_refresh_token CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_access_token CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_authorization_code CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_client CASCADE;
+DROP TABLE IF EXISTS fortress_tenant_user CASCADE;
+DROP TABLE IF EXISTS fortress_tenant CASCADE;
+DROP TABLE IF EXISTS fortress_social_account CASCADE;
+DROP TABLE IF EXISTS fortress_trusted_device CASCADE;
+DROP TABLE IF EXISTS fortress_backup_code CASCADE;
+DROP TABLE IF EXISTS fortress_two_factor_secret CASCADE;
+DROP TABLE IF EXISTS fortress_api_key CASCADE;
+DROP TABLE IF EXISTS fortress_magic_link_token CASCADE;
+DROP TABLE IF EXISTS fortress_email_verification_token CASCADE;
+DROP TABLE IF EXISTS fortress_direct_permission_binding CASCADE;
+DROP TABLE IF EXISTS fortress_role_binding CASCADE;
+DROP TABLE IF EXISTS fortress_role_permission CASCADE;
+DROP TABLE IF EXISTS fortress_role CASCADE;
+DROP TABLE IF EXISTS fortress_permission CASCADE;
+DROP TABLE IF EXISTS fortress_resource CASCADE;
+DROP TABLE IF EXISTS fortress_service_account CASCADE;
+DROP TABLE IF EXISTS fortress_group_user CASCADE;
+DROP TABLE IF EXISTS fortress_group CASCADE;
+DROP TABLE IF EXISTS fortress_refresh_token CASCADE;
+DROP TABLE IF EXISTS fortress_login_identifier CASCADE;
+DROP TABLE IF EXISTS fortress_user CASCADE;
+`.trim();
+var SQLITE_0003_UP = `
+CREATE TABLE fortress_refresh_token_v3 (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  token_family TEXT NOT NULL,
+  family_created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  successor_token_hash TEXT,
+  rotated_at INTEGER,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at INTEGER NOT NULL,
+  ip_address TEXT,
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at INTEGER,
+  fingerprint_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+INSERT INTO fortress_refresh_token_v3 (
+  id, user_id, token_hash, token_family, family_created_at,
+  successor_token_hash, rotated_at, is_revoked, expires_at, ip_address,
+  user_agent, device_name, last_active_at, fingerprint_hash, created_at
+)
+SELECT
+  token.id, token.user_id, token.token_hash, token.token_family,
+  (SELECT MIN(family.created_at)
+   FROM fortress_refresh_token AS family
+   WHERE family.token_family = token.token_family),
+  NULL, NULL, token.is_revoked, token.expires_at, token.ip_address,
+  token.user_agent, token.device_name, token.last_active_at,
+  token.fingerprint_hash, token.created_at
+FROM fortress_refresh_token AS token;
+DROP TABLE fortress_refresh_token;
+ALTER TABLE fortress_refresh_token_v3 RENAME TO fortress_refresh_token;
+
+CREATE TABLE fortress_auth_continuation (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  reason TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+`.trim();
+var SQLITE_0003_DOWN = `
+DROP TABLE IF EXISTS fortress_auth_continuation;
+CREATE TABLE fortress_refresh_token_v2 (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  token_family TEXT NOT NULL,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at INTEGER NOT NULL,
+  ip_address TEXT,
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at INTEGER,
+  fingerprint_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+INSERT INTO fortress_refresh_token_v2 (
+  id, user_id, token_hash, token_family, is_revoked, expires_at,
+  ip_address, user_agent, device_name, last_active_at, fingerprint_hash, created_at
+)
+SELECT
+  id, user_id, token_hash, token_family, is_revoked, expires_at,
+  ip_address, user_agent, device_name, last_active_at, fingerprint_hash, created_at
+FROM fortress_refresh_token;
+DROP TABLE fortress_refresh_token;
+ALTER TABLE fortress_refresh_token_v2 RENAME TO fortress_refresh_token;
+`.trim();
+var PG_0003_UP = `
+ALTER TABLE fortress_refresh_token
+  ADD COLUMN family_created_at TIMESTAMP;
+UPDATE fortress_refresh_token AS token
+  SET family_created_at = family.created_at
+  FROM (
+    SELECT token_family, MIN(created_at) AS created_at
+    FROM fortress_refresh_token
+    GROUP BY token_family
+  ) AS family
+  WHERE token.token_family = family.token_family;
+ALTER TABLE fortress_refresh_token
+  ALTER COLUMN family_created_at SET NOT NULL;
+ALTER TABLE fortress_refresh_token
+  ALTER COLUMN family_created_at SET DEFAULT now();
+ALTER TABLE fortress_refresh_token
+  ADD COLUMN successor_token_hash VARCHAR(64);
+ALTER TABLE fortress_refresh_token
+  ADD COLUMN rotated_at TIMESTAMP;
+
+CREATE TABLE fortress_auth_continuation (
+  id BIGSERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash VARCHAR(64) NOT NULL UNIQUE,
+  reason VARCHAR(32) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  consumed_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+`.trim();
+var PG_0003_DOWN = `
+DROP TABLE IF EXISTS fortress_auth_continuation CASCADE;
+ALTER TABLE fortress_refresh_token DROP COLUMN rotated_at;
+ALTER TABLE fortress_refresh_token DROP COLUMN successor_token_hash;
+ALTER TABLE fortress_refresh_token DROP COLUMN family_created_at;
+`.trim();
+var SQLITE_0004_UP = `
+UPDATE fortress_tenant_user
+SET is_default = 0
+WHERE is_default = 1
+  AND rowid NOT IN (
+    SELECT MIN(rowid)
+    FROM fortress_tenant_user
+    WHERE is_default = 1
+    GROUP BY user_id
+  );
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id)
+  WHERE is_default = 1;
+`.trim();
+var SQLITE_0004_DOWN = `
+DROP INDEX IF EXISTS fortress_tenant_user_one_default_idx;
+`.trim();
+var PG_0004_UP = `
+WITH ranked_defaults AS (
+  SELECT ctid, ROW_NUMBER() OVER (PARTITION BY user_id ORDER BY tenant_id) AS position
+  FROM fortress_tenant_user
+  WHERE is_default = true
+)
+UPDATE fortress_tenant_user AS membership
+SET is_default = false
+FROM ranked_defaults
+WHERE membership.ctid = ranked_defaults.ctid
+  AND ranked_defaults.position > 1;
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id)
+  WHERE is_default = true;
+`.trim();
+var PG_0004_DOWN = `
+DROP INDEX IF EXISTS fortress_tenant_user_one_default_idx;
+`.trim();
+var SQLITE_0005_UP = `
+CREATE INDEX refresh_token_family_idx ON fortress_refresh_token (token_family);
+CREATE INDEX refresh_token_user_idx ON fortress_refresh_token (user_id);
+CREATE INDEX email_verification_token_token_idx ON fortress_email_verification_token (token);
+CREATE INDEX magic_link_token_token_idx ON fortress_magic_link_token (token);
+CREATE INDEX role_binding_subject_idx ON fortress_role_binding (subject_type, subject_id);
+CREATE INDEX direct_permission_binding_subject_idx ON fortress_direct_permission_binding (subject_type, subject_id);
+CREATE INDEX backup_code_user_idx ON fortress_backup_code (user_id);
+CREATE INDEX trusted_device_user_idx ON fortress_trusted_device (user_id);
+CREATE INDEX webhook_delivery_retry_idx ON fortress_webhook_delivery (status, next_retry_at);
+CREATE INDEX audit_log_timestamp_idx ON fortress_audit_log (timestamp);
+`.trim();
+var SQLITE_0005_DOWN = `
+DROP INDEX IF EXISTS audit_log_timestamp_idx;
+DROP INDEX IF EXISTS webhook_delivery_retry_idx;
+DROP INDEX IF EXISTS trusted_device_user_idx;
+DROP INDEX IF EXISTS backup_code_user_idx;
+DROP INDEX IF EXISTS direct_permission_binding_subject_idx;
+DROP INDEX IF EXISTS role_binding_subject_idx;
+DROP INDEX IF EXISTS magic_link_token_token_idx;
+DROP INDEX IF EXISTS email_verification_token_token_idx;
+DROP INDEX IF EXISTS refresh_token_user_idx;
+DROP INDEX IF EXISTS refresh_token_family_idx;
+`.trim();
+var PG_0005_UP = `
+CREATE INDEX refresh_token_family_idx ON fortress_refresh_token (token_family);
+CREATE INDEX refresh_token_user_idx ON fortress_refresh_token (user_id);
+CREATE INDEX email_verification_token_token_idx ON fortress_email_verification_token (token);
+CREATE INDEX magic_link_token_token_idx ON fortress_magic_link_token (token);
+CREATE INDEX role_binding_subject_idx ON fortress_role_binding (subject_type, subject_id);
+CREATE INDEX direct_permission_binding_subject_idx ON fortress_direct_permission_binding (subject_type, subject_id);
+CREATE INDEX backup_code_user_idx ON fortress_backup_code (user_id);
+CREATE INDEX trusted_device_user_idx ON fortress_trusted_device (user_id);
+CREATE INDEX webhook_delivery_retry_idx ON fortress_webhook_delivery (status, next_retry_at);
+CREATE INDEX audit_log_timestamp_idx ON fortress_audit_log (timestamp);
+
+ALTER TABLE fortress_schema_version ALTER COLUMN applied_at TYPE TIMESTAMPTZ USING applied_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN family_created_at TYPE TIMESTAMPTZ USING family_created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN rotated_at TYPE TIMESTAMPTZ USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN last_active_at TYPE TIMESTAMPTZ USING last_active_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN consumed_at TYPE TIMESTAMPTZ USING consumed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN last_used_at TYPE TIMESTAMPTZ USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_two_factor_secret ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_backup_code ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN last_used_at TYPE TIMESTAMPTZ USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN token_expires_at TYPE TIMESTAMPTZ USING token_expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_client ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN issued_at TYPE TIMESTAMPTZ USING issued_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN rotated_at TYPE TIMESTAMPTZ USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user_scope_assignment ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN last_failed_at TYPE TIMESTAMPTZ USING last_failed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN locked_until TYPE TIMESTAMPTZ USING locked_until AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN timestamp TYPE TIMESTAMPTZ USING timestamp AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_endpoint ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN last_attempt_at TYPE TIMESTAMPTZ USING last_attempt_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN next_retry_at TYPE TIMESTAMPTZ USING next_retry_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_credential ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+`.trim();
+var PG_0005_DOWN = `
+ALTER TABLE fortress_schema_version ALTER COLUMN applied_at TYPE TIMESTAMP USING applied_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN family_created_at TYPE TIMESTAMP USING family_created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN rotated_at TYPE TIMESTAMP USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN last_active_at TYPE TIMESTAMP USING last_active_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN consumed_at TYPE TIMESTAMP USING consumed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN last_used_at TYPE TIMESTAMP USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_two_factor_secret ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_backup_code ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN last_used_at TYPE TIMESTAMP USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN token_expires_at TYPE TIMESTAMP USING token_expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_client ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN issued_at TYPE TIMESTAMP USING issued_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN rotated_at TYPE TIMESTAMP USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user_scope_assignment ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN last_failed_at TYPE TIMESTAMP USING last_failed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN locked_until TYPE TIMESTAMP USING locked_until AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN timestamp TYPE TIMESTAMP USING timestamp AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_endpoint ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN last_attempt_at TYPE TIMESTAMP USING last_attempt_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN next_retry_at TYPE TIMESTAMP USING next_retry_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_credential ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+
+DROP INDEX IF EXISTS audit_log_timestamp_idx;
+DROP INDEX IF EXISTS webhook_delivery_retry_idx;
+DROP INDEX IF EXISTS trusted_device_user_idx;
+DROP INDEX IF EXISTS backup_code_user_idx;
+DROP INDEX IF EXISTS direct_permission_binding_subject_idx;
+DROP INDEX IF EXISTS role_binding_subject_idx;
+DROP INDEX IF EXISTS magic_link_token_token_idx;
+DROP INDEX IF EXISTS email_verification_token_token_idx;
+DROP INDEX IF EXISTS refresh_token_user_idx;
+DROP INDEX IF EXISTS refresh_token_family_idx;
+`.trim();
+async function normalizeExistingUserEmails(db) {
+  const users3 = await db.findMany({
+    model: "user",
+    sortBy: { field: "id", direction: "asc" }
+  });
+  const identifiers = await db.findMany({
+    model: "login_identifier",
+    sortBy: { field: "id", direction: "asc" }
+  });
+  const groups3 = /* @__PURE__ */ new Map();
+  const usedCanonicalEmails = /* @__PURE__ */ new Set([
+    ...users3.map((user) => normalizeEmail(user.email)),
+    ...identifiers.map((identifier) => normalizeEmail(identifier.value))
+  ]);
+  for (const user of users3) {
+    const canonical = normalizeEmail(user.email);
+    const group = groups3.get(canonical) ?? [];
+    group.push(user);
+    groups3.set(canonical, group);
+  }
+  const tombstoneFor = (id2) => {
+    let attempt = 0;
+    let value = `fortress-duplicate-${id2}@invalid`;
+    while (usedCanonicalEmails.has(normalizeEmail(value))) {
+      attempt++;
+      value = `fortress-duplicate-${id2}-${attempt}@invalid`;
+    }
+    usedCanonicalEmails.add(normalizeEmail(value));
+    return value;
+  };
+  const duplicateUserIds = /* @__PURE__ */ new Set();
+  const primaryOwnerByCanonical = /* @__PURE__ */ new Map();
+  for (const [canonical, matches] of groups3) {
+    const [survivor, ...duplicates] = matches;
+    primaryOwnerByCanonical.set(canonical, survivor.id);
+    for (const duplicate of duplicates) {
+      duplicateUserIds.add(duplicate.id);
+      const tombstone = tombstoneFor(duplicate.id);
+      await db.update({
+        model: "refresh_token",
+        where: [{ field: "userId", operator: "=", value: duplicate.id }],
+        data: { isRevoked: true }
+      });
+      for (const model of [
+        "oauth_refresh_token",
+        "oauth_access_token",
+        "oauth_authorization_code",
+        "oauth_pending_flow",
+        "auth_continuation"
+      ]) {
+        await db.delete({
+          model,
+          where: [{ field: "userId", operator: "=", value: duplicate.id }]
+        });
+      }
+      await db.update({
+        model: "user",
+        where: [{ field: "id", operator: "=", value: duplicate.id }],
+        data: { email: tombstone, isActive: false }
+      });
+    }
+    if (survivor.email !== canonical) {
+      await db.update({
+        model: "user",
+        where: [{ field: "id", operator: "=", value: survivor.id }],
+        data: { email: canonical }
+      });
+    }
+  }
+  const identifierGroups = /* @__PURE__ */ new Map();
+  const occupiedNonEmailValues = /* @__PURE__ */ new Set();
+  for (const identifier of identifiers) {
+    if (duplicateUserIds.has(identifier.userId)) {
+      await db.delete({
+        model: "login_identifier",
+        where: [{ field: "id", operator: "=", value: identifier.id }]
+      });
+      continue;
+    }
+    if (identifier.type !== "email") {
+      if (primaryOwnerByCanonical.has(identifier.value)) {
+        await db.delete({
+          model: "login_identifier",
+          where: [{ field: "id", operator: "=", value: identifier.id }]
+        });
+      } else {
+        occupiedNonEmailValues.add(identifier.value);
+      }
+      continue;
+    }
+    const canonical = normalizeEmail(identifier.value);
+    const group = identifierGroups.get(canonical) ?? [];
+    group.push(identifier);
+    identifierGroups.set(canonical, group);
+  }
+  for (const [canonical, matches] of identifierGroups) {
+    const primaryOwner = primaryOwnerByCanonical.get(canonical);
+    const survivor = occupiedNonEmailValues.has(canonical) ? void 0 : primaryOwner ? matches.find((identifier) => identifier.userId === primaryOwner) : matches[0];
+    for (const duplicate of matches) {
+      if (duplicate.id === survivor?.id)
+        continue;
+      await db.delete({
+        model: "login_identifier",
+        where: [{ field: "id", operator: "=", value: duplicate.id }]
+      });
+    }
+    if (survivor && survivor.value !== canonical) {
+      await db.update({
+        model: "login_identifier",
+        where: [{ field: "id", operator: "=", value: survivor.id }],
+        data: { value: canonical }
+      });
+    }
+  }
+  if (!db.rawQuery)
+    throw new Error("Email data migration requires rawQuery support");
+  await db.rawQuery("CREATE TABLE fortress_email_migration_ready (id INTEGER PRIMARY KEY)");
+}
+var SQLITE_0006_UP = `
+-- This sentinel is created only by the Fortress migration engine after its
+-- Unicode-aware data step. Applying this SQL directly fails closed.
+INSERT INTO fortress_email_migration_ready (id) VALUES (1);
+CREATE UNIQUE INDEX user_email_ci_unique ON fortress_user (email COLLATE NOCASE);
+CREATE UNIQUE INDEX login_identifier_email_ci_unique
+  ON fortress_login_identifier (value COLLATE NOCASE)
+  WHERE type = 'email';
+DROP TABLE fortress_email_migration_ready;
+`.trim();
+var SQLITE_0006_FRESH_UP = `
+CREATE UNIQUE INDEX user_email_ci_unique ON fortress_user (email COLLATE NOCASE);
+CREATE UNIQUE INDEX login_identifier_email_ci_unique
+  ON fortress_login_identifier (value COLLATE NOCASE)
+  WHERE type = 'email';
+`.trim();
+var SQLITE_0006_DOWN = `
+-- Canonicalization and duplicate-account quarantine are intentionally irreversible.
+DROP INDEX IF EXISTS login_identifier_email_ci_unique;
+DROP INDEX IF EXISTS user_email_ci_unique;
+`.trim();
+var PG_0006_UP = `
+-- This sentinel is created only by the Fortress migration engine after its
+-- Unicode-aware data step. Applying this SQL directly fails closed.
+INSERT INTO fortress_email_migration_ready (id) VALUES (1);
+CREATE UNIQUE INDEX user_email_ci_unique ON fortress_user (lower(email));
+CREATE UNIQUE INDEX login_identifier_email_ci_unique
+  ON fortress_login_identifier (lower(value))
+  WHERE type = 'email';
+DROP TABLE fortress_email_migration_ready;
+`.trim();
+var PG_0006_FRESH_UP = `
+CREATE UNIQUE INDEX user_email_ci_unique ON fortress_user (lower(email));
+CREATE UNIQUE INDEX login_identifier_email_ci_unique
+  ON fortress_login_identifier (lower(value))
+  WHERE type = 'email';
+`.trim();
+var PG_0006_DOWN = `
+-- Canonicalization and duplicate-account quarantine are intentionally irreversible.
+DROP INDEX IF EXISTS login_identifier_email_ci_unique;
+DROP INDEX IF EXISTS user_email_ci_unique;
+`.trim();
+var SQLITE_0007_UP = `
+CREATE TABLE fortress_audit_chain_state (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  last_hash TEXT,
+  entry_count INTEGER NOT NULL CHECK (entry_count >= 0),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  CHECK ((entry_count = 0 AND last_hash IS NULL) OR (entry_count > 0 AND last_hash IS NOT NULL))
+);
+INSERT INTO fortress_audit_chain_state (id, last_hash, entry_count) VALUES (1, NULL, 0);
+`.trim();
+var SQLITE_0007_DOWN = "DROP TABLE IF EXISTS fortress_audit_chain_state;";
+var PG_0007_UP = `
+CREATE TABLE fortress_audit_chain_state (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  last_hash VARCHAR(64),
+  entry_count INTEGER NOT NULL CHECK (entry_count >= 0),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  CHECK ((entry_count = 0 AND last_hash IS NULL) OR (entry_count > 0 AND last_hash IS NOT NULL))
+);
+INSERT INTO fortress_audit_chain_state (id, last_hash, entry_count) VALUES (1, NULL, 0);
+`.trim();
+var PG_0007_DOWN = "DROP TABLE IF EXISTS fortress_audit_chain_state;";
+var SQLITE_0008_UP = `
+ALTER TABLE fortress_auth_continuation ADD COLUMN failed_attempts INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE fortress_auth_continuation ADD COLUMN last_failed_at INTEGER;
+ALTER TABLE fortress_auth_continuation ADD COLUMN invalidated_at INTEGER;
+ALTER TABLE fortress_auth_continuation ADD COLUMN max_attempts INTEGER NOT NULL DEFAULT 5;
+ALTER TABLE fortress_auth_continuation ADD COLUMN cooldown_seconds INTEGER NOT NULL DEFAULT 1;
+CREATE INDEX auth_continuation_failure_idx ON fortress_auth_continuation (user_id, reason, last_failed_at);
+`.trim();
+var SQLITE_0008_DOWN = `
+CREATE TABLE fortress_auth_continuation_old AS SELECT id, user_id, token_hash, reason, expires_at, consumed_at, created_at FROM fortress_auth_continuation;
+DROP TABLE fortress_auth_continuation;
+CREATE TABLE fortress_auth_continuation (
+  id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE, reason TEXT NOT NULL, expires_at INTEGER NOT NULL, consumed_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+INSERT INTO fortress_auth_continuation SELECT * FROM fortress_auth_continuation_old;
+DROP TABLE fortress_auth_continuation_old;
+`.trim();
+var PG_0008_UP = `
+ALTER TABLE fortress_auth_continuation
+  ADD COLUMN failed_attempts INTEGER NOT NULL DEFAULT 0,
+  ADD COLUMN last_failed_at TIMESTAMPTZ,
+  ADD COLUMN invalidated_at TIMESTAMPTZ,
+  ADD COLUMN max_attempts INTEGER NOT NULL DEFAULT 5,
+  ADD COLUMN cooldown_seconds INTEGER NOT NULL DEFAULT 1;
+CREATE INDEX auth_continuation_failure_idx ON fortress_auth_continuation (user_id, reason, last_failed_at);
+`.trim();
+var PG_0008_DOWN = `
+DROP INDEX IF EXISTS auth_continuation_failure_idx;
+ALTER TABLE fortress_auth_continuation DROP COLUMN cooldown_seconds, DROP COLUMN max_attempts, DROP COLUMN invalidated_at, DROP COLUMN last_failed_at, DROP COLUMN failed_attempts;
+`.trim();
+var SQLITE_0009_UP = `
+DELETE FROM fortress_backup_code;
+DELETE FROM fortress_trusted_device;
+DELETE FROM fortress_two_factor_secret;
+`.trim();
+var SQLITE_0009_DOWN = "SELECT 1;";
+var PG_0009_UP = SQLITE_0009_UP;
+var PG_0009_DOWN = SQLITE_0009_DOWN;
+var SQLITE_0010_UP = "SELECT 1;";
+var SQLITE_0010_DOWN = "SELECT 1;";
+var PG_0010_UP = `
+ALTER SEQUENCE fortress_refresh_token_id_seq AS BIGINT;
+ALTER TABLE fortress_refresh_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_auth_continuation_id_seq AS BIGINT;
+ALTER TABLE fortress_auth_continuation ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_email_verification_token_id_seq AS BIGINT;
+ALTER TABLE fortress_email_verification_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_magic_link_token_id_seq AS BIGINT;
+ALTER TABLE fortress_magic_link_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_authorization_code_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_access_token_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_refresh_token_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_pending_flow_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_audit_log_id_seq AS BIGINT;
+ALTER TABLE fortress_audit_log ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_webhook_delivery_id_seq AS BIGINT;
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_webauthn_challenge_id_seq AS BIGINT;
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN id TYPE BIGINT;
+`.trim();
+var PG_0010_DOWN = "SELECT 1;";
+var fortressMigrations = {
+  sqlite: [
+    { version: 1, name: "schema_version", dialect: "sqlite", up: SQLITE_0001_UP, down: SQLITE_0001_DOWN },
+    { version: 2, name: "initial_schema", dialect: "sqlite", up: SQLITE_0002_UP, down: SQLITE_0002_DOWN },
+    { version: 3, name: "auth_continuation", dialect: "sqlite", up: SQLITE_0003_UP, down: SQLITE_0003_DOWN },
+    { version: 4, name: "tenant_default_unique", dialect: "sqlite", up: SQLITE_0004_UP, down: SQLITE_0004_DOWN },
+    { version: 5, name: "hot_indexes_timestamptz", dialect: "sqlite", up: SQLITE_0005_UP, down: SQLITE_0005_DOWN },
+    { version: 6, name: "canonical_email", dialect: "sqlite", up: SQLITE_0006_UP, down: SQLITE_0006_DOWN, freshUp: SQLITE_0006_FRESH_UP, dataStep: "normalize-email-v2", beforeUp: normalizeExistingUserEmails },
+    { version: 7, name: "audit_chain_anchor", dialect: "sqlite", up: SQLITE_0007_UP, down: SQLITE_0007_DOWN },
+    { version: 8, name: "two_factor_hardening", dialect: "sqlite", up: SQLITE_0008_UP, down: SQLITE_0008_DOWN },
+    { version: 9, name: "encrypt_totp_secrets", dialect: "sqlite", up: SQLITE_0009_UP, down: SQLITE_0009_DOWN },
+    { version: 10, name: "bigint_append_only_ids", dialect: "sqlite", up: SQLITE_0010_UP, down: SQLITE_0010_DOWN }
+  ],
+  pg: [
+    { version: 1, name: "schema_version", dialect: "pg", up: PG_0001_UP, down: PG_0001_DOWN },
+    { version: 2, name: "initial_schema", dialect: "pg", up: PG_0002_UP, down: PG_0002_DOWN },
+    { version: 3, name: "auth_continuation", dialect: "pg", up: PG_0003_UP, down: PG_0003_DOWN },
+    { version: 4, name: "tenant_default_unique", dialect: "pg", up: PG_0004_UP, down: PG_0004_DOWN },
+    { version: 5, name: "hot_indexes_timestamptz", dialect: "pg", up: PG_0005_UP, down: PG_0005_DOWN },
+    { version: 6, name: "canonical_email", dialect: "pg", up: PG_0006_UP, down: PG_0006_DOWN, freshUp: PG_0006_FRESH_UP, dataStep: "normalize-email-v2", beforeUp: normalizeExistingUserEmails },
+    { version: 7, name: "audit_chain_anchor", dialect: "pg", up: PG_0007_UP, down: PG_0007_DOWN },
+    { version: 8, name: "two_factor_hardening", dialect: "pg", up: PG_0008_UP, down: PG_0008_DOWN },
+    { version: 9, name: "encrypt_totp_secrets", dialect: "pg", up: PG_0009_UP, down: PG_0009_DOWN },
+    { version: 10, name: "bigint_append_only_ids", dialect: "pg", up: PG_0010_UP, down: PG_0010_DOWN }
+  ]
+};
+function getFortressMigrations(dialect) {
+  return [...fortressMigrations[dialect]].sort((a, b) => a.version - b.version);
+}
+function getLatestMigrationVersion(dialect) {
+  return getFortressMigrations(dialect).at(-1)?.version ?? 0;
+}
+function getMigrationUpSql(dialect) {
+  return getFortressMigrations(dialect).map((migration) => migration.freshUp ?? migration.up).join("\n\n");
+}
+var FORTRESS_TABLES = [
+  "fortress_schema_version",
+  "fortress_user",
+  "fortress_login_identifier",
+  "fortress_refresh_token",
+  "fortress_auth_continuation",
+  "fortress_group",
+  "fortress_group_user",
+  "fortress_service_account",
+  "fortress_resource",
+  "fortress_permission",
+  "fortress_role",
+  "fortress_role_permission",
+  "fortress_role_binding",
+  "fortress_direct_permission_binding",
+  "fortress_email_verification_token",
+  "fortress_magic_link_token",
+  "fortress_api_key",
+  "fortress_two_factor_secret",
+  "fortress_backup_code",
+  "fortress_trusted_device",
+  "fortress_social_account",
+  "fortress_tenant",
+  "fortress_tenant_user",
+  "fortress_oauth_client",
+  "fortress_oauth_authorization_code",
+  "fortress_oauth_access_token",
+  "fortress_oauth_refresh_token",
+  "fortress_oauth_pending_flow",
+  "fortress_oauth_signing_key",
+  "fortress_user_scope_assignment",
+  "fortress_account_lockout",
+  "fortress_audit_log",
+  "fortress_audit_chain_state",
+  "fortress_webhook_endpoint",
+  "fortress_webhook_delivery",
+  "fortress_webauthn_credential",
+  "fortress_webauthn_challenge"
+];
+var FORTRESS_INDEXES = [
+  { name: "refresh_token_family_idx", table: "fortress_refresh_token", columns: ["token_family"] },
+  { name: "refresh_token_user_idx", table: "fortress_refresh_token", columns: ["user_id"] },
+  { name: "email_verification_token_token_idx", table: "fortress_email_verification_token", columns: ["token"] },
+  { name: "magic_link_token_token_idx", table: "fortress_magic_link_token", columns: ["token"] },
+  { name: "role_binding_subject_idx", table: "fortress_role_binding", columns: ["subject_type", "subject_id"] },
+  { name: "direct_permission_binding_subject_idx", table: "fortress_direct_permission_binding", columns: ["subject_type", "subject_id"] },
+  { name: "backup_code_user_idx", table: "fortress_backup_code", columns: ["user_id"] },
+  { name: "trusted_device_user_idx", table: "fortress_trusted_device", columns: ["user_id"] },
+  { name: "webhook_delivery_retry_idx", table: "fortress_webhook_delivery", columns: ["status", "next_retry_at"] },
+  { name: "audit_log_timestamp_idx", table: "fortress_audit_log", columns: ["timestamp"] }
+];
+var CONSTRAINT_KEYWORDS = /* @__PURE__ */ new Set(["primary", "unique", "foreign", "constraint", "check"]);
+var CREATE_TABLE_RE = /create\s+table\s+(?:if\s+not\s+exists\s+)?(\w+)\s*\(/gi;
+var ADD_COLUMN_RE = /alter\s+table\s+(\w+)\s+add\s+column\s+(\w+)/gi;
+var RENAME_TABLE_RE = /alter\s+table\s+(\w+)\s+rename\s+to\s+(\w+)/gi;
+var WHITESPACE_RE = /\s+/;
+var QUOTE_CHARS_RE = /["'`]/g;
+function getExpectedColumns(dialect) {
+  const sql4 = getMigrationUpSql(dialect).split("\n").filter((line) => !line.trimStart().startsWith("--")).join("\n");
+  const result = {};
+  CREATE_TABLE_RE.lastIndex = 0;
+  let match = CREATE_TABLE_RE.exec(sql4);
+  while (match !== null) {
+    const tableName = match[1];
+    const bodyStart = match.index + match[0].length;
+    let depth = 1;
+    let i = bodyStart;
+    for (; i < sql4.length && depth > 0; i++) {
+      if (sql4[i] === "(")
+        depth++;
+      else if (sql4[i] === ")")
+        depth--;
+    }
+    const body = sql4.slice(bodyStart, i - 1);
+    result[tableName] = extractColumnNames(body);
+    CREATE_TABLE_RE.lastIndex = i;
+    match = CREATE_TABLE_RE.exec(sql4);
+  }
+  ADD_COLUMN_RE.lastIndex = 0;
+  let addMatch = ADD_COLUMN_RE.exec(sql4);
+  while (addMatch !== null) {
+    const [, tableName, columnName] = addMatch;
+    const columns = result[tableName] ?? (result[tableName] = []);
+    const normalized = columnName.toLowerCase();
+    if (!columns.includes(normalized))
+      columns.push(normalized);
+    addMatch = ADD_COLUMN_RE.exec(sql4);
+  }
+  RENAME_TABLE_RE.lastIndex = 0;
+  let renameMatch = RENAME_TABLE_RE.exec(sql4);
+  while (renameMatch !== null) {
+    const [, fromName, toName] = renameMatch;
+    if (result[fromName]) {
+      result[toName] = result[fromName];
+      delete result[fromName];
+    }
+    renameMatch = RENAME_TABLE_RE.exec(sql4);
+  }
+  return result;
+}
+function extractColumnNames(body) {
+  const columns = [];
+  let depth = 0;
+  let current = "";
+  const flush = () => {
+    const trimmed = current.trim();
+    current = "";
+    if (!trimmed)
+      return;
+    const firstWord = trimmed.split(WHITESPACE_RE)[0].replace(QUOTE_CHARS_RE, "").toLowerCase();
+    if (!firstWord || CONSTRAINT_KEYWORDS.has(firstWord))
+      return;
+    columns.push(firstWord);
+  };
+  for (const char of body) {
+    if (char === "(") {
+      depth++;
+      current += char;
+    } else if (char === ")") {
+      depth--;
+      current += char;
+    } else if (char === "," && depth === 0) {
+      flush();
+    } else {
+      current += char;
+    }
+  }
+  flush();
+  return columns;
+}
+
+// src/drizzle/adapter.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { and, eq, getTableColumns, gt, gte, inArray, isNull, like, lt, lte, ne, sql as sql3 } from "drizzle-orm";
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/drizzle/pg-error-map.ts
+var MAX_CAUSE_DEPTH = 6;
+var SQLSTATE_PATTERN = /^[0-9A-Z]{5}$/;
+var PG_SQLSTATE_MAP = {
+  "23505": (cause) => Errors.conflict("Resource already exists", { cause }),
+  "23503": (cause) => Errors.unprocessable("Referenced resource does not exist", { cause }),
+  "23502": (_cause) => Errors.badRequest("Required field is missing"),
+  "23514": (cause) => Errors.unprocessable("Constraint check failed", { cause }),
+  "40001": (cause) => Errors.conflict("Serialization failure, retry the request", { cause }),
+  "40P01": (cause) => Errors.conflict("Deadlock detected, retry the request", { cause }),
+  "57014": (cause) => Errors.serviceUnavailable("Query canceled", { cause })
+};
+var SQLITE_CONSTRAINT_MAP = [
+  {
+    match: /SQLITE_CONSTRAINT_(?:UNIQUE|PRIMARYKEY)|UNIQUE constraint failed/i,
+    factory: (cause) => Errors.conflict("Resource already exists", { cause })
+  },
+  {
+    match: /SQLITE_CONSTRAINT_FOREIGNKEY|FOREIGN KEY constraint failed/i,
+    factory: (cause) => Errors.unprocessable("Referenced resource does not exist", { cause })
+  },
+  {
+    match: /SQLITE_CONSTRAINT_NOTNULL|NOT NULL constraint failed/i,
+    factory: (_cause) => Errors.badRequest("Required field is missing")
+  }
+];
+function mapSqliteConstraint(err) {
+  let current = err;
+  for (let i = 0; i < MAX_CAUSE_DEPTH; i++) {
+    if (current === null || typeof current !== "object")
+      return null;
+    const coded = current;
+    const code = typeof coded.code === "string" ? coded.code : "";
+    const message = typeof coded.message === "string" ? coded.message : "";
+    const haystack = `${code} ${message}`;
+    for (const { match, factory } of SQLITE_CONSTRAINT_MAP) {
+      if (match.test(haystack))
+        return factory(err);
+    }
+    current = coded.cause;
+  }
+  return null;
+}
+function findSqlstate(err) {
+  let current = err;
+  for (let i = 0; i < MAX_CAUSE_DEPTH; i++) {
+    if (current === null || typeof current !== "object")
+      return null;
+    const candidate = current.code;
+    if (typeof candidate === "string" && SQLSTATE_PATTERN.test(candidate))
+      return candidate;
+    current = current.cause;
+  }
+  return null;
+}
+function rethrowDbError(err, dialect) {
+  if (dialect === "pg") {
+    const sqlstate = findSqlstate(err);
+    const factory = sqlstate ? PG_SQLSTATE_MAP[sqlstate] : void 0;
+    if (factory)
+      throw factory(err);
+    throw err;
+  }
+  if (dialect === "sqlite") {
+    const mapped = mapSqliteConstraint(err);
+    if (mapped)
+      throw mapped;
+    throw err;
+  }
+  throw err;
+}
+
+// src/drizzle/pg/schema.ts
+import { sql } from "drizzle-orm";
+import { bigserial, boolean, index, integer, jsonb, pgTable, primaryKey, serial, text, timestamp, unique, uniqueIndex, varchar } from "drizzle-orm/pg-core";
+var schemaVersion = pgTable("fortress_schema_version", {
+  id: integer("id").primaryKey().default(1),
+  version: integer("version").notNull(),
+  appliedAt: timestamp("applied_at", { withTimezone: true }).notNull().defaultNow()
+});
+var users = pgTable("fortress_user", {
+  id: serial("id").primaryKey(),
+  email: varchar("email", { length: 255 }).notNull().unique(),
+  name: varchar("name", { length: 255 }).notNull(),
+  passwordHash: text("password_hash"),
+  isActive: boolean("is_active").notNull().default(true),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  uniqueIndex("user_email_ci_unique").on(sql`lower(${table.email})`)
+]);
+var loginIdentifiers = pgTable("fortress_login_identifier", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  type: varchar("type", { length: 20 }).notNull(),
+  // 'email' | 'phone' | 'username'
+  value: varchar("value", { length: 255 }).notNull().unique()
+}, (table) => [
+  uniqueIndex("login_identifier_email_ci_unique").on(sql`lower(${table.value})`).where(sql`${table.type} = 'email'`)
+]);
+var refreshTokens = pgTable("fortress_refresh_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: varchar("token_hash", { length: 64 }).notNull().unique(),
+  tokenFamily: varchar("token_family", { length: 64 }).notNull(),
+  familyCreatedAt: timestamp("family_created_at", { withTimezone: true }).notNull().defaultNow(),
+  successorTokenHash: varchar("successor_token_hash", { length: 64 }),
+  rotatedAt: timestamp("rotated_at", { withTimezone: true }),
+  isRevoked: boolean("is_revoked").notNull().default(false),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: varchar("ip_address", { length: 45 }),
+  userAgent: text("user_agent"),
+  deviceName: text("device_name"),
+  lastActiveAt: timestamp("last_active_at", { withTimezone: true }),
+  fingerprintHash: varchar("fingerprint_hash", { length: 64 }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  index("refresh_token_family_idx").on(table.tokenFamily),
+  index("refresh_token_user_idx").on(table.userId)
+]);
+var authContinuations = pgTable("fortress_auth_continuation", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  tokenHash: varchar("token_hash", { length: 64 }).notNull().unique(),
+  reason: varchar("reason", { length: 32 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  consumedAt: timestamp("consumed_at", { withTimezone: true }),
+  failedAttempts: integer("failed_attempts").notNull().default(0),
+  lastFailedAt: timestamp("last_failed_at", { withTimezone: true }),
+  invalidatedAt: timestamp("invalidated_at", { withTimezone: true }),
+  maxAttempts: integer("max_attempts").notNull().default(5),
+  cooldownSeconds: integer("cooldown_seconds").notNull().default(1),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  index("auth_continuation_failure_idx").on(table.userId, table.reason, table.lastFailedAt)
+]);
+var groups = pgTable("fortress_group", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 100 }).notNull().unique(),
+  description: text("description")
+});
+var groupUsers = pgTable(
+  "fortress_group_user",
+  {
+    groupId: integer("group_id").notNull().references(() => groups.id, { onDelete: "cascade" }),
+    userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey({ columns: [table.groupId, table.userId] })]
+);
+var serviceAccounts = pgTable("fortress_service_account", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 100 }).notNull().unique(),
+  displayName: varchar("display_name", { length: 255 }),
+  description: text("description"),
+  isActive: boolean("is_active").notNull().default(true),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var resources = pgTable("fortress_resource", {
+  name: varchar("name", { length: 100 }).primaryKey(),
+  description: text("description")
+});
+var permissions = pgTable("fortress_permission", {
+  id: serial("id").primaryKey(),
+  resource: varchar("resource", { length: 100 }).notNull().references(() => resources.name, { onDelete: "cascade" }),
+  action: varchar("action", { length: 100 }).notNull(),
+  effect: varchar("effect", { length: 10 }).notNull().default("ALLOW"),
+  // 'ALLOW' | 'DENY'
+  conditions: jsonb("conditions"),
+  // PermissionCondition[] as JSONB
+  description: text("description")
+}, (table) => [
+  // M8 fix — same split-index pattern as role/direct-permission bindings
+  // so concurrent findOrCreatePermission can't insert duplicate rows when
+  // conditions is NULL (a plain UNIQUE treats NULLs as distinct).
+  uniqueIndex("uniq_permission_no_conditions").on(table.resource, table.action, table.effect).where(sql`${table.conditions} is null`),
+  uniqueIndex("uniq_permission_with_conditions").on(table.resource, table.action, table.effect, table.conditions).where(sql`${table.conditions} is not null`)
+]);
+var roles = pgTable("fortress_role", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 100 }).notNull().unique(),
+  description: text("description"),
+  isSystem: boolean("is_system").notNull().default(false)
+});
+var rolePermissions = pgTable(
+  "fortress_role_permission",
+  {
+    roleId: integer("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+    permissionId: integer("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey({ columns: [table.roleId, table.permissionId] })]
+);
+var roleBindings = pgTable("fortress_role_binding", {
+  id: serial("id").primaryKey(),
+  roleId: integer("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+  subjectType: varchar("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer("subject_id").notNull(),
+  tenantId: varchar("tenant_id", { length: 100 })
+}, (table) => [
+  unique().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex("uniq_role_binding_global").on(table.roleId, table.subjectType, table.subjectId).where(sql`${table.tenantId} is null`),
+  uniqueIndex("uniq_role_binding_tenant").on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(sql`${table.tenantId} is not null`),
+  index("role_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var directPermissionBindings = pgTable("fortress_direct_permission_binding", {
+  id: serial("id").primaryKey(),
+  permissionId: integer("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" }),
+  subjectType: varchar("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer("subject_id").notNull(),
+  tenantId: varchar("tenant_id", { length: 100 })
+}, (table) => [
+  unique().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex("uniq_direct_permission_binding_global").on(table.permissionId, table.subjectType, table.subjectId).where(sql`${table.tenantId} is null`),
+  uniqueIndex("uniq_direct_permission_binding_tenant").on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(sql`${table.tenantId} is not null`),
+  index("direct_permission_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var emailVerificationTokens = pgTable("fortress_email_verification_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  token: text("token").notNull(),
+  email: varchar("email", { length: 255 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("email_verification_token_token_idx").on(table.token)]);
+var magicLinkTokens = pgTable("fortress_magic_link_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  email: varchar("email", { length: 255 }).notNull(),
+  token: varchar("token", { length: 64 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("magic_link_token_token_idx").on(table.token)]);
+var apiKeys = pgTable("fortress_api_key", {
+  id: serial("id").primaryKey(),
+  subjectType: varchar("subject_type", { length: 20 }).notNull(),
+  // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: integer("subject_id").notNull(),
+  name: varchar("name", { length: 255 }).notNull(),
+  keyHash: varchar("key_hash", { length: 64 }).notNull().unique(),
+  keyPrefix: varchar("key_prefix", { length: 20 }).notNull(),
+  scopes: text("scopes"),
+  // JSON array of "resource:action" strings
+  expiresAt: timestamp("expires_at", { withTimezone: true }),
+  lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+  isRevoked: boolean("is_revoked").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("api_key_subject_idx").on(table.subjectType, table.subjectId)]);
+var twoFactorSecrets = pgTable("fortress_two_factor_secret", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().unique().references(() => users.id, { onDelete: "cascade" }),
+  secret: text("secret").notNull(),
+  // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: boolean("is_enabled").notNull().default(false),
+  lastUsedCounter: integer("last_used_counter"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var backupCodes = pgTable("fortress_backup_code", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  codeHash: text("code_hash").notNull(),
+  isUsed: boolean("is_used").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("backup_code_user_idx").on(table.userId)]);
+var trustedDevices = pgTable("fortress_trusted_device", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: varchar("device_hash", { length: 64 }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  lastUsedAt: timestamp("last_used_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("trusted_device_user_idx").on(table.userId)]);
+var socialAccounts = pgTable("fortress_social_account", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  provider: varchar("provider", { length: 50 }).notNull(),
+  providerAccountId: varchar("provider_account_id", { length: 255 }).notNull(),
+  email: varchar("email", { length: 255 }),
+  accessToken: text("access_token"),
+  // Encrypted
+  refreshToken: text("refresh_token"),
+  // Encrypted
+  tokenExpiresAt: timestamp("token_expires_at", { withTimezone: true }),
+  profile: jsonb("profile"),
+  // JSON
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  unique().on(table.userId, table.provider),
+  unique().on(table.provider, table.providerAccountId)
+]);
+var tenants = pgTable("fortress_tenant", {
+  id: serial("id").primaryKey(),
+  name: varchar("name", { length: 255 }).notNull(),
+  taxId: varchar("tax_id", { length: 100 }).notNull().unique(),
+  description: text("description"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var tenantUsers = pgTable(
+  "fortress_tenant_user",
+  {
+    tenantId: integer("tenant_id").notNull().references(() => tenants.id, { onDelete: "cascade" }),
+    userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    isDefault: boolean("is_default").notNull().default(false)
+  },
+  (table) => [
+    primaryKey({ columns: [table.tenantId, table.userId] }),
+    uniqueIndex("fortress_tenant_user_one_default_idx").on(table.userId).where(sql`${table.isDefault} = true`)
+  ]
+);
+var oauthClients = pgTable("fortress_oauth_client", {
+  id: serial("id").primaryKey(),
+  clientId: varchar("client_id", { length: 255 }).notNull().unique(),
+  clientSecretHash: text("client_secret_hash").notNull(),
+  name: varchar("name", { length: 255 }).notNull(),
+  redirectUris: text("redirect_uris").notNull(),
+  // JSON array
+  grantTypes: text("grant_types").notNull(),
+  // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: text("allowed_scopes"),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAuthorizationCodes = pgTable("fortress_oauth_authorization_code", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  code: varchar("code", { length: 255 }).notNull().unique(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  userId: integer("user_id").notNull(),
+  redirectUri: text("redirect_uri").notNull(),
+  scope: text("scope"),
+  codeChallenge: text("code_challenge"),
+  codeChallengeMethod: varchar("code_challenge_method", { length: 10 }),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: text("nonce"),
+  authTime: integer("auth_time"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthAccessTokens = pgTable("fortress_oauth_access_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  token: varchar("token", { length: 255 }).notNull().unique(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  userId: integer("user_id"),
+  scope: text("scope"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthRefreshTokens = pgTable("fortress_oauth_refresh_token", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  token: varchar("token", { length: 255 }).notNull().unique(),
+  familyId: varchar("family_id", { length: 64 }).notNull(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  userId: integer("user_id").notNull(),
+  scope: text("scope"),
+  issuedAt: timestamp("issued_at", { withTimezone: true }).notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  parentId: integer("parent_id"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthPendingFlows = pgTable("fortress_oauth_pending_flow", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  flowId: text("flow_id").notNull().unique(),
+  clientId: varchar("client_id", { length: 255 }).notNull(),
+  redirectUri: text("redirect_uri").notNull(),
+  scope: text("scope"),
+  state: varchar("state", { length: 255 }).notNull(),
+  codeChallenge: text("code_challenge"),
+  codeChallengeMethod: varchar("code_challenge_method", { length: 10 }),
+  nonce: text("nonce"),
+  // H6 fix: subject the flow is bound to (TOFU-claimed on first
+  // authenticated touch).
+  userId: integer("user_id"),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: timestamp("used_at", { withTimezone: true }),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var oauthSigningKeys = pgTable("fortress_oauth_signing_key", {
+  id: serial("id").primaryKey(),
+  kid: varchar("kid", { length: 64 }).notNull().unique(),
+  alg: varchar("alg", { length: 16 }).notNull(),
+  publicJwk: text("public_jwk").notNull(),
+  privateJwk: text("private_jwk").notNull(),
+  rotatedAt: timestamp("rotated_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var userScopeAssignments = pgTable("fortress_user_scope_assignment", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  scopeName: varchar("scope_name", { length: 100 }).notNull(),
+  scopeValue: varchar("scope_value", { length: 255 }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var accountLockouts = pgTable("fortress_account_lockout", {
+  id: serial("id").primaryKey(),
+  identifier: varchar("identifier", { length: 255 }).notNull().unique(),
+  failedAttempts: integer("failed_attempts").notNull().default(0),
+  lastFailedAt: timestamp("last_failed_at", { withTimezone: true }),
+  lockedUntil: timestamp("locked_until", { withTimezone: true }),
+  lockoutCount: integer("lockout_count").notNull().default(0),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var auditLogs = pgTable("fortress_audit_log", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  timestamp: timestamp("timestamp", { withTimezone: true }).notNull().defaultNow(),
+  eventType: varchar("event_type", { length: 100 }).notNull(),
+  actorId: integer("actor_id"),
+  actorType: varchar("actor_type", { length: 20 }).notNull().default("USER"),
+  targetId: integer("target_id"),
+  targetType: varchar("target_type", { length: 50 }),
+  ipAddress: varchar("ip_address", { length: 45 }),
+  userAgent: text("user_agent"),
+  outcome: varchar("outcome", { length: 20 }).notNull().default("SUCCESS"),
+  metadata: jsonb("metadata"),
+  previousHash: text("previous_hash"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [index("audit_log_timestamp_idx").on(table.timestamp)]);
+var auditChainState = pgTable("fortress_audit_chain_state", {
+  id: integer("id").primaryKey(),
+  lastHash: varchar("last_hash", { length: 64 }),
+  entryCount: integer("entry_count").notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookEndpoints = pgTable("fortress_webhook_endpoint", {
+  id: serial("id").primaryKey(),
+  url: text("url").notNull(),
+  events: text("events").notNull(),
+  // JSON array
+  secret: text("secret").notNull(),
+  isActive: boolean("is_active").notNull().default(true),
+  deactivatedReason: text("deactivated_reason"),
+  consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webhookDeliveries = pgTable("fortress_webhook_delivery", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  endpointId: integer("endpoint_id").notNull().references(() => webhookEndpoints.id, { onDelete: "cascade" }),
+  eventType: varchar("event_type", { length: 100 }).notNull(),
+  payload: text("payload").notNull(),
+  // JSON
+  status: varchar("status", { length: 20 }).notNull().default("pending"),
+  // pending | success | failed
+  attempts: integer("attempts").notNull().default(0),
+  idempotencyKey: text("idempotency_key"),
+  lastAttemptAt: timestamp("last_attempt_at", { withTimezone: true }),
+  nextRetryAt: timestamp("next_retry_at", { withTimezone: true }),
+  responseStatus: integer("response_status"),
+  responseBody: text("response_body"),
+  errorKind: text("error_kind"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+  uniqueIndex("uniq_webhook_delivery_idempotency").on(table.endpointId, table.idempotencyKey).where(sql`${table.idempotencyKey} is not null`),
+  index("webhook_delivery_retry_idx").on(table.status, table.nextRetryAt)
+]);
+var webauthnCredentials = pgTable("fortress_webauthn_credential", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  credentialId: text("credential_id").notNull().unique(),
+  publicKey: text("public_key").notNull(),
+  counter: integer("counter").notNull().default(0),
+  deviceType: varchar("device_type", { length: 20 }).notNull(),
+  backedUp: boolean("backed_up").notNull().default(false),
+  transports: text("transports"),
+  // JSON array
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var webauthnChallenges = pgTable("fortress_webauthn_challenge", {
+  id: bigserial("id", { mode: "number" }).primaryKey(),
+  challenge: text("challenge").notNull().unique(),
+  userId: integer("user_id"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+var fortressPgSchema = {
+  schemaVersion,
+  users,
+  loginIdentifiers,
+  refreshTokens,
+  authContinuations,
+  groups,
+  groupUsers,
+  serviceAccounts,
+  resources,
+  permissions,
+  roles,
+  rolePermissions,
+  roleBindings,
+  directPermissionBindings,
+  emailVerificationTokens,
+  magicLinkTokens,
+  apiKeys,
+  twoFactorSecrets,
+  backupCodes,
+  trustedDevices,
+  socialAccounts,
+  tenants,
+  tenantUsers,
+  oauthClients,
+  oauthAuthorizationCodes,
+  oauthAccessTokens,
+  oauthRefreshTokens,
+  oauthPendingFlows,
+  oauthSigningKeys,
+  userScopeAssignments,
+  accountLockouts,
+  auditLogs,
+  auditChainState,
+  webhookEndpoints,
+  webhookDeliveries,
+  webauthnCredentials,
+  webauthnChallenges
+};
+
+// src/drizzle/schema.ts
+import { sql as sql2 } from "drizzle-orm";
+import { index as index2, integer as integer2, primaryKey as primaryKey2, sqliteTable, text as text2, unique as unique2, uniqueIndex as uniqueIndex2 } from "drizzle-orm/sqlite-core";
+var schemaVersion2 = sqliteTable("fortress_schema_version", {
+  id: integer2("id").primaryKey().default(1),
+  version: integer2("version").notNull(),
+  appliedAt: integer2("applied_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var users2 = sqliteTable("fortress_user", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  email: text2("email").notNull().unique(),
+  name: text2("name").notNull(),
+  passwordHash: text2("password_hash"),
+  isActive: integer2("is_active", { mode: "boolean" }).notNull().default(true),
+  emailVerified: integer2("email_verified", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  uniqueIndex2("user_email_ci_unique").on(sql2`${table.email} COLLATE NOCASE`)
+]);
+var loginIdentifiers2 = sqliteTable("fortress_login_identifier", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  type: text2("type").notNull(),
+  // 'email' | 'phone' | 'username'
+  value: text2("value").notNull().unique()
+}, (table) => [
+  uniqueIndex2("login_identifier_email_ci_unique").on(sql2`${table.value} COLLATE NOCASE`).where(sql2`${table.type} = 'email'`)
+]);
+var refreshTokens2 = sqliteTable("fortress_refresh_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  tokenHash: text2("token_hash").notNull().unique(),
+  tokenFamily: text2("token_family").notNull(),
+  familyCreatedAt: integer2("family_created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  successorTokenHash: text2("successor_token_hash"),
+  rotatedAt: integer2("rotated_at", { mode: "timestamp" }),
+  isRevoked: integer2("is_revoked", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  ipAddress: text2("ip_address"),
+  userAgent: text2("user_agent"),
+  deviceName: text2("device_name"),
+  lastActiveAt: integer2("last_active_at", { mode: "timestamp" }),
+  fingerprintHash: text2("fingerprint_hash"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  index2("refresh_token_family_idx").on(table.tokenFamily),
+  index2("refresh_token_user_idx").on(table.userId)
+]);
+var authContinuations2 = sqliteTable("fortress_auth_continuation", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  tokenHash: text2("token_hash").notNull().unique(),
+  reason: text2("reason").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  consumedAt: integer2("consumed_at", { mode: "timestamp" }),
+  failedAttempts: integer2("failed_attempts").notNull().default(0),
+  lastFailedAt: integer2("last_failed_at", { mode: "timestamp" }),
+  invalidatedAt: integer2("invalidated_at", { mode: "timestamp" }),
+  maxAttempts: integer2("max_attempts").notNull().default(5),
+  cooldownSeconds: integer2("cooldown_seconds").notNull().default(1),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  index2("auth_continuation_failure_idx").on(table.userId, table.reason, table.lastFailedAt)
+]);
+var groups2 = sqliteTable("fortress_group", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull().unique(),
+  description: text2("description")
+});
+var groupUsers2 = sqliteTable(
+  "fortress_group_user",
+  {
+    groupId: integer2("group_id").notNull().references(() => groups2.id, { onDelete: "cascade" }),
+    userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey2({ columns: [table.groupId, table.userId] })]
+);
+var serviceAccounts2 = sqliteTable("fortress_service_account", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull().unique(),
+  displayName: text2("display_name"),
+  description: text2("description"),
+  isActive: integer2("is_active", { mode: "boolean" }).notNull().default(true),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var resources2 = sqliteTable("fortress_resource", {
+  name: text2("name").primaryKey(),
+  description: text2("description")
+});
+var permissions2 = sqliteTable("fortress_permission", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  resource: text2("resource").notNull().references(() => resources2.name, { onDelete: "cascade" }),
+  action: text2("action").notNull(),
+  effect: text2("effect").notNull().default("ALLOW"),
+  // 'ALLOW' | 'DENY'
+  conditions: text2("conditions"),
+  // JSON string of PermissionCondition[]
+  description: text2("description")
+}, (table) => [
+  // M8 fix: SQL UNIQUE treats two NULL `conditions` as distinct, so the
+  // plain unique() above lets `findOrCreatePermission` insert duplicate
+  // rows for the same (resource, action, effect, conditions=NULL) tuple
+  // under concurrency. Mirror the split-index pattern used for role /
+  // direct-permission bindings.
+  uniqueIndex2("uniq_permission_no_conditions").on(table.resource, table.action, table.effect).where(sql2`${table.conditions} is null`),
+  uniqueIndex2("uniq_permission_with_conditions").on(table.resource, table.action, table.effect, table.conditions).where(sql2`${table.conditions} is not null`)
+]);
+var roles2 = sqliteTable("fortress_role", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull().unique(),
+  description: text2("description"),
+  isSystem: integer2("is_system", { mode: "boolean" }).notNull().default(false)
+});
+var rolePermissions2 = sqliteTable(
+  "fortress_role_permission",
+  {
+    roleId: integer2("role_id").notNull().references(() => roles2.id, { onDelete: "cascade" }),
+    permissionId: integer2("permission_id").notNull().references(() => permissions2.id, { onDelete: "cascade" })
+  },
+  (table) => [primaryKey2({ columns: [table.roleId, table.permissionId] })]
+);
+var roleBindings2 = sqliteTable("fortress_role_binding", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  roleId: integer2("role_id").notNull().references(() => roles2.id, { onDelete: "cascade" }),
+  subjectType: text2("subject_type").notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer2("subject_id").notNull(),
+  tenantId: text2("tenant_id")
+}, (table) => [
+  unique2().on(table.roleId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex2("uniq_role_binding_global").on(table.roleId, table.subjectType, table.subjectId).where(sql2`${table.tenantId} is null`),
+  uniqueIndex2("uniq_role_binding_tenant").on(table.roleId, table.subjectType, table.subjectId, table.tenantId).where(sql2`${table.tenantId} is not null`),
+  index2("role_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var directPermissionBindings2 = sqliteTable("fortress_direct_permission_binding", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  permissionId: integer2("permission_id").notNull().references(() => permissions2.id, { onDelete: "cascade" }),
+  subjectType: text2("subject_type").notNull(),
+  // 'USER' | 'GROUP' | 'SERVICE_ACCOUNT'
+  subjectId: integer2("subject_id").notNull(),
+  tenantId: text2("tenant_id")
+}, (table) => [
+  unique2().on(table.permissionId, table.subjectType, table.subjectId, table.tenantId),
+  uniqueIndex2("uniq_direct_permission_binding_global").on(table.permissionId, table.subjectType, table.subjectId).where(sql2`${table.tenantId} is null`),
+  uniqueIndex2("uniq_direct_permission_binding_tenant").on(table.permissionId, table.subjectType, table.subjectId, table.tenantId).where(sql2`${table.tenantId} is not null`),
+  index2("direct_permission_binding_subject_idx").on(table.subjectType, table.subjectId)
+]);
+var emailVerificationTokens2 = sqliteTable("fortress_email_verification_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  token: text2("token").notNull(),
+  email: text2("email").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("email_verification_token_token_idx").on(table.token)]);
+var magicLinkTokens2 = sqliteTable("fortress_magic_link_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  email: text2("email").notNull(),
+  token: text2("token").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("magic_link_token_token_idx").on(table.token)]);
+var apiKeys2 = sqliteTable("fortress_api_key", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  subjectType: text2("subject_type").notNull(),
+  // 'USER' | 'SERVICE_ACCOUNT' — polymorphic owner
+  subjectId: integer2("subject_id").notNull(),
+  name: text2("name").notNull(),
+  keyHash: text2("key_hash").notNull().unique(),
+  keyPrefix: text2("key_prefix").notNull(),
+  scopes: text2("scopes"),
+  // JSON array of "resource:action" strings
+  expiresAt: integer2("expires_at", { mode: "timestamp" }),
+  lastUsedAt: integer2("last_used_at", { mode: "timestamp" }),
+  isRevoked: integer2("is_revoked", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("api_key_subject_idx").on(table.subjectType, table.subjectId)]);
+var twoFactorSecrets2 = sqliteTable("fortress_two_factor_secret", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().unique().references(() => users2.id, { onDelete: "cascade" }),
+  secret: text2("secret").notNull(),
+  // Versioned AES-GCM envelope containing the TOTP seed
+  isEnabled: integer2("is_enabled", { mode: "boolean" }).notNull().default(false),
+  lastUsedCounter: integer2("last_used_counter"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var backupCodes2 = sqliteTable("fortress_backup_code", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  codeHash: text2("code_hash").notNull(),
+  isUsed: integer2("is_used", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("backup_code_user_idx").on(table.userId)]);
+var trustedDevices2 = sqliteTable("fortress_trusted_device", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the server-issued trusted-device secret (never raw token). */
+  deviceHash: text2("device_hash").notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  lastUsedAt: integer2("last_used_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("trusted_device_user_idx").on(table.userId)]);
+var socialAccounts2 = sqliteTable("fortress_social_account", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  provider: text2("provider").notNull(),
+  providerAccountId: text2("provider_account_id").notNull(),
+  email: text2("email"),
+  accessToken: text2("access_token"),
+  // Encrypted
+  refreshToken: text2("refresh_token"),
+  // Encrypted
+  tokenExpiresAt: integer2("token_expires_at", { mode: "timestamp" }),
+  profile: text2("profile"),
+  // JSON
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  unique2().on(table.userId, table.provider),
+  unique2().on(table.provider, table.providerAccountId)
+]);
+var tenants2 = sqliteTable("fortress_tenant", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  name: text2("name").notNull(),
+  taxId: text2("tax_id").notNull().unique(),
+  description: text2("description"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var tenantUsers2 = sqliteTable(
+  "fortress_tenant_user",
+  {
+    tenantId: integer2("tenant_id").notNull().references(() => tenants2.id, { onDelete: "cascade" }),
+    userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+    isDefault: integer2("is_default", { mode: "boolean" }).notNull().default(false)
+  },
+  (table) => [
+    primaryKey2({ columns: [table.tenantId, table.userId] }),
+    uniqueIndex2("fortress_tenant_user_one_default_idx").on(table.userId).where(sql2`${table.isDefault} = true`)
+  ]
+);
+var oauthClients2 = sqliteTable("fortress_oauth_client", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  clientId: text2("client_id").notNull().unique(),
+  clientSecretHash: text2("client_secret_hash").notNull(),
+  name: text2("name").notNull(),
+  redirectUris: text2("redirect_uris").notNull(),
+  // JSON array
+  grantTypes: text2("grant_types").notNull(),
+  // JSON array
+  // RFC 6749 §3.3 / RFC 9700 §2.2.1 per-client scope allow-list (JSON array,
+  // nullable for legacy v0 clients).
+  allowedScopes: text2("allowed_scopes"),
+  // RFC 6749 §2.1 client authentication method ('client_secret_basic' |
+  // 'client_secret_post' | 'none' for RFC 8252 public clients).
+  tokenEndpointAuthMethod: text2("token_endpoint_auth_method"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthAuthorizationCodes2 = sqliteTable("fortress_oauth_authorization_code", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  code: text2("code").notNull().unique(),
+  clientId: text2("client_id").notNull(),
+  userId: integer2("user_id").notNull(),
+  redirectUri: text2("redirect_uri").notNull(),
+  scope: text2("scope"),
+  codeChallenge: text2("code_challenge"),
+  codeChallengeMethod: text2("code_challenge_method"),
+  // OIDC Core §3.1.2.1 / §2 — echoed into the id_token if present.
+  nonce: text2("nonce"),
+  authTime: integer2("auth_time"),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthAccessTokens2 = sqliteTable("fortress_oauth_access_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  token: text2("token").notNull().unique(),
+  clientId: text2("client_id").notNull(),
+  userId: integer2("user_id"),
+  scope: text2("scope"),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthRefreshTokens2 = sqliteTable("fortress_oauth_refresh_token", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  token: text2("token").notNull().unique(),
+  familyId: text2("family_id").notNull(),
+  clientId: text2("client_id").notNull(),
+  userId: integer2("user_id").notNull(),
+  scope: text2("scope"),
+  issuedAt: integer2("issued_at", { mode: "timestamp" }).notNull(),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  parentId: integer2("parent_id"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthPendingFlows2 = sqliteTable("fortress_oauth_pending_flow", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  flowId: text2("flow_id").notNull().unique(),
+  clientId: text2("client_id").notNull(),
+  redirectUri: text2("redirect_uri").notNull(),
+  scope: text2("scope"),
+  state: text2("state").notNull(),
+  codeChallenge: text2("code_challenge"),
+  codeChallengeMethod: text2("code_challenge_method"),
+  nonce: text2("nonce"),
+  // H6 fix: subject the flow is bound to. Nullable for the
+  // login-redirect path which can't know the user up front — the
+  // first authenticated GetFlow / Approve claims it.
+  userId: integer2("user_id"),
+  // Single-use approval/denial claim used by the OAuth consent API.
+  usedAt: integer2("used_at", { mode: "timestamp" }),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var oauthSigningKeys2 = sqliteTable("fortress_oauth_signing_key", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  kid: text2("kid").notNull().unique(),
+  alg: text2("alg").notNull(),
+  publicJwk: text2("public_jwk").notNull(),
+  privateJwk: text2("private_jwk").notNull(),
+  rotatedAt: integer2("rotated_at", { mode: "timestamp" }),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var userScopeAssignments2 = sqliteTable("fortress_user_scope_assignment", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  scopeName: text2("scope_name").notNull(),
+  scopeValue: text2("scope_value").notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var accountLockouts2 = sqliteTable("fortress_account_lockout", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  identifier: text2("identifier").notNull().unique(),
+  failedAttempts: integer2("failed_attempts").notNull().default(0),
+  lastFailedAt: integer2("last_failed_at", { mode: "timestamp" }),
+  lockedUntil: integer2("locked_until", { mode: "timestamp" }),
+  lockoutCount: integer2("lockout_count").notNull().default(0),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var auditLogs2 = sqliteTable("fortress_audit_log", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  timestamp: integer2("timestamp", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date()),
+  eventType: text2("event_type").notNull(),
+  actorId: integer2("actor_id"),
+  actorType: text2("actor_type").notNull().default("USER"),
+  targetId: integer2("target_id"),
+  targetType: text2("target_type"),
+  ipAddress: text2("ip_address"),
+  userAgent: text2("user_agent"),
+  outcome: text2("outcome").notNull().default("SUCCESS"),
+  metadata: text2("metadata"),
+  previousHash: text2("previous_hash"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [index2("audit_log_timestamp_idx").on(table.timestamp)]);
+var auditChainState2 = sqliteTable("fortress_audit_chain_state", {
+  id: integer2("id").primaryKey(),
+  lastHash: text2("last_hash"),
+  entryCount: integer2("entry_count").notNull(),
+  updatedAt: integer2("updated_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webhookEndpoints2 = sqliteTable("fortress_webhook_endpoint", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  url: text2("url").notNull(),
+  events: text2("events").notNull(),
+  // JSON array
+  secret: text2("secret").notNull(),
+  isActive: integer2("is_active", { mode: "boolean" }).notNull().default(true),
+  deactivatedReason: text2("deactivated_reason"),
+  consecutiveFailures: integer2("consecutive_failures").notNull().default(0),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webhookDeliveries2 = sqliteTable("fortress_webhook_delivery", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  endpointId: integer2("endpoint_id").notNull().references(() => webhookEndpoints2.id, { onDelete: "cascade" }),
+  eventType: text2("event_type").notNull(),
+  payload: text2("payload").notNull(),
+  // JSON
+  status: text2("status").notNull().default("pending"),
+  // pending | success | failed
+  attempts: integer2("attempts").notNull().default(0),
+  idempotencyKey: text2("idempotency_key"),
+  lastAttemptAt: integer2("last_attempt_at", { mode: "timestamp" }),
+  nextRetryAt: integer2("next_retry_at", { mode: "timestamp" }),
+  responseStatus: integer2("response_status"),
+  responseBody: text2("response_body"),
+  errorKind: text2("error_kind"),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+}, (table) => [
+  uniqueIndex2("uniq_webhook_delivery_idempotency").on(table.endpointId, table.idempotencyKey).where(sql2`${table.idempotencyKey} is not null`),
+  index2("webhook_delivery_retry_idx").on(table.status, table.nextRetryAt)
+]);
+var webauthnCredentials2 = sqliteTable("fortress_webauthn_credential", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  userId: integer2("user_id").notNull().references(() => users2.id, { onDelete: "cascade" }),
+  credentialId: text2("credential_id").notNull().unique(),
+  publicKey: text2("public_key").notNull(),
+  counter: integer2("counter").notNull().default(0),
+  deviceType: text2("device_type").notNull(),
+  backedUp: integer2("backed_up", { mode: "boolean" }).notNull().default(false),
+  transports: text2("transports"),
+  // JSON array
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var webauthnChallenges2 = sqliteTable("fortress_webauthn_challenge", {
+  id: integer2("id").primaryKey({ autoIncrement: true }),
+  challenge: text2("challenge").notNull().unique(),
+  userId: integer2("user_id"),
+  expiresAt: integer2("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer2("created_at", { mode: "timestamp" }).notNull().$defaultFn(() => /* @__PURE__ */ new Date())
+});
+var fortressSchema = {
+  schemaVersion: schemaVersion2,
+  users: users2,
+  loginIdentifiers: loginIdentifiers2,
+  refreshTokens: refreshTokens2,
+  authContinuations: authContinuations2,
+  groups: groups2,
+  groupUsers: groupUsers2,
+  serviceAccounts: serviceAccounts2,
+  resources: resources2,
+  permissions: permissions2,
+  roles: roles2,
+  rolePermissions: rolePermissions2,
+  roleBindings: roleBindings2,
+  directPermissionBindings: directPermissionBindings2,
+  emailVerificationTokens: emailVerificationTokens2,
+  magicLinkTokens: magicLinkTokens2,
+  apiKeys: apiKeys2,
+  twoFactorSecrets: twoFactorSecrets2,
+  backupCodes: backupCodes2,
+  trustedDevices: trustedDevices2,
+  socialAccounts: socialAccounts2,
+  tenants: tenants2,
+  tenantUsers: tenantUsers2,
+  oauthClients: oauthClients2,
+  oauthAuthorizationCodes: oauthAuthorizationCodes2,
+  oauthAccessTokens: oauthAccessTokens2,
+  oauthRefreshTokens: oauthRefreshTokens2,
+  oauthPendingFlows: oauthPendingFlows2,
+  oauthSigningKeys: oauthSigningKeys2,
+  userScopeAssignments: userScopeAssignments2,
+  accountLockouts: accountLockouts2,
+  auditLogs: auditLogs2,
+  auditChainState: auditChainState2,
+  webhookEndpoints: webhookEndpoints2,
+  webhookDeliveries: webhookDeliveries2,
+  webauthnCredentials: webauthnCredentials2,
+  webauthnChallenges: webauthnChallenges2
+};
+
+// src/drizzle/adapter.ts
+function buildTableMap(schema) {
+  return {
+    schema_version: schema.schemaVersion,
+    user: schema.users,
+    login_identifier: schema.loginIdentifiers,
+    refresh_token: schema.refreshTokens,
+    auth_continuation: schema.authContinuations,
+    group: schema.groups,
+    group_user: schema.groupUsers,
+    service_account: schema.serviceAccounts,
+    resource: schema.resources,
+    permission: schema.permissions,
+    role: schema.roles,
+    role_permission: schema.rolePermissions,
+    role_binding: schema.roleBindings,
+    direct_permission_binding: schema.directPermissionBindings,
+    email_verification_token: schema.emailVerificationTokens,
+    magic_link_token: schema.magicLinkTokens,
+    api_key: schema.apiKeys,
+    two_factor_secret: schema.twoFactorSecrets,
+    backup_code: schema.backupCodes,
+    trusted_device: schema.trustedDevices,
+    social_account: schema.socialAccounts,
+    tenant: schema.tenants,
+    tenant_user: schema.tenantUsers,
+    oauth_client: schema.oauthClients,
+    oauth_authorization_code: schema.oauthAuthorizationCodes,
+    oauth_access_token: schema.oauthAccessTokens,
+    oauth_refresh_token: schema.oauthRefreshTokens,
+    oauth_pending_flow: schema.oauthPendingFlows,
+    oauth_signing_key: schema.oauthSigningKeys,
+    user_scope_assignment: schema.userScopeAssignments,
+    account_lockout: schema.accountLockouts,
+    audit_log: schema.auditLogs,
+    audit_chain_state: schema.auditChainState,
+    webhook_endpoint: schema.webhookEndpoints,
+    webhook_delivery: schema.webhookDeliveries,
+    webauthn_credential: schema.webauthnCredentials,
+    webauthn_challenge: schema.webauthnChallenges
+  };
+}
+var SQLITE_DEFAULT_TABLE_MAP = buildTableMap(fortressSchema);
+var PG_DEFAULT_TABLE_MAP = buildTableMap(fortressPgSchema);
+function getColumn(table, field) {
+  const columns = getTableColumns(table);
+  if (columns[field])
+    return columns[field];
+  const camelCase = field.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+  if (columns[camelCase])
+    return columns[camelCase];
+  throw Errors.badRequest(`Unknown field: ${field} on table`);
+}
+function buildWhereCondition(table, where) {
+  if (where.length === 0)
+    throw Errors.badRequest("A non-empty where clause is required (empty where would match all rows)");
+  const conditions = where.map((clause) => {
+    const column = getColumn(table, clause.field);
+    switch (clause.operator) {
+      case "=":
+        return eq(column, clause.value);
+      case "!=":
+        return ne(column, clause.value);
+      case "in":
+        return inArray(column, clause.value);
+      case "gt":
+        return gt(column, clause.value);
+      case "lt":
+        return lt(column, clause.value);
+      case "gte":
+        return gte(column, clause.value);
+      case "lte":
+        return lte(column, clause.value);
+      case "like":
+        return like(column, clause.value);
+      case "isNull":
+        return isNull(column);
+      default:
+        throw Errors.badRequest(`Unsupported operator: ${clause.operator}`);
+    }
+  });
+  return conditions.length === 1 ? conditions[0] : and(...conditions);
+}
+function sanitizeData(data) {
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    result[key] = value === void 0 ? null : value;
+  }
+  return result;
+}
+var ID_FIELD_RE = /[a-z]Id$/;
+function isIdField(key) {
+  return key === "id" || ID_FIELD_RE.test(key);
+}
+function stringifyIds(row) {
+  if (row == null || typeof row !== "object")
+    return row;
+  if (Array.isArray(row))
+    return row.map(stringifyIds);
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (isIdField(key) && (typeof value === "number" || typeof value === "bigint")) {
+      out[key] = String(value);
+    } else if (value && typeof value === "object" && !(value instanceof Date)) {
+      out[key] = stringifyIds(value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function buildRawSql(sqlText, params = []) {
+  if (params.length === 0)
+    return sql3.raw(sqlText);
+  if (sqlText.includes("?")) {
+    const parts = sqlText.split("?");
+    if (parts.length - 1 !== params.length) {
+      throw Errors.badRequest(`rawQuery placeholder count (${parts.length - 1}) does not match params (${params.length})`);
+    }
+    let query = sql3.raw(parts[0]);
+    for (let i = 0; i < params.length; i++) {
+      query = sql3`${query}${params[i]}${sql3.raw(parts[i + 1])}`;
+    }
+    return query;
+  }
+  throw Errors.badRequest(
+    "rawQuery uses ? positional placeholders on every dialect; params were provided but no ? placeholders were found"
+  );
+}
+function normalizeRawRows(result) {
+  if (Array.isArray(result))
+    return result;
+  const rows = result?.rows;
+  if (Array.isArray(rows))
+    return rows;
+  return [];
+}
+function sqliteStatementReturnsRows(sqlText) {
+  const normalized = sqlText.trimStart().toLowerCase();
+  return normalized.startsWith("select") || normalized.startsWith("with") || normalized.startsWith("pragma") || normalized.includes(" returning ");
+}
+function createDrizzleAdapter(db, options) {
+  const dialect = options?.dialect ?? "sqlite";
+  const defaults = dialect === "pg" ? PG_DEFAULT_TABLE_MAP : SQLITE_DEFAULT_TABLE_MAP;
+  const tableMap = { ...defaults, ...options?.tables };
+  const isSqlite = dialect === "sqlite";
+  let sqliteTxChain = Promise.resolve();
+  const sqliteTxContext = new AsyncLocalStorage();
+  function serializeSqlite(op) {
+    if (!isSqlite || sqliteTxContext.getStore())
+      return op();
+    const result = sqliteTxChain.then(op, op);
+    sqliteTxChain = result.catch(() => void 0);
+    return result;
+  }
+  async function execOne(query) {
+    const row = isSqlite ? query.get() : (await query)[0];
+    return row === void 0 ? void 0 : stringifyIds(row);
+  }
+  async function execMany(query) {
+    const rows = isSqlite ? query.all() : await query;
+    return rows.map(stringifyIds);
+  }
+  async function execRun(query) {
+    if (isSqlite) {
+      query.run();
+      return;
+    }
+    await query;
+  }
+  function getTable(model) {
+    const table = tableMap[model];
+    if (!table) {
+      throw Errors.badRequest(`Unknown model: ${model}`);
+    }
+    return table;
+  }
+  function buildAdapter(drizzle) {
+    const self = {
+      get dialect() {
+        return dialect;
+      },
+      async create(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          try {
+            const result = await execOne(drizzle.insert(table).values(sanitizeData(params.data)).returning());
+            return result;
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async findOne(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          const result = await execOne(drizzle.select().from(table).where(condition).limit(1));
+          return result ?? null;
+        });
+      },
+      async findMany(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          let query = drizzle.select().from(table).$dynamic();
+          if (params.where && params.where.length > 0) {
+            const condition = buildWhereCondition(table, params.where);
+            query = query.where(condition);
+          }
+          if (params.sortBy) {
+            const column = getColumn(table, params.sortBy.field);
+            query = query.orderBy(
+              params.sortBy.direction === "desc" ? sql3`${column} desc` : sql3`${column} asc`
+            );
+          }
+          if (params.limit) {
+            query = query.limit(params.limit);
+          }
+          if (params.offset) {
+            query = query.offset(params.offset);
+          }
+          return execMany(query);
+        });
+      },
+      async update(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          const query = drizzle.update(table).set(sanitizeData(params.data)).where(condition).returning();
+          try {
+            if (isSqlite) {
+              const rows = query.all().map(stringifyIds);
+              return rows[0] ?? null;
+            }
+            const result = await execOne(query);
+            return result ?? null;
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async delete(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          const condition = buildWhereCondition(table, params.where);
+          try {
+            await execRun(drizzle.delete(table).where(condition));
+          } catch (err) {
+            rethrowDbError(err, dialect);
+          }
+        });
+      },
+      async count(params) {
+        return serializeSqlite(async () => {
+          const table = getTable(params.model);
+          let query = drizzle.select({ count: sql3`count(*)` }).from(table).$dynamic();
+          if (params.where && params.where.length > 0) {
+            const condition = buildWhereCondition(table, params.where);
+            query = query.where(condition);
+          }
+          const result = await execOne(query);
+          return Number(result?.count) || 0;
+        });
+      },
+      async rawQuery(sqlText, params) {
+        return serializeSqlite(async () => {
+          const query = buildRawSql(sqlText, params ?? []);
+          if (isSqlite) {
+            if (typeof drizzle.all === "function" && sqliteStatementReturnsRows(sqlText))
+              return normalizeRawRows(drizzle.all(query)).map(stringifyIds);
+            if (typeof drizzle.run === "function") {
+              drizzle.run(query);
+              return [];
+            }
+            if (typeof drizzle.execute === "function")
+              return normalizeRawRows(await drizzle.execute(query)).map(stringifyIds);
+            throw Errors.badRequest("rawQuery is not supported by this SQLite Drizzle driver");
+          }
+          if (typeof drizzle.execute !== "function")
+            throw Errors.badRequest("rawQuery is not supported by this Drizzle driver");
+          return normalizeRawRows(await drizzle.execute(query)).map(stringifyIds);
+        });
+      },
+      async transaction(fn) {
+        if (dialect === "sqlite") {
+          if (sqliteTxContext.getStore()) {
+            throw Errors.badRequest("Nested transactions are not supported by the SQLite Drizzle adapter");
+          }
+          const run = async () => {
+            drizzle.run(sql3`BEGIN IMMEDIATE`);
+            try {
+              const result2 = await sqliteTxContext.run(true, () => fn(self));
+              drizzle.run(sql3`COMMIT`);
+              return result2;
+            } catch (error) {
+              drizzle.run(sql3`ROLLBACK`);
+              throw error;
+            }
+          };
+          const result = sqliteTxChain.then(run, run);
+          sqliteTxChain = result.catch(() => void 0);
+          return result;
+        }
+        return drizzle.transaction(async (tx) => {
+          const txAdapter = buildAdapter(tx);
+          return fn(txAdapter);
+        });
+      }
+    };
+    return self;
+  }
+  return buildAdapter(db);
+}
+
+// src/core/schema-builder.ts
+import { fromJSONSchema } from "@bajustone/fetcher/openapi";
+import { date as fDate, datetime as fDatetime, email as fEmail, time as fTime, url as fUrl, uuid as fUuid } from "@bajustone/fetcher/schema";
+function collectRefNames(schema, acc) {
+  if (!schema || typeof schema !== "object")
+    return acc;
+  if (typeof schema.$ref === "string") {
+    const i = schema.$ref.lastIndexOf("/");
+    acc.add(i >= 0 ? schema.$ref.slice(i + 1) : schema.$ref);
+  }
+  if (schema.properties) {
+    for (const key of Object.keys(schema.properties))
+      collectRefNames(schema.properties[key], acc);
+  }
+  collectRefNames(schema.items, acc);
+  for (const key of ["oneOf", "anyOf", "allOf"]) {
+    const variants = schema[key];
+    if (variants) {
+      for (const variant of variants)
+        collectRefNames(variant, acc);
+    }
+  }
+  if (schema.additionalProperties && typeof schema.additionalProperties === "object")
+    collectRefNames(schema.additionalProperties, acc);
+  return acc;
+}
+var refDefinitionContexts = /* @__PURE__ */ new WeakMap();
+function refName(refPath) {
+  const i = refPath.lastIndexOf("/");
+  return i >= 0 ? refPath.slice(i + 1) : refPath;
+}
+var COMPONENT_NAME_RE = /^[\w.-]+$/;
+function assertComponentName(name) {
+  if (!COMPONENT_NAME_RE.test(name))
+    throw new Error(`Invalid OpenAPI component name '${name}'`);
+}
+function resolveRefDefs(schema) {
+  if (collectRefNames(schema, /* @__PURE__ */ new Set()).size === 0)
+    return void 0;
+  const defs = /* @__PURE__ */ Object.create(null);
+  const unresolved = /* @__PURE__ */ new Set();
+  const hasOwn = (value, key) => Object.hasOwn(value, key);
+  const visit = (node, inherited) => {
+    if (!node || typeof node !== "object")
+      return;
+    const context = refDefinitionContexts.get(node) ?? inherited;
+    if (typeof node.$ref === "string") {
+      const name = refName(node.$ref);
+      const component = context && hasOwn(context, name) ? context[name] : void 0;
+      if (component) {
+        if (hasOwn(defs, name) && !unresolved.has(name) && defs[name] !== component) {
+          throw new Error(`Conflicting component definitions for $ref '${name}'`);
+        }
+        const firstResolution = !hasOwn(defs, name) || unresolved.delete(name);
+        defs[name] = component;
+        if (firstResolution)
+          visit(component, context);
+      } else if (!hasOwn(defs, name)) {
+        defs[name] = {};
+        unresolved.add(name);
+      }
+    }
+    if (node.properties) {
+      for (const child of Object.values(node.properties))
+        visit(child, context);
+    }
+    visit(node.items, context);
+    for (const key of ["oneOf", "anyOf", "allOf"]) {
+      for (const child of node[key] ?? [])
+        visit(child, context);
+    }
+    if (node.additionalProperties && typeof node.additionalProperties === "object")
+      visit(node.additionalProperties, context);
+  };
+  visit(schema);
+  return defs;
+}
+function createStandardProps(schema) {
+  let validateFn;
+  return {
+    version: 1,
+    vendor: "fortress",
+    validate(value) {
+      if (!validateFn) {
+        const defs = resolveRefDefs(schema);
+        validateFn = fromJSONSchema(schema, defs)["~standard"].validate;
+      }
+      return validateFn(value);
+    }
+  };
+}
+function createExactOneOfProps(schemas) {
+  const validate = (value) => {
+    const results = schemas.map((schema) => schema["~standard"].validate(value));
+    if (results.some((result) => result instanceof Promise)) {
+      return Promise.all(results).then((resolved) => exactOneResult(resolved));
+    }
+    return exactOneResult(results);
+  };
+  return {
+    version: 1,
+    vendor: "fortress",
+    validate
+  };
+}
+function exactOneResult(results) {
+  const successes = results.filter((result) => !result.issues);
+  if (successes.length === 1)
+    return { value: successes[0].value };
+  return {
+    issues: [{
+      message: successes.length === 0 ? "Value must match exactly one oneOf variant" : "Value must match exactly one oneOf variant; multiple variants matched"
+    }]
+  };
+}
+function toFortressSchema(schema, refDefinitions, standardProps) {
+  if (refDefinitions)
+    refDefinitionContexts.set(schema, refDefinitions);
+  return Object.assign(schema, {
+    "~standard": standardProps ?? createStandardProps(schema)
+  });
+}
+function str(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "string" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minLength = o.min;
+  if (o.max !== void 0)
+    s.maxLength = o.max;
+  if (o.pattern !== void 0)
+    s.pattern = o.pattern;
+  if (o.format !== void 0)
+    s.format = o.format;
+  return toFortressSchema(s);
+}
+function int(opts) {
+  const o = typeof opts === "string" ? { description: opts } : opts ?? {};
+  const s = { type: "integer" };
+  if (o.description)
+    s.description = o.description;
+  if (o.min !== void 0)
+    s.minimum = o.min;
+  if (o.max !== void 0)
+    s.maximum = o.max;
+  return toFortressSchema(s);
+}
+function id(description) {
+  const s = { type: "string", minLength: 1 };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function bool(description) {
+  const s = { type: "boolean" };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function arr(items, description) {
+  const s = { type: "array", items };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function obj(properties, ...required) {
+  const s = { type: "object", properties };
+  if (required.length > 0)
+    s.required = required;
+  return toFortressSchema(s);
+}
+function nullable(schema) {
+  if (typeof schema.$ref === "string")
+    return toFortressSchema({ oneOf: [schema, { type: "null" }] });
+  const s = { ...schema, nullable: true };
+  return toFortressSchema(s, refDefinitionContexts.get(schema));
+}
+function oneOf(...schemas) {
+  const schema = { oneOf: schemas };
+  return toFortressSchema(
+    schema,
+    void 0,
+    createExactOneOfProps(schemas)
+  );
+}
+function defineComponents(components) {
+  for (const name of Object.keys(components))
+    assertComponentName(name);
+  const definitions = Object.assign(
+    /* @__PURE__ */ Object.create(null),
+    components
+  );
+  return {
+    components,
+    ref: (name) => {
+      assertComponentName(name);
+      return toFortressSchema(
+        { $ref: `#/components/schemas/${String(name)}` },
+        definitions
+      );
+    }
+  };
+}
+function enums(...values) {
+  return toFortressSchema({ enum: values });
+}
+function strFormat(format, description) {
+  const s = { type: "string", format };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function nullType() {
+  return toFortressSchema({ type: "null" });
+}
+function record(description) {
+  const s = { type: "object", additionalProperties: true };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function recordOf(valueSchema, description) {
+  const s = { type: "object", additionalProperties: valueSchema };
+  if (description)
+    s.description = description;
+  return toFortressSchema(s);
+}
+function makeFormatBuilder(factory) {
+  const f = factory();
+  return (description) => {
+    const s = { type: "string" };
+    if (f.format)
+      s.format = f.format;
+    if (f.pattern)
+      s.pattern = f.pattern;
+    if (description)
+      s.description = description;
+    return toFortressSchema(s);
+  };
+}
+var email = makeFormatBuilder(fEmail);
+var uuid = makeFormatBuilder(fUuid);
+var url = makeFormatBuilder(fUrl);
+var datetime = makeFormatBuilder(fDatetime);
+var date = makeFormatBuilder(fDate);
+var time = makeFormatBuilder(fTime);
+function isStandardSchema(value) {
+  return typeof value === "object" && value !== null && "~standard" in value && typeof value["~standard"]?.validate === "function";
+}
+function isFortressSchema(value) {
+  return isStandardSchema(value) && value["~standard"].vendor === "fortress" && ("type" in value || "$ref" in value || "oneOf" in value || "anyOf" in value);
+}
+var JSON_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "integer", "boolean", "object", "array", "null"]);
+function hasJsonSchemaShape(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  if ("$ref" in v || "oneOf" in v || "anyOf" in v || "allOf" in v)
+    return true;
+  if (typeof v.type === "string" && JSON_SCHEMA_TYPES.has(v.type))
+    return true;
+  if (Array.isArray(v.type) && v.type.every((t) => typeof t === "string" && JSON_SCHEMA_TYPES.has(t)))
+    return true;
+  return false;
+}
+function extractJsonSchema(schema) {
+  if (isFortressSchema(schema)) {
+    return schema;
+  }
+  if (isStandardSchema(schema)) {
+    const std = schema["~standard"];
+    if (std?.jsonSchema?.input) {
+      return std.jsonSchema.input({ target: "draft-2020-12" });
+    }
+    if (hasJsonSchemaShape(schema)) {
+      return schema;
+    }
+  }
+  return {};
+}
+var ErrorEnvelope = obj({
+  code: str("Machine-readable error code"),
+  message: str("Human-readable error message"),
+  statusCode: int("HTTP status code"),
+  details: toFortressSchema({ description: "Optional structured error details" })
+}, "code", "message", "statusCode");
+var EndpointBuilder = class {
+  _method;
+  _path;
+  _handler = "";
+  _summary = "";
+  _description;
+  _tags = [];
+  _security = [];
+  _deprecated = false;
+  _permission;
+  _body;
+  _query;
+  _params;
+  _responses = {};
+  constructor(method, path) {
+    this._method = method;
+    this._path = path;
+  }
+  summary(s) {
+    this._summary = s;
+    return this;
+  }
+  description(s) {
+    this._description = s;
+    return this;
+  }
+  tags(...t) {
+    this._tags.push(...t);
+    return this;
+  }
+  security(...s) {
+    this._security.push(...s);
+    return this;
+  }
+  deprecated() {
+    this._deprecated = true;
+    return this;
+  }
+  permission(resource, action) {
+    this._permission = { resource, action };
+    return this;
+  }
+  body(schema) {
+    this._body = schema;
+    return this;
+  }
+  query(schema) {
+    this._query = schema;
+    return this;
+  }
+  params(schema) {
+    this._params = schema;
+    return this;
+  }
+  response(status, description, schema) {
+    const stored = { description };
+    if (schema !== void 0) {
+      stored.schema = isStandardSchema(schema) ? extractJsonSchema(schema) : schema;
+    }
+    this._responses[status] = stored;
+    return this;
+  }
+  /**
+   * Declare an error response that returns the canonical {@link ErrorEnvelope}
+   * body. Shorthand for `.response(status, description, ErrorEnvelope)`.
+   *
+   * Aligns host endpoint error responses with what Fortress's own routes
+   * emit, so a single client-side error parser works everywhere.
+   *
+   * ```ts
+   * endpoint('GET', '/schools/:id')
+   *   .summary('Get a school')
+   *   .params(obj({ id: str() }, 'id'))
+   *   .response(200, 'OK', SchoolEnvelope)
+   *   .errorResponse(404, 'School not found')
+   *   .errorResponse(403, 'Forbidden')
+   *   .build();
+   * ```
+   */
+  errorResponse(status, description) {
+    return this.response(status, description, ErrorEnvelope);
+  }
+  handler(name) {
+    this._handler = name;
+    return this;
+  }
+  build() {
+    const def = {
+      method: this._method,
+      path: this._path,
+      handler: this._handler
+    };
+    if (this._summary || this._tags.length > 0 || this._security.length > 0 || this._description || this._deprecated || this._permission) {
+      def.meta = {
+        summary: this._summary,
+        ...this._description && { description: this._description },
+        ...this._tags.length > 0 && { tags: this._tags },
+        ...this._security.length > 0 && { security: this._security },
+        ...this._deprecated && { deprecated: true },
+        ...this._permission && { permission: this._permission }
+      };
+    }
+    if (this._body || this._query || this._params) {
+      def.input = {};
+      if (this._body) {
+        def.input.body = extractJsonSchema(this._body);
+        if (isStandardSchema(this._body))
+          def.input.bodySchema = this._body;
+      }
+      if (this._query) {
+        def.input.query = extractJsonSchema(this._query);
+        if (isStandardSchema(this._query))
+          def.input.querySchema = this._query;
+      }
+      if (this._params) {
+        def.input.params = extractJsonSchema(this._params);
+        if (isStandardSchema(this._params))
+          def.input.paramsSchema = this._params;
+      }
+    }
+    if (Object.keys(this._responses).length > 0) {
+      def.responses = this._responses;
+    }
+    return def;
+  }
+};
+function endpoint(method, path) {
+  return new EndpointBuilder(method, path);
+}
+
+// src/core/auth/auth-endpoints.ts
+var User = obj(
+  {
+    id: id("User ID"),
+    email: strFormat("email", "User email"),
+    name: str("Display name"),
+    isActive: bool("Account active status"),
+    emailVerified: bool("Email verification status"),
+    createdAt: strFormat("date-time", "Creation timestamp"),
+    updatedAt: strFormat("date-time", "Last update timestamp")
+  },
+  "id",
+  "email",
+  "name",
+  "isActive",
+  "createdAt",
+  "updatedAt"
+);
+var AuthChallenge = obj(
+  {
+    reason: enums("two-factor", "webauthn", "email-verification", "magic-link"),
+    continuationToken: str("Single-use post-auth continuation token")
+  },
+  "reason",
+  "continuationToken"
+);
+var AuthResult = oneOf(
+  obj(
+    {
+      status: enums("success"),
+      user: User,
+      method: enums("password", "refresh", "two-factor", "webauthn", "magic-link", "impersonation"),
+      accessToken: str("JWT access token"),
+      refreshToken: str("Refresh token for rotation"),
+      pluginData: record()
+    },
+    "status",
+    "user",
+    "method",
+    "accessToken",
+    "refreshToken"
+  ),
+  obj(
+    {
+      status: enums("pending"),
+      user: User,
+      pending: AuthChallenge,
+      pluginData: record()
+    },
+    "status",
+    "user",
+    "pending"
+  ),
+  obj(
+    {
+      status: enums("impersonation"),
+      user: User,
+      accessToken: str("JWT access token"),
+      refreshToken: nullType(),
+      pluginData: record()
+    },
+    "status",
+    "user",
+    "accessToken",
+    "refreshToken"
+  )
+);
+var AuthTokenPair = obj(
+  {
+    accessToken: str("JWT access token"),
+    refreshToken: str("New refresh token")
+  },
+  "accessToken",
+  "refreshToken"
+);
+var SessionInfo = obj(
+  {
+    id: id("Token ID"),
+    ipAddress: nullable(str("Client IP address")),
+    userAgent: nullable(str("Client user agent")),
+    deviceName: nullable(str("Device name")),
+    createdAt: strFormat("date-time", "Session creation time"),
+    lastActiveAt: nullable(strFormat("date-time", "Last activity time"))
+  },
+  "id",
+  "createdAt"
+);
+var CreateUserInput = obj(
+  {
+    email: email("User email"),
+    // enforced format (ReDoS-safe pattern), not annotation-only
+    name: str("Display name"),
+    password: str("User password"),
+    isActive: bool("Set active status (default true)")
+  },
+  "email",
+  "name"
+);
+var ErrorResponse = obj(
+  {
+    code: str("Error code (e.g. UNAUTHORIZED)"),
+    message: str("Human-readable message"),
+    statusCode: int("HTTP status code")
+  },
+  "code",
+  "message",
+  "statusCode"
+);
+var LoginIdentifier = obj(
+  {
+    id: id("Identifier ID"),
+    userId: id("User ID"),
+    type: enums("email", "phone", "username"),
+    value: str("Identifier value")
+  },
+  "id",
+  "userId",
+  "type",
+  "value"
+);
+var authComponents = defineComponents({
+  User,
+  AuthChallenge,
+  AuthResult,
+  AuthTokenPair,
+  SessionInfo,
+  CreateUserInput,
+  ErrorResponse,
+  LoginIdentifier
+});
+var authComponentSchemas = authComponents.components;
+var authRef = authComponents.ref;
+var authEndpoints = {
+  login: endpoint("POST", "/auth/login").summary("Login with credentials").tags("Auth").security("none").body(obj(
+    {
+      identifier: str("Email, username, or phone"),
+      password: str("User password"),
+      trustedDeviceToken: str("Opaque trusted-device token previously returned after two-factor verification")
+    },
+    "identifier",
+    "password"
+  )).response(200, "Login successful", authRef("AuthResult")).response(401, "Invalid credentials", authRef("ErrorResponse")).handler("login").build(),
+  verifyTwoFactor: endpoint("POST", "/auth/2fa/verify").summary("Complete a pending two-factor challenge").tags("Auth", "Two-Factor").security("none").body(obj(
+    {
+      continuationToken: str("Single-use auth continuation token"),
+      code: str("TOTP or backup code"),
+      rememberDevice: bool("Issue an opaque trusted-device token after successful verification")
+    },
+    "continuationToken",
+    "code"
+  )).response(200, "Authentication result", authRef("AuthResult")).response(400, "Two-factor plugin unavailable", authRef("ErrorResponse")).response(401, "Invalid continuation or verification code", authRef("ErrorResponse")).handler("verifyTwoFactor").build(),
+  verifyMagicLink: endpoint("POST", "/auth/magic-link/verify").summary("Verify a magic-link token").tags("Auth", "Magic Link").security("none").body(obj({ token: str("Raw magic-link token") }, "token")).response(200, "Authentication result", authRef("AuthResult")).response(400, "Magic-link plugin unavailable", authRef("ErrorResponse")).response(404, "Invalid or expired magic link", authRef("ErrorResponse")).handler("verifyMagicLink").build(),
+  createUser: endpoint("POST", "/auth/register").summary("Create a new user").tags("Auth").security("none").body(CreateUserInput).response(201, "User created", authRef("User")).response(409, "Email already exists", authRef("ErrorResponse")).handler("createUser").build(),
+  refresh: endpoint("POST", "/auth/refresh").summary("Refresh access token").tags("Auth").security("none").body(obj({ refreshToken: str("Current refresh token") }, "refreshToken")).response(200, "Tokens refreshed", authRef("AuthTokenPair")).response(401, "Invalid or expired refresh token", authRef("ErrorResponse")).handler("refresh").build(),
+  logout: endpoint("POST", "/auth/logout").summary("Logout and revoke refresh token").tags("Auth").security("none").body(obj({ refreshToken: str("Refresh token to revoke") }, "refreshToken")).response(200, "Logged out", obj({ ok: bool() }, "ok")).handler("logout").build(),
+  me: endpoint("GET", "/auth/me").summary("Get current user profile").tags("Auth").security("bearer").response(200, "Current user", authRef("User")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("me").build(),
+  listSessions: endpoint("GET", "/auth/sessions").summary("List active sessions").tags("Auth").security("bearer").response(200, "Active sessions", arr(authRef("SessionInfo"))).response(401, "Not authenticated", authRef("ErrorResponse")).handler("listSessions").build(),
+  revokeSession: endpoint("DELETE", "/auth/sessions/:id").summary("Revoke a specific session").tags("Auth").security("bearer").params(obj({ id: id("Session/token ID") }, "id")).response(200, "Session revoked", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("revokeSession").build(),
+  revokeAllOtherSessions: endpoint("DELETE", "/auth/sessions").summary("Revoke all other sessions").description("Revokes all active sessions except the current one. Requires the current token ID.").tags("Auth").security("bearer").body(obj({ currentTokenId: id("Current token ID to keep") }, "currentTokenId")).response(200, "Other sessions revoked", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("revokeAllOtherSessions").build(),
+  addLoginIdentifier: endpoint("POST", "/auth/identifiers").summary("Add a login identifier").tags("Auth").security("bearer").body(obj(
+    {
+      type: enums("email", "phone", "username"),
+      value: str("Identifier value")
+    },
+    "type",
+    "value"
+  )).response(200, "Identifier added", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("addLoginIdentifier").build(),
+  removeLoginIdentifier: endpoint("DELETE", "/auth/identifiers").summary("Remove a login identifier").tags("Auth").security("bearer").body(obj(
+    {
+      type: enums("email", "phone", "username"),
+      value: str("Identifier value")
+    },
+    "type",
+    "value"
+  )).response(200, "Identifier removed", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("removeLoginIdentifier").build(),
+  getLoginIdentifiers: endpoint("GET", "/auth/identifiers").summary("List login identifiers").tags("Auth").security("bearer").response(200, "Login identifiers", arr(authRef("LoginIdentifier"))).response(401, "Not authenticated", authRef("ErrorResponse")).handler("getLoginIdentifiers").build(),
+  impersonate: endpoint("POST", "/auth/impersonate").summary("Impersonate a user").description("Issue a short-lived, non-renewable token to act as another user. Requires fortress:impersonate permission.").tags("Auth").security("bearer").permission("fortress", "impersonate").body(obj(
+    {
+      targetUserId: id("User to impersonate"),
+      reason: str("Reason for impersonation"),
+      expirySeconds: int("Token expiry in seconds (default 3600)")
+    },
+    "targetUserId"
+  )).response(200, "Impersonation token issued", authRef("AuthResult")).response(401, "Not authenticated", authRef("ErrorResponse")).response(404, "Target user not found", authRef("ErrorResponse")).handler("impersonate").build()
+};
+
+// src/core/http/csrf.ts
+function resolveCsrfConfig(config) {
+  return {
+    enabled: config?.enabled ?? true,
+    headerName: config?.headerName ?? "X-Fortress-CSRF",
+    skipPaths: config?.skipPaths ?? [],
+    rejectSameSite: config?.rejectSameSite ?? false
+  };
+}
+
+// src/core/iam/iam-endpoints.ts
+var Role = obj(
+  {
+    id: id("Role ID"),
+    name: str("Role name"),
+    description: nullable(str("Role description")),
+    isSystem: bool("Whether this is a system role")
+  },
+  "id",
+  "name"
+);
+var Group = obj(
+  {
+    id: id("Group ID"),
+    name: str("Group name"),
+    description: nullable(str("Group description"))
+  },
+  "id",
+  "name"
+);
+var Permission = obj(
+  {
+    id: id("Permission ID"),
+    resource: str("Resource name"),
+    action: str("Action name"),
+    effect: enums("ALLOW", "DENY"),
+    conditions: arr(obj({
+      field: str("Condition field"),
+      operator: enums("eq", "neq", "in", "startsWith"),
+      value: str("Condition value")
+    }), "Permission conditions"),
+    description: nullable(str("Permission description"))
+  },
+  "id",
+  "resource",
+  "action",
+  "effect"
+);
+var PermissionInput = obj(
+  {
+    resource: str("Resource name"),
+    action: str("Action name"),
+    effect: enums("ALLOW", "DENY"),
+    conditions: arr(obj({
+      field: str("Condition field"),
+      operator: enums("eq", "neq", "in", "startsWith"),
+      value: str("Condition value")
+    }))
+  },
+  "resource",
+  "action"
+);
+var ServiceAccount = obj(
+  {
+    id: id("Service account ID"),
+    name: str("Machine identifier \u2014 immutable after creation"),
+    displayName: nullable(str("Human-readable label")),
+    description: nullable(str("Free-form description")),
+    isActive: bool("Whether the account can authenticate and resolve permissions"),
+    createdAt: str("ISO 8601 creation timestamp"),
+    updatedAt: str("ISO 8601 update timestamp")
+  },
+  "id",
+  "name",
+  "isActive"
+);
+var iamComponents = defineComponents({
+  Role,
+  Group,
+  Permission,
+  PermissionInput,
+  ServiceAccount
+});
+var iamComponentSchemas = iamComponents.components;
+var iamRef = iamComponents.ref;
+var iamEndpoints = {
+  // ── Resources ──
+  getResources: endpoint("GET", "/iam/resources").summary("List all available resources").tags("IAM", "Resources").security("bearer").permission("fortress", "viewResources").response(200, "Available resources with their actions", obj({
+    resources: recordOf(obj({
+      actions: arr(str("Action name"), "Available actions"),
+      description: str("Resource description")
+    }), "Map of resource name to definition")
+  }, "resources")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("getResources").build(),
+  // ── Roles ──
+  getRoles: endpoint("GET", "/iam/roles").summary("List all roles").tags("IAM", "Roles").security("bearer").permission("fortress", "viewRoles").response(200, "All roles", arr(iamRef("Role"))).response(401, "Not authenticated", authRef("ErrorResponse")).handler("getRoles").build(),
+  createRole: endpoint("POST", "/iam/roles").summary("Create a role").tags("IAM", "Roles").security("bearer").permission("fortress", "createRole").body(obj(
+    {
+      name: str("Role name"),
+      permissions: arr(iamRef("PermissionInput"), "Permissions to assign"),
+      description: str("Role description")
+    },
+    "name",
+    "permissions"
+  )).response(201, "Role created", iamRef("Role")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("createRole").build(),
+  deleteRole: endpoint("DELETE", "/iam/roles/:id").summary("Delete a role").tags("IAM", "Roles").security("bearer").permission("fortress", "deleteRole").params(obj({ id: id("Role ID") }, "id")).response(200, "Role deleted", obj({ ok: bool() }, "ok")).response(400, "Cannot delete system role", authRef("ErrorResponse")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("deleteRole").build(),
+  // ── Role Bindings ──
+  bindRoleToUser: endpoint("POST", "/iam/roles/:id/bind/user").summary("Bind role to a user").tags("IAM", "Roles").security("bearer").permission("fortress", "bindRole").params(obj({ id: id("Role ID") }, "id")).body(obj(
+    { userId: id("User ID"), tenantId: str("Tenant ID (optional)") },
+    "userId"
+  )).response(200, "Role bound to user", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("bindRoleToUser").build(),
+  bindRoleToGroup: endpoint("POST", "/iam/roles/:id/bind/group").summary("Bind role to a group").tags("IAM", "Roles").security("bearer").permission("fortress", "bindRole").params(obj({ id: id("Role ID") }, "id")).body(obj(
+    { groupId: id("Group ID"), tenantId: str("Tenant ID (optional)") },
+    "groupId"
+  )).response(200, "Role bound to group", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("bindRoleToGroup").build(),
+  unbindRole: endpoint("DELETE", "/iam/roles/:id/bind").summary("Unbind a role").tags("IAM", "Roles").security("bearer").permission("fortress", "unbindRole").params(obj({ id: id("Role ID") }, "id")).body(obj(
+    {
+      subjectType: enums("USER", "GROUP", "SERVICE_ACCOUNT"),
+      subjectId: id("Subject ID"),
+      tenantId: str("Tenant ID (optional)")
+    },
+    "subjectType",
+    "subjectId"
+  )).response(200, "Role unbound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("unbindRole").build(),
+  // ── Groups ──
+  createGroup: endpoint("POST", "/iam/groups").summary("Create a group").tags("IAM", "Groups").security("bearer").permission("fortress", "createGroup").body(obj(
+    { name: str("Group name"), description: str("Group description") },
+    "name"
+  )).response(201, "Group created", iamRef("Group")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("createGroup").build(),
+  addUserToGroup: endpoint("POST", "/iam/groups/:id/users").summary("Add user to group").tags("IAM", "Groups").security("bearer").permission("fortress", "manageGroup").params(obj({ id: id("Group ID") }, "id")).body(obj({ userId: id("User ID") }, "userId")).response(200, "User added to group", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("addUserToGroup").build(),
+  removeUserFromGroup: endpoint("DELETE", "/iam/groups/:id/users/:userId").summary("Remove user from group").tags("IAM", "Groups").security("bearer").permission("fortress", "manageGroup").params(obj({ id: id("Group ID"), userId: id("User ID") }, "id", "userId")).response(200, "User removed from group", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("removeUserFromGroup").build(),
+  // ── Permissions ──
+  getUserPermissions: endpoint("GET", "/iam/users/:id/permissions").summary("Get user permissions").tags("IAM", "Permissions").security("bearer").permission("fortress", "viewPermissions").params(obj({ id: id("User ID") }, "id")).query(obj({ tenantId: str("Tenant ID (optional)") })).response(200, "User permissions", arr(iamRef("Permission"))).response(401, "Not authenticated", authRef("ErrorResponse")).handler("getUserPermissions").build(),
+  checkPermission: endpoint("POST", "/iam/check").summary("Check if user has permission").tags("IAM", "Permissions").security("bearer").permission("fortress", "viewPermissions").body(obj(
+    {
+      userId: id("User ID"),
+      resource: str("Resource name"),
+      action: str("Action name"),
+      context: record("Permission context")
+    },
+    "userId",
+    "resource",
+    "action"
+  )).response(200, "Permission check result", obj({ allowed: bool("Whether permission is granted") }, "allowed")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("checkPermission").build(),
+  bindPermissionToUser: endpoint("POST", "/iam/permissions/bind/user").summary("Bind permission directly to a user").tags("IAM", "Permissions").security("bearer").permission("fortress", "managePermissions").body(obj(
+    {
+      userId: id("User ID"),
+      permission: iamRef("PermissionInput"),
+      tenantId: str("Tenant ID (optional)")
+    },
+    "userId",
+    "permission"
+  )).response(200, "Permission bound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("bindPermissionToUser").build(),
+  bindPermissionToGroup: endpoint("POST", "/iam/permissions/bind/group").summary("Bind permission directly to a group").tags("IAM", "Permissions").security("bearer").permission("fortress", "managePermissions").body(obj(
+    {
+      groupId: id("Group ID"),
+      permission: iamRef("PermissionInput"),
+      tenantId: str("Tenant ID (optional)")
+    },
+    "groupId",
+    "permission"
+  )).response(200, "Permission bound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("bindPermissionToGroup").build(),
+  unbindPermissionFromUser: endpoint("DELETE", "/iam/permissions/bind/user").summary("Unbind permission from a user").tags("IAM", "Permissions").security("bearer").permission("fortress", "managePermissions").body(obj(
+    {
+      userId: id("User ID"),
+      permissionId: id("Permission ID"),
+      tenantId: str("Tenant ID (optional)")
+    },
+    "userId",
+    "permissionId"
+  )).response(200, "Permission unbound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("unbindPermissionFromUser").build(),
+  unbindPermissionFromGroup: endpoint("DELETE", "/iam/permissions/bind/group").summary("Unbind permission from a group").tags("IAM", "Permissions").security("bearer").permission("fortress", "managePermissions").body(obj(
+    {
+      groupId: id("Group ID"),
+      permissionId: id("Permission ID"),
+      tenantId: str("Tenant ID (optional)")
+    },
+    "groupId",
+    "permissionId"
+  )).response(200, "Permission unbound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("unbindPermissionFromGroup").build(),
+  // ── Service Accounts ──
+  createServiceAccount: endpoint("POST", "/iam/service-accounts").summary("Create a service account").description("Create a non-human IAM principal. Service accounts hold roles and direct permissions just like users, but have no sessions, passwords, or group memberships. The `name` is immutable after creation.").tags("IAM", "Service Accounts").security("bearer").permission("fortress", "createServiceAccount").body(obj(
+    {
+      name: str("Machine identifier (immutable)"),
+      displayName: str("Human-readable label"),
+      description: str("Free-form description")
+    },
+    "name"
+  )).response(201, "Service account created", iamRef("ServiceAccount")).response(400, "Bad request", authRef("ErrorResponse")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("createServiceAccount").build(),
+  listServiceAccounts: endpoint("GET", "/iam/service-accounts").summary("List service accounts").tags("IAM", "Service Accounts").security("bearer").permission("fortress", "viewServiceAccounts").query(obj({
+    limit: int("Page size (default 50)"),
+    offset: int("Offset from the start of the list")
+  })).response(200, "Service accounts", obj({
+    serviceAccounts: arr(iamRef("ServiceAccount")),
+    total: int("Total service accounts")
+  }, "serviceAccounts", "total")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("listServiceAccounts").build(),
+  getServiceAccount: endpoint("GET", "/iam/service-accounts/:id").summary("Get a service account by ID").tags("IAM", "Service Accounts").security("bearer").permission("fortress", "viewServiceAccounts").params(obj({ id: id("Service account ID") }, "id")).response(200, "Service account", iamRef("ServiceAccount")).response(401, "Not authenticated", authRef("ErrorResponse")).response(404, "Not found", authRef("ErrorResponse")).handler("getServiceAccount").build(),
+  updateServiceAccount: endpoint("PATCH", "/iam/service-accounts/:id").summary("Update a service account").description("Update displayName, description, or isActive. The `name` field is immutable \u2014 to rename, delete and recreate.").tags("IAM", "Service Accounts").security("bearer").permission("fortress", "manageServiceAccount").params(obj({ id: id("Service account ID") }, "id")).body(obj({
+    displayName: nullable(str("New human-readable label")),
+    description: nullable(str("New description")),
+    isActive: bool("Whether the account is active")
+  })).response(200, "Service account updated", iamRef("ServiceAccount")).response(401, "Not authenticated", authRef("ErrorResponse")).response(404, "Not found", authRef("ErrorResponse")).handler("updateServiceAccount").build(),
+  deleteServiceAccount: endpoint("DELETE", "/iam/service-accounts/:id").summary("Delete a service account").description("Hard-deletes the service account and cascades to role bindings, direct permission bindings, and (via plugin observer) api keys owned by the account.").tags("IAM", "Service Accounts").security("bearer").permission("fortress", "manageServiceAccount").params(obj({ id: id("Service account ID") }, "id")).response(200, "Service account deleted", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).response(404, "Not found", authRef("ErrorResponse")).handler("deleteServiceAccount").build(),
+  getServiceAccountPermissions: endpoint("GET", "/iam/service-accounts/:id/permissions").summary("Get effective permissions for a service account").tags("IAM", "Service Accounts", "Permissions").security("bearer").permission("fortress", "viewPermissions").params(obj({ id: id("Service account ID") }, "id")).query(obj({ tenantId: str("Tenant ID (optional)") })).response(200, "Service account permissions", arr(iamRef("Permission"))).response(401, "Not authenticated", authRef("ErrorResponse")).handler("getServiceAccountPermissions").build(),
+  bindRoleToServiceAccount: endpoint("POST", "/iam/roles/:id/bind/service-account").summary("Bind role to a service account").tags("IAM", "Roles", "Service Accounts").security("bearer").permission("fortress", "bindRole").params(obj({ id: id("Role ID") }, "id")).body(obj(
+    { serviceAccountId: id("Service account ID"), tenantId: str("Tenant ID (optional)") },
+    "serviceAccountId"
+  )).response(200, "Role bound to service account", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("bindRoleToServiceAccount").build(),
+  unbindRoleFromServiceAccount: endpoint("DELETE", "/iam/roles/:id/bind/service-account").summary("Unbind role from a service account").tags("IAM", "Roles", "Service Accounts").security("bearer").permission("fortress", "unbindRole").params(obj({ id: id("Role ID") }, "id")).body(obj(
+    { serviceAccountId: id("Service account ID"), tenantId: str("Tenant ID (optional)") },
+    "serviceAccountId"
+  )).response(200, "Role unbound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("unbindRoleFromServiceAccount").build(),
+  bindPermissionToServiceAccount: endpoint("POST", "/iam/permissions/bind/service-account").summary("Bind permission directly to a service account").tags("IAM", "Permissions", "Service Accounts").security("bearer").permission("fortress", "managePermissions").body(obj(
+    {
+      serviceAccountId: id("Service account ID"),
+      permission: iamRef("PermissionInput"),
+      tenantId: str("Tenant ID (optional)")
+    },
+    "serviceAccountId",
+    "permission"
+  )).response(200, "Permission bound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("bindPermissionToServiceAccount").build(),
+  unbindPermissionFromServiceAccount: endpoint("DELETE", "/iam/permissions/bind/service-account").summary("Unbind permission from a service account").tags("IAM", "Permissions", "Service Accounts").security("bearer").permission("fortress", "managePermissions").body(obj(
+    {
+      serviceAccountId: id("Service account ID"),
+      permissionId: id("Permission ID"),
+      tenantId: str("Tenant ID (optional)")
+    },
+    "serviceAccountId",
+    "permissionId"
+  )).response(200, "Permission unbound", obj({ ok: bool() }, "ok")).response(401, "Not authenticated", authRef("ErrorResponse")).handler("unbindPermissionFromServiceAccount").build()
+};
+
+// src/core/manifest/route-manifest.ts
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function endpointKey(endpoint2) {
+  return `${endpoint2.method.toUpperCase()} ${endpoint2.path}`;
+}
+function classifyEndpoint(endpoint2) {
+  const security = endpoint2.meta?.security ?? [];
+  if (endpoint2.meta?.bearerKind === "oauth")
+    return "oauth-protocol";
+  if (security.includes("none"))
+    return "public";
+  if (endpoint2.meta?.permission)
+    return "rbac";
+  if (security.includes("bearer") || security.includes("apiKey") || security.includes("basic"))
+    return "authenticated";
+  return "default-deny";
+}
+function pathPatternToRegex(pattern) {
+  const regexStr = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/:[^/]+/g, "[^/]+").replace(/\\\*/g, ".*").replace(/\//g, "\\/");
+  return new RegExp(`^${regexStr}$`);
+}
+function middlewareMatchesEndpoint(middleware, endpoint2) {
+  if (!pathPatternToRegex(middleware.path).test(endpoint2.path))
+    return false;
+  const methods = middleware.methods;
+  if (methods && !methods.map((m) => m.toUpperCase()).includes(endpoint2.method.toUpperCase()))
+    return false;
+  return true;
+}
+function isRateLimited(endpoint2, plugins) {
+  for (const plugin of plugins) {
+    if (plugin.name !== "rate-limit")
+      continue;
+    for (const middleware of plugin.middleware ?? []) {
+      if (middlewareMatchesEndpoint(middleware, endpoint2))
+        return true;
+    }
+  }
+  if (plugins.some((plugin) => plugin.name === "rate-limit")) {
+    if (endpoint2.method === "POST" && endpoint2.path === "/auth/login")
+      return true;
+    if (endpoint2.method === "POST" && endpoint2.path === "/auth/register")
+      return true;
+    if (endpoint2.method === "POST" && endpoint2.path === "/auth/refresh")
+      return true;
+  }
+  return false;
+}
+function csrfApplies(endpoint2, fortress) {
+  const csrf = resolveCsrfConfig(fortress.config.csrf);
+  if (!csrf.enabled)
+    return false;
+  if (SAFE_METHODS.has(endpoint2.method.toUpperCase()))
+    return false;
+  for (const skip of csrf.skipPaths) {
+    if (endpoint2.path === skip || endpoint2.path.startsWith(`${skip}/`))
+      return false;
+  }
+  return true;
+}
+function collectEndpointOrigins(fortress) {
+  const origins = /* @__PURE__ */ new Map();
+  const coreAuth = Object.values(authEndpoints);
+  const coreIam = Object.values(iamEndpoints);
+  for (const endpoint2 of coreAuth)
+    origins.set(endpointKey(endpoint2), { endpoint: endpoint2, plugin: "auth" });
+  for (const endpoint2 of coreIam)
+    origins.set(endpointKey(endpoint2), { endpoint: endpoint2, plugin: "iam" });
+  for (const endpoint2 of Object.values(fortress.config.routes ?? {})) {
+    origins.set(endpointKey(endpoint2), { endpoint: endpoint2, plugin: null });
+  }
+  for (const plugin of fortress.config.plugins ?? []) {
+    for (const endpoint2 of Object.values(plugin.routes ?? {})) {
+      origins.set(endpointKey(endpoint2), { endpoint: endpoint2, plugin: plugin.name });
+    }
+  }
+  const byKey = /* @__PURE__ */ new Map();
+  for (const endpoint2 of fortress.endpoints) {
+    const key = endpointKey(endpoint2);
+    byKey.set(key, origins.get(key) ?? { endpoint: endpoint2, plugin: null });
+  }
+  return [...byKey.values()];
+}
+function buildRouteManifest(fortress) {
+  const plugins = fortress.config.plugins ?? [];
+  return collectEndpointOrigins(fortress).map(({ endpoint: endpoint2, plugin }) => {
+    const security = endpoint2.meta?.security ?? [];
+    return {
+      method: endpoint2.method,
+      path: endpoint2.path,
+      handler: endpoint2.handler,
+      plugin,
+      classification: classifyEndpoint(endpoint2),
+      ...endpoint2.meta?.permission ? { permission: endpoint2.meta.permission } : {},
+      security,
+      ...endpoint2.meta?.bearerKind ? { bearerKind: endpoint2.meta.bearerKind } : {},
+      csrfApplicable: csrfApplies(endpoint2, fortress),
+      rateLimited: isRateLimited(endpoint2, plugins),
+      // Top-level host routes are metadata/protection declarations only.
+      // Framework adapters must fall through to the host's own handler.
+      mounted: plugin !== null
+    };
+  }).sort((a, b) => `${a.method} ${a.path}`.localeCompare(`${b.method} ${b.path}`));
+}
+
+// src/core/manifest/drift.ts
+function endpointKey2(route) {
+  return `${route.method.toUpperCase()} ${route.path}`;
+}
+function manifestKey(route) {
+  return `${route.method.toUpperCase()} ${route.path}`;
+}
+function toOpenAPIPath(path) {
+  return path.replace(/:(\w+)/g, "{$1}");
+}
+function fromOpenAPIPath(path) {
+  return path.replace(/\{(\w+)\}/g, ":$1");
+}
+function permissionKey(permission) {
+  return permission ? `${permission.resource}:${permission.action}` : void 0;
+}
+function diffSets(expected, actual) {
+  return [...expected].filter((item) => !actual.has(item)).sort();
+}
+function detectRouteManifestDrift(fortress, options = {}) {
+  const canonicalManifest = buildRouteManifest(fortress);
+  const manifest = options.manifest ?? fortress.manifest ?? canonicalManifest;
+  const mounted = new Set(canonicalManifest.filter((entry) => entry.mounted).map(manifestKey));
+  const manifestMountedRoutes = new Set(manifest.filter((entry) => entry.mounted).map(manifestKey));
+  const manifestRoutes = new Set(manifest.map(manifestKey));
+  let openapiRoutes = /* @__PURE__ */ new Set();
+  if (options.openapi) {
+    for (const [path, operations] of Object.entries(options.openapi.paths)) {
+      for (const method of Object.keys(operations))
+        openapiRoutes.add(`${method.toUpperCase()} ${fromOpenAPIPath(path)}`);
+    }
+  } else {
+    openapiRoutes = new Set(fortress.endpoints.map((ep) => `${ep.method.toUpperCase()} ${toOpenAPIPath(ep.path)}`).map((key) => key.replace(/\{(\w+)\}/g, ":$1")));
+  }
+  const endpointPermissions = /* @__PURE__ */ new Map();
+  for (const endpoint2 of fortress.endpoints)
+    endpointPermissions.set(endpointKey2(endpoint2), permissionKey(endpoint2.meta?.permission));
+  const rbacPermissionMismatches = [];
+  for (const entry of manifest) {
+    const key = manifestKey(entry);
+    const expected = endpointPermissions.get(key);
+    const actual = permissionKey(entry.permission);
+    if (expected !== actual) {
+      rbacPermissionMismatches.push({ route: key, expected, actual });
+      continue;
+    }
+    if (entry.classification === "rbac" && !actual) {
+      rbacPermissionMismatches.push({ route: key, expected, actual });
+    }
+  }
+  return {
+    mountedMissingFromManifest: diffSets(mounted, manifestMountedRoutes),
+    manifestMissingFromMounted: diffSets(manifestMountedRoutes, mounted),
+    openapiMissingFromManifest: diffSets(openapiRoutes, manifestRoutes),
+    manifestMissingFromOpenapi: diffSets(manifestRoutes, openapiRoutes),
+    rbacPermissionMismatches
+  };
+}
+function hasRouteManifestDrift(drift) {
+  return drift.mountedMissingFromManifest.length > 0 || drift.manifestMissingFromMounted.length > 0 || drift.openapiMissingFromManifest.length > 0 || drift.manifestMissingFromOpenapi.length > 0 || drift.rbacPermissionMismatches.length > 0;
+}
+
+// src/core/migrations/engine.ts
+function assertRawQuery(db) {
+  if (!db.rawQuery) {
+    throw Errors.badRequest("Migration tooling requires a database adapter with rawQuery support");
+  }
+  return db.rawQuery.bind(db);
+}
+async function tableExists(db, dialect) {
+  const rawQuery = assertRawQuery(db);
+  if (dialect === "sqlite") {
+    const rows2 = await rawQuery(
+      "SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'fortress_schema_version'"
+    );
+    return rows2.length > 0;
+  }
+  const rows = await rawQuery(
+    "SELECT table_name FROM information_schema.tables WHERE table_schema = 'public' AND table_name = 'fortress_schema_version'"
+  );
+  return rows.length > 0;
+}
+async function listFortressTables(db, dialect) {
+  const rawQuery = assertRawQuery(db);
+  if (dialect === "sqlite") {
+    const rows2 = await rawQuery(
+      "SELECT name FROM sqlite_master WHERE type = 'table' AND name LIKE 'fortress_%'"
+    );
+    return new Set(rows2.map((row) => row.name));
+  }
+  const rows = await rawQuery(
+    "SELECT table_name FROM information_schema.tables WHERE table_schema = 'public' AND table_name LIKE 'fortress_%'"
+  );
+  return new Set(rows.map((row) => row.table_name));
+}
+async function listColumns(db, dialect, table) {
+  const rawQuery = assertRawQuery(db);
+  if (dialect === "sqlite") {
+    const rows2 = await rawQuery(`PRAGMA table_info(${table})`);
+    return new Set(rows2.map((row) => row.name.toLowerCase()));
+  }
+  const rows = await rawQuery(
+    "SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?",
+    [table]
+  );
+  return new Set(rows.map((row) => row.column_name.toLowerCase()));
+}
+async function listFortressIndexes(db, dialect) {
+  const rawQuery = assertRawQuery(db);
+  if (dialect === "sqlite") {
+    const rows2 = await rawQuery(
+      "SELECT name FROM sqlite_master WHERE type = 'index' AND name NOT LIKE 'sqlite_autoindex_%'"
+    );
+    return new Set(rows2.map((row) => row.name));
+  }
+  const rows = await rawQuery(
+    "SELECT indexname FROM pg_indexes WHERE schemaname = 'public' AND tablename LIKE 'fortress_%'"
+  );
+  return new Set(rows.map((row) => row.indexname));
+}
+async function readCurrentVersion(db, dialect) {
+  const hasVersionTable = await tableExists(db, dialect);
+  if (!hasVersionTable)
+    return { version: 0, hasVersionTable };
+  const rawQuery = assertRawQuery(db);
+  const rows = await rawQuery("SELECT version FROM fortress_schema_version WHERE id = 1");
+  return { version: Number(rows[0]?.version ?? 0), hasVersionTable };
+}
+var sqliteMigrationChain = Promise.resolve();
+async function getMigrationStatus(db, dialect = db.dialect === "pg" ? "pg" : "sqlite") {
+  const migrations = getFortressMigrations(dialect);
+  const latestVersion = getLatestMigrationVersion(dialect);
+  const { version: currentVersion, hasVersionTable } = await readCurrentVersion(db, dialect);
+  return {
+    dialect,
+    currentVersion,
+    latestVersion,
+    pending: migrations.filter((migration) => migration.version > currentVersion),
+    applied: migrations.filter((migration) => migration.version <= currentVersion),
+    upToDate: currentVersion >= latestVersion,
+    hasVersionTable
+  };
+}
+async function detectMigrationDrift(db, dialect = db.dialect === "pg" ? "pg" : "sqlite") {
+  const status = await getMigrationStatus(db, dialect);
+  const present = await listFortressTables(db, dialect);
+  const missingTables = FORTRESS_TABLES.filter((name) => !present.has(name));
+  const expectedColumns = getExpectedColumns(dialect);
+  const missingColumns = [];
+  for (const [table, columns] of Object.entries(expectedColumns)) {
+    if (!present.has(table))
+      continue;
+    const live = await listColumns(db, dialect, table);
+    const missing = columns.filter((column) => !live.has(column));
+    if (missing.length > 0)
+      missingColumns.push({ table, columns: missing });
+  }
+  const presentIndexes = await listFortressIndexes(db, dialect);
+  const missingIndexes = FORTRESS_INDEXES.map((index3) => index3.name).filter((name) => !presentIndexes.has(name));
+  return {
+    dialect,
+    currentVersion: status.currentVersion,
+    latestVersion: status.latestVersion,
+    missingVersionTable: !status.hasVersionTable,
+    unknownFutureVersion: status.currentVersion > status.latestVersion,
+    pendingVersions: status.pending.map((migration) => migration.version),
+    missingTables,
+    missingColumns,
+    missingIndexes
+  };
+}
+function hasMigrationDrift(drift) {
+  return drift.missingVersionTable || drift.unknownFutureVersion || drift.pendingVersions.length > 0 || drift.missingTables.length > 0 || drift.missingColumns.length > 0 || drift.missingIndexes.length > 0;
+}
+
+// src/testing/checks.ts
+function checkRouteManifestDrift(fortress) {
+  const drift = detectRouteManifestDrift(fortress);
+  const messages = [];
+  if (drift.mountedMissingFromManifest.length > 0)
+    messages.push(`Mounted routes missing from manifest: ${drift.mountedMissingFromManifest.join(", ")}`);
+  if (drift.manifestMissingFromMounted.length > 0)
+    messages.push(`Manifest routes missing from mounted set: ${drift.manifestMissingFromMounted.join(", ")}`);
+  if (drift.rbacPermissionMismatches.length > 0) {
+    messages.push(
+      `RBAC permission mismatches:
+  ${drift.rbacPermissionMismatches.map((m) => `${m.route}: expected=${m.expected ?? "(none)"} actual=${m.actual ?? "(none)"}`).join("\n  ")}`
+    );
+  }
+  if (drift.openapiMissingFromManifest.length > 0)
+    messages.push(`Routes in OpenAPI but missing from manifest: ${drift.openapiMissingFromManifest.join(", ")}`);
+  if (drift.manifestMissingFromOpenapi.length > 0)
+    messages.push(`Routes in manifest but missing from OpenAPI: ${drift.manifestMissingFromOpenapi.join(", ")}`);
+  return { ok: !hasRouteManifestDrift(drift), drift, messages };
+}
+var DEFAULT_PUBLIC_ALLOW = [
+  "POST /auth/login",
+  "POST /auth/register",
+  "POST /auth/refresh",
+  "POST /auth/logout",
+  "POST /auth/2fa/verify",
+  "POST /auth/magic-link/verify",
+  "GET /oauth/authorize",
+  "POST /oauth/token",
+  "POST /oauth/introspect",
+  "POST /oauth/revoke",
+  "GET /oauth/userinfo",
+  "GET /oauth/.well-known/openid-configuration",
+  "GET /oauth/.well-known/jwks.json"
+];
+function checkPublicRoutes(fortress, options = {}) {
+  const allow = /* @__PURE__ */ new Set([...options.allow ?? [], ...DEFAULT_PUBLIC_ALLOW]);
+  const classifications = new Set(
+    options.classifications ?? ["public", "oauth-protocol"]
+  );
+  const manifest = buildRouteManifest(fortress);
+  const unexpected = manifest.filter(
+    (entry) => classifications.has(entry.classification) && !allow.has(`${entry.method} ${entry.path}`)
+  );
+  const messages = unexpected.map(
+    (entry) => `Unexpected ${entry.classification} route: ${entry.method} ${entry.path} (plugin=${entry.plugin ?? "core"})`
+  );
+  return { ok: unexpected.length === 0, unexpected, messages };
+}
+async function checkMigrationDrift(db, dialect) {
+  const drift = await detectMigrationDrift(db, dialect);
+  const messages = [];
+  if (drift.missingVersionTable)
+    messages.push("Schema version table is missing \u2014 run fortress.migrate()");
+  if (drift.pendingVersions.length > 0)
+    messages.push(`Pending migrations: ${drift.pendingVersions.join(", ")}`);
+  if (drift.unknownFutureVersion)
+    messages.push(`Database is at version ${drift.currentVersion} but bundled catalog stops at ${drift.latestVersion}`);
+  if (drift.missingTables.length > 0)
+    messages.push(`Missing Fortress tables: ${drift.missingTables.join(", ")}`);
+  if (drift.missingColumns.length > 0) {
+    messages.push(
+      `Stale Fortress tables missing columns: ${drift.missingColumns.map((entry) => `${entry.table} (${entry.columns.join(", ")})`).join("; ")}`
+    );
+  }
+  return { ok: !hasMigrationDrift(drift), drift, messages };
+}
+async function smokeTestAuth(fortress, options = {}) {
+  const email2 = options.email ?? `smoke+${Date.now()}@fortress.test`;
+  const password = options.password ?? "smoke-test-password-1234564!";
+  const name = options.name ?? "Smoke Test";
+  const messages = [];
+  try {
+    await fortress.auth.createUser({ email: email2, password, name });
+    const login = await fortress.auth.login(email2, password);
+    if (login.status !== "success" || !login.accessToken)
+      throw new Error(`login returned status=${login.status}`);
+    const claims = await fortress.auth.verifyToken(login.accessToken);
+    if (claims.sub !== login.user.id)
+      throw new Error(`token sub mismatch: ${claims.sub} vs user.id ${login.user.id}`);
+    if (!login.refreshToken)
+      throw new Error("login did not return a refresh token");
+    const refreshed = await fortress.auth.refresh(login.refreshToken);
+    if (!refreshed.accessToken)
+      throw new Error("refresh did not return a new access token");
+    await fortress.auth.logout(refreshed.refreshToken);
+    return { ok: true, messages };
+  } catch (err) {
+    messages.push(`Auth smoke test failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { ok: false, messages };
+  }
+}
+async function runFortressChecks(options) {
+  const manifest = checkRouteManifestDrift(options.fortress);
+  const publicRoutes = checkPublicRoutes(options.fortress, options.publicRoutes);
+  const migrations = options.skipMigrations ? void 0 : await checkMigrationDrift(options.db ?? options.fortress.config.database);
+  const authSmokeTest = options.skipAuthSmokeTest ? void 0 : await smokeTestAuth(options.fortress, options.smokeTest);
+  const messages = [];
+  if (!manifest.ok)
+    messages.push(...manifest.messages.map((m) => `[manifest] ${m}`));
+  if (!publicRoutes.ok)
+    messages.push(...publicRoutes.messages.map((m) => `[public-routes] ${m}`));
+  if (migrations && !migrations.ok)
+    messages.push(...migrations.messages.map((m) => `[migrations] ${m}`));
+  if (authSmokeTest && !authSmokeTest.ok)
+    messages.push(...authSmokeTest.messages.map((m) => `[auth-smoke] ${m}`));
+  return {
+    ok: manifest.ok && publicRoutes.ok && (migrations?.ok ?? true) && (authSmokeTest?.ok ?? true),
+    manifest,
+    publicRoutes,
+    ...migrations ? { migrations } : {},
+    ...authSmokeTest ? { authSmokeTest } : {},
+    messages
+  };
+}
+
+// src/testing/index.ts
+var CREATE_TABLES_SQL = getMigrationUpSql("sqlite");
+var STAMP_SCHEMA_VERSION_SQL = `
+  INSERT INTO fortress_schema_version (id, version, applied_at)
+  VALUES (1, ${getLatestMigrationVersion("sqlite")}, unixepoch())
+  ON CONFLICT(id) DO UPDATE SET
+    version = excluded.version,
+    applied_at = excluded.applied_at;
+`;
+var isBun = typeof globalThis.Bun !== "undefined";
+var runtimeRequire = globalThis.require ?? createRequire(resolve(process.argv[1] ?? "__fortress_testing__.mjs"));
+function createTestAdapter() {
+  if (isBun) {
+    return createBunAdapter();
+  }
+  return createNodeAdapter();
+}
+function createBunAdapter() {
+  const { Database } = runtimeRequire("bun:sqlite");
+  const { drizzle } = runtimeRequire("drizzle-orm/bun-sqlite");
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode = WAL;");
+  sqlite.exec("PRAGMA foreign_keys = ON;");
+  sqlite.exec(CREATE_TABLES_SQL);
+  sqlite.exec(STAMP_SCHEMA_VERSION_SQL);
+  const db = drizzle(sqlite);
+  return createDrizzleAdapter(db);
+}
+function createNodeAdapter() {
+  const BetterSqlite3 = runtimeRequire("better-sqlite3");
+  const { drizzle } = runtimeRequire("drizzle-orm/better-sqlite3");
+  const sqlite = new BetterSqlite3(":memory:");
+  sqlite.pragma("journal_mode = WAL");
+  sqlite.pragma("foreign_keys = ON");
+  sqlite.exec(CREATE_TABLES_SQL);
+  sqlite.exec(STAMP_SCHEMA_VERSION_SQL);
+  const db = drizzle(sqlite);
+  return createDrizzleAdapter(db);
+}
+export {
+  checkMigrationDrift,
+  checkPublicRoutes,
+  checkRouteManifestDrift,
+  createTestAdapter,
+  runFortressChecks,
+  smokeTestAuth
+};