@bajustone/fortress 1.0.0-rc.1

package/migrations/pg/0010_bigint_append_only_ids.sql

@@ -0,0 +1,23 @@
+-- Widen identifiers on unbounded/churn-heavy append tables before int4 exhaustion.
+ALTER SEQUENCE fortress_refresh_token_id_seq AS BIGINT;
+ALTER TABLE fortress_refresh_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_auth_continuation_id_seq AS BIGINT;
+ALTER TABLE fortress_auth_continuation ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_email_verification_token_id_seq AS BIGINT;
+ALTER TABLE fortress_email_verification_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_magic_link_token_id_seq AS BIGINT;
+ALTER TABLE fortress_magic_link_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_authorization_code_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_access_token_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_refresh_token_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_oauth_pending_flow_id_seq AS BIGINT;
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_audit_log_id_seq AS BIGINT;
+ALTER TABLE fortress_audit_log ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_webhook_delivery_id_seq AS BIGINT;
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN id TYPE BIGINT;
+ALTER SEQUENCE fortress_webauthn_challenge_id_seq AS BIGINT;
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN id TYPE BIGINT;

package/migrations/sqlite/0001_schema_version.down.sql

@@ -0,0 +1,2 @@
+-- Fortress migration 0001 rollback: schema version tracking table (SQLite)
+DROP TABLE IF EXISTS fortress_schema_version;

package/migrations/sqlite/0001_schema_version.sql

@@ -0,0 +1,8 @@
+-- Fortress migration 0001: schema version tracking table (SQLite)
+-- The version row is written by the migration runner after apply; this
+-- migration only creates the checkpoint table.
+CREATE TABLE IF NOT EXISTS fortress_schema_version (
+  id INTEGER PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+  version INTEGER NOT NULL,
+  applied_at INTEGER NOT NULL DEFAULT (unixepoch())
+);

package/migrations/sqlite/0002_initial_schema.down.sql

@@ -0,0 +1,36 @@
+-- Fortress migration 0002: initial Fortress schema (SQLite) — rollback
+
+DROP TABLE IF EXISTS fortress_webauthn_challenge;
+DROP TABLE IF EXISTS fortress_webauthn_credential;
+DROP TABLE IF EXISTS fortress_webhook_delivery;
+DROP TABLE IF EXISTS fortress_webhook_endpoint;
+DROP TABLE IF EXISTS fortress_audit_log;
+DROP TABLE IF EXISTS fortress_account_lockout;
+DROP TABLE IF EXISTS fortress_user_scope_assignment;
+DROP TABLE IF EXISTS fortress_oauth_signing_key;
+DROP TABLE IF EXISTS fortress_oauth_pending_flow;
+DROP TABLE IF EXISTS fortress_oauth_refresh_token;
+DROP TABLE IF EXISTS fortress_oauth_access_token;
+DROP TABLE IF EXISTS fortress_oauth_authorization_code;
+DROP TABLE IF EXISTS fortress_oauth_client;
+DROP TABLE IF EXISTS fortress_tenant_user;
+DROP TABLE IF EXISTS fortress_tenant;
+DROP TABLE IF EXISTS fortress_social_account;
+DROP TABLE IF EXISTS fortress_trusted_device;
+DROP TABLE IF EXISTS fortress_backup_code;
+DROP TABLE IF EXISTS fortress_two_factor_secret;
+DROP TABLE IF EXISTS fortress_api_key;
+DROP TABLE IF EXISTS fortress_magic_link_token;
+DROP TABLE IF EXISTS fortress_email_verification_token;
+DROP TABLE IF EXISTS fortress_direct_permission_binding;
+DROP TABLE IF EXISTS fortress_role_binding;
+DROP TABLE IF EXISTS fortress_role_permission;
+DROP TABLE IF EXISTS fortress_role;
+DROP TABLE IF EXISTS fortress_permission;
+DROP TABLE IF EXISTS fortress_resource;
+DROP TABLE IF EXISTS fortress_service_account;
+DROP TABLE IF EXISTS fortress_group_user;
+DROP TABLE IF EXISTS fortress_group;
+DROP TABLE IF EXISTS fortress_refresh_token;
+DROP TABLE IF EXISTS fortress_login_identifier;
+DROP TABLE IF EXISTS fortress_user;

package/migrations/sqlite/0002_initial_schema.sql

@@ -0,0 +1,376 @@
+-- Fortress migration 0002: initial Fortress schema (SQLite)
+
+CREATE TABLE IF NOT EXISTS fortress_user (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL UNIQUE,
+  name TEXT NOT NULL,
+  password_hash TEXT,
+  is_active INTEGER NOT NULL DEFAULT 1,
+  email_verified INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_login_identifier (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  type TEXT NOT NULL,
+  value TEXT NOT NULL UNIQUE
+);
+
+CREATE TABLE IF NOT EXISTS fortress_refresh_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  token_family TEXT NOT NULL,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at INTEGER NOT NULL,
+  ip_address TEXT,
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at INTEGER,
+  fingerprint_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL UNIQUE,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group_user (
+  group_id INTEGER NOT NULL REFERENCES fortress_group(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  PRIMARY KEY (group_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_service_account (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL UNIQUE,
+  display_name TEXT,
+  description TEXT,
+  is_active INTEGER NOT NULL DEFAULT 1,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_resource (
+  name TEXT PRIMARY KEY,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_permission (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  resource TEXT NOT NULL REFERENCES fortress_resource(name) ON DELETE CASCADE,
+  action TEXT NOT NULL,
+  effect TEXT NOT NULL DEFAULT 'ALLOW',
+  conditions TEXT,
+  description TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_no_conditions
+  ON fortress_permission (resource, action, effect)
+  WHERE conditions IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_with_conditions
+  ON fortress_permission (resource, action, effect, conditions)
+  WHERE conditions IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_role (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL UNIQUE,
+  description TEXT,
+  is_system INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_permission (
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  PRIMARY KEY (role_id, permission_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_binding (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  subject_type TEXT NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id TEXT,
+  UNIQUE (role_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_global
+  ON fortress_role_binding (role_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_tenant
+  ON fortress_role_binding (role_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_direct_permission_binding (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  subject_type TEXT NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id TEXT,
+  UNIQUE (permission_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_global
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_tenant
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_email_verification_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token TEXT NOT NULL,
+  email TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_magic_link_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL,
+  token TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_api_key (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  subject_type TEXT NOT NULL,
+  subject_id INTEGER NOT NULL,
+  name TEXT NOT NULL,
+  key_hash TEXT NOT NULL UNIQUE,
+  key_prefix TEXT NOT NULL,
+  scopes TEXT,
+  expires_at INTEGER,
+  last_used_at INTEGER,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+CREATE INDEX IF NOT EXISTS api_key_subject_idx ON fortress_api_key (subject_type, subject_id);
+
+CREATE TABLE IF NOT EXISTS fortress_two_factor_secret (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL UNIQUE REFERENCES fortress_user(id) ON DELETE CASCADE,
+  secret TEXT NOT NULL,
+  is_enabled INTEGER NOT NULL DEFAULT 0,
+  last_used_counter INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_backup_code (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  code_hash TEXT NOT NULL,
+  is_used INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_trusted_device (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  device_hash TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  last_used_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_social_account (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL,
+  provider_account_id TEXT NOT NULL,
+  email TEXT,
+  access_token TEXT,
+  refresh_token TEXT,
+  token_expires_at INTEGER,
+  profile TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  UNIQUE (user_id, provider),
+  UNIQUE (provider, provider_account_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL,
+  tax_id TEXT NOT NULL UNIQUE,
+  description TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant_user (
+  tenant_id INTEGER NOT NULL REFERENCES fortress_tenant(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  is_default INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (tenant_id, user_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id) WHERE is_default = 1;
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_client (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  client_id TEXT NOT NULL UNIQUE,
+  client_secret_hash TEXT NOT NULL,
+  name TEXT NOT NULL,
+  redirect_uris TEXT NOT NULL,
+  grant_types TEXT NOT NULL,
+  allowed_scopes TEXT,
+  token_endpoint_auth_method TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_authorization_code (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  code TEXT NOT NULL UNIQUE,
+  client_id TEXT NOT NULL,
+  user_id INTEGER NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  nonce TEXT,
+  auth_time INTEGER,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_access_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  token TEXT NOT NULL UNIQUE,
+  client_id TEXT NOT NULL,
+  user_id INTEGER,
+  scope TEXT,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_refresh_token (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  token TEXT NOT NULL UNIQUE,
+  family_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id INTEGER NOT NULL,
+  scope TEXT,
+  issued_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  parent_id INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_pending_flow (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  flow_id TEXT NOT NULL UNIQUE,
+  client_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  state TEXT NOT NULL,
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  nonce TEXT,
+  user_id INTEGER,
+  used_at INTEGER,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_signing_key (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  kid TEXT NOT NULL UNIQUE,
+  alg TEXT NOT NULL,
+  public_jwk TEXT NOT NULL,
+  private_jwk TEXT NOT NULL,
+  rotated_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_user_scope_assignment (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  scope_name TEXT NOT NULL,
+  scope_value TEXT NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_account_lockout (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  identifier TEXT NOT NULL UNIQUE,
+  failed_attempts INTEGER NOT NULL DEFAULT 0,
+  last_failed_at INTEGER,
+  locked_until INTEGER,
+  lockout_count INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_audit_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  timestamp INTEGER NOT NULL DEFAULT (unixepoch()),
+  event_type TEXT NOT NULL,
+  actor_id INTEGER,
+  actor_type TEXT NOT NULL DEFAULT 'USER',
+  target_id INTEGER,
+  target_type TEXT,
+  ip_address TEXT,
+  user_agent TEXT,
+  outcome TEXT NOT NULL DEFAULT 'SUCCESS',
+  metadata TEXT,
+  previous_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_endpoint (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  url TEXT NOT NULL,
+  events TEXT NOT NULL,
+  secret TEXT NOT NULL,
+  is_active INTEGER NOT NULL DEFAULT 1,
+  deactivated_reason TEXT,
+  consecutive_failures INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_delivery (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  endpoint_id INTEGER NOT NULL REFERENCES fortress_webhook_endpoint(id) ON DELETE CASCADE,
+  event_type TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  attempts INTEGER NOT NULL DEFAULT 0,
+  idempotency_key TEXT,
+  last_attempt_at INTEGER,
+  next_retry_at INTEGER,
+  response_status INTEGER,
+  response_body TEXT,
+  error_kind TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_webhook_delivery_idempotency
+  ON fortress_webhook_delivery (endpoint_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_credential (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  credential_id TEXT NOT NULL UNIQUE,
+  public_key TEXT NOT NULL,
+  counter INTEGER NOT NULL DEFAULT 0,
+  device_type TEXT NOT NULL,
+  backed_up INTEGER NOT NULL DEFAULT 0,
+  transports TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_challenge (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  challenge TEXT NOT NULL UNIQUE,
+  user_id INTEGER,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);

package/migrations/sqlite/0003_auth_continuation.down.sql

@@ -0,0 +1,27 @@
+-- Fortress migration 0003 rollback: auth continuation + refresh-session metadata (SQLite)
+
+DROP TABLE IF EXISTS fortress_auth_continuation;
+CREATE TABLE fortress_refresh_token_v2 (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  token_family TEXT NOT NULL,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at INTEGER NOT NULL,
+  ip_address TEXT,
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at INTEGER,
+  fingerprint_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+INSERT INTO fortress_refresh_token_v2 (
+  id, user_id, token_hash, token_family, is_revoked, expires_at,
+  ip_address, user_agent, device_name, last_active_at, fingerprint_hash, created_at
+)
+SELECT
+  id, user_id, token_hash, token_family, is_revoked, expires_at,
+  ip_address, user_agent, device_name, last_active_at, fingerprint_hash, created_at
+FROM fortress_refresh_token;
+DROP TABLE fortress_refresh_token;
+ALTER TABLE fortress_refresh_token_v2 RENAME TO fortress_refresh_token;

package/migrations/sqlite/0003_auth_continuation.sql

@@ -0,0 +1,45 @@
+-- Fortress migration 0003: auth continuation + refresh-session metadata (SQLite)
+
+CREATE TABLE fortress_refresh_token_v3 (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  token_family TEXT NOT NULL,
+  family_created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  successor_token_hash TEXT,
+  rotated_at INTEGER,
+  is_revoked INTEGER NOT NULL DEFAULT 0,
+  expires_at INTEGER NOT NULL,
+  ip_address TEXT,
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at INTEGER,
+  fingerprint_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+INSERT INTO fortress_refresh_token_v3 (
+  id, user_id, token_hash, token_family, family_created_at,
+  successor_token_hash, rotated_at, is_revoked, expires_at, ip_address,
+  user_agent, device_name, last_active_at, fingerprint_hash, created_at
+)
+SELECT
+  token.id, token.user_id, token.token_hash, token.token_family,
+  (SELECT MIN(family.created_at)
+   FROM fortress_refresh_token AS family
+   WHERE family.token_family = token.token_family),
+  NULL, NULL, token.is_revoked, token.expires_at, token.ip_address,
+  token.user_agent, token.device_name, token.last_active_at,
+  token.fingerprint_hash, token.created_at
+FROM fortress_refresh_token AS token;
+DROP TABLE fortress_refresh_token;
+ALTER TABLE fortress_refresh_token_v3 RENAME TO fortress_refresh_token;
+
+CREATE TABLE fortress_auth_continuation (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  reason TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);

package/migrations/sqlite/0004_tenant_default_unique.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS fortress_tenant_user_one_default_idx;

package/migrations/sqlite/0004_tenant_default_unique.sql

@@ -0,0 +1,13 @@
+UPDATE fortress_tenant_user
+SET is_default = 0
+WHERE is_default = 1
+  AND rowid NOT IN (
+    SELECT MIN(rowid)
+    FROM fortress_tenant_user
+    WHERE is_default = 1
+    GROUP BY user_id
+  );
+
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id)
+  WHERE is_default = 1;

package/migrations/sqlite/0005_hot_indexes_timestamptz.down.sql

@@ -0,0 +1,10 @@
+DROP INDEX IF EXISTS audit_log_timestamp_idx;
+DROP INDEX IF EXISTS webhook_delivery_retry_idx;
+DROP INDEX IF EXISTS trusted_device_user_idx;
+DROP INDEX IF EXISTS backup_code_user_idx;
+DROP INDEX IF EXISTS direct_permission_binding_subject_idx;
+DROP INDEX IF EXISTS role_binding_subject_idx;
+DROP INDEX IF EXISTS magic_link_token_token_idx;
+DROP INDEX IF EXISTS email_verification_token_token_idx;
+DROP INDEX IF EXISTS refresh_token_user_idx;
+DROP INDEX IF EXISTS refresh_token_family_idx;

package/migrations/sqlite/0005_hot_indexes_timestamptz.sql

@@ -0,0 +1,10 @@
+CREATE INDEX refresh_token_family_idx ON fortress_refresh_token (token_family);
+CREATE INDEX refresh_token_user_idx ON fortress_refresh_token (user_id);
+CREATE INDEX email_verification_token_token_idx ON fortress_email_verification_token (token);
+CREATE INDEX magic_link_token_token_idx ON fortress_magic_link_token (token);
+CREATE INDEX role_binding_subject_idx ON fortress_role_binding (subject_type, subject_id);
+CREATE INDEX direct_permission_binding_subject_idx ON fortress_direct_permission_binding (subject_type, subject_id);
+CREATE INDEX backup_code_user_idx ON fortress_backup_code (user_id);
+CREATE INDEX trusted_device_user_idx ON fortress_trusted_device (user_id);
+CREATE INDEX webhook_delivery_retry_idx ON fortress_webhook_delivery (status, next_retry_at);
+CREATE INDEX audit_log_timestamp_idx ON fortress_audit_log (timestamp);

package/migrations/sqlite/0006_canonical_email.down.sql

@@ -0,0 +1,3 @@
+-- Canonicalization and duplicate-account quarantine are intentionally irreversible.
+DROP INDEX IF EXISTS login_identifier_email_ci_unique;
+DROP INDEX IF EXISTS user_email_ci_unique;

package/migrations/sqlite/0006_canonical_email.sql

@@ -0,0 +1,8 @@
+-- This sentinel is created only by the Fortress migration engine after its
+-- Unicode-aware data step. Applying this SQL directly fails closed.
+INSERT INTO fortress_email_migration_ready (id) VALUES (1);
+CREATE UNIQUE INDEX user_email_ci_unique ON fortress_user (email COLLATE NOCASE);
+CREATE UNIQUE INDEX login_identifier_email_ci_unique
+  ON fortress_login_identifier (value COLLATE NOCASE)
+  WHERE type = 'email';
+DROP TABLE fortress_email_migration_ready;

package/migrations/sqlite/0007_audit_chain_anchor.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS fortress_audit_chain_state;

package/migrations/sqlite/0007_audit_chain_anchor.sql

@@ -0,0 +1,8 @@
+CREATE TABLE fortress_audit_chain_state (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  last_hash TEXT,
+  entry_count INTEGER NOT NULL CHECK (entry_count >= 0),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  CHECK ((entry_count = 0 AND last_hash IS NULL) OR (entry_count > 0 AND last_hash IS NOT NULL))
+);
+INSERT INTO fortress_audit_chain_state (id, last_hash, entry_count) VALUES (1, NULL, 0);

package/migrations/sqlite/0008_two_factor_hardening.down.sql

@@ -0,0 +1,14 @@
+-- SQLite cannot drop columns portably; recreate the continuation table without hardening fields.
+CREATE TABLE fortress_auth_continuation_old AS SELECT id, user_id, token_hash, reason, expires_at, consumed_at, created_at FROM fortress_auth_continuation;
+DROP TABLE fortress_auth_continuation;
+CREATE TABLE fortress_auth_continuation (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  reason TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+INSERT INTO fortress_auth_continuation SELECT * FROM fortress_auth_continuation_old;
+DROP TABLE fortress_auth_continuation_old;

package/migrations/sqlite/0008_two_factor_hardening.sql

@@ -0,0 +1,7 @@
+-- Fortress migration 0008: bounded MFA continuation attempts.
+ALTER TABLE fortress_auth_continuation ADD COLUMN failed_attempts INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE fortress_auth_continuation ADD COLUMN last_failed_at INTEGER;
+ALTER TABLE fortress_auth_continuation ADD COLUMN invalidated_at INTEGER;
+ALTER TABLE fortress_auth_continuation ADD COLUMN max_attempts INTEGER NOT NULL DEFAULT 5;
+ALTER TABLE fortress_auth_continuation ADD COLUMN cooldown_seconds INTEGER NOT NULL DEFAULT 1;
+CREATE INDEX auth_continuation_failure_idx ON fortress_auth_continuation (user_id, reason, last_failed_at);

package/migrations/sqlite/0009_encrypt_totp_secrets.down.sql

@@ -0,0 +1,2 @@
+SELECT 1;
+-- Deleted plaintext TOTP credentials cannot be restored.

package/migrations/sqlite/0009_encrypt_totp_secrets.sql

@@ -0,0 +1,5 @@
+-- Existing TOTP seeds were stored in plaintext. SQL migrations cannot encrypt
+-- them with the application-held key, so fail securely by requiring re-enrolment.
+DELETE FROM fortress_backup_code;
+DELETE FROM fortress_trusted_device;
+DELETE FROM fortress_two_factor_secret;

package/migrations/sqlite/0010_bigint_append_only_ids.down.sql

@@ -0,0 +1 @@
+SELECT 1;

package/migrations/sqlite/0010_bigint_append_only_ids.sql

@@ -0,0 +1,2 @@
+-- SQLite INTEGER already stores signed 64-bit identifiers.
+SELECT 1;