@byline/db-mysql 6.7.1 → 6.8.0

package/dist/database/schema/auth.d.ts

@@ -60,6 +60,23 @@ export declare const adminUsers: import("drizzle-orm/mysql-core").MySqlTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        webauthn_user_handle: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "webauthn_user_handle";
+            tableName: "byline_admin_users";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         session_version: import("drizzle-orm/mysql-core").MySqlColumn<{
             name: "session_version";
             tableName: "byline_admin_users";
@@ -1151,3 +1168,450 @@ export declare const adminSignInRateLimits: import("drizzle-orm/mysql-core").MyS
     };
     dialect: 'mysql';
 }>;
+/** Credential identities survive revocation and account deletion as tombstones. */
+export declare const adminPasskeyCredentials: import("drizzle-orm/mysql-core").MySqlTableWithColumns<{
+    name: "byline_admin_passkey_credentials";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "id";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        admin_user_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "admin_user_id";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credential_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "credential_id";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        public_key: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "public_key";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "string";
+            columnType: "MySqlText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        counter: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "counter";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "number";
+            columnType: "MySqlBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        transports: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "transports";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "json";
+            columnType: "MySqlJson";
+            data: string[];
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        backup_eligible: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "backup_eligible";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "boolean";
+            columnType: "MySqlBoolean";
+            data: boolean;
+            driverParam: number | boolean;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        backed_up: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "backed_up";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "boolean";
+            columnType: "MySqlBoolean";
+            data: boolean;
+            driverParam: number | boolean;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "name";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "string";
+            columnType: "MySqlVarChar";
+            data: string;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        created_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "created_at";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        last_used_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "last_used_at";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revoked_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "revoked_at";
+            tableName: "byline_admin_passkey_credentials";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'mysql';
+}>;
+/** No FK cascades: short-lived authority is checked against live account/login state. */
+export declare const adminPasskeyAttempts: import("drizzle-orm/mysql-core").MySqlTableWithColumns<{
+    name: "byline_admin_passkey_attempts";
+    schema: undefined;
+    columns: {
+        token_hash: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "token_hash";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        purpose: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "purpose";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "string";
+            columnType: "MySqlVarChar";
+            data: "enrollment" | "fresh-authentication" | "grant" | "sign-in";
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "enrollment" | "fresh-authentication" | "grant" | "sign-in";
+        }>;
+        challenge: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "challenge";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "string";
+            columnType: "MySqlVarChar";
+            data: string;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actor_user_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "actor_user_id";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actor_login_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "actor_login_id";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actor_generation: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "actor_generation";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "number";
+            columnType: "MySqlInt";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        action: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "action";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "string";
+            columnType: "MySqlVarChar";
+            data: "enroll" | "remove";
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "enroll" | "remove";
+        }>;
+        target_user_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "target_user_id";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credential_record_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "credential_record_id";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        proof_credential_id: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "proof_credential_id";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "custom";
+            columnType: "MySqlCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        created_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "created_at";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expires_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "expires_at";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumed_at: import("drizzle-orm/mysql-core").MySqlColumn<{
+            name: "consumed_at";
+            tableName: "byline_admin_passkey_attempts";
+            dataType: "date";
+            columnType: "MySqlDateTime";
+            data: Date;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'mysql';
+}>;

package/dist/database/schema/auth.js

@@ -24,7 +24,7 @@
  * reference.
  */
 import { relations, sql } from 'drizzle-orm';
-import { boolean, datetime, foreignKey, index, int, json, mysqlTable, primaryKey, text, unique, varchar, } from 'drizzle-orm/mysql-core';
+import { bigint, boolean, customType, datetime, foreignKey, index, int, json, mysqlTable, primaryKey, text, unique, varchar, } from 'drizzle-orm/mysql-core';
 import { createdAt, timestamps, uuidChar } from './common.js';
 // Foreign keys below use the table-level `foreignKey()` builder with an
 // explicit, short `fk_<table>_<column>` name rather than the Postgres
@@ -34,8 +34,14 @@ import { createdAt, timestamps, uuidChar } from './common.js';
 // ---------------------------------------------------------------------------
 // byline_admin_users
 // ---------------------------------------------------------------------------
+const passkeyBytes = customType({
+    dataType: (config) => `varbinary(${config?.length ?? 1366})`,
+    toDriver: (value) => Buffer.from(value, 'ascii'),
+    fromDriver: (value) => value.toString('ascii'),
+});
 export const adminUsers = mysqlTable('byline_admin_users', {
     id: uuidChar('id').primaryKey(),
+    webauthn_user_handle: passkeyBytes('webauthn_user_handle', { length: 43 }).unique(),
     session_version: int('session_version').notNull().default(0),
     vid: int('vid').notNull().default(1),
     given_name: varchar('given_name', { length: 100 }),
@@ -176,6 +182,8 @@ export const adminLoginSessions = mysqlTable('byline_admin_login_sessions', {
         foreignColumns: [adminUsers.id],
     }).onDelete('cascade'),
     index('idx_admin_login_sessions_user').on(table.admin_user_id),
+    index('idx_admin_login_sessions_expiry').on(table.expires_at),
+    index('idx_admin_login_sessions_revoked').on(table.revoked_at),
 ]);
 export const adminRefreshTokens = mysqlTable('byline_admin_refresh_tokens', {
     id: uuidChar('id').primaryKey(),
@@ -211,6 +219,7 @@ export const adminRefreshTokens = mysqlTable('byline_admin_refresh_tokens', {
         foreignColumns: [adminUsers.id],
     }).onDelete('cascade'),
     index('idx_admin_refresh_tokens_sid').on(table.sid),
+    index('idx_admin_refresh_tokens_legacy_expiry').on(table.sid, table.expires_at),
     index('idx_byline_admin_refresh_tokens_user').on(table.admin_user_id),
     index('idx_byline_admin_refresh_tokens_token_hash').on(table.token_hash),
 ]);
@@ -253,3 +262,48 @@ export const adminSignInRateLimits = mysqlTable('byline_admin_sign_in_rate_limit
     attempts: int('attempts').notNull(),
     expires_at: datetime('expires_at', { fsp: 3 }).notNull(),
 }, (table) => [index('idx_admin_sign_in_rate_limits_expiry').on(table.expires_at)]);
+/** Credential identities survive revocation and account deletion as tombstones. */
+export const adminPasskeyCredentials = mysqlTable('byline_admin_passkey_credentials', {
+    id: uuidChar('id').primaryKey(),
+    admin_user_id: uuidChar('admin_user_id'),
+    credential_id: passkeyBytes('credential_id', { length: 1366 }).notNull().unique(),
+    public_key: text('public_key').notNull(),
+    counter: bigint('counter', { mode: 'number' }).notNull(),
+    transports: json('transports').$type().notNull(),
+    backup_eligible: boolean('backup_eligible').notNull(),
+    backed_up: boolean('backed_up').notNull(),
+    name: varchar('name', { length: 80 }).notNull(),
+    created_at: datetime('created_at', { fsp: 6 }).notNull(),
+    last_used_at: datetime('last_used_at', { fsp: 6 }),
+    revoked_at: datetime('revoked_at', { fsp: 6 }),
+}, (table) => [
+    foreignKey({
+        name: 'fk_admin_passkeys_user',
+        columns: [table.admin_user_id],
+        foreignColumns: [adminUsers.id],
+    }).onDelete('set null'),
+    index('idx_admin_passkeys_user').on(table.admin_user_id),
+]);
+/** No FK cascades: short-lived authority is checked against live account/login state. */
+export const adminPasskeyAttempts = mysqlTable('byline_admin_passkey_attempts', {
+    token_hash: passkeyBytes('token_hash', { length: 64 }).primaryKey(),
+    purpose: varchar('purpose', { length: 24 })
+        .$type()
+        .notNull(),
+    // Compared only by the verifier in application code, never by SQL collation.
+    challenge: varchar('challenge', { length: 43 }),
+    actor_user_id: uuidChar('actor_user_id'),
+    actor_login_id: uuidChar('actor_login_id'),
+    actor_generation: int('actor_generation'),
+    action: varchar('action', { length: 8 }).$type(),
+    target_user_id: uuidChar('target_user_id'),
+    credential_record_id: uuidChar('credential_record_id'),
+    proof_credential_id: uuidChar('proof_credential_id'),
+    created_at: datetime('created_at', { fsp: 6 }).notNull(),
+    expires_at: datetime('expires_at', { fsp: 6 }).notNull(),
+    consumed_at: datetime('consumed_at', { fsp: 6 }),
+}, (table) => [
+    index('idx_admin_passkey_attempts_expiry').on(table.expires_at),
+    index('idx_admin_passkey_attempts_consumed').on(table.consumed_at),
+    index('idx_admin_passkey_attempts_login').on(table.actor_login_id),
+]);

package/dist/database/schema/index.d.ts

@@ -4102,4 +4102,4 @@ export declare const recurringTasks: import("drizzle-orm/mysql-core").MySqlTable
     };
     dialect: 'mysql';
 }>;
-export { adminLoginSessions, adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminSignInRateLimits, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';
+export { adminLoginSessions, adminPasskeyAttempts, adminPasskeyCredentials, adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminSignInRateLimits, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';

package/dist/database/schema/index.js

@@ -996,4 +996,4 @@ export const recurringTasks = mysqlTable('byline_recurring_tasks', {
 // Auth schema — byline_admin_users, byline_admin_roles, etc.
 // See ./auth.ts for definitions and rationale.
 // ---------------------------------------------------------------------------
-export { adminLoginSessions, adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminSignInRateLimits, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';
+export { adminLoginSessions, adminPasskeyAttempts, adminPasskeyCredentials, adminPermissions, adminPermissionsRelations, adminRefreshTokens, adminRefreshTokensRelations, adminRoleAdminUser, adminRoleAdminUserRelations, adminRoles, adminRolesRelations, adminSignInRateLimits, adminUserPreferences, adminUsers, adminUsersRelations, } from './auth.js';

package/dist/database/schema/schema-pins.test.node.js

@@ -131,6 +131,9 @@ function columnByteWidth(columnName, sqlType) {
     const typeName = typeMatch?.[1]?.toLowerCase();
     const args = typeMatch?.[2];
     switch (typeName) {
+        case 'binary':
+        case 'varbinary':
+            return Number(args);
         case 'boolean':
         case 'tinyint':
             return 1;

package/dist/modules/admin/admin-store.js

@@ -11,7 +11,9 @@ import { createAdminPermissionsRepository } from './admin-permissions-repository
 import { createAdminPreferencesRepository } from './admin-preferences-repository.js';
 import { createAdminRolesRepository } from './admin-roles-repository.js';
 import { createAdminUsersRepository } from './admin-users-repository.js';
+import { createAuthMaintenanceRepository } from './auth-maintenance-repository.js';
 import { createLoginSessionsRepository } from './login-sessions-repository.js';
+import { createPasskeysRepository } from './passkeys-repository.js';
 import { createRefreshTokensRepository } from './refresh-tokens-repository.js';
 import { createSignInRateLimitStore } from './sign-in-rate-limit-store.js';
 /**
@@ -24,6 +26,9 @@ import { createSignInRateLimitStore } from './sign-in-rate-limit-store.js';
  * Construct once per process, alongside the `mysqlAdapter` call.
  */
 export function createAdminStore(db) {
+    return createScopedAdminStore(db, null);
+}
+function createScopedAdminStore(db, lockedAccounts) {
     return {
         async withSessionLock(adminUserId, work) {
             return db.transaction(async (tx) => {
@@ -32,7 +37,7 @@ export function createAdminStore(db) {
                     .from(adminUsers)
                     .where(eq(adminUsers.id, adminUserId))
                     .for('update');
-                const scoped = createAdminStore(tx);
+                const scoped = createScopedAdminStore(tx, [adminUserId]);
                 const user = await scoped.adminUsers.getByIdForSignIn(adminUserId);
                 return work(scoped, user);
             });
@@ -46,9 +51,11 @@ export function createAdminStore(db) {
                         .where(eq(adminUsers.id, id))
                         .for('update');
                 }
-                return work(createAdminStore(tx));
+                return work(createScopedAdminStore(tx, adminUserIds));
             });
         },
+        authMaintenance: createAuthMaintenanceRepository(db, lockedAccounts),
+        passkeys: createPasskeysRepository(db, lockedAccounts),
         loginSessions: createLoginSessionsRepository(db),
         signInRateLimits: createSignInRateLimitStore(db),
         adminUsers: createAdminUsersRepository(db),

package/dist/modules/admin/auth-maintenance-repository.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { AuthMaintenanceRepository } from '@byline/admin/auth';
+import type { MySql2Database } from 'drizzle-orm/mysql2';
+import type * as schema from '../../database/schema/index.js';
+export declare function createAuthMaintenanceRepository(db: MySql2Database<typeof schema>, lockedAccounts: readonly string[] | null): AuthMaintenanceRepository;

package/dist/modules/admin/auth-maintenance-repository.js

@@ -0,0 +1,94 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { and, eq, inArray, isNull, lte, notInArray } from 'drizzle-orm';
+import { adminPasskeyAttempts as attempts, adminLoginSessions as logins, adminRefreshTokens as refresh, } from '../../database/schema/auth.js';
+export function createAuthMaintenanceRepository(db, lockedAccounts) {
+    return {
+        async purgeAttempts(before) {
+            // Separate indexed scans avoid sorting or materializing an unbounded OR result.
+            const expired = await db
+                .select({ id: attempts.token_hash })
+                .from(attempts)
+                .where(lte(attempts.expires_at, before))
+                .limit(100);
+            const ids = expired.map((row) => row.id);
+            if (ids.length < 100) {
+                const consumed = await db
+                    .select({ id: attempts.token_hash })
+                    .from(attempts)
+                    .where(and(lte(attempts.consumed_at, before), ids.length ? notInArray(attempts.token_hash, ids) : undefined))
+                    .limit(100 - ids.length);
+                ids.push(...consumed.map((row) => row.id));
+            }
+            if (!ids.length)
+                return 0;
+            const [removed] = await db.delete(attempts).where(inArray(attempts.token_hash, ids));
+            return removed.affectedRows;
+        },
+        async findTerminalLogin(before) {
+            const projection = { id: logins.id, adminUserId: logins.admin_user_id };
+            const [expired] = await db
+                .select(projection)
+                .from(logins)
+                .where(lte(logins.expires_at, before))
+                .limit(1);
+            if (expired)
+                return expired;
+            const [revoked] = await db
+                .select(projection)
+                .from(logins)
+                .where(lte(logins.revoked_at, before))
+                .limit(1);
+            return revoked ?? null;
+        },
+        async pruneTerminalLogin({ id, adminUserId, before }) {
+            if (!lockedAccounts?.includes(adminUserId))
+                throw new Error('Login cleanup requires the owning account lock');
+            const [login] = await db
+                .select()
+                .from(logins)
+                .where(and(eq(logins.id, id), eq(logins.admin_user_id, adminUserId)))
+                .for('update');
+            if (!login || (login.expires_at > before && (!login.revoked_at || login.revoked_at > before)))
+                return { refreshDeleted: 0, loginDeleted: false };
+            const children = await db
+                .select({ id: refresh.id })
+                .from(refresh)
+                .where(eq(refresh.sid, id))
+                .limit(100);
+            let refreshDeleted = 0;
+            if (children.length) {
+                const [removed] = await db.delete(refresh).where(inArray(refresh.id, children.map((row) => row.id)));
+                refreshDeleted = removed.affectedRows;
+            }
+            const [remaining] = await db
+                .select({ id: refresh.id })
+                .from(refresh)
+                .where(eq(refresh.sid, id))
+                .limit(1);
+            if (remaining)
+                return { refreshDeleted, loginDeleted: false };
+            // The account and login-row locks prevent native renewal or issuance from
+            // adding children between this empty check and deletion. The FK cascade
+            // has no work to do; the task never relies on it to drain a token family.
+            await db.delete(logins).where(eq(logins.id, id));
+            return { refreshDeleted, loginDeleted: true };
+        },
+        async purgeLegacyRefreshTokens(before) {
+            const rows = await db
+                .select({ id: refresh.id })
+                .from(refresh)
+                .where(and(isNull(refresh.sid), lte(refresh.expires_at, before)))
+                .limit(100);
+            if (!rows.length)
+                return 0;
+            const [removed] = await db.delete(refresh).where(and(inArray(refresh.id, rows.map((row) => row.id)), isNull(refresh.sid), lte(refresh.expires_at, before)));
+            return removed.affectedRows;
+        },
+    };
+}

package/dist/modules/admin/passkeys-repository.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { type PasskeysRepository } from '@byline/admin/auth';
+import type { MySql2Database } from 'drizzle-orm/mysql2';
+import type * as schema from '../../database/schema/index.js';
+export declare function createPasskeysRepository(db: MySql2Database<typeof schema>, lockedAccounts: readonly string[] | null): PasskeysRepository;

package/dist/modules/admin/passkeys-repository.js

@@ -0,0 +1,165 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { assertPasskeyAttempt, assertPasskeyBytes, assertPasskeyClaim, assertPasskeyTokenHash, } from '@byline/admin/auth';
+import { and, count, eq, gt, isNull, sql } from 'drizzle-orm';
+import { v7 as uuidv7 } from 'uuid';
+import { adminLoginSessions, adminRefreshTokens, adminUsers, adminPasskeyAttempts as attempts, adminPasskeyCredentials as credentials, } from '../../database/schema/auth.js';
+import { auditLog } from '../../database/schema/index.js';
+export function createPasskeysRepository(db, lockedAccounts) {
+    function requireLock(id) {
+        if (id === null || !lockedAccounts?.includes(id))
+            throw new Error('Passkey write requires the owning account lock');
+    }
+    async function requireCredentialLock(id) {
+        const [row] = await db
+            .select({ owner: credentials.admin_user_id })
+            .from(credentials)
+            .where(eq(credentials.id, id));
+        if (!row)
+            throw new Error('Passkey credential not found');
+        requireLock(row.owner);
+    }
+    return {
+        async invalidateAccountLogins(adminUserId, at) {
+            requireLock(adminUserId);
+            await db
+                .update(adminUsers)
+                .set({ session_version: sql `${adminUsers.session_version} + 1` })
+                .where(eq(adminUsers.id, adminUserId));
+            await db
+                .update(adminLoginSessions)
+                .set({ revoked_at: at })
+                .where(and(eq(adminLoginSessions.admin_user_id, adminUserId), isNull(adminLoginSessions.revoked_at)));
+            await db
+                .update(adminRefreshTokens)
+                .set({ revoked_at: at })
+                .where(and(eq(adminRefreshTokens.admin_user_id, adminUserId), isNull(adminRefreshTokens.revoked_at)));
+        },
+        async appendRemovalAudit(input) {
+            if (input.outcome === 'success') {
+                requireLock(input.actorId);
+                requireLock(input.targetId);
+            }
+            await db.insert(auditLog).values({
+                id: uuidv7(),
+                actor_id: input.actorId,
+                actor_realm: 'admin',
+                action: 'admin.passkey.remove',
+                after: {
+                    targetUserId: input.targetId,
+                    credentialRecordId: input.credentialId,
+                    outcome: input.outcome,
+                },
+            });
+        },
+        async getUserHandle(adminUserId) {
+            const [row] = await db
+                .select({ handle: adminUsers.webauthn_user_handle })
+                .from(adminUsers)
+                .where(eq(adminUsers.id, adminUserId));
+            return row?.handle ?? null;
+        },
+        async ensureUserHandle(adminUserId, candidate) {
+            requireLock(adminUserId);
+            assertPasskeyBytes(candidate, 32, 32);
+            await db
+                .update(adminUsers)
+                .set({ webauthn_user_handle: candidate })
+                .where(and(eq(adminUsers.id, adminUserId), isNull(adminUsers.webauthn_user_handle)));
+            const [row] = await db
+                .select({ handle: adminUsers.webauthn_user_handle })
+                .from(adminUsers)
+                .where(eq(adminUsers.id, adminUserId));
+            if (!row?.handle)
+                throw new Error('Passkey account not found');
+            return row.handle;
+        },
+        async findCredential(id) {
+            const [row] = await db.select().from(credentials).where(eq(credentials.id, id));
+            return row ?? null;
+        },
+        async findCredentialByCredentialId(credentialId) {
+            assertPasskeyBytes(credentialId, 1024);
+            const [row] = await db
+                .select()
+                .from(credentials)
+                .where(eq(credentials.credential_id, credentialId));
+            return row ?? null;
+        },
+        async listCredentials(adminUserId) {
+            return db
+                .select()
+                .from(credentials)
+                .where(and(eq(credentials.admin_user_id, adminUserId), isNull(credentials.revoked_at)));
+        },
+        async createCredential(input) {
+            requireLock(input.admin_user_id);
+            assertPasskeyBytes(input.credential_id, 1024);
+            assertPasskeyBytes(input.public_key, 8192);
+            await db.insert(credentials).values(input);
+        },
+        async updateCredential(id, patch) {
+            await requireCredentialLock(id);
+            await db
+                .update(credentials)
+                .set(patch)
+                .where(and(eq(credentials.id, id), isNull(credentials.revoked_at)));
+        },
+        async revokeCredential(id, at) {
+            await requireCredentialLock(id);
+            await db
+                .update(credentials)
+                .set({ revoked_at: at })
+                .where(and(eq(credentials.id, id), isNull(credentials.revoked_at)));
+        },
+        async createAttempt(input) {
+            assertPasskeyAttempt(input);
+            if (input.purpose !== 'sign-in')
+                requireLock(input.actor_user_id);
+            await db.insert(attempts).values(input);
+        },
+        async findAttempt(tokenHash) {
+            assertPasskeyTokenHash(tokenHash);
+            const [row] = await db.select().from(attempts).where(eq(attempts.token_hash, tokenHash));
+            return row ?? null;
+        },
+        async countPendingForLogin(loginId, now) {
+            const [row] = await db
+                .select({ total: count() })
+                .from(attempts)
+                .where(and(eq(attempts.actor_login_id, loginId), isNull(attempts.consumed_at), gt(attempts.expires_at, now)));
+            return Number(row?.total ?? 0);
+        },
+        async claimAttempt(input) {
+            if (lockedAccounts !== null)
+                throw new Error('Passkey claims require a root store, outside account transactions');
+            assertPasskeyClaim(input);
+            const binding = input.binding;
+            const match = and(eq(attempts.token_hash, input.tokenHash), eq(attempts.purpose, input.purpose), isNull(attempts.consumed_at), gt(attempts.expires_at, input.now), binding.actor_user_id === null
+                ? isNull(attempts.actor_user_id)
+                : eq(attempts.actor_user_id, binding.actor_user_id), binding.actor_login_id === null
+                ? isNull(attempts.actor_login_id)
+                : eq(attempts.actor_login_id, binding.actor_login_id), binding.actor_generation === null
+                ? isNull(attempts.actor_generation)
+                : eq(attempts.actor_generation, binding.actor_generation), input.purpose === 'sign-in' ? isNull(attempts.action) : eq(attempts.action, input.action));
+            // The transaction promise resolves only after commit. No retry/savepoint path.
+            return db.transaction(async (tx) => {
+                const [result] = await tx.update(attempts).set({ consumed_at: input.now }).where(match);
+                if (result.affectedRows !== 1)
+                    return null;
+                const [row] = await tx
+                    .select()
+                    .from(attempts)
+                    .where(eq(attempts.token_hash, input.tokenHash));
+                if (!row)
+                    throw new Error('Claimed passkey attempt disappeared');
+                return row;
+            });
+        },
+    };
+}

package/dist/modules/admin/refresh-tokens-repository.js

@@ -5,9 +5,10 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import { and, eq, isNull, lt } from 'drizzle-orm';
+import { and, eq, isNull } from 'drizzle-orm';
 import { adminRefreshTokens } from '../../database/schema/auth.js';
 import { affectedRowCount } from '../storage/storage-utils.js';
+import { createAuthMaintenanceRepository } from './auth-maintenance-repository.js';
 /**
  * MySQL implementation of `RefreshTokensRepository`, backing the built-in
  * `JwtSessionProvider`. Ported from
@@ -117,10 +118,8 @@ export function createRefreshTokensRepository(db) {
             return affectedRowCount(result);
         },
         async purgeExpired(now = new Date()) {
-            const result = await db
-                .delete(adminRefreshTokens)
-                .where(lt(adminRefreshTokens.expires_at, now));
-            return affectedRowCount(result);
+            // Preserve every member of a native login, including expired predecessors.
+            return createAuthMaintenanceRepository(db, null).purgeLegacyRefreshTokens(new Date(now.getTime() - 30 * 86_400_000));
         },
         async listActiveForUser(adminUserId) {
             return db

package/package.json

@@ -2,9 +2,9 @@
   "name": "@byline/db-mysql",
   "private": false,
   "license": "MPL-2.0",
-  "version": "6.7.1",
+  "version": "6.8.0",
   "engines": {
-    "node": ">=20.9.0"
+    "node": ">=22.22.2"
   },
   "description": "Byline CMS db mysql package",
   "keywords": [
@@ -47,26 +47,26 @@
     "dist"
   ],
   "dependencies": {
-    "drizzle-orm": "^0.45.2",
-    "mysql2": "^3.24.4",
-    "uuid": "^14.0.2",
-    "@byline/admin": "6.7.1",
-    "@byline/core": "6.7.1"
+    "@byline/admin": "6.8.0",
+    "@byline/core": "6.8.0",
+    "drizzle-orm": "^0.45.4",
+    "mysql2": "^3.24.6",
+    "uuid": "^14.0.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.14",
-    "@types/node": "^26.6.2",
+    "@biomejs/biome": "2.5.15",
+    "@byline/auth": "6.8.0",
+    "@byline/client": "6.8.0",
+    "@byline/db-conformance": "0.0.10",
+    "@types/node": "^26.6.5",
     "chokidar": "^5.0.0",
     "chokidar-cli": "^3.0.0",
-    "dotenv": "^18.0.1",
-    "drizzle-kit": "^0.31.10",
+    "dotenv": "^18.0.8",
+    "drizzle-kit": "^0.31.11",
     "npm-run-all": "^4.1.5",
-    "tsc-alias": "^1.9.5",
+    "tsc-alias": "^1.9.7",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.1",
-    "@byline/auth": "6.7.1",
-    "@byline/client": "6.7.1",
-    "@byline/db-conformance": "0.0.10"
+    "vitest": "^5.0.4"
   },
   "publishConfig": {
     "access": "public",