@kontrolia/db 2.1.2 → 2.1.4

package/dist/api-key.d.ts

@@ -1,5 +1,7 @@
 /** Generates a new plaintext application sync API key. Shown once, never stored. */
 export declare function generateApplicationApiKey(): string;
-/** sha256 hex digest — what actually gets stored in kontrolia_auth.applications.api_key_hash. */
+/** sha256 hex digest — what actually gets stored as application_api_keys.key_hash. */
 export declare function hashApplicationApiKey(plaintext: string): string;
+/** First few characters after the prefix, stored alongside the hash purely so a key list UI can show "kapp_a1b2c3…" without ever persisting (or being able to redisplay) the full secret. */
+export declare function applicationApiKeyDisplayPrefix(plaintext: string): string;
 //# sourceMappingURL=api-key.d.ts.map

package/dist/api-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAIA,oFAAoF;AACpF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D"}
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAIA,oFAAoF;AACpF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,6LAA6L;AAC7L,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/api-key.js

@@ -4,7 +4,11 @@ const API_KEY_PREFIX = "kapp_";
 export function generateApplicationApiKey() {
     return `${API_KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
 }
-/** sha256 hex digest — what actually gets stored in kontrolia_auth.applications.api_key_hash. */
+/** sha256 hex digest — what actually gets stored as application_api_keys.key_hash. */
 export function hashApplicationApiKey(plaintext) {
     return createHash("sha256").update(plaintext).digest("hex");
 }
+/** First few characters after the prefix, stored alongside the hash purely so a key list UI can show "kapp_a1b2c3…" without ever persisting (or being able to redisplay) the full secret. */
+export function applicationApiKeyDisplayPrefix(plaintext) {
+    return plaintext.slice(0, API_KEY_PREFIX.length + 6);
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { migrate, type MigrateOptions } from "./migrate.js";
 export { grantPlatformAdmin, type GrantPlatformAdminOptions, type GrantPlatformAdminResult } from "./grant-platform-admin.js";
 export { registerApplication, type RegisterApplicationOptions, type RegisteredApplication, type PermissionInput, } from "./register-application.js";
-export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
+export { generateApplicationApiKey, hashApplicationApiKey, applicationApiKeyDisplayPrefix } from "./api-key.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9H,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9H,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
 export { migrate } from "./migrate.js";
 export { grantPlatformAdmin } from "./grant-platform-admin.js";
 export { registerApplication, } from "./register-application.js";
-export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
+export { generateApplicationApiKey, hashApplicationApiKey, applicationApiKeyDisplayPrefix } from "./api-key.js";

package/migrations/0037_grant_oauth_client_id_select.sql

@@ -0,0 +1,19 @@
+-- Migration 0036 added applications.oauth_client_id but forgot the
+-- column-level grant migration 0032 made mandatory for any new column on
+-- this table: 0032 revoked the old blanket `grant select on all tables to
+-- authenticated` and replaced it with an explicit per-column list, so a
+-- column added later without its own grant is invisible to `authenticated`
+-- — worse than invisible, actually: PostgREST's single SELECT statement
+-- fails outright with "permission denied for table applications" the
+-- moment oauth_client_id is included alongside the columns that ARE
+-- granted, taking the whole query down with it. Live-reproduced against
+-- production: apps/admin-panel's applications page select list includes
+-- oauth_client_id unconditionally, so every authenticated user's query
+-- failed and the entire "Aplicaciones" list rendered empty since 0036
+-- shipped — not a caching or migration-timing issue, a missing grant.
+--
+-- Not sensitive like api_key_hash (a GoTrue client_id, not a secret), so
+-- it belongs in the same broadly-readable column set as
+-- owner_organization_id/homepage_url/etc., not restricted to service_role.
+
+grant select (oauth_client_id) on kontrolia_auth.applications to authenticated;

package/migrations/0038_role_and_role_permissions_audit_triggers.sql

@@ -0,0 +1,84 @@
+-- 0013/0024 established "the database logs it, not application code" for
+-- every other mutation surface, but roles and role_permissions were never
+-- covered — creating or deleting a custom role, or granting/revoking a
+-- permission on one, has produced zero audit trail since day one. Found
+-- while designing API + MCP routes for role management: those routes must
+-- not become the first and only place these actions get logged, since the
+-- whole point of trigger-based auditing is that it keeps recording
+-- regardless of which caller (browser, API, MCP, Studio/psql) made the
+-- change.
+--
+-- These fire for system-role rows too (the auto-created "Administrador de
+-- <app>" role, and its auto-synced permission set) — same as every other
+-- trigger here, the log reflects what actually happened in the database,
+-- not just human-initiated changes. actor_user_id is auth.uid(), which is
+-- null for those system-triggered inserts; that's expected and matches how
+-- 0013's own device.revoked/membership.created triggers already behave.
+
+create or replace function kontrolia_auth.log_role_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.organization_id, auth.uid(), 'role.created', 'role', new.id::text,
+      jsonb_build_object('name', new.name, 'slug', new.slug, 'application_id', new.application_id, 'is_system_role', new.is_system_role)
+    );
+    return new;
+  else
+    if old.organization_id is null or exists (select 1 from kontrolia_auth.organizations where id = old.organization_id) then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (
+        old.organization_id, auth.uid(), 'role.deleted', 'role', old.id::text,
+        jsonb_build_object('name', old.name, 'slug', old.slug, 'application_id', old.application_id)
+      );
+    end if;
+    return old;
+  end if;
+end;
+$$;
+
+create trigger audit_role_change
+  after insert or delete on kontrolia_auth.roles
+  for each row execute function kontrolia_auth.log_role_change();
+
+create or replace function kontrolia_auth.log_role_permission_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  target_role record;
+begin
+  select organization_id, name, slug into target_role
+  from kontrolia_auth.roles
+  where id = coalesce(new.role_id, old.role_id);
+
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      target_role.organization_id, auth.uid(), 'role_permission.granted', 'role', new.role_id::text,
+      jsonb_build_object('role_slug', target_role.slug, 'permission_id', new.permission_id)
+    );
+    return new;
+  else
+    if target_role.organization_id is null or exists (select 1 from kontrolia_auth.organizations where id = target_role.organization_id) then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (
+        target_role.organization_id, auth.uid(), 'role_permission.revoked', 'role', old.role_id::text,
+        jsonb_build_object('role_slug', target_role.slug, 'permission_id', old.permission_id)
+      );
+    end if;
+    return old;
+  end if;
+end;
+$$;
+
+create trigger audit_role_permission_change
+  after insert or delete on kontrolia_auth.role_permissions
+  for each row execute function kontrolia_auth.log_role_permission_change();

package/migrations/0039_instance_settings.sql

@@ -0,0 +1,54 @@
+-- Instance-wide branding/behavior settings for auth-server's hosted auth
+-- screens (login, register, forgot-password, reset-password, verify-email,
+-- MFA challenge, invitation accept, OAuth consent — everywhere AuthShell
+-- renders). A single row, not per-organization: this installation's
+-- self-hosted auth UI has one look, controlled by a platform admin from
+-- admin-panel, same way there's one GoTrue project per installation.
+--
+-- registration_enabled: when false, auth-server hides "Crear cuenta" and
+-- /register redirects back to /login — the only way to add a new person is
+-- an Owner/Admin inviting them from admin-panel. theme forces light/dark
+-- regardless of the browser's prefers-color-scheme, or 'system' (default)
+-- to keep following it. button_color overrides --k-primary. logo_url
+-- replaces the "K" mark + wordmark when set.
+create table kontrolia_auth.instance_settings (
+  id boolean primary key default true,
+  registration_enabled boolean not null default true,
+  theme text not null default 'system' check (theme in ('light', 'dark', 'system')),
+  button_color text check (button_color is null or button_color ~ '^#[0-9a-fA-F]{6}$'),
+  logo_url text,
+  updated_at timestamptz not null default now(),
+  updated_by uuid references auth.users (id) on delete set null,
+  constraint instance_settings_singleton check (id)
+);
+
+comment on table kontrolia_auth.instance_settings is 'Singleton row (id is always true) — instance-wide branding/behavior for auth-server''s hosted auth screens.';
+
+insert into kontrolia_auth.instance_settings (id) values (true);
+
+alter table kontrolia_auth.instance_settings enable row level security;
+
+-- Public read: auth-server's login/register/etc. pages render this before
+-- anyone is authenticated, and none of these fields are sensitive.
+create policy "anyone can read instance settings" on kontrolia_auth.instance_settings
+  for select using (true);
+
+-- Writes still go through auth-server's API routes with a service-role
+-- client (same Model B pattern as platform-admins/oauth-clients), which
+-- bypasses RLS — this policy is defense-in-depth for any direct client use.
+create policy "platform admins can update instance settings" on kontrolia_auth.instance_settings
+  for update using (exists (select 1 from kontrolia_auth.platform_admins pa where pa.user_id = auth.uid()));
+
+grant select on kontrolia_auth.instance_settings to anon, authenticated;
+grant update on kontrolia_auth.instance_settings to authenticated;
+
+-- Logo uploads. Public bucket: served via Supabase's unauthenticated
+-- /storage/v1/object/public/branding/... path, so auth-server's own
+-- unauthenticated login screen can just <img src> it directly — no signed
+-- URLs, no extra round-trip. Uploads/deletes only ever happen server-side
+-- through auth-server's service-role client (same as every other
+-- platform-admin-gated mutation in this codebase), so no storage.objects
+-- RLS policies are needed for writes.
+insert into storage.buckets (id, name, public)
+values ('branding', 'branding', true)
+on conflict (id) do nothing;

package/migrations/0040_application_api_keys.sql

@@ -0,0 +1,171 @@
+-- Replaces the single kapp_ key on kontrolia_auth.applications with a real
+-- multi-key model: an application can have any number of named, revocable,
+-- optionally-expiring keys, each independently scoped to whichever
+-- organization it was generated for — not necessarily the application's
+-- owner_organization_id. A tenant organization that merely enabled an
+-- application (application_organizations) can mint its own key to call
+-- that application's members API on its own behalf, without needing the
+-- owning organization's involvement at all. The application's own global
+-- permission catalog (POST /api/applications/sync) still accepts any valid,
+-- non-revoked, non-expired key for the application regardless of which org
+-- it's scoped to — syncing permissions isn't an org-scoped operation.
+create table kontrolia_auth.application_api_keys (
+  id uuid primary key default gen_random_uuid(),
+  application_id uuid not null references kontrolia_auth.applications (id) on delete cascade,
+  organization_id uuid not null references kontrolia_auth.organizations (id) on delete cascade,
+  name text not null,
+  key_hash text not null,
+  -- First several characters of the plaintext, purely so the list UI can
+  -- show "kapp_a1b2c3…" to help an operator tell keys apart without ever
+  -- storing (or being able to show again) the full secret. Null for rows
+  -- backfilled from the old single-key column below, where no prefix was
+  -- ever recorded.
+  key_prefix text,
+  last_used_at timestamptz,
+  expires_at timestamptz,
+  revoked_at timestamptz,
+  revoked_by uuid references auth.users (id) on delete set null,
+  created_by uuid references auth.users (id) on delete set null,
+  created_at timestamptz not null default now()
+);
+
+comment on table kontrolia_auth.application_api_keys is 'Named, independently-scoped, revocable/expiring kapp_ keys — replaces the single applications.api_key_hash. organization_id is whichever org the key was generated for (must have application_id enabled), not necessarily the application''s owner.';
+
+-- 0016's own "platform admins can view the platform admin list" SELECT
+-- policy on platform_admins queries platform_admins from inside its own
+-- policy — harmless as long as the only caller is service_role (which
+-- bypasses RLS entirely, the only way this table has ever actually been
+-- read in this codebase before now). The moment ANY other RLS policy
+-- (this migration's, below) checks platform-admin status via a plain
+-- `exists (select 1 from platform_admins ...)` under a real (non-service-role)
+-- caller, Postgres has to evaluate platform_admins' own SELECT policy for
+-- that subquery — which itself queries platform_admins — genuine infinite
+-- recursion ("infinite recursion detected in policy for relation
+-- platform_admins"), live-reproduced while building this migration's own
+-- policies below. A SECURITY DEFINER function (same escape hatch
+-- is_org_admin/is_org_owner already use for memberships/roles) runs with
+-- the function owner's privileges, bypassing the caller's own RLS on the
+-- table it queries — no recursion.
+create or replace function kontrolia_auth.is_platform_admin()
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (select 1 from kontrolia_auth.platform_admins pa where pa.user_id = auth.uid());
+$$;
+
+-- Retrofit 0016's policy onto the same function, closing the recursion risk
+-- there too — not just in the new policies below that happened to expose it.
+drop policy if exists "platform admins can view the platform admin list" on kontrolia_auth.platform_admins;
+create policy "platform admins can view the platform admin list" on kontrolia_auth.platform_admins
+  for select using (kontrolia_auth.is_platform_admin());
+
+alter table kontrolia_auth.application_api_keys enable row level security;
+
+create policy "org admins can view their org's application keys" on kontrolia_auth.application_api_keys
+  for select using (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin());
+
+create policy "org admins can create application keys for their org" on kontrolia_auth.application_api_keys
+  for insert
+  with check (
+    (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin())
+    and exists (
+      select 1 from kontrolia_auth.application_organizations ao
+      where ao.application_id = application_api_keys.application_id
+        and ao.organization_id = application_api_keys.organization_id
+    )
+  );
+
+-- Keys are only ever revoked, never edited or hard-deleted — this policy
+-- only needs to authorize the "set revoked_at/revoked_by" update, which is
+-- everything the API route ever writes here.
+create policy "org admins can revoke their org's application keys" on kontrolia_auth.application_api_keys
+  for update using (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin())
+  with check (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin());
+
+-- Column-level ACL, same reasoning as 0032 for the column this replaces:
+-- key_hash must never be readable by any authenticated user for any
+-- organization. The auth-server route that matches a caller's Bearer key
+-- against these rows runs as service_role, which needs its own explicit
+-- grant — column privileges aren't inherited from a table-level grant.
+grant select (
+  id, application_id, organization_id, name, key_prefix, last_used_at, expires_at, revoked_at, revoked_by, created_by, created_at
+) on kontrolia_auth.application_api_keys to authenticated;
+grant insert (application_id, organization_id, name, key_hash, key_prefix, expires_at, created_by) on kontrolia_auth.application_api_keys to authenticated;
+grant update (revoked_at, revoked_by) on kontrolia_auth.application_api_keys to authenticated;
+grant select (id, application_id, organization_id, key_hash) on kontrolia_auth.application_api_keys to service_role;
+
+-- Same "the database logs it" pattern as every other mutation surface
+-- (0013, 0024, 0032, 0038).
+create or replace function kontrolia_auth.log_application_api_key_lifecycle()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.organization_id, auth.uid(), 'application_api_key.created', 'application', new.application_id::text,
+      jsonb_build_object('keyId', new.id, 'name', new.name, 'expiresAt', new.expires_at)
+    );
+    return new;
+  end if;
+
+  if old.revoked_at is null and new.revoked_at is not null then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.organization_id, auth.uid(), 'application_api_key.revoked', 'application', new.application_id::text,
+      jsonb_build_object('keyId', new.id, 'name', new.name)
+    );
+  end if;
+  return new;
+end;
+$$;
+
+create trigger audit_application_api_key_lifecycle
+  after insert or update on kontrolia_auth.application_api_keys
+  for each row execute function kontrolia_auth.log_application_api_key_lifecycle();
+
+-- Carry forward every application's existing single key as its first named
+-- key, scoped to the same organization that already administered it
+-- (owner_organization_id — the only organization the old RLS policy ever
+-- let touch it).
+insert into kontrolia_auth.application_api_keys (application_id, organization_id, name, key_hash, last_used_at, created_at)
+select id, owner_organization_id, 'Clave original', api_key_hash, api_key_last_used_at, created_at
+from kontrolia_auth.applications
+where api_key_hash is not null and owner_organization_id is not null;
+
+-- log_application_api_key_change() (0032, extended by 0034) did double duty:
+-- logging api_key_hash changes AND ownership changes on kontrolia_auth.applications.
+-- The key-lifecycle half moves to the new table's own trigger above; redefine
+-- this one (same name, same trigger — a transparent swap, no drop/recreate
+-- needed) to keep only what it's now solely responsible for.
+create or replace function kontrolia_auth.log_application_api_key_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if old.owner_organization_id is distinct from new.owner_organization_id then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.owner_organization_id,
+      auth.uid(),
+      case when old.owner_organization_id is null then 'application.ownership_claimed' else 'application.ownership_transferred' end,
+      'application',
+      new.id::text,
+      jsonb_build_object('slug', new.slug, 'previous_owner_organization_id', old.owner_organization_id)
+    );
+  end if;
+
+  return new;
+end;
+$$;
+
+alter table kontrolia_auth.applications drop column api_key_hash;
+alter table kontrolia_auth.applications drop column api_key_last_used_at;

package/migrations/0041_mcp_oauth_client.sql

@@ -0,0 +1,14 @@
+-- Tracks the single, auto-provisioned, non-deletable OAuth client reserved
+-- for MCP agent connections (Claude Code, Claude Desktop, ChatGPT
+-- connectors, ...). Registering a client OAuth was previously only
+-- reachable through an application's own "Cliente OAuth" dialog — correct
+-- for genuine app SSO, but a modeling mismatch for a generic agent that
+-- isn't "logging in as" any one catalogued application. NULL until the
+-- first visit to admin-panel's "Clientes OAuth" screen bootstraps it (see
+-- POST /api/oauth-clients/mcp-bootstrap) — there's no way to create it from
+-- a plain SQL migration, since GoTrue's OAuth clients live behind its own
+-- admin HTTP API, not a table this schema can INSERT into directly.
+alter table kontrolia_auth.instance_settings add column mcp_oauth_client_id text;
+
+comment on column kontrolia_auth.instance_settings.mcp_oauth_client_id is
+  'GoTrue client_id of the reserved MCP OAuth client, once bootstrapped. Not a secret (client_id is public in the OAuth flow) — safe to expose via the same public GET /api/instance-settings as everything else on this row.';

package/migrations/0042_supabase_oauth_connection.sql

@@ -0,0 +1,32 @@
+-- Stores the OAuth 2.1 tokens for KontrolIA Auth's own connection to
+-- Supabase's Management API (a "Supabase OAuth App" a platform admin
+-- authorizes once, from admin-panel's Social login screen) — the
+-- self-renewing alternative to pasting a Personal Access Token that
+-- silently expires. access_token is short-lived; refresh_token lets
+-- auth-server renew it on its own, forever, until the connection is
+-- revoked (from here, or from the user's own Supabase account).
+--
+-- Deliberately NOT modeled like instance_settings (public-read singleton):
+-- RLS is enabled with zero policies, and there is no grant to anon/
+-- authenticated at all beyond the schema's blanket default privileges from
+-- migration 0008 — with RLS enabled and no permissive policy, that default
+-- grant still resolves to zero rows/denied for every command, for every
+-- role except service_role (which bypasses RLS entirely). This table's
+-- contents are account-wide-privileged Supabase credentials, meant to be
+-- reachable ONLY from auth-server's own service-role client — never via
+-- PostgREST under any authenticated session, no matter how the caller got
+-- there.
+create table kontrolia_auth.supabase_oauth_connection (
+  id boolean primary key default true,
+  access_token text not null,
+  refresh_token text not null,
+  expires_at timestamptz not null,
+  connected_by uuid references auth.users (id) on delete set null,
+  connected_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint supabase_oauth_connection_singleton check (id)
+);
+
+comment on table kontrolia_auth.supabase_oauth_connection is 'Singleton row (id is always true) — OAuth tokens for this installation''s connection to Supabase''s Management API. service_role only, never exposed via PostgREST.';
+
+alter table kontrolia_auth.supabase_oauth_connection enable row level security;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontrolia/db",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "license": "MIT",
   "description": "KontrolIA Auth database layer: SQL migrations for the `kontrolia` schema (organizations, RBAC, Custom Access Token Hook) and a connection-string-agnostic migration runner.",
   "keywords": [