@spinajs/session-provider-db 2.0.489 → 2.0.490

package/lib/cjs/index.d.ts

@@ -2,6 +2,8 @@ import { SessionProvider, ISession } from '@spinajs/rbac';
 import { Log } from '@spinajs/log';
 export * from './models/DbSession.js';
 export * from './migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.js';
+export * from './migrations/UserSessionDataJson_2026_07_31_00_00_00.js';
+export * from './migrations/UserSessionTimestamps_2026_07_31_00_00_01.js';
 /**
  * Relational-db backed session store. Conforms to the `@spinajs/rbac`
  * `SessionProvider` contract: ownership is the numeric `UserId`, expiration is

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAqD,MAAM,eAAe,CAAC;AAE7G,OAAO,EAAU,GAAG,EAAE,MAAM,cAAc,CAAC;AAM3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,+DAA+D,CAAC;AAE9E;;;;;GAKG;AACH,qBACa,cAAe,SAAQ,eAAe;IAEjD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB;;;;OAIG;IAIH,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;IAErB,OAAO;IAWpB;;;;;;OAMG;IACU,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAgBjC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAmBpD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtC,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB1C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAM/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,gBAAgB;CAMzB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAqD,MAAM,eAAe,CAAC;AAE7G,OAAO,EAAU,GAAG,EAAE,MAAM,cAAc,CAAC;AAM3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,+DAA+D,CAAC;AAC9E,cAAc,yDAAyD,CAAC;AACxE,cAAc,2DAA2D,CAAC;AAE1E;;;;;GAKG;AACH,qBACa,cAAe,SAAQ,eAAe;IAEjD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB;;;;OAIG;IAIH,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;IAErB,OAAO;IAWpB;;;;;;OAMG;IACU,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAgBjC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAmBpD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtC,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB1C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAM/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,gBAAgB;CAMzB"}

package/lib/cjs/index.js

@@ -33,6 +33,8 @@ const configuration_1 = require("@spinajs/configuration");
 const luxon_1 = require("luxon");
 __exportStar(require("./models/DbSession.js"), exports);
 __exportStar(require("./migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.js"), exports);
+__exportStar(require("./migrations/UserSessionDataJson_2026_07_31_00_00_00.js"), exports);
+__exportStar(require("./migrations/UserSessionTimestamps_2026_07_31_00_00_01.js"), exports);
 /**
  * Relational-db backed session store. Conforms to the `@spinajs/rbac`
  * `SessionProvider` contract: ownership is the numeric `UserId`, expiration is
@@ -138,7 +140,7 @@ let DbSessionStore = class DbSessionStore extends rbac_1.SessionProvider {
             UserId: row.UserId,
             Creation: row.CreatedAt,
             Expiration: row.Expiration ?? undefined,
-            Data: (0, rbac_1.decodeSessionData)(row.Data),
+            Data: (0, rbac_1.decodeSessionData)(sessionDataFromColumn(row.Data)),
         });
     }
     expirationEquals(a, b) {
@@ -162,4 +164,34 @@ __decorate([
 exports.DbSessionStore = DbSessionStore = __decorate([
     (0, di_1.Injectable)(rbac_1.SessionProvider)
 ], DbSessionStore);
+/**
+ * Presents whatever the driver hands back for `user_sessions.Data` in one of the
+ * two shapes {@link decodeSessionData} understands - a JSON string, or an
+ * already-parsed object graph.
+ *
+ * `Data` is a MySQL `json` column, so mysql2 parses it for us and this function
+ * passes the OBJECT straight through: no `JSON.stringify` / `JSON.parse`
+ * round-trip, the decoder walks the graph natively. Strings pass through just as
+ * untouched - sqlite has no json type and returns the stored text, and a
+ * connection configured otherwise (`typeCast`, an older column, a text-typed
+ * table that has not run the converging migration yet) may still yield one.
+ *
+ * The only value actually converted is a `Buffer`: a blob-ish column or a driver
+ * in binary mode delivers one, and neither the object walk nor `JSON.parse` can
+ * read it. Note it is decoded to text rather than handed over as an object -
+ * treating a Buffer as an object graph would walk its byte indices and decode to
+ * an empty session.
+ *
+ * The write path is untouched: `encodeSessionData` still stores a string, which
+ * a `json` column accepts verbatim (mysql2 does NOT auto-serialize objects into
+ * json columns, and `DbSession.Data` deliberately carries no `@Json()`
+ * decorator - the ORM's JsonValueConverter would `JSON.stringify` the already
+ * encoded string and double-encode every session).
+ */
+function sessionDataFromColumn(data) {
+    if (Buffer.isBuffer(data)) {
+        return data.toString('utf8');
+    }
+    return data;
+}
 //# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAA6G;AAC7G,oCAAyC;AACzC,sCAA2C;AAC3C,wDAAkD;AAClD,sCAA+C;AAC/C,0DAAgD;AAChD,iCAAiC;AAEjC,wDAAsC;AACtC,gGAA8E;AAE9E;;;;;GAKG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,sBAAe;IAc1C,KAAK,CAAC,OAAO;QAClB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAE1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzB,6DAA6D;QAC7D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,cAAc;QACzB,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,cAAc;QACd,MAAM,OAAO,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,wBAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,MAAM,GAAG,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC;YAChC,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEX,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEpC,sCAAsC;QACtC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAiB;QACjC,6EAA6E;QAC7E,qEAAqE;QACrE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,GAAG,MAAM,wBAAS,CAAC,QAAQ,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QAEH,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC/B,0EAA0E;QAC1E,CAAC,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAa,CAAC;QACxD,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,IAAI,GAAG,IAAA,wBAAiB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAC7B,MAAM,wBAAS,CAAC,MAAM,CAAC;YACrB,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,MAAM,wBAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,wBAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,MAAM,wBAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAEO,SAAS,CAAC,GAAc;QAC9B,OAAO,IAAI,kBAAW,CAAC;YACrB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;YACvC,IAAI,EAAE,IAAA,wBAAiB,EAAC,GAAG,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;QACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AArJY,wCAAc;AAEf;IADT,IAAA,YAAM,EAAC,kBAAkB,CAAC;8BACZ,SAAG;2CAAC;AAUT;IAHT,IAAA,sBAAM,EAAC,iCAAiC,EAAE;QACzC,YAAY,EAAE,MAAM;KACrB,CAAC;;uDACgC;yBAZvB,cAAc;IAD1B,IAAA,eAAU,EAAC,sBAAe,CAAC;GACf,cAAc,CAqJ1B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wCAA6G;AAC7G,oCAAyC;AACzC,sCAA2C;AAC3C,wDAAkD;AAClD,sCAA+C;AAC/C,0DAAgD;AAChD,iCAAiC;AAEjC,wDAAsC;AACtC,gGAA8E;AAC9E,0FAAwE;AACxE,4FAA0E;AAE1E;;;;;GAKG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,sBAAe;IAc1C,KAAK,CAAC,OAAO;QAClB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAE1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzB,6DAA6D;QAC7D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,cAAc;QACzB,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,cAAc;QACd,MAAM,OAAO,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAE1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,wBAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,MAAM,GAAG,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC;YAChC,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEX,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEpC,sCAAsC;QACtC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAiB;QACjC,6EAA6E;QAC7E,qEAAqE;QACrE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,GAAG,MAAM,wBAAS,CAAC,QAAQ,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QAEH,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC/B,0EAA0E;QAC1E,CAAC,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAa,CAAC;QACxD,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,IAAI,GAAG,IAAA,wBAAiB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,CAAC,MAAM,CAAC,qBAAe,CAAC,cAAc,CAAC,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAC7B,MAAM,wBAAS,CAAC,MAAM,CAAC;YACrB,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,MAAM,wBAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,wBAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,MAAM,wBAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,MAAM,wBAAS,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAEO,SAAS,CAAC,GAAc;QAC9B,OAAO,IAAI,kBAAW,CAAC;YACrB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;YACvC,IAAI,EAAE,IAAA,wBAAiB,EAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;QACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AArJY,wCAAc;AAEf;IADT,IAAA,YAAM,EAAC,kBAAkB,CAAC;8BACZ,SAAG;2CAAC;AAUT;IAHT,IAAA,sBAAM,EAAC,iCAAiC,EAAE;QACzC,YAAY,EAAE,MAAM;KACrB,CAAC;;uDACgC;yBAZvB,cAAc;IAD1B,IAAA,eAAU,EAAC,sBAAe,CAAC;GACf,cAAc,CAqJ1B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,qBAAqB,CAAC,IAAa;IAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/cjs/migration-support.d.ts

@@ -0,0 +1,43 @@
+import { OrmDriver } from '@spinajs/orm';
+/**
+ * True when the connection speaks MySQL's DDL dialect. See {@link MYSQL_DRIVERS}.
+ *
+ * @param connection - the migration's connection
+ */
+export declare function isMySqlDialect(connection: OrmDriver): boolean;
+/**
+ * Reduces a driver-reported `NativeType` to its bare type name, lower-cased.
+ *
+ * `IColumnDescriptor.NativeType` is documented as the FULL database type - MySQL
+ * reports `information_schema.DATA_TYPE` (already bare: `varchar`, `text`,
+ * `json`, `date`), but sqlite reports the declared type verbatim, so
+ * `VARCHAR(36)` and `INT(10) UNSIGNED` both occur. Comparing raw strings would
+ * therefore miss exactly the databases the probe exists to recognise.
+ *
+ * @param nativeType - whatever the driver reported
+ */
+export declare function normalizeNativeType(nativeType: string): string;
+/**
+ * True when the (normalized) type is one of the text-family types listed in
+ * {@link TEXT_FAMILY}.
+ *
+ * @param nativeType - a type name, normalized or not
+ */
+export declare function isTextFamily(nativeType: string): boolean;
+/**
+ * Normalized native type of one column, or `null` when it cannot be established.
+ *
+ * `null` means "do not touch anything": the table is not described, the column
+ * is absent, or the driver's `tableInfo()` refused/failed. A migration that
+ * cannot see the current state must SKIP, never guess - a throw here would be
+ * recorded as a failed migration, and `assertNoFailed()` then blocks every
+ * subsequent migration on that connection until somebody edits the tracking
+ * table by hand. On a service that migrates at boot that is an outage, and the
+ * thing being probed is a type conversion nobody is waiting for.
+ *
+ * @param connection - the migration's connection
+ * @param table - table name
+ * @param column - column name, compared case-insensitively
+ */
+export declare function columnNativeType(connection: OrmDriver, table: string, column: string): Promise<string | null>;
+//# sourceMappingURL=migration-support.d.ts.map

package/lib/cjs/migration-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-support.d.ts","sourceRoot":"","sources":["../../src/migration-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAiCzC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBnH"}

package/lib/cjs/migration-support.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMySqlDialect = isMySqlDialect;
+exports.normalizeNativeType = normalizeNativeType;
+exports.isTextFamily = isTextFamily;
+exports.columnNativeType = columnNativeType;
+/**
+ * Shared probes for the converging migrations in `./migrations`.
+ *
+ * Lives OUTSIDE `src/migrations` on purpose: `MigrationSource` globs that
+ * directory and imports every `.js` it finds, and a module that is not a
+ * migration has no business being pulled into that scan.
+ */
+/**
+ * Driver names (the `@Injectable(...)` keys the mysql package registers, which
+ * is what `db.Connections[n].Driver` carries) whose dialect understands
+ * `ALTER TABLE ... MODIFY <col> <type>` and has a native `JSON` column type.
+ *
+ * This gate is not decoration. `MODIFY` is MySQL/MariaDB syntax - MSSQL spells
+ * it `ALTER COLUMN` and has no `JSON` type at all, sqlite has neither - so
+ * emitting the statement anywhere else is a syntax error, i.e. a FAILED
+ * migration, i.e. `assertNoFailed()` blocking every future migration on that
+ * connection. Every other dialect stores the payload as text and the read path
+ * (`decodeSessionData`) already handles the string shape, so skipping there is
+ * not a compromise: there is genuinely nothing to converge.
+ */
+const MYSQL_DRIVERS = ['orm-driver-mysql', 'orm-driver-mysql-ssh'];
+/**
+ * The text-family native types a legacy `user_sessions.Data` can carry. A
+ * column of any of these is the state the JSON conversion exists to fix;
+ * anything else (`json` on a converged or fresh database, or something nobody
+ * anticipated) is left alone.
+ */
+const TEXT_FAMILY = ['text', 'tinytext', 'mediumtext', 'longtext', 'varchar', 'nvarchar'];
+/**
+ * True when the connection speaks MySQL's DDL dialect. See {@link MYSQL_DRIVERS}.
+ *
+ * @param connection - the migration's connection
+ */
+function isMySqlDialect(connection) {
+    return MYSQL_DRIVERS.includes(connection.Options?.Driver);
+}
+/**
+ * Reduces a driver-reported `NativeType` to its bare type name, lower-cased.
+ *
+ * `IColumnDescriptor.NativeType` is documented as the FULL database type - MySQL
+ * reports `information_schema.DATA_TYPE` (already bare: `varchar`, `text`,
+ * `json`, `date`), but sqlite reports the declared type verbatim, so
+ * `VARCHAR(36)` and `INT(10) UNSIGNED` both occur. Comparing raw strings would
+ * therefore miss exactly the databases the probe exists to recognise.
+ *
+ * @param nativeType - whatever the driver reported
+ */
+function normalizeNativeType(nativeType) {
+    return String(nativeType).toLowerCase().split('(')[0].trim().split(/\s+/)[0];
+}
+/**
+ * True when the (normalized) type is one of the text-family types listed in
+ * {@link TEXT_FAMILY}.
+ *
+ * @param nativeType - a type name, normalized or not
+ */
+function isTextFamily(nativeType) {
+    return TEXT_FAMILY.includes(normalizeNativeType(nativeType));
+}
+/**
+ * Normalized native type of one column, or `null` when it cannot be established.
+ *
+ * `null` means "do not touch anything": the table is not described, the column
+ * is absent, or the driver's `tableInfo()` refused/failed. A migration that
+ * cannot see the current state must SKIP, never guess - a throw here would be
+ * recorded as a failed migration, and `assertNoFailed()` then blocks every
+ * subsequent migration on that connection until somebody edits the tracking
+ * table by hand. On a service that migrates at boot that is an outage, and the
+ * thing being probed is a type conversion nobody is waiting for.
+ *
+ * @param connection - the migration's connection
+ * @param table - table name
+ * @param column - column name, compared case-insensitively
+ */
+async function columnNativeType(connection, table, column) {
+    let columns;
+    try {
+        columns = await connection.tableInfo(table);
+    }
+    catch {
+        // e.g. the mysql driver throws when the connection carries no Database, and
+        // a driver may not implement tableInfo usefully at all.
+        return null;
+    }
+    const found = columns?.find((c) => c.Name?.toLowerCase() === column.toLowerCase());
+    if (!found?.NativeType) {
+        return null;
+    }
+    return normalizeNativeType(found.NativeType);
+}
+//# sourceMappingURL=migration-support.js.map

package/lib/cjs/migration-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-support.js","sourceRoot":"","sources":["../../src/migration-support.ts"],"names":[],"mappings":";;AAsCA,wCAEC;AAaD,kDAEC;AAQD,oCAEC;AAiBD,4CAkBC;AAlGD;;;;;;GAMG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAE1F;;;;GAIG;AACH,SAAgB,cAAc,CAAC,UAAqB;IAClD,OAAO,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,UAAkB;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,UAAkB;IAC7C,OAAO,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,gBAAgB,CAAC,UAAqB,EAAE,KAAa,EAAE,MAAc;IACzF,IAAI,OAAO,CAAC;IAEZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,wDAAwD;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAEnF,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC"}

package/lib/cjs/migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserSessionDBSqlMigration_2022_06_28_01_20_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAAE,SAAS,EAAqB,MAAM,cAAc,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBACa,6CAA8C,SAAQ,YAAY;IAChE,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBxC,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAC/C"}
+{"version":3,"file":"UserSessionDBSqlMigration_2022_06_28_01_20_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAAE,SAAS,EAAqB,MAAM,cAAc,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBACa,6CAA8C,SAAQ,YAAY;IAChE,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BxC,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAC/C"}

package/lib/cjs/migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.js

@@ -41,6 +41,14 @@ let UserSessionDBSqlMigration_2022_06_28_01_20_00 = class UserSessionDBSqlMigrat
             table.string('SessionId', 36).primaryKey().notNull();
             table.dateTime('CreatedAt').notNull();
             table.dateTime('Expiration');
+            // JSON is the intended type, so a fresh install gets it straight away and never needs the
+            // converging migration (`UserSessionDataJson_2026_07_31_00_00_00`) to do any work. Deployed
+            // databases created before this migration existed carry a text-family column - the guard
+            // above means the type declared here has never run against them - and that migration is what
+            // brings them here.
+            //
+            // The read path consumes both shapes on purpose: mysql2 returns a json column as a parsed
+            // object, sqlite (which has no json type) returns the stored text. See `decodeSessionData`.
             table.json('Data').notNull();
             table.int('UserId').notNull();
             table.foreignKey('UserId').references('users', 'Id').onDelete(orm_1.ReferentialAction.Cascade);

package/lib/cjs/migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserSessionDBSqlMigration_2022_06_28_01_20_00.js","sourceRoot":"","sources":["../../../src/migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sCAAqF;AAErF;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEI,IAAM,6CAA6C,GAAnD,MAAM,6CAA8C,SAAQ,kBAAY;IACtE,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,6FAA6F;QAC7F,uEAAuE;QACvE,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;YAC/D,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,CAAC;YACrD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;YAE9B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QAEH,gGAAgG;QAChG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtH,CAAC;IAED,qCAAqC;IAC9B,KAAK,CAAC,IAAI,CAAC,CAAY,IAAkB,CAAC;CAClD,CAAA;AAxBY,sGAA6C;wDAA7C,6CAA6C;IADzD,IAAA,eAAS,EAAC,6BAA6B,CAAC;GAC5B,6CAA6C,CAwBzD"}
+{"version":3,"file":"UserSessionDBSqlMigration_2022_06_28_01_20_00.js","sourceRoot":"","sources":["../../../src/migrations/UserSessionDBSqlMigration_2022_06_28_01_20_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sCAAqF;AAErF;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEI,IAAM,6CAA6C,GAAnD,MAAM,6CAA8C,SAAQ,kBAAY;IACtE,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,6FAA6F;QAC7F,uEAAuE;QACvE,IAAI,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;YAC/D,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,CAAC;YACrD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,0FAA0F;YAC1F,4FAA4F;YAC5F,yFAAyF;YACzF,6FAA6F;YAC7F,oBAAoB;YACpB,EAAE;YACF,0FAA0F;YAC1F,4FAA4F;YAC5F,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;YAE9B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QAEH,gGAAgG;QAChG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtH,CAAC;IAED,qCAAqC;IAC9B,KAAK,CAAC,IAAI,CAAC,CAAY,IAAkB,CAAC;CAClD,CAAA;AAhCY,sGAA6C;wDAA7C,6CAA6C;IADzD,IAAA,eAAS,EAAC,6BAA6B,CAAC;GAC5B,6CAA6C,CAgCzD"}

package/lib/cjs/migrations/UserSessionDataJson_2026_07_31_00_00_00.d.ts

@@ -0,0 +1,101 @@
+import { OrmMigration, OrmDriver } from '@spinajs/orm';
+/**
+ * Converts an EXISTING text-typed `user_sessions.Data` to a native MySQL `json`
+ * column, so the read path receives a parsed object graph instead of text.
+ *
+ * Databases created before the create-path migration
+ * (`UserSessionDBSqlMigration_2022_06_28_01_20_00`) declared `json` - i.e. every
+ * deployment - carry `Data text NOT NULL`. The create migration returns early
+ * when the table is already there, so the type it declares has never reached
+ * them. Fresh installs already get `json`. Two shapes of the same table exist in
+ * the wild and nothing detected which one you had; this migration ends that.
+ *
+ * mysql2 parses a json column on the way out, so the read path receives the
+ * payload as a live object graph and rebuilds the session `Map` from it directly
+ * (`decodeSessionData`). The write path is unchanged - `encodeSessionData` still
+ * produces JSON text, which a json column stores verbatim.
+ *
+ * Everything below is a guard. Read them in order.
+ *
+ * 1. Table missing: nothing to converge
+ * ---------------------------------------
+ * It normally IS there - the create migration carries an earlier timestamp and
+ * runs first in the same batch - but a connection that hosts only part of the
+ * schema must not blow up here.
+ *
+ * 2. Column state probe: skip unless it is text-family
+ * ------------------------------------------------------
+ * The previous version of this migration was unconditional, on the argument that
+ * `MODIFY` to a type a column already has is a harmless rewrite. True on MySQL,
+ * and irrelevant everywhere else: it reached the schema builder's `alterTable()`,
+ * which resolves `AlterTableQueryCompiler` - and `orm-mssql` registers no
+ * implementation for it, so DI hands back the ABSTRACT class, whose `compile()`
+ * does not exist. That throw is recorded as a FAILED migration, and
+ * `assertNoFailed()` then refuses to run ANY migration on that connection ever
+ * again: the application never boots without manual surgery on the tracking
+ * table. Probing the target state first and returning early is the same shape
+ * `@spinajs/rbac`'s `RBACRegisteredAt_2026_07_28_00_00_00` already uses, and it
+ * makes the no-op case genuinely free rather than merely survivable.
+ *
+ * An unreadable probe skips too - see `columnNativeType`.
+ *
+ * 3. Dialect gate: MySQL only
+ * ------------------------------
+ * `MODIFY` and the `JSON` type are MySQL's. A text-family `Data` on MSSQL
+ * (`nvarchar`) or sqlite (`TEXT`) passes guard 2 and would then be handed
+ * syntax its server rejects - the same failed-migration outage guard 2 exists to
+ * prevent. Those dialects keep a text column and the read path keeps decoding a
+ * string, which is exactly what `decodeSessionData` does with it.
+ *
+ * 4. The wipe
+ * -----------
+ * Reached only when an actual `text -> json` conversion is about to happen.
+ * MySQL validates EVERY existing row during that conversion, and a single
+ * malformed / truncated / empty payload (a row from a crashed write, a row
+ * written by an older codec, a row truncated by TEXT's 64 KiB limit) fails the
+ * statement:
+ *
+ *     ERROR 3140 (22032): Invalid JSON text: "Invalid value." at position 1
+ *
+ * Emptying the table first makes the conversion unconditionally safe. Sessions
+ * are disposable state: the worst a user sees is one forced re-login, and that
+ * is now paid ONLY by the deployments actually being converted - a fresh install
+ * skips at guard 2 and never deletes anything.
+ *
+ * `DELETE`, not `TRUNCATE`: truncate is not transactional, is refused outright
+ * by some engines for a table involved in foreign keys, and there is no volume
+ * here to make the difference worth having.
+ *
+ * 5. ONE statement, not three
+ * ----------------------------
+ * `alterTable()` compiles one `ICompilerOutput` per modified column and
+ * `SqlDriver.execute` wraps the array in `Promise.all` - three concurrent
+ * `ALTER TABLE`s on three pooled connections against one table. A partial
+ * failure leaves the table half-converted AND the migration marked failed. The
+ * raw escape hatch (`schema().raw`, compiled by `SqlRawSchemaQueryCompiler`,
+ * registered by every SQL driver via `orm-sql`) sends exactly one statement.
+ * The `CreatedAt`/`Expiration` widening that used to ride along here now lives
+ * in its own migration (`UserSessionTimestamps_2026_07_31_00_00_01`), because it
+ * is a cast that cannot fail and must stay independently applicable.
+ */
+export declare class UserSessionDataJson_2026_07_31_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    /**
+     * Restores the text column. The sessions `up()` deleted are gone for good -
+     * that part is not reversible and nothing pretends otherwise - but the SHAPE
+     * is, and a package rollback that leaves a `json` column behind for a
+     * `2.0.488` reader is its own outage.
+     *
+     * Guarded by the inverse probe: only a column that is currently `json` is
+     * touched, so running `down()` twice, or against a database this migration
+     * never converted, does nothing.
+     *
+     * `TEXT` because `TEXT` is what the deployed databases had. Note this is a
+     * NARROWING cast - a stored payload above TEXT's 64 KiB limit would fail the
+     * statement in strict mode. That is acceptable here in a way it would not be
+     * in `up()`: `down()` runs only on an explicit, interactive rollback, never at
+     * boot, so a failure is loud and immediate rather than an unbootable service.
+     */
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=UserSessionDataJson_2026_07_31_00_00_00.d.ts.map

package/lib/cjs/migrations/UserSessionDataJson_2026_07_31_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserSessionDataJson_2026_07_31_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/UserSessionDataJson_2026_07_31_00_00_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,qBACa,uCAAwC,SAAQ,YAAY;IAC1D,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BrD;;;;;;;;;;;;;;;OAeG;IACU,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAaxD"}

package/lib/cjs/migrations/UserSessionDataJson_2026_07_31_00_00_00.js

@@ -0,0 +1,144 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserSessionDataJson_2026_07_31_00_00_00 = void 0;
+const orm_1 = require("@spinajs/orm");
+const migration_support_js_1 = require("../migration-support.js");
+/**
+ * Converts an EXISTING text-typed `user_sessions.Data` to a native MySQL `json`
+ * column, so the read path receives a parsed object graph instead of text.
+ *
+ * Databases created before the create-path migration
+ * (`UserSessionDBSqlMigration_2022_06_28_01_20_00`) declared `json` - i.e. every
+ * deployment - carry `Data text NOT NULL`. The create migration returns early
+ * when the table is already there, so the type it declares has never reached
+ * them. Fresh installs already get `json`. Two shapes of the same table exist in
+ * the wild and nothing detected which one you had; this migration ends that.
+ *
+ * mysql2 parses a json column on the way out, so the read path receives the
+ * payload as a live object graph and rebuilds the session `Map` from it directly
+ * (`decodeSessionData`). The write path is unchanged - `encodeSessionData` still
+ * produces JSON text, which a json column stores verbatim.
+ *
+ * Everything below is a guard. Read them in order.
+ *
+ * 1. Table missing: nothing to converge
+ * ---------------------------------------
+ * It normally IS there - the create migration carries an earlier timestamp and
+ * runs first in the same batch - but a connection that hosts only part of the
+ * schema must not blow up here.
+ *
+ * 2. Column state probe: skip unless it is text-family
+ * ------------------------------------------------------
+ * The previous version of this migration was unconditional, on the argument that
+ * `MODIFY` to a type a column already has is a harmless rewrite. True on MySQL,
+ * and irrelevant everywhere else: it reached the schema builder's `alterTable()`,
+ * which resolves `AlterTableQueryCompiler` - and `orm-mssql` registers no
+ * implementation for it, so DI hands back the ABSTRACT class, whose `compile()`
+ * does not exist. That throw is recorded as a FAILED migration, and
+ * `assertNoFailed()` then refuses to run ANY migration on that connection ever
+ * again: the application never boots without manual surgery on the tracking
+ * table. Probing the target state first and returning early is the same shape
+ * `@spinajs/rbac`'s `RBACRegisteredAt_2026_07_28_00_00_00` already uses, and it
+ * makes the no-op case genuinely free rather than merely survivable.
+ *
+ * An unreadable probe skips too - see `columnNativeType`.
+ *
+ * 3. Dialect gate: MySQL only
+ * ------------------------------
+ * `MODIFY` and the `JSON` type are MySQL's. A text-family `Data` on MSSQL
+ * (`nvarchar`) or sqlite (`TEXT`) passes guard 2 and would then be handed
+ * syntax its server rejects - the same failed-migration outage guard 2 exists to
+ * prevent. Those dialects keep a text column and the read path keeps decoding a
+ * string, which is exactly what `decodeSessionData` does with it.
+ *
+ * 4. The wipe
+ * -----------
+ * Reached only when an actual `text -> json` conversion is about to happen.
+ * MySQL validates EVERY existing row during that conversion, and a single
+ * malformed / truncated / empty payload (a row from a crashed write, a row
+ * written by an older codec, a row truncated by TEXT's 64 KiB limit) fails the
+ * statement:
+ *
+ *     ERROR 3140 (22032): Invalid JSON text: "Invalid value." at position 1
+ *
+ * Emptying the table first makes the conversion unconditionally safe. Sessions
+ * are disposable state: the worst a user sees is one forced re-login, and that
+ * is now paid ONLY by the deployments actually being converted - a fresh install
+ * skips at guard 2 and never deletes anything.
+ *
+ * `DELETE`, not `TRUNCATE`: truncate is not transactional, is refused outright
+ * by some engines for a table involved in foreign keys, and there is no volume
+ * here to make the difference worth having.
+ *
+ * 5. ONE statement, not three
+ * ----------------------------
+ * `alterTable()` compiles one `ICompilerOutput` per modified column and
+ * `SqlDriver.execute` wraps the array in `Promise.all` - three concurrent
+ * `ALTER TABLE`s on three pooled connections against one table. A partial
+ * failure leaves the table half-converted AND the migration marked failed. The
+ * raw escape hatch (`schema().raw`, compiled by `SqlRawSchemaQueryCompiler`,
+ * registered by every SQL driver via `orm-sql`) sends exactly one statement.
+ * The `CreatedAt`/`Expiration` widening that used to ride along here now lives
+ * in its own migration (`UserSessionTimestamps_2026_07_31_00_00_01`), because it
+ * is a cast that cannot fail and must stay independently applicable.
+ */
+let UserSessionDataJson_2026_07_31_00_00_00 = class UserSessionDataJson_2026_07_31_00_00_00 extends orm_1.OrmMigration {
+    async up(connection) {
+        if (!(await connection.schema().tableExists('user_sessions'))) {
+            return;
+        }
+        const dataType = await (0, migration_support_js_1.columnNativeType)(connection, 'user_sessions', 'Data');
+        // already `json` (fresh install / already converged), unreadable, or a type
+        // nobody anticipated - all three mean "leave it alone"
+        if (dataType === null || !(0, migration_support_js_1.isTextFamily)(dataType)) {
+            return;
+        }
+        if (!(0, migration_support_js_1.isMySqlDialect)(connection)) {
+            return;
+        }
+        await connection.schema().raw('DELETE FROM user_sessions');
+        // Identifiers are backtick-quoted: this statement is MySQL-only by
+        // construction (guard 3), so portability of the quoting style is not a
+        // constraint, and quoting removes any question about `Data` being a MySQL
+        // keyword. `NOT NULL` is restated because MODIFY replaces the WHOLE column
+        // definition - omitting it would silently make the column nullable.
+        await connection.schema().raw('ALTER TABLE `user_sessions` MODIFY `Data` JSON NOT NULL');
+    }
+    /**
+     * Restores the text column. The sessions `up()` deleted are gone for good -
+     * that part is not reversible and nothing pretends otherwise - but the SHAPE
+     * is, and a package rollback that leaves a `json` column behind for a
+     * `2.0.488` reader is its own outage.
+     *
+     * Guarded by the inverse probe: only a column that is currently `json` is
+     * touched, so running `down()` twice, or against a database this migration
+     * never converted, does nothing.
+     *
+     * `TEXT` because `TEXT` is what the deployed databases had. Note this is a
+     * NARROWING cast - a stored payload above TEXT's 64 KiB limit would fail the
+     * statement in strict mode. That is acceptable here in a way it would not be
+     * in `up()`: `down()` runs only on an explicit, interactive rollback, never at
+     * boot, so a failure is loud and immediate rather than an unbootable service.
+     */
+    async down(connection) {
+        if (!(await connection.schema().tableExists('user_sessions'))) {
+            return;
+        }
+        const dataType = await (0, migration_support_js_1.columnNativeType)(connection, 'user_sessions', 'Data');
+        if (dataType !== 'json' || !(0, migration_support_js_1.isMySqlDialect)(connection)) {
+            return;
+        }
+        await connection.schema().raw('ALTER TABLE `user_sessions` MODIFY `Data` TEXT NOT NULL');
+    }
+};
+exports.UserSessionDataJson_2026_07_31_00_00_00 = UserSessionDataJson_2026_07_31_00_00_00;
+exports.UserSessionDataJson_2026_07_31_00_00_00 = UserSessionDataJson_2026_07_31_00_00_00 = __decorate([
+    (0, orm_1.Migration)('session-provider-connection')
+], UserSessionDataJson_2026_07_31_00_00_00);
+//# sourceMappingURL=UserSessionDataJson_2026_07_31_00_00_00.js.map

package/lib/cjs/migrations/UserSessionDataJson_2026_07_31_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserSessionDataJson_2026_07_31_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/UserSessionDataJson_2026_07_31_00_00_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sCAAkE;AAClE,kEAAyF;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEI,IAAM,uCAAuC,GAA7C,MAAM,uCAAwC,SAAQ,kBAAY;IAChE,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,uCAAgB,EAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAE7E,4EAA4E;QAC5E,uDAAuD;QACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAA,mCAAY,EAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAA,qCAAc,EAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAE3D,mEAAmE;QACnE,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,uCAAgB,EAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAE7E,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,IAAA,qCAAc,EAAC,UAAU,CAAC,EAAE,CAAC;YACvD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IAC3F,CAAC;CACF,CAAA;AAzDY,0FAAuC;kDAAvC,uCAAuC;IADnD,IAAA,eAAS,EAAC,6BAA6B,CAAC;GAC5B,uCAAuC,CAyDnD"}

package/lib/cjs/migrations/UserSessionTimestamps_2026_07_31_00_00_01.d.ts

@@ -0,0 +1,68 @@
+import { OrmMigration, OrmDriver } from '@spinajs/orm';
+/**
+ * Widens `user_sessions.CreatedAt` / `Expiration` from `date` to `datetime`.
+ *
+ * !! This is a correctness fix in its own right and has nothing to do with the
+ * JSON conversion it used to be bundled with. It is a separate migration
+ * precisely so it can be applied, skipped, reviewed and reverted on its own.
+ *
+ * The bug
+ * -------
+ * A MySQL `date` column stores only the calendar day - MySQL truncates the time
+ * component on write, silently:
+ *
+ *     INSERT INTO probe VALUES ('2026-07-31 23:45:12', '2026-07-31 23:45:12');
+ *     asDate       asDateTime
+ *     2026-07-31   2026-07-31 23:45:12
+ *
+ * So on a deployed database a session's `Expiration` has no time of day: a
+ * session created at 23:45 with a 60-minute sliding TTL, due to expire at
+ * 00:45:12, is stored as expiring at 00:00:00 and the cleanup sweep kills it
+ * ~45 minutes early. Sliding expiration, `SessionProvider.isExpired`,
+ * `cleanupExpired` and `touch` all operate on that truncated value. `DbSession`
+ * declares both fields as luxon `DateTime` and the create path has declared both
+ * as `dateTime` since 2024; `datetime` is the type the code has always assumed
+ * it had.
+ *
+ * Why this one is safe where the JSON one was not
+ * -----------------------------------------------
+ * `date -> datetime` is a WIDENING cast. Every existing value is representable
+ * in the target type (midnight of the stored day), so unlike the `text -> json`
+ * conversion it cannot fail on row content and needs no wipe. Nothing is
+ * deleted here.
+ *
+ * Guards mirror the JSON migration: skip when the table is absent, skip unless
+ * `CreatedAt` is currently exactly `date`, skip on any non-MySQL dialect
+ * (`MODIFY` is MySQL syntax; a failed migration at boot bricks every later
+ * migration on the connection through `assertNoFailed()`). `CreatedAt` alone is
+ * probed - the two columns were created by the same statement in every database
+ * that has the old shape, and a `date`/`datetime` split between them has never
+ * existed.
+ *
+ * ONE statement with two `MODIFY` clauses, via the raw escape hatch, rather than
+ * `alterTable()`: the builder compiles one statement per column and
+ * `SqlDriver.execute` runs them through `Promise.all`, i.e. two concurrent
+ * `ALTER TABLE`s on the same table from two pooled connections.
+ *
+ * Nullability is restated verbatim from the create path - `MODIFY` replaces the
+ * whole column definition, and `CreatedAt` is `notNull()` there while
+ * `Expiration` is nullable (a never-expiring session persists a NULL).
+ */
+export declare class UserSessionTimestamps_2026_07_31_00_00_01 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    /**
+     * Deliberately a no-op, and this is a decision rather than an omission.
+     *
+     * `up()` widened `date -> datetime`. Reversing it would be a NARROWING cast
+     * that silently truncates the time-of-day off every stored row - it destroys
+     * data, and it re-introduces the exact expiry bug this migration exists to
+     * fix, on a schema whose model and create path have declared `dateTime` for
+     * years. A `datetime` column is also perfectly readable by every version of
+     * this package, so a rollback has nothing to gain from shrinking it.
+     *
+     * (The JSON migration's `down()` is implemented, because there the old readers
+     * genuinely cannot cope with the new column type. That is not the case here.)
+     */
+    down(_connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=UserSessionTimestamps_2026_07_31_00_00_01.d.ts.map

package/lib/cjs/migrations/UserSessionTimestamps_2026_07_31_00_00_01.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserSessionTimestamps_2026_07_31_00_00_01.d.ts","sourceRoot":"","sources":["../../../src/migrations/UserSessionTimestamps_2026_07_31_00_00_01.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBACa,yCAA0C,SAAQ,YAAY;IAC5D,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD;;;;;;;;;;;;OAYG;IAEU,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CACzD"}