[
  {
    "type": "create_table",
    "description": "Create authAuditLog table for authentication event audit trail",
    "database": "kiosk_users",
    "check_query": "SHOW TABLES LIKE 'authAuditLog'",
    "sql": "CREATE TABLE `authAuditLog` (\n  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,\n  `userId` int(10) unsigned DEFAULT NULL COMMENT 'FK to users.id, NULL for anonymous events',\n  `eventType` enum('login_success','login_failed','logout','password_change','password_reset_request','password_reset_complete','mfa_enabled','mfa_disabled','mfa_success','mfa_failed','token_issued','token_refreshed','token_revoked','account_locked','account_unlocked','api_key_created','api_key_revoked','remember_me_issued','remember_me_used','remember_me_revoked','password_hash_upgraded') NOT NULL,\n  `ipAddress` varchar(45) DEFAULT NULL,\n  `userAgent` text DEFAULT NULL,\n  `details` json DEFAULT NULL COMMENT 'Additional event context',\n  `createdAt` timestamp NOT NULL DEFAULT current_timestamp(),\n  PRIMARY KEY (`id`),\n  KEY `idx_userId` (`userId`),\n  KEY `idx_eventType` (`eventType`),\n  KEY `idx_createdAt` (`createdAt`),\n  KEY `idx_userId_eventType` (`userId`, `eventType`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='Authentication audit log - 90 day retention'"
  }
]