@alinsafawi/aegis-auth 0.2.2 → 0.2.4

package/dist/index.js

@@ -2126,20 +2126,20 @@ var require_range = __commonJS({
     };
     var replaceTilde = (comp, options) => {
       const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE];
-      return comp.replace(r, (_, M, m, p10, pr) => {
-        debug("tilde", comp, _, M, m, p10, pr);
+      return comp.replace(r, (_, M, m, p9, pr) => {
+        debug("tilde", comp, _, M, m, p9, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
           ret = `>=${M}.0.0 <${+M + 1}.0.0-0`;
-        } else if (isX(p10)) {
+        } else if (isX(p9)) {
           ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`;
         } else if (pr) {
           debug("replaceTilde pr", pr);
-          ret = `>=${M}.${m}.${p10}-${pr} <${M}.${+m + 1}.0-0`;
+          ret = `>=${M}.${m}.${p9}-${pr} <${M}.${+m + 1}.0-0`;
         } else {
-          ret = `>=${M}.${m}.${p10} <${M}.${+m + 1}.0-0`;
+          ret = `>=${M}.${m}.${p9} <${M}.${+m + 1}.0-0`;
         }
         debug("tilde return", ret);
         return ret;
@@ -2152,14 +2152,14 @@ var require_range = __commonJS({
       debug("caret", comp, options);
       const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET];
       const z3 = options.includePrerelease ? "-0" : "";
-      return comp.replace(r, (_, M, m, p10, pr) => {
-        debug("caret", comp, _, M, m, p10, pr);
+      return comp.replace(r, (_, M, m, p9, pr) => {
+        debug("caret", comp, _, M, m, p9, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
           ret = `>=${M}.0.0${z3} <${+M + 1}.0.0-0`;
-        } else if (isX(p10)) {
+        } else if (isX(p9)) {
           if (M === "0") {
             ret = `>=${M}.${m}.0${z3} <${M}.${+m + 1}.0-0`;
           } else {
@@ -2169,23 +2169,23 @@ var require_range = __commonJS({
           debug("replaceCaret pr", pr);
           if (M === "0") {
             if (m === "0") {
-              ret = `>=${M}.${m}.${p10}-${pr} <${M}.${m}.${+p10 + 1}-0`;
+              ret = `>=${M}.${m}.${p9}-${pr} <${M}.${m}.${+p9 + 1}-0`;
             } else {
-              ret = `>=${M}.${m}.${p10}-${pr} <${M}.${+m + 1}.0-0`;
+              ret = `>=${M}.${m}.${p9}-${pr} <${M}.${+m + 1}.0-0`;
             }
           } else {
-            ret = `>=${M}.${m}.${p10}-${pr} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m}.${p9}-${pr} <${+M + 1}.0.0-0`;
           }
         } else {
           debug("no pr");
           if (M === "0") {
             if (m === "0") {
-              ret = `>=${M}.${m}.${p10}${z3} <${M}.${m}.${+p10 + 1}-0`;
+              ret = `>=${M}.${m}.${p9}${z3} <${M}.${m}.${+p9 + 1}-0`;
             } else {
-              ret = `>=${M}.${m}.${p10}${z3} <${M}.${+m + 1}.0-0`;
+              ret = `>=${M}.${m}.${p9}${z3} <${M}.${+m + 1}.0-0`;
             }
           } else {
-            ret = `>=${M}.${m}.${p10} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m}.${p9} <${+M + 1}.0.0-0`;
           }
         }
         debug("caret return", ret);
@@ -2199,11 +2199,11 @@ var require_range = __commonJS({
     var replaceXRange = (comp, options) => {
       comp = comp.trim();
       const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
-      return comp.replace(r, (ret, gtlt, M, m, p10, pr) => {
-        debug("xRange", comp, ret, gtlt, M, m, p10, pr);
+      return comp.replace(r, (ret, gtlt, M, m, p9, pr) => {
+        debug("xRange", comp, ret, gtlt, M, m, p9, pr);
         const xM = isX(M);
         const xm = xM || isX(m);
-        const xp = xm || isX(p10);
+        const xp = xm || isX(p9);
         const anyX = xp;
         if (gtlt === "=" && anyX) {
           gtlt = "";
@@ -2219,16 +2219,16 @@ var require_range = __commonJS({
           if (xm) {
             m = 0;
           }
-          p10 = 0;
+          p9 = 0;
           if (gtlt === ">") {
             gtlt = ">=";
             if (xm) {
               M = +M + 1;
               m = 0;
-              p10 = 0;
+              p9 = 0;
             } else {
               m = +m + 1;
-              p10 = 0;
+              p9 = 0;
             }
           } else if (gtlt === "<=") {
             gtlt = "<";
@@ -2241,7 +2241,7 @@ var require_range = __commonJS({
           if (gtlt === "<") {
             pr = "-0";
           }
-          ret = `${gtlt + M}.${m}.${p10}${pr}`;
+          ret = `${gtlt + M}.${m}.${p9}${pr}`;
         } else if (xm) {
           ret = `>=${M}.0.0${pr} <${+M + 1}.0.0-0`;
         } else if (xp) {
@@ -6919,14 +6919,14 @@ var require_mask_pattern = __commonJS({
       const numPatterns = Object.keys(exports2.Patterns).length;
       let bestPattern = 0;
       let lowerPenalty = Infinity;
-      for (let p10 = 0; p10 < numPatterns; p10++) {
-        setupFormatFunc(p10);
-        exports2.applyMask(p10, data);
+      for (let p9 = 0; p9 < numPatterns; p9++) {
+        setupFormatFunc(p9);
+        exports2.applyMask(p9, data);
         const penalty = exports2.getPenaltyN1(data) + exports2.getPenaltyN2(data) + exports2.getPenaltyN3(data) + exports2.getPenaltyN4(data);
-        exports2.applyMask(p10, data);
+        exports2.applyMask(p9, data);
         if (penalty < lowerPenalty) {
           lowerPenalty = penalty;
-          bestPattern = p10;
+          bestPattern = p9;
         }
       }
       return bestPattern;
@@ -10909,7 +10909,7 @@ var require_browser = __commonJS({
     var QRCode2 = require_qrcode();
     var CanvasRenderer = require_canvas();
     var SvgRenderer = require_svg_tag();
-    function renderCanvas(renderFunc, canvas, text8, opts, cb) {
+    function renderCanvas(renderFunc, canvas, text7, opts, cb) {
       const args2 = [].slice.call(arguments, 1);
       const argsNum = args2.length;
       const isLastArgCb = typeof args2[argsNum - 1] === "function";
@@ -10921,8 +10921,8 @@ var require_browser = __commonJS({
           throw new Error("Too few arguments provided");
         }
         if (argsNum === 2) {
-          cb = text8;
-          text8 = canvas;
+          cb = text7;
+          text7 = canvas;
           canvas = opts = void 0;
         } else if (argsNum === 3) {
           if (canvas.getContext && typeof cb === "undefined") {
@@ -10930,8 +10930,8 @@ var require_browser = __commonJS({
             opts = void 0;
           } else {
             cb = opts;
-            opts = text8;
-            text8 = canvas;
+            opts = text7;
+            text7 = canvas;
             canvas = void 0;
           }
         }
@@ -10940,16 +10940,16 @@ var require_browser = __commonJS({
           throw new Error("Too few arguments provided");
         }
         if (argsNum === 1) {
-          text8 = canvas;
+          text7 = canvas;
           canvas = opts = void 0;
         } else if (argsNum === 2 && !canvas.getContext) {
-          opts = text8;
-          text8 = canvas;
+          opts = text7;
+          text7 = canvas;
           canvas = void 0;
         }
         return new Promise(function(resolve, reject) {
           try {
-            const data = QRCode2.create(text8, opts);
+            const data = QRCode2.create(text7, opts);
             resolve(renderFunc(data, canvas, opts));
           } catch (e) {
             reject(e);
@@ -10957,7 +10957,7 @@ var require_browser = __commonJS({
         });
       }
       try {
-        const data = QRCode2.create(text8, opts);
+        const data = QRCode2.create(text7, opts);
         cb(null, renderFunc(data, canvas, opts));
       } catch (e) {
         cb(e);
@@ -10982,8 +10982,8 @@ var require_server = __commonJS({
     var Utf8Renderer = require_utf8();
     var TerminalRenderer = require_terminal2();
     var SvgRenderer = require_svg();
-    function checkParams(text8, opts, cb) {
-      if (typeof text8 === "undefined") {
+    function checkParams(text7, opts, cb) {
+      if (typeof text7 === "undefined") {
         throw new Error("String required as first argument");
       }
       if (typeof cb === "undefined") {
@@ -11030,11 +11030,11 @@ var require_server = __commonJS({
           return Utf8Renderer;
       }
     }
-    function render(renderFunc, text8, params) {
+    function render(renderFunc, text7, params) {
       if (!params.cb) {
         return new Promise(function(resolve, reject) {
           try {
-            const data = QRCode2.create(text8, params.opts);
+            const data = QRCode2.create(text7, params.opts);
             return renderFunc(data, params.opts, function(err, data2) {
               return err ? reject(err) : resolve(data2);
             });
@@ -11044,7 +11044,7 @@ var require_server = __commonJS({
         });
       }
       try {
-        const data = QRCode2.create(text8, params.opts);
+        const data = QRCode2.create(text7, params.opts);
         return renderFunc(data, params.opts, params.cb);
       } catch (e) {
         params.cb(e);
@@ -11052,43 +11052,43 @@ var require_server = __commonJS({
     }
     exports2.create = QRCode2.create;
     exports2.toCanvas = require_browser().toCanvas;
-    exports2.toString = function toString(text8, opts, cb) {
-      const params = checkParams(text8, opts, cb);
+    exports2.toString = function toString(text7, opts, cb) {
+      const params = checkParams(text7, opts, cb);
       const type = params.opts ? params.opts.type : void 0;
       const renderer = getStringRendererFromType(type);
-      return render(renderer.render, text8, params);
+      return render(renderer.render, text7, params);
     };
-    exports2.toDataURL = function toDataURL(text8, opts, cb) {
-      const params = checkParams(text8, opts, cb);
+    exports2.toDataURL = function toDataURL(text7, opts, cb) {
+      const params = checkParams(text7, opts, cb);
       const renderer = getRendererFromType(params.opts.type);
-      return render(renderer.renderToDataURL, text8, params);
+      return render(renderer.renderToDataURL, text7, params);
     };
-    exports2.toBuffer = function toBuffer(text8, opts, cb) {
-      const params = checkParams(text8, opts, cb);
+    exports2.toBuffer = function toBuffer(text7, opts, cb) {
+      const params = checkParams(text7, opts, cb);
       const renderer = getRendererFromType(params.opts.type);
-      return render(renderer.renderToBuffer, text8, params);
+      return render(renderer.renderToBuffer, text7, params);
     };
-    exports2.toFile = function toFile(path6, text8, opts, cb) {
-      if (typeof path6 !== "string" || !(typeof text8 === "string" || typeof text8 === "object")) {
+    exports2.toFile = function toFile(path6, text7, opts, cb) {
+      if (typeof path6 !== "string" || !(typeof text7 === "string" || typeof text7 === "object")) {
         throw new Error("Invalid argument");
       }
       if (arguments.length < 3 && !canPromise()) {
         throw new Error("Too few arguments provided");
       }
-      const params = checkParams(text8, opts, cb);
+      const params = checkParams(text7, opts, cb);
       const type = params.opts.type || getTypeFromFilename(path6);
       const renderer = getRendererFromType(type);
       const renderToFile = renderer.renderToFile.bind(null, path6);
-      return render(renderToFile, text8, params);
+      return render(renderToFile, text7, params);
     };
-    exports2.toFileStream = function toFileStream(stream, text8, opts) {
+    exports2.toFileStream = function toFileStream(stream, text7, opts) {
       if (arguments.length < 2) {
         throw new Error("Too few arguments provided");
       }
-      const params = checkParams(text8, opts, stream.emit.bind(stream, "error"));
+      const params = checkParams(text7, opts, stream.emit.bind(stream, "error"));
       const renderer = getRendererFromType("png");
       const renderToFileStream = renderer.renderToFileStream.bind(null, stream);
-      render(renderToFileStream, text8, params);
+      render(renderToFileStream, text7, params);
     };
   }
 });
@@ -16697,16 +16697,16 @@ var require_mail_composer = __commonJS({
        * @returns {Array} An array of alternative elements. Includes the `text` and `html` values as well
        */
       getAlternatives() {
-        let alternatives = [], text8, html, watchHtml, amp, icalEvent, eventObject;
+        let alternatives = [], text7, html, watchHtml, amp, icalEvent, eventObject;
         if (this.mail.text) {
           if (typeof this.mail.text === "object" && (this.mail.text.content || this.mail.text.path || this.mail.text.href || this.mail.text.raw)) {
-            text8 = this.mail.text;
+            text7 = this.mail.text;
           } else {
-            text8 = {
+            text7 = {
               content: this.mail.text
             };
           }
-          text8.contentType = "text/plain; charset=utf-8";
+          text7.contentType = "text/plain; charset=utf-8";
         }
         if (this.mail.watchHtml) {
           if (typeof this.mail.watchHtml === "object" && (this.mail.watchHtml.content || this.mail.watchHtml.path || this.mail.watchHtml.href || this.mail.watchHtml.raw)) {
@@ -16759,7 +16759,7 @@ var require_mail_composer = __commonJS({
           }
           html.contentType = "text/html; charset=utf-8";
         }
-        [].concat(text8 || []).concat(watchHtml || []).concat(amp || []).concat(html || []).concat(eventObject || []).concat(this.mail.alternatives || []).forEach((alternative) => {
+        [].concat(text7 || []).concat(watchHtml || []).concat(amp || []).concat(html || []).concat(eventObject || []).concat(this.mail.alternatives || []).forEach((alternative) => {
           let data;
           if (/^data:/i.test(alternative.path || alternative.href)) {
             alternative = this._processDataUrl(alternative);
@@ -22296,8 +22296,8 @@ var require_nodemailer = __commonJS({
 });
 
 // src/commands/init.ts
-var p7 = __toESM(require("@clack/prompts"));
-var import_chalk8 = __toESM(require("chalk"));
+var p6 = __toESM(require("@clack/prompts"));
+var import_chalk7 = __toESM(require("chalk"));
 var import_fs_extra = __toESM(require("fs-extra"));
 var import_path = __toESM(require("path"));
 var import_execa = require("execa");
@@ -22933,41 +22933,6 @@ async function promptInfrastructure() {
   };
 }
 
-// src/prompts/style.ts
-var p6 = __toESM(require("@clack/prompts"));
-var import_chalk7 = __toESM(require("chalk"));
-async function promptStyle() {
-  console.log(
-    `
-  ${import_chalk7.default.dim("Used on buttons, links, and focus rings in all scaffolded pages.")}
-  ${import_chalk7.default.dim("This becomes a CSS variable \u2014 change it any time in globals.css.")}
-`
-  );
-  const primaryColor = await p6.text({
-    message: "Primary color",
-    initialValue: "oklch(0.6 0.2 240)",
-    validate: (v) => !v ? "Required" : void 0
-  });
-  if (p6.isCancel(primaryColor)) process.exit(0);
-  console.log(
-    `
-  ${import_chalk7.default.dim("Accepts any CSS color:")}
-  ${import_chalk7.default.dim("  #3b82f6              (hex)")}
-  ${import_chalk7.default.dim("  hsl(220 90% 56%)     (HSL)")}
-  ${import_chalk7.default.dim("  oklch(0.6 0.2 240)   (recommended \u2014 perceptually uniform)")}
-`
-  );
-  const logoUrl = await p6.text({
-    message: "Logo path  (optional \u2014 leave blank to skip)",
-    placeholder: "/logo.svg"
-  });
-  if (p6.isCancel(logoUrl)) process.exit(0);
-  return {
-    primaryColor,
-    logoUrl: logoUrl || void 0
-  };
-}
-
 // ../core/dist/index.js
 var import_zod = require("zod");
 var import_jsonwebtoken = __toESM(require_jsonwebtoken(), 1);
@@ -23342,8 +23307,8 @@ function serializePermissions(role) {
   if (mode === "none") return `'none'`;
   if (mode === "dynamic") return `'dynamic'`;
   const perms = typeof role.permissions === "object" ? role.permissions : {};
-  const lines = Object.entries(perms).map(([key, p10]) => {
-    const def = p10;
+  const lines = Object.entries(perms).map(([key, p9]) => {
+    const def = p9;
     return [
       `      ${key}: {`,
       `        label: '${def.label}',`,
@@ -23782,8 +23747,406 @@ function generatePackageJson(name, packageManager) {
     2
   );
 }
+function generatePrismaLib() {
+  return `import { PrismaClient } from '@prisma/client'
+
+const globalForPrisma = globalThis as unknown as { prisma: PrismaClient }
+
+export const prisma = globalForPrisma.prisma ?? new PrismaClient()
+
+if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma
+`;
+}
+function generateLoginRoute() {
+  return `import { createLoginHandler } from '@alinsafawi/aegis-auth-next'
+import { prisma } from '@/lib/prisma'
+import config from '../../../../../auth.config'
+
+export const POST = createLoginHandler(config, prisma)
+`;
+}
+function generateLogoutRoute() {
+  return `import { createLogoutHandler } from '@alinsafawi/aegis-auth-next'
+import config from '../../../../../auth.config'
+
+export const POST = createLogoutHandler(config)
+`;
+}
+function generateTwoFactorRoute() {
+  return `import { createTwoFactorHandler } from '@alinsafawi/aegis-auth-next'
+import { prisma } from '@/lib/prisma'
+import config from '../../../../../auth.config'
+
+export const POST = createTwoFactorHandler(config, prisma)
+`;
+}
+function generateChangePasswordRoute() {
+  return `import { createChangePasswordHandler } from '@alinsafawi/aegis-auth-next'
+import { prisma } from '@/lib/prisma'
+import config from '../../../../../auth.config'
+
+export const POST = createChangePasswordHandler(config, prisma)
+`;
+}
+function generateForgotPasswordPage(language) {
+  const ts = language === "typescript";
+  return `'use client'
+
+import { useState } from 'react'
+
+export default function ForgotPasswordPage() {
+  const [email, setEmail] = useState('')
+  const [sent, setSent] = useState(false)
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e${ts ? ": React.FormEvent" : ""}) {
+    e.preventDefault()
+    setLoading(true)
+    setError('')
+    const res = await fetch('/api/auth/forgot-password', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email }),
+    })
+    setLoading(false)
+    if (!res.ok) { setError((await res.json()).error ?? 'Something went wrong'); return }
+    setSent(true)
+  }
+
+  if (sent) {
+    return (
+      <main className="min-h-screen flex items-center justify-center p-4">
+        <div className="w-full max-w-sm text-center space-y-3">
+          <h1 className="text-2xl font-bold">Check your email</h1>
+          <p className="text-[var(--muted)] text-sm">
+            If an account exists for <strong>{email}</strong>, a reset link has been sent.
+          </p>
+          <a href="/login" className="block text-sm text-[var(--muted)] hover:underline mt-4">
+            Back to login
+          </a>
+        </div>
+      </main>
+    )
+  }
+
+  return (
+    <main className="min-h-screen flex items-center justify-center p-4">
+      <div className="w-full max-w-sm">
+        <div className="text-center mb-8">
+          <h1 className="text-2xl font-bold">Forgot password</h1>
+          <p className="text-[var(--muted)] text-sm mt-1">We'll send you a reset link.</p>
+        </div>
+        <form onSubmit={handleSubmit} className="space-y-4">
+          {error && <div className="text-sm text-red-500 bg-red-50 border border-red-200 rounded-md p-3">{error}</div>}
+          <div>
+            <label className="block text-sm font-medium mb-1">Email address</label>
+            <input
+              type="email"
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              required
+              autoComplete="email"
+              className="w-full px-3 py-2 rounded-md border bg-[var(--input)] focus:outline-none focus:ring-2 focus:ring-[var(--primary)]"
+            />
+          </div>
+          <button
+            type="submit"
+            disabled={loading}
+            style={{ background: 'var(--primary)', color: 'var(--primary-foreground)' }}
+            className="w-full py-2 px-4 rounded-md font-medium disabled:opacity-50 transition-opacity"
+          >
+            {loading ? 'Sending\u2026' : 'Send reset link'}
+          </button>
+          <div className="text-center">
+            <a href="/login" className="text-sm text-[var(--muted)] hover:underline">Back to login</a>
+          </div>
+        </form>
+      </div>
+    </main>
+  )
+}
+`;
+}
+function generateResetPasswordPage(language) {
+  const ts = language === "typescript";
+  return `'use client'
+
+import { useState } from 'react'
+import { useSearchParams, useRouter } from 'next/navigation'
+
+export default function ResetPasswordPage() {
+  const params = useSearchParams()
+  const router = useRouter()
+  const token = params.get('token') ?? ''
+  const [password, setPassword] = useState('')
+  const [confirm, setConfirm] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e${ts ? ": React.FormEvent" : ""}) {
+    e.preventDefault()
+    if (password !== confirm) { setError('Passwords do not match'); return }
+    setLoading(true)
+    setError('')
+    const res = await fetch('/api/auth/reset-password', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ token, newPassword: password }),
+    })
+    setLoading(false)
+    if (!res.ok) { setError((await res.json()).error ?? 'Something went wrong'); return }
+    router.push('/login?reset=1')
+  }
+
+  return (
+    <main className="min-h-screen flex items-center justify-center p-4">
+      <div className="w-full max-w-sm">
+        <div className="text-center mb-8">
+          <h1 className="text-2xl font-bold">Reset password</h1>
+        </div>
+        <form onSubmit={handleSubmit} className="space-y-4">
+          {error && <div className="text-sm text-red-500 bg-red-50 border border-red-200 rounded-md p-3">{error}</div>}
+          <div>
+            <label className="block text-sm font-medium mb-1">New password</label>
+            <input
+              type="password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              required
+              autoComplete="new-password"
+              className="w-full px-3 py-2 rounded-md border bg-[var(--input)] focus:outline-none focus:ring-2 focus:ring-[var(--primary)]"
+            />
+          </div>
+          <div>
+            <label className="block text-sm font-medium mb-1">Confirm new password</label>
+            <input
+              type="password"
+              value={confirm}
+              onChange={(e) => setConfirm(e.target.value)}
+              required
+              autoComplete="new-password"
+              className="w-full px-3 py-2 rounded-md border bg-[var(--input)] focus:outline-none focus:ring-2 focus:ring-[var(--primary)]"
+            />
+          </div>
+          <button
+            type="submit"
+            disabled={loading}
+            style={{ background: 'var(--primary)', color: 'var(--primary-foreground)' }}
+            className="w-full py-2 px-4 rounded-md font-medium disabled:opacity-50 transition-opacity"
+          >
+            {loading ? 'Resetting\u2026' : 'Reset password'}
+          </button>
+        </form>
+      </div>
+    </main>
+  )
+}
+`;
+}
+function generateTwoFactorPage(language) {
+  const ts = language === "typescript";
+  return `'use client'
+
+import { useState } from 'react'
+import { useRouter } from 'next/navigation'
+
+export default function TwoFactorPage() {
+  const [code, setCode] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const router = useRouter()
+
+  async function handleSubmit(e${ts ? ": React.FormEvent" : ""}) {
+    e.preventDefault()
+    setLoading(true)
+    setError('')
+    const res = await fetch('/api/auth/two-factor', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ code }),
+    })
+    const data = await res.json()
+    setLoading(false)
+    if (!res.ok) { setError(data.error ?? 'Invalid code'); return }
+    router.push(\`/\${data.role}/dashboard\`)
+  }
+
+  return (
+    <main className="min-h-screen flex items-center justify-center p-4">
+      <div className="w-full max-w-sm">
+        <div className="text-center mb-8">
+          <h1 className="text-2xl font-bold">Two-factor authentication</h1>
+          <p className="text-[var(--muted)] text-sm mt-1">Enter the 6-digit code from your authenticator app.</p>
+        </div>
+        <form onSubmit={handleSubmit} className="space-y-4">
+          {error && <div className="text-sm text-red-500 bg-red-50 border border-red-200 rounded-md p-3">{error}</div>}
+          <div>
+            <label className="block text-sm font-medium mb-1">Authentication code</label>
+            <input
+              type="text"
+              inputMode="numeric"
+              pattern="[0-9]*"
+              maxLength={6}
+              value={code}
+              onChange={(e) => setCode(e.target.value.replace(/D/g, ''))}
+              required
+              autoComplete="one-time-code"
+              placeholder="000000"
+              className="w-full px-3 py-2 rounded-md border bg-[var(--input)] focus:outline-none focus:ring-2 focus:ring-[var(--primary)] text-center tracking-widest text-lg"
+            />
+          </div>
+          <button
+            type="submit"
+            disabled={loading || code.length !== 6}
+            style={{ background: 'var(--primary)', color: 'var(--primary-foreground)' }}
+            className="w-full py-2 px-4 rounded-md font-medium disabled:opacity-50 transition-opacity"
+          >
+            {loading ? 'Verifying\u2026' : 'Verify'}
+          </button>
+          <div className="text-center">
+            <a href="/login" className="text-sm text-[var(--muted)] hover:underline">Back to login</a>
+          </div>
+        </form>
+      </div>
+    </main>
+  )
+}
+`;
+}
+function generateVerifyEmailNoticePage() {
+  return `export default function VerifyEmailNoticePage() {
+  return (
+    <main className="min-h-screen flex items-center justify-center p-4">
+      <div className="w-full max-w-sm text-center space-y-3">
+        <h1 className="text-2xl font-bold">Verify your email</h1>
+        <p className="text-[var(--muted)] text-sm">
+          We sent a verification code to your email address. Enter it below to activate your account.
+        </p>
+        <a href="/verify-email" className="block mt-4 text-sm underline" style={{ color: 'var(--primary)' }}>
+          Enter verification code \u2192
+        </a>
+      </div>
+    </main>
+  )
+}
+`;
+}
+function generateVerifyEmailPage(language) {
+  const ts = language === "typescript";
+  return `'use client'
+
+import { useState } from 'react'
+import { useRouter } from 'next/navigation'
+
+export default function VerifyEmailPage() {
+  const [code, setCode] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const router = useRouter()
+
+  async function handleSubmit(e${ts ? ": React.FormEvent" : ""}) {
+    e.preventDefault()
+    setLoading(true)
+    setError('')
+    const res = await fetch('/api/auth/verify-email', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ code }),
+    })
+    const data = await res.json()
+    setLoading(false)
+    if (!res.ok) { setError(data.error ?? 'Invalid code'); return }
+    router.push(\`/\${data.role}/dashboard\`)
+  }
+
+  return (
+    <main className="min-h-screen flex items-center justify-center p-4">
+      <div className="w-full max-w-sm">
+        <div className="text-center mb-8">
+          <h1 className="text-2xl font-bold">Enter verification code</h1>
+          <p className="text-[var(--muted)] text-sm mt-1">Check your email for the 6-digit code.</p>
+        </div>
+        <form onSubmit={handleSubmit} className="space-y-4">
+          {error && <div className="text-sm text-red-500 bg-red-50 border border-red-200 rounded-md p-3">{error}</div>}
+          <div>
+            <label className="block text-sm font-medium mb-1">Verification code</label>
+            <input
+              type="text"
+              inputMode="numeric"
+              pattern="[0-9]*"
+              maxLength={6}
+              value={code}
+              onChange={(e) => setCode(e.target.value.replace(/D/g, ''))}
+              required
+              autoComplete="one-time-code"
+              placeholder="000000"
+              className="w-full px-3 py-2 rounded-md border bg-[var(--input)] focus:outline-none focus:ring-2 focus:ring-[var(--primary)] text-center tracking-widest text-lg"
+            />
+          </div>
+          <button
+            type="submit"
+            disabled={loading || code.length !== 6}
+            style={{ background: 'var(--primary)', color: 'var(--primary-foreground)' }}
+            className="w-full py-2 px-4 rounded-md font-medium disabled:opacity-50 transition-opacity"
+          >
+            {loading ? 'Verifying\u2026' : 'Verify email'}
+          </button>
+          <div className="text-center">
+            <a href="/login" className="text-sm text-[var(--muted)] hover:underline">Back to login</a>
+          </div>
+        </form>
+      </div>
+    </main>
+  )
+}
+`;
+}
+function generateForgotPasswordRoute(language) {
+  const ts = language === "typescript";
+  return `import { NextRequest, NextResponse } from 'next/server'
+import { prisma } from '@/lib/prisma'
+import config from '../../../../../auth.config'
+
+export async function POST(request${ts ? ": NextRequest" : ""}) {
+  // TODO: implement \u2014 find user by email, generate reset token, send email
+  // You can use: import { sendEmail } from '@alinsafawi/aegis-auth-core'
+  const { email } = await request.json()
+  return NextResponse.json({ success: true })
+}
+`;
+}
+function generateResetPasswordRoute(language) {
+  const ts = language === "typescript";
+  return `import { NextRequest, NextResponse } from 'next/server'
+import { prisma } from '@/lib/prisma'
+import { hashPassword } from '@alinsafawi/aegis-auth-core'
+import config from '../../../../../auth.config'
+
+export async function POST(request${ts ? ": NextRequest" : ""}) {
+  // TODO: implement \u2014 verify token, update password hash
+  const { token, newPassword } = await request.json()
+  return NextResponse.json({ success: true })
+}
+`;
+}
+function generateVerifyEmailRoute(language) {
+  const ts = language === "typescript";
+  return `import { NextRequest, NextResponse } from 'next/server'
+import { prisma } from '@/lib/prisma'
+import config from '../../../../../auth.config'
+
+export async function POST(request${ts ? ": NextRequest" : ""}) {
+  // TODO: implement \u2014 verify code, mark emailVerified = true, return role
+  const { code } = await request.json()
+  return NextResponse.json({ success: true, role: 'user' })
+}
+`;
+}
 
 // src/commands/init.ts
+var DEFAULT_COLOR = "oklch(0.6 0.2 240)";
+var DEFAULT_STYLE = { primaryColor: DEFAULT_COLOR, logoUrl: void 0 };
 function detectPackageManager() {
   if (process.env.npm_config_user_agent?.includes("pnpm")) return "pnpm";
   if (process.env.npm_config_user_agent?.includes("yarn")) return "yarn";
@@ -23793,10 +24156,10 @@ function detectPackageManager() {
 function isExistingNextProject(dir) {
   return import_fs_extra.default.existsSync(import_path.default.join(dir, "next.config.ts")) || import_fs_extra.default.existsSync(import_path.default.join(dir, "next.config.js")) || import_fs_extra.default.existsSync(import_path.default.join(dir, "next.config.mjs"));
 }
-var STEPS = ["PROJECT", "APP", "ROLES", "FEATURES", "INFRA", "STYLE"];
+var STEPS = ["PROJECT", "APP", "ROLES", "FEATURES", "INFRA"];
 async function runInit() {
   printBanner();
-  const mode = await p7.select({
+  const mode = await p6.select({
     message: "What would you like to do?",
     options: [
       {
@@ -23811,8 +24174,8 @@ async function runInit() {
       }
     ]
   });
-  if (p7.isCancel(mode)) {
-    p7.cancel("Cancelled.");
+  if (p6.isCancel(mode)) {
+    p6.cancel("Cancelled.");
     process.exit(0);
   }
   let targetDir = process.cwd();
@@ -23829,12 +24192,12 @@ async function runInit() {
     database = project.database;
     targetDir = import_path.default.join(process.cwd(), project.name);
     if (import_fs_extra.default.existsSync(targetDir)) {
-      const overwrite = await p7.confirm({
+      const overwrite = await p6.confirm({
         message: `Folder '${project.name}' already exists. Continue anyway?`,
         initialValue: false
       });
-      if (p7.isCancel(overwrite) || !overwrite) {
-        p7.cancel("Cancelled.");
+      if (p6.isCancel(overwrite) || !overwrite) {
+        p6.cancel("Cancelled.");
         process.exit(0);
       }
     }
@@ -23850,17 +24213,17 @@ async function runInit() {
     printStatusList(checks);
     language = import_fs_extra.default.existsSync(import_path.default.join(targetDir, "tsconfig.json")) ? "typescript" : "javascript";
     if (checks.find((c4) => c4.label === "Next.js")?.status === "error") {
-      p7.cancel(`No Next.js project found in ${targetDir}. Run from inside your project folder.`);
+      p6.cancel(`No Next.js project found in ${targetDir}. Run from inside your project folder.`);
       process.exit(1);
     }
     console.log(`
-  ${import_chalk8.default.dim("This wizard will:")}
+  ${import_chalk7.default.dim("This wizard will:")}
 `);
-    console.log(`  ${import_chalk8.default.dim("\xB7")}  Generate Prisma models for your roles`);
-    console.log(`  ${import_chalk8.default.dim("\xB7")}  Create API route handlers  ${import_chalk8.default.dim("src/app/api/auth/**")}`);
-    console.log(`  ${import_chalk8.default.dim("\xB7")}  Scaffold auth pages  ${import_chalk8.default.dim("(login, 2FA, reset password, etc.)")}`);
-    console.log(`  ${import_chalk8.default.dim("\xB7")}  Create auth.config.ts`);
-    console.log(`  ${import_chalk8.default.dim("\xB7")}  Update .env.example
+    console.log(`  ${import_chalk7.default.dim("\xB7")}  Generate Prisma models for your roles`);
+    console.log(`  ${import_chalk7.default.dim("\xB7")}  Create API route handlers  ${import_chalk7.default.dim("src/app/api/auth/**")}`);
+    console.log(`  ${import_chalk7.default.dim("\xB7")}  Scaffold auth pages  ${import_chalk7.default.dim("(login, 2FA, reset password, etc.)")}`);
+    console.log(`  ${import_chalk7.default.dim("\xB7")}  Create auth.config.ts`);
+    console.log(`  ${import_chalk7.default.dim("\xB7")}  Update .env.example
 `);
   }
   printSection(mode === "new" ? `STEP 2 of ${STEPS.length}  \u25B8  PROJECT \u2713  \u25B8  APP` : `STEP 1 of ${STEPS.length - 1}  \u25B8  APP`);
@@ -23871,31 +24234,29 @@ async function runInit() {
   let features = await promptFeatures(Object.keys(roles));
   printSection(mode === "new" ? `STEP 5 of ${STEPS.length}  \u25B8  ...  FEATURES \u2713  \u25B8  INFRA` : `STEP 4  \u25B8  FEATURES \u2713  \u25B8  INFRA`);
   let infra = await promptInfrastructure();
-  printSection(mode === "new" ? `STEP 6 of ${STEPS.length}  \u25B8  ...  INFRA \u2713  \u25B8  STYLE` : `STEP 5  \u25B8  INFRA \u2713  \u25B8  STYLE`);
-  let style = await promptStyle();
   let isDry = false;
   while (true) {
     printSection("REVIEW  \xB7  Everything that's about to happen");
-    console.log(`  ${import_chalk8.default.bold("Configuration")}
+    console.log(`  ${import_chalk7.default.bold("Configuration")}
 `);
-    console.log(`  App              ${import_chalk8.default.cyan(app.appName)}`);
-    console.log(`  Cookie prefix    ${import_chalk8.default.cyan(app.cookiePrefix)}`);
-    console.log(`  Session          ${import_chalk8.default.cyan(app.sessionDuration / 3600 + " hours")}`);
+    console.log(`  App              ${import_chalk7.default.cyan(app.appName)}`);
+    console.log(`  Cookie prefix    ${import_chalk7.default.cyan(app.cookiePrefix)}`);
+    console.log(`  Session          ${import_chalk7.default.cyan(app.sessionDuration / 3600 + " hours")}`);
     if (mode === "new") {
-      console.log(`  Language         ${import_chalk8.default.cyan(language)}`);
-      console.log(`  Package manager  ${import_chalk8.default.cyan(packageManager)}`);
-      console.log(`  Database         ${import_chalk8.default.cyan(database)}`);
+      console.log(`  Language         ${import_chalk7.default.cyan(language)}`);
+      console.log(`  Package manager  ${import_chalk7.default.cyan(packageManager)}`);
+      console.log(`  Database         ${import_chalk7.default.cyan(database)}`);
     }
     console.log();
-    console.log(`  ${import_chalk8.default.bold("Roles")}`);
+    console.log(`  ${import_chalk7.default.bold("Roles")}`);
     for (const [id, role] of Object.entries(roles)) {
-      console.log(`  ${import_chalk8.default.dim("\xB7")}  ${import_chalk8.default.magentaBright(id)}  ${import_chalk8.default.dim("\u2192")}  ${role.prismaModel}  ${import_chalk8.default.dim("(")}${role.loginField}${import_chalk8.default.dim(")")}`);
+      console.log(`  ${import_chalk7.default.dim("\xB7")}  ${import_chalk7.default.magentaBright(id)}  ${import_chalk7.default.dim("\u2192")}  ${role.prismaModel}  ${import_chalk7.default.dim("(")}${role.loginField}${import_chalk7.default.dim(")")}`);
     }
     console.log();
     const onFeatures = Object.entries(features).filter(([k, v]) => v === true && ["twoFactor", "emailVerification", "passwordReset", "accountLockout", "apiKeys", "auditLog", "sessionTracking"].includes(k)).map(([k]) => k);
-    console.log(`  ${import_chalk8.default.bold("Features")}  ${onFeatures.map((f) => import_chalk8.default.cyan(f)).join(import_chalk8.default.dim("  \xB7  "))}`);
+    console.log(`  ${import_chalk7.default.bold("Features")}  ${onFeatures.map((f) => import_chalk7.default.cyan(f)).join(import_chalk7.default.dim("  \xB7  "))}`);
     console.log();
-    const action = await p7.select({
+    const action = await p6.select({
       message: "Proceed?",
       options: [
         { value: "go", label: mode === "new" ? "Create project" : "Create files" },
@@ -23904,41 +24265,39 @@ async function runInit() {
         { value: "no", label: "Cancel" }
       ]
     });
-    if (p7.isCancel(action) || action === "no") {
-      p7.cancel("Cancelled.");
+    if (p6.isCancel(action) || action === "no") {
+      p6.cancel("Cancelled.");
       process.exit(0);
     }
     if (action === "edit") {
-      const section = await p7.select({
+      const section = await p6.select({
         message: "Which section would you like to change?",
         options: [
           { value: "app", label: "App identity  (name, cookie prefix, session duration)" },
           { value: "roles", label: "Roles" },
           { value: "features", label: "Features" },
-          { value: "infra", label: "Infrastructure  (SMTP, rate limiting)" },
-          { value: "style", label: "Style  (primary colour, logo)" }
+          { value: "infra", label: "Infrastructure  (SMTP, rate limiting)" }
         ]
       });
-      if (p7.isCancel(section)) {
-        p7.cancel("Cancelled.");
+      if (p6.isCancel(section)) {
+        p6.cancel("Cancelled.");
         process.exit(0);
       }
       if (section === "app") app = await promptApp(projectName);
       if (section === "roles") roles = await promptRoles();
       if (section === "features") features = await promptFeatures(Object.keys(roles));
       if (section === "infra") infra = await promptInfrastructure();
-      if (section === "style") style = await promptStyle();
       continue;
     }
     isDry = action === "dry";
     break;
   }
   printSection(mode === "new" ? `BUILDING  ${projectName}` : "INSTALLING");
-  const spin = p7.spinner();
+  const spin = p6.spinner();
   async function writeFile(relPath, content) {
     const full = import_path.default.join(targetDir, relPath);
     if (isDry) {
-      console.log(`  ${import_chalk8.default.dim("+")} ${import_chalk8.default.yellow(relPath)}`);
+      console.log(`  ${import_chalk7.default.dim("+")} ${import_chalk7.default.yellow(relPath)}`);
       return;
     }
     await import_fs_extra.default.ensureDir(import_path.default.dirname(full));
@@ -23947,7 +24306,7 @@ async function runInit() {
   async function step(label, fn) {
     spin.start(label);
     await fn();
-    spin.stop(`${import_chalk8.default.green("\u2713")}  ${label}`);
+    spin.stop(`${import_chalk7.default.green("\u2713")}  ${label}`);
   }
   if (mode === "new") {
     await step("Scaffolding Next.js project", async () => {
@@ -23963,9 +24322,9 @@ dist
 *.tsbuildinfo
 `);
       await writeFile(".env.local", "");
-      await writeFile("src/app/layout.tsx", generateRootLayout(app.appName, style.primaryColor, language));
-      await writeFile("src/app/globals.css", generateGlobalsCss(style.primaryColor));
-      await writeFile("src/app/page.tsx", generateRootPage(roles[Object.keys(roles)[0]] ? "/login" : "/login"));
+      await writeFile("src/app/layout.tsx", generateRootLayout(app.appName, DEFAULT_COLOR, language));
+      await writeFile("src/app/globals.css", generateGlobalsCss(DEFAULT_COLOR));
+      await writeFile("src/app/page.tsx", generateRootPage("/login"));
     });
   }
   await step("Generating Prisma schema", async () => {
@@ -23986,7 +24345,7 @@ dist
     await writeFile("prisma/schema.prisma", schema);
   });
   await step("Creating auth.config.ts", async () => {
-    const config = generateAuthConfig({ appName: app.appName, cookiePrefix: app.cookiePrefix, sessionDuration: app.sessionDuration, roles, features, infra, style, language });
+    const config = generateAuthConfig({ appName: app.appName, cookiePrefix: app.cookiePrefix, sessionDuration: app.sessionDuration, roles, features, infra, style: DEFAULT_STYLE, language });
     await writeFile(`auth.config.${language === "typescript" ? "ts" : "js"}`, config);
   });
   await step("Creating middleware", async () => {
@@ -23995,9 +24354,35 @@ dist
   await step("Creating session helpers", async () => {
     await writeFile(`src/lib/auth.${language === "typescript" ? "ts" : "js"}`, generateAuthLib(language));
   });
-  await step("Scaffolding auth pages", async () => {
+  await step("Scaffolding auth pages and API routes", async () => {
     const e = language === "typescript" ? "tsx" : "jsx";
-    await writeFile(`src/app/(auth)/login/page.${e}`, generateLoginPage(app.appName, style.primaryColor, language));
+    const r = language === "typescript" ? "ts" : "js";
+    await writeFile(`src/lib/prisma.${r}`, generatePrismaLib());
+    await writeFile(`src/app/api/auth/login/route.${r}`, generateLoginRoute());
+    await writeFile(`src/app/api/auth/logout/route.${r}`, generateLogoutRoute());
+    await writeFile(`src/app/api/auth/change-password/route.${r}`, generateChangePasswordRoute());
+    if (features.twoFactor) {
+      await writeFile(`src/app/api/auth/two-factor/route.${r}`, generateTwoFactorRoute());
+    }
+    if (features.passwordReset) {
+      await writeFile(`src/app/api/auth/forgot-password/route.${r}`, generateForgotPasswordRoute(language));
+      await writeFile(`src/app/api/auth/reset-password/route.${r}`, generateResetPasswordRoute(language));
+    }
+    if (features.emailVerification) {
+      await writeFile(`src/app/api/auth/verify-email/route.${r}`, generateVerifyEmailRoute(language));
+    }
+    await writeFile(`src/app/(auth)/login/page.${e}`, generateLoginPage(app.appName, DEFAULT_COLOR, language));
+    if (features.passwordReset) {
+      await writeFile(`src/app/(auth)/forgot-password/page.${e}`, generateForgotPasswordPage(language));
+      await writeFile(`src/app/(auth)/reset-password/page.${e}`, generateResetPasswordPage(language));
+    }
+    if (features.twoFactor) {
+      await writeFile(`src/app/(auth)/two-factor/page.${e}`, generateTwoFactorPage(language));
+    }
+    if (features.emailVerification) {
+      await writeFile(`src/app/(auth)/verify-email-notice/page.${e}`, generateVerifyEmailNoticePage());
+      await writeFile(`src/app/(auth)/verify-email/page.${e}`, generateVerifyEmailPage(language));
+    }
   });
   await step("Creating .env and .env.example", async () => {
     await writeFile(".env", generateEnvFile(app.cookiePrefix, infra, features));
@@ -24013,55 +24398,53 @@ dist
   printNextSteps([
     ...isNew ? [{
       n: 0,
-      title: `Enter your project  ${import_chalk8.default.dim("(run every command below from inside here)")}`,
-      lines: [`${import_chalk8.default.green(`cd ${projectName}`)}`]
+      title: `Enter your project  ${import_chalk7.default.dim("(run every command below from inside here)")}`,
+      lines: [`${import_chalk7.default.green(`cd ${projectName}`)}`]
     }] : [],
     {
       n: 1,
-      title: `Fill in ${import_chalk8.default.yellow(".env")}  ${import_chalk8.default.dim("(created for you \u2014 open it and add your values)")}`,
+      title: `Fill in ${import_chalk7.default.yellow(".env")}  ${import_chalk7.default.dim("(created for you \u2014 open it and add your values)")}`,
       lines: [
-        `${import_chalk8.default.cyan("DATABASE_URL=")}        ${import_chalk8.default.dim("\u2190 your Postgres connection string  (Neon, Supabase, local)")}`,
-        `${import_chalk8.default.cyan("AEGIS_JWT_SECRET=")}    ${import_chalk8.default.dim(process.platform === "win32" ? "\u2190 [Convert]::ToBase64String((1..32|%{[byte](Get-Random -Max 256)}))" : "\u2190 openssl rand -base64 32")}`,
-        ...features.emailVerification || features.passwordReset ? [`${import_chalk8.default.cyan("AEGIS_SMTP_HOST=")}        ${import_chalk8.default.dim("\u2190 and SMTP_PORT, SMTP_USER, SMTP_PASS, SMTP_FROM")}`] : [],
-        ...infra.rateLimitProvider === "upstash" ? [`${import_chalk8.default.cyan("UPSTASH_REDIS_REST_URL=")} ${import_chalk8.default.dim("\u2190 and UPSTASH_REDIS_REST_TOKEN")}`] : []
+        `${import_chalk7.default.cyan("DATABASE_URL=")}        ${import_chalk7.default.dim("\u2190 your Postgres connection string  (Neon, Supabase, local)")}`,
+        `${import_chalk7.default.cyan("AEGIS_JWT_SECRET=")}    ${import_chalk7.default.dim(process.platform === "win32" ? "\u2190 [Convert]::ToBase64String((1..32|%{[byte](Get-Random -Max 256)}))" : "\u2190 openssl rand -base64 32")}`,
+        ...features.emailVerification || features.passwordReset ? [`${import_chalk7.default.cyan("AEGIS_SMTP_HOST=")}        ${import_chalk7.default.dim("\u2190 and SMTP_PORT, SMTP_USER, SMTP_PASS, SMTP_FROM")}`] : [],
+        ...infra.rateLimitProvider === "upstash" ? [`${import_chalk7.default.cyan("UPSTASH_REDIS_REST_URL=")} ${import_chalk7.default.dim("\u2190 and UPSTASH_REDIS_REST_TOKEN")}`] : []
       ]
     },
     {
       n: 2,
       title: "Apply the database schema",
       lines: [
-        ...isNew ? [`${import_chalk8.default.green(`cd ${projectName}`)}  ${import_chalk8.default.dim("\u2190 if not already inside")}`] : [],
-        `${import_chalk8.default.green("npx prisma migrate dev --name init")}`
+        ...isNew ? [`${import_chalk7.default.green(`cd ${projectName}`)}  ${import_chalk7.default.dim("\u2190 if not already inside")}`] : [],
+        `${import_chalk7.default.green("npx prisma migrate dev --name init")}`
       ]
     },
     {
       n: 3,
       title: "Create your first user",
-      lines: [`${import_chalk8.default.green("npx aegis-auth seed")}`]
+      lines: [`${import_chalk7.default.green("npx aegis-auth seed")}`]
     },
     {
       n: 4,
       title: mode === "new" ? "Start building" : "Start your dev server",
       lines: [
-        `${import_chalk8.default.green(packageManager === "npm" ? "npm run dev" : `${packageManager} dev`)}  ${import_chalk8.default.dim("\u2192  http://localhost:3000")}`
+        `${import_chalk7.default.green(packageManager === "npm" ? "npm run dev" : `${packageManager} dev`)}  ${import_chalk7.default.dim("\u2192  http://localhost:3000")}`
       ]
     }
   ]);
   console.log();
-  console.log(
-    `  ${import_chalk8.default.dim("Commands available any time:")}
-`
-  );
-  console.log(`  ${import_chalk8.default.green("aegis-auth add-role")}    ${import_chalk8.default.dim("add a new role")}`);
-  console.log(`  ${import_chalk8.default.green("aegis-auth generate")}    ${import_chalk8.default.dim("regenerate TypeScript types")}`);
-  console.log(`  ${import_chalk8.default.green("aegis-auth validate")}    ${import_chalk8.default.dim("check config without hitting DB")}`);
-  console.log(`  ${import_chalk8.default.green("aegis-auth doctor")}      ${import_chalk8.default.dim("check env, DB, SMTP, Redis")}`);
-  console.log(`  ${import_chalk8.default.green("aegis-auth upgrade")}     ${import_chalk8.default.dim("update to a new version")}`);
+  console.log(`  ${import_chalk7.default.dim("Commands available any time:")}
+`);
+  console.log(`  ${import_chalk7.default.green("aegis-auth add-role")}    ${import_chalk7.default.dim("add a new role")}`);
+  console.log(`  ${import_chalk7.default.green("aegis-auth generate")}    ${import_chalk7.default.dim("regenerate TypeScript types")}`);
+  console.log(`  ${import_chalk7.default.green("aegis-auth validate")}    ${import_chalk7.default.dim("check config without hitting DB")}`);
+  console.log(`  ${import_chalk7.default.green("aegis-auth doctor")}      ${import_chalk7.default.dim("check env, DB, SMTP, Redis")}`);
+  console.log(`  ${import_chalk7.default.green("aegis-auth upgrade")}     ${import_chalk7.default.dim("update to a new version")}`);
   console.log();
 }
 
 // src/commands/doctor.ts
-var import_chalk9 = __toESM(require("chalk"));
+var import_chalk8 = __toESM(require("chalk"));
 var import_fs_extra2 = __toESM(require("fs-extra"));
 var import_path2 = __toESM(require("path"));
 async function runDoctor() {
@@ -24089,7 +24472,7 @@ async function runDoctor() {
     "AEGIS_JWT_SECRET_PREVIOUS"
   ];
   console.log(`
-  ${import_chalk9.default.dim("\u2500  Environment  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")}
+  ${import_chalk8.default.dim("\u2500  Environment  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")}
 `);
   for (const key of requiredEnv) {
     const val = process.env[key];
@@ -24112,20 +24495,20 @@ async function runDoctor() {
   const warns = results.filter((r) => r.status === "warn");
   console.log();
   if (errors.length === 0 && warns.length === 0) {
-    console.log(`  ${import_chalk9.default.green("\u2713")}  ${import_chalk9.default.green("Everything looks good.")}`);
+    console.log(`  ${import_chalk8.default.green("\u2713")}  ${import_chalk8.default.green("Everything looks good.")}`);
   } else {
     console.log(
-      `  ${import_chalk9.default.red(errors.length)} error${errors.length !== 1 ? "s" : ""}` + (warns.length ? `  ${import_chalk9.default.yellow(warns.length)} warning${warns.length !== 1 ? "s" : ""}` : "") + ` found.`
+      `  ${import_chalk8.default.red(errors.length)} error${errors.length !== 1 ? "s" : ""}` + (warns.length ? `  ${import_chalk8.default.yellow(warns.length)} warning${warns.length !== 1 ? "s" : ""}` : "") + ` found.`
     );
     console.log();
-    console.log(`  Fix the above, then re-run:  ${import_chalk9.default.green("npx aegis-auth doctor")}`);
+    console.log(`  Fix the above, then re-run:  ${import_chalk8.default.green("npx aegis-auth doctor")}`);
   }
   console.log();
 }
 
 // src/commands/add-role.ts
-var p8 = __toESM(require("@clack/prompts"));
-var import_chalk10 = __toESM(require("chalk"));
+var p7 = __toESM(require("@clack/prompts"));
+var import_chalk9 = __toESM(require("chalk"));
 var import_fs_extra3 = __toESM(require("fs-extra"));
 var import_path3 = __toESM(require("path"));
 async function runAddRole() {
@@ -24134,25 +24517,25 @@ async function runAddRole() {
   const cwd = process.cwd();
   const configPath = import_fs_extra3.default.existsSync(import_path3.default.join(cwd, "auth.config.ts")) ? import_path3.default.join(cwd, "auth.config.ts") : import_fs_extra3.default.existsSync(import_path3.default.join(cwd, "auth.config.js")) ? import_path3.default.join(cwd, "auth.config.js") : null;
   if (!configPath) {
-    p8.cancel("No auth.config.ts found. Run: npx aegis-auth init first.");
+    p7.cancel("No auth.config.ts found. Run: npx aegis-auth init first.");
     process.exit(1);
   }
   console.log(
     `
-  ${import_chalk10.default.dim("Adding a new role to your existing setup.")}
-  ${import_chalk10.default.dim("You will need to run  npx prisma migrate dev  after.")}
+  ${import_chalk9.default.dim("Adding a new role to your existing setup.")}
+  ${import_chalk9.default.dim("You will need to run  npx prisma migrate dev  after.")}
 `
   );
   const { id, config } = await promptRole(1, 1);
   console.log();
-  console.log(`  ${import_chalk10.default.green("\u2713")}  Role ${import_chalk10.default.magentaBright(id)} defined.`);
+  console.log(`  ${import_chalk9.default.green("\u2713")}  Role ${import_chalk9.default.magentaBright(id)} defined.`);
   console.log();
-  console.log(`  ${import_chalk10.default.dim("Next steps:")}`);
+  console.log(`  ${import_chalk9.default.dim("Next steps:")}`);
   console.log();
   console.log(`  1  Add to auth.config.ts \u2192 roles:`);
   console.log();
   console.log(
-    import_chalk10.default.dim(
+    import_chalk9.default.dim(
       `     ${id}: {
        label: '${config.label}',
        prismaModel: '${config.prismaModel}',
@@ -24164,15 +24547,15 @@ async function runAddRole() {
   );
   console.log();
   console.log(`  2  Apply the schema:`);
-  console.log(`     ${import_chalk10.default.green("npx prisma migrate dev --name add-role-" + id)}`);
+  console.log(`     ${import_chalk9.default.green("npx prisma migrate dev --name add-role-" + id)}`);
   console.log();
   console.log(`  3  Regenerate types:`);
-  console.log(`     ${import_chalk10.default.green("npx aegis-auth generate")}`);
+  console.log(`     ${import_chalk9.default.green("npx aegis-auth generate")}`);
   console.log();
 }
 
 // src/commands/generate.ts
-var import_chalk11 = __toESM(require("chalk"));
+var import_chalk10 = __toESM(require("chalk"));
 var import_fs_extra4 = __toESM(require("fs-extra"));
 var import_path4 = __toESM(require("path"));
 async function runGenerate() {
@@ -24180,7 +24563,7 @@ async function runGenerate() {
   const cwd = process.cwd();
   const outPath = import_path4.default.join(cwd, "src", "lib", "auth-types.generated.ts");
   console.log(`
-  ${import_chalk11.default.dim("Regenerating TypeScript types from auth.config.ts...")}
+  ${import_chalk10.default.dim("Regenerating TypeScript types from auth.config.ts...")}
 `);
   const content = `// auto-generated by aegis-auth \u2014 do not edit
 // run: npx aegis-auth generate  to update
@@ -24194,13 +24577,13 @@ export type { AegisSession }
 `;
   await import_fs_extra4.default.ensureDir(import_path4.default.dirname(outPath));
   await import_fs_extra4.default.writeFile(outPath, content, "utf8");
-  console.log(`  ${import_chalk11.default.green("\u2713")}  ${import_chalk11.default.yellow("src/lib/auth-types.generated.ts")}  updated`);
+  console.log(`  ${import_chalk10.default.green("\u2713")}  ${import_chalk10.default.yellow("src/lib/auth-types.generated.ts")}  updated`);
   console.log();
 }
 
 // src/commands/seed.ts
-var p9 = __toESM(require("@clack/prompts"));
-var import_chalk12 = __toESM(require("chalk"));
+var p8 = __toESM(require("@clack/prompts"));
+var import_chalk11 = __toESM(require("chalk"));
 var import_fs_extra5 = __toESM(require("fs-extra"));
 var import_path5 = __toESM(require("path"));
 async function runSeed() {
@@ -24209,45 +24592,45 @@ async function runSeed() {
   const cwd = process.cwd();
   const hasConfig = import_fs_extra5.default.existsSync(import_path5.default.join(cwd, "auth.config.ts")) || import_fs_extra5.default.existsSync(import_path5.default.join(cwd, "auth.config.js"));
   if (!hasConfig) {
-    p9.cancel("No auth.config.ts found. Run: npx aegis-auth init first.");
+    p8.cancel("No auth.config.ts found. Run: npx aegis-auth init first.");
     process.exit(1);
   }
   const hasPrisma = import_fs_extra5.default.existsSync(import_path5.default.join(cwd, "node_modules", ".prisma", "client"));
   if (!hasPrisma) {
-    p9.cancel("Prisma client not generated. Run: npx prisma generate first.");
+    p8.cancel("Prisma client not generated. Run: npx prisma generate first.");
     process.exit(1);
   }
   console.log(`
-  ${import_chalk12.default.dim("Creates the first user account in your database.")}
+  ${import_chalk11.default.dim("Creates the first user account in your database.")}
 `);
-  const role = await p9.text({
+  const role = await p8.text({
     message: "Role ID",
     placeholder: "admin",
     validate: (v) => !v ? "Required" : void 0
   });
-  if (p9.isCancel(role)) process.exit(0);
-  const loginField = await p9.select({
+  if (p8.isCancel(role)) process.exit(0);
+  const loginField = await p8.select({
     message: "Login field for this role",
     options: [
       { value: "email", label: "email" },
       { value: "username", label: "username" }
     ]
   });
-  if (p9.isCancel(loginField)) process.exit(0);
-  const identifier = await p9.text({
+  if (p8.isCancel(loginField)) process.exit(0);
+  const identifier = await p8.text({
     message: loginField === "email" ? "Email address" : "Username",
     validate: (v) => {
       if (!v) return "Required";
       if (loginField === "email" && !v.includes("@")) return "Enter a valid email address";
     }
   });
-  if (p9.isCancel(identifier)) process.exit(0);
-  const password3 = await p9.password({
+  if (p8.isCancel(identifier)) process.exit(0);
+  const password3 = await p8.password({
     message: "Password",
     validate: (v) => v.length < 8 ? "At least 8 characters" : void 0
   });
-  if (p9.isCancel(password3)) process.exit(0);
-  const spin = p9.spinner();
+  if (p8.isCancel(password3)) process.exit(0);
+  const spin = p8.spinner();
   spin.start("Creating user\u2026");
   try {
     const envPath = import_path5.default.join(cwd, ".env");
@@ -24275,18 +24658,18 @@ async function runSeed() {
       }
     });
     await prisma.$disconnect();
-    spin.stop(`${import_chalk12.default.green("\u2713")}  User created`);
+    spin.stop(`${import_chalk11.default.green("\u2713")}  User created`);
     console.log();
-    console.log(`  ${import_chalk12.default.bold("Role")}      ${import_chalk12.default.magentaBright(role)}`);
-    console.log(`  ${import_chalk12.default.bold(loginField)}   ${import_chalk12.default.cyan(identifier)}`);
+    console.log(`  ${import_chalk11.default.bold("Role")}      ${import_chalk11.default.magentaBright(role)}`);
+    console.log(`  ${import_chalk11.default.bold(loginField)}   ${import_chalk11.default.cyan(identifier)}`);
     console.log();
   } catch (err) {
-    spin.stop(`${import_chalk12.default.red("\u2717")}  Failed`);
+    spin.stop(`${import_chalk11.default.red("\u2717")}  Failed`);
     console.log();
     if (err?.code === "P2002") {
-      console.log(`  ${import_chalk12.default.red("A user with that ${loginField} already exists.")}`);
+      console.log(`  ${import_chalk11.default.red("A user with that ${loginField} already exists.")}`);
     } else {
-      console.log(`  ${import_chalk12.default.red(err?.message ?? String(err))}`);
+      console.log(`  ${import_chalk11.default.red(err?.message ?? String(err))}`);
     }
     console.log();
     process.exit(1);
@@ -24294,7 +24677,7 @@ async function runSeed() {
 }
 
 // src/index.ts
-var import_chalk13 = __toESM(require("chalk"));
+var import_chalk12 = __toESM(require("chalk"));
 var [, , command, ...args] = process.argv;
 var COMMANDS = {
   init: runInit,
@@ -24315,23 +24698,23 @@ var DESCRIPTIONS = {
 async function main() {
   if (!command || command === "--help" || command === "-h") {
     printBanner();
-    console.log(`  ${import_chalk13.default.bold("Usage")}  ${import_chalk13.default.cyan("npx aegis-auth")} ${import_chalk13.default.yellow("<command>")}`);
+    console.log(`  ${import_chalk12.default.bold("Usage")}  ${import_chalk12.default.cyan("npx aegis-auth")} ${import_chalk12.default.yellow("<command>")}`);
     console.log();
-    console.log(`  ${import_chalk13.default.bold("Commands")}`);
+    console.log(`  ${import_chalk12.default.bold("Commands")}`);
     console.log();
     for (const [cmd, desc] of Object.entries(DESCRIPTIONS)) {
-      console.log(`  ${import_chalk13.default.green(cmd.padEnd(14))}  ${import_chalk13.default.dim(desc)}`);
+      console.log(`  ${import_chalk12.default.green(cmd.padEnd(14))}  ${import_chalk12.default.dim(desc)}`);
     }
     console.log();
-    console.log(`  ${import_chalk13.default.dim("Run")}  ${import_chalk13.default.cyan("npx aegis-auth <command> --help")}  ${import_chalk13.default.dim("for more info.")}`);
+    console.log(`  ${import_chalk12.default.dim("Run")}  ${import_chalk12.default.cyan("npx aegis-auth <command> --help")}  ${import_chalk12.default.dim("for more info.")}`);
     console.log();
     return;
   }
   const handler = COMMANDS[command];
   if (!handler) {
     console.error(`
-  ${import_chalk13.default.red("Unknown command:")} ${import_chalk13.default.yellow(command)}`);
-    console.error(`  Run ${import_chalk13.default.cyan("npx aegis-auth --help")} for available commands.
+  ${import_chalk12.default.red("Unknown command:")} ${import_chalk12.default.yellow(command)}`);
+    console.error(`  Run ${import_chalk12.default.cyan("npx aegis-auth --help")} for available commands.
 `);
     process.exit(1);
   }
@@ -24339,7 +24722,7 @@ async function main() {
 }
 main().catch((err) => {
   console.error(`
-  ${import_chalk13.default.red("Unexpected error:")} ${err.message}
+  ${import_chalk12.default.red("Unexpected error:")} ${err.message}
 `);
   process.exit(1);
 });