@archlast/server 0.0.1

package/dist/auth/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/auth/interfaces.ts"],"names":[],"mappings":";;AAqJA,4EAyCC;AAsBD,8CA4DC;AA3HD,SAAgB,gCAAgC,CAC5C,WAAoC,UAAU;IAE9C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;IAEzB,MAAM,GAAG,GAAgB;QACrB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,IAAI;QACZ,eAAe,EAAE,KAAK;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ;QACR,GAAG,EAAE,IAAI;QAET,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QAEd,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,EAAE;QAEf,aAAa,EAAE,IAAI;QAEnB,oBAAoB,EAAE,GAAG,EAAE;YACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QACD,aAAa,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QACD,WAAW,EAAE,GAAG,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QACD,iBAAiB,EAAE,GAAG,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;KACJ,CAAC;IAEF,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAClB,WAAiD,EACjD,UAAkB;IAElB,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3D,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,UAAU,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACvC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzD,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAgB,iBAAiB,CAC7B,IAOC;IAED,MAAM,GAAG,GAAgB;QACrB,GAAG,IAAI;QAEP,aAAa,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC;QAElF,oBAAoB,EAAE,GAAG,EAAE;YACvB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvC,CAAC;YACD,gDAAgD;YAChD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvC,CAAC;QACL,CAAC;QAED,aAAa,EAAE,GAAG,EAAE;YAChB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC1C,CAAC;QACL,CAAC;QAED,WAAW,EAAE,CAAC,IAAuB,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvC,CAAC;YACD,mDAAmD;YACnD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAClC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YACjC,CAAC;QACL,CAAC;QAED,iBAAiB,EAAE,CAAC,UAAkB,EAAE,EAAE;YACtC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,GAAG,CAAC,CAAC;YACrE,CAAC;QACL,CAAC;KACJ,CAAC;IAEF,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/auth/mfa/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * MFA Module Exports
+ */
+export { mfaSchema, MFA_COLLECTIONS, MFA_TYPES, type MfaType } from "./schema.js";
+export { createMfaService, type MfaService } from "./service.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/mfa/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/mfa/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/auth/mfa/index.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * MFA Module Exports
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMfaService = exports.MFA_TYPES = exports.MFA_COLLECTIONS = exports.mfaSchema = void 0;
+var schema_js_1 = require("./schema.js");
+Object.defineProperty(exports, "mfaSchema", { enumerable: true, get: function () { return schema_js_1.mfaSchema; } });
+Object.defineProperty(exports, "MFA_COLLECTIONS", { enumerable: true, get: function () { return schema_js_1.MFA_COLLECTIONS; } });
+Object.defineProperty(exports, "MFA_TYPES", { enumerable: true, get: function () { return schema_js_1.MFA_TYPES; } });
+var service_js_1 = require("./service.js");
+Object.defineProperty(exports, "createMfaService", { enumerable: true, get: function () { return service_js_1.createMfaService; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/mfa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/mfa/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,yCAAkF;AAAzE,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,sGAAA,SAAS,OAAA;AAC9C,2CAAiE;AAAxD,8GAAA,gBAAgB,OAAA"}

package/dist/auth/mfa/schema.d.ts

@@ -0,0 +1,32 @@
+/**
+ * MFA (Multi-Factor Authentication) Schema
+ * Supports TOTP and backup codes
+ */
+export declare const MFA_COLLECTIONS: {
+    readonly factors: "_auth_factors";
+};
+export declare const mfaSchema: {
+    tables: {
+        /**
+         * _auth_factors
+         * Stores user MFA factors (TOTP secrets, backup codes)
+         */
+        _auth_factors: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            type: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            secret: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            verified: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            lastUsedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+        }>;
+    };
+};
+export declare const MFA_TYPES: {
+    readonly TOTP: "totp";
+    readonly BACKUP_CODES: "backup_codes";
+};
+export type MfaType = (typeof MFA_TYPES)[keyof typeof MFA_TYPES];
+//# sourceMappingURL=schema.d.ts.map

package/dist/auth/mfa/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/auth/mfa/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,eAAO,MAAM,eAAe;;CAElB,CAAC;AAEX,eAAO,MAAM,SAAS;;QAClB;;;WAGG;;;;;;;;;;;;;CAiBL,CAAC;AAEH,eAAO,MAAM,SAAS;;;CAGZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC"}

package/dist/auth/mfa/schema.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * MFA (Multi-Factor Authentication) Schema
+ * Supports TOTP and backup codes
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MFA_TYPES = exports.mfaSchema = exports.MFA_COLLECTIONS = void 0;
+const definition_js_1 = require("../../schema/definition.js");
+exports.MFA_COLLECTIONS = {
+    factors: "_auth_factors",
+};
+exports.mfaSchema = (0, definition_js_1.defineSchema)({
+    /**
+     * _auth_factors
+     * Stores user MFA factors (TOTP secrets, backup codes)
+     */
+    [exports.MFA_COLLECTIONS.factors]: (0, definition_js_1.defineTable)({
+        _id: definition_js_1.v.id().primaryKey(),
+        userId: definition_js_1.v.string(),
+        type: definition_js_1.v.string(), // "totp" | "backup_codes"
+        secret: definition_js_1.v.string(), // Encrypted TOTP secret or backup codes
+        verified: definition_js_1.v.boolean().default(false),
+        name: definition_js_1.v.string().optional(), // User-friendly name like "Authenticator App"
+        lastUsedAt: definition_js_1.v.number().optional(),
+        createdAt: definition_js_1.v.number(),
+        updatedAt: definition_js_1.v.number().optional(),
+    }, {
+        indexes: [{ fields: ["userId", "type"], name: "idx_mfa_user_type" }],
+    }),
+});
+exports.MFA_TYPES = {
+    TOTP: "totp",
+    BACKUP_CODES: "backup_codes",
+};
+//# sourceMappingURL=schema.js.map

package/dist/auth/mfa/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/auth/mfa/schema.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,8DAA0E;AAE7D,QAAA,eAAe,GAAG;IAC3B,OAAO,EAAE,eAAe;CAClB,CAAC;AAEE,QAAA,SAAS,GAAG,IAAA,4BAAY,EAAC;IAClC;;;OAGG;IACH,CAAC,uBAAe,CAAC,OAAO,CAAC,EAAE,IAAA,2BAAW,EAClC;QACI,GAAG,EAAE,iBAAC,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE;QACxB,MAAM,EAAE,iBAAC,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,iBAAC,CAAC,MAAM,EAAE,EAAE,0BAA0B;QAC5C,MAAM,EAAE,iBAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC;QAC5D,QAAQ,EAAE,iBAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,iBAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,8CAA8C;QAC3E,UAAU,EAAE,iBAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,SAAS,EAAE,iBAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,iBAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,EACD;QACI,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;KACvE,CACJ;CACJ,CAAC,CAAC;AAEU,QAAA,SAAS,GAAG;IACrB,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;CACtB,CAAC"}

package/dist/auth/mfa/service.d.ts

@@ -0,0 +1,65 @@
+/**
+ * MFA (TOTP) Service
+ * Handles TOTP enrollment, verification, and backup codes
+ */
+import type { IDatabaseClient } from "../../db/interfaces.js";
+export interface MfaService {
+    /**
+     * Enroll a new TOTP factor
+     */
+    enrollTotp(options: {
+        userId: string;
+        issuer?: string;
+        accountName?: string;
+    }): Promise<{
+        secret: string;
+        uri: string;
+        qrDataUrl: string;
+    }>;
+    /**
+     * Verify TOTP enrollment
+     */
+    verifyTotpEnrollment(options: {
+        userId: string;
+        code: string;
+    }): Promise<{
+        valid: boolean;
+    }>;
+    /**
+     * Verify a TOTP code
+     */
+    verifyTotp(options: {
+        userId: string;
+        code: string;
+    }): Promise<{
+        valid: boolean;
+    }>;
+    /**
+     * Check if user has MFA enabled
+     */
+    hasMfaEnabled(userId: string): Promise<boolean>;
+    /**
+     * Remove MFA for user
+     */
+    removeMfa(userId: string): Promise<void>;
+    /**
+     * Generate backup codes
+     */
+    generateBackupCodes(userId: string): Promise<{
+        codes: string[];
+    }>;
+    /**
+     * Verify a backup code
+     */
+    verifyBackupCode(options: {
+        userId: string;
+        code: string;
+    }): Promise<{
+        valid: boolean;
+    }>;
+}
+/**
+ * Create MFA Service instance
+ */
+export declare function createMfaService(db: IDatabaseClient): MfaService;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/mfa/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/mfa/service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA8B9D,MAAM,WAAW,UAAU;IACvB;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEhE;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAE7F;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAEnF;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;OAEG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAElE;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC5F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,eAAe,GAAG,UAAU,CAkOhE"}

package/dist/auth/mfa/service.js

@@ -0,0 +1,255 @@
+"use strict";
+/**
+ * MFA (TOTP) Service
+ * Handles TOTP enrollment, verification, and backup codes
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMfaService = createMfaService;
+const cuid2_1 = require("@paralleldrive/cuid2");
+const crypto_1 = require("crypto");
+const OTPAuth = __importStar(require("otpauth"));
+const schema_js_1 = require("./schema.js");
+const ENCRYPTION_KEY = process.env.ARCHLAST_MFA_ENCRYPTION_KEY || "default-dev-key-32-bytes-long!!";
+/**
+ * Encrypt a secret for storage
+ */
+function encryptSecret(plaintext) {
+    const iv = (0, crypto_1.randomBytes)(16);
+    const key = Buffer.from(ENCRYPTION_KEY.padEnd(32, "0").slice(0, 32));
+    const cipher = (0, crypto_1.createCipheriv)("aes-256-cbc", key, iv);
+    let encrypted = cipher.update(plaintext, "utf8", "hex");
+    encrypted += cipher.final("hex");
+    return iv.toString("hex") + ":" + encrypted;
+}
+/**
+ * Decrypt a stored secret
+ */
+function decryptSecret(ciphertext) {
+    const [ivHex, encryptedHex] = ciphertext.split(":");
+    const iv = Buffer.from(ivHex, "hex");
+    const key = Buffer.from(ENCRYPTION_KEY.padEnd(32, "0").slice(0, 32));
+    const decipher = (0, crypto_1.createDecipheriv)("aes-256-cbc", key, iv);
+    let decrypted = decipher.update(encryptedHex, "hex", "utf8");
+    decrypted += decipher.final("utf8");
+    return decrypted;
+}
+/**
+ * Create MFA Service instance
+ */
+function createMfaService(db) {
+    async function enrollTotp(options) {
+        const secret = new OTPAuth.Secret({ size: 20 });
+        const totp = new OTPAuth.TOTP({
+            issuer: options.issuer || "Archlast",
+            label: options.accountName || options.userId,
+            algorithm: "SHA1",
+            digits: 6,
+            period: 30,
+            secret: secret,
+        });
+        const uri = totp.toString();
+        // Check for existing unverified enrollment
+        const existing = await db.findMany(schema_js_1.MFA_COLLECTIONS.factors, {
+            where: {
+                and: [
+                    { userId: { eq: options.userId } },
+                    { type: { eq: schema_js_1.MFA_TYPES.TOTP } },
+                    { verified: { eq: false } },
+                ],
+            },
+        });
+        // Remove old unverified enrollments
+        for (const record of existing) {
+            await db.delete(schema_js_1.MFA_COLLECTIONS.factors, record._id);
+        }
+        // Create new enrollment (unverified)
+        const now = Date.now();
+        await db.insert(schema_js_1.MFA_COLLECTIONS.factors, {
+            _id: (0, cuid2_1.createId)(),
+            userId: options.userId,
+            type: schema_js_1.MFA_TYPES.TOTP,
+            secret: encryptSecret(secret.base32),
+            verified: false,
+            name: "Authenticator App",
+            createdAt: now,
+        });
+        // Generate QR code data URL
+        const qrDataUrl = `data:image/svg+xml,${encodeURIComponent(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 50"><text y="30" font-family="monospace" font-size="10">Scan via ${uri.slice(0, 40)}...</text></svg>`)}`;
+        return {
+            secret: secret.base32,
+            uri,
+            qrDataUrl,
+        };
+    }
+    async function verifyTotpEnrollment(options) {
+        const records = await db.findMany(schema_js_1.MFA_COLLECTIONS.factors, {
+            where: {
+                and: [
+                    { userId: { eq: options.userId } },
+                    { type: { eq: schema_js_1.MFA_TYPES.TOTP } },
+                    { verified: { eq: false } },
+                ],
+            },
+            take: 1,
+        });
+        const record = records[0];
+        if (!record)
+            return { valid: false };
+        const secretBase32 = decryptSecret(record.secret);
+        const totp = new OTPAuth.TOTP({
+            secret: OTPAuth.Secret.fromBase32(secretBase32),
+            algorithm: "SHA1",
+            digits: 6,
+            period: 30,
+        });
+        const delta = totp.validate({ token: options.code, window: 1 });
+        if (delta === null)
+            return { valid: false };
+        // Mark as verified
+        await db.patch(schema_js_1.MFA_COLLECTIONS.factors, record._id, {
+            verified: true,
+            updatedAt: Date.now(),
+        });
+        return { valid: true };
+    }
+    async function verifyTotp(options) {
+        const records = await db.findMany(schema_js_1.MFA_COLLECTIONS.factors, {
+            where: {
+                and: [
+                    { userId: { eq: options.userId } },
+                    { type: { eq: schema_js_1.MFA_TYPES.TOTP } },
+                    { verified: { eq: true } },
+                ],
+            },
+            take: 1,
+        });
+        const record = records[0];
+        if (!record)
+            return { valid: false };
+        const secretBase32 = decryptSecret(record.secret);
+        const totp = new OTPAuth.TOTP({
+            secret: OTPAuth.Secret.fromBase32(secretBase32),
+            algorithm: "SHA1",
+            digits: 6,
+            period: 30,
+        });
+        const delta = totp.validate({ token: options.code, window: 1 });
+        if (delta === null)
+            return { valid: false };
+        // Update last used
+        await db.patch(schema_js_1.MFA_COLLECTIONS.factors, record._id, {
+            lastUsedAt: Date.now(),
+        });
+        return { valid: true };
+    }
+    async function hasMfaEnabled(userId) {
+        const records = await db.findMany(schema_js_1.MFA_COLLECTIONS.factors, {
+            where: {
+                and: [{ userId: { eq: userId } }, { verified: { eq: true } }],
+            },
+            take: 1,
+        });
+        return records.length > 0;
+    }
+    async function removeMfa(userId) {
+        const records = await db.findMany(schema_js_1.MFA_COLLECTIONS.factors, {
+            where: { userId: { eq: userId } },
+        });
+        for (const record of records) {
+            await db.delete(schema_js_1.MFA_COLLECTIONS.factors, record._id);
+        }
+    }
+    async function generateBackupCodes(userId) {
+        const codes = [];
+        for (let i = 0; i < 10; i++) {
+            codes.push((0, crypto_1.randomBytes)(4).toString("hex").toUpperCase());
+        }
+        // Remove existing backup codes
+        const existing = await db.findMany(schema_js_1.MFA_COLLECTIONS.factors, {
+            where: {
+                and: [{ userId: { eq: userId } }, { type: { eq: schema_js_1.MFA_TYPES.BACKUP_CODES } }],
+            },
+        });
+        for (const record of existing) {
+            await db.delete(schema_js_1.MFA_COLLECTIONS.factors, record._id);
+        }
+        // Store new backup codes
+        const now = Date.now();
+        await db.insert(schema_js_1.MFA_COLLECTIONS.factors, {
+            _id: (0, cuid2_1.createId)(),
+            userId,
+            type: schema_js_1.MFA_TYPES.BACKUP_CODES,
+            secret: encryptSecret(JSON.stringify(codes)),
+            verified: true,
+            name: "Backup Codes",
+            createdAt: now,
+        });
+        return { codes };
+    }
+    async function verifyBackupCode(options) {
+        const records = await db.findMany(schema_js_1.MFA_COLLECTIONS.factors, {
+            where: {
+                and: [{ userId: { eq: options.userId } }, { type: { eq: schema_js_1.MFA_TYPES.BACKUP_CODES } }],
+            },
+            take: 1,
+        });
+        const record = records[0];
+        if (!record)
+            return { valid: false };
+        const codes = JSON.parse(decryptSecret(record.secret));
+        const normalizedCode = options.code.toUpperCase().replace(/[^A-F0-9]/g, "");
+        const index = codes.indexOf(normalizedCode);
+        if (index === -1)
+            return { valid: false };
+        // Remove used code
+        codes.splice(index, 1);
+        await db.patch(schema_js_1.MFA_COLLECTIONS.factors, record._id, {
+            secret: encryptSecret(JSON.stringify(codes)),
+            lastUsedAt: Date.now(),
+        });
+        return { valid: true };
+    }
+    return {
+        enrollTotp,
+        verifyTotpEnrollment,
+        verifyTotp,
+        hasMfaEnabled,
+        removeMfa,
+        generateBackupCodes,
+        verifyBackupCode,
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/mfa/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/mfa/service.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EH,4CAkOC;AA/SD,gDAAgD;AAChD,mCAAuE;AACvE,iDAAmC;AAEnC,2CAAuE;AAEvE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,iCAAiC,CAAC;AAEpG;;GAEG;AACH,SAAS,aAAa,CAAC,SAAiB;IACpC,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,UAAkB;IACrC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACrB,CAAC;AA2CD;;GAEG;AACH,SAAgB,gBAAgB,CAAC,EAAmB;IAChD,KAAK,UAAU,UAAU,CAAC,OAIzB;QACG,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;YACpC,KAAK,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM;YAC5C,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,MAAM;SACjB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAE5B,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC/D,KAAK,EAAE;gBACH,GAAG,EAAE;oBACD,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;oBAClC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,qBAAS,CAAC,IAAI,EAAE,EAAE;oBAChC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;iBAC9B;aACJ;SACJ,CAAC,CAAC;QAEH,oCAAoC;QACpC,KAAK,MAAM,MAAM,IAAI,QAAiB,EAAE,CAAC;YACrC,MAAM,EAAE,CAAC,MAAM,CAAC,2BAAe,CAAC,OAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,qCAAqC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC5C,GAAG,EAAE,IAAA,gBAAQ,GAAE;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,qBAAS,CAAC,IAAI;YACpB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;YACpC,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE,GAAG;SACjB,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,SAAS,GAAG,sBAAsB,kBAAkB,CACtD,6HAA6H,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAClK,EAAE,CAAC;QAEJ,OAAO;YACH,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG;YACH,SAAS;SACZ,CAAC;IACN,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,OAGnC;QACG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC9D,KAAK,EAAE;gBACH,GAAG,EAAE;oBACD,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;oBAClC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,qBAAS,CAAC,IAAI,EAAE,EAAE;oBAChC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;iBAC9B;aACJ;YACD,IAAI,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,MAAM,MAAM,GAAI,OAAiB,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAErC,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YAC/C,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;SACb,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAE5C,mBAAmB;QACnB,MAAM,EAAE,CAAC,KAAK,CAAC,2BAAe,CAAC,OAAc,EAAE,MAAM,CAAC,GAAG,EAAE;YACvD,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,OAGzB;QACG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC9D,KAAK,EAAE;gBACH,GAAG,EAAE;oBACD,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;oBAClC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,qBAAS,CAAC,IAAI,EAAE,EAAE;oBAChC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;iBAC7B;aACJ;YACD,IAAI,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,MAAM,MAAM,GAAI,OAAiB,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAErC,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YAC/C,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;SACb,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAE5C,mBAAmB;QACnB,MAAM,EAAE,CAAC,KAAK,CAAC,2BAAe,CAAC,OAAc,EAAE,MAAM,CAAC,GAAG,EAAE;YACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,MAAc;QACvC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC9D,KAAK,EAAE;gBACH,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;aAChE;YACD,IAAI,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,OAAQ,OAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAc;QACnC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC9D,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;SACpC,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,OAAgB,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,2BAAe,CAAC,OAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,MAAc;QAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC/D,KAAK,EAAE;gBACH,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,qBAAS,CAAC,YAAY,EAAE,EAAE,CAAC;aAC9E;SACJ,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,QAAiB,EAAE,CAAC;YACrC,MAAM,EAAE,CAAC,MAAM,CAAC,2BAAe,CAAC,OAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,yBAAyB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,MAAM,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC5C,GAAG,EAAE,IAAA,gBAAQ,GAAE;YACf,MAAM;YACN,IAAI,EAAE,qBAAS,CAAC,YAAY;YAC5B,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5C,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,GAAG;SACjB,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,OAG/B;QACG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAAe,CAAC,OAAc,EAAE;YAC9D,KAAK,EAAE;gBACH,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,qBAAS,CAAC,YAAY,EAAE,EAAE,CAAC;aACtF;YACD,IAAI,EAAE,CAAC;SACV,CAAC,CAAC;QAEH,MAAM,MAAM,GAAI,OAAiB,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAErC,MAAM,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAE1C,mBAAmB;QACnB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,CAAC,KAAK,CAAC,2BAAe,CAAC,OAAc,EAAE,MAAM,CAAC,GAAG,EAAE;YACvD,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACH,UAAU;QACV,oBAAoB;QACpB,UAAU;QACV,aAAa;QACb,SAAS;QACT,mBAAmB;QACnB,gBAAgB;KACnB,CAAC;AACN,CAAC"}

package/dist/auth/oauth-proxy.d.ts

@@ -0,0 +1,58 @@
+/**
+ * OAuth Proxy Service
+ *
+ * Acts as an internal HTTP service that handles OAuth flows for external providers
+ * (Google, GitHub) and maps their profiles to the internal auth_users schema.
+ *
+ * Design:
+ * - Providers are configured via environment variables.
+ * - The proxy handles the callback, exchanges the code for tokens, and fetches the profile.
+ * - It creates or links the user in auth_users and auth_accounts.
+ * - Returns a session token via SessionManager.
+ */
+import type { IDatabaseClient } from "../db/interfaces.js";
+import { SessionManager } from "./session-manager.js";
+export type OAuthProvider = "google" | "github";
+export interface OAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+}
+export interface OAuthProviderProfile {
+    provider: OAuthProvider;
+    providerAccountId: string;
+    email: string;
+    emailVerified: boolean;
+    name?: string;
+    imageUrl?: string;
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+}
+export interface OAuthProxyConfig {
+    google?: OAuthConfig;
+    github?: OAuthConfig;
+}
+export declare class OAuthProxy {
+    private readonly db;
+    private readonly sessionManager;
+    private readonly config;
+    constructor(db: IDatabaseClient, sessionManager: SessionManager, config?: OAuthProxyConfig);
+    private loadProviderConfig;
+    /**
+     * Generate the OAuth authorization URL for a provider.
+     */
+    getAuthorizationUrl(provider: OAuthProvider, state: string): string | null;
+    /**
+     * Handle the OAuth callback: exchange code for tokens, fetch profile, create/link user.
+     */
+    handleCallback(provider: OAuthProvider, code: string): Promise<{
+        token: string;
+        userId: string;
+        isNewUser: boolean;
+    } | null>;
+    private exchangeCodeForTokens;
+    private fetchProfile;
+    private createOrLinkUser;
+}
+//# sourceMappingURL=oauth-proxy.d.ts.map

package/dist/auth/oauth-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-proxy.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,WAAW;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,qBAAa,UAAU;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAkB;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;gBAE9B,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,gBAAgB;IAS1F,OAAO,CAAC,kBAAkB;IAY1B;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAuB1E;;OAEG;IACG,cAAc,CAChB,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;YAgD1D,qBAAqB;YAwDrB,YAAY;YA2DZ,gBAAgB;CAyGjC"}