@binary1702/auth 0.1.0 → 0.2.0

package/INSTALL.md

@@ -40,8 +40,19 @@ const user = await requireUser()   // { id, username } or throws 401
 
 ## More users
 
+From the terminal:
+
 ```bash
 npx @binary1702/auth add-user
 npx @binary1702/auth set-password
 npx @binary1702/auth list-users
 ```
+
+Or let people register themselves at `/auth/sign-up`. Add to `.env.local`:
+
+```
+AUTH_SIGNUP=open             # anyone can create an account
+AUTH_INVITE_CODE=secret      # optional: the form then asks for this code
+```
+
+Without `AUTH_SIGNUP`, sign-up is closed. The one exception is a fresh install with zero users, where `/auth/sign-in` takes you to create the first account.

package/PROMPT.md

@@ -0,0 +1,80 @@
+# Agent prompt: install @binary1702/auth
+
+Copy everything below the line into an AI coding agent running inside the Next.js project.
+
+---
+
+Install `@binary1702/auth` in this project. It adds username + password auth to a Next.js App Router app. Follow these steps exactly and report the result of each.
+
+## Before you start
+
+Check these and stop if any fails:
+
+- `app/` or `src/app/` exists (App Router). Pages Router is not supported.
+- A Postgres connection string is available. Look for `DATABASE_URL` or `NEON_DATABASE_URL` in `.env.local` or the environment. If none exists, ask me for one.
+- If the project already has auth (a `proxy.ts` or `middleware.ts` that checks sessions, or packages like next-auth, better-auth, clerk, `@neondatabase/auth`), tell me before continuing. This package will put its own sign-in in front of everything.
+
+## Install
+
+Run, in the project root:
+
+```bash
+npx @binary1702/auth
+```
+
+It is interactive. It asks for the Postgres connection string, then a username and a password for the first user. If you cannot answer prompts, run it and hand control to me.
+
+It does the following, skipping anything already done:
+
+```
+✓ @binary1702/auth installed             → package.json
+✓ DATABASE_URL → .env.local
+✓ AUTH_SECRET generated → .env.local
+✓ app/auth/[...path]/route.ts            → export { GET, POST } from "@binary1702/auth/next"
+✓ proxy.ts                               → guard in front of every route
+✓ auth_users table ready                 → in the database
+✓ user "<name>" created
+```
+
+If `proxy.ts` or `middleware.ts` already existed, the CLI does not touch it and prints a snippet instead. Merge the snippet into the existing file: call the package's `proxy` for the paths you want protected and keep the matcher inline. On Next 15 the file is `middleware.ts`, same content.
+
+## Verify
+
+Start the dev server and check with real HTTP requests:
+
+| Request | Expect |
+|---|---|
+| `GET /` with no cookie | redirect to `/auth/sign-in` |
+| `GET /auth/sign-in` | 200, HTML form |
+| `GET /api/<any>` with no cookie | 401 JSON |
+| `POST /auth/sign-in` JSON `{ "username", "password" }` | 200 `{ user }` and `Set-Cookie: auth_session=…; HttpOnly` |
+| `GET /auth/session` with that cookie | `{ user: { id, username } }` |
+| `GET /auth/sign-out` | cookie cleared, redirect to sign-in |
+
+Then open `/auth/sign-in` in the browser, sign in, confirm you land on `/`.
+
+## Wire it into the code
+
+Wherever the app needs the current user on the server:
+
+```ts
+import { requireUser } from "@binary1702/auth/next"
+
+const user = await requireUser()   // { id, username } or throws AuthError (401)
+```
+
+`getUser()` returns `null` instead of throwing. Both work in route handlers, server components and server actions.
+
+For sign-out, link to `/auth/sign-out`. For client code, `fetch("/auth/session")`.
+
+Do not build a sign-up page. One exists at `/auth/sign-up`. It is closed by default (except for the very first user on an empty install). To let people register, add `AUTH_SIGNUP=open` to `.env.local`, optionally with `AUTH_INVITE_CODE=<code>` to require a code on the form. Users can also be created with `npx @binary1702/auth add-user`.
+
+## Deploy
+
+Copy `DATABASE_URL` and `AUTH_SECRET` from `.env.local` into the host's environment. Nothing else.
+
+## Report
+
+Tell me, in order: each install step and whether it was done or skipped, each verify row with the actual status code, anything that failed with the error text verbatim, and anything that took more steps than it should. Do not modify the package itself, only this project.
+
+Docs: https://www.npmjs.com/package/@binary1702/auth

package/README.md

@@ -8,6 +8,8 @@ npx @binary1702/auth
 
 One command. It installs itself, writes two env vars, writes two files, creates the table, creates your first user. Then you move on.
 
+Letting an AI agent do the install? Paste [PROMPT.md](./PROMPT.md) into it. Same steps, written for an agent, with the checks to run and what to report back. [INSTALL.md](./INSTALL.md) is the short human version.
+
 ---
 
 ## Quick start (new project)
@@ -75,6 +77,7 @@ Works in route handlers, server components, and server actions.
 | URL | What it does |
 |---|---|
 | `/auth/sign-in` | The sign-in page. Served by the package, no React, no styling work. |
+| `/auth/sign-up` | Self registration. Closed unless `AUTH_SIGNUP=open`. See [Users](#users). |
 | `/auth/sign-out` | Clears the session and sends you back to sign-in. Link to it. |
 | `/auth/session` | `{ user }` or `{ user: null }` as JSON, for client code. |
 
@@ -82,9 +85,11 @@ Everything else on the site requires a session. Unauthenticated page requests re
 
 ---
 
-## Managing users
+## Users
+
+Two ways in. Pick one or use both.
 
-There is no sign-up page. Users are created from the terminal.
+**From the terminal** (always works):
 
 ```bash
 npx @binary1702/auth add-user           # prompts for username and password
@@ -93,6 +98,18 @@ npx @binary1702/auth set-password ben
 npx @binary1702/auth list-users
 ```
 
+**Self sign-up at `/auth/sign-up`**, controlled by one env var:
+
+| `.env.local` | Who can sign up |
+|---|---|
+| nothing set | Nobody. Except on a fresh install with zero users: `/auth/sign-in` sends you to create the first account. |
+| `AUTH_SIGNUP=open` | Anyone. The sign-in page gets a "Create one" link. |
+| `AUTH_SIGNUP=open` + `AUTH_INVITE_CODE=secret` | Anyone who knows the code. The form gets an invite field. |
+
+Rules on the form: username 2 to 32 characters (letters, numbers, `. _ -`), password at least 8. Accounts are created and signed in immediately. Nothing to approve.
+
+Programmatic: `POST /auth/sign-up` as JSON `{ username, password, invite? }` returns `200 { user }` and the cookie, or `400 / 403 / 404 / 409` with `{ error }`.
+
 ---
 
 ## The two files it wrote

package/dist/cli.js

@@ -234,6 +234,9 @@ Get the user in any route or server component:
   const user = await requireUser()   // { id, username }
 
 Add users later:  npx ${PKG} add-user
+Or let people register themselves at /auth/sign-up:
+  AUTH_SIGNUP=open            in .env.local (anyone)
+  AUTH_INVITE_CODE=<code>     optional, the form then needs it
 `);
 }
 // ── main ──────────────────────────────────────────────────────

package/dist/core/config.d.ts

@@ -2,6 +2,7 @@ export declare const COOKIE_NAME = "auth_session";
 export declare const SESSION_DAYS = 7;
 export declare const SIGN_IN_PATH = "/auth/sign-in";
 export declare const SIGN_OUT_PATH = "/auth/sign-out";
+export declare const SIGN_UP_PATH = "/auth/sign-up";
 export declare const TABLE = "auth_users";
 export declare function getSecret(): string;
 export declare function getDatabaseUrl(): string;

package/dist/core/config.js

@@ -8,6 +8,7 @@ export const COOKIE_NAME = "auth_session";
 export const SESSION_DAYS = 7;
 export const SIGN_IN_PATH = "/auth/sign-in";
 export const SIGN_OUT_PATH = "/auth/sign-out";
+export const SIGN_UP_PATH = "/auth/sign-up";
 export const TABLE = "auth_users";
 export function getSecret() {
     const secret = process.env.AUTH_SECRET;

package/dist/core/html.d.ts

@@ -2,4 +2,12 @@ export declare function signInPage(opts?: {
     error?: string;
     next?: string;
     title?: string;
+    canSignUp?: boolean;
+}): string;
+export declare function signUpPage(opts?: {
+    error?: string;
+    next?: string;
+    title?: string;
+    inviteRequired?: boolean;
+    first?: boolean;
 }): string;

package/dist/core/html.js

@@ -1,20 +1,10 @@
 // ─────────────────────────────────────────────────────────────
-// The sign-in page. Plain HTML served by the route handler,
-// so the consumer never builds a form or a page.
+// The sign-in and sign-up pages. Plain HTML served by the route
+// handler, so the consumer never builds a form or a page.
 // ─────────────────────────────────────────────────────────────
-import { SIGN_IN_PATH } from "./config.js";
+import { SIGN_IN_PATH, SIGN_UP_PATH } from "./config.js";
 const escape = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-export function signInPage(opts = {}) {
-    const title = escape(opts.title ?? "Sign in");
-    const next = escape(opts.next ?? "/");
-    const error = opts.error ? `<p class="error">${escape(opts.error)}</p>` : "";
-    return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
-<style>
+const STYLE = `
   :root { color-scheme: light dark; --fg: #111; --bg: #fff; --line: #ddd; --muted: #666; --err: #c0392b; }
   @media (prefers-color-scheme: dark) { :root { --fg: #eee; --bg: #111; --line: #333; --muted: #999; --err: #ff6b6b; } }
   * { box-sizing: border-box; }
@@ -27,17 +17,58 @@ export function signInPage(opts = {}) {
   input:focus { outline: 2px solid var(--fg); outline-offset: 1px; }
   button { font: inherit; font-weight: 500; padding: 9px; border: 0; border-radius: 6px; background: var(--fg); color: var(--bg); cursor: pointer; }
   .error { margin: 0; font-size: 13px; color: var(--err); }
-</style>
+  .alt { margin: 4px 0 0; font-size: 13px; color: var(--muted); text-align: center; }
+  .alt a { color: var(--fg); }
+`;
+function page(opts) {
+    const title = escape(opts.title);
+    const next = escape(opts.next ?? "/");
+    const error = opts.error ? `<p class="error">${escape(opts.error)}</p>` : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>${STYLE}</style>
 </head>
 <body>
-<form method="post" action="${SIGN_IN_PATH}">
+<form method="post" action="${opts.action}">
   <h1>${title}</h1>
   ${error}
-  <label>Username <input name="username" autocomplete="username" autofocus required></label>
-  <label>Password <input name="password" type="password" autocomplete="current-password" required></label>
+  ${opts.fields}
   <input type="hidden" name="next" value="${next}">
-  <button type="submit">Sign in</button>
+  <button type="submit">${escape(opts.button)}</button>
+  ${opts.alt ?? ""}
 </form>
 </body>
 </html>`;
 }
+export function signInPage(opts = {}) {
+    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
+    return page({
+        title: opts.title ?? "Sign in",
+        action: SIGN_IN_PATH,
+        error: opts.error,
+        next: opts.next,
+        button: "Sign in",
+        fields: `
+  <label>Username <input name="username" autocomplete="username" autofocus required></label>
+  <label>Password <input name="password" type="password" autocomplete="current-password" required></label>`,
+        alt: opts.canSignUp ? `<p class="alt">No account? <a href="${SIGN_UP_PATH}${next}">Create one</a></p>` : undefined,
+    });
+}
+export function signUpPage(opts = {}) {
+    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
+    return page({
+        title: opts.title ?? (opts.first ? "Create the first account" : "Create account"),
+        action: SIGN_UP_PATH,
+        error: opts.error,
+        next: opts.next,
+        button: "Create account",
+        fields: `
+  <label>Username <input name="username" autocomplete="username" autofocus required></label>
+  <label>Password <input name="password" type="password" autocomplete="new-password" minlength="8" required></label>${opts.inviteRequired ? `\n  <label>Invite code <input name="invite" autocomplete="off" required></label>` : ""}`,
+        alt: opts.first ? undefined : `<p class="alt">Have an account? <a href="${SIGN_IN_PATH}${next}">Sign in</a></p>`,
+    });
+}

package/dist/core/signup.d.ts

@@ -0,0 +1,15 @@
+export type SignupPolicy = {
+    /** Can anyone reach the sign-up page right now? */
+    allowed: boolean;
+    /** Is an invite code required on the form? */
+    inviteRequired: boolean;
+    /** Why it is allowed. "first" skips the invite code: there is nobody to invite you. */
+    reason: "open" | "first" | "closed";
+};
+export declare function signupPolicy(env: {
+    AUTH_SIGNUP?: string;
+    AUTH_INVITE_CODE?: string;
+}, userCount: number): SignupPolicy;
+export declare const USERNAME_RE: RegExp;
+/** Returns an error message, or null when the pair is acceptable. */
+export declare function validateCredentials(username: string, password: string): string | null;

package/dist/core/signup.js

@@ -0,0 +1,26 @@
+// ─────────────────────────────────────────────────────────────
+// Sign-up policy. One pure function, so it can be tested and read.
+//
+//   AUTH_SIGNUP=open          anyone may register at /auth/sign-up
+//   AUTH_INVITE_CODE=<code>   with "open": the form also needs this code
+//   (unset)                   closed, EXCEPT when there are no users yet,
+//                             so a fresh install can create its first
+//                             account in the browser instead of the CLI
+// ─────────────────────────────────────────────────────────────
+export function signupPolicy(env, userCount) {
+    if (userCount === 0)
+        return { allowed: true, inviteRequired: false, reason: "first" };
+    if (env.AUTH_SIGNUP === "open") {
+        return { allowed: true, inviteRequired: Boolean(env.AUTH_INVITE_CODE), reason: "open" };
+    }
+    return { allowed: false, inviteRequired: false, reason: "closed" };
+}
+export const USERNAME_RE = /^[a-z0-9][a-z0-9._-]{1,31}$/i;
+/** Returns an error message, or null when the pair is acceptable. */
+export function validateCredentials(username, password) {
+    if (!USERNAME_RE.test(username))
+        return "Username: 2 to 32 letters, numbers, dots, dashes or underscores.";
+    if (password.length < 8)
+        return "Password must be at least 8 characters.";
+    return null;
+}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { hashPassword, verifyPassword } from "./core/password.ts";
 export { signSession, verifySession, type User } from "./core/session.ts";
 export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.ts";
-export { signInPage } from "./core/html.ts";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";
+export { signInPage, signUpPage } from "./core/html.ts";
+export { signupPolicy, validateCredentials, type SignupPolicy } from "./core/signup.ts";
+export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";

package/dist/index.js

@@ -3,5 +3,6 @@
 export { hashPassword, verifyPassword } from "./core/password.js";
 export { signSession, verifySession } from "./core/session.js";
 export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.js";
-export { signInPage } from "./core/html.js";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, getSecret, getDatabaseUrl } from "./core/config.js";
+export { signInPage, signUpPage } from "./core/html.js";
+export { signupPolicy, validateCredentials } from "./core/signup.js";
+export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";

package/dist/next/index.js

@@ -7,6 +7,8 @@
 // Serves:
 //   GET  /auth/sign-in    the sign-in page
 //   POST /auth/sign-in    verify, set cookie, redirect to ?next or /
+//   GET  /auth/sign-up    the sign-up page (see core/signup.ts for when)
+//   POST /auth/sign-up    create user, set cookie, redirect
 //   GET  /auth/sign-out   clear cookie, redirect to sign-in
 //   POST /auth/sign-out   same (for fetch callers)
 //   GET  /auth/session    { user } or { user: null }
@@ -17,11 +19,12 @@
 // ─────────────────────────────────────────────────────────────
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
-import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, getSecret } from "../core/config.js";
+import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_UP_PATH, getSecret } from "../core/config.js";
 import { signSession, verifySession } from "../core/session.js";
-import { verifyPassword } from "../core/password.js";
-import { findUser } from "../core/db.js";
-import { signInPage } from "../core/html.js";
+import { hashPassword, verifyPassword } from "../core/password.js";
+import { countUsers, createUser, findUser } from "../core/db.js";
+import { signInPage, signUpPage } from "../core/html.js";
+import { signupPolicy, validateCredentials } from "../core/signup.js";
 export class AuthError extends Error {
     status = 401;
     constructor(message = "Unauthorized") {
@@ -67,18 +70,37 @@ function html(body, status = 200) {
 }
 async function readBody(req) {
     const type = req.headers.get("content-type") ?? "";
-    if (type.includes("application/json")) {
-        const b = (await req.json().catch(() => ({})));
-        return { username: String(b.username ?? ""), password: String(b.password ?? ""), next: safeNext(String(b.next ?? "")), json: true };
-    }
-    const f = await req.formData();
+    const get = (b, k) => String((b instanceof FormData ? b.get(k) : b[k]) ?? "");
+    const b = type.includes("application/json")
+        ? (await req.json().catch(() => ({})))
+        : await req.formData();
     return {
-        username: String(f.get("username") ?? ""),
-        password: String(f.get("password") ?? ""),
-        next: safeNext(String(f.get("next") ?? "")),
-        json: false,
+        username: get(b, "username").trim(),
+        password: get(b, "password"),
+        invite: get(b, "invite").trim(),
+        next: safeNext(get(b, "next")),
+        json: type.includes("application/json"),
     };
 }
+async function currentUser(req) {
+    const token = req.cookies.get(COOKIE_NAME)?.value;
+    return token ? verifySession(token, getSecret()) : null;
+}
+/** Sign the user in on a response: cookie + redirect (form) or JSON (fetch). */
+async function signedIn(req, user, next, json) {
+    const token = await signSession(user, getSecret());
+    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
+    res.cookies.set(COOKIE_NAME, token, cookieOptions());
+    return res;
+}
+/** Back to a form with ?error=<msg>, keeping ?next. */
+function backTo(req, path, error, next) {
+    const url = new URL(path, req.url);
+    url.searchParams.set("error", error);
+    if (next !== "/")
+        url.searchParams.set("next", next);
+    return NextResponse.redirect(url, 303);
+}
 function signOutResponse(req, json) {
     const res = json
         ? NextResponse.json({ ok: true })
@@ -86,26 +108,37 @@ function signOutResponse(req, json) {
     res.cookies.set(COOKIE_NAME, "", { ...cookieOptions(), maxAge: 0 });
     return res;
 }
+async function policy() {
+    return signupPolicy(process.env, await countUsers());
+}
 // ── handlers ──────────────────────────────────────────────────
 export async function GET(req, ctx) {
     const { path } = await ctx.params;
     const route = path.join("/");
+    const q = req.nextUrl.searchParams;
+    const next = safeNext(q.get("next"));
     if (route === "sign-in") {
-        const next = safeNext(req.nextUrl.searchParams.get("next"));
-        const existing = req.cookies.get(COOKIE_NAME)?.value;
-        if (existing && (await verifySession(existing, getSecret()))) {
+        if (await currentUser(req))
             return NextResponse.redirect(new URL(next, req.url));
-        }
-        const error = req.nextUrl.searchParams.get("error") ? "Wrong username or password." : undefined;
-        return html(signInPage({ next, error }));
+        const p = await policy();
+        // A fresh install has nobody to sign in: go straight to creating the first account.
+        if (p.reason === "first")
+            return NextResponse.redirect(new URL(SIGN_UP_PATH, req.url));
+        const error = q.get("error") === "1" ? "Wrong username or password." : (q.get("error") ?? undefined);
+        return html(signInPage({ next, error, canSignUp: p.allowed }));
+    }
+    if (route === "sign-up") {
+        if (await currentUser(req))
+            return NextResponse.redirect(new URL(next, req.url));
+        const p = await policy();
+        if (!p.allowed)
+            return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
+        return html(signUpPage({ next, error: q.get("error") ?? undefined, inviteRequired: p.inviteRequired, first: p.reason === "first" }));
     }
     if (route === "sign-out")
         return signOutResponse(req, false);
-    if (route === "session") {
-        const token = req.cookies.get(COOKIE_NAME)?.value;
-        const user = token ? await verifySession(token, getSecret()) : null;
-        return NextResponse.json({ user });
-    }
+    if (route === "session")
+        return NextResponse.json({ user: await currentUser(req) });
     return NextResponse.json({ error: "Not found" }, { status: 404 });
 }
 export async function POST(req, ctx) {
@@ -113,23 +146,32 @@ export async function POST(req, ctx) {
     const route = path.join("/");
     if (route === "sign-out")
         return signOutResponse(req, true);
-    if (route !== "sign-in")
-        return NextResponse.json({ error: "Not found" }, { status: 404 });
-    const { username, password, next, json } = await readBody(req);
-    const row = username && password ? await findUser(username.trim()) : null;
-    const ok = row ? await verifyPassword(password, row.password_hash) : false;
-    if (!row || !ok) {
-        if (json)
-            return NextResponse.json({ error: "Wrong username or password" }, { status: 401 });
-        const url = new URL(SIGN_IN_PATH, req.url);
-        url.searchParams.set("error", "1");
-        if (next !== "/")
-            url.searchParams.set("next", next);
-        return NextResponse.redirect(url, 303);
+    if (route === "sign-in") {
+        const { username, password, next, json } = await readBody(req);
+        const row = username && password ? await findUser(username) : null;
+        const ok = row ? await verifyPassword(password, row.password_hash) : false;
+        if (!row || !ok) {
+            if (json)
+                return NextResponse.json({ error: "Wrong username or password" }, { status: 401 });
+            return backTo(req, SIGN_IN_PATH, "1", next);
+        }
+        return signedIn(req, { id: row.id, username: row.username }, next, json);
     }
-    const user = { id: row.id, username: row.username };
-    const token = await signSession(user, getSecret());
-    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
-    res.cookies.set(COOKIE_NAME, token, cookieOptions());
-    return res;
+    if (route === "sign-up") {
+        const { username, password, invite, next, json } = await readBody(req);
+        const p = await policy();
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH, msg, next);
+        if (!p.allowed)
+            return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
+        if (p.inviteRequired && invite !== process.env.AUTH_INVITE_CODE)
+            return fail("Wrong invite code.", 403);
+        const invalid = validateCredentials(username, password);
+        if (invalid)
+            return fail(invalid);
+        if (await findUser(username))
+            return fail("That username is taken.", 409);
+        const user = await createUser(username, await hashPassword(password));
+        return signedIn(req, user, next, json);
+    }
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@binary1702/auth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Username + password auth for Next.js. One command: npx @binary1702/auth",
   "type": "module",
   "repository": {
@@ -30,7 +30,8 @@
   },
   "files": [
     "dist",
-    "INSTALL.md"
+    "INSTALL.md",
+    "PROMPT.md"
   ],
   "scripts": {
     "build": "tsc",