@eaccess/auth 0.1.0

package/dist/index.cjs

@@ -0,0 +1,2632 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ActivityLogger: () => ActivityLogger,
+  AuthActivityAction: () => AuthActivityAction,
+  AuthError: () => AuthError,
+  AuthRole: () => AuthRole,
+  AuthStatus: () => AuthStatus,
+  AzureProvider: () => AzureProvider,
+  BaseOAuthProvider: () => BaseOAuthProvider,
+  ConfirmationExpiredError: () => ConfirmationExpiredError,
+  ConfirmationNotFoundError: () => ConfirmationNotFoundError,
+  EmailNotVerifiedError: () => EmailNotVerifiedError,
+  EmailTakenError: () => EmailTakenError,
+  GitHubProvider: () => GitHubProvider,
+  GoogleProvider: () => GoogleProvider,
+  InvalidBackupCodeError: () => InvalidBackupCodeError,
+  InvalidEmailError: () => InvalidEmailError,
+  InvalidPasswordError: () => InvalidPasswordError,
+  InvalidTokenError: () => InvalidTokenError,
+  InvalidTwoFactorCodeError: () => InvalidTwoFactorCodeError,
+  OtpProvider: () => OtpProvider,
+  ResetDisabledError: () => ResetDisabledError,
+  ResetExpiredError: () => ResetExpiredError,
+  ResetNotFoundError: () => ResetNotFoundError,
+  SecondFactorRequiredError: () => SecondFactorRequiredError,
+  TooManyResetsError: () => TooManyResetsError,
+  TotpProvider: () => TotpProvider,
+  TwoFactorAlreadyEnabledError: () => TwoFactorAlreadyEnabledError,
+  TwoFactorExpiredError: () => TwoFactorExpiredError,
+  TwoFactorManager: () => TwoFactorManager,
+  TwoFactorMechanism: () => TwoFactorMechanism,
+  TwoFactorNotSetupError: () => TwoFactorNotSetupError,
+  TwoFactorSetupIncompleteError: () => TwoFactorSetupIncompleteError,
+  UserInactiveError: () => UserInactiveError,
+  UserNotFoundError: () => UserNotFoundError,
+  UserNotLoggedInError: () => UserNotLoggedInError,
+  cleanupExpiredTokens: () => cleanupExpiredTokens,
+  createAuthMiddleware: () => createAuthMiddleware,
+  createAuthTables: () => createAuthTables,
+  dropAuthTables: () => dropAuthTables,
+  getAuthTableStats: () => getAuthTableStats,
+  isValidEmail: () => isValidEmail,
+  validateEmail: () => validateEmail
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/auth-admin-manager.ts
+var import_hash = require("@prsm/hash");
+var import_ms = __toESM(require("@prsm/ms"), 1);
+
+// src/types.ts
+var import_express_session = require("express-session");
+var TwoFactorMechanism = /* @__PURE__ */ ((TwoFactorMechanism2) => {
+  TwoFactorMechanism2[TwoFactorMechanism2["TOTP"] = 1] = "TOTP";
+  TwoFactorMechanism2[TwoFactorMechanism2["EMAIL"] = 2] = "EMAIL";
+  TwoFactorMechanism2[TwoFactorMechanism2["SMS"] = 3] = "SMS";
+  return TwoFactorMechanism2;
+})(TwoFactorMechanism || {});
+var AuthStatus = {
+  Normal: 0,
+  Archived: 1,
+  Banned: 2,
+  Locked: 3,
+  PendingReview: 4,
+  Suspended: 5
+};
+var AuthRole = {
+  Admin: 1,
+  Author: 2,
+  Collaborator: 4,
+  Consultant: 8,
+  Consumer: 16,
+  Contributor: 32,
+  Coordinator: 64,
+  Creator: 128,
+  Developer: 256,
+  Director: 512,
+  Editor: 1024,
+  Employee: 2048,
+  Maintainer: 4096,
+  Manager: 8192,
+  Moderator: 16384,
+  Publisher: 32768,
+  Reviewer: 65536,
+  Subscriber: 131072,
+  SuperAdmin: 262144,
+  SuperEditor: 524288,
+  SuperModerator: 1048576,
+  Translator: 2097152
+};
+var AuthActivityAction = {
+  Login: "login",
+  Logout: "logout",
+  FailedLogin: "failed_login",
+  Register: "register",
+  EmailConfirmed: "email_confirmed",
+  PasswordResetRequested: "password_reset_requested",
+  PasswordResetCompleted: "password_reset_completed",
+  PasswordChanged: "password_changed",
+  EmailChanged: "email_changed",
+  RoleChanged: "role_changed",
+  StatusChanged: "status_changed",
+  ForceLogout: "force_logout",
+  OAuthConnected: "oauth_connected",
+  RememberTokenCreated: "remember_token_created",
+  TwoFactorSetup: "two_factor_setup",
+  TwoFactorVerified: "two_factor_verified",
+  TwoFactorFailed: "two_factor_failed",
+  TwoFactorDisabled: "two_factor_disabled",
+  BackupCodeUsed: "backup_code_used"
+};
+
+// src/queries.ts
+var AuthQueries = class {
+  constructor(config) {
+    this.db = config.db;
+    this.tablePrefix = config.tablePrefix || "user_";
+  }
+  get accountsTable() {
+    return `${this.tablePrefix}accounts`;
+  }
+  get confirmationsTable() {
+    return `${this.tablePrefix}confirmations`;
+  }
+  get remembersTable() {
+    return `${this.tablePrefix}remembers`;
+  }
+  get resetsTable() {
+    return `${this.tablePrefix}resets`;
+  }
+  get providersTable() {
+    return `${this.tablePrefix}providers`;
+  }
+  get twoFactorMethodsTable() {
+    return `${this.tablePrefix}2fa_methods`;
+  }
+  get twoFactorTokensTable() {
+    return `${this.tablePrefix}2fa_tokens`;
+  }
+  async findAccountById(id) {
+    const sql = `SELECT * FROM ${this.accountsTable} WHERE id = $1`;
+    const result = await this.db.query(sql, [id]);
+    return result.rows[0] || null;
+  }
+  async findAccountByUserId(userId) {
+    const sql = `SELECT * FROM ${this.accountsTable} WHERE user_id = $1`;
+    const result = await this.db.query(sql, [userId]);
+    return result.rows[0] || null;
+  }
+  async findAccountByEmail(email) {
+    const sql = `SELECT * FROM ${this.accountsTable} WHERE email = $1`;
+    const result = await this.db.query(sql, [email]);
+    return result.rows[0] || null;
+  }
+  async createAccount(data) {
+    const sql = `
+      INSERT INTO ${this.accountsTable} (
+        user_id, email, password, verified, status, rolemask, 
+        force_logout, resettable, registered
+      )
+      VALUES ($1, $2, $3, $4, $5, $6, 0, true, NOW())
+      RETURNING *
+    `;
+    const result = await this.db.query(sql, [data.userId, data.email, data.password, data.verified, data.status, data.rolemask]);
+    return result.rows[0];
+  }
+  async updateAccount(id, updates) {
+    const fields = [];
+    const values = [];
+    let paramIndex = 1;
+    for (const [key, value] of Object.entries(updates)) {
+      if (key === "id") continue;
+      fields.push(`${key} = $${paramIndex++}`);
+      values.push(value);
+    }
+    if (fields.length === 0) return;
+    values.push(id);
+    const sql = `UPDATE ${this.accountsTable} SET ${fields.join(", ")} WHERE id = $${paramIndex}`;
+    await this.db.query(sql, values);
+  }
+  async updateAccountLastLogin(id) {
+    const sql = `UPDATE ${this.accountsTable} SET last_login = NOW() WHERE id = $1`;
+    await this.db.query(sql, [id]);
+  }
+  async incrementForceLogout(id) {
+    const sql = `UPDATE ${this.accountsTable} SET force_logout = force_logout + 1 WHERE id = $1`;
+    await this.db.query(sql, [id]);
+  }
+  async deleteAccount(id) {
+    await this.db.query(`DELETE FROM ${this.twoFactorTokensTable} WHERE account_id = $1`, [id]);
+    await this.db.query(`DELETE FROM ${this.twoFactorMethodsTable} WHERE account_id = $1`, [id]);
+    await this.db.query(`DELETE FROM ${this.providersTable} WHERE account_id = $1`, [id]);
+    await this.db.query(`DELETE FROM ${this.confirmationsTable} WHERE account_id = $1`, [id]);
+    await this.db.query(`DELETE FROM ${this.remembersTable} WHERE account_id = $1`, [id]);
+    await this.db.query(`DELETE FROM ${this.resetsTable} WHERE account_id = $1`, [id]);
+    await this.db.query(`DELETE FROM ${this.accountsTable} WHERE id = $1`, [id]);
+  }
+  async createConfirmation(data) {
+    await this.db.query(`DELETE FROM ${this.confirmationsTable} WHERE account_id = $1`, [data.accountId]);
+    const sql = `
+      INSERT INTO ${this.confirmationsTable} (account_id, token, email, expires)
+      VALUES ($1, $2, $3, $4)
+    `;
+    await this.db.query(sql, [data.accountId, data.token, data.email, data.expires]);
+  }
+  async findConfirmation(token) {
+    const sql = `SELECT * FROM ${this.confirmationsTable} WHERE token = $1`;
+    const result = await this.db.query(sql, [token]);
+    return result.rows[0] || null;
+  }
+  async findLatestConfirmationForAccount(accountId) {
+    const sql = `
+      SELECT * FROM ${this.confirmationsTable} 
+      WHERE account_id = $1 
+      ORDER BY expires DESC 
+      LIMIT 1
+    `;
+    const result = await this.db.query(sql, [accountId]);
+    return result.rows[0] || null;
+  }
+  async deleteConfirmation(token) {
+    await this.db.query(`DELETE FROM ${this.confirmationsTable} WHERE token = $1`, [token]);
+  }
+  async createRememberToken(data) {
+    await this.db.query(`DELETE FROM ${this.remembersTable} WHERE account_id = $1`, [data.accountId]);
+    const sql = `
+      INSERT INTO ${this.remembersTable} (account_id, token, expires)
+      VALUES ($1, $2, $3)
+    `;
+    await this.db.query(sql, [data.accountId, data.token, data.expires]);
+  }
+  async findRememberToken(token) {
+    const sql = `SELECT * FROM ${this.remembersTable} WHERE token = $1`;
+    const result = await this.db.query(sql, [token]);
+    return result.rows[0] || null;
+  }
+  async deleteRememberToken(token) {
+    await this.db.query(`DELETE FROM ${this.remembersTable} WHERE token = $1`, [token]);
+  }
+  async deleteRememberTokensForAccount(accountId) {
+    await this.db.query(`DELETE FROM ${this.remembersTable} WHERE account_id = $1`, [accountId]);
+  }
+  async deleteExpiredRememberTokensForAccount(accountId) {
+    await this.db.query(`DELETE FROM ${this.remembersTable} WHERE account_id = $1 AND expires <= NOW()`, [accountId]);
+  }
+  async createResetToken(data) {
+    const sql = `
+      INSERT INTO ${this.resetsTable} (account_id, token, expires)
+      VALUES ($1, $2, $3)
+    `;
+    await this.db.query(sql, [data.accountId, data.token, data.expires]);
+  }
+  async findResetToken(token) {
+    const sql = `
+      SELECT * FROM ${this.resetsTable} 
+      WHERE token = $1 
+      ORDER BY expires DESC 
+      LIMIT 1
+    `;
+    const result = await this.db.query(sql, [token]);
+    return result.rows[0] || null;
+  }
+  async countActiveResetTokensForAccount(accountId) {
+    const sql = `
+      SELECT COUNT(*) as count FROM ${this.resetsTable} 
+      WHERE account_id = $1 AND expires >= NOW()
+    `;
+    const result = await this.db.query(sql, [accountId]);
+    return parseInt(result.rows[0]?.count || "0");
+  }
+  async deleteResetToken(token) {
+    await this.db.query(`DELETE FROM ${this.resetsTable} WHERE token = $1`, [token]);
+  }
+  async deleteResetTokensForAccount(accountId) {
+    await this.db.query(`DELETE FROM ${this.resetsTable} WHERE account_id = $1`, [accountId]);
+  }
+  async createProvider(data) {
+    const sql = `
+      INSERT INTO ${this.providersTable} (
+        account_id, provider, provider_id, provider_email, 
+        provider_username, provider_name, provider_avatar
+      )
+      VALUES ($1, $2, $3, $4, $5, $6, $7)
+      RETURNING *
+    `;
+    const result = await this.db.query(sql, [data.accountId, data.provider, data.providerId, data.providerEmail, data.providerUsername, data.providerName, data.providerAvatar]);
+    return result.rows[0];
+  }
+  async findProviderByProviderIdAndType(providerId, provider) {
+    const sql = `SELECT * FROM ${this.providersTable} WHERE provider_id = $1 AND provider = $2`;
+    const result = await this.db.query(sql, [providerId, provider]);
+    return result.rows[0] || null;
+  }
+  async findProvidersByAccountId(accountId) {
+    const sql = `SELECT * FROM ${this.providersTable} WHERE account_id = $1 ORDER BY created_at DESC`;
+    const result = await this.db.query(sql, [accountId]);
+    return result.rows;
+  }
+  async deleteProvider(id) {
+    await this.db.query(`DELETE FROM ${this.providersTable} WHERE id = $1`, [id]);
+  }
+  async deleteProvidersByAccountId(accountId) {
+    await this.db.query(`DELETE FROM ${this.providersTable} WHERE account_id = $1`, [accountId]);
+  }
+  // two-factor authentication methods
+  async findTwoFactorMethodsByAccountId(accountId) {
+    const sql = `SELECT * FROM ${this.twoFactorMethodsTable} WHERE account_id = $1 ORDER BY created_at DESC`;
+    const result = await this.db.query(sql, [accountId]);
+    return result.rows;
+  }
+  async findTwoFactorMethodByAccountAndMechanism(accountId, mechanism) {
+    const sql = `SELECT * FROM ${this.twoFactorMethodsTable} WHERE account_id = $1 AND mechanism = $2`;
+    const result = await this.db.query(sql, [accountId, mechanism]);
+    return result.rows[0] || null;
+  }
+  async createTwoFactorMethod(data) {
+    const sql = `
+      INSERT INTO ${this.twoFactorMethodsTable} (
+        account_id, mechanism, secret, backup_codes, verified
+      )
+      VALUES ($1, $2, $3, $4, $5)
+      RETURNING *
+    `;
+    const result = await this.db.query(sql, [data.accountId, data.mechanism, data.secret || null, data.backupCodes || null, data.verified || false]);
+    return result.rows[0];
+  }
+  async updateTwoFactorMethod(id, updates) {
+    const fields = [];
+    const values = [];
+    let paramIndex = 1;
+    for (const [key, value] of Object.entries(updates)) {
+      if (key === "id") continue;
+      fields.push(`${key} = $${paramIndex++}`);
+      values.push(value);
+    }
+    if (fields.length === 0) return;
+    values.push(id);
+    const sql = `UPDATE ${this.twoFactorMethodsTable} SET ${fields.join(", ")} WHERE id = $${paramIndex}`;
+    await this.db.query(sql, values);
+  }
+  async deleteTwoFactorMethod(id) {
+    await this.db.query(`DELETE FROM ${this.twoFactorMethodsTable} WHERE id = $1`, [id]);
+  }
+  async deleteTwoFactorMethodsByAccountId(accountId) {
+    await this.db.query(`DELETE FROM ${this.twoFactorMethodsTable} WHERE account_id = $1`, [accountId]);
+  }
+  // two-factor authentication tokens
+  async createTwoFactorToken(data) {
+    const sql = `
+      INSERT INTO ${this.twoFactorTokensTable} (
+        account_id, mechanism, selector, token_hash, expires_at
+      )
+      VALUES ($1, $2, $3, $4, $5)
+      RETURNING *
+    `;
+    const result = await this.db.query(sql, [data.accountId, data.mechanism, data.selector, data.tokenHash, data.expiresAt]);
+    return result.rows[0];
+  }
+  async findTwoFactorTokenBySelector(selector) {
+    const sql = `SELECT * FROM ${this.twoFactorTokensTable} WHERE selector = $1 AND expires_at > NOW()`;
+    const result = await this.db.query(sql, [selector]);
+    return result.rows[0] || null;
+  }
+  async deleteTwoFactorToken(id) {
+    await this.db.query(`DELETE FROM ${this.twoFactorTokensTable} WHERE id = $1`, [id]);
+  }
+  async deleteTwoFactorTokensByAccountId(accountId) {
+    await this.db.query(`DELETE FROM ${this.twoFactorTokensTable} WHERE account_id = $1`, [accountId]);
+  }
+  async deleteTwoFactorTokensByAccountAndMechanism(accountId, mechanism) {
+    await this.db.query(`DELETE FROM ${this.twoFactorTokensTable} WHERE account_id = $1 AND mechanism = $2`, [accountId, mechanism]);
+  }
+};
+
+// src/errors.ts
+var AuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = this.constructor.name;
+  }
+};
+var ConfirmationExpiredError = class extends AuthError {
+  constructor() {
+    super("Confirmation token has expired");
+  }
+};
+var ConfirmationNotFoundError = class extends AuthError {
+  constructor() {
+    super("Confirmation token not found");
+  }
+};
+var EmailNotVerifiedError = class extends AuthError {
+  constructor() {
+    super("Email address has not been verified");
+  }
+};
+var EmailTakenError = class extends AuthError {
+  constructor() {
+    super("Email address is already in use");
+  }
+};
+var InvalidEmailError = class extends AuthError {
+  constructor() {
+    super("Invalid email address format");
+  }
+};
+var InvalidPasswordError = class extends AuthError {
+  constructor() {
+    super("Invalid password");
+  }
+};
+var InvalidTokenError = class extends AuthError {
+  constructor() {
+    super("Invalid token");
+  }
+};
+var ResetDisabledError = class extends AuthError {
+  constructor() {
+    super("Password reset is disabled for this account");
+  }
+};
+var ResetExpiredError = class extends AuthError {
+  constructor() {
+    super("Password reset token has expired");
+  }
+};
+var ResetNotFoundError = class extends AuthError {
+  constructor() {
+    super("Password reset token not found");
+  }
+};
+var TooManyResetsError = class extends AuthError {
+  constructor() {
+    super("Too many password reset requests");
+  }
+};
+var UserInactiveError = class extends AuthError {
+  constructor() {
+    super("User account is inactive");
+  }
+};
+var UserNotFoundError = class extends AuthError {
+  constructor() {
+    super("User not found");
+  }
+};
+var UserNotLoggedInError = class extends AuthError {
+  constructor() {
+    super("User is not logged in");
+  }
+};
+var SecondFactorRequiredError = class extends AuthError {
+  constructor(availableMethods) {
+    super("Second factor authentication required");
+    this.availableMethods = availableMethods;
+  }
+};
+var InvalidTwoFactorCodeError = class extends AuthError {
+  constructor() {
+    super("Invalid two-factor authentication code");
+  }
+};
+var TwoFactorExpiredError = class extends AuthError {
+  constructor() {
+    super("Two-factor authentication session has expired");
+  }
+};
+var TwoFactorNotSetupError = class extends AuthError {
+  constructor() {
+    super("Two-factor authentication is not set up for this account");
+  }
+};
+var TwoFactorAlreadyEnabledError = class extends AuthError {
+  constructor() {
+    super("Two-factor authentication is already enabled for this mechanism");
+  }
+};
+var InvalidBackupCodeError = class extends AuthError {
+  constructor() {
+    super("Invalid backup code");
+  }
+};
+var TwoFactorSetupIncompleteError = class extends AuthError {
+  constructor() {
+    super("Two-factor authentication setup is not complete");
+  }
+};
+
+// src/util.ts
+var isValidEmail = (email) => {
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  return emailRegex.test(email);
+};
+var validateEmail = (email) => {
+  if (typeof email !== "string") {
+    throw new InvalidEmailError();
+  }
+  if (!email.trim()) {
+    throw new InvalidEmailError();
+  }
+  if (!isValidEmail(email)) {
+    throw new InvalidEmailError();
+  }
+};
+var createMapFromEnum = (enumObj) => Object.fromEntries(Object.entries(enumObj).map(([key, value]) => [value, key]));
+
+// src/auth-admin-manager.ts
+var AuthAdminManager = class {
+  constructor(req, res, config, auth) {
+    this.req = req;
+    this.res = res;
+    this.config = config;
+    this.queries = new AuthQueries(config);
+    this.auth = auth;
+  }
+  validatePassword(password) {
+    const minLength = this.config.minPasswordLength || 8;
+    const maxLength = this.config.maxPasswordLength || 64;
+    if (typeof password !== "string") {
+      throw new InvalidPasswordError();
+    }
+    if (password.length < minLength) {
+      throw new InvalidPasswordError();
+    }
+    if (password.length > maxLength) {
+      throw new InvalidPasswordError();
+    }
+  }
+  generateAutoUserId() {
+    return crypto.randomUUID();
+  }
+  async findAccountByIdentifier(identifier) {
+    if (identifier.accountId !== void 0) {
+      return await this.queries.findAccountById(identifier.accountId);
+    } else if (identifier.email !== void 0) {
+      return await this.queries.findAccountByEmail(identifier.email);
+    } else if (identifier.userId !== void 0) {
+      return await this.queries.findAccountByUserId(identifier.userId);
+    }
+    return null;
+  }
+  async createConfirmationToken(account, email, callback) {
+    const token = import_hash.hash.encode(email);
+    const expires = new Date(Date.now() + 1e3 * 60 * 60 * 24 * 7);
+    await this.queries.createConfirmation({
+      accountId: account.id,
+      token,
+      email,
+      expires
+    });
+    if (callback) {
+      callback(token);
+    }
+  }
+  /**
+   * Create a new user account (admin function).
+   *
+   * @param credentials - Email and password for new account
+   * @param userId - Optional user ID to link this auth account to. If not provided, a UUID will be generated automatically.
+   * @param callback - If provided, account is created unverified and callback receives confirmation token. Create a URL like /confirm/{token} and call confirmEmail() in that handler. If omitted, account is immediately verified.
+   * @returns The created account record
+   * @throws {EmailTakenError} Email is already registered
+   * @throws {InvalidPasswordError} Password doesn't meet length requirements
+   */
+  async createUser(credentials, userId, callback) {
+    validateEmail(credentials.email);
+    this.validatePassword(credentials.password);
+    const existing = await this.queries.findAccountByEmail(credentials.email);
+    if (existing) {
+      throw new EmailTakenError();
+    }
+    const finalUserId = userId || this.generateAutoUserId();
+    const hashedPassword = import_hash.hash.encode(credentials.password);
+    const verified = typeof callback !== "function";
+    const account = await this.queries.createAccount({
+      userId: finalUserId,
+      email: credentials.email,
+      password: hashedPassword,
+      verified,
+      status: AuthStatus.Normal,
+      rolemask: 0
+    });
+    if (!verified && callback) {
+      await this.createConfirmationToken(account, credentials.email, callback);
+    }
+    return account;
+  }
+  /**
+   * Log in as another user (admin function).
+   * Creates a new session as the target user without requiring their password.
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @throws {UserNotFoundError} No account matches the identifier
+   */
+  async loginAsUserBy(identifier) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    await this.auth.onLoginSuccessful(account, false);
+  }
+  /**
+   * Delete a user account and all associated data (admin function).
+   * Removes account, confirmations, remember tokens, and reset tokens.
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @throws {UserNotFoundError} No account matches the identifier
+   */
+  async deleteUserBy(identifier) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    await this.queries.deleteAccount(account.id);
+  }
+  /**
+   * Add a role to a user's account (admin function).
+   * Uses bitwise OR to add role to existing rolemask.
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @param role - Role bitmask to add (e.g., AuthRole.Admin)
+   * @throws {UserNotFoundError} No account matches the identifier
+   */
+  async addRoleForUserBy(identifier, role) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    const rolemask = account.rolemask | role;
+    await this.queries.updateAccount(account.id, { rolemask });
+  }
+  /**
+   * Remove a role from a user's account (admin function).
+   * Uses bitwise operations to remove role from rolemask.
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @param role - Role bitmask to remove (e.g., AuthRole.Admin)
+   * @throws {UserNotFoundError} No account matches the identifier
+   */
+  async removeRoleForUserBy(identifier, role) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    const rolemask = account.rolemask & ~role;
+    await this.queries.updateAccount(account.id, { rolemask });
+  }
+  /**
+   * Check if a user has a specific role (admin function).
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @param role - Role bitmask to check (e.g., AuthRole.Admin)
+   * @returns true if user has the role, false otherwise
+   * @throws {UserNotFoundError} No account matches the identifier
+   */
+  async hasRoleForUserBy(identifier, role) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    return (account.rolemask & role) === role;
+  }
+  /**
+   * Change a user's password (admin function).
+   * Does not require knowing the current password.
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @param password - New password (will be hashed)
+   * @throws {UserNotFoundError} No account matches the identifier
+   * @throws {InvalidPasswordError} New password doesn't meet requirements
+   */
+  async changePasswordForUserBy(identifier, password) {
+    this.validatePassword(password);
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    await this.queries.updateAccount(account.id, {
+      password: import_hash.hash.encode(password)
+    });
+  }
+  /**
+   * Change a user's account status (admin function).
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @param status - New status (0=Normal, 1=Archived, 2=Banned, 3=Locked, etc.)
+   * @throws {UserNotFoundError} No account matches the identifier
+   */
+  async setStatusForUserBy(identifier, status) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    await this.queries.updateAccount(account.id, { status });
+  }
+  /**
+   * Initiate password reset for a user (admin function).
+   * Creates a reset token without rate limiting.
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @param expiresAfter - Token expiration (default: 6h). Accepts ms format like '1h', '30m'
+   * @param callback - Called with reset token. Create a URL like /reset/{token} and call confirmResetPassword() in that handler
+   * @throws {UserNotFoundError} No account matches the identifier
+   * @throws {EmailNotVerifiedError} Account exists but email is not verified
+   */
+  async initiatePasswordResetForUserBy(identifier, expiresAfter = null, callback) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    if (!account.verified) {
+      throw new EmailNotVerifiedError();
+    }
+    const expiry = !expiresAfter ? (0, import_ms.default)("6h") : (0, import_ms.default)(expiresAfter);
+    const token = import_hash.hash.encode(account.email);
+    const expires = new Date(Date.now() + expiry);
+    await this.queries.createResetToken({
+      accountId: account.id,
+      token,
+      expires
+    });
+    if (callback) {
+      callback(token);
+    }
+  }
+  /**
+   * Force logout all sessions for a specific user (admin function).
+   * Increments force_logout counter and deletes all remember tokens.
+   * If target user is currently logged in, marks their session for logout.
+   *
+   * @param identifier - Find user by accountId, email, or userId
+   * @throws {UserNotFoundError} No account matches the identifier
+   */
+  async forceLogoutForUserBy(identifier) {
+    const account = await this.findAccountByIdentifier(identifier);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    await this.queries.incrementForceLogout(account.id);
+    if (this.auth.getId() === account.id) {
+      this.req.session.auth.shouldForceLogout = true;
+    }
+  }
+};
+
+// src/auth-manager.ts
+var import_hash4 = require("@prsm/hash");
+var import_ms3 = __toESM(require("@prsm/ms"), 1);
+
+// src/activity-logger.ts
+var import_bowser = __toESM(require("bowser"), 1);
+var ActivityLogger = class {
+  constructor(config) {
+    this.config = config;
+    this.enabled = config.activityLog?.enabled !== false;
+    this.maxEntries = config.activityLog?.maxEntries || 1e4;
+    this.allowedActions = config.activityLog?.actions || null;
+    this.tablePrefix = config.tablePrefix || "user_";
+  }
+  get activityTable() {
+    return `${this.tablePrefix}activity_log`;
+  }
+  parseUserAgent(userAgent) {
+    if (!userAgent) {
+      return { browser: null, os: null, device: null };
+    }
+    try {
+      const browser = import_bowser.default.getParser(userAgent);
+      const result = browser.getResult();
+      return {
+        browser: result.browser.name || null,
+        os: result.os.name || null,
+        device: result.platform.type || "desktop"
+      };
+    } catch (error) {
+      return this.parseUserAgentSimple(userAgent);
+    }
+  }
+  parseUserAgentSimple(userAgent) {
+    let browser = null;
+    if (userAgent.includes("Chrome")) browser = "Chrome";
+    else if (userAgent.includes("Firefox")) browser = "Firefox";
+    else if (userAgent.includes("Safari")) browser = "Safari";
+    else if (userAgent.includes("Edge")) browser = "Edge";
+    let os = null;
+    if (userAgent.includes("Windows")) os = "Windows";
+    else if (userAgent.includes("Mac OS")) os = "macOS";
+    else if (userAgent.includes("Linux")) os = "Linux";
+    else if (userAgent.includes("Android")) os = "Android";
+    else if (userAgent.includes("iOS")) os = "iOS";
+    let device = "desktop";
+    if (userAgent.includes("Mobile")) device = "mobile";
+    else if (userAgent.includes("Tablet")) device = "tablet";
+    return { browser, os, device };
+  }
+  getIpAddress(req) {
+    return req.ip || req.connection?.remoteAddress || req.socket?.remoteAddress || req.connection?.socket?.remoteAddress || null;
+  }
+  async logActivity(accountId, action, req, success = true, metadata = {}) {
+    if (!this.enabled) return;
+    if (this.allowedActions && !this.allowedActions.includes(action)) {
+      return;
+    }
+    const userAgent = (typeof req.get === "function" ? req.get("User-Agent") : req.headers?.["user-agent"]) || null;
+    const ip = this.getIpAddress(req);
+    const parsed = this.parseUserAgent(userAgent);
+    try {
+      await this.config.db.query(
+        `
+        INSERT INTO ${this.activityTable} 
+        (account_id, action, ip_address, user_agent, browser, os, device, success, metadata)
+        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+        `,
+        [accountId, action, ip, userAgent, parsed.browser, parsed.os, parsed.device, success, Object.keys(metadata).length > 0 ? JSON.stringify(metadata) : null]
+      );
+      if (Math.random() < 0.01) {
+        await this.cleanup();
+      }
+    } catch (error) {
+      console.error("ActivityLogger: Failed to log activity:", error);
+    }
+  }
+  async cleanup() {
+    if (!this.enabled) return;
+    try {
+      await this.config.db.query(
+        `
+        DELETE FROM ${this.activityTable} 
+        WHERE id NOT IN (
+          SELECT id FROM ${this.activityTable} 
+          ORDER BY created_at DESC 
+          LIMIT $1
+        )
+        `,
+        [this.maxEntries]
+      );
+    } catch (error) {
+      console.error("ActivityLogger: Failed to cleanup old entries:", error);
+    }
+  }
+  async getRecentActivity(limit = 100, accountId) {
+    if (!this.enabled) return [];
+    try {
+      let sql = `
+        SELECT 
+          al.*,
+          a.email 
+        FROM ${this.activityTable} al
+        LEFT JOIN ${this.tablePrefix}accounts a ON al.account_id = a.id
+      `;
+      const params = [];
+      if (accountId !== void 0) {
+        sql += " WHERE al.account_id = $1";
+        params.push(accountId);
+      }
+      sql += ` ORDER BY al.created_at DESC LIMIT $${params.length + 1}`;
+      params.push(Math.min(limit, 1e3));
+      const result = await this.config.db.query(sql, params);
+      return result.rows.map((row) => ({
+        ...row,
+        metadata: row.metadata ? JSON.parse(row.metadata) : null
+      }));
+    } catch (error) {
+      console.error("ActivityLogger: Failed to get recent activity:", error);
+      return [];
+    }
+  }
+  async getActivityStats() {
+    if (!this.enabled) {
+      return {
+        totalEntries: 0,
+        uniqueUsers: 0,
+        recentLogins: 0,
+        failedAttempts: 0
+      };
+    }
+    try {
+      const [total, unique, recent, failed] = await Promise.all([
+        this.config.db.query(`SELECT COUNT(*) as count FROM ${this.activityTable}`),
+        this.config.db.query(`SELECT COUNT(DISTINCT account_id) as count FROM ${this.activityTable} WHERE account_id IS NOT NULL`),
+        this.config.db.query(`SELECT COUNT(*) as count FROM ${this.activityTable} WHERE action = 'login' AND created_at > NOW() - INTERVAL '24 hours'`),
+        this.config.db.query(`SELECT COUNT(*) as count FROM ${this.activityTable} WHERE success = false AND created_at > NOW() - INTERVAL '24 hours'`)
+      ]);
+      return {
+        totalEntries: parseInt(total.rows[0]?.count || "0"),
+        uniqueUsers: parseInt(unique.rows[0]?.count || "0"),
+        recentLogins: parseInt(recent.rows[0]?.count || "0"),
+        failedAttempts: parseInt(failed.rows[0]?.count || "0")
+      };
+    } catch (error) {
+      console.error("ActivityLogger: Failed to get activity stats:", error);
+      return {
+        totalEntries: 0,
+        uniqueUsers: 0,
+        recentLogins: 0,
+        failedAttempts: 0
+      };
+    }
+  }
+};
+
+// src/providers/base-provider.ts
+var BaseOAuthProvider = class {
+  constructor(config, authConfig, authManager) {
+    this.config = config;
+    this.authConfig = authConfig;
+    this.authManager = authManager;
+  }
+  async handleCallback(req) {
+    const userData = await this.getUserData(req);
+    await this.processOAuthLogin(userData, req);
+  }
+  async processOAuthLogin(userData, req) {
+    const { queries } = this.authManager;
+    const providerName = this.getProviderName();
+    const existingProvider = await queries.findProviderByProviderIdAndType(userData.id, providerName);
+    if (existingProvider) {
+      const account2 = await queries.findAccountById(existingProvider.account_id);
+      if (account2) {
+        await this.authManager.onLoginSuccessful(account2, false);
+        return;
+      }
+    }
+    if (userData.email) {
+      const existingAccount = await queries.findAccountByEmail(userData.email);
+      if (existingAccount) {
+        throw new Error("You already have an account associated with this email address.");
+      }
+    }
+    let userId;
+    if (this.authConfig.createUser) {
+      userId = await this.authConfig.createUser(userData);
+    } else {
+      userId = crypto.randomUUID();
+    }
+    const account = await queries.createAccount({
+      userId,
+      email: userData.email,
+      password: null,
+      verified: true,
+      // OAuth providers are pre-verified
+      status: 0,
+      // AuthStatus.Normal
+      rolemask: 0
+    });
+    await queries.createProvider({
+      accountId: account.id,
+      provider: providerName,
+      providerId: userData.id,
+      providerEmail: userData.email,
+      providerUsername: userData.username || null,
+      providerName: userData.name || null,
+      providerAvatar: userData.avatar || null
+    });
+    await this.authManager.onLoginSuccessful(account, false);
+  }
+  async exchangeCodeForToken(code, tokenUrl) {
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret,
+        code,
+        redirect_uri: this.config.redirectUri,
+        grant_type: "authorization_code"
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`OAuth token exchange failed: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    if (!data.access_token) {
+      throw new Error("No access token received from OAuth provider");
+    }
+    return data.access_token;
+  }
+  async fetchUserFromAPI(accessToken, apiUrl) {
+    const response = await fetch(apiUrl, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
+      }
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch user data: ${response.status} ${response.statusText}`);
+    }
+    return response.json();
+  }
+};
+
+// src/providers/github-provider.ts
+var GitHubProvider = class extends BaseOAuthProvider {
+  constructor(config, authConfig, authManager) {
+    super(config, authConfig, authManager);
+  }
+  getAuthUrl(state, scopes) {
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri,
+      scope: scopes?.join(" ") || "user:email",
+      state: state || Math.random().toString(36).substring(2),
+      response_type: "code"
+    });
+    return `https://github.com/login/oauth/authorize?${params}`;
+  }
+  async getUserData(req) {
+    const code = req.query.code;
+    if (!code) {
+      throw new Error("No authorization code provided");
+    }
+    const accessToken = await this.exchangeCodeForToken(code, "https://github.com/login/oauth/access_token");
+    const [user, emails] = await Promise.all([this.fetchUserFromAPI(accessToken, "https://api.github.com/user"), this.fetchUserFromAPI(accessToken, "https://api.github.com/user/emails")]);
+    const primaryEmail = Array.isArray(emails) ? emails.find((email) => email.primary)?.email : null;
+    if (!primaryEmail) {
+      throw new Error("No primary email found in GitHub account");
+    }
+    return {
+      id: user.id.toString(),
+      email: primaryEmail,
+      username: user.login,
+      name: user.name || user.login,
+      avatar: user.avatar_url
+    };
+  }
+  getProviderName() {
+    return "github";
+  }
+};
+
+// src/providers/google-provider.ts
+var GoogleProvider = class extends BaseOAuthProvider {
+  constructor(config, authConfig, authManager) {
+    super(config, authConfig, authManager);
+  }
+  getAuthUrl(state, scopes) {
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri,
+      scope: scopes?.join(" ") || "openid profile email",
+      state: state || Math.random().toString(36).substring(2),
+      response_type: "code",
+      access_type: "offline",
+      prompt: "consent"
+    });
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+  }
+  async getUserData(req) {
+    const code = req.query.code;
+    if (!code) {
+      throw new Error("No authorization code provided");
+    }
+    const accessToken = await this.exchangeCodeForToken(code, "https://oauth2.googleapis.com/token");
+    const user = await this.fetchUserFromAPI(accessToken, "https://www.googleapis.com/oauth2/v2/userinfo");
+    if (!user.email) {
+      throw new Error("No email found in Google account");
+    }
+    return {
+      id: user.id,
+      email: user.email,
+      username: user.email.split("@")[0],
+      // use email prefix as username
+      name: user.name,
+      avatar: user.picture
+    };
+  }
+  getProviderName() {
+    return "google";
+  }
+};
+
+// src/providers/azure-provider.ts
+var AzureProvider = class extends BaseOAuthProvider {
+  constructor(config, authConfig, authManager) {
+    super(config, authConfig, authManager);
+  }
+  getAuthUrl(state, scopes) {
+    const azureConfig = this.config;
+    const params = new URLSearchParams({
+      client_id: azureConfig.clientId,
+      redirect_uri: azureConfig.redirectUri,
+      scope: scopes?.join(" ") || "openid profile email User.Read",
+      state: state || Math.random().toString(36).substring(2),
+      response_type: "code",
+      response_mode: "query"
+    });
+    return `https://login.microsoftonline.com/${azureConfig.tenantId}/oauth2/v2.0/authorize?${params}`;
+  }
+  async getUserData(req) {
+    const code = req.query.code;
+    if (!code) {
+      throw new Error("No authorization code provided");
+    }
+    const azureConfig = this.config;
+    const accessToken = await this.exchangeCodeForToken(code, `https://login.microsoftonline.com/${azureConfig.tenantId}/oauth2/v2.0/token`);
+    const user = await this.fetchUserFromAPI(accessToken, "https://graph.microsoft.com/v1.0/me");
+    if (!user.mail && !user.userPrincipalName) {
+      throw new Error("No email found in Azure account");
+    }
+    return {
+      id: user.id,
+      email: user.mail || user.userPrincipalName,
+      username: user.mailNickname || user.userPrincipalName?.split("@")[0],
+      name: user.displayName,
+      avatar: void 0
+      // Azure doesn't provide avatar in basic profile
+    };
+  }
+  getProviderName() {
+    return "azure";
+  }
+  async exchangeCodeForToken(code, tokenUrl) {
+    const azureConfig = this.config;
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        client_id: azureConfig.clientId,
+        client_secret: azureConfig.clientSecret,
+        code,
+        redirect_uri: azureConfig.redirectUri,
+        grant_type: "authorization_code",
+        scope: "openid profile email User.Read"
+      })
+    });
+    if (!response.ok) {
+      throw new Error(`OAuth token exchange failed: ${response.status} ${response.statusText}`);
+    }
+    const data = await response.json();
+    if (!data.access_token) {
+      throw new Error("No access token received from Azure");
+    }
+    return data.access_token;
+  }
+};
+
+// src/two-factor/totp-provider.ts
+var import_totp = __toESM(require("@eaccess/totp"), 1);
+var import_hash2 = require("@prsm/hash");
+var TotpProvider = class {
+  constructor(config) {
+    this.config = config;
+  }
+  generateSecret() {
+    return import_totp.default.createSecret();
+  }
+  generateQRCode(email, secret) {
+    const issuer = this.config.twoFactor?.issuer || "EasyAccess";
+    return import_totp.default.createTotpKeyUriForQrCode(issuer, email, secret);
+  }
+  verify(secret, code) {
+    const window = this.config.twoFactor?.totpWindow || 1;
+    return import_totp.default.verifyTotp(secret, code, window);
+  }
+  generateBackupCodes(count = 10) {
+    const codes = [];
+    for (let i = 0; i < count; i++) {
+      const chars = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+      let code = "";
+      for (let j = 0; j < 8; j++) {
+        code += chars.charAt(Math.floor(Math.random() * chars.length));
+      }
+      codes.push(code);
+    }
+    return codes;
+  }
+  hashBackupCodes(codes) {
+    return codes.map((code) => import_hash2.hash.encode(code));
+  }
+  verifyBackupCode(hashedCodes, inputCode) {
+    for (let i = 0; i < hashedCodes.length; i++) {
+      if (import_hash2.hash.verify(hashedCodes[i], inputCode.toUpperCase())) {
+        return { isValid: true, index: i };
+      }
+    }
+    return { isValid: false, index: -1 };
+  }
+  maskEmail(email) {
+    const [username, domain] = email.split("@");
+    if (username.length <= 2) {
+      return `${username[0]}***@${domain}`;
+    }
+    return `${username[0]}${"*".repeat(username.length - 2)}${username[username.length - 1]}@${domain}`;
+  }
+};
+
+// src/two-factor/otp-provider.ts
+var import_ms2 = __toESM(require("@prsm/ms"), 1);
+var import_hash3 = require("@prsm/hash");
+var OtpProvider = class {
+  constructor(config) {
+    this.config = config;
+    this.queries = new AuthQueries(config);
+  }
+  generateOTP() {
+    const length = this.config.twoFactor?.codeLength || 6;
+    let otp = "";
+    for (let i = 0; i < length; i++) {
+      otp += Math.floor(Math.random() * 10).toString();
+    }
+    return otp;
+  }
+  generateSelector() {
+    const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+    let selector = "";
+    for (let i = 0; i < 32; i++) {
+      selector += chars.charAt(Math.floor(Math.random() * chars.length));
+    }
+    return selector;
+  }
+  async createAndStoreOTP(accountId, mechanism) {
+    const otp = this.generateOTP();
+    const selector = this.generateSelector();
+    const tokenHash = import_hash3.hash.encode(otp);
+    const expiryDuration = this.config.twoFactor?.tokenExpiry || "5m";
+    const expiresAt = new Date(Date.now() + (0, import_ms2.default)(expiryDuration));
+    await this.queries.deleteTwoFactorTokensByAccountAndMechanism(accountId, mechanism);
+    await this.queries.createTwoFactorToken({
+      accountId,
+      mechanism,
+      selector,
+      tokenHash,
+      expiresAt
+    });
+    return { otp, selector };
+  }
+  async verifyOTP(selector, inputCode) {
+    const token = await this.queries.findTwoFactorTokenBySelector(selector);
+    if (!token) {
+      return { isValid: false };
+    }
+    if (token.expires_at <= /* @__PURE__ */ new Date()) {
+      await this.queries.deleteTwoFactorToken(token.id);
+      return { isValid: false };
+    }
+    const isValid = import_hash3.hash.verify(token.token_hash, inputCode);
+    if (isValid) {
+      await this.queries.deleteTwoFactorToken(token.id);
+      return { isValid: true, token };
+    }
+    return { isValid: false };
+  }
+  maskPhone(phone) {
+    if (phone.length < 4) {
+      return phone.replace(/./g, "*");
+    }
+    if (phone.startsWith("+")) {
+      return phone[0] + phone[1] + "*".repeat(phone.length - 3) + phone.slice(-2);
+    }
+    return phone[0] + "*".repeat(phone.length - 3) + phone.slice(-2);
+  }
+  maskEmail(email) {
+    const [username, domain] = email.split("@");
+    if (username.length <= 2) {
+      return `${username[0]}***@${domain}`;
+    }
+    return `${username[0]}${"*".repeat(username.length - 2)}${username[username.length - 1]}@${domain}`;
+  }
+};
+
+// src/two-factor/two-factor-manager.ts
+var TwoFactorManager = class {
+  constructor(req, res, config) {
+    // setup & management
+    this.setup = {
+      totp: async (requireVerification = false) => {
+        const accountId = this.getAccountId();
+        const email = this.getEmail();
+        if (!accountId || !email) {
+          throw new UserNotLoggedInError();
+        }
+        const existingMethod = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 1 /* TOTP */);
+        if (existingMethod?.verified) {
+          throw new TwoFactorAlreadyEnabledError();
+        }
+        const secret = this.totpProvider.generateSecret();
+        const qrCode = this.totpProvider.generateQRCode(email, secret);
+        let backupCodes;
+        if (!requireVerification) {
+          const backupCodesCount = this.config.twoFactor?.backupCodesCount || 10;
+          backupCodes = this.totpProvider.generateBackupCodes(backupCodesCount);
+        }
+        const hashedBackupCodes = backupCodes ? this.totpProvider.hashBackupCodes(backupCodes) : void 0;
+        const verified = !requireVerification;
+        if (existingMethod) {
+          await this.queries.updateTwoFactorMethod(existingMethod.id, {
+            secret,
+            backup_codes: hashedBackupCodes || null,
+            verified
+          });
+        } else {
+          await this.queries.createTwoFactorMethod({
+            accountId,
+            mechanism: 1 /* TOTP */,
+            secret,
+            backupCodes: hashedBackupCodes,
+            verified
+          });
+        }
+        if (verified) {
+          await this.activityLogger.logActivity(accountId, AuthActivityAction.TwoFactorSetup, this.req, true, { mechanism: "totp" });
+        }
+        return { secret, qrCode, backupCodes };
+      },
+      email: async (email, requireVerification = false) => {
+        const accountId = this.getAccountId();
+        const userEmail = email || this.getEmail();
+        if (!accountId || !userEmail) {
+          throw new UserNotLoggedInError();
+        }
+        const existingMethod = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 2 /* EMAIL */);
+        if (existingMethod?.verified) {
+          throw new TwoFactorAlreadyEnabledError();
+        }
+        const verified = !requireVerification;
+        if (existingMethod) {
+          await this.queries.updateTwoFactorMethod(existingMethod.id, {
+            secret: userEmail,
+            verified
+          });
+        } else {
+          await this.queries.createTwoFactorMethod({
+            accountId,
+            mechanism: 2 /* EMAIL */,
+            secret: userEmail,
+            verified
+          });
+        }
+        if (verified) {
+          await this.activityLogger.logActivity(accountId, AuthActivityAction.TwoFactorSetup, this.req, true, { mechanism: "email" });
+        }
+      },
+      sms: async (phone, requireVerification = true) => {
+        const accountId = this.getAccountId();
+        if (!accountId) {
+          throw new UserNotLoggedInError();
+        }
+        const existingMethod = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 3 /* SMS */);
+        if (existingMethod?.verified) {
+          throw new TwoFactorAlreadyEnabledError();
+        }
+        const verified = !requireVerification;
+        if (existingMethod) {
+          await this.queries.updateTwoFactorMethod(existingMethod.id, {
+            secret: phone,
+            verified
+          });
+        } else {
+          await this.queries.createTwoFactorMethod({
+            accountId,
+            mechanism: 3 /* SMS */,
+            secret: phone,
+            verified
+          });
+        }
+        if (verified) {
+          await this.activityLogger.logActivity(accountId, AuthActivityAction.TwoFactorSetup, this.req, true, { mechanism: "sms" });
+        }
+      }
+    };
+    this.complete = {
+      totp: async (code) => {
+        const accountId = this.getAccountId();
+        if (!accountId) {
+          throw new UserNotLoggedInError();
+        }
+        const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 1 /* TOTP */);
+        if (!method || !method.secret) {
+          throw new TwoFactorNotSetupError();
+        }
+        if (method.verified) {
+          throw new TwoFactorAlreadyEnabledError();
+        }
+        const isValid = this.totpProvider.verify(method.secret, code);
+        if (!isValid) {
+          await this.activityLogger.logActivity(accountId, AuthActivityAction.TwoFactorFailed, this.req, false, { mechanism: "totp", reason: "invalid_code" });
+          throw new InvalidTwoFactorCodeError();
+        }
+        const backupCodesCount = this.config.twoFactor?.backupCodesCount || 10;
+        const backupCodes = this.totpProvider.generateBackupCodes(backupCodesCount);
+        const hashedBackupCodes = this.totpProvider.hashBackupCodes(backupCodes);
+        await this.queries.updateTwoFactorMethod(method.id, {
+          verified: true,
+          backup_codes: hashedBackupCodes,
+          last_used_at: /* @__PURE__ */ new Date()
+        });
+        await this.activityLogger.logActivity(accountId, AuthActivityAction.TwoFactorSetup, this.req, true, { mechanism: "totp" });
+        return backupCodes;
+      },
+      email: async (code) => {
+        await this.completeOtpSetup(2 /* EMAIL */, code);
+      },
+      sms: async (code) => {
+        await this.completeOtpSetup(3 /* SMS */, code);
+      }
+    };
+    // verification during login flow
+    this.verify = {
+      totp: async (code) => {
+        const twoFactorState = this.req.session?.auth?.awaitingTwoFactor;
+        if (!twoFactorState) {
+          throw new UserNotLoggedInError();
+        }
+        const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(twoFactorState.accountId, 1 /* TOTP */);
+        if (!method || !method.verified || !method.secret) {
+          throw new TwoFactorNotSetupError();
+        }
+        const isValid = this.totpProvider.verify(method.secret, code);
+        if (!isValid) {
+          await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.TwoFactorFailed, this.req, false, { mechanism: "totp", reason: "invalid_code" });
+          throw new InvalidTwoFactorCodeError();
+        }
+        await this.queries.updateTwoFactorMethod(method.id, {
+          last_used_at: /* @__PURE__ */ new Date()
+        });
+        await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.TwoFactorVerified, this.req, true, { mechanism: "totp" });
+      },
+      email: async (code) => {
+        await this.verifyOtp(2 /* EMAIL */, code);
+      },
+      sms: async (code) => {
+        await this.verifyOtp(3 /* SMS */, code);
+      },
+      backupCode: async (code) => {
+        const twoFactorState = this.req.session?.auth?.awaitingTwoFactor;
+        if (!twoFactorState) {
+          throw new UserNotLoggedInError();
+        }
+        const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(twoFactorState.accountId, 1 /* TOTP */);
+        if (!method || !method.verified || !method.backup_codes) {
+          throw new TwoFactorNotSetupError();
+        }
+        const { isValid, index } = this.totpProvider.verifyBackupCode(method.backup_codes, code);
+        if (!isValid) {
+          await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.TwoFactorFailed, this.req, false, { mechanism: "backup_code", reason: "invalid_code" });
+          throw new InvalidBackupCodeError();
+        }
+        const updatedBackupCodes = [...method.backup_codes];
+        updatedBackupCodes.splice(index, 1);
+        await this.queries.updateTwoFactorMethod(method.id, {
+          backup_codes: updatedBackupCodes,
+          last_used_at: /* @__PURE__ */ new Date()
+        });
+        await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.BackupCodeUsed, this.req, true, { remaining_codes: updatedBackupCodes.length });
+      },
+      otp: async (code) => {
+        const twoFactorState = this.req.session?.auth?.awaitingTwoFactor;
+        if (!twoFactorState) {
+          throw new UserNotLoggedInError();
+        }
+        const availableMechanisms = twoFactorState.availableMechanisms.filter((m) => m === 2 /* EMAIL */ || m === 3 /* SMS */);
+        if (availableMechanisms.length === 0) {
+          throw new TwoFactorNotSetupError();
+        }
+        for (const mechanism of availableMechanisms) {
+          try {
+            await this.verifyOtp(mechanism, code);
+            return;
+          } catch (error) {
+            continue;
+          }
+        }
+        await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.TwoFactorFailed, this.req, false, { mechanism: "otp", reason: "invalid_code" });
+        throw new InvalidTwoFactorCodeError();
+      }
+    };
+    this.req = req;
+    this.res = res;
+    this.config = config;
+    this.queries = new AuthQueries(config);
+    this.activityLogger = new ActivityLogger(config);
+    this.totpProvider = new TotpProvider(config);
+    this.otpProvider = new OtpProvider(config);
+  }
+  getAccountId() {
+    return this.req.session?.auth?.accountId || null;
+  }
+  getEmail() {
+    return this.req.session?.auth?.email || null;
+  }
+  // status queries
+  async isEnabled() {
+    const accountId = this.getAccountId();
+    if (!accountId) return false;
+    const methods = await this.queries.findTwoFactorMethodsByAccountId(accountId);
+    return methods.some((method) => method.verified);
+  }
+  async totpEnabled() {
+    const accountId = this.getAccountId();
+    if (!accountId) return false;
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 1 /* TOTP */);
+    return method?.verified || false;
+  }
+  async emailEnabled() {
+    const accountId = this.getAccountId();
+    if (!accountId) return false;
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 2 /* EMAIL */);
+    return method?.verified || false;
+  }
+  async smsEnabled() {
+    const accountId = this.getAccountId();
+    if (!accountId) return false;
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 3 /* SMS */);
+    return method?.verified || false;
+  }
+  async getEnabledMethods() {
+    const accountId = this.getAccountId();
+    if (!accountId) return [];
+    const methods = await this.queries.findTwoFactorMethodsByAccountId(accountId);
+    return methods.filter((method) => method.verified).map((method) => method.mechanism);
+  }
+  async completeOtpSetup(mechanism, code) {
+    const accountId = this.getAccountId();
+    if (!accountId) {
+      throw new UserNotLoggedInError();
+    }
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, mechanism);
+    if (!method) {
+      throw new TwoFactorNotSetupError();
+    }
+    if (method.verified) {
+      throw new TwoFactorAlreadyEnabledError();
+    }
+    await this.queries.updateTwoFactorMethod(method.id, {
+      verified: true,
+      last_used_at: /* @__PURE__ */ new Date()
+    });
+    await this.activityLogger.logActivity(accountId, AuthActivityAction.TwoFactorSetup, this.req, true, { mechanism: mechanism === 2 /* EMAIL */ ? "email" : "sms" });
+  }
+  async verifyOtp(mechanism, code) {
+    const twoFactorState = this.req.session?.auth?.awaitingTwoFactor;
+    if (!twoFactorState) {
+      throw new UserNotLoggedInError();
+    }
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(twoFactorState.accountId, mechanism);
+    if (!method || !method.verified) {
+      throw new TwoFactorNotSetupError();
+    }
+    const selector = mechanism === 2 /* EMAIL */ ? this.req.session?.auth?.awaitingTwoFactor?.selectors?.email : this.req.session?.auth?.awaitingTwoFactor?.selectors?.sms;
+    if (!selector) {
+      throw new InvalidTwoFactorCodeError();
+    }
+    const { isValid } = await this.otpProvider.verifyOTP(selector, code);
+    if (!isValid) {
+      await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.TwoFactorFailed, this.req, false, {
+        mechanism: mechanism === 2 /* EMAIL */ ? "email" : "sms",
+        reason: "invalid_code"
+      });
+      throw new InvalidTwoFactorCodeError();
+    }
+    await this.queries.updateTwoFactorMethod(method.id, {
+      last_used_at: /* @__PURE__ */ new Date()
+    });
+    await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.TwoFactorVerified, this.req, true, { mechanism: mechanism === 2 /* EMAIL */ ? "email" : "sms" });
+  }
+  // management
+  async disable(mechanism) {
+    const accountId = this.getAccountId();
+    if (!accountId) {
+      throw new UserNotLoggedInError();
+    }
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, mechanism);
+    if (!method) {
+      throw new TwoFactorNotSetupError();
+    }
+    await this.queries.deleteTwoFactorMethod(method.id);
+    await this.activityLogger.logActivity(accountId, AuthActivityAction.TwoFactorDisabled, this.req, true, {
+      mechanism: mechanism === 1 /* TOTP */ ? "totp" : mechanism === 2 /* EMAIL */ ? "email" : "sms"
+    });
+  }
+  async generateNewBackupCodes() {
+    const accountId = this.getAccountId();
+    if (!accountId) {
+      throw new UserNotLoggedInError();
+    }
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, 1 /* TOTP */);
+    if (!method || !method.verified) {
+      throw new TwoFactorNotSetupError();
+    }
+    const backupCodesCount = this.config.twoFactor?.backupCodesCount || 10;
+    const backupCodes = this.totpProvider.generateBackupCodes(backupCodesCount);
+    const hashedBackupCodes = this.totpProvider.hashBackupCodes(backupCodes);
+    await this.queries.updateTwoFactorMethod(method.id, {
+      backup_codes: hashedBackupCodes
+    });
+    return backupCodes;
+  }
+  async getContact(mechanism) {
+    const accountId = this.getAccountId();
+    if (!accountId) {
+      return null;
+    }
+    const method = await this.queries.findTwoFactorMethodByAccountAndMechanism(accountId, mechanism);
+    return method?.secret || null;
+  }
+  // challenge creation (used during login)
+  async createChallenge(accountId) {
+    const methods = await this.queries.findTwoFactorMethodsByAccountId(accountId);
+    const verifiedMethods = methods.filter((method) => method.verified);
+    const challenge = {
+      selectors: {}
+    };
+    for (const method of verifiedMethods) {
+      switch (method.mechanism) {
+        case 1 /* TOTP */:
+          challenge.totp = true;
+          break;
+        case 2 /* EMAIL */:
+          if (method.secret) {
+            const { otp, selector } = await this.otpProvider.createAndStoreOTP(accountId, method.mechanism);
+            challenge.email = {
+              otpValue: otp,
+              maskedContact: this.otpProvider.maskEmail(method.secret)
+            };
+            challenge.selectors.email = selector;
+          }
+          break;
+        case 3 /* SMS */:
+          if (method.secret) {
+            const { otp, selector } = await this.otpProvider.createAndStoreOTP(accountId, method.mechanism);
+            challenge.sms = {
+              otpValue: otp,
+              maskedContact: this.otpProvider.maskPhone(method.secret)
+            };
+            challenge.selectors.sms = selector;
+          }
+          break;
+      }
+    }
+    return challenge;
+  }
+};
+
+// src/auth-manager.ts
+var AuthManager = class {
+  constructor(req, res, config) {
+    this.req = req;
+    this.res = res;
+    this.config = config;
+    this.queries = new AuthQueries(config);
+    this.activityLogger = new ActivityLogger(config);
+    this.providers = this.initializeProviders();
+    this.twoFactor = new TwoFactorManager(req, res, config);
+  }
+  initializeProviders() {
+    const providers = {};
+    if (this.config.providers?.github) {
+      providers.github = new GitHubProvider(this.config.providers.github, this.config, this);
+    }
+    if (this.config.providers?.google) {
+      providers.google = new GoogleProvider(this.config.providers.google, this.config, this);
+    }
+    if (this.config.providers?.azure) {
+      providers.azure = new AzureProvider(this.config.providers.azure, this.config, this);
+    }
+    return providers;
+  }
+  generateAutoUserId() {
+    return crypto.randomUUID();
+  }
+  async shouldRequire2FA(account) {
+    const providers = await this.queries.findProvidersByAccountId(account.id);
+    const hasOAuthProviders = providers.length > 0;
+    if (hasOAuthProviders && !this.config.twoFactor?.requireForOAuth) {
+      return false;
+    }
+    return true;
+  }
+  validatePassword(password) {
+    const minLength = this.config.minPasswordLength || 8;
+    const maxLength = this.config.maxPasswordLength || 64;
+    if (typeof password !== "string") {
+      throw new InvalidPasswordError();
+    }
+    if (password.length < minLength) {
+      throw new InvalidPasswordError();
+    }
+    if (password.length > maxLength) {
+      throw new InvalidPasswordError();
+    }
+  }
+  getRoleMap() {
+    return createMapFromEnum(AuthRole);
+  }
+  getStatusMap() {
+    return createMapFromEnum(AuthStatus);
+  }
+  async getAuthAccount() {
+    if (!this.req.session?.auth?.accountId) {
+      return null;
+    }
+    return await this.queries.findAccountById(this.req.session.auth.accountId);
+  }
+  setRememberCookie(token, expires) {
+    const cookieName = this.config.rememberCookieName || "remember_token";
+    if (token === null) {
+      this.res.clearCookie(cookieName);
+    } else {
+      this.res.cookie(cookieName, token, {
+        expires,
+        httpOnly: true,
+        secure: this.req.secure
+      });
+    }
+  }
+  getRememberToken() {
+    const { cookies } = this.req;
+    if (!cookies) {
+      return { token: null };
+    }
+    const cookieName = this.config.rememberCookieName || "remember_token";
+    const token = cookies[cookieName];
+    return { token: token || null };
+  }
+  async regenerateSession() {
+    const { auth } = this.req.session;
+    return new Promise((resolve, reject) => {
+      this.req.session.regenerate((err) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        this.req.session.auth = auth;
+        resolve();
+      });
+    });
+  }
+  async resyncSession(force = false) {
+    if (!this.isLoggedIn()) {
+      return;
+    }
+    if (this.req.session.auth.shouldForceLogout) {
+      await this.logout();
+      return;
+    }
+    const interval = (0, import_ms3.default)(this.config.resyncInterval || "30s");
+    const lastResync = new Date(this.req.session.auth.lastResync);
+    if (!force && lastResync && lastResync.getTime() > Date.now() - interval) {
+      return;
+    }
+    const account = await this.getAuthAccount();
+    if (!account) {
+      await this.logout();
+      return;
+    }
+    if (account.force_logout > this.req.session.auth.forceLogout) {
+      await this.logout();
+      return;
+    }
+    this.req.session.auth.shouldForceLogout = false;
+    this.req.session.auth.email = account.email;
+    this.req.session.auth.status = account.status;
+    this.req.session.auth.rolemask = account.rolemask;
+    this.req.session.auth.verified = account.verified;
+    this.req.session.auth.lastResync = /* @__PURE__ */ new Date();
+  }
+  async processRememberDirective() {
+    if (this.isLoggedIn()) {
+      return;
+    }
+    const { token } = this.getRememberToken();
+    if (!token) {
+      return;
+    }
+    const remember = await this.queries.findRememberToken(token);
+    if (!remember) {
+      this.setRememberCookie(null, /* @__PURE__ */ new Date(0));
+      return;
+    }
+    if (/* @__PURE__ */ new Date() > remember.expires) {
+      await this.queries.deleteRememberToken(token);
+      this.setRememberCookie(null, /* @__PURE__ */ new Date(0));
+      return;
+    }
+    await this.queries.deleteExpiredRememberTokensForAccount(remember.account_id);
+    const account = await this.queries.findAccountById(remember.account_id);
+    if (!account) {
+      await this.queries.deleteRememberToken(token);
+      this.setRememberCookie(null, /* @__PURE__ */ new Date(0));
+      return;
+    }
+    await this.onLoginSuccessful(account, true);
+  }
+  async onLoginSuccessful(account, remember = false) {
+    await this.queries.updateAccountLastLogin(account.id);
+    return new Promise((resolve, reject) => {
+      if (!this.req.session?.regenerate) {
+        resolve();
+        return;
+      }
+      this.req.session.regenerate(async (err) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        const session = {
+          loggedIn: true,
+          accountId: account.id,
+          userId: account.user_id,
+          email: account.email,
+          status: account.status,
+          rolemask: account.rolemask,
+          remembered: remember,
+          lastResync: /* @__PURE__ */ new Date(),
+          lastRememberCheck: /* @__PURE__ */ new Date(),
+          forceLogout: account.force_logout,
+          verified: account.verified,
+          shouldForceLogout: false
+        };
+        this.req.session.auth = session;
+        if (remember) {
+          await this.createRememberDirective(account);
+        }
+        this.req.session.save((err2) => {
+          if (err2) {
+            reject(err2);
+            return;
+          }
+          resolve();
+        });
+      });
+    });
+  }
+  async createRememberDirective(account) {
+    const token = import_hash4.hash.encode(account.email);
+    const duration = this.config.rememberDuration || "30d";
+    const expires = new Date(Date.now() + (0, import_ms3.default)(duration));
+    await this.queries.createRememberToken({
+      accountId: account.id,
+      token,
+      expires
+    });
+    this.setRememberCookie(token, expires);
+    await this.activityLogger.logActivity(account.id, AuthActivityAction.RememberTokenCreated, this.req, true, { email: account.email, duration });
+    return token;
+  }
+  /**
+   * Check if the current user is logged in.
+   * @returns true if user has an active authenticated session
+   */
+  isLoggedIn() {
+    return this.req.session?.auth?.loggedIn ?? false;
+  }
+  /**
+   * Authenticate user with email and password.
+   * Creates a new session and optionally sets a remember token for persistent login.
+   *
+   * @param email - User's email address
+   * @param password - Plain text password
+   * @param remember - If true, sets a persistent cookie for auto-login on future visits
+   * @throws {UserNotFoundError} Account with this email doesn't exist
+   * @throws {InvalidPasswordError} Password is incorrect
+   * @throws {EmailNotVerifiedError} Account exists but email is not verified
+   * @throws {UserInactiveError} Account is banned, locked, or otherwise inactive
+   */
+  async login(email, password, remember = false) {
+    try {
+      const account = await this.queries.findAccountByEmail(email);
+      if (!account) {
+        await this.activityLogger.logActivity(null, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "account_not_found" });
+        throw new UserNotFoundError();
+      }
+      if (!account.password || !import_hash4.hash.verify(account.password, password)) {
+        await this.activityLogger.logActivity(account.id, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "invalid_password" });
+        throw new InvalidPasswordError();
+      }
+      if (!account.verified) {
+        await this.activityLogger.logActivity(account.id, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "email_not_verified" });
+        throw new EmailNotVerifiedError();
+      }
+      if (account.status !== AuthStatus.Normal) {
+        await this.activityLogger.logActivity(account.id, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "account_inactive", status: account.status });
+        throw new UserInactiveError();
+      }
+      if (this.config.twoFactor?.enabled && await this.shouldRequire2FA(account)) {
+        const twoFactorMethods = await this.queries.findTwoFactorMethodsByAccountId(account.id);
+        const enabledMethods = twoFactorMethods.filter((method) => method.verified);
+        if (enabledMethods.length > 0) {
+          const challenge = await this.twoFactor.createChallenge(account.id);
+          const expiryDuration = this.config.twoFactor?.tokenExpiry || "5m";
+          const expiresAt = new Date(Date.now() + (0, import_ms3.default)(expiryDuration));
+          this.req.session.auth = {
+            loggedIn: false,
+            accountId: 0,
+            userId: "",
+            email: "",
+            status: 0,
+            rolemask: 0,
+            remembered: false,
+            lastResync: /* @__PURE__ */ new Date(),
+            lastRememberCheck: /* @__PURE__ */ new Date(),
+            forceLogout: 0,
+            verified: false,
+            awaitingTwoFactor: {
+              accountId: account.id,
+              expiresAt,
+              remember,
+              availableMechanisms: enabledMethods.map((m) => m.mechanism),
+              attemptedMechanisms: [],
+              originalEmail: account.email,
+              selectors: challenge.selectors
+            }
+          };
+          await this.activityLogger.logActivity(account.id, AuthActivityAction.TwoFactorFailed, this.req, true, { prompt: true, mechanisms: enabledMethods.map((m) => m.mechanism) });
+          throw new SecondFactorRequiredError(challenge);
+        }
+      }
+      await this.onLoginSuccessful(account, remember);
+      await this.activityLogger.logActivity(account.id, AuthActivityAction.Login, this.req, true, { email, remember });
+    } catch (error) {
+      throw error;
+    }
+  }
+  /**
+   * Complete two-factor authentication and log in the user.
+   * This should be called after receiving a SecondFactorRequiredError.
+   */
+  async completeTwoFactorLogin() {
+    const twoFactorState = this.req.session?.auth?.awaitingTwoFactor;
+    if (!twoFactorState) {
+      throw new TwoFactorExpiredError();
+    }
+    if (twoFactorState.expiresAt <= /* @__PURE__ */ new Date()) {
+      delete this.req.session.auth.awaitingTwoFactor;
+      throw new TwoFactorExpiredError();
+    }
+    const account = await this.queries.findAccountById(twoFactorState.accountId);
+    if (!account) {
+      delete this.req.session.auth.awaitingTwoFactor;
+      throw new UserNotFoundError();
+    }
+    await this.onLoginSuccessful(account, twoFactorState.remember);
+    delete this.req.session.auth.awaitingTwoFactor;
+    await this.activityLogger.logActivity(account.id, AuthActivityAction.Login, this.req, true, { email: account.email, remember: twoFactorState.remember, twoFactorCompleted: true });
+  }
+  /**
+   * Log out the current user.
+   * Clears the session and removes any remember tokens.
+   */
+  async logout() {
+    if (!this.isLoggedIn()) {
+      return;
+    }
+    const accountId = this.getId();
+    const email = this.getEmail();
+    const { token } = this.getRememberToken();
+    if (token) {
+      await this.queries.deleteRememberToken(token);
+      this.setRememberCookie(null, /* @__PURE__ */ new Date(0));
+    }
+    this.req.session.auth = void 0;
+    if (accountId && email) {
+      await this.activityLogger.logActivity(accountId, AuthActivityAction.Logout, this.req, true, { email });
+    }
+  }
+  /**
+   * Register a new account.
+   *
+   * @param email - Email address for the new account
+   * @param password - Plain text password (will be hashed)
+   * @param userId - Optional user ID to link this auth account to. If not provided, a UUID will be generated automatically.
+   * @param callback - If provided, account is created unverified and callback receives confirmation token. Create a URL like /confirm/{token} and call confirmEmail() in that handler. If omitted, account is immediately verified.
+   * @returns The created account record
+   * @throws {EmailTakenError} Email is already registered
+   * @throws {InvalidPasswordError} Password doesn't meet length requirements
+   */
+  async register(email, password, userId, callback) {
+    validateEmail(email);
+    this.validatePassword(password);
+    const existing = await this.queries.findAccountByEmail(email);
+    if (existing) {
+      throw new EmailTakenError();
+    }
+    const finalUserId = userId || this.generateAutoUserId();
+    const hashedPassword = import_hash4.hash.encode(password);
+    const verified = typeof callback !== "function";
+    const account = await this.queries.createAccount({
+      userId: finalUserId,
+      email,
+      password: hashedPassword,
+      verified,
+      status: AuthStatus.Normal,
+      rolemask: 0
+    });
+    if (!verified && callback) {
+      await this.createConfirmationToken(account, email, callback);
+    }
+    await this.activityLogger.logActivity(account.id, AuthActivityAction.Register, this.req, true, { email, verified, userId: finalUserId });
+    return account;
+  }
+  async createConfirmationToken(account, email, callback) {
+    const token = import_hash4.hash.encode(email);
+    const expires = new Date(Date.now() + 1e3 * 60 * 60 * 24 * 7);
+    await this.queries.createConfirmation({
+      accountId: account.id,
+      token,
+      email,
+      expires
+    });
+    if (callback) {
+      callback(token);
+    }
+  }
+  /**
+   * Get the current user's account ID.
+   * @returns Account ID if logged in, null otherwise
+   */
+  getId() {
+    return this.req.session?.auth?.accountId || null;
+  }
+  /**
+   * Get the current user's email address.
+   * @returns Email if logged in, null otherwise
+   */
+  getEmail() {
+    return this.req.session?.auth?.email || null;
+  }
+  /**
+   * Get the current user's account status.
+   * @returns Status number (0=Normal, 1=Archived, 2=Banned, etc.) if logged in, null otherwise
+   */
+  getStatus() {
+    return this.req.session?.auth?.status ?? null;
+  }
+  /**
+   * Check if the current user's email is verified.
+   * @returns true if verified, false if unverified, null if not logged in
+   */
+  getVerified() {
+    return this.req.session?.auth?.verified ?? null;
+  }
+  /**
+   * Get human-readable role names for the current user or a specific rolemask.
+   * @param rolemask - Optional specific rolemask to check. If omitted, uses current user's roles
+   * @returns Array of role names (e.g., ['Admin', 'Editor'])
+   */
+  getRoleNames(rolemask) {
+    const mask = rolemask !== void 0 ? rolemask : this.req.session?.auth?.rolemask ?? 0;
+    if (!mask && mask !== 0) {
+      return [];
+    }
+    return Object.entries(this.getRoleMap()).filter(([key]) => mask & parseInt(key)).map(([, value]) => value);
+  }
+  /**
+   * Get human-readable status name for the current user.
+   * @returns Status name (e.g., 'Normal', 'Banned', 'Locked') if logged in, null otherwise
+   */
+  getStatusName() {
+    const status = this.getStatus();
+    if (status === null) return null;
+    return this.getStatusMap()[status] || null;
+  }
+  /**
+   * Check if the current user has a specific role.
+   * @param role - Role bitmask to check (e.g., AuthRole.Admin)
+   * @returns true if user has the role, false otherwise
+   */
+  async hasRole(role) {
+    if (this.req.session?.auth) {
+      return (this.req.session.auth.rolemask & role) === role;
+    }
+    const account = await this.getAuthAccount();
+    return account ? (account.rolemask & role) === role : false;
+  }
+  /**
+   * Check if the current user has admin privileges.
+   * @returns true if user has Admin role, false otherwise
+   */
+  async isAdmin() {
+    return this.hasRole(AuthRole.Admin);
+  }
+  /**
+   * Check if the current user was automatically logged in via remember token.
+   * @returns true if auto-logged in from persistent cookie, false if manual login or not logged in
+   */
+  isRemembered() {
+    return this.req.session?.auth?.remembered ?? false;
+  }
+  /**
+   * Request an email change for the current user.
+   * Sends a confirmation token to verify the new email before changing it.
+   *
+   * @param newEmail - New email address
+   * @param callback - Called with confirmation token. Create a URL like /confirm/{token} and call confirmEmail() in that handler
+   * @throws {UserNotLoggedInError} User is not logged in
+   * @throws {EmailTakenError} New email is already registered
+   * @throws {UserNotFoundError} Current user account not found
+   * @throws {EmailNotVerifiedError} Current account's email is not verified
+   */
+  async changeEmail(newEmail, callback) {
+    if (!this.isLoggedIn()) {
+      throw new UserNotLoggedInError();
+    }
+    validateEmail(newEmail);
+    const existing = await this.queries.findAccountByEmail(newEmail);
+    if (existing) {
+      throw new EmailTakenError();
+    }
+    const account = await this.getAuthAccount();
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    if (!account.verified) {
+      throw new EmailNotVerifiedError();
+    }
+    await this.createConfirmationToken(account, newEmail, callback);
+  }
+  /**
+   * Confirm an email address using a token from registration or email change.
+   * Updates the account to verified status and changes email if this was from changeEmail.
+   *
+   * @param token - Confirmation token from registration or email change
+   * @returns The confirmed email address
+   * @throws {ConfirmationNotFoundError} Token is invalid or doesn't exist
+   * @throws {ConfirmationExpiredError} Token has expired
+   * @throws {InvalidTokenError} Token format is invalid
+   */
+  async confirmEmail(token) {
+    const confirmation = await this.queries.findConfirmation(token);
+    if (!confirmation) {
+      throw new ConfirmationNotFoundError();
+    }
+    if (new Date(confirmation.expires) < /* @__PURE__ */ new Date()) {
+      throw new ConfirmationExpiredError();
+    }
+    if (!import_hash4.hash.verify(token, confirmation.email)) {
+      throw new InvalidTokenError();
+    }
+    await this.queries.updateAccount(confirmation.account_id, {
+      verified: true,
+      email: confirmation.email
+    });
+    if (this.isLoggedIn() && this.req.session?.auth?.accountId === confirmation.account_id) {
+      this.req.session.auth.verified = true;
+      this.req.session.auth.email = confirmation.email;
+    }
+    await this.queries.deleteConfirmation(token);
+    await this.activityLogger.logActivity(confirmation.account_id, AuthActivityAction.EmailConfirmed, this.req, true, { email: confirmation.email });
+    return confirmation.email;
+  }
+  /**
+   * Confirm email and automatically log in the user.
+   * Useful for "click to verify and login" flows.
+   *
+   * @param token - Confirmation token from registration
+   * @param remember - Whether to set persistent login cookie
+   * @throws {ConfirmationNotFoundError} Token is invalid or doesn't exist
+   * @throws {ConfirmationExpiredError} Token has expired
+   * @throws {InvalidTokenError} Token format is invalid
+   * @throws {UserNotFoundError} Associated account no longer exists
+   */
+  async confirmEmailAndLogin(token, remember = false) {
+    const email = await this.confirmEmail(token);
+    if (this.isLoggedIn()) {
+      return;
+    }
+    const account = await this.queries.findAccountByEmail(email);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    if (this.config.twoFactor?.enabled && await this.shouldRequire2FA(account)) {
+      const twoFactorMethods = await this.queries.findTwoFactorMethodsByAccountId(account.id);
+      const enabledMethods = twoFactorMethods.filter((method) => method.verified);
+      if (enabledMethods.length > 0) {
+        const challenge = await this.twoFactor.createChallenge(account.id);
+        const expiryDuration = this.config.twoFactor?.tokenExpiry || "5m";
+        const expiresAt = new Date(Date.now() + (0, import_ms3.default)(expiryDuration));
+        this.req.session.auth = {
+          loggedIn: false,
+          accountId: 0,
+          userId: "",
+          email: "",
+          status: 0,
+          rolemask: 0,
+          remembered: false,
+          lastResync: /* @__PURE__ */ new Date(),
+          lastRememberCheck: /* @__PURE__ */ new Date(),
+          forceLogout: 0,
+          verified: false,
+          awaitingTwoFactor: {
+            accountId: account.id,
+            expiresAt,
+            remember,
+            availableMechanisms: enabledMethods.map((m) => m.mechanism),
+            attemptedMechanisms: [],
+            originalEmail: account.email,
+            selectors: challenge.selectors
+          }
+        };
+        await this.activityLogger.logActivity(account.id, AuthActivityAction.TwoFactorFailed, this.req, true, { prompt: true, mechanisms: enabledMethods.map((m) => m.mechanism) });
+        throw new SecondFactorRequiredError(challenge);
+      }
+    }
+    await this.onLoginSuccessful(account, remember);
+  }
+  /**
+   * Initiate a password reset for a user.
+   * Creates a reset token and calls the callback to send reset email.
+   *
+   * @param email - Email address of account to reset
+   * @param expiresAfter - Token expiration (default: 6h). Accepts ms format like '1h', '30m'
+   * @param maxOpenRequests - Maximum concurrent reset tokens (default: 2)
+   * @param callback - Called with reset token. Create a URL like /reset/{token} and call confirmResetPassword() in that handler
+   * @throws {EmailNotVerifiedError} Account doesn't exist or email not verified
+   * @throws {ResetDisabledError} Account has password reset disabled
+   * @throws {TooManyResetsError} Too many active reset requests
+   */
+  async resetPassword(email, expiresAfter = null, maxOpenRequests = null, callback) {
+    validateEmail(email);
+    const expiry = !expiresAfter ? (0, import_ms3.default)("6h") : (0, import_ms3.default)(expiresAfter);
+    const maxRequests = maxOpenRequests === null ? 2 : Math.max(1, maxOpenRequests);
+    const account = await this.queries.findAccountByEmail(email);
+    if (!account || !account.verified) {
+      throw new EmailNotVerifiedError();
+    }
+    if (!account.resettable) {
+      throw new ResetDisabledError();
+    }
+    const openRequests = await this.queries.countActiveResetTokensForAccount(account.id);
+    if (openRequests >= maxRequests) {
+      throw new TooManyResetsError();
+    }
+    const token = import_hash4.hash.encode(email);
+    const expires = new Date(Date.now() + expiry);
+    await this.queries.createResetToken({
+      accountId: account.id,
+      token,
+      expires
+    });
+    await this.activityLogger.logActivity(account.id, AuthActivityAction.PasswordResetRequested, this.req, true, { email });
+    if (callback) {
+      callback(token);
+    }
+  }
+  /**
+   * Complete a password reset using a reset token.
+   * Changes the password and optionally logs out all sessions.
+   *
+   * @param token - Reset token from resetPassword callback
+   * @param password - New password (will be hashed)
+   * @param logout - Whether to force logout all sessions (default: true)
+   * @throws {ResetNotFoundError} Token is invalid or doesn't exist
+   * @throws {ResetExpiredError} Token has expired
+   * @throws {UserNotFoundError} Associated account no longer exists
+   * @throws {ResetDisabledError} Account has password reset disabled
+   * @throws {InvalidPasswordError} New password doesn't meet requirements
+   * @throws {InvalidTokenError} Token format is invalid
+   */
+  async confirmResetPassword(token, password, logout = true) {
+    const reset = await this.queries.findResetToken(token);
+    if (!reset) {
+      throw new ResetNotFoundError();
+    }
+    if (new Date(reset.expires) < /* @__PURE__ */ new Date()) {
+      throw new ResetExpiredError();
+    }
+    const account = await this.queries.findAccountById(reset.account_id);
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    if (!account.resettable) {
+      throw new ResetDisabledError();
+    }
+    this.validatePassword(password);
+    if (!import_hash4.hash.verify(token, account.email)) {
+      throw new InvalidTokenError();
+    }
+    await this.queries.updateAccount(account.id, {
+      password: import_hash4.hash.encode(password)
+    });
+    if (logout) {
+      await this.forceLogoutForAccountById(account.id);
+    }
+    await this.queries.deleteResetToken(token);
+    await this.activityLogger.logActivity(account.id, AuthActivityAction.PasswordResetCompleted, this.req, true, { email: account.email });
+  }
+  /**
+   * Verify if a password matches the current user's password.
+   * Useful for "confirm current password" flows before sensitive operations.
+   *
+   * @param password - Password to verify
+   * @returns true if password matches, false otherwise
+   * @throws {UserNotLoggedInError} User is not logged in
+   * @throws {UserNotFoundError} Current user account not found
+   */
+  async verifyPassword(password) {
+    if (!this.isLoggedIn()) {
+      throw new UserNotLoggedInError();
+    }
+    const account = await this.getAuthAccount();
+    if (!account) {
+      throw new UserNotFoundError();
+    }
+    if (!account.password) {
+      return false;
+    }
+    return import_hash4.hash.verify(account.password, password);
+  }
+  async forceLogoutForAccountById(accountId) {
+    await this.queries.deleteRememberTokensForAccount(accountId);
+    await this.queries.incrementForceLogout(accountId);
+  }
+  /**
+   * Force logout all OTHER sessions while keeping current session active.
+   * Useful for "logout other devices" functionality.
+   */
+  async logoutEverywhereElse() {
+    if (!this.isLoggedIn()) {
+      return;
+    }
+    const accountId = this.getId();
+    if (!accountId) {
+      return;
+    }
+    const account = await this.queries.findAccountById(accountId);
+    if (!account) {
+      await this.logout();
+      return;
+    }
+    await this.forceLogoutForAccountById(accountId);
+    this.req.session.auth.forceLogout += 1;
+    await this.regenerateSession();
+  }
+  /**
+   * Force logout ALL sessions including the current one.
+   * Logs out everywhere else, then logs out current session.
+   */
+  async logoutEverywhere() {
+    if (!this.isLoggedIn()) {
+      return;
+    }
+    await this.logoutEverywhereElse();
+    await this.logout();
+  }
+};
+
+// src/middleware.ts
+function createAuthMiddleware(config) {
+  return async (req, res, next) => {
+    try {
+      const authManager = new AuthManager(req, res, config);
+      const authAdminManager = new AuthAdminManager(req, res, config, authManager);
+      req.auth = authManager;
+      req.authAdmin = authAdminManager;
+      await authManager.resyncSession();
+      await authManager.processRememberDirective();
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+// src/schema.ts
+async function createAuthTables(config) {
+  const prefix = config.tablePrefix || "user_";
+  const { db } = config;
+  const accountsTable = `${prefix}accounts`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${accountsTable} (
+      id SERIAL PRIMARY KEY,
+      user_id VARCHAR(255) NOT NULL,
+      email VARCHAR(255) NOT NULL UNIQUE,
+      password VARCHAR(255),
+      verified BOOLEAN DEFAULT FALSE,
+      status INTEGER DEFAULT 0,
+      rolemask INTEGER DEFAULT 0,
+      last_login TIMESTAMPTZ,
+      force_logout INTEGER DEFAULT 0,
+      resettable BOOLEAN DEFAULT TRUE,
+      registered TIMESTAMPTZ DEFAULT NOW(),
+      CONSTRAINT ${prefix}unique_user_id_per_account UNIQUE(user_id)
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}accounts_user_id ON ${accountsTable}(user_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}accounts_email ON ${accountsTable}(email)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}accounts_status ON ${accountsTable}(status)`);
+  const confirmationsTable = `${prefix}confirmations`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${confirmationsTable} (
+      id SERIAL PRIMARY KEY,
+      account_id INTEGER NOT NULL,
+      token VARCHAR(255) NOT NULL,
+      email VARCHAR(255) NOT NULL,
+      expires TIMESTAMPTZ NOT NULL,
+      CONSTRAINT fk_${prefix}confirmations_account 
+        FOREIGN KEY (account_id) REFERENCES ${accountsTable}(id) ON DELETE CASCADE
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}confirmations_token ON ${confirmationsTable}(token)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}confirmations_email ON ${confirmationsTable}(email)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}confirmations_account_id ON ${confirmationsTable}(account_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}confirmations_expires ON ${confirmationsTable}(expires)`);
+  const remembersTable = `${prefix}remembers`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${remembersTable} (
+      id SERIAL PRIMARY KEY,
+      account_id INTEGER NOT NULL,
+      token VARCHAR(255) NOT NULL,
+      expires TIMESTAMPTZ NOT NULL,
+      CONSTRAINT fk_${prefix}remembers_account 
+        FOREIGN KEY (account_id) REFERENCES ${accountsTable}(id) ON DELETE CASCADE
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}remembers_token ON ${remembersTable}(token)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}remembers_account_id ON ${remembersTable}(account_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}remembers_expires ON ${remembersTable}(expires)`);
+  const resetsTable = `${prefix}resets`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${resetsTable} (
+      id SERIAL PRIMARY KEY,
+      account_id INTEGER NOT NULL,
+      token VARCHAR(255) NOT NULL,
+      expires TIMESTAMPTZ NOT NULL,
+      CONSTRAINT fk_${prefix}resets_account 
+        FOREIGN KEY (account_id) REFERENCES ${accountsTable}(id) ON DELETE CASCADE
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}resets_token ON ${resetsTable}(token)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}resets_account_id ON ${resetsTable}(account_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}resets_expires ON ${resetsTable}(expires)`);
+  const providersTable = `${prefix}providers`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${providersTable} (
+      id SERIAL PRIMARY KEY,
+      account_id INTEGER NOT NULL,
+      provider VARCHAR(50) NOT NULL,
+      provider_id VARCHAR(255) NOT NULL,
+      provider_email VARCHAR(255),
+      provider_username VARCHAR(255),
+      provider_name VARCHAR(255),
+      provider_avatar VARCHAR(500),
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      updated_at TIMESTAMPTZ DEFAULT NOW(),
+      CONSTRAINT fk_${prefix}providers_account 
+        FOREIGN KEY (account_id) REFERENCES ${accountsTable}(id) ON DELETE CASCADE,
+      CONSTRAINT ${prefix}unique_provider_identity 
+        UNIQUE(provider, provider_id)
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}providers_account_id ON ${providersTable}(account_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}providers_provider ON ${providersTable}(provider)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}providers_provider_id ON ${providersTable}(provider_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}providers_email ON ${providersTable}(provider_email)`);
+  const activityTable = `${prefix}activity_log`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${activityTable} (
+      id SERIAL PRIMARY KEY,
+      account_id INTEGER,
+      action VARCHAR(255) NOT NULL,
+      ip_address INET,
+      user_agent TEXT,
+      browser VARCHAR(255),
+      os VARCHAR(255),
+      device VARCHAR(255),
+      success BOOLEAN DEFAULT TRUE,
+      metadata JSONB,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      CONSTRAINT fk_${prefix}activity_log_account 
+        FOREIGN KEY (account_id) REFERENCES ${accountsTable}(id) ON DELETE CASCADE
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}activity_log_created_at ON ${activityTable}(created_at DESC)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}activity_log_account_id ON ${activityTable}(account_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}activity_log_action ON ${activityTable}(action)`);
+  const twoFactorMethodsTable = `${prefix}2fa_methods`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${twoFactorMethodsTable} (
+      id SERIAL PRIMARY KEY,
+      account_id INTEGER NOT NULL,
+      mechanism INTEGER NOT NULL,
+      secret VARCHAR(255),
+      backup_codes TEXT[],
+      verified BOOLEAN DEFAULT FALSE,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      last_used_at TIMESTAMPTZ,
+      CONSTRAINT fk_${prefix}2fa_methods_account 
+        FOREIGN KEY (account_id) REFERENCES ${accountsTable}(id) ON DELETE CASCADE,
+      CONSTRAINT ${prefix}unique_account_mechanism 
+        UNIQUE(account_id, mechanism)
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}2fa_methods_account_id ON ${twoFactorMethodsTable}(account_id)`);
+  const twoFactorTokensTable = `${prefix}2fa_tokens`;
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS ${twoFactorTokensTable} (
+      id SERIAL PRIMARY KEY,
+      account_id INTEGER NOT NULL,
+      mechanism INTEGER NOT NULL,
+      selector VARCHAR(32) NOT NULL,
+      token_hash VARCHAR(255) NOT NULL,
+      expires_at TIMESTAMPTZ NOT NULL,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      CONSTRAINT fk_${prefix}2fa_tokens_account 
+        FOREIGN KEY (account_id) REFERENCES ${accountsTable}(id) ON DELETE CASCADE
+    )
+  `);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}2fa_tokens_selector ON ${twoFactorTokensTable}(selector)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}2fa_tokens_account_id ON ${twoFactorTokensTable}(account_id)`);
+  await db.query(`CREATE INDEX IF NOT EXISTS idx_${prefix}2fa_tokens_expires ON ${twoFactorTokensTable}(expires_at)`);
+}
+async function dropAuthTables(config) {
+  const prefix = config.tablePrefix || "user_";
+  const { db } = config;
+  await db.query(`DROP TABLE IF EXISTS ${prefix}2fa_tokens CASCADE`);
+  await db.query(`DROP TABLE IF EXISTS ${prefix}2fa_methods CASCADE`);
+  await db.query(`DROP TABLE IF EXISTS ${prefix}activity_log CASCADE`);
+  await db.query(`DROP TABLE IF EXISTS ${prefix}providers CASCADE`);
+  await db.query(`DROP TABLE IF EXISTS ${prefix}resets CASCADE`);
+  await db.query(`DROP TABLE IF EXISTS ${prefix}remembers CASCADE`);
+  await db.query(`DROP TABLE IF EXISTS ${prefix}confirmations CASCADE`);
+  await db.query(`DROP TABLE IF EXISTS ${prefix}accounts CASCADE`);
+}
+async function cleanupExpiredTokens(config) {
+  const prefix = config.tablePrefix || "user_";
+  const { db } = config;
+  await db.query(`DELETE FROM ${prefix}confirmations WHERE expires < NOW()`);
+  await db.query(`DELETE FROM ${prefix}remembers WHERE expires < NOW()`);
+  await db.query(`DELETE FROM ${prefix}resets WHERE expires < NOW()`);
+  await db.query(`DELETE FROM ${prefix}2fa_tokens WHERE expires_at < NOW()`);
+}
+async function getAuthTableStats(config) {
+  const prefix = config.tablePrefix || "user_";
+  const { db } = config;
+  const [accountsResult, providersResult, confirmationsResult, remembersResult, resetsResult, twoFactorMethodsResult, twoFactorTokensResult, expiredConfirmationsResult, expiredRemembersResult, expiredResetsResult, expiredTwoFactorTokensResult] = await Promise.all([
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}accounts`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}providers`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}confirmations`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}remembers`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}resets`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}2fa_methods`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}2fa_tokens`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}confirmations WHERE expires < NOW()`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}remembers WHERE expires < NOW()`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}resets WHERE expires < NOW()`),
+    db.query(`SELECT COUNT(*) as count FROM ${prefix}2fa_tokens WHERE expires_at < NOW()`)
+  ]);
+  return {
+    accounts: parseInt(accountsResult.rows[0]?.count || "0"),
+    providers: parseInt(providersResult.rows[0]?.count || "0"),
+    confirmations: parseInt(confirmationsResult.rows[0]?.count || "0"),
+    remembers: parseInt(remembersResult.rows[0]?.count || "0"),
+    resets: parseInt(resetsResult.rows[0]?.count || "0"),
+    twoFactorMethods: parseInt(twoFactorMethodsResult.rows[0]?.count || "0"),
+    twoFactorTokens: parseInt(twoFactorTokensResult.rows[0]?.count || "0"),
+    expiredConfirmations: parseInt(expiredConfirmationsResult.rows[0]?.count || "0"),
+    expiredRemembers: parseInt(expiredRemembersResult.rows[0]?.count || "0"),
+    expiredResets: parseInt(expiredResetsResult.rows[0]?.count || "0"),
+    expiredTwoFactorTokens: parseInt(expiredTwoFactorTokensResult.rows[0]?.count || "0")
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ActivityLogger,
+  AuthActivityAction,
+  AuthError,
+  AuthRole,
+  AuthStatus,
+  AzureProvider,
+  BaseOAuthProvider,
+  ConfirmationExpiredError,
+  ConfirmationNotFoundError,
+  EmailNotVerifiedError,
+  EmailTakenError,
+  GitHubProvider,
+  GoogleProvider,
+  InvalidBackupCodeError,
+  InvalidEmailError,
+  InvalidPasswordError,
+  InvalidTokenError,
+  InvalidTwoFactorCodeError,
+  OtpProvider,
+  ResetDisabledError,
+  ResetExpiredError,
+  ResetNotFoundError,
+  SecondFactorRequiredError,
+  TooManyResetsError,
+  TotpProvider,
+  TwoFactorAlreadyEnabledError,
+  TwoFactorExpiredError,
+  TwoFactorManager,
+  TwoFactorMechanism,
+  TwoFactorNotSetupError,
+  TwoFactorSetupIncompleteError,
+  UserInactiveError,
+  UserNotFoundError,
+  UserNotLoggedInError,
+  cleanupExpiredTokens,
+  createAuthMiddleware,
+  createAuthTables,
+  dropAuthTables,
+  getAuthTableStats,
+  isValidEmail,
+  validateEmail
+});
+//# sourceMappingURL=index.cjs.map