@hyperfixation/auth 0.1.0

package/dist/factory.js

@@ -0,0 +1,81 @@
+import { hfAccount, hfInvitation, hfMember, hfOrganization, hfPasskey, hfSession, hfUser, hfVerification, } from "@hyperfixation/db";
+import { passkey } from "@better-auth/passkey";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { admin, emailOTP, organization } from "better-auth/plugins";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { ADMIN_ROLE } from "./policy.js";
+import { sessionFactorForPath } from "./session.js";
+/** Model name → the `hf_*` table it lives in. Every better-auth table is prefixed, forever. */
+export const AUTH_SCHEMA = {
+    user: hfUser,
+    session: hfSession,
+    account: hfAccount,
+    verification: hfVerification,
+    passkey: hfPasskey,
+    organization: hfOrganization,
+    member: hfMember,
+    invitation: hfInvitation,
+};
+/** Promotes a code-factor session in place; see `upgradeSessionFactor`. */
+const UPGRADE_SESSION_FACTOR_STATEMENT = "UPDATE hf_session SET factor = 'passkey', updated_at = now() WHERE token = $1 AND factor = 'code'";
+/**
+ * The better-auth instance, wired to the seven `hf_*` tables chunk 2 created.
+ *
+ * `disableSignUp: true` on the OTP plugin is the shape of the whole product: there is no
+ * self-serve path into an app. A user exists because `bootstrapAdmin` or an existing admin put
+ * them there, and a code sent to an address with no `hf_user` row signs nobody in.
+ *
+ * `emailAndPassword` is left off entirely rather than configured off — the `password` column on
+ * `hf_account` is better-auth's, not a supported credential here — and the only two ways to
+ * hold a session are an emailed code and a passkey, which is exactly what `factor` records.
+ */
+export function createAuth(options) {
+    const db = drizzle(options.pool, { schema: AUTH_SCHEMA });
+    return betterAuth({
+        database: drizzleAdapter(db, { provider: "pg", schema: AUTH_SCHEMA }),
+        baseURL: options.baseURL,
+        secret: options.secret,
+        trustedOrigins: options.trustedOrigins,
+        session: {
+            additionalFields: {
+                // `input: false` — the factor is stamped from the endpoint that minted the session,
+                // never from anything a client sends.
+                factor: { type: "string", required: false, input: false, defaultValue: "code" },
+            },
+        },
+        databaseHooks: {
+            session: {
+                create: {
+                    before: async (session, ctx) => ({
+                        data: { ...session, factor: sessionFactorForPath(ctx?.path) },
+                    }),
+                },
+            },
+        },
+        plugins: [
+            emailOTP({ sendVerificationOTP: options.sendVerificationOTP, disableSignUp: true }),
+            passkey({ rpID: options.rpID, rpName: options.rpName, origin: options.origin }),
+            admin({ defaultRole: "member", adminRoles: [ADMIN_ROLE] }),
+            // `invitationLimit: 0` because an invitation ends in a sign-up, and there is no sign-up:
+            // an invited stranger has nowhere to land. `hf_invitation` exists all the same — the
+            // plugin refuses to initialise with a model it cannot reach — so turning invitations on
+            // later is a config change, not a migration.
+            organization({ invitationLimit: 0 }),
+        ],
+    });
+}
+/**
+ * Promotes the session that just enrolled a passkey, so the user is not sent back through the
+ * email code to reach the app they enrolled from.
+ *
+ * Registration is not authentication, so it does not go through `sessionFactorForPath`: this is
+ * a deliberate second entry into `passkey`, taken only after `/passkey/verify-registration`
+ * succeeded for this very session. It grants nothing an immediate passkey sign-in would not —
+ * whoever enrolled the authenticator can use it — and the `factor = 'code'` predicate makes it
+ * a no-op on a session that already holds the stronger factor.
+ */
+export async function upgradeSessionFactor(pool, sessionToken) {
+    const result = await pool.query(UPGRADE_SESSION_FACTOR_STATEMENT, [sessionToken]);
+    return result.rowCount === 1;
+}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { createAuth, upgradeSessionFactor, AUTH_SCHEMA, type CreateAuthOptions, type HyperfixationAuth, } from "./factory.js";
+export { hasRole, sessionFactorForPath, sessionFactors, EMAIL_OTP_SIGN_IN_PATH, PASSKEY_AUTHENTICATION_PATH, PASSKEY_REGISTRATION_PATH, type AuthSession, type SessionFactor, type SessionUser, } from "./session.js";
+export { evaluateAccess, routeAreaOf, ADMIN_AREA, ADMIN_ROLE, AUTH_AREA, DEFAULT_SIGN_IN_PATH, DEFAULT_STEP_UP_PATH, type AccessDecision, type AccessPaths, type AccessRefusal, type AccessRequest, type RouteArea, } from "./policy.js";
+export { createSessionGuard, AccessRefused, type RequireSession, type RequireSessionOptions, type SessionGuardOptions, } from "./require-session.js";
+export { bootstrapAdmin, BootstrapRefused, BOOTSTRAPPED_MARKER, BOOTSTRAP_EMAIL_ENV, type BootstrapAdminOptions, type BootstrapRefusal, type BootstrapResult, } from "./bootstrap.js";
+export { createResetSecondFactorAction, resetSecondFactor, SECOND_FACTOR_RESET_MARKER, type ResetSecondFactorAction, type ResetSecondFactorActionOptions, type ResetSecondFactorOptions, type ResetSecondFactorResult, } from "./reset-second-factor.js";

package/dist/index.js

@@ -0,0 +1,6 @@
+export { createAuth, upgradeSessionFactor, AUTH_SCHEMA, } from "./factory.js";
+export { hasRole, sessionFactorForPath, sessionFactors, EMAIL_OTP_SIGN_IN_PATH, PASSKEY_AUTHENTICATION_PATH, PASSKEY_REGISTRATION_PATH, } from "./session.js";
+export { evaluateAccess, routeAreaOf, ADMIN_AREA, ADMIN_ROLE, AUTH_AREA, DEFAULT_SIGN_IN_PATH, DEFAULT_STEP_UP_PATH, } from "./policy.js";
+export { createSessionGuard, AccessRefused, } from "./require-session.js";
+export { bootstrapAdmin, BootstrapRefused, BOOTSTRAPPED_MARKER, BOOTSTRAP_EMAIL_ENV, } from "./bootstrap.js";
+export { createResetSecondFactorAction, resetSecondFactor, SECOND_FACTOR_RESET_MARKER, } from "./reset-second-factor.js";

package/dist/policy.d.ts

@@ -0,0 +1,65 @@
+import type { AuthSession, SessionFactor } from "./session.js";
+/** Where a code-factor session is allowed to be, and where an unauthenticated one is sent. */
+export declare const AUTH_AREA = "auth";
+/** The area that does not exist for anyone who cannot enter it. */
+export declare const ADMIN_AREA = "admin";
+export declare const DEFAULT_SIGN_IN_PATH = "/auth/sign-in";
+export declare const DEFAULT_STEP_UP_PATH = "/auth/passkey";
+/** The role `/admin/*` requires, and the one `bootstrapAdmin` grants. */
+export declare const ADMIN_ROLE = "admin";
+export type RouteArea = "auth" | "admin" | "app";
+export type AccessRefusal = "no-session" | "banned" | "code-factor" | "missing-role";
+export type AccessDecision = {
+    outcome: "allow";
+    session: AuthSession;
+} | {
+    outcome: "redirect";
+    to: string;
+    refusal: AccessRefusal;
+} | {
+    outcome: "not-found";
+    refusal: AccessRefusal;
+};
+export interface AccessPaths {
+    signInPath?: string;
+    stepUpPath?: string;
+}
+export interface AccessRequest extends AccessPaths {
+    session: AuthSession | null | undefined;
+    /**
+     * The route being entered. A layout or route handler knows it; a server action does not, and
+     * omitting it is the strict case — see `evaluateAccess`.
+     */
+    pathname?: string;
+    /** Raise the bar above what the route alone demands. Never lowers `/admin/*`. */
+    factor?: SessionFactor;
+    role?: string;
+}
+/**
+ * The first segment, with a leading `/api` stripped, so `/api/admin/users` is admin territory
+ * to a route handler exactly as `/admin/users` is to a layout. Stripping `/api` is also what
+ * keeps `/api/auth/*` — better-auth's own handler, which a code-factor session must be able to
+ * drive in order to enrol a passkey at all — inside the auth area.
+ */
+export declare function routeAreaOf(pathname: string): RouteArea;
+/**
+ * The session-factor policy, as one pure function over a fake-able session.
+ *
+ * Three rules, and the order between them is the point:
+ *
+ * 1. A check that names a role — every `/admin/*` route, and any action that asks for one —
+ *    answers **404 for every refusal**, including "not signed in at all". A redirect would say
+ *    that the path exists and that signing in is worth trying; the whole reason `/admin/*`
+ *    404s rather than redirects is that it must not say so. So the role test runs before the
+ *    factor test: an admin holding only a code-factor session gets the same 404 as a stranger,
+ *    not a step-up redirect that would confirm the area.
+ * 2. A code-factor session is confined to the auth area. Everywhere else it is refused and sent
+ *    to step up, because it is one factor — possession of an inbox — and nothing more.
+ * 3. Requirements are minimums. A passkey session satisfies `factor: 'code'`; the reverse is
+ *    what rule 2 refuses.
+ *
+ * `pathname` omitted means "app area", the strict case: a server action states its own bar, and
+ * one that carries no `factor` is passkey-only. An action reachable from `/auth/*` — sending a
+ * code, enrolling the first passkey — opts down with `factor: 'code'` explicitly.
+ */
+export declare function evaluateAccess(request: AccessRequest): AccessDecision;

package/dist/policy.js

@@ -0,0 +1,68 @@
+import { hasRole } from "./session.js";
+/** Where a code-factor session is allowed to be, and where an unauthenticated one is sent. */
+export const AUTH_AREA = "auth";
+/** The area that does not exist for anyone who cannot enter it. */
+export const ADMIN_AREA = "admin";
+export const DEFAULT_SIGN_IN_PATH = "/auth/sign-in";
+export const DEFAULT_STEP_UP_PATH = "/auth/passkey";
+/** The role `/admin/*` requires, and the one `bootstrapAdmin` grants. */
+export const ADMIN_ROLE = "admin";
+/**
+ * The first segment, with a leading `/api` stripped, so `/api/admin/users` is admin territory
+ * to a route handler exactly as `/admin/users` is to a layout. Stripping `/api` is also what
+ * keeps `/api/auth/*` — better-auth's own handler, which a code-factor session must be able to
+ * drive in order to enrol a passkey at all — inside the auth area.
+ */
+export function routeAreaOf(pathname) {
+    const path = pathname.split("?")[0].split("#")[0];
+    const segments = path.split("/").filter((segment) => segment.length > 0);
+    const first = (segments[0] === "api" ? segments.slice(1) : segments)[0];
+    if (first === AUTH_AREA)
+        return "auth";
+    if (first === ADMIN_AREA)
+        return "admin";
+    return "app";
+}
+/**
+ * The session-factor policy, as one pure function over a fake-able session.
+ *
+ * Three rules, and the order between them is the point:
+ *
+ * 1. A check that names a role — every `/admin/*` route, and any action that asks for one —
+ *    answers **404 for every refusal**, including "not signed in at all". A redirect would say
+ *    that the path exists and that signing in is worth trying; the whole reason `/admin/*`
+ *    404s rather than redirects is that it must not say so. So the role test runs before the
+ *    factor test: an admin holding only a code-factor session gets the same 404 as a stranger,
+ *    not a step-up redirect that would confirm the area.
+ * 2. A code-factor session is confined to the auth area. Everywhere else it is refused and sent
+ *    to step up, because it is one factor — possession of an inbox — and nothing more.
+ * 3. Requirements are minimums. A passkey session satisfies `factor: 'code'`; the reverse is
+ *    what rule 2 refuses.
+ *
+ * `pathname` omitted means "app area", the strict case: a server action states its own bar, and
+ * one that carries no `factor` is passkey-only. An action reachable from `/auth/*` — sending a
+ * code, enrolling the first passkey — opts down with `factor: 'code'` explicitly.
+ */
+export function evaluateAccess(request) {
+    const area = request.pathname === undefined ? "app" : routeAreaOf(request.pathname);
+    const requiredRole = request.role ?? (area === "admin" ? ADMIN_ROLE : undefined);
+    const requiredFactor = request.factor ?? (area === "auth" ? "code" : "passkey");
+    const hidden = requiredRole !== undefined;
+    const signIn = request.signInPath ?? DEFAULT_SIGN_IN_PATH;
+    const stepUp = request.stepUpPath ?? DEFAULT_STEP_UP_PATH;
+    const refuse = (refusal, to) => hidden ? { outcome: "not-found", refusal } : { outcome: "redirect", to, refusal };
+    const { session } = request;
+    if (!session)
+        return refuse("no-session", signIn);
+    // A ban lands on the user row while their sessions are still live; it has to be read here or
+    // a banned admin keeps the tab they already had open.
+    if (session.user.banned === true)
+        return refuse("banned", signIn);
+    if (requiredRole !== undefined && !hasRole(session.user, requiredRole)) {
+        return { outcome: "not-found", refusal: "missing-role" };
+    }
+    if (requiredFactor === "passkey" && session.factor !== "passkey") {
+        return refuse("code-factor", stepUp);
+    }
+    return { outcome: "allow", session };
+}

package/dist/require-session.d.ts

@@ -0,0 +1,34 @@
+import { type AccessDecision, type AccessPaths, type AccessRequest } from "./policy.js";
+import type { AuthSession } from "./session.js";
+/**
+ * What a refusal throws when the host's handler returns instead of diverting. Next's
+ * `redirect()` and `notFound()` both throw, so in the template this is unreachable — it exists
+ * so that `requireSession` cannot return an unauthorized session under a handler that forgets.
+ */
+export declare class AccessRefused extends Error {
+    readonly decision: AccessDecision;
+    constructor(decision: AccessDecision);
+}
+export interface SessionGuardOptions extends AccessPaths {
+    /**
+     * Reads the session for the current request. In Next this is
+     * `auth.api.getSession({ headers: await headers() })`; in a test it is a fake.
+     */
+    getSession: () => Promise<AuthSession | null | undefined>;
+    /** `redirect(to)` in Next. Expected to throw; if it returns, `AccessRefused` is thrown. */
+    onRedirect?: (to: string, decision: AccessDecision) => void | Promise<void>;
+    /** `notFound()` in Next. Same contract. */
+    onNotFound?: (decision: AccessDecision) => void | Promise<void>;
+}
+export interface RequireSessionOptions {
+    factor?: AccessRequest["factor"];
+    role?: AccessRequest["role"];
+    /** The route being entered. Omitted in a server action — see `evaluateAccess`. */
+    pathname?: string;
+}
+export type RequireSession = (options?: RequireSessionOptions) => Promise<AuthSession>;
+/**
+ * `requireSession({ factor, role })` for layouts, server actions and route handlers, bound once
+ * per app to a session reader and to whatever this host diverts with.
+ */
+export declare function createSessionGuard(options: SessionGuardOptions): RequireSession;

package/dist/require-session.js

@@ -0,0 +1,42 @@
+import { evaluateAccess, } from "./policy.js";
+/**
+ * What a refusal throws when the host's handler returns instead of diverting. Next's
+ * `redirect()` and `notFound()` both throw, so in the template this is unreachable — it exists
+ * so that `requireSession` cannot return an unauthorized session under a handler that forgets.
+ */
+export class AccessRefused extends Error {
+    decision;
+    constructor(decision) {
+        super(decision.outcome === "not-found"
+            ? `access refused (${decision.refusal}): not found`
+            : decision.outcome === "redirect"
+                ? `access refused (${decision.refusal}): redirect to ${decision.to}`
+                : "access refused");
+        this.name = "AccessRefused";
+        this.decision = decision;
+    }
+}
+/**
+ * `requireSession({ factor, role })` for layouts, server actions and route handlers, bound once
+ * per app to a session reader and to whatever this host diverts with.
+ */
+export function createSessionGuard(options) {
+    return async (required = {}) => {
+        const session = await options.getSession();
+        const decision = evaluateAccess({
+            session,
+            pathname: required.pathname,
+            factor: required.factor,
+            role: required.role,
+            signInPath: options.signInPath,
+            stepUpPath: options.stepUpPath,
+        });
+        if (decision.outcome === "allow")
+            return decision.session;
+        if (decision.outcome === "redirect")
+            await options.onRedirect?.(decision.to, decision);
+        else
+            await options.onNotFound?.(decision);
+        throw new AccessRefused(decision);
+    };
+}

package/dist/reset-second-factor.d.ts

@@ -0,0 +1,37 @@
+import type { Pool } from "pg";
+import type { RequireSession } from "./require-session.js";
+/** One line per reset; the user has just lost every way in and support will be asked why. */
+export declare const SECOND_FACTOR_RESET_MARKER = "hf-auth: second factor reset";
+export interface ResetSecondFactorOptions {
+    userId: string;
+    /** The admin who did it. Null only for a reset driven from the CLI. */
+    actorId?: string | null;
+    reason?: string;
+}
+export interface ResetSecondFactorResult {
+    userId: string;
+    passkeysRemoved: number;
+    sessionsRevoked: number;
+}
+/**
+ * Unenrols every passkey a user holds, so someone who lost their device can be let back in
+ * through the email code and enrol a new one.
+ *
+ * It revokes **all** of the user's sessions, not only the passkey-factor ones. A code-factor
+ * session is confined to `/auth/*`, but `/auth/*` is exactly where enrolment lives: leaving one
+ * alive would let whoever holds the lost device's still-valid session enrol a fresh
+ * authenticator and promote itself back to `passkey`, which is the state this reset exists to
+ * end. The passkey rows and the sessions go in one transaction for the same reason.
+ */
+export declare function resetSecondFactor(pool: Pool, options: ResetSecondFactorOptions): Promise<ResetSecondFactorResult>;
+export interface ResetSecondFactorActionOptions {
+    pool: Pool;
+    requireSession: RequireSession;
+}
+export type ResetSecondFactorAction = (options: ResetSecondFactorOptions) => Promise<ResetSecondFactorResult>;
+/**
+ * The admin action, with its guard attached rather than left to the caller to remember. It
+ * takes the actor from the guarded session, so the audit row names who actually did it and not
+ * whoever the form said.
+ */
+export declare function createResetSecondFactorAction(options: ResetSecondFactorActionOptions): ResetSecondFactorAction;

package/dist/reset-second-factor.js

@@ -0,0 +1,60 @@
+import { ADMIN_ROLE } from "./policy.js";
+/** One line per reset; the user has just lost every way in and support will be asked why. */
+export const SECOND_FACTOR_RESET_MARKER = "hf-auth: second factor reset";
+const DELETE_PASSKEYS_STATEMENT = "DELETE FROM hf_passkey WHERE user_id = $1 RETURNING id";
+const DELETE_SESSIONS_STATEMENT = "DELETE FROM hf_session WHERE user_id = $1 RETURNING id";
+const AUDIT_STATEMENT = "INSERT INTO hf_audit (actor_id, action, target_type, target_id, meta) " +
+    "VALUES ($1, 'auth.second_factor_reset', 'user', $2, $3::jsonb)";
+/**
+ * Unenrols every passkey a user holds, so someone who lost their device can be let back in
+ * through the email code and enrol a new one.
+ *
+ * It revokes **all** of the user's sessions, not only the passkey-factor ones. A code-factor
+ * session is confined to `/auth/*`, but `/auth/*` is exactly where enrolment lives: leaving one
+ * alive would let whoever holds the lost device's still-valid session enrol a fresh
+ * authenticator and promote itself back to `passkey`, which is the state this reset exists to
+ * end. The passkey rows and the sessions go in one transaction for the same reason.
+ */
+export async function resetSecondFactor(pool, options) {
+    const client = await pool.connect();
+    try {
+        await client.query("BEGIN");
+        const passkeys = await client.query(DELETE_PASSKEYS_STATEMENT, [options.userId]);
+        const sessions = await client.query(DELETE_SESSIONS_STATEMENT, [options.userId]);
+        await client.query(AUDIT_STATEMENT, [
+            options.actorId ?? null,
+            options.userId,
+            JSON.stringify({
+                passkeysRemoved: passkeys.rowCount ?? 0,
+                sessionsRevoked: sessions.rowCount ?? 0,
+                reason: options.reason ?? null,
+            }),
+        ]);
+        await client.query("COMMIT");
+        const result = {
+            userId: options.userId,
+            passkeysRemoved: passkeys.rowCount ?? 0,
+            sessionsRevoked: sessions.rowCount ?? 0,
+        };
+        console.info(SECOND_FACTOR_RESET_MARKER, JSON.stringify(result));
+        return result;
+    }
+    catch (error) {
+        await client.query("ROLLBACK");
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+}
+/**
+ * The admin action, with its guard attached rather than left to the caller to remember. It
+ * takes the actor from the guarded session, so the audit row names who actually did it and not
+ * whoever the form said.
+ */
+export function createResetSecondFactorAction(options) {
+    return async (reset) => {
+        const session = await options.requireSession({ factor: "passkey", role: ADMIN_ROLE });
+        return resetSecondFactor(options.pool, { ...reset, actorId: session.user.id });
+    };
+}

package/dist/session.d.ts

@@ -0,0 +1,34 @@
+import { sessionFactors, type SessionFactor } from "@hyperfixation/db";
+export type { SessionFactor };
+export { sessionFactors };
+/** The endpoint that proves possession of an enrolled authenticator. */
+export declare const PASSKEY_AUTHENTICATION_PATH = "/passkey/verify-authentication";
+/** Enrolment. It creates no session, but it does let an existing one be promoted. */
+export declare const PASSKEY_REGISTRATION_PATH = "/passkey/verify-registration";
+/** The email-OTP sign-in endpoint, named here so the stamping rule reads as a pair. */
+export declare const EMAIL_OTP_SIGN_IN_PATH = "/sign-in/email-otp";
+/** What the guard needs of a user; better-auth's own user object is a superset. */
+export interface SessionUser {
+    id: string;
+    email?: string;
+    role?: string | null;
+    banned?: boolean | null;
+}
+/** What the guard needs of a session; better-auth's `session` is a superset. */
+export interface AuthSession {
+    factor: SessionFactor;
+    user: SessionUser;
+}
+/**
+ * An **allowlist**: only the passkey authentication endpoint mints a passkey-factor session,
+ * and every other path — including one a future plugin adds — gets `code`. The column defaults
+ * the same way for the same reason; a session must not reach a passkey-gated check because
+ * nobody taught this function about the path that created it.
+ */
+export declare function sessionFactorForPath(path: string | null | undefined): SessionFactor;
+/**
+ * better-auth's admin plugin stores roles as one comma-separated `text` column, so membership
+ * is a list test rather than an equality test. Comparison is case-insensitive because the role
+ * arrives from whatever wrote the column — the bootstrap path, an admin UI, or a hand-run SQL.
+ */
+export declare function hasRole(user: SessionUser | null | undefined, role: string): boolean;

package/dist/session.js

@@ -0,0 +1,31 @@
+import { sessionFactors } from "@hyperfixation/db";
+export { sessionFactors };
+/** The endpoint that proves possession of an enrolled authenticator. */
+export const PASSKEY_AUTHENTICATION_PATH = "/passkey/verify-authentication";
+/** Enrolment. It creates no session, but it does let an existing one be promoted. */
+export const PASSKEY_REGISTRATION_PATH = "/passkey/verify-registration";
+/** The email-OTP sign-in endpoint, named here so the stamping rule reads as a pair. */
+export const EMAIL_OTP_SIGN_IN_PATH = "/sign-in/email-otp";
+/**
+ * An **allowlist**: only the passkey authentication endpoint mints a passkey-factor session,
+ * and every other path — including one a future plugin adds — gets `code`. The column defaults
+ * the same way for the same reason; a session must not reach a passkey-gated check because
+ * nobody taught this function about the path that created it.
+ */
+export function sessionFactorForPath(path) {
+    return path === PASSKEY_AUTHENTICATION_PATH ? "passkey" : "code";
+}
+/**
+ * better-auth's admin plugin stores roles as one comma-separated `text` column, so membership
+ * is a list test rather than an equality test. Comparison is case-insensitive because the role
+ * arrives from whatever wrote the column — the bootstrap path, an admin UI, or a hand-run SQL.
+ */
+export function hasRole(user, role) {
+    if (!user?.role)
+        return false;
+    const wanted = role.trim().toLowerCase();
+    return user.role
+        .split(",")
+        .map((entry) => entry.trim().toLowerCase())
+        .includes(wanted);
+}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@hyperfixation/auth",
+  "version": "0.1.0",
+  "license": "MIT",
+  "description": "better-auth factory, session-factor policy, requireSession, and the bootstrap user",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/grahamlutz/hyperfixation-core.git",
+    "directory": "packages/auth"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.test.*"
+  ],
+  "devDependencies": {
+    "@hyperfixation/eslint-config": "0.1.0",
+    "@hyperfixation/testing": "0.1.0",
+    "@microsoft/api-extractor": "^7.59.1",
+    "@types/pg": "^8.23.1",
+    "eslint": "^10.10.0"
+  },
+  "dependencies": {
+    "@better-auth/passkey": "1.7.5",
+    "@hyperfixation/db": "0.1.0",
+    "@simplewebauthn/server": "13.3.3",
+    "better-auth": "1.7.5",
+    "drizzle-orm": "^0.45.2",
+    "pg": "^8.23.0",
+    "zod": "4.6.5"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint src",
+    "api-extractor": "api-extractor run",
+    "api-extractor:update": "api-extractor run --local",
+    "test": "vitest run --passWithNoTests"
+  }
+}