@mountsqli/auth 0.1.0

package/dist/index.js

@@ -0,0 +1,1247 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/core/auth.ts
+import { eq as eq3 } from "@mountsqli/core";
+import { createHash, createCipheriv, createDecipheriv, randomBytes as randomBytes3, createHmac as createHmac2 } from "crypto";
+
+// src/core/password.ts
+import { scrypt, randomBytes, timingSafeEqual } from "crypto";
+import { promisify } from "util";
+var scryptAsync = promisify(scrypt);
+var SALT_LENGTH = 32;
+var HASH_LENGTH = 64;
+async function hashPassword(password) {
+  const salt = randomBytes(SALT_LENGTH);
+  const hash = await scryptAsync(password, salt, HASH_LENGTH);
+  return `$scrypt$${salt.toString("hex")}$${hash.toString("hex")}`;
+}
+async function verifyPassword(password, hash) {
+  if (!hash.startsWith("$scrypt$")) return false;
+  const [, , saltHex, storedHashHex] = hash.split("$");
+  if (!saltHex || !storedHashHex) return false;
+  const salt = Buffer.from(saltHex, "hex");
+  const storedHash = Buffer.from(storedHashHex, "hex");
+  const computedHash = await scryptAsync(password, salt, HASH_LENGTH);
+  if (computedHash.length !== storedHash.length) return false;
+  return timingSafeEqual(computedHash, storedHash);
+}
+
+// src/core/session-manager.ts
+import { eq, and, gt } from "@mountsqli/core";
+
+// src/core/jwt.ts
+import { SignJWT, jwtVerify } from "jose";
+var encoder = new TextEncoder();
+async function createToken(payload, secret, options) {
+  const secretKey = encoder.encode(secret);
+  const maxAge = options?.maxAge ?? 30 * 24 * 60 * 60;
+  return new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(`${maxAge}s`).sign(secretKey);
+}
+async function verifyToken(token, secret) {
+  try {
+    const secretKey = encoder.encode(secret);
+    const { payload } = await jwtVerify(token, secretKey);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function decodeToken(token) {
+  try {
+    const [, payloadB64] = token.split(".");
+    if (!payloadB64) return null;
+    const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/core/session-manager.ts
+async function createSession(config, user, options) {
+  const expiresAt = new Date(Date.now() + config.maxAge * 1e3);
+  if (config.strategy === "jwt") {
+    const token2 = await createToken(
+      {
+        sub: user.id,
+        email: user.email,
+        name: user.name ?? void 0,
+        image: user.image ?? void 0
+      },
+      config.secret,
+      { maxAge: config.maxAge }
+    );
+    return {
+      user,
+      session: { user, expiresAt },
+      token: token2
+    };
+  }
+  const token = await createToken(
+    {
+      sub: user.id,
+      email: user.email,
+      name: user.name ?? void 0,
+      image: user.image ?? void 0
+    },
+    config.secret,
+    { maxAge: config.maxAge }
+  );
+  const [session] = await config.db.insert(config.sessionsTable).values({
+    userId: user.id,
+    token,
+    expiresAt,
+    ipAddress: options?.ipAddress,
+    userAgent: options?.userAgent
+  }).returning();
+  return {
+    user,
+    session: { user, expiresAt },
+    token
+  };
+}
+async function validateSession(config, token) {
+  const payload = await verifyToken(token, config.secret);
+  if (!payload) return null;
+  if (config.strategy === "jwt") {
+    const [user2] = await config.db.select().from(config.usersTable).where(eq(config.usersTable.id, payload.sub));
+    if (!user2) return null;
+    return {
+      user: sanitizeUser(user2),
+      expiresAt: new Date(payload.exp * 1e3)
+    };
+  }
+  const [session] = await config.db.select().from(config.sessionsTable).where(
+    and(
+      eq(config.sessionsTable.token, token),
+      gt(config.sessionsTable.expiresAt, /* @__PURE__ */ new Date())
+    )
+  );
+  if (!session) return null;
+  const [user] = await config.db.select().from(config.usersTable).where(eq(config.usersTable.id, session.userId));
+  if (!user) return null;
+  return {
+    user: sanitizeUser(user),
+    expiresAt: session.expiresAt
+  };
+}
+async function revokeSession(config, token) {
+  if (config.strategy === "jwt") {
+    return;
+  }
+  await config.db.delete(config.sessionsTable).where(eq(config.sessionsTable.token, token));
+}
+async function revokeAllSessions(config, userId) {
+  if (config.strategy === "jwt") {
+    return;
+  }
+  await config.db.delete(config.sessionsTable).where(eq(config.sessionsTable.userId, userId));
+}
+function sanitizeUser(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    emailVerified: user.emailVerified,
+    name: user.name,
+    image: user.image,
+    twoFactorEnabled: user.twoFactorEnabled,
+    createdAt: user.createdAt,
+    updatedAt: user.updatedAt
+  };
+}
+
+// src/core/totp.ts
+import { createHmac, randomBytes as randomBytes2 } from "crypto";
+function generateSecret(length = 20) {
+  return randomBytes2(length).toString("base64url");
+}
+function generateCode(secret, timestamp6, config) {
+  const digits = config?.digits ?? 6;
+  const period = config?.period ?? 30;
+  const algorithm = config?.algorithm ?? "sha1";
+  const time = Math.floor((timestamp6 ?? Date.now()) / 1e3 / period);
+  const timeBuffer = Buffer.alloc(8);
+  timeBuffer.writeUInt32BE(0, 0);
+  timeBuffer.writeUInt32BE(time, 4);
+  const secretBuffer = Buffer.from(secret, "base64url");
+  const hmac = createHmac(algorithm, secretBuffer).update(timeBuffer).digest();
+  const offset = hmac[hmac.length - 1] & 15;
+  const code = (hmac[offset] & 127) << 24 | (hmac[offset + 1] & 255) << 16 | (hmac[offset + 2] & 255) << 8 | hmac[offset + 3] & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyCode(secret, code, config) {
+  const period = config?.period ?? 30;
+  const digits = config?.digits ?? 6;
+  const now = Math.floor(Date.now() / 1e3);
+  for (const drift of [-1, 0, 1]) {
+    const timestamp6 = (now + drift * period) * 1e3;
+    const expectedCode = generateCode(secret, timestamp6, config);
+    const expectedBuf = Buffer.from(expectedCode.padEnd(digits, "0"));
+    const inputBuf = Buffer.from(code.padEnd(digits, "0"));
+    if (expectedBuf.length === inputBuf.length) {
+      const { timingSafeEqual: timingSafeEqual2 } = __require("crypto");
+      if (timingSafeEqual2(expectedBuf, inputBuf)) return true;
+    }
+  }
+  return false;
+}
+function generateURI(secret, email, issuer = "MountSQLi", config) {
+  const digits = config?.digits ?? 6;
+  const period = config?.period ?? 30;
+  const algorithm = config?.algorithm ?? "sha1";
+  const encodedIssuer = encodeURIComponent(issuer);
+  const encodedEmail = encodeURIComponent(email);
+  return `otpauth://totp/${encodedIssuer}:${encodedEmail}?secret=${secret}&issuer=${encodedIssuer}&algorithm=${algorithm.toUpperCase()}&digits=${digits}&period=${period}`;
+}
+
+// src/core/oauth.ts
+function getAuthorizationUrl(provider, state) {
+  const scope = provider.scope?.join(" ") ?? "openid email profile";
+  const params = new URLSearchParams({
+    client_id: provider.clientId,
+    redirect_uri: `${getBaseUrl()}/auth/callback/${provider.id}`,
+    response_type: "code",
+    scope,
+    state
+  });
+  const authUrl = provider.authorizationUrl ?? getDefaultAuthorizationUrl(provider.id);
+  return `${authUrl}?${params.toString()}`;
+}
+async function exchangeCode(provider, code) {
+  const tokenUrl = provider.tokenUrl ?? getDefaultTokenUrl(provider.id);
+  const response = await fetch(tokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams({
+      client_id: provider.clientId,
+      client_secret: provider.clientSecret,
+      code,
+      grant_type: "authorization_code",
+      redirect_uri: `${getBaseUrl()}/auth/callback/${provider.id}`
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`OAuth token exchange failed: ${response.statusText}`);
+  }
+  return response.json();
+}
+async function getUserInfo(provider, accessToken) {
+  const userInfoUrl = provider.userInfoUrl ?? getDefaultUserInfoUrl(provider.id);
+  const response = await fetch(userInfoUrl, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      Accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`OAuth user info fetch failed: ${response.statusText}`);
+  }
+  const data = await response.json();
+  return normalizeUserInfo(provider.id, data);
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function getDefaultAuthorizationUrl(providerId) {
+  const urls = {
+    google: "https://accounts.google.com/o/oauth2/v2/auth",
+    github: "https://github.com/login/oauth/authorize"
+  };
+  return urls[providerId] ?? "";
+}
+function getDefaultTokenUrl(providerId) {
+  const urls = {
+    google: "https://oauth2.googleapis.com/token",
+    github: "https://github.com/login/oauth/access_token"
+  };
+  return urls[providerId] ?? "";
+}
+function getDefaultUserInfoUrl(providerId) {
+  const urls = {
+    google: "https://www.googleapis.com/oauth2/v2/userinfo",
+    github: "https://api.github.com/user"
+  };
+  return urls[providerId] ?? "";
+}
+function normalizeUserInfo(providerId, data) {
+  switch (providerId) {
+    case "google":
+      return {
+        id: data.id ?? data.sub,
+        email: data.email,
+        name: data.name ?? data.given_name,
+        image: data.picture,
+        emailVerified: data.verified_email ?? false
+      };
+    case "github":
+      return {
+        id: String(data.id),
+        email: data.email,
+        name: data.name ?? data.login,
+        image: data.avatar_url,
+        emailVerified: true
+      };
+    default:
+      return {
+        id: String(data.id ?? data.sub),
+        email: data.email,
+        name: data.name,
+        image: data.image ?? data.picture ?? data.avatar_url,
+        emailVerified: data.email_verified ?? false
+      };
+  }
+}
+function getBaseUrl() {
+  return process.env.AUTH_BASE_URL ?? process.env.NEXTAUTH_URL ?? "http://localhost:3000";
+}
+
+// src/core/rbac.ts
+import { eq as eq2 } from "@mountsqli/core";
+async function createRole(config, data) {
+  const [role] = await config.db.insert(config.rolesTable).values(data).returning();
+  return {
+    id: role.id,
+    name: role.name,
+    permissions: role.permissions,
+    createdAt: role.createdAt
+  };
+}
+async function deleteRole(config, roleId) {
+  await config.db.delete(config.rolesTable).where(eq2(config.rolesTable.id, roleId));
+}
+async function getRoleByName(config, name) {
+  const [role] = await config.db.select().from(config.rolesTable).where(eq2(config.rolesTable.name, name));
+  return role ?? null;
+}
+async function assignRole(config, userId, roleName) {
+  const role = await getRoleByName(config, roleName);
+  if (!role) throw new Error(`Role "${roleName}" not found`);
+  await config.db.insert(config.userRolesTable).values({ userId, roleId: role.id }).onConflictDoNothing();
+}
+async function removeRole(config, userId, roleName) {
+  const role = await getRoleByName(config, roleName);
+  if (!role) return;
+  await config.db.delete(config.userRolesTable).where(
+    eq2(config.userRolesTable.userId, userId) && eq2(config.userRolesTable.roleId, role.id)
+  );
+}
+async function getUserRoles(config, userId) {
+  const results = await config.db.select({
+    id: config.rolesTable.id,
+    name: config.rolesTable.name,
+    permissions: config.rolesTable.permissions,
+    createdAt: config.rolesTable.createdAt
+  }).from(config.userRolesTable).innerJoin(
+    config.rolesTable,
+    eq2(config.userRolesTable.roleId, config.rolesTable.id)
+  ).where(eq2(config.userRolesTable.userId, userId));
+  return results;
+}
+async function hasRole(config, userId, roleName) {
+  const roles = await getUserRoles(config, userId);
+  return roles.some((r) => r.name === roleName);
+}
+async function hasPermission(config, userId, permission) {
+  const roles = await getUserRoles(config, userId);
+  if (roles.some((r) => r.permissions.includes("*"))) return true;
+  return roles.some((r) => r.permissions.includes(permission));
+}
+
+// src/core/email.ts
+var ConsoleEmailAdapter = class {
+  async send(params) {
+    console.log(`[Auth Email] To: ${params.to}`);
+    console.log(`[Auth Email] Subject: ${params.subject}`);
+    console.log(`[Auth Email] Body: ${params.text ?? params.html ?? ""}`);
+  }
+};
+async function sendVerificationEmail(adapter, email, token, baseUrl = "http://localhost:3000") {
+  const verifyUrl = `${baseUrl}/auth/verify?token=${token}`;
+  await adapter.send({
+    to: email,
+    subject: "Verify your email address",
+    text: `Click the link to verify your email: ${verifyUrl}`,
+    html: `
+      <h1>Verify your email</h1>
+      <p>Click the link below to verify your email address:</p>
+      <a href="${verifyUrl}">${verifyUrl}</a>
+      <p>This link will expire in 24 hours.</p>
+    `
+  });
+}
+async function sendPasswordResetEmail(adapter, email, token, baseUrl = "http://localhost:3000") {
+  const resetUrl = `${baseUrl}/auth/reset-password?token=${token}`;
+  await adapter.send({
+    to: email,
+    subject: "Reset your password",
+    text: `Click the link to reset your password: ${resetUrl}`,
+    html: `
+      <h1>Reset your password</h1>
+      <p>Click the link below to reset your password:</p>
+      <a href="${resetUrl}">${resetUrl}</a>
+      <p>This link will expire in 1 hour.</p>
+      <p>If you didn't request this, ignore this email.</p>
+    `
+  });
+}
+
+// src/core/rate-limiter.ts
+var InMemoryRateLimiter = class {
+  store = /* @__PURE__ */ new Map();
+  maxRequests;
+  windowMs;
+  cleanupInterval;
+  constructor(config) {
+    this.maxRequests = config?.maxRequests ?? 5;
+    this.windowMs = config?.windowMs ?? 15 * 60 * 1e3;
+    this.cleanupInterval = setInterval(() => this.cleanup(), 5 * 60 * 1e3);
+  }
+  async check(key) {
+    const now = Date.now();
+    const entry = this.store.get(key);
+    if (!entry || now > entry.resetAt) {
+      const resetAt = now + this.windowMs;
+      this.store.set(key, { count: 1, resetAt });
+      return {
+        allowed: true,
+        remaining: this.maxRequests - 1,
+        resetAt: new Date(resetAt)
+      };
+    }
+    entry.count++;
+    return {
+      allowed: entry.count <= this.maxRequests,
+      remaining: Math.max(0, this.maxRequests - entry.count),
+      resetAt: new Date(entry.resetAt)
+    };
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of this.store.entries()) {
+      if (now > entry.resetAt) {
+        this.store.delete(key);
+      }
+    }
+  }
+  destroy() {
+    clearInterval(this.cleanupInterval);
+  }
+};
+
+// src/errors.ts
+var AuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthError";
+  }
+};
+var UnauthorizedError = class extends AuthError {
+  constructor(message = "Unauthorized") {
+    super(message);
+    this.name = "UnauthorizedError";
+  }
+};
+var ForbiddenError = class extends AuthError {
+  constructor(message = "Forbidden") {
+    super(message);
+    this.name = "ForbiddenError";
+  }
+};
+var InvalidCredentialsError = class extends AuthError {
+  constructor(message = "Invalid email or password") {
+    super(message);
+    this.name = "InvalidCredentialsError";
+  }
+};
+var UserNotFoundError = class extends AuthError {
+  constructor(message = "User not found") {
+    super(message);
+    this.name = "UserNotFoundError";
+  }
+};
+var EmailAlreadyExistsError = class extends AuthError {
+  constructor(message = "Email already registered") {
+    super(message);
+    this.name = "EmailAlreadyExistsError";
+  }
+};
+var InvalidTokenError = class extends AuthError {
+  constructor(message = "Invalid or expired token") {
+    super(message);
+    this.name = "InvalidTokenError";
+  }
+};
+var TwoFactorRequiredError = class extends AuthError {
+  constructor(message = "Two-factor authentication required") {
+    super(message);
+    this.name = "TwoFactorRequiredError";
+  }
+};
+var TwoFactorInvalidError = class extends AuthError {
+  constructor(message = "Invalid two-factor code") {
+    super(message);
+    this.name = "TwoFactorInvalidError";
+  }
+};
+var SessionExpiredError = class extends AuthError {
+  constructor(message = "Session expired") {
+    super(message);
+    this.name = "SessionExpiredError";
+  }
+};
+var ProviderError = class extends AuthError {
+  constructor(message = "Authentication provider error") {
+    super(message);
+    this.name = "ProviderError";
+  }
+};
+
+// src/core/auth.ts
+async function encryptToken(token, secret) {
+  const key = createHash("sha256").update(secret).digest();
+  const iv = randomBytes3(16);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(token, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${tag.toString("hex")}:${encrypted.toString("hex")}`;
+}
+var Auth = class {
+  config;
+  db;
+  secret;
+  sessionConfig;
+  emailAdapter;
+  rateLimiter;
+  // Schema tables (with fallback defaults)
+  usersTable;
+  sessionsTable;
+  accountsTable;
+  verificationTable;
+  rolesTable;
+  userRolesTable;
+  constructor(config) {
+    this.config = config;
+    this.db = config.db;
+    this.secret = config.secret;
+    this.sessionConfig = {
+      strategy: config.session?.strategy ?? "jwt",
+      maxAge: config.session?.maxAge ?? 30 * 24 * 60 * 60
+    };
+    this.rateLimiter = config.rateLimiter ?? new InMemoryRateLimiter();
+    this.usersTable = config.tables?.users;
+    this.sessionsTable = config.tables?.sessions;
+    this.accountsTable = config.tables?.accounts;
+    this.verificationTable = config.tables?.verification;
+    this.rolesTable = config.tables?.roles;
+    this.userRolesTable = config.tables?.userRoles;
+    this.emailAdapter = config.callbacks?.onRegister ? new ConsoleEmailAdapter() : new ConsoleEmailAdapter();
+  }
+  // ---------------------------------------------------------------------------
+  // Registration
+  // ---------------------------------------------------------------------------
+  async register(data) {
+    const rateLimitResult = await this.rateLimiter.check(`register:${data.email}`);
+    if (!rateLimitResult.allowed) {
+      throw new UnauthorizedError("Too many registration attempts. Please try again later.");
+    }
+    if (!this.isValidEmail(data.email)) {
+      throw new InvalidCredentialsError("Invalid email format");
+    }
+    const passwordValidation = this.isValidPassword(data.password);
+    if (!passwordValidation.valid) {
+      throw new InvalidCredentialsError(passwordValidation.errors.join(". "));
+    }
+    const [existing] = await this.db.select().from(this.usersTable).where(eq3(this.usersTable.email, data.email));
+    if (existing) {
+      throw new EmailAlreadyExistsError();
+    }
+    const hashedPassword = await hashPassword(data.password);
+    const [user] = await this.db.insert(this.usersTable).values({
+      email: data.email,
+      password: hashedPassword,
+      name: data.name
+    }).returning();
+    const sanitizedUser = this.sanitizeUser(user);
+    const result = await createSession(
+      {
+        db: this.db,
+        secret: this.secret,
+        strategy: this.sessionConfig.strategy,
+        maxAge: this.sessionConfig.maxAge,
+        sessionsTable: this.sessionsTable,
+        usersTable: this.usersTable
+      },
+      sanitizedUser
+    );
+    await this.config.callbacks?.onRegister?.(sanitizedUser);
+    return result;
+  }
+  // ---------------------------------------------------------------------------
+  // Login
+  // ---------------------------------------------------------------------------
+  async login(providerId, credentials2) {
+    const provider = this.config.providers.find((p) => p.id === providerId);
+    if (!provider) {
+      throw new ProviderError(`Provider "${providerId}" not found`);
+    }
+    if (provider.type === "credentials") {
+      return this.loginWithCredentials(provider, credentials2);
+    }
+    throw new ProviderError(`Provider "${providerId}" is not a credentials provider`);
+  }
+  async loginWithCredentials(provider, credentials2) {
+    const { email, password } = credentials2;
+    if (!email || !password) {
+      throw new InvalidCredentialsError();
+    }
+    const rateLimitResult = await this.rateLimiter.check(`login:${email}`);
+    if (!rateLimitResult.allowed) {
+      throw new UnauthorizedError("Too many login attempts. Please try again later.");
+    }
+    const [user] = await this.db.select().from(this.usersTable).where(eq3(this.usersTable.email, email));
+    if (!user || !user.password) {
+      throw new InvalidCredentialsError();
+    }
+    const valid = await verifyPassword(password, user.password);
+    if (!valid) {
+      throw new InvalidCredentialsError();
+    }
+    if (user.twoFactorEnabled) {
+      const code = credentials2.totp;
+      if (!code) {
+        throw new TwoFactorRequiredError();
+      }
+      if (!user.twoFactorSecret || !verifyCode(user.twoFactorSecret, code)) {
+        throw new TwoFactorInvalidError();
+      }
+    }
+    const sanitizedUser = this.sanitizeUser(user);
+    const result = await createSession(
+      {
+        db: this.db,
+        secret: this.secret,
+        strategy: this.sessionConfig.strategy,
+        maxAge: this.sessionConfig.maxAge,
+        sessionsTable: this.sessionsTable,
+        usersTable: this.usersTable
+      },
+      sanitizedUser
+    );
+    await this.config.callbacks?.onLogin?.(sanitizedUser);
+    return result;
+  }
+  // ---------------------------------------------------------------------------
+  // OAuth
+  // ---------------------------------------------------------------------------
+  async signIn(providerId) {
+    const provider = this.config.providers.find((p) => p.id === providerId);
+    if (!provider || provider.type !== "oauth") {
+      throw new ProviderError(`OAuth provider "${providerId}" not found`);
+    }
+    const state = generateState();
+    await this.db.insert(this.verificationTable).values({
+      identifier: `state:${state}`,
+      token: state,
+      expiresAt: new Date(Date.now() + 10 * 60 * 1e3)
+    });
+    return getAuthorizationUrl(provider, state);
+  }
+  async handleCallback(providerId, params) {
+    if (params.error) {
+      throw new ProviderError(`OAuth error: ${params.error}`);
+    }
+    if (!params.code) {
+      throw new ProviderError("Missing authorization code");
+    }
+    if (params.state) {
+      const [stored] = await this.db.select().from(this.verificationTable).where(eq3(this.verificationTable.identifier, `state:${params.state}`));
+      if (!stored || stored.expiresAt < /* @__PURE__ */ new Date()) {
+        throw new ProviderError("Invalid or expired OAuth state");
+      }
+      await this.db.delete(this.verificationTable).where(eq3(this.verificationTable.identifier, `state:${params.state}`));
+    }
+    const provider = this.config.providers.find((p) => p.id === providerId);
+    if (!provider || provider.type !== "oauth") {
+      throw new ProviderError(`OAuth provider "${providerId}" not found`);
+    }
+    const oauthProvider = provider;
+    const tokenResponse = await exchangeCode(oauthProvider, params.code);
+    const userInfo = await getUserInfo(oauthProvider, tokenResponse.access_token);
+    if (!userInfo.emailVerified) {
+      throw new ProviderError("Email not verified on OAuth provider");
+    }
+    let [user] = await this.db.select().from(this.usersTable).where(eq3(this.usersTable.email, userInfo.email));
+    if (!user) {
+      const [newUser] = await this.db.insert(this.usersTable).values({
+        email: userInfo.email,
+        name: userInfo.name,
+        image: userInfo.image,
+        emailVerified: /* @__PURE__ */ new Date()
+      }).returning();
+      user = newUser;
+      const encryptedAccessToken = await encryptToken(tokenResponse.access_token, this.secret);
+      const encryptedRefreshToken = tokenResponse.refresh_token ? await encryptToken(tokenResponse.refresh_token, this.secret) : null;
+      await this.db.insert(this.accountsTable).values({
+        userId: user.id,
+        provider: providerId,
+        providerAccountId: userInfo.id,
+        accessToken: encryptedAccessToken,
+        refreshToken: encryptedRefreshToken
+      });
+      await this.config.callbacks?.onRegister?.(this.sanitizeUser(user));
+    } else {
+      const [existingAccount] = await this.db.select().from(this.accountsTable).where(
+        eq3(this.accountsTable.userId, user.id) && eq3(this.accountsTable.provider, providerId)
+      );
+      if (existingAccount) {
+        const encryptedAccessToken = await encryptToken(tokenResponse.access_token, this.secret);
+        const encryptedRefreshToken = tokenResponse.refresh_token ? await encryptToken(tokenResponse.refresh_token, this.secret) : null;
+        await this.db.update(this.accountsTable).set({
+          accessToken: encryptedAccessToken,
+          refreshToken: encryptedRefreshToken
+        }).where(eq3(this.accountsTable.id, existingAccount.id));
+      } else {
+        const encryptedAccessToken = await encryptToken(tokenResponse.access_token, this.secret);
+        const encryptedRefreshToken = tokenResponse.refresh_token ? await encryptToken(tokenResponse.refresh_token, this.secret) : null;
+        await this.db.insert(this.accountsTable).values({
+          userId: user.id,
+          provider: providerId,
+          providerAccountId: userInfo.id,
+          accessToken: encryptedAccessToken,
+          refreshToken: encryptedRefreshToken
+        });
+      }
+    }
+    const sanitizedUser = this.sanitizeUser(user);
+    const result = await createSession(
+      {
+        db: this.db,
+        secret: this.secret,
+        strategy: this.sessionConfig.strategy,
+        maxAge: this.sessionConfig.maxAge,
+        sessionsTable: this.sessionsTable,
+        usersTable: this.usersTable
+      },
+      sanitizedUser
+    );
+    await this.config.callbacks?.onLogin?.(sanitizedUser);
+    return result;
+  }
+  // ---------------------------------------------------------------------------
+  // Session
+  // ---------------------------------------------------------------------------
+  async getSession(request) {
+    const token = this.extractToken(request);
+    if (!token) return null;
+    const session = await validateSession(
+      {
+        db: this.db,
+        secret: this.secret,
+        strategy: this.sessionConfig.strategy,
+        maxAge: this.sessionConfig.maxAge,
+        sessionsTable: this.sessionsTable,
+        usersTable: this.usersTable
+      },
+      token
+    );
+    if (!session) return null;
+    const enriched = await this.config.callbacks?.onSession?.(session);
+    return enriched ?? session;
+  }
+  async logout(token) {
+    const session = await validateSession(
+      {
+        db: this.db,
+        secret: this.secret,
+        strategy: this.sessionConfig.strategy,
+        maxAge: this.sessionConfig.maxAge,
+        sessionsTable: this.sessionsTable,
+        usersTable: this.usersTable
+      },
+      token
+    );
+    if (session) {
+      await this.config.callbacks?.onLogout?.(session);
+    }
+    await revokeSession(
+      {
+        db: this.db,
+        secret: this.secret,
+        strategy: this.sessionConfig.strategy,
+        maxAge: this.sessionConfig.maxAge,
+        sessionsTable: this.sessionsTable,
+        usersTable: this.usersTable
+      },
+      token
+    );
+  }
+  // ---------------------------------------------------------------------------
+  // 2FA
+  // ---------------------------------------------------------------------------
+  twoFactor = {
+    generate: async (userId) => {
+      const secret = generateSecret();
+      const otpauthUrl = generateURI(secret, userId, "MountSQLi");
+      await this.db.update(this.usersTable).set({ twoFactorSecret: secret }).where(eq3(this.usersTable.id, userId));
+      return { secret, otpauthUrl };
+    },
+    enable: async (userId, code) => {
+      const [user] = await this.db.select().from(this.usersTable).where(eq3(this.usersTable.id, userId));
+      if (!user?.twoFactorSecret) {
+        throw new UserNotFoundError();
+      }
+      if (!verifyCode(user.twoFactorSecret, code)) {
+        throw new TwoFactorInvalidError();
+      }
+      await this.db.update(this.usersTable).set({ twoFactorEnabled: true }).where(eq3(this.usersTable.id, userId));
+    },
+    disable: async (userId) => {
+      await this.db.update(this.usersTable).set({ twoFactorEnabled: false, twoFactorSecret: null }).where(eq3(this.usersTable.id, userId));
+    },
+    verify: (secret, code) => {
+      return verifyCode(secret, code);
+    }
+  };
+  // ---------------------------------------------------------------------------
+  // Password Reset
+  // ---------------------------------------------------------------------------
+  passwordReset = {
+    create: async (email) => {
+      const [user] = await this.db.select().from(this.usersTable).where(eq3(this.usersTable.email, email));
+      if (!user) {
+        return "If an account exists, a reset email has been sent.";
+      }
+      const token = generateSecret(32);
+      const expiresAt = new Date(Date.now() + 60 * 60 * 1e3);
+      await this.db.insert(this.verificationTable).values({
+        identifier: email,
+        token,
+        expiresAt
+      });
+      await sendPasswordResetEmail(this.emailAdapter, email, token);
+      return "If an account exists, a reset email has been sent.";
+    },
+    verify: async (token, newPassword) => {
+      const [verification] = await this.db.select().from(this.verificationTable).where(eq3(this.verificationTable.token, token));
+      if (!verification || verification.expiresAt < /* @__PURE__ */ new Date()) {
+        throw new UnauthorizedError("Invalid or expired reset token");
+      }
+      const hashedPassword = await hashPassword(newPassword);
+      await this.db.update(this.usersTable).set({ password: hashedPassword, updatedAt: /* @__PURE__ */ new Date() }).where(eq3(this.usersTable.email, verification.identifier));
+      await this.db.delete(this.verificationTable).where(eq3(this.verificationTable.token, token));
+      await revokeAllSessions(
+        {
+          db: this.db,
+          secret: this.secret,
+          strategy: this.sessionConfig.strategy,
+          maxAge: this.sessionConfig.maxAge,
+          sessionsTable: this.sessionsTable,
+          usersTable: this.usersTable
+        },
+        (await this.db.select().from(this.usersTable).where(eq3(this.usersTable.email, verification.identifier)))[0]?.id
+      );
+    }
+  };
+  // ---------------------------------------------------------------------------
+  // Email Verification
+  // ---------------------------------------------------------------------------
+  emailVerification = {
+    create: async (userId) => {
+      const [user] = await this.db.select().from(this.usersTable).where(eq3(this.usersTable.id, userId));
+      if (!user) throw new UserNotFoundError();
+      const token = generateSecret(32);
+      const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1e3);
+      await this.db.insert(this.verificationTable).values({
+        identifier: user.email,
+        token,
+        expiresAt
+      });
+      await sendVerificationEmail(this.emailAdapter, user.email, token);
+      return token;
+    },
+    verify: async (token) => {
+      const [verification] = await this.db.select().from(this.verificationTable).where(eq3(this.verificationTable.token, token));
+      if (!verification || verification.expiresAt < /* @__PURE__ */ new Date()) {
+        throw new UnauthorizedError("Invalid or expired verification token");
+      }
+      await this.db.update(this.usersTable).set({ emailVerified: /* @__PURE__ */ new Date() }).where(eq3(this.usersTable.email, verification.identifier));
+      await this.db.delete(this.verificationTable).where(eq3(this.verificationTable.token, token));
+    }
+  };
+  // ---------------------------------------------------------------------------
+  // RBAC
+  // ---------------------------------------------------------------------------
+  rbac = {
+    createRole: (data) => createRole({ db: this.db, rolesTable: this.rolesTable, userRolesTable: this.userRolesTable }, data),
+    deleteRole: (roleId) => deleteRole({ db: this.db, rolesTable: this.rolesTable, userRolesTable: this.userRolesTable }, roleId),
+    assignRole: (userId, roleName) => assignRole({ db: this.db, rolesTable: this.rolesTable, userRolesTable: this.userRolesTable }, userId, roleName),
+    removeRole: (userId, roleName) => removeRole({ db: this.db, rolesTable: this.rolesTable, userRolesTable: this.userRolesTable }, userId, roleName),
+    getUserRoles: (userId) => getUserRoles({ db: this.db, rolesTable: this.rolesTable, userRolesTable: this.userRolesTable }, userId),
+    hasRole: (userId, roleName) => hasRole({ db: this.db, rolesTable: this.rolesTable, userRolesTable: this.userRolesTable }, userId, roleName),
+    authorize: (userId, permission) => hasPermission({ db: this.db, rolesTable: this.rolesTable, userRolesTable: this.userRolesTable }, userId, permission)
+  };
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+  isValidEmail(email) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) && email.length <= 254;
+  }
+  isValidPassword(password) {
+    const errors = [];
+    if (password.length < 8) errors.push("Password must be at least 8 characters");
+    if (password.length > 128) errors.push("Password must be at most 128 characters");
+    if (!/[A-Z]/.test(password)) errors.push("Password must contain an uppercase letter");
+    if (!/[a-z]/.test(password)) errors.push("Password must contain a lowercase letter");
+    if (!/[0-9]/.test(password)) errors.push("Password must contain a number");
+    return { valid: errors.length === 0, errors };
+  }
+  /** Generate a CSRF token for a session */
+  generateCsrfToken(sessionToken) {
+    return createHmac2("sha256", this.secret).update(sessionToken).digest("hex");
+  }
+  /** Validate a CSRF token */
+  validateCsrfToken(sessionToken, csrfToken) {
+    const expected = this.generateCsrfToken(sessionToken);
+    const expectedBuf = Buffer.from(expected);
+    const inputBuf = Buffer.from(csrfToken);
+    if (expectedBuf.length !== inputBuf.length) return false;
+    const { timingSafeEqual: timingSafeEqual2 } = __require("crypto");
+    return timingSafeEqual2(expectedBuf, inputBuf);
+  }
+  extractToken(request) {
+    const authHeader = request.headers?.authorization;
+    if (authHeader?.startsWith("Bearer ")) {
+      return authHeader.slice(7);
+    }
+    const cookieHeader = request.headers?.cookie;
+    if (cookieHeader) {
+      const match = cookieHeader.match(/auth-token=([^;]+)/);
+      if (match) return match[1] ?? null;
+    }
+    return null;
+  }
+  sanitizeUser(user) {
+    return {
+      id: user.id,
+      email: user.email,
+      emailVerified: user.emailVerified,
+      name: user.name,
+      image: user.image,
+      twoFactorEnabled: user.twoFactorEnabled,
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt
+    };
+  }
+};
+
+// src/schema/user.ts
+import { pgTable, uuid, text, boolean, timestamp } from "@mountsqli/pg";
+var authUsers = pgTable("auth_users", {
+  id: uuid("id").defaultRandom().primaryKey(),
+  email: text("email").notNull().unique(),
+  emailVerified: timestamp("email_verified", { withTimezone: true }),
+  password: text("password"),
+  // nullable — null for OAuth-only users
+  name: text("name"),
+  image: text("image"),
+  twoFactorEnabled: boolean("two_factor_enabled").default(false).notNull(),
+  twoFactorSecret: text("two_factor_secret"),
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull()
+});
+
+// src/schema/session.ts
+import { pgTable as pgTable2, uuid as uuid2, text as text2, timestamp as timestamp2 } from "@mountsqli/pg";
+var authSessions = pgTable2("auth_sessions", {
+  id: uuid2("id").defaultRandom().primaryKey(),
+  userId: uuid2("user_id").notNull().references(() => authUsers.id, { onDelete: "cascade" }),
+  token: text2("token").notNull().unique(),
+  expiresAt: timestamp2("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: text2("ip_address"),
+  userAgent: text2("user_agent")
+});
+
+// src/schema/account.ts
+import { pgTable as pgTable3, uuid as uuid3, text as text3, timestamp as timestamp3 } from "@mountsqli/pg";
+var authAccounts = pgTable3("auth_accounts", {
+  id: uuid3("id").defaultRandom().primaryKey(),
+  userId: uuid3("user_id").notNull().references(() => authUsers.id, { onDelete: "cascade" }),
+  provider: text3("provider").notNull(),
+  providerAccountId: text3("provider_account_id").notNull(),
+  accessToken: text3("access_token"),
+  refreshToken: text3("refresh_token"),
+  expiresAt: timestamp3("expires_at", { withTimezone: true }),
+  createdAt: timestamp3("created_at", { withTimezone: true }).defaultNow().notNull()
+});
+
+// src/schema/verification.ts
+import { pgTable as pgTable4, uuid as uuid4, text as text4, timestamp as timestamp4 } from "@mountsqli/pg";
+var authVerificationTokens = pgTable4("auth_verification_tokens", {
+  id: uuid4("id").defaultRandom().primaryKey(),
+  identifier: text4("identifier").notNull(),
+  // email address
+  token: text4("token").notNull().unique(),
+  expiresAt: timestamp4("expires_at", { withTimezone: true }).notNull()
+});
+
+// src/schema/role.ts
+import { pgTable as pgTable5, uuid as uuid5, text as text5, json, timestamp as timestamp5 } from "@mountsqli/pg";
+var authRoles = pgTable5("auth_roles", {
+  id: uuid5("id").defaultRandom().primaryKey(),
+  name: text5("name").notNull().unique(),
+  permissions: json("permissions").$type().default([]).notNull(),
+  createdAt: timestamp5("created_at", { withTimezone: true }).defaultNow().notNull()
+});
+
+// src/schema/user-role.ts
+import { pgTable as pgTable6, uuid as uuid6 } from "@mountsqli/pg";
+var authUserRoles = pgTable6("auth_user_roles", {
+  userId: uuid6("user_id").notNull().references(() => authUsers.id, { onDelete: "cascade" }),
+  roleId: uuid6("role_id").notNull().references(() => authRoles.id, { onDelete: "cascade" })
+});
+
+// src/providers/credentials.ts
+function credentials(config) {
+  return {
+    id: "credentials",
+    name: "Email & Password",
+    type: "credentials",
+    authorize: config?.authorize ?? (async () => null)
+  };
+}
+
+// src/providers/google.ts
+function google(config) {
+  return {
+    id: "google",
+    name: "Google",
+    type: "oauth",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scope: config.scope ?? ["openid", "email", "profile"],
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userInfoUrl: "https://www.googleapis.com/oauth2/v2/userinfo"
+  };
+}
+
+// src/providers/github.ts
+function github(config) {
+  return {
+    id: "github",
+    name: "GitHub",
+    type: "oauth",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scope: config.scope ?? ["read:user", "user:email"],
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userInfoUrl: "https://api.github.com/user"
+  };
+}
+
+// src/middleware/generic.ts
+async function resolveAuth(auth, request, options) {
+  const session = await auth.getSession(request);
+  if (options?.required && !session) {
+    throw new UnauthorizedError("Authentication required");
+  }
+  if (options?.requiredRole && session) {
+    const hasRole2 = await auth.rbac.hasRole(session.user.id, options.requiredRole);
+    if (!hasRole2) {
+      throw new ForbiddenError(`Role "${options.requiredRole}" required`);
+    }
+  }
+  if (options?.requiredPermission && session) {
+    const hasPermission2 = await auth.rbac.authorize(session.user.id, options.requiredPermission);
+    if (!hasPermission2) {
+      throw new ForbiddenError(`Permission "${options.requiredPermission}" required`);
+    }
+  }
+  return {
+    user: session?.user ?? null,
+    session
+  };
+}
+
+// src/middleware/express.ts
+function expressMiddleware(auth, options) {
+  return async (req, res, next) => {
+    try {
+      const result = await resolveAuth(auth, { headers: req.headers }, options);
+      req.auth = result;
+      next();
+    } catch (err) {
+      if (options?.onError) {
+        return options.onError(err, req, res, next);
+      }
+      next(err);
+    }
+  };
+}
+function requireAuth(auth, options) {
+  return async (req, res, next) => {
+    try {
+      const result = await resolveAuth(auth, { headers: req.headers }, {
+        ...options,
+        required: true
+      });
+      req.auth = result;
+      next();
+    } catch (err) {
+      if (options?.onError) {
+        return options.onError(err, req, res, next);
+      }
+      next(err);
+    }
+  };
+}
+
+// src/middleware/nextjs.ts
+function nextjsMiddleware(auth, options) {
+  return async (request) => {
+    const result = await resolveAuth(auth, { headers: request.headers });
+    if (options?.authorized) {
+      const isAuthorized = await options.authorized(result.session, request);
+      if (!isAuthorized) {
+        return { redirect: options.pages?.signIn ?? "/auth/signin" };
+      }
+    }
+    if (options?.required && !result.session) {
+      return { redirect: options.pages?.signIn ?? "/auth/signin" };
+    }
+    return null;
+  };
+}
+function nextjsApiAuth(auth) {
+  return async (request) => {
+    return resolveAuth(auth, { headers: Object.fromEntries(request.headers.entries()) });
+  };
+}
+
+// src/middleware/fastify.ts
+function fastifyPlugin(auth, options) {
+  return async function authPlugin(fastify) {
+    fastify.decorateRequest("auth", null);
+    fastify.addHook("onRequest", async (request, reply) => {
+      try {
+        const result = await resolveAuth(auth, { headers: request.headers }, options);
+        request.auth = result;
+      } catch (err) {
+        if (options?.onError) {
+          return options.onError(err, request, reply);
+        }
+        throw err;
+      }
+    });
+  };
+}
+function requireAuthFastify(auth, options) {
+  return async function(request, reply) {
+    try {
+      const result = await resolveAuth(auth, { headers: request.headers }, {
+        ...options,
+        required: true
+      });
+      request.auth = result;
+    } catch (err) {
+      if (options?.onError) {
+        return options.onError(err, request, reply);
+      }
+      throw err;
+    }
+  };
+}
+
+// src/middleware/hono.ts
+function honoMiddleware(auth, options) {
+  return async (c, next) => {
+    try {
+      const result = await resolveAuth(auth, { headers: Object.fromEntries(c.req.raw.headers.entries()) }, options);
+      c.set("auth", result);
+      await next();
+    } catch (err) {
+      if (options?.onError) {
+        return options.onError(err, c);
+      }
+      return c.json({ error: err.message }, 401);
+    }
+  };
+}
+function requireAuthHono(auth, options) {
+  return async (c, next) => {
+    try {
+      const result = await resolveAuth(auth, { headers: Object.fromEntries(c.req.raw.headers.entries()) }, {
+        ...options,
+        required: true
+      });
+      c.set("auth", result);
+      await next();
+    } catch (err) {
+      if (options?.onError) {
+        return options.onError(err, c);
+      }
+      return c.json({ error: err.message }, 401);
+    }
+  };
+}
+
+// src/index.ts
+function createAuth(config) {
+  return new Auth(config);
+}
+export {
+  Auth,
+  AuthError,
+  ConsoleEmailAdapter,
+  EmailAlreadyExistsError,
+  ForbiddenError,
+  InvalidCredentialsError,
+  InvalidTokenError,
+  ProviderError,
+  SessionExpiredError,
+  TwoFactorInvalidError,
+  TwoFactorRequiredError,
+  UnauthorizedError,
+  UserNotFoundError,
+  authAccounts,
+  authRoles,
+  authSessions,
+  authUserRoles,
+  authUsers,
+  authVerificationTokens,
+  createAuth,
+  createToken,
+  credentials,
+  decodeToken,
+  expressMiddleware,
+  fastifyPlugin,
+  generateCode,
+  generateSecret,
+  generateURI,
+  github,
+  google,
+  hashPassword,
+  honoMiddleware,
+  nextjsApiAuth,
+  nextjsMiddleware,
+  requireAuth,
+  requireAuthFastify,
+  requireAuthHono,
+  resolveAuth,
+  sendPasswordResetEmail,
+  sendVerificationEmail,
+  verifyCode,
+  verifyPassword,
+  verifyToken
+};