@pureq/auth 0.2.0

package/README.md

@@ -0,0 +1,293 @@
+# @pureq/auth
+
+@pureq/auth is the authentication and session layer for the pureq ecosystem.
+
+It is designed to give teams both:
+
+- a short, practical onboarding path for shipping auth quickly
+- explicit policy control for security, runtime behavior, and operations
+
+## Design Goals
+
+- framework-neutral core that works across browser, SSR/BFF, Node, and edge
+- explicit security and lifecycle contracts instead of hidden auth behavior
+- production-aware adapter and provider ergonomics
+- migration tooling that turns cutover risk into measurable checks
+
+## Comparison with Better Auth and Auth.js (NextAuth)
+
+All three target modern TypeScript auth, but they optimize for different adoption and operations profiles.
+
+| Concern | Better Auth (general tendency) | Auth.js / NextAuth (general tendency) | @pureq/auth |
+| --- | --- | --- | --- |
+| Primary orientation | framework/app integration speed | Next.js-centric ecosystem with broad adoption history | policy-explicit, framework-neutral core |
+| Default developer flow | batteries-included framework DX | strong Next.js onboarding and established provider patterns | AuthKit/Starter fast path plus explicit lower-level control |
+| Runtime model | framework-focused server flows | primarily Next.js server/client integration surface | browser, SSR/BFF, Node, and edge with shared primitives |
+| Security visibility | secure defaults in framework context | battle-tested defaults with framework conventions | explicit mode-based defaults and policy override diagnostics |
+| Adapter production gate | adapter usage depends on app checks | adapter ecosystem maturity is strong, readiness checks are app-defined | built-in readiness assessment (`probe` + `assess`) |
+| Migration support | docs-driven migration | migration mostly docs/conventions and ecosystem tooling | diagnostics APIs and cutover/rollback checklist generation |
+
+Use Better Auth when tight framework-native velocity is the top priority.
+
+Use Auth.js/NextAuth when Next.js ecosystem fit and long adoption history are the primary decision factors.
+
+Use @pureq/auth when you need one auth core with explicit policy boundaries, deployment-readiness gates, and migration telemetry across mixed runtimes.
+
+## What Is Included
+
+### Core construction APIs
+
+- createAuth
+- createAuthKit
+- createAuthStarter
+
+### Route and framework integration
+
+- createAuthRouteHandlerRecipe
+- createAuthServerActionRecipe
+- createAuthFrameworkContext
+- createAuthRequestAdapter
+- createNextAuthKitPack
+- createExpressAuthKitPack
+- createFastifyAuthKitPack
+- createReactAuthKitBootstrapPack
+
+### Session and state lifecycle
+
+- createAuthSessionManager
+- createAuthSessionStore
+- createReactAuthHooks
+- createVueAuthSessionComposable
+- createBufferedSessionEventExporter
+- composeSessionEventAudits
+- createConsoleSessionEventAudit
+
+### Providers and OIDC
+
+- credentialsProvider
+- emailProvider
+- createTopProviderPreset
+- listTopProviderPresets
+- createOIDCFlow
+- createOIDCFlowFromProvider
+- oidcProviders
+- validateProviderCallbackContract
+- normalizeProviderError
+- PROVIDER_ERROR_NORMALIZATION_TABLE
+
+### Adapters and SQL
+
+- createInMemoryAdapter
+- createPostgresAdapter
+- createMySqlAdapter
+- createSqlAdapter
+- createPostgresExecutor
+- createMySqlExecutor
+- getSqlSchemaStatements
+- probeAdapterCapabilities
+- assessAdapterReadiness
+
+### Security controls
+
+- createAuthCsrfProtection
+- withCsrfProtection
+- createAuthRevocationRegistry
+- withRevocationGuard
+- authEncryptedStore
+- createAuthEncryption
+- verifyJwt
+
+### Migration and diagnostics
+
+- normalizeLegacyAuthTokens
+- migrateLegacyTokensToStore
+- hydrateSessionManagerFromLegacy
+- analyzeAuthMigration
+- formatMigrationParityReport
+- generateMigrationChecklists
+
+## Installation
+
+```bash
+pnpm add @pureq/auth
+```
+
+## Quick Start (Recommended)
+
+For the shortest implementation path, start from createAuthStarter.
+
+```ts
+import { createAuthStarter, createInMemoryAdapter, credentialsProvider } from "@pureq/auth";
+
+const starter = await createAuthStarter({
+  security: { mode: "ssr-bff" },
+  adapter: createInMemoryAdapter(),
+  providers: [
+    credentialsProvider({
+      authorize: async (credentials) => {
+        if (credentials.username === "alice" && credentials.password === "secret") {
+          return { id: "alice", email: "alice@example.com" };
+        }
+        return null;
+      },
+    }),
+  ],
+});
+
+export const handlers = starter.kit.handlers;
+```
+
+## AuthKit-First Setup
+
+If you want explicit assembly while keeping strong defaults, use createAuthKit.
+
+```ts
+import { createAuthKit, createInMemoryAdapter } from "@pureq/auth";
+
+const kit = createAuthKit({
+  security: { mode: "ssr-bff" },
+  adapter: createInMemoryAdapter(),
+});
+
+export const { handleSignIn, handleCallback, handleSession, handleSignOut } = kit.handlers;
+```
+
+## Providers
+
+Top-provider presets and generic OIDC helpers are available.
+
+```ts
+import { createTopProviderPreset, listTopProviderPresets } from "@pureq/auth";
+
+const supported = listTopProviderPresets();
+const google = createTopProviderPreset("google");
+```
+
+Built-in top presets include:
+
+- google
+- github
+- microsoft
+- auth0
+- apple
+- okta
+- keycloak
+- cognito
+- gitlab
+- discord
+- slack
+- generic
+
+## SQL Adapters and Readiness
+
+```ts
+import {
+  createPostgresAdapter,
+  getSqlSchemaStatements,
+  assessAdapterReadiness,
+} from "@pureq/auth";
+
+const adapter = createPostgresAdapter(pgPool);
+const report = assessAdapterReadiness(adapter, {
+  deployment: "production",
+  requireEmailProviderSupport: true,
+});
+
+if (report.status !== "ready") {
+  throw new Error(`adapter not ready: ${report.status}`);
+}
+
+for (const sql of getSqlSchemaStatements("postgres")) {
+  await pgPool.query(sql);
+}
+```
+
+Versioned SQL templates are included in:
+
+- [PostgreSQL v1 template](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/sql/migrations/v1/postgres.sql)
+- [MySQL v1 template](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/sql/migrations/v1/mysql.sql)
+
+## Security Model
+
+### Automatic behavior
+
+- OIDC callback replay protection with TTL cache
+- JWT verification hardening (no alg:none acceptance)
+- secure cookie defaults in cookie-backed flows
+
+### Opt-in behavior
+
+- CSRF middleware for browser-mutating endpoints
+- revocation guard for jti/sid/sub invalidation
+- encrypted token storage
+- broadcast sync for multi-tab state propagation
+
+### Runtime-mode defaults
+
+Security defaults are mode-aware:
+
+- browser-spa
+- ssr-bff
+- edge
+
+Policy overrides are diagnosable through onPolicyOverride hooks.
+
+## Migration Workflow
+
+Migration helpers are provided for:
+
+- legacy token normalization
+- store/session hydration
+- parity report generation
+- cutover and rollback checklist generation
+
+Starter can run adapter preflight at process boot and fail early on blocked readiness.
+
+## Framework and Runtime Coverage
+
+Core primitives are framework-neutral.
+
+Thin packs and recipes are provided for:
+
+- Next.js
+- Express
+- Fastify
+- React bootstrap
+- SSR/BFF bridge patterns
+- edge-compatible context and response handoff
+
+## Documentation
+
+- [Documentation Index](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/README.md)
+- [Package Overview](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/auth_package.md)
+- [AuthKit Quickstart](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/authkit_quickstart.md)
+- [Auth Starter](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/auth_starter.md)
+- [Implementation Examples](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/implementation_examples.md)
+- [Framework Packs](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/framework_packs.md)
+- [Framework Adapters](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/framework_adapters.md)
+- [Framework Hooks](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/framework_hooks.md)
+- [Security Controls](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/security_controls.md)
+- [Session Event Operations](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/session_event_operations.md)
+- [SSR Bridge](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/ssr_bridge.md)
+- [SQL Adapters Quickstart](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/sql_adapters_quickstart.md)
+- [Adapter Compatibility Matrix](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/adapter_compatibility_matrix.md)
+- [Adapter Harness](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/adapter_harness.md)
+- [Provider Priorities](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/provider_priorities.md)
+- [Provider Error Normalization](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/provider_error_normalization.md)
+- [Migration Guide](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/migration_guide.md)
+- [Migration Playbook](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/migration_playbook.md)
+- [Templates and Presets](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/templates_and_presets.md)
+- [Event Adapters](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/event_adapters.md)
+- [Error Code Reference](https://github.com/shiro-shihi/pureq/blob/main/packages/auth/docs/error_code_reference.md)
+
+## Testing
+
+```bash
+pnpm --filter @pureq/auth test:unit
+pnpm --filter @pureq/auth test:contract
+pnpm --filter @pureq/auth test:integration
+```
+
+## License
+
+MIT © Shihiro

package/dist/adapter/capabilities.d.ts

@@ -0,0 +1,23 @@
+import type { AuthDatabaseAdapter } from "../shared";
+export interface AdapterCapabilityReport {
+    readonly hasCoreUserMethods: boolean;
+    readonly hasCoreAccountMethods: boolean;
+    readonly hasCoreSessionMethods: boolean;
+    readonly hasVerificationTokenMethods: boolean;
+    readonly missingRequired: readonly string[];
+    readonly missingRecommended: readonly string[];
+    readonly level: "level-a" | "level-b" | "level-c";
+}
+export interface AdapterReadinessOptions {
+    readonly deployment?: "development" | "production";
+    readonly requireEmailProviderSupport?: boolean;
+}
+export interface AdapterReadinessReport {
+    readonly capability: AdapterCapabilityReport;
+    readonly blockers: readonly string[];
+    readonly warnings: readonly string[];
+    readonly status: "ready" | "needs-attention" | "blocked";
+}
+export declare function probeAdapterCapabilities(adapter: AuthDatabaseAdapter): AdapterCapabilityReport;
+export declare function assessAdapterReadiness(adapter: AuthDatabaseAdapter, options?: AdapterReadinessOptions): AdapterReadinessReport;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/adapter/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/adapter/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAAC;CAC1D;AAMD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,uBAAuB,CAwD9F;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CA+BxB"}

package/dist/adapter/capabilities.js

@@ -0,0 +1,77 @@
+function hasMethod(target, key) {
+    return typeof target[String(key)] === "function";
+}
+export function probeAdapterCapabilities(adapter) {
+    const required = [
+        "createUser",
+        "getUser",
+        "getUserByEmail",
+        "getUserByAccount",
+        "updateUser",
+        "linkAccount",
+        "createSession",
+        "getSessionAndUser",
+        "updateSession",
+        "deleteSession",
+    ];
+    const recommended = [
+        "deleteUser",
+        "unlinkAccount",
+        "createVerificationToken",
+        "useVerificationToken",
+    ];
+    const missingRequired = required.filter((key) => !hasMethod(adapter, key)).map(String);
+    const missingRecommended = recommended.filter((key) => !hasMethod(adapter, key)).map(String);
+    const hasCoreUserMethods = hasMethod(adapter, "createUser") &&
+        hasMethod(adapter, "getUser") &&
+        hasMethod(adapter, "getUserByEmail") &&
+        hasMethod(adapter, "updateUser");
+    const hasCoreAccountMethods = hasMethod(adapter, "getUserByAccount") && hasMethod(adapter, "linkAccount");
+    const hasCoreSessionMethods = hasMethod(adapter, "createSession") &&
+        hasMethod(adapter, "getSessionAndUser") &&
+        hasMethod(adapter, "updateSession") &&
+        hasMethod(adapter, "deleteSession");
+    const hasVerificationTokenMethods = hasMethod(adapter, "createVerificationToken") && hasMethod(adapter, "useVerificationToken");
+    const level = missingRequired.length === 0 && missingRecommended.length === 0
+        ? "level-a"
+        : missingRequired.length === 0
+            ? "level-b"
+            : "level-c";
+    return {
+        hasCoreUserMethods,
+        hasCoreAccountMethods,
+        hasCoreSessionMethods,
+        hasVerificationTokenMethods,
+        missingRequired,
+        missingRecommended,
+        level,
+    };
+}
+export function assessAdapterReadiness(adapter, options = {}) {
+    const capability = probeAdapterCapabilities(adapter);
+    const blockers = [];
+    const warnings = [];
+    const deployment = options.deployment ?? "development";
+    for (const missing of capability.missingRequired) {
+        blockers.push(`missing required adapter method: ${missing}`);
+    }
+    if (options.requireEmailProviderSupport && !capability.hasVerificationTokenMethods) {
+        blockers.push("email provider flows require createVerificationToken/useVerificationToken support");
+    }
+    if (deployment === "production") {
+        if (capability.level === "level-c") {
+            blockers.push("level-c adapters are not production-ready");
+        }
+        for (const missing of capability.missingRecommended) {
+            warnings.push(`missing recommended production method: ${missing}`);
+        }
+    }
+    const status = blockers.length > 0 ? "blocked" : warnings.length > 0 ? "needs-attention" : "ready";
+    return {
+        capability,
+        blockers,
+        warnings,
+        status,
+    };
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/adapter/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/adapter/capabilities.ts"],"names":[],"mappings":"AAwBA,SAAS,SAAS,CAAmB,MAAS,EAAE,GAA8B;IAC5E,OAAO,OAAQ,MAAkC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA4B;IACnE,MAAM,QAAQ,GAAqC;QACjD,YAAY;QACZ,SAAS;QACT,gBAAgB;QAChB,kBAAkB;QAClB,YAAY;QACZ,aAAa;QACb,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,eAAe;KAChB,CAAC;IAEF,MAAM,WAAW,GAAqC;QACpD,YAAY;QACZ,eAAe;QACf,yBAAyB;QACzB,sBAAsB;KACvB,CAAC;IAEF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvF,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7F,MAAM,kBAAkB,GACtB,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;QAChC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7B,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;QACpC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEnC,MAAM,qBAAqB,GAAG,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAE1G,MAAM,qBAAqB,GACzB,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;QACnC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;QACvC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;QACnC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAEtC,MAAM,2BAA2B,GAAG,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAEhI,MAAM,KAAK,GACT,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAElB,OAAO;QACL,kBAAkB;QAClB,qBAAqB;QACrB,qBAAqB;QACrB,2BAA2B;QAC3B,eAAe;QACf,kBAAkB;QAClB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAA4B,EAC5B,UAAmC,EAAE;IAErC,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IAEvD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,2BAA2B,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,0CAA0C,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAqC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;IAErI,OAAO;QACL,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/adapter/index.d.ts

@@ -0,0 +1,12 @@
+import type { AuthDatabaseAdapter } from "../shared";
+export { probeAdapterCapabilities, assessAdapterReadiness } from "./capabilities";
+export type { AdapterCapabilityReport, AdapterReadinessOptions, AdapterReadinessReport } from "./capabilities";
+export { createMySqlAdapter, createMySqlExecutor, createPostgresAdapter, createPostgresExecutor, createSqlAdapter, getSqlSchemaStatements, } from "./sql";
+export type { MySqlClientLike, PostgresClientLike, SqlAdapterOptions, SqlDialect, SqlExecutor, SqlRow, SqlValue, TableNames, } from "./sql";
+/**
+ * In-memory database adapter for testing and development.
+ * FEAT-H1: Implements the full AuthDatabaseAdapter interface.
+ */
+export declare function createInMemoryAdapter(): AuthDatabaseAdapter;
+export type { AuthDatabaseAdapter, AuthUser, AuthAccount, AuthPersistedSession, AuthVerificationToken } from "../shared";
+//# sourceMappingURL=index.d.ts.map

package/dist/adapter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapter/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAKpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAClF,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC/G,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,OAAO,CAAC;AACf,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,MAAM,EACN,QAAQ,EACR,UAAU,GACX,MAAM,OAAO,CAAC;AAEf;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,mBAAmB,CAoI3D;AAED,YAAY,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC"}

package/dist/adapter/index.js

@@ -0,0 +1,121 @@
+export { probeAdapterCapabilities, assessAdapterReadiness } from "./capabilities";
+export { createMySqlAdapter, createMySqlExecutor, createPostgresAdapter, createPostgresExecutor, createSqlAdapter, getSqlSchemaStatements, } from "./sql";
+/**
+ * In-memory database adapter for testing and development.
+ * FEAT-H1: Implements the full AuthDatabaseAdapter interface.
+ */
+export function createInMemoryAdapter() {
+    const users = new Map();
+    const accounts = [];
+    const sessions = new Map();
+    const verificationTokens = new Map();
+    let userIdCounter = 0;
+    const generateId = () => {
+        userIdCounter += 1;
+        return `user-${userIdCounter}-${Math.random().toString(36).slice(2, 8)}`;
+    };
+    return {
+        async createUser(user) {
+            const id = generateId();
+            const newUser = { ...user, id };
+            users.set(id, newUser);
+            return newUser;
+        },
+        async getUser(id) {
+            return users.get(id) ?? null;
+        },
+        async getUserByEmail(email) {
+            for (const user of users.values()) {
+                if (user.email === email) {
+                    return user;
+                }
+            }
+            return null;
+        },
+        async getUserByAccount(provider, providerAccountId) {
+            const account = accounts.find((a) => a.provider === provider && a.providerAccountId === providerAccountId);
+            if (!account) {
+                return null;
+            }
+            return users.get(account.userId) ?? null;
+        },
+        async updateUser(user) {
+            const existing = users.get(user.id);
+            if (!existing) {
+                throw new Error(`pureq: user ${user.id} not found`);
+            }
+            const updated = { ...existing, ...user };
+            users.set(user.id, updated);
+            return updated;
+        },
+        async deleteUser(id) {
+            users.delete(id);
+            const toRemove = accounts.filter((a) => a.userId === id);
+            for (const acc of toRemove) {
+                const idx = accounts.indexOf(acc);
+                if (idx !== -1) {
+                    accounts.splice(idx, 1);
+                }
+            }
+        },
+        async linkAccount(account) {
+            accounts.push(account);
+            return account;
+        },
+        async unlinkAccount(provider, providerAccountId) {
+            const idx = accounts.findIndex((a) => a.provider === provider && a.providerAccountId === providerAccountId);
+            if (idx !== -1) {
+                accounts.splice(idx, 1);
+            }
+        },
+        async createSession(session) {
+            sessions.set(session.sessionToken, { session, userId: session.userId });
+            return session;
+        },
+        async getSessionAndUser(sessionToken) {
+            const entry = sessions.get(sessionToken);
+            if (!entry) {
+                return null;
+            }
+            if (entry.session.expiresAt < new Date()) {
+                sessions.delete(sessionToken);
+                return null;
+            }
+            const user = users.get(entry.userId);
+            if (!user) {
+                return null;
+            }
+            return { session: entry.session, user };
+        },
+        async updateSession(session) {
+            const existing = sessions.get(session.sessionToken);
+            if (!existing) {
+                return null;
+            }
+            const updated = { ...existing.session, ...session };
+            sessions.set(session.sessionToken, { session: updated, userId: existing.userId });
+            return updated;
+        },
+        async deleteSession(sessionToken) {
+            sessions.delete(sessionToken);
+        },
+        async createVerificationToken(token) {
+            const key = `${token.identifier}:${token.token}`;
+            verificationTokens.set(key, token);
+            return token;
+        },
+        async useVerificationToken(params) {
+            const key = `${params.identifier}:${params.token}`;
+            const token = verificationTokens.get(key);
+            if (!token) {
+                return null;
+            }
+            verificationTokens.delete(key);
+            if (token.expiresAt < new Date()) {
+                return null;
+            }
+            return token;
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/adapter/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapter/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAElF,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,OAAO,CAAC;AAYf;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6D,CAAC;IACtF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAiC,CAAC;IACpE,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,UAAU,GAAG,GAAW,EAAE;QAC9B,aAAa,IAAI,CAAC,CAAC;QACnB,OAAO,QAAQ,aAAa,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,OAAO,GAAa,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBACzB,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB;YAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,KAAK,iBAAiB,CAC5E,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE;YACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;YACzD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,iBAAiB;YAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,KAAK,iBAAiB,CAC5E,CAAC;YACF,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAY;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBACzC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC9B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;YACpD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,YAAY;YAC9B,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,KAAK;YACjC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACjD,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,MAAM;YAC/B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YACD,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapter/sql.d.ts

@@ -0,0 +1,36 @@
+import type { AuthDatabaseAdapter } from "../shared";
+type SqlValue = string | number | boolean | Date | null;
+type SqlRow = Readonly<Record<string, unknown>>;
+type SqlDialect = "postgres" | "mysql";
+interface TableNames {
+    readonly users: string;
+    readonly accounts: string;
+    readonly sessions: string;
+    readonly verificationTokens: string;
+}
+interface SqlExecutor {
+    readonly select: (sql: string, params: readonly SqlValue[]) => Promise<readonly SqlRow[]>;
+    readonly execute: (sql: string, params: readonly SqlValue[]) => Promise<{
+        readonly affectedRows: number;
+    }>;
+}
+interface SqlAdapterOptions {
+    readonly tableNames?: Partial<TableNames>;
+}
+export interface PostgresClientLike {
+    query(sql: string, params?: readonly SqlValue[]): Promise<{
+        readonly rows?: readonly SqlRow[];
+        readonly rowCount?: number | null;
+    }>;
+}
+export interface MySqlClientLike {
+    execute(sql: string, params?: readonly SqlValue[]): Promise<readonly [unknown, unknown?]>;
+}
+export declare function createPostgresExecutor(client: PostgresClientLike): SqlExecutor;
+export declare function createMySqlExecutor(client: MySqlClientLike): SqlExecutor;
+export declare function createSqlAdapter(dialect: SqlDialect, executor: SqlExecutor, options?: SqlAdapterOptions): AuthDatabaseAdapter;
+export declare function createPostgresAdapter(client: PostgresClientLike, options?: SqlAdapterOptions): AuthDatabaseAdapter;
+export declare function createMySqlAdapter(client: MySqlClientLike, options?: SqlAdapterOptions): AuthDatabaseAdapter;
+export declare function getSqlSchemaStatements(dialect: SqlDialect, options?: SqlAdapterOptions): readonly string[];
+export type { SqlDialect, SqlAdapterOptions, TableNames, SqlExecutor, SqlRow, SqlValue };
+//# sourceMappingURL=sql.d.ts.map

package/dist/adapter/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../src/adapter/sql.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,mBAAmB,EAIpB,MAAM,WAAW,CAAC;AAEnB,KAAK,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AACxD,KAAK,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhD,KAAK,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;AAEvC,UAAU,UAAU;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5G;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACrI;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3F;AAwFD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,CAW9E;AAmBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAWxE;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,iBAAsB,GAC9B,mBAAmB,CAgKrB;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,mBAAmB,CAErB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,iBAAsB,GAC9B,mBAAmB,CAErB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,GAAE,iBAAsB,GAAG,SAAS,MAAM,EAAE,CAoB9G;AAED,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC"}