@revealui/auth 0.3.6 → 0.3.8

package/README.md

@@ -1,17 +1,17 @@
 # @revealui/auth
 
-Session-based authentication for RevealUI — database-backed sessions, rate limiting, brute force protection, and password reset.
+Session-based authentication for RevealUI  -  database-backed sessions, rate limiting, brute force protection, and password reset.
 
 ## Features
 
-- **Database Sessions** — PostgreSQL/NeonDB-backed sessions with SHA-256 token hashing
-- **Secure Cookies** — HTTP-only, SameSite, secure flag, cross-subdomain support
-- **Rate Limiting** — Configurable per-endpoint rate limits stored in database
-- **Brute Force Protection** — Progressive lockout on failed sign-in attempts
-- **Password Reset** — Token-based password reset flow with email integration
-- **Password Validation** — Strength requirements and common password checks
-- **React Hooks** — Client-side session management (`useSession`, `useSignIn`, `useSignOut`)
-- **Framework Agnostic** — Works with Next.js, Hono, and other Node.js frameworks
+- **Database Sessions**  -  PostgreSQL/NeonDB-backed sessions with SHA-256 token hashing
+- **Secure Cookies**  -  HTTP-only, SameSite, secure flag, cross-subdomain support
+- **Rate Limiting**  -  Configurable per-endpoint rate limits stored in database
+- **Brute Force Protection**  -  Progressive lockout on failed sign-in attempts
+- **Password Reset**  -  Token-based password reset flow with email integration
+- **Password Validation**  -  Strength requirements and common password checks
+- **React Hooks**  -  Client-side session management (`useSession`, `useSignIn`, `useSignOut`)
+- **Framework Agnostic**  -  Works with Next.js, Hono, and other Node.js frameworks
 
 ## Installation
 
@@ -95,8 +95,8 @@ pnpm test
 - You need session-based auth with database-backed sessions for a RevealUI app
 - You want built-in brute force protection and rate limiting without external services
 - You need React hooks for client-side session management (`useSession`, `useSignIn`, `useSignOut`)
-- **Not** for OAuth-only flows — use a dedicated OAuth provider and wire tokens through this package
-- **Not** for stateless JWT auth — this package uses database sessions by design
+- **Not** for OAuth-only flows  -  use a dedicated OAuth provider and wire tokens through this package
+- **Not** for stateless JWT auth  -  this package uses database sessions by design
 
 ## JOSHUA Alignment
 
@@ -106,9 +106,9 @@ pnpm test
 
 ## Related
 
-- [Core Package](../core/README.md) — CMS engine (uses auth for access control)
-- [DB Package](../db/README.md) — Database schema (sessions, users, rate_limits tables)
-- [Auth Guide](../../docs/AUTH.md) — Architecture, usage patterns, and security design
+- [Core Package](../core/README.md)  -  Runtime engine (uses auth for access control)
+- [DB Package](../db/README.md)  -  Database schema (sessions, users, rate_limits tables)
+- [Auth Guide](../../docs/AUTH.md)  -  Architecture, usage patterns, and security design
 
 ## License
 

package/dist/react/useMFA.d.ts

@@ -15,7 +15,7 @@ export interface MFASetupData {
     backupCodes: string[];
 }
 export interface UseMFASetupResult {
-    /** Initiate MFA setup — returns secret, QR URI, and backup codes */
+    /** Initiate MFA setup  -  returns secret, QR URI, and backup codes */
     setup: () => Promise<MFASetupData | null>;
     /** Verify a TOTP code to confirm setup */
     verifySetup: (code: string) => Promise<boolean>;

package/dist/react/useMFA.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useMFA.d.ts","sourceRoot":"","sources":["../../src/react/useMFA.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1C,0CAA0C;IAC1C,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,IAAI,iBAAiB,CAqE/C;AAED,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,IAAI,kBAAkB,CAsEjD"}
+{"version":3,"file":"useMFA.d.ts","sourceRoot":"","sources":["../../src/react/useMFA.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1C,0CAA0C;IAC1C,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,IAAI,iBAAiB,CAqE/C;AAED,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,IAAI,kBAAkB,CAsEjD"}

package/dist/server/audit-bridge.d.ts

@@ -1,5 +1,5 @@
 /**
- * Security Event Bridge — Connects auth events to the audit trail.
+ * Security Event Bridge  -  Connects auth events to the audit trail.
  *
  * Each function wraps an auth operation with structured audit logging
  * via the AuditSystem from @revealui/security. Uses lazy import to

package/dist/server/audit-bridge.js

@@ -1,5 +1,5 @@
 /**
- * Security Event Bridge — Connects auth events to the audit trail.
+ * Security Event Bridge  -  Connects auth events to the audit trail.
  *
  * Each function wraps an auth operation with structured audit logging
  * via the AuditSystem from @revealui/security. Uses lazy import to
@@ -20,7 +20,7 @@ async function getAudit() {
     }
 }
 /**
- * Internal helper — logs an audit event, silently skipping if the
+ * Internal helper  -  logs an audit event, silently skipping if the
  * audit system is unavailable.
  */
 async function logAuditEvent(event) {

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AASpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAqKvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAiBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAsLvB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AASpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAuKvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAiBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAgMvB"}

package/dist/server/auth.js

@@ -12,7 +12,7 @@ import { and, eq, isNull } from 'drizzle-orm';
 import { clearFailedAttempts, isAccountLocked, recordFailedAttempt } from './brute-force.js';
 import { validatePasswordStrength } from './password-validation.js';
 import { checkRateLimit } from './rate-limit.js';
-import { createSession } from './session.js';
+import { createSession, rotateSession } from './session.js';
 /** Grace period after signup during which unverified users can still sign in (24 hours) */
 const EMAIL_VERIFICATION_GRACE_PERIOD_MS = 24 * 60 * 60 * 1000;
 /**
@@ -137,7 +137,7 @@ export async function signIn(email, password, options) {
                 };
             }
         }
-        // Check if MFA is enabled — if so, return early and require TOTP verification
+        // Check if MFA is enabled  -  if so, return early and require TOTP verification
         if (user.mfaEnabled) {
             return {
                 success: true,
@@ -145,10 +145,12 @@ export async function signIn(email, password, options) {
                 mfaUserId: user.id,
             };
         }
-        // Create session
+        // Rotate session: delete all existing sessions for this user, then create
+        // a fresh one. This prevents session fixation attacks where an attacker
+        // plants a session token that the victim later authenticates.
         let token;
         try {
-            const sessionResult = await createSession(user.id, {
+            const sessionResult = await rotateSession(user.id, {
                 userAgent: options?.userAgent || 'Unknown',
                 ipAddress: options?.ipAddress || 'Unknown',
             });
@@ -238,6 +240,15 @@ export async function signUp(email, password, name, options) {
                 error: passwordValidation.errors.join('. '),
             };
         }
+        // Check password against known data breaches (non-blocking on failure)
+        const { checkPasswordBreach } = await import('./password-validation.js');
+        const breachCount = await checkPasswordBreach(password);
+        if (breachCount > 0) {
+            return {
+                success: false,
+                error: `This password has appeared in ${breachCount.toLocaleString()} data breaches. Please choose a different password.`,
+            };
+        }
         let db;
         try {
             db = getClient();

package/dist/server/mfa-enforcement.js

@@ -39,7 +39,7 @@ export function requireMfa(options = {}) {
     return (request) => {
         const session = request.session;
         if (!session) {
-            // No session — nothing to enforce (auth middleware handles this)
+            // No session  -  nothing to enforce (auth middleware handles this)
             return { allowed: true };
         }
         const user = session.user;

package/dist/server/mfa.d.ts

@@ -1,5 +1,5 @@
 /**
- * MFA/2FA — TOTP-based Multi-Factor Authentication
+ * MFA/2FA  -  TOTP-based Multi-Factor Authentication
  *
  * Uses the timing-safe TOTP implementation from @revealui/core/security/auth.
  * Backup codes are bcrypt-hashed for storage (one-time use, consumed on verify).

package/dist/server/mfa.js

@@ -1,5 +1,5 @@
 /**
- * MFA/2FA — TOTP-based Multi-Factor Authentication
+ * MFA/2FA  -  TOTP-based Multi-Factor Authentication
  *
  * Uses the timing-safe TOTP implementation from @revealui/core/security/auth.
  * Backup codes are bcrypt-hashed for storage (one-time use, consumed on verify).
@@ -274,7 +274,7 @@ export async function disableMFA(userId, proof) {
             return { success: false, error: 'Invalid password' };
         }
     }
-    // For passkey proof, the API route has already performed the WebAuthn assertion —
+    // For passkey proof, the API route has already performed the WebAuthn assertion  -
     // the `verified: true` flag is trusted as a server-side signal.
     // Clear all MFA data
     await db

package/dist/server/oauth.d.ts

@@ -1,5 +1,5 @@
 /**
- * OAuth Core — State Management + User Upsert
+ * OAuth Core  -  State Management + User Upsert
  *
  * CSRF state: signed cookie using HMAC-SHA256 over a base64url payload.
  * Provider dispatch: routes to Google / GitHub / Vercel provider modules.
@@ -16,7 +16,7 @@ export interface ProviderUser {
  * Generate a signed OAuth state token.
  *
  * State encodes provider + redirectTo + nonce as base64url JSON.
- * Cookie value is `<state>.<hmac>` — the HMAC is over the state string
+ * Cookie value is `<state>.<hmac>`  -  the HMAC is over the state string
  * using REVEALUI_SECRET, providing CSRF protection without a DB table.
  */
 export declare function generateOAuthState(provider: string, redirectTo: string, options?: {
@@ -24,6 +24,7 @@ export declare function generateOAuthState(provider: string, redirectTo: string,
 }): {
     state: string;
     cookieValue: string;
+    codeChallenge: string;
 };
 /**
  * Verify a signed OAuth state token from the callback.
@@ -34,9 +35,10 @@ export declare function verifyOAuthState(state: string | null | undefined, cooki
     provider: string;
     redirectTo: string;
     linkConsent?: boolean;
+    codeVerifier?: string;
 } | null;
-export declare function buildAuthUrl(provider: string, redirectUri: string, state: string): string;
-export declare function exchangeCode(provider: string, code: string, redirectUri: string): Promise<string>;
+export declare function buildAuthUrl(provider: string, redirectUri: string, state: string, codeChallenge?: string): string;
+export declare function exchangeCode(provider: string, code: string, redirectUri: string, codeVerifier?: string): Promise<string>;
 export declare function fetchProviderUser(provider: string, accessToken: string): Promise<ProviderUser>;
 export interface UpsertOAuthOptions {
     /**

package/dist/server/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/server/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAMxC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAkBxC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAqDxE;AAwBD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CASzF;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAQvB;AAMD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmGf;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,IAAI,CAAC,CAiEf;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCxF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAajG"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/server/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAMxC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAuB/D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwD/F;AAwBD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CASR;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAQvB;AAMD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmGf;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,IAAI,CAAC,CAiEf;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCxF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAajG"}

package/dist/server/oauth.js

@@ -1,5 +1,5 @@
 /**
- * OAuth Core — State Management + User Upsert
+ * OAuth Core  -  State Management + User Upsert
  *
  * CSRF state: signed cookie using HMAC-SHA256 over a base64url payload.
  * Provider dispatch: routes to Google / GitHub / Vercel provider modules.
@@ -21,15 +21,19 @@ import * as vercel from './providers/vercel.js';
  * Generate a signed OAuth state token.
  *
  * State encodes provider + redirectTo + nonce as base64url JSON.
- * Cookie value is `<state>.<hmac>` — the HMAC is over the state string
+ * Cookie value is `<state>.<hmac>`  -  the HMAC is over the state string
  * using REVEALUI_SECRET, providing CSRF protection without a DB table.
  */
 export function generateOAuthState(provider, redirectTo, options) {
     const nonce = crypto.randomBytes(16).toString('hex');
+    // PKCE: generate a code_verifier (RFC 7636 §4.1  -  32 random bytes → 43 base64url chars)
+    const codeVerifier = crypto.randomBytes(32).toString('base64url');
+    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
     const payload = JSON.stringify({
         provider,
         redirectTo,
         nonce,
+        cv: codeVerifier,
         ...(options?.linkConsent ? { linkConsent: true } : {}),
     });
     const state = Buffer.from(payload).toString('base64url');
@@ -38,8 +42,9 @@ export function generateOAuthState(provider, redirectTo, options) {
         throw new Error('REVEALUI_SECRET is required for OAuth state signing. ' +
             'Set it in your environment variables.');
     }
+    // lgtm[js/insufficient-password-hash] - HMAC-SHA256 for CSRF state signing, not password hashing
     const hmac = crypto.createHmac('sha256', secret).update(state).digest('hex');
-    return { state, cookieValue: `${state}.${hmac}` };
+    return { state, cookieValue: `${state}.${hmac}`, codeChallenge };
 }
 /**
  * Verify a signed OAuth state token from the callback.
@@ -64,8 +69,9 @@ export function verifyOAuthState(state, cookieValue) {
         throw new Error('REVEALUI_SECRET is required for OAuth state verification. ' +
             'Set it in your environment variables.');
     }
+    // lgtm[js/insufficient-password-hash] - HMAC-SHA256 for CSRF state verification, not password hashing
     const expectedHmac = crypto.createHmac('sha256', secret).update(state).digest('hex');
-    // Both are hex-encoded SHA-256 HMACs — must be exactly 64 hex characters.
+    // Both are hex-encoded SHA-256 HMACs  -  must be exactly 64 hex characters.
     // Reject wrong-length inputs immediately; do NOT pad (padding enables forged matches
     // where a short storedHmac is zero-padded to collide with the expected hash).
     if (storedHmac.length !== 64 || expectedHmac.length !== 64)
@@ -84,6 +90,7 @@ export function verifyOAuthState(state, cookieValue) {
             provider: parsed.provider,
             redirectTo: parsed.redirectTo,
             ...(parsed.linkConsent ? { linkConsent: true } : {}),
+            ...(parsed.cv ? { codeVerifier: parsed.cv } : {}),
         };
     }
     catch {
@@ -108,7 +115,7 @@ function getClientId(provider) {
         throw new Error(`Missing client ID for provider: ${provider}`);
     return id;
 }
-export function buildAuthUrl(provider, redirectUri, state) {
+export function buildAuthUrl(provider, redirectUri, state, codeChallenge) {
     if (!isProvider(provider))
         throw new Error(`Unknown provider: ${provider}`);
     const clientId = getClientId(provider);
@@ -117,9 +124,9 @@ export function buildAuthUrl(provider, redirectUri, state) {
         github: github.buildAuthUrl,
         vercel: vercel.buildAuthUrl,
     };
-    return builders[provider](clientId, redirectUri, state);
+    return builders[provider](clientId, redirectUri, state, codeChallenge);
 }
-export async function exchangeCode(provider, code, redirectUri) {
+export async function exchangeCode(provider, code, redirectUri, codeVerifier) {
     if (!isProvider(provider))
         throw new Error(`Unknown provider: ${provider}`);
     const exchangers = {
@@ -127,7 +134,7 @@ export async function exchangeCode(provider, code, redirectUri) {
         github: github.exchangeCode,
         vercel: vercel.exchangeCode,
     };
-    return exchangers[provider](code, redirectUri);
+    return exchangers[provider](code, redirectUri, codeVerifier);
 }
 export async function fetchProviderUser(provider, accessToken) {
     if (!isProvider(provider))
@@ -194,7 +201,7 @@ export async function upsertOAuthUser(provider, providerUser, options) {
             .limit(1);
         if (existingUser) {
             if (options?.linkConsent) {
-                // User explicitly consented to link — use the existing account
+                // User explicitly consented to link  -  use the existing account
                 userId = existingUser.id;
                 isNewUser = false;
                 logger.info(`Linking ${provider} account to existing user ${userId} (consent-based)`);
@@ -266,7 +273,7 @@ export async function linkOAuthAccount(userId, provider, providerUser) {
         .limit(1);
     if (existingLink) {
         if (existingLink.userId === userId) {
-            // Already linked to this user — refresh metadata and return
+            // Already linked to this user  -  refresh metadata and return
             await db
                 .update(oauthAccounts)
                 .set({
@@ -281,7 +288,7 @@ export async function linkOAuthAccount(userId, provider, providerUser) {
                 throw new Error('Authenticated user not found in database');
             return user;
         }
-        // Linked to a different user — cannot steal the identity
+        // Linked to a different user  -  cannot steal the identity
         throw new Error('This provider account is already linked to another user. Unlink it from the other account first.');
     }
     // 2. Check the authenticated user exists

package/dist/server/passkey.d.ts

@@ -13,9 +13,9 @@ export interface PasskeyConfig {
     maxPasskeysPerUser: number;
     /** Challenge TTL in ms (default: 5 minutes) */
     challengeTtlMs: number;
-    /** Relying Party ID — domain name (default: 'localhost') */
+    /** Relying Party ID  -  domain name (default: 'localhost') */
     rpId: string;
-    /** Relying Party name — user-visible (default: 'RevealUI') */
+    /** Relying Party name  -  user-visible (default: 'RevealUI') */
     rpName: string;
     /** Expected origin(s) for verification (default: 'http://localhost:4000') */
     origin: string | string[];
@@ -93,7 +93,7 @@ export declare function verifyAuthentication(response: AuthenticationResponseJSO
     newCounter: number;
 }>;
 /**
- * List all passkeys for a user (safe for client — excludes publicKey and counter).
+ * List all passkeys for a user (safe for client  -  excludes publicKey and counter).
  */
 export declare function listPasskeys(userId: string): Promise<{
     id: string;

package/dist/server/passkey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/server/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EACV,0BAA0B,EAC1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAahC,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC3B;AAaD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAGxE;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAgBD;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAC/B,OAAO,CAAC,sCAAsC,CAAC,CAwBjD;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,wBAAwB,EAClC,iBAAiB,EAAE,MAAM,EACzB,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GACjC,OAAO,CAAC,4BAA4B,CAAC,CAavC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;IACV,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,UAAU,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,EACD,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC,CAqCD;AAMD;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,gBAAgB,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,GACzD,OAAO,CAAC,qCAAqC,CAAC,CAqBhD;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,kBAAkB,EAC9B,iBAAiB,EAAE,MAAM,EACzB,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GACjC,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAyBD;AAMD;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CACzD;IACE,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB,EAAE,CACJ,CAgBA;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASpF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAkBzD"}
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/server/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EACV,0BAA0B,EAC1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAahC,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC3B;AAaD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAGxE;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAgBD;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAC/B,OAAO,CAAC,sCAAsC,CAAC,CAwBjD;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,wBAAwB,EAClC,iBAAiB,EAAE,MAAM,EACzB,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GACjC,OAAO,CAAC,4BAA4B,CAAC,CAavC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE;IACV,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,UAAU,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,EACD,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC,CAqCD;AAMD;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,gBAAgB,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,GACzD,OAAO,CAAC,qCAAqC,CAAC,CAqBhD;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,kBAAkB,EAC9B,iBAAiB,EAAE,MAAM,EACzB,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GACjC,OAAO,CAAC;IACT,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAyBD;AAMD;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CACzD;IACE,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB,EAAE,CACJ,CAgBA;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASpF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAkBzD"}

package/dist/server/passkey.js

@@ -199,7 +199,7 @@ export async function verifyAuthentication(response, credential, expectedChallen
 // Management
 // =============================================================================
 /**
- * List all passkeys for a user (safe for client — excludes publicKey and counter).
+ * List all passkeys for a user (safe for client  -  excludes publicKey and counter).
  */
 export async function listPasskeys(userId) {
     const db = getClient();

package/dist/server/password-reset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.d.ts","sourceRoot":"","sources":["../../src/server/password-reset.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAuBD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwE5F;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CA4E9B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAiD/B;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqChG"}
+{"version":3,"file":"password-reset.d.ts","sourceRoot":"","sources":["../../src/server/password-reset.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAuBD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwE5F;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CAuF9B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAiD/B;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqChG"}

package/dist/server/password-reset.js

@@ -37,7 +37,7 @@ function generateSalt() {
 export async function generatePasswordResetToken(email) {
     try {
         const db = getClient();
-        // Find user by email — intentionally does NOT check user.password.
+        // Find user by email  -  intentionally does NOT check user.password.
         // OAuth-only users (password: null) can use this flow to set a password,
         // giving them a fallback login method independent of their OAuth provider.
         // This is safe because the reset link is sent to their verified email.
@@ -166,7 +166,7 @@ export async function resetPasswordWithToken(tokenId, token, newPassword) {
             };
         }
         // Validate password strength
-        const { validatePasswordStrength } = await import('./password-validation.js');
+        const { validatePasswordStrength, checkPasswordBreach } = await import('./password-validation.js');
         const passwordValidation = validatePasswordStrength(newPassword);
         if (!passwordValidation.valid) {
             return {
@@ -174,6 +174,14 @@ export async function resetPasswordWithToken(tokenId, token, newPassword) {
                 error: passwordValidation.errors.join('. '),
             };
         }
+        // Check password against known data breaches (non-blocking on failure)
+        const breachCount = await checkPasswordBreach(newPassword);
+        if (breachCount > 0) {
+            return {
+                success: false,
+                error: `This password has appeared in ${breachCount.toLocaleString()} data breaches. Please choose a different password.`,
+            };
+        }
         // Hash new password
         const password = await bcrypt.hash(newPassword, 12);
         // Update user password
@@ -242,7 +250,7 @@ export async function changePassword(userId, currentPassword, newPassword, curre
                 .where(and(eq(sessions.userId, userId), ne(sessions.id, currentSessionId)));
         }
         else {
-            // No current session ID provided — delete all sessions as a safe default
+            // No current session ID provided  -  delete all sessions as a safe default
             await db.delete(sessions).where(eq(sessions.userId, userId));
         }
         return { success: true };

package/dist/server/password-validation.d.ts

@@ -22,4 +22,15 @@ export declare function validatePasswordStrength(password: string): PasswordVali
  * @returns True if meets minimum requirements
  */
 export declare function meetsMinimumPasswordRequirements(password: string): boolean;
+/**
+ * Check if a password appears in known data breaches via the
+ * HaveIBeenPwned Passwords API (k-anonymity model).
+ *
+ * Only the first 5 characters of the SHA-1 hash are sent to the API.
+ * The full hash never leaves the server.
+ *
+ * @returns The number of times this password has been seen in breaches, or 0 if clean.
+ *          Returns -1 if the check could not be performed (network error).
+ */
+export declare function checkPasswordBreach(password: string): Promise<number>;
 //# sourceMappingURL=password-validation.d.ts.map

package/dist/server/password-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-validation.d.ts","sourceRoot":"","sources":["../../src/server/password-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,CA2BnF;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1E"}
+{"version":3,"file":"password-validation.d.ts","sourceRoot":"","sources":["../../src/server/password-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,CA2BnF;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B3E"}

package/dist/server/password-validation.js

@@ -50,3 +50,40 @@ export function validatePasswordStrength(password) {
 export function meetsMinimumPasswordRequirements(password) {
     return password.length >= 8 && password.length <= 128;
 }
+/**
+ * Check if a password appears in known data breaches via the
+ * HaveIBeenPwned Passwords API (k-anonymity model).
+ *
+ * Only the first 5 characters of the SHA-1 hash are sent to the API.
+ * The full hash never leaves the server.
+ *
+ * @returns The number of times this password has been seen in breaches, or 0 if clean.
+ *          Returns -1 if the check could not be performed (network error).
+ */
+export async function checkPasswordBreach(password) {
+    const { createHash } = await import('node:crypto');
+    // lgtm[js/insufficient-password-hash] - SHA-1 required by HIBP k-anonymity API, not used for password storage
+    const sha1 = createHash('sha1').update(password).digest('hex').toUpperCase();
+    const prefix = sha1.slice(0, 5);
+    const suffix = sha1.slice(5);
+    try {
+        const response = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`, {
+            headers: { 'Add-Padding': 'true' },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!response.ok)
+            return -1;
+        const text = await response.text();
+        for (const line of text.split('\n')) {
+            const [hashSuffix, countStr] = line.split(':');
+            if (hashSuffix?.trim() === suffix) {
+                return Number.parseInt(countStr?.trim() ?? '0', 10);
+            }
+        }
+        return 0;
+    }
+    catch {
+        // Network error, timeout, or API issue  -  don't block the user
+        return -1;
+    }
+}

package/dist/server/providers/github.d.ts

@@ -1,14 +1,14 @@
 /**
  * GitHub OAuth Provider
  *
- * Uses native fetch — no additional npm dependencies.
+ * Uses native fetch  -  no additional npm dependencies.
  * Scopes: read:user user:email
  *
  * Note: GitHub may return null email if user has set it private.
  * In that case we fetch from /user/emails and pick the primary verified one.
  */
 import type { ProviderUser } from '../oauth.js';
-export declare function buildAuthUrl(clientId: string, redirectUri: string, state: string): string;
-export declare function exchangeCode(code: string, redirectUri: string): Promise<string>;
+export declare function buildAuthUrl(clientId: string, redirectUri: string, state: string, codeChallenge?: string): string;
+export declare function exchangeCode(code: string, redirectUri: string, codeVerifier?: string): Promise<string>;
 export declare function fetchUser(accessToken: string): Promise<ProviderUser>;
 //# sourceMappingURL=github.d.ts.map

package/dist/server/providers/github.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/server/providers/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzF;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCrF;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkD1E"}
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/server/providers/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAWR;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAwCjB;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkD1E"}

package/dist/server/providers/github.js

@@ -1,33 +1,41 @@
 /**
  * GitHub OAuth Provider
  *
- * Uses native fetch — no additional npm dependencies.
+ * Uses native fetch  -  no additional npm dependencies.
  * Scopes: read:user user:email
  *
  * Note: GitHub may return null email if user has set it private.
  * In that case we fetch from /user/emails and pick the primary verified one.
  */
-export function buildAuthUrl(clientId, redirectUri, state) {
+export function buildAuthUrl(clientId, redirectUri, state, codeChallenge) {
     const url = new URL('https://github.com/login/oauth/authorize');
     url.searchParams.set('client_id', clientId);
     url.searchParams.set('redirect_uri', redirectUri);
     url.searchParams.set('scope', 'read:user user:email');
     url.searchParams.set('state', state);
+    if (codeChallenge) {
+        url.searchParams.set('code_challenge', codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+    }
     return url.toString();
 }
-export async function exchangeCode(code, redirectUri) {
+export async function exchangeCode(code, redirectUri, codeVerifier) {
+    const params = {
+        code,
+        client_id: process.env.GITHUB_CLIENT_ID ?? '',
+        client_secret: process.env.GITHUB_CLIENT_SECRET ?? '',
+        redirect_uri: redirectUri,
+    };
+    if (codeVerifier) {
+        params.code_verifier = codeVerifier;
+    }
     const response = await fetch('https://github.com/login/oauth/access_token', {
         method: 'POST',
         headers: {
             'Content-Type': 'application/x-www-form-urlencoded',
             Accept: 'application/json',
         },
-        body: new URLSearchParams({
-            code,
-            client_id: process.env.GITHUB_CLIENT_ID ?? '',
-            client_secret: process.env.GITHUB_CLIENT_SECRET ?? '',
-            redirect_uri: redirectUri,
-        }),
+        body: new URLSearchParams(params),
     });
     if (!response.ok) {
         let detail = '';
@@ -36,9 +44,9 @@ export async function exchangeCode(code, redirectUri) {
             detail = err.error_description ?? err.error ?? '';
         }
         catch {
-            // Response body not JSON — use status only
+            // Response body not JSON  -  use status only
         }
-        throw new Error(`GitHub token exchange failed: ${response.status}${detail ? ` — ${detail}` : ''}`);
+        throw new Error(`GitHub token exchange failed: ${response.status}${detail ? `  -  ${detail}` : ''}`);
     }
     const data = (await response.json());
     if (data.error) {
@@ -64,7 +72,7 @@ export async function fetchUser(accessToken) {
         catch {
             // Response body not JSON
         }
-        throw new Error(`GitHub user fetch failed: ${userResponse.status}${detail ? ` — ${detail}` : ''}`);
+        throw new Error(`GitHub user fetch failed: ${userResponse.status}${detail ? `  -  ${detail}` : ''}`);
     }
     const user = (await userResponse.json());
     let email = user.email ?? null;

package/dist/server/providers/google.d.ts

@@ -1,11 +1,11 @@
 /**
  * Google OAuth 2.0 Provider
  *
- * Uses native fetch — no additional npm dependencies.
+ * Uses native fetch  -  no additional npm dependencies.
  * Scopes: openid email profile
  */
 import type { ProviderUser } from '../oauth.js';
-export declare function buildAuthUrl(clientId: string, redirectUri: string, state: string): string;
-export declare function exchangeCode(code: string, redirectUri: string): Promise<string>;
+export declare function buildAuthUrl(clientId: string, redirectUri: string, state: string, codeChallenge?: string): string;
+export declare function exchangeCode(code: string, redirectUri: string, codeVerifier?: string): Promise<string>;
 export declare function fetchUser(accessToken: string): Promise<ProviderUser>;
 //# sourceMappingURL=google.d.ts.map

package/dist/server/providers/google.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../src/server/providers/google.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CASzF;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BrF;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA+B1E"}
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../src/server/providers/google.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAaR;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA+B1E"}

package/dist/server/providers/google.js

@@ -1,10 +1,10 @@
 /**
  * Google OAuth 2.0 Provider
  *
- * Uses native fetch — no additional npm dependencies.
+ * Uses native fetch  -  no additional npm dependencies.
  * Scopes: openid email profile
  */
-export function buildAuthUrl(clientId, redirectUri, state) {
+export function buildAuthUrl(clientId, redirectUri, state, codeChallenge) {
     const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
     url.searchParams.set('client_id', clientId);
     url.searchParams.set('redirect_uri', redirectUri);
@@ -12,19 +12,27 @@ export function buildAuthUrl(clientId, redirectUri, state) {
     url.searchParams.set('scope', 'openid email profile');
     url.searchParams.set('state', state);
     url.searchParams.set('access_type', 'online');
+    if (codeChallenge) {
+        url.searchParams.set('code_challenge', codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+    }
     return url.toString();
 }
-export async function exchangeCode(code, redirectUri) {
+export async function exchangeCode(code, redirectUri, codeVerifier) {
+    const params = {
+        code,
+        client_id: process.env.GOOGLE_CLIENT_ID ?? '',
+        client_secret: process.env.GOOGLE_CLIENT_SECRET ?? '',
+        redirect_uri: redirectUri,
+        grant_type: 'authorization_code',
+    };
+    if (codeVerifier) {
+        params.code_verifier = codeVerifier;
+    }
     const response = await fetch('https://oauth2.googleapis.com/token', {
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: new URLSearchParams({
-            code,
-            client_id: process.env.GOOGLE_CLIENT_ID ?? '',
-            client_secret: process.env.GOOGLE_CLIENT_SECRET ?? '',
-            redirect_uri: redirectUri,
-            grant_type: 'authorization_code',
-        }),
+        body: new URLSearchParams(params),
     });
     if (!response.ok) {
         let detail = '';
@@ -33,9 +41,9 @@ export async function exchangeCode(code, redirectUri) {
             detail = err.error_description ?? err.error ?? '';
         }
         catch {
-            // Response body not JSON — use status only
+            // Response body not JSON  -  use status only
         }
-        throw new Error(`Google token exchange failed: ${response.status}${detail ? ` — ${detail}` : ''}`);
+        throw new Error(`Google token exchange failed: ${response.status}${detail ? `  -  ${detail}` : ''}`);
     }
     const data = (await response.json());
     if (!data.access_token || typeof data.access_token !== 'string') {
@@ -56,7 +64,7 @@ export async function fetchUser(accessToken) {
         catch {
             // Response body not JSON
         }
-        throw new Error(`Google userinfo fetch failed: ${response.status}${detail ? ` — ${detail}` : ''}`);
+        throw new Error(`Google userinfo fetch failed: ${response.status}${detail ? `  -  ${detail}` : ''}`);
     }
     const data = (await response.json());
     return {

package/dist/server/providers/vercel.d.ts

@@ -1,11 +1,11 @@
 /**
  * Vercel OAuth Provider
  *
- * Uses native fetch — no additional npm dependencies.
- * No scopes required — Vercel uses full access by default.
+ * Uses native fetch  -  no additional npm dependencies.
+ * No scopes required  -  Vercel uses full access by default.
  */
 import type { ProviderUser } from '../oauth.js';
-export declare function buildAuthUrl(clientId: string, redirectUri: string, state: string): string;
-export declare function exchangeCode(code: string, redirectUri: string): Promise<string>;
+export declare function buildAuthUrl(clientId: string, redirectUri: string, state: string, _codeChallenge?: string): string;
+export declare function exchangeCode(code: string, redirectUri: string, _codeVerifier?: string): Promise<string>;
 export declare function fetchUser(accessToken: string): Promise<ProviderUser>;
 //# sourceMappingURL=vercel.d.ts.map

package/dist/server/providers/vercel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../../src/server/providers/vercel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzF;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCrF;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAiC1E"}
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../../src/server/providers/vercel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,CAMR;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmC1E"}

package/dist/server/providers/vercel.js

@@ -1,17 +1,17 @@
 /**
  * Vercel OAuth Provider
  *
- * Uses native fetch — no additional npm dependencies.
- * No scopes required — Vercel uses full access by default.
+ * Uses native fetch  -  no additional npm dependencies.
+ * No scopes required  -  Vercel uses full access by default.
  */
-export function buildAuthUrl(clientId, redirectUri, state) {
+export function buildAuthUrl(clientId, redirectUri, state, _codeChallenge) {
     const url = new URL('https://vercel.com/oauth/authorize');
     url.searchParams.set('client_id', clientId);
     url.searchParams.set('redirect_uri', redirectUri);
     url.searchParams.set('state', state);
     return url.toString();
 }
-export async function exchangeCode(code, redirectUri) {
+export async function exchangeCode(code, redirectUri, _codeVerifier) {
     const response = await fetch('https://api.vercel.com/v2/oauth/access_token', {
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
@@ -29,9 +29,9 @@ export async function exchangeCode(code, redirectUri) {
             detail = err.error_description ?? err.error ?? '';
         }
         catch {
-            // Response body not JSON — use status only
+            // Response body not JSON  -  use status only
         }
-        throw new Error(`Vercel token exchange failed: ${response.status}${detail ? ` — ${detail}` : ''}`);
+        throw new Error(`Vercel token exchange failed: ${response.status}${detail ? `  -  ${detail}` : ''}`);
     }
     const data = (await response.json());
     if (data.error) {
@@ -55,7 +55,7 @@ export async function fetchUser(accessToken) {
         catch {
             // Response body not JSON
         }
-        throw new Error(`Vercel user fetch failed: ${response.status}${detail ? ` — ${detail}` : ''}`);
+        throw new Error(`Vercel user fetch failed: ${response.status}${detail ? `  -  ${detail}` : ''}`);
     }
     const data = (await response.json());
     const u = data.user;

package/dist/server/session.d.ts

@@ -8,7 +8,7 @@ import type { Session, User } from '../types.js';
 export interface SessionBindingConfig {
     /** Invalidate session when user-agent changes (default: true) */
     enforceUserAgent: boolean;
-    /** Invalidate session when IP address changes (default: false — users roam) */
+    /** Invalidate session when IP address changes (default: false  -  users roam) */
     enforceIp: boolean;
     /** Log a warning when IP changes but don't invalidate (default: true) */
     warnOnIpChange: boolean;
@@ -36,7 +36,7 @@ export interface SessionData {
 /**
  * Check if a session is a recovery session (created via magic link recovery).
  *
- * Recovery sessions are restricted — they should only be used for:
+ * Recovery sessions are restricted  -  they should only be used for:
  * - Changing the password (`/api/auth/change-password`)
  * - Signing out (`/api/auth/sign-out`)
  * - Viewing current session (`/api/auth/me`, `/api/auth/session`)

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAUD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAkH7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC9C;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAUD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAkH7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC9C;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}

package/dist/server/session.js

@@ -57,7 +57,7 @@ export function validateSessionBinding(session, ctx) {
 /**
  * Check if a session is a recovery session (created via magic link recovery).
  *
- * Recovery sessions are restricted — they should only be used for:
+ * Recovery sessions are restricted  -  they should only be used for:
  * - Changing the password (`/api/auth/change-password`)
  * - Signing out (`/api/auth/sign-out`)
  * - Viewing current session (`/api/auth/me`, `/api/auth/session`)
@@ -127,7 +127,7 @@ export async function getSession(headers, requestContext) {
         if (requestContext) {
             const bindingError = validateSessionBinding(session, requestContext);
             if (bindingError) {
-                logger.warn('Session binding violation — invalidating session', {
+                logger.warn('Session binding violation  -  invalidating session', {
                     sessionId: session.id,
                     reason: bindingError,
                 });

package/dist/server/signed-cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signed-cookie.d.ts","sourceRoot":"","sources":["../../src/server/signed-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC/D,OAAO,EAAE,CAAC,EACV,MAAM,EAAE,MAAM,GACb,MAAM,CAQR;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EACjE,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,CAAC,GAAG,IAAI,CAyCV"}
+{"version":3,"file":"signed-cookie.d.ts","sourceRoot":"","sources":["../../src/server/signed-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC/D,OAAO,EAAE,CAAC,EACV,MAAM,EAAE,MAAM,GACb,MAAM,CASR;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EACjE,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,CAAC,GAAG,IAAI,CA0CV"}

package/dist/server/signed-cookie.js

@@ -18,6 +18,7 @@ import crypto from 'node:crypto';
 export function signCookiePayload(payload, secret) {
     const payloadJson = JSON.stringify(payload);
     const payloadB64 = Buffer.from(payloadJson).toString('base64url');
+    // lgtm[js/insufficient-password-hash] - HMAC-SHA256 for cookie payload signing, not password hashing
     const signature = crypto.createHmac('sha256', secret).update(payloadB64).digest();
     const signatureB64 = signature.toString('base64url');
     return `${payloadB64}.${signatureB64}`;
@@ -42,16 +43,17 @@ export function verifyCookiePayload(signed, secret) {
         }
         const [payloadB64, signatureB64] = parts;
         // Recompute the expected signature
+        // lgtm[js/insufficient-password-hash] - HMAC-SHA256 for cookie verification, not password hashing
         const expectedSignature = crypto.createHmac('sha256', secret).update(payloadB64).digest();
         const actualSignature = Buffer.from(signatureB64, 'base64url');
-        // Timing-safe comparison — buffers must be same length
+        // Timing-safe comparison  -  buffers must be same length
         if (expectedSignature.length !== actualSignature.length) {
             return null;
         }
         if (!crypto.timingSafeEqual(expectedSignature, actualSignature)) {
             return null;
         }
-        // Signature valid — decode and parse the payload
+        // Signature valid  -  decode and parse the payload
         const payloadJson = Buffer.from(payloadB64, 'base64url').toString('utf8');
         const payload = JSON.parse(payloadJson);
         // Check expiry

package/dist/server/storage/index.js

@@ -39,7 +39,7 @@ export function getStorage() {
         }
     }
     catch {
-        // Config validation failed — try process.env fallback below
+        // Config validation failed  -  try process.env fallback below
     }
     dbUrl = dbUrl || process.env.POSTGRES_URL || process.env.DATABASE_URL;
     if (dbUrl) {
@@ -79,7 +79,7 @@ export function createStorage() {
         }
     }
     catch {
-        // Config validation failed — fall through to in-memory
+        // Config validation failed  -  fall through to in-memory
     }
     return new InMemoryStorage();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/auth",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Authentication system for RevealUI - database-backed sessions with Better Auth patterns",
   "keywords": [
     "auth",
@@ -14,23 +14,23 @@
     "bcryptjs": "^3.0.3",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.3.6",
-    "@revealui/config": "0.3.2",
-    "@revealui/contracts": "1.3.5",
-    "@revealui/core": "0.5.4",
-    "@revealui/db": "0.3.5",
-    "@revealui/security": "0.2.5"
+    "@revealui/config": "0.3.4",
+    "@revealui/contracts": "1.3.7",
+    "@revealui/core": "0.5.6",
+    "@revealui/db": "0.3.7",
+    "@revealui/security": "0.2.7"
   },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.3.0",
     "@testing-library/react": "^16.3.2",
-    "@types/node": "^25.5.0",
+    "@types/node": "^25.5.2",
     "@types/react": "^19.2.14",
-    "@vitest/coverage-v8": "^4.1.0",
-    "happy-dom": "^20.8.4",
-    "react": "^19.2.3",
+    "@vitest/coverage-v8": "^4.1.3",
+    "happy-dom": "^20.8.9",
+    "react": "^19.2.5",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.0",
-    "dev": "0.0.1"
+    "vitest": "^4.1.3",
+    "@revealui/dev": "0.1.0"
   },
   "engines": {
     "node": ">=24.13.0"
@@ -72,6 +72,16 @@
   },
   "type": "module",
   "types": "./dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/RevealUIStudio/revealui.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://revealui.com",
+  "author": "RevealUI Studio <founder@revealui.com>",
+  "bugs": {
+    "url": "https://github.com/RevealUIStudio/revealui/issues"
+  },
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist",