@simple-auth-kit/cli 1.5.1 → 1.6.1

package/registry/combos/express-drizzle/shared/src/{openapi-spec.ts → openapi/openapi-spec.ts}

@@ -19,7 +19,8 @@ export const openApiSpec: Record<string, unknown> = {
   openapi: "3.0.3",
   info: {
     title: "simple-auth-kit API",
-    description: "express-drizzle combo — signup/login, sessions, TOTP 2FA, OAuth, password reset, RBAC, audit log",
+    description:
+      "express-drizzle combo — signup/login, sessions, TOTP 2FA, OAuth, password reset, RBAC, audit log",
     version: "1.0",
   },
   servers: [{ url: "/" }],
@@ -39,18 +40,37 @@ export const openApiSpec: Record<string, unknown> = {
         properties: {
           email: { type: "string", example: "alice@example.com" },
           password: { type: "string", example: "correct-horse-battery-staple" },
-          firstName: { type: "string", description: "Unique across the deployment.", example: "Alice" },
-          lastName: { type: "string", description: "Unique across the deployment.", example: "Nguyen" },
+          firstName: {
+            type: "string",
+            description: "Unique across the deployment.",
+            example: "Alice",
+          },
+          lastName: {
+            type: "string",
+            description: "Unique across the deployment.",
+            example: "Nguyen",
+          },
           displayName: { type: "string", example: "Alice Nguyen" },
-          phone: { type: "string", description: "Unique across the deployment." },
-          username: { type: "string", description: "Unique across the deployment." },
+          phone: {
+            type: "string",
+            description: "Unique across the deployment.",
+          },
+          username: {
+            type: "string",
+            description: "Unique across the deployment.",
+          },
         },
       },
       LoginDto: {
         type: "object",
         required: ["identifier", "password"],
         properties: {
-          identifier: { type: "string", description: "Email, username, or phone — whichever the account has set.", example: "alice@example.com" },
+          identifier: {
+            type: "string",
+            description:
+              "Email, username, or phone — whichever the account has set.",
+            example: "alice@example.com",
+          },
           password: { type: "string", example: "correct-horse-battery-staple" },
         },
       },
@@ -58,8 +78,16 @@ export const openApiSpec: Record<string, unknown> = {
         type: "object",
         required: ["challengeToken", "code"],
         properties: {
-          challengeToken: { type: "string", description: "Returned by POST /auth/login when the account has 2FA enabled" },
-          code: { type: "string", description: "6-digit TOTP code, or an unused backup code", example: "123456" },
+          challengeToken: {
+            type: "string",
+            description:
+              "Returned by POST /auth/login when the account has 2FA enabled",
+          },
+          code: {
+            type: "string",
+            description: "6-digit TOTP code, or an unused backup code",
+            example: "123456",
+          },
         },
       },
       RefreshDto: {
@@ -87,7 +115,10 @@ export const openApiSpec: Record<string, unknown> = {
         type: "object",
         required: ["token", "newPassword"],
         properties: {
-          token: { type: "string", description: "Raw token from the sendPasswordResetEmail hook" },
+          token: {
+            type: "string",
+            description: "Raw token from the sendPasswordResetEmail hook",
+          },
           newPassword: { type: "string" },
         },
       },
@@ -95,7 +126,11 @@ export const openApiSpec: Record<string, unknown> = {
         type: "object",
         required: ["currentPassword", "newPassword"],
         properties: {
-          currentPassword: { type: "string", description: "The caller's current password, re-checked server-side before anything changes." },
+          currentPassword: {
+            type: "string",
+            description:
+              "The caller's current password, re-checked server-side before anything changes.",
+          },
           newPassword: { type: "string" },
         },
       },
@@ -135,7 +170,12 @@ export const openApiSpec: Record<string, unknown> = {
           displayName: { type: "string", nullable: true },
           phone: { type: "string", nullable: true },
           username: { type: "string", nullable: true },
-          photo: { type: "string", nullable: true, description: "A data URI or an externally-hosted URL — stored as-is, never processed server-side." },
+          photo: {
+            type: "string",
+            nullable: true,
+            description:
+              "A data URI or an externally-hosted URL — stored as-is, never processed server-side.",
+          },
         },
       },
       SelfProfileDto: {
@@ -148,7 +188,12 @@ export const openApiSpec: Record<string, unknown> = {
           displayName: { type: "string", nullable: true },
           phone: { type: "string", nullable: true },
           username: { type: "string", nullable: true },
-          photo: { type: "string", nullable: true, description: "A data URI or an externally-hosted URL — stored as-is, never processed server-side." },
+          photo: {
+            type: "string",
+            nullable: true,
+            description:
+              "A data URI or an externally-hosted URL — stored as-is, never processed server-side.",
+          },
           createdAt: { type: "string", format: "date-time" },
         },
       },
@@ -171,19 +216,30 @@ export const openApiSpec: Record<string, unknown> = {
         type: "object",
         properties: {
           secret: { type: "string", description: "Base32 TOTP secret" },
-          provisioningUri: { type: "string", description: "otpauth:// provisioning URI, render as a QR code" },
+          provisioningUri: {
+            type: "string",
+            description: "otpauth:// provisioning URI, render as a QR code",
+          },
         },
       },
       ConfirmTwoFactorResponseDto: {
         type: "object",
         properties: {
-          backupCodes: { type: "array", items: { type: "string" }, description: "One-time recovery codes — shown once" },
+          backupCodes: {
+            type: "array",
+            items: { type: "string" },
+            description: "One-time recovery codes — shown once",
+          },
         },
       },
       OAuthStartResponseDto: {
         type: "object",
         properties: {
-          url: { type: "string", description: "Redirect the user/webview to this URL to start the OAuth flow" },
+          url: {
+            type: "string",
+            description:
+              "Redirect the user/webview to this URL to start the OAuth flow",
+          },
         },
       },
       RoleSummaryDto: {
@@ -203,12 +259,20 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Create a user and issue a session",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/SignupDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/SignupDto" },
+            },
+          },
         },
         responses: {
           "201": {
             description: "Session created",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/AuthTokensDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthTokensDto" },
+              },
+            },
           },
         },
       },
@@ -221,7 +285,11 @@ export const openApiSpec: Record<string, unknown> = {
           "identifier is matched against email, username, and phone, in that order. Returns tokens directly, or a 2FA challenge if the account has 2FA enabled.",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/LoginDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/LoginDto" },
+            },
+          },
         },
         responses: {
           "200": {
@@ -246,12 +314,20 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Complete the 2FA challenge from POST /auth/login",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/LoginTwoFactorDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/LoginTwoFactorDto" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "Session created",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/AuthTokensDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthTokensDto" },
+              },
+            },
           },
         },
       },
@@ -262,12 +338,20 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Rotate a refresh token for a new access+refresh pair",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/RefreshDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/RefreshDto" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "New token pair",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/RefreshResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/RefreshResponseDto" },
+              },
+            },
           },
         },
       },
@@ -276,29 +360,43 @@ export const openApiSpec: Record<string, unknown> = {
       get: {
         tags: ["auth"],
         summary: "Current session's identity",
-        description: "`roles` and `permissions` are whatever applies to this request — see authz.middleware.ts for how they are resolved.",
+        description:
+          "`roles` and `permissions` are whatever applies to this request — see authz.middleware.ts for how they are resolved.",
         security: [{ bearerAuth: [] }],
         parameters: adminSpec.scopeParameters,
         responses: {
           "200": {
             description: "Current user",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/CurrentUserDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/CurrentUserDto" },
+              },
+            },
           },
         },
       },
       patch: {
         tags: ["auth"],
         summary: "Update the current user's own profile",
-        description: "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
+        description:
+          "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateUserRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/UpdateUserRequest" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "Updated profile",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/SelfProfileDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/SelfProfileDto" },
+              },
+            },
           },
           "401": { description: "Missing or invalid access token" },
         },
@@ -312,7 +410,14 @@ export const openApiSpec: Record<string, unknown> = {
         responses: {
           "200": {
             description: "Active sessions",
-            content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/SessionSummaryDto" } } } },
+            content: {
+              "application/json": {
+                schema: {
+                  type: "array",
+                  items: { $ref: "#/components/schemas/SessionSummaryDto" },
+                },
+              },
+            },
           },
         },
       },
@@ -325,7 +430,11 @@ export const openApiSpec: Record<string, unknown> = {
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponseDto" },
+              },
+            },
           },
         },
       },
@@ -338,7 +447,11 @@ export const openApiSpec: Record<string, unknown> = {
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponseDto" },
+              },
+            },
           },
         },
       },
@@ -351,7 +464,11 @@ export const openApiSpec: Record<string, unknown> = {
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponseDto" },
+              },
+            },
           },
         },
       },
@@ -365,7 +482,13 @@ export const openApiSpec: Record<string, unknown> = {
         responses: {
           "200": {
             description: "TOTP secret + provisioning URI",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/EnrollTwoFactorResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/EnrollTwoFactorResponseDto",
+                },
+              },
+            },
           },
         },
       },
@@ -374,16 +497,27 @@ export const openApiSpec: Record<string, unknown> = {
       post: {
         tags: ["auth"],
         summary: "Confirm TOTP enrollment with a code",
-        description: "Enables 2FA and returns one-time backup codes, shown only here.",
+        description:
+          "Enables 2FA and returns one-time backup codes, shown only here.",
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/TwoFactorCodeDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/TwoFactorCodeDto" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "Backup codes",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/ConfirmTwoFactorResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/ConfirmTwoFactorResponseDto",
+                },
+              },
+            },
           },
         },
       },
@@ -396,12 +530,20 @@ export const openApiSpec: Record<string, unknown> = {
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/TwoFactorCodeDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/TwoFactorCodeDto" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponseDto" },
+              },
+            },
           },
         },
       },
@@ -410,15 +552,24 @@ export const openApiSpec: Record<string, unknown> = {
       post: {
         tags: ["auth"],
         summary: "Request a password reset",
-        description: "Always reports success, whether or not the email exists — avoids account enumeration.",
+        description:
+          "Always reports success, whether or not the email exists — avoids account enumeration.",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/ForgotPasswordDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ForgotPasswordDto" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponseDto" },
+              },
+            },
           },
         },
       },
@@ -430,12 +581,20 @@ export const openApiSpec: Record<string, unknown> = {
         description: "Revokes every existing session for the user on success.",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/ResetPasswordDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ResetPasswordDto" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponseDto" },
+              },
+            },
           },
         },
       },
@@ -444,16 +603,25 @@ export const openApiSpec: Record<string, unknown> = {
       post: {
         tags: ["auth"],
         summary: "Change the current user's password",
-        description: "Verifies currentPassword server-side, then revokes every other session for the user — the calling session is left alone.",
+        description:
+          "Verifies currentPassword server-side, then revokes every other session for the user — the calling session is left alone.",
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/ChangePasswordDto" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ChangePasswordDto" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponseDto" },
+              },
+            },
           },
         },
       },
@@ -462,11 +630,22 @@ export const openApiSpec: Record<string, unknown> = {
       get: {
         tags: ["auth"],
         summary: "Get the redirect URL to start an OAuth login",
-        parameters: [{ name: "provider", in: "path", required: true, schema: { type: "string", enum: ["google", "apple"] } }],
+        parameters: [
+          {
+            name: "provider",
+            in: "path",
+            required: true,
+            schema: { type: "string", enum: ["google", "apple"] },
+          },
+        ],
         responses: {
           "200": {
             description: "Redirect URL",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/OAuthStartResponseDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OAuthStartResponseDto" },
+              },
+            },
           },
         },
       },
@@ -474,16 +653,36 @@ export const openApiSpec: Record<string, unknown> = {
     "/auth/oauth/{provider}/callback": {
       get: {
         tags: ["auth"],
-        summary: "OAuth provider callback — exchanges the code and completes login",
+        summary:
+          "OAuth provider callback — exchanges the code and completes login",
         parameters: [
-          { name: "provider", in: "path", required: true, schema: { type: "string", enum: ["google", "apple"] } },
-          { name: "code", in: "query", required: true, schema: { type: "string" } },
-          { name: "state", in: "query", required: true, schema: { type: "string" } },
+          {
+            name: "provider",
+            in: "path",
+            required: true,
+            schema: { type: "string", enum: ["google", "apple"] },
+          },
+          {
+            name: "code",
+            in: "query",
+            required: true,
+            schema: { type: "string" },
+          },
+          {
+            name: "state",
+            in: "query",
+            required: true,
+            schema: { type: "string" },
+          },
         ],
         responses: {
           "200": {
             description: "Session created",
-            content: { "application/json": { schema: { $ref: "#/components/schemas/AuthTokensDto" } } },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthTokensDto" },
+              },
+            },
           },
         },
       },

package/registry/combos/express-drizzle/shared/src/repositories/oauth.repository.ts

@@ -1,9 +1,9 @@
 import { and, eq } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 import * as schema from "../schema.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 /**
  * Plain class, no decorators — Drizzle-specific implementation of `OAuthStoreDeps`

package/registry/combos/express-drizzle/shared/src/repositories/password-reset.repository.ts

@@ -2,7 +2,7 @@ import { eq } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
 import * as schema from "../schema.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 /**
  * Plain class, no decorators — Drizzle-specific implementation of `PasswordResetStoreDeps`
@@ -23,9 +23,7 @@ export class PasswordResetRepository implements PasswordResetStoreDeps {
     });
   }
 
-  async findValidResetToken(
-    tokenHash: string,
-  ): Promise<{
+  async findValidResetToken(tokenHash: string): Promise<{
     userId: string;
     expiresAt: string;
     consumedAt: string | null;

package/registry/combos/express-drizzle/shared/src/repositories/session.repository.ts

@@ -7,10 +7,10 @@ import type {
   SessionRecord,
 } from "@/lib/auth/core/types.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import type { AuthConfig } from "../auth.config.js";
-import type { Database } from "../db.js";
+import type { AuthConfig } from "../config/auth.config.js";
+import type { Database } from "../config/db.js";
 import { denylistedAccessTokens, sessions } from "../schema.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 function toSessionRecord(row: typeof sessions.$inferSelect): SessionRecord {
   return {

package/registry/combos/express-drizzle/shared/src/request-context.ts

@@ -19,7 +19,7 @@
 // the `Express` namespace, see @types/express-serve-static-core) rather than the reference's
 // `declare module "express"`.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
-import type { AppAbility } from "./ability.js";
+import type { AppAbility } from "./ability/ability.js";
 import type { AuthzContext } from "./middleware/authz.middleware.js";
 
 declare global {