@stacksjs/actions 0.70.88 → 0.70.90

package/dist/action.d.ts

@@ -0,0 +1,149 @@
+import type { ExtractParams, InferValidations, JobOptions, RequestInstance } from '@stacksjs/types';
+/**
+ * Shape of `validations:` on an action. Each entry pairs a
+ * ts-validation `Validator<T>` rule with an optional error message.
+ *
+ * Kept loose at the index-signature level so existing actions with
+ * untyped validation objects keep compiling. New code that wants the
+ * body-inference benefit (stacksjs/stacks#1851 Phase 2b) declares
+ * validations `as const` so {@link InferValidations} can read the
+ * concrete rule types.
+ *
+ * Exported so the router can run validations without redeclaring the
+ * type (stacksjs/stacks#1870 R-3 — the previous copy in
+ * `stacks-router.ts` would drift out of sync).
+ */
+export declare interface ActionValidations {
+  [key: string]: {
+    rule: { validate: (value: any) => any }
+    message?: string | Record<string, string>
+  }
+}
+/**
+ * Shape of {@link validateActionInput}'s return value. Lives here next
+ * to {@link ActionValidations} so the router and actions package share
+ * a single declaration (stacksjs/stacks#1870 R-3).
+ */
+export declare interface ValidationResult {
+  valid: boolean
+  errors: Record<string, string[]>
+}
+declare interface ActionOptions<TModel = string, TValidations extends ActionValidations | undefined = undefined, TPath extends string = '',> {
+  name?: string
+  description?: string
+  apiResponse?: boolean
+  validations?: TValidations
+  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
+  rate?: JobOptions['rate']
+  tries?: JobOptions['tries']
+  backoff?: JobOptions['backoff']
+  enabled?: JobOptions['enabled']
+  path?: TPath
+  requestFile?: string
+  model?: TModel
+  skipCsrf?: boolean
+  csrf?: boolean
+  authorize?: (
+    request: InferRequest<TModel, TValidations, TPath>,
+  ) => boolean | Response | Promise<boolean | Response>
+  before?: (
+    request: InferRequest<TModel, TValidations, TPath>,
+  ) => void | Response | Promise<void | Response>
+  handle: {
+    bivarianceHack: (
+      request: InferRequest<TModel, TValidations, TPath>,
+    ) => ActionResult | Promise<ActionResult>
+  }['bivarianceHack']
+  dependencies?: () => Record<string, unknown>
+}
+/**
+ * Resolve the body shape (`TFields`) for an action's request:
+ *
+ *   1. If `model:` is a `defineModel()` return, use its row shape —
+ *      preserves the existing model-aware ergonomics.
+ *   2. Else if `validations:` is set as a const, infer the body
+ *      from each rule's `Validator<T>` output type
+ *      (stacksjs/stacks#1851 Phase 2b).
+ *   3. Else fall back to `Record<string, any>` — bare-typed action
+ *      with no narrowing.
+ */
+declare type ResolveBody<TModel, TValidations> = TModel extends { _isStacksModel: true }
+    ? TModel
+    : TValidations extends ActionValidations
+      ? InferValidations<TValidations>
+      : Record<string, any>;
+/**
+ * Build the request type passed to the action's `handle()`. Combines
+ * the body resolution above with path-extracted params from `TPath`
+ * (stacksjs/stacks#1851 Phase 2a).
+ */
+declare type InferRequest<TModel, TValidations, TPath extends string> = TPath extends ''
+    ? RequestInstance<ResolveBody<TModel, TValidations>>
+    : RequestInstance<ResolveBody<TModel, TValidations>, ExtractParams<TPath>>;
+/**
+ * Everything an action's `handle()` is allowed to return. The router's
+ * `formatResult()` walks each branch:
+ *
+ *   - `Response`                       → returned as-is (caller built their own)
+ *   - `null` / `undefined`             → `204` for API clients, empty `200` for browser
+ *   - object / array (incl. records)   → `Response.json(...)`
+ *   - `string` / `number` / `boolean`  → JSON-encoded for API clients, `text/plain`
+ *                                        for top-level browser navigations
+ *   - `ReadableStream`                 → streamed back (stacksjs/stacks#1870 R-4)
+ *
+ * Previously typed `Promise<any> | any`, which let non-serializable returns
+ * (class instances with cycles, undefined-bearing tuples, etc.) sneak through
+ * to runtime. Narrowing here surfaces them at the call site instead.
+ * See stacksjs/stacks#1870 R-11.
+ */
+export type ActionResult = | Response
+  | ReadableStream
+  | null
+  | undefined
+  | string
+  | number
+  | boolean
+  | object
+  | unknown[];
+export declare class Action<TModel = string, TValidations extends ActionValidations | undefined = undefined, TPath extends string = '',> {
+  name?: string;
+  description?: string;
+  apiResponse?: boolean;
+  rate?: ActionOptions['rate'];
+  tries?: ActionOptions['tries'];
+  backoff?: ActionOptions['backoff'];
+  enabled?: ActionOptions['enabled'];
+  path?: ActionOptions<TModel, TValidations, TPath>['path'];
+  method?: ActionOptions['method'];
+  validations?: TValidations;
+  requestFile?: string;
+  skipCsrf?: boolean;
+  csrf?: boolean;
+  authorize?: ActionOptions<TModel, TValidations, TPath>['authorize'];
+  before?: ActionOptions<TModel, TValidations, TPath>['before'];
+  handle: ActionOptions<TModel, TValidations, TPath>['handle'];
+  model?: string;
+  constructor({
+  name,
+  description,
+  apiResponse,
+  validations,
+  handle,
+  rate,
+  tries,
+  backoff,
+  enabled,
+  path,
+  method,
+  requestFile,
+  model,
+  skipCsrf,
+  csrf,
+  authorize,
+  before,
+  dependencies,
+}: ActionOptions<TModel, TValidations, TPath>);
+  get deps(): Record<string, unknown>;
+  overrideDependencies(overrides: Record<string, unknown>): void;
+  resetDependencies(): void;
+}

package/dist/action.js

@@ -0,0 +1,78 @@
+export class Action {
+  name;
+  description;
+  apiResponse;
+  rate;
+  tries;
+  backoff;
+  enabled;
+  path;
+  method;
+  validations;
+  requestFile;
+  skipCsrf;
+  csrf;
+  authorize;
+  before;
+  handle;
+  model;
+  _dependenciesFactory;
+  _resolvedDeps;
+  _depsOverrides;
+  constructor({
+    name,
+    description,
+    apiResponse,
+    validations,
+    handle,
+    rate,
+    tries,
+    backoff,
+    enabled,
+    path,
+    method,
+    requestFile,
+    model,
+    skipCsrf,
+    csrf,
+    authorize,
+    before,
+    dependencies
+  }) {
+    this.name = name;
+    this.description = description;
+    this.apiResponse = apiResponse;
+    this.validations = validations;
+    this.rate = rate;
+    this.tries = tries;
+    this.backoff = backoff;
+    this.enabled = enabled;
+    this.path = path;
+    this.method = method;
+    this.handle = handle;
+    this.requestFile = requestFile;
+    this.skipCsrf = skipCsrf;
+    this.csrf = csrf;
+    this.authorize = authorize;
+    this.before = before;
+    this._dependenciesFactory = dependencies;
+    if (model && typeof model === "object" && "name" in model)
+      this.model = model.name;
+    else if (typeof model === "string")
+      this.model = model;
+  }
+  get deps() {
+    if (!this._resolvedDeps)
+      this._resolvedDeps = this._dependenciesFactory?.() ?? {};
+    if (this._depsOverrides)
+      return { ...this._resolvedDeps, ...this._depsOverrides };
+    return this._resolvedDeps;
+  }
+  overrideDependencies(overrides) {
+    this._depsOverrides = { ...this._depsOverrides ?? {}, ...overrides };
+  }
+  resetDependencies() {
+    this._depsOverrides = void 0;
+    this._resolvedDeps = void 0;
+  }
+}

package/dist/actions.d.ts

@@ -0,0 +1,2 @@
+export * from './helpers/utils';
+export * as actions from './helpers/utils';

package/dist/actions.js

@@ -0,0 +1,2 @@
+export * from "./helpers/utils";
+export * as actions from "./helpers/utils";

package/dist/add.d.ts

@@ -0,0 +1,6 @@
+import type { AddOptions } from '@stacksjs/types';
+export declare function invoke(options: AddOptions): Promise<void>;
+export declare function add(options: AddOptions): Promise<void>;
+export declare function addTable(): Promise<void>;
+export declare function addCalendar(): Promise<void>;
+export declare function installPackages(names: string[]): Promise<void>;

package/dist/add.js

@@ -0,0 +1,20 @@
+import { installPackage } from "@stacksjs/cli";
+export async function invoke(options) {
+  if (options?.table)
+    await addTable();
+  if (options?.calendar)
+    await addCalendar();
+}
+export async function add(options) {
+  return await invoke(options);
+}
+export async function addTable() {
+  await installPackage("@stacksjs/table");
+}
+export async function addCalendar() {
+  await installPackage("@stacksjs/calendar");
+}
+export async function installPackages(names) {
+  for (const name of names)
+    await installPackage(name);
+}

package/dist/ai/request-model-access.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ai/request-model-access.js

@@ -0,0 +1,10 @@
+var {require}=import.meta;import { requestModelAccess } from "@stacksjs/ai";
+async function main() {
+  try {
+    await requestModelAccess();
+  } catch (error) {
+    console.error("Error requesting model access:", error);
+  }
+}
+if (import.meta.main)
+  main();

package/dist/auth/client.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/client.js

@@ -0,0 +1,44 @@
+import process from "node:process";
+import { randomBytes, scryptSync } from "node:crypto";
+import { db } from "@stacksjs/database";
+import { HttpError } from "@stacksjs/error-handling";
+import { log } from "@stacksjs/logging";
+const args = process.argv.slice(2), getArg = (name) => {
+  const idx = args.findIndex((a) => a.startsWith(`--${name}=`) || a.startsWith(`-${name.charAt(0)}=`));
+  if (idx !== -1) {
+    const arg = args[idx];
+    if (!arg)
+      return;
+    const eqIdx = arg.indexOf("=");
+    return eqIdx >= 0 ? arg.slice(eqIdx + 1) : void 0;
+  }
+  const flagIdx = args.findIndex((a) => a === `--${name}` || a === `-${name.charAt(0)}`), value = flagIdx !== -1 ? args[flagIdx + 1] : void 0;
+  if (value && !value.startsWith("-"))
+    return value;
+  return;
+}, hasFlag = (name) => {
+  return args.includes(`--${name}`);
+}, name = getArg("name") || "OAuth Client", redirect = getArg("redirect") || "http://localhost", isPersonalAccess = hasFlag("personal"), isPasswordClient = hasFlag("password");
+log.info(`Creating OAuth client: ${name}`);
+const secret = randomBytes(40).toString("hex"), salt = randomBytes(16).toString("hex"), hashedSecret = `${salt}:${scryptSync(secret, salt, 64).toString("hex")}`, result = await db.insertInto("oauth_clients").values({
+  name,
+  secret: hashedSecret,
+  provider: "local",
+  redirect,
+  personal_access_client: isPersonalAccess,
+  password_client: isPasswordClient,
+  revoked: !1
+}).executeTakeFirst(), insertId = result?.insertId || Number(result?.numInsertedOrUpdatedRows);
+if (!insertId)
+  throw new HttpError(500, "Failed to create OAuth client");
+log.success("OAuth client created successfully");
+log.info("");
+log.info("Client Details:");
+log.info(`  Client ID: ${insertId}`);
+log.info("  Client Secret: [REDACTED]");
+process.stdout.write(`Client Secret (save now, shown once): ${secret}
+`);
+log.info(`  Redirect URI: ${redirect}`);
+log.info("");
+log.warn("Make sure to save the client secret. You will not be able to retrieve it again.");
+process.exit(0);

package/dist/auth/prune.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/prune.js

@@ -0,0 +1,35 @@
+import process from "node:process";
+import { db, sql } from "@stacksjs/database";
+import { log } from "@stacksjs/logging";
+const args = process.argv.slice(2), hasFlag = (name) => {
+  return args.includes(`--${name}`);
+}, getArg = (name) => {
+  const idx = args.findIndex((a) => a.startsWith(`--${name}=`) || a.startsWith(`-${name.charAt(0)}=`));
+  if (idx !== -1) {
+    const arg = args[idx];
+    if (!arg)
+      return;
+    const eqIdx = arg.indexOf("=");
+    return eqIdx >= 0 ? arg.slice(eqIdx + 1) : void 0;
+  }
+  const flagIdx = args.findIndex((a) => a === `--${name}` || a === `-${name.charAt(0)}`), value = flagIdx !== -1 ? args[flagIdx + 1] : void 0;
+  if (value && !value.startsWith("-"))
+    return value;
+  return;
+}, pruneExpired = !hasFlag("no-expired"), pruneRevoked = !hasFlag("no-revoked"), daysOld = Number(getArg("days")) || 7;
+log.info("Pruning authentication tokens...");
+let expiredCount = 0, revokedCount = 0;
+if (pruneExpired) {
+  log.info("Removing expired tokens...");
+  expiredCount = await db.deleteFrom("personal_access_tokens").where("expires_at", "<", sql.raw("NOW()")).execute();
+  log.success(`Removed ${expiredCount} expired token(s)`);
+}
+if (pruneRevoked) {
+  log.info(`Removing tokens revoked more than ${daysOld} day(s) ago...`);
+  const cutoffDate = new Date;
+  cutoffDate.setDate(cutoffDate.getDate() - daysOld);
+  revokedCount = await db.deleteFrom("personal_access_tokens").where("revoked_at", "is not", null).where("revoked_at", "<", cutoffDate.toISOString()).execute();
+  log.success(`Removed ${revokedCount} revoked token(s)`);
+}
+log.success(`Token pruning complete. Total removed: ${expiredCount + revokedCount}`);
+process.exit(0);

package/dist/auth/setup.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/setup.js

@@ -0,0 +1,322 @@
+import process from "node:process";
+import { randomBytes } from "node:crypto";
+import { db } from "@stacksjs/database";
+import { log } from "@stacksjs/logging";
+import { makeHash } from "@stacksjs/security";
+import { env } from "@stacksjs/env";
+import { sqlHelpers, usersEmailVerifiedAtSql, usersPasswordChangedAtSql } from "@stacksjs/database";
+const dbDriver = env.DB_CONNECTION || "sqlite", sql = sqlHelpers(dbDriver), { isPostgres, isMysql, now, boolTrue, boolFalse: _boolFalse } = sql;
+log.info("Setting up authentication...");
+log.info(`Database driver: ${dbDriver}`);
+log.info("Ensuring OAuth tables exist...");
+try {
+  if (isPostgres)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_clients (
+        id SERIAL PRIMARY KEY,
+        name VARCHAR(255) NOT NULL,
+        secret VARCHAR(100),
+        provider VARCHAR(255),
+        redirect VARCHAR(2000) NOT NULL,
+        personal_access_client BOOLEAN NOT NULL DEFAULT false,
+        password_client BOOLEAN NOT NULL DEFAULT false,
+        revoked BOOLEAN NOT NULL DEFAULT false,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP
+      )
+    `);
+  else if (isMysql)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_clients (
+        id INTEGER AUTO_INCREMENT PRIMARY KEY,
+        name VARCHAR(255) NOT NULL,
+        secret VARCHAR(100),
+        provider VARCHAR(255),
+        redirect VARCHAR(2000) NOT NULL,
+        personal_access_client BOOLEAN NOT NULL DEFAULT 0,
+        password_client BOOLEAN NOT NULL DEFAULT 0,
+        revoked BOOLEAN NOT NULL DEFAULT 0,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP
+      )
+    `);
+  else
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_clients (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        name VARCHAR(255) NOT NULL,
+        secret VARCHAR(100),
+        provider VARCHAR(255),
+        redirect VARCHAR(2000) NOT NULL,
+        personal_access_client BOOLEAN NOT NULL DEFAULT 0,
+        password_client BOOLEAN NOT NULL DEFAULT 0,
+        revoked BOOLEAN NOT NULL DEFAULT 0,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP
+      )
+    `);
+  if (isPostgres)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_access_tokens (
+        id SERIAL PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        oauth_client_id INTEGER NOT NULL,
+        token TEXT NOT NULL,
+        name VARCHAR(255),
+        scopes TEXT,
+        revoked BOOLEAN NOT NULL DEFAULT false,
+        expires_at TIMESTAMP,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP
+      )
+    `);
+  else if (isMysql)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_access_tokens (
+        id INTEGER AUTO_INCREMENT PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        oauth_client_id INTEGER NOT NULL,
+        token TEXT NOT NULL,
+        name VARCHAR(255),
+        scopes TEXT,
+        revoked BOOLEAN NOT NULL DEFAULT 0,
+        expires_at TIMESTAMP NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP NULL
+      )
+    `);
+  else
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_access_tokens (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id INTEGER NOT NULL,
+        oauth_client_id INTEGER NOT NULL,
+        token TEXT NOT NULL,
+        name VARCHAR(255),
+        scopes TEXT,
+        revoked BOOLEAN NOT NULL DEFAULT 0,
+        expires_at TIMESTAMP,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP
+      )
+    `);
+  await db.unsafe(`
+    CREATE INDEX IF NOT EXISTS idx_oauth_access_tokens_token ON oauth_access_tokens(token)
+  `);
+  if (isPostgres)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+        id SERIAL PRIMARY KEY,
+        access_token_id INTEGER NOT NULL,
+        token TEXT NOT NULL,
+        revoked BOOLEAN NOT NULL DEFAULT false,
+        expires_at TIMESTAMP,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else if (isMysql)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+        id INTEGER AUTO_INCREMENT PRIMARY KEY,
+        access_token_id INTEGER NOT NULL,
+        token TEXT NOT NULL,
+        revoked BOOLEAN NOT NULL DEFAULT 0,
+        expires_at TIMESTAMP NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        access_token_id INTEGER NOT NULL,
+        token TEXT NOT NULL,
+        revoked BOOLEAN NOT NULL DEFAULT 0,
+        expires_at TIMESTAMP,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  await db.unsafe(`
+    CREATE INDEX IF NOT EXISTS idx_oauth_refresh_tokens_token ON oauth_refresh_tokens(token)
+  `);
+  log.success("OAuth tables ready");
+} catch (error) {
+  log.error("Failed to create OAuth tables", error);
+  process.exit(1);
+}
+log.info("Ensuring password_resets table exists...");
+try {
+  if (isPostgres)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS password_resets (
+        id SERIAL PRIMARY KEY,
+        email VARCHAR(255) NOT NULL,
+        token VARCHAR(255) NOT NULL,
+        expires_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else if (isMysql)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS password_resets (
+        id INTEGER AUTO_INCREMENT PRIMARY KEY,
+        email VARCHAR(255) NOT NULL,
+        token VARCHAR(255) NOT NULL,
+        expires_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS password_resets (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        email VARCHAR(255) NOT NULL,
+        token VARCHAR(255) NOT NULL,
+        expires_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  try {
+    await db.unsafe("ALTER TABLE password_resets ADD COLUMN expires_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP");
+  } catch {}
+  await db.unsafe(`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_password_resets_email_unique ON password_resets(email)
+  `);
+  log.success("Password resets table ready");
+} catch (error) {
+  log.error("Failed to create password_resets table", error);
+  process.exit(1);
+}
+log.info("Ensuring email_verifications table exists...");
+try {
+  if (isPostgres)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS email_verifications (
+        id SERIAL PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        token VARCHAR(255) NOT NULL,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else if (isMysql)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS email_verifications (
+        id INTEGER AUTO_INCREMENT PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        token VARCHAR(255) NOT NULL,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS email_verifications (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id INTEGER NOT NULL,
+        token VARCHAR(255) NOT NULL,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  await db.unsafe(`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_email_verifications_user_id_unique ON email_verifications(user_id)
+  `);
+  try {
+    await db.unsafe(usersEmailVerifiedAtSql(sql));
+  } catch {}
+  try {
+    await db.unsafe(usersPasswordChangedAtSql(sql));
+  } catch {}
+  log.success("Email verifications table ready");
+} catch (error) {
+  log.error("Failed to create email_verifications table", error);
+  process.exit(1);
+}
+log.info("Ensuring webauthn_challenges table exists...");
+try {
+  if (isPostgres)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS webauthn_challenges (
+        id SERIAL PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        challenge TEXT NOT NULL,
+        purpose VARCHAR(32) NOT NULL,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else if (isMysql)
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS webauthn_challenges (
+        id INTEGER AUTO_INCREMENT PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        challenge TEXT NOT NULL,
+        purpose VARCHAR(32) NOT NULL,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  else
+    await db.unsafe(`
+      CREATE TABLE IF NOT EXISTS webauthn_challenges (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id INTEGER NOT NULL,
+        challenge TEXT NOT NULL,
+        purpose VARCHAR(32) NOT NULL,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+  await db.unsafe(`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_webauthn_challenges_user_purpose ON webauthn_challenges(user_id, purpose)
+  `);
+  log.success("WebAuthn challenges table ready");
+} catch (error) {
+  log.error("Failed to create webauthn_challenges table", error);
+  process.exit(1);
+}
+log.info("Creating personal access client...");
+try {
+  if ((await db.unsafe(`
+    SELECT id FROM oauth_clients WHERE personal_access_client = ${boolTrue} LIMIT 1
+  `))?.length > 0)
+    console.log(`
+\u2713 Personal access client already exists`);
+  else {
+    const secret = randomBytes(40).toString("hex"), hashedSecret = await makeHash(secret, { algorithm: "bcrypt" });
+    if (isPostgres)
+      await db.unsafe(`
+        INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
+        VALUES ($1, $2, $3, $4, $5, $6, $7, NOW())
+      `, ["Personal Access Client", hashedSecret, "local", "http://localhost", !0, !1, !1]);
+    else
+      await db.unsafe(`
+        INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ${now})
+      `, ["Personal Access Client", hashedSecret, "local", "http://localhost", 1, 0, 0]);
+    console.log(`
+\u2713 Personal access client created successfully`);
+  }
+} catch (error) {
+  console.error("Failed to create personal access client:", error);
+  process.exit(1);
+}
+console.log(`
+\u2713 Authentication setup complete!`);
+console.log(`
+Features enabled:`);
+console.log("  - Token hashing (SHA-256) for secure storage");
+console.log("  - Refresh tokens for seamless token renewal");
+console.log("  - Scope-based authorization");
+console.log("  - Password reset flow");
+console.log(`
+Next steps:`);
+console.log("  1. Use createToken(userId, name, scopes) to generate tokens");
+console.log("  2. Use refreshToken(token) to exchange refresh tokens");
+console.log('  3. Use the "auth" middleware to protect routes');
+console.log("  4. Use tokenCan(scope) for authorization checks");
+console.log("  5. POST /password/forgot to request password reset");
+console.log(`  6. POST /password/reset to reset password with token
+`);
+process.exit(0);

package/dist/auth/token.d.ts

@@ -0,0 +1 @@
+export {};