@syncello/auth 2.5.1

package/dist/cli/index.js

@@ -0,0 +1,1100 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { Command } from "commander";
+
+// src/cli/commands/init.ts
+import * as fs3 from "fs";
+import * as path2 from "path";
+
+// src/schema/definitions.ts
+var SCHEMA_VERSION = "2026.05.1";
+var enums = {
+  identifierType: {
+    name: "identifier_type_enum",
+    values: ["email", "ip"]
+  },
+  twoFactorMethod: {
+    name: "two_factor_method",
+    values: ["totp", "email"]
+  },
+  deviceType: {
+    name: "device_type",
+    values: ["desktop", "mobile", "tablet"]
+  }
+};
+var tables = {
+  users: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      email: { type: "varchar", length: 255, notNull: true, unique: true },
+      name: { type: "text" },
+      hashedPassword: { type: "varchar", length: 255 },
+      pepperKid: { type: "varchar", length: 10, default: "v1" },
+      emailVerified: { type: "boolean", default: false },
+      isAdmin: { type: "boolean", default: false, notNull: true },
+      sessionVersion: { type: "integer", default: 1 },
+      lockedUntil: { type: "bigint", mode: "number" },
+      failedLoginCount: { type: "integer", default: 0 },
+      emailBounced: { type: "boolean", default: false, notNull: true },
+      emailBouncedAt: { type: "timestamp", withTimezone: true },
+      emailComplained: { type: "boolean", default: false, notNull: true },
+      emailComplainedAt: { type: "timestamp", withTimezone: true },
+      activatedAt: { type: "timestamp", withTimezone: true },
+      deletedAt: { type: "timestamp", withTimezone: true },
+      scheduledPurgeAt: { type: "timestamp", withTimezone: true },
+      createdAt: { type: "timestamp", withTimezone: true, default: "now()" },
+      updatedAt: { type: "timestamp", withTimezone: true, default: "now()" }
+    },
+    indexes: [{ name: "idx_users_email", columns: ["email"] }]
+  },
+  sessions: {
+    columns: {
+      id: { type: "varchar", length: 128, primaryKey: true },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      expiresAt: { type: "bigint", mode: "number", notNull: true },
+      createdAt: { type: "bigint", mode: "number", notNull: true },
+      lastActiveAt: { type: "bigint", mode: "number" },
+      fingerprint: { type: "varchar", length: 64 },
+      ipAddress: { type: "varchar", length: 45 }
+    },
+    indexes: [
+      { name: "idx_sessions_expires", columns: ["expiresAt"] },
+      { name: "idx_sessions_user", columns: ["userId"] }
+    ]
+  },
+  user2faMethods: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      method: { type: "two_factor_method", notNull: true },
+      totpSecret: { type: "varchar", length: 256 },
+      lastTotpCounter: { type: "bigint", mode: "number" },
+      isPrimary: { type: "boolean", default: false, notNull: true },
+      verifiedAt: { type: "bigint", mode: "number", notNull: true },
+      createdAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [
+      { name: "user_2fa_methods_user_method_idx", columns: ["userId", "method"], unique: true },
+      { name: "user_2fa_methods_user_idx", columns: ["userId"] }
+    ]
+  },
+  userBackupCodes: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      codeHash: { type: "varchar", length: 255, notNull: true },
+      usedAt: { type: "bigint", mode: "number" },
+      createdAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [{ name: "user_backup_codes_user_idx", columns: ["userId"] }]
+  },
+  userTrustedDevices: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      tokenHash: { type: "varchar", length: 128, notNull: true },
+      deviceName: { type: "varchar", length: 255, notNull: true },
+      deviceType: { type: "device_type", notNull: true, default: "desktop" },
+      ipAddress: { type: "varchar", length: 45, notNull: true },
+      expiresAt: { type: "bigint", mode: "number", notNull: true },
+      lastUsedAt: { type: "bigint", mode: "number", notNull: true },
+      createdAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [
+      { name: "user_trusted_devices_user_idx", columns: ["userId"] },
+      { name: "user_trusted_devices_token_idx", columns: ["tokenHash"] },
+      { name: "user_trusted_devices_expires_idx", columns: ["expiresAt"] }
+    ]
+  },
+  emailVerificationTokens: {
+    columns: {
+      tokenHash: { type: "varchar", length: 128, primaryKey: true },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      email: { type: "varchar", length: 255, notNull: true },
+      expiresAt: { type: "bigint", mode: "number", notNull: true },
+      createdAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [
+      { name: "idx_email_verification_user", columns: ["userId"] },
+      { name: "idx_email_verification_expires", columns: ["expiresAt"] }
+    ]
+  },
+  passwordResetTokens: {
+    columns: {
+      tokenHash: { type: "varchar", length: 128, primaryKey: true },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      expiresAt: { type: "bigint", mode: "number", notNull: true },
+      used: { type: "boolean", default: false },
+      createdAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [
+      { name: "idx_password_reset_user", columns: ["userId"] },
+      { name: "idx_password_reset_expires", columns: ["expiresAt"] }
+    ]
+  },
+  emailChangeTokens: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      newEmail: { type: "varchar", length: 255, notNull: true },
+      tokenHash: { type: "varchar", length: 128, notNull: true },
+      cancelTokenHash: { type: "varchar", length: 128, notNull: true },
+      expiresAt: { type: "bigint", mode: "number", notNull: true },
+      createdAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [
+      { name: "idx_email_change_tokens_user", columns: ["userId"], unique: true },
+      { name: "idx_email_change_tokens_token", columns: ["tokenHash"] },
+      { name: "idx_email_change_tokens_cancel", columns: ["cancelTokenHash"] },
+      { name: "idx_email_change_tokens_expires", columns: ["expiresAt"] }
+    ]
+  },
+  emailEvents: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      emailId: { type: "text", notNull: true },
+      userId: {
+        type: "uuid",
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      eventType: { type: "text", notNull: true },
+      emailAddress: { type: "text", notNull: true },
+      metadata: { type: "json" },
+      createdAt: { type: "timestamp", withTimezone: true, default: "now()", notNull: true }
+    },
+    indexes: [
+      { name: "email_events_email_address_idx", columns: ["emailAddress"] },
+      { name: "email_events_user_id_idx", columns: ["userId"] },
+      { name: "email_events_email_id_event_type_idx", columns: ["emailId", "eventType"], unique: true }
+    ]
+  },
+  failedLoginAttempts: {
+    columns: {
+      id: { type: "serial", primaryKey: true },
+      identifier: { type: "varchar", length: 255, notNull: true },
+      identifierType: { type: "identifier_type_enum", notNull: true },
+      attemptedAt: { type: "bigint", mode: "number", notNull: true }
+    },
+    indexes: [
+      { name: "idx_failed_attempts_identifier", columns: ["identifier", "attemptedAt"] },
+      { name: "idx_failed_attempts_time", columns: ["attemptedAt"] }
+    ]
+  },
+  securityAuditLog: {
+    columns: {
+      id: { type: "serial", primaryKey: true },
+      userId: {
+        type: "uuid",
+        references: { table: "users", column: "id", onDelete: "set null" }
+      },
+      eventType: { type: "varchar", length: 50, notNull: true },
+      eventData: { type: "json" },
+      ipAddress: { type: "varchar", length: 45 },
+      userAgent: { type: "text" },
+      success: { type: "boolean", notNull: true },
+      createdAt: { type: "timestamp", withTimezone: true, default: "now()" }
+    },
+    indexes: [
+      { name: "idx_audit_user", columns: ["userId"] },
+      { name: "idx_audit_event", columns: ["eventType"] },
+      { name: "idx_audit_created", columns: ["createdAt"] }
+    ]
+  },
+  oauthAccounts: {
+    columns: {
+      id: { type: "uuid", primaryKey: true, default: "gen_random_uuid()" },
+      userId: {
+        type: "uuid",
+        notNull: true,
+        references: { table: "users", column: "id", onDelete: "cascade" }
+      },
+      provider: { type: "varchar", length: 50, notNull: true },
+      providerUserId: { type: "varchar", length: 255, notNull: true },
+      email: { type: "varchar", length: 255, notNull: true },
+      createdAt: { type: "timestamp", withTimezone: true, default: "now()", notNull: true }
+    },
+    indexes: [
+      { name: "oauth_accounts_user_provider_idx", columns: ["userId", "provider"], unique: true },
+      { name: "oauth_accounts_provider_user_idx", columns: ["provider", "providerUserId"], unique: true }
+    ]
+  }
+};
+var tableNames = {
+  users: "users",
+  sessions: "sessions",
+  user2faMethods: "user_2fa_methods",
+  userBackupCodes: "user_backup_codes",
+  userTrustedDevices: "user_trusted_devices",
+  emailVerificationTokens: "email_verification_tokens",
+  passwordResetTokens: "password_reset_tokens",
+  emailChangeTokens: "email_change_tokens",
+  emailEvents: "email_events",
+  failedLoginAttempts: "failed_login_attempts",
+  securityAuditLog: "security_audit_log",
+  oauthAccounts: "oauth_accounts"
+};
+
+// src/schema/generator.ts
+function toSnakeCase(str) {
+  return str.replace(/([a-z])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase();
+}
+function toPascalCase(str) {
+  return str.split(/[_-]/).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+}
+function isEnumType(type) {
+  return Object.values(enums).some((e) => e.name === type);
+}
+function getEnumVarName(enumDbName) {
+  const entry = Object.entries(enums).find(([_, e]) => e.name === enumDbName);
+  return entry ? `${entry[0]}Enum` : enumDbName;
+}
+function generateColumnCode(name, col) {
+  const snakeName = toSnakeCase(name);
+  const parts = [];
+  if (isEnumType(col.type)) {
+    parts.push(`${getEnumVarName(col.type)}('${snakeName}')`);
+  } else {
+    switch (col.type) {
+      case "uuid":
+        parts.push(`uuid('${snakeName}')`);
+        break;
+      case "varchar":
+        parts.push(`varchar('${snakeName}', { length: ${col.length ?? 255} })`);
+        break;
+      case "text":
+        parts.push(`text('${snakeName}')`);
+        break;
+      case "boolean":
+        parts.push(`boolean('${snakeName}')`);
+        break;
+      case "integer":
+        parts.push(`integer('${snakeName}')`);
+        break;
+      case "bigint":
+        parts.push(`bigint('${snakeName}', { mode: 'number' })`);
+        break;
+      case "timestamp":
+        if (col.withTimezone) {
+          parts.push(`timestamp('${snakeName}', { withTimezone: true })`);
+        } else {
+          parts.push(`timestamp('${snakeName}')`);
+        }
+        break;
+      case "json":
+        parts.push(`json('${snakeName}')`);
+        break;
+      case "serial":
+        parts.push(`serial('${snakeName}')`);
+        break;
+      default:
+        parts.push(`text('${snakeName}')`);
+    }
+  }
+  if (col.primaryKey) {
+    parts.push(".primaryKey()");
+  }
+  if (col.notNull && !col.primaryKey) {
+    parts.push(".notNull()");
+  }
+  if (col.unique) {
+    parts.push(".unique()");
+  }
+  if (col.default !== void 0) {
+    if (col.default === "gen_random_uuid()") {
+      parts.push(".defaultRandom()");
+    } else if (col.default === "now()") {
+      parts.push(".defaultNow()");
+    } else if (typeof col.default === "boolean") {
+      parts.push(`.default(${col.default})`);
+    } else if (typeof col.default === "number") {
+      parts.push(`.default(${col.default})`);
+    } else if (typeof col.default === "string") {
+      parts.push(`.default('${col.default}')`);
+    }
+  }
+  if (col.references) {
+    const refTable = col.references.table;
+    const refColumn = col.references.column;
+    const onDelete = col.references.onDelete ?? "no action";
+    parts.push(`.references(() => ${refTable}.${refColumn}, { onDelete: '${onDelete}' })`);
+  }
+  return parts.join("");
+}
+function generateIndexCode(idx, tableVar) {
+  const columns = idx.columns.map((c) => `${tableVar}.${c}`).join(", ");
+  if (idx.unique) {
+    return `uniqueIndex('${idx.name}').on(${columns})`;
+  }
+  return `index('${idx.name}').on(${columns})`;
+}
+function deriveRelationName(columnName) {
+  if (columnName.endsWith("Id")) {
+    return columnName.slice(0, -2);
+  }
+  return columnName;
+}
+function pluralize(name) {
+  if (name.endsWith("s")) return name;
+  if (name.endsWith("y") && !name.endsWith("ey") && !name.endsWith("ay") && !name.endsWith("oy")) {
+    return name.slice(0, -1) + "ies";
+  }
+  return name + "s";
+}
+function extractForeignKeys() {
+  const foreignKeys = [];
+  for (const [tableName, tableDef] of Object.entries(tables)) {
+    for (const [columnName, columnDef] of Object.entries(tableDef.columns)) {
+      const col = columnDef;
+      if (col.references) {
+        foreignKeys.push({
+          tableName,
+          columnName,
+          referencedTable: col.references.table,
+          referencedColumn: col.references.column
+        });
+      }
+    }
+  }
+  return foreignKeys;
+}
+function buildRelations(foreignKeys) {
+  const relationsByTable = /* @__PURE__ */ new Map();
+  const addRelation = (tableName, relation) => {
+    if (!relationsByTable.has(tableName)) {
+      relationsByTable.set(tableName, []);
+    }
+    relationsByTable.get(tableName).push(relation);
+  };
+  for (const fk of foreignKeys) {
+    const relationName = deriveRelationName(fk.columnName);
+    addRelation(fk.tableName, {
+      tableName: fk.tableName,
+      relationName,
+      type: "one",
+      targetTable: fk.referencedTable,
+      fieldColumn: fk.columnName,
+      refColumn: fk.referencedColumn
+    });
+    const manyRelationName = pluralize(fk.tableName);
+    addRelation(fk.referencedTable, {
+      tableName: fk.referencedTable,
+      relationName: manyRelationName,
+      type: "many",
+      targetTable: fk.tableName
+    });
+  }
+  return relationsByTable;
+}
+function generateRelations() {
+  const foreignKeys = extractForeignKeys();
+  const relationsByTable = buildRelations(foreignKeys);
+  const lines = [];
+  const sortedTables = Array.from(relationsByTable.keys()).sort();
+  for (const tableName of sortedTables) {
+    const relations = relationsByTable.get(tableName);
+    const oneRelations = relations.filter((r) => r.type === "one");
+    const manyRelations = relations.filter((r) => r.type === "many");
+    const params = [];
+    if (oneRelations.length > 0) params.push("one");
+    if (manyRelations.length > 0) params.push("many");
+    if (params.length === 0) continue;
+    lines.push(`export const ${tableName}Relations = relations(${tableName}, ({ ${params.join(", ")} }) => ({`);
+    for (const rel of oneRelations) {
+      lines.push(`	${rel.relationName}: one(${rel.targetTable}, {`);
+      lines.push(`		fields: [${rel.tableName}.${rel.fieldColumn}],`);
+      lines.push(`		references: [${rel.targetTable}.${rel.refColumn}],`);
+      lines.push("	}),");
+    }
+    for (const rel of manyRelations) {
+      lines.push(`	${rel.relationName}: many(${rel.targetTable}),`);
+    }
+    lines.push("}));");
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function generateSchemaFile() {
+  const lines = [];
+  lines.push("/**");
+  lines.push(" * AUTO-GENERATED by @syncello/auth - DO NOT EDIT");
+  lines.push(` * Schema version: ${SCHEMA_VERSION}`);
+  lines.push(" * Regenerate with: npx syncello-auth sync");
+  lines.push(" */");
+  lines.push("");
+  lines.push("import {");
+  lines.push("	pgTable,");
+  lines.push("	pgEnum,");
+  lines.push("	uuid,");
+  lines.push("	varchar,");
+  lines.push("	text,");
+  lines.push("	boolean,");
+  lines.push("	integer,");
+  lines.push("	bigint,");
+  lines.push("	timestamp,");
+  lines.push("	json,");
+  lines.push("	serial,");
+  lines.push("	index,");
+  lines.push("	uniqueIndex,");
+  lines.push("} from 'drizzle-orm/pg-core';");
+  lines.push("import { relations } from 'drizzle-orm';");
+  lines.push("");
+  lines.push("// ====================================");
+  lines.push("// ENUMS");
+  lines.push("// ====================================");
+  lines.push("");
+  for (const [key, enumDef] of Object.entries(enums)) {
+    const varName = `${key}Enum`;
+    const values = enumDef.values.map((v) => `'${v}'`).join(", ");
+    lines.push(`export const ${varName} = pgEnum('${enumDef.name}', [${values}]);`);
+  }
+  lines.push("");
+  lines.push("// ====================================");
+  lines.push("// TABLES");
+  lines.push("// ====================================");
+  lines.push("");
+  for (const [tableKey, tableDef] of Object.entries(tables)) {
+    const dbTableName = tableNames[tableKey];
+    lines.push(`export const ${tableKey} = pgTable('${dbTableName}', {`);
+    for (const [colName, colDef] of Object.entries(tableDef.columns)) {
+      const colCode = generateColumnCode(colName, colDef);
+      lines.push(`	${colName}: ${colCode},`);
+    }
+    if (tableDef.indexes && tableDef.indexes.length > 0) {
+      lines.push("}, (table) => ({");
+      for (const idx of tableDef.indexes) {
+        const idxCode = generateIndexCode(idx, "table");
+        const idxVarName = idx.name.replace(/-/g, "_");
+        lines.push(`	${idxVarName}: ${idxCode},`);
+      }
+      lines.push("}));");
+    } else {
+      lines.push("});");
+    }
+    lines.push("");
+  }
+  lines.push("// ====================================");
+  lines.push("// RELATIONS");
+  lines.push("// ====================================");
+  lines.push("");
+  lines.push(generateRelations());
+  lines.push("// ====================================");
+  lines.push("// TYPE EXPORTS");
+  lines.push("// ====================================");
+  lines.push("");
+  for (const tableKey of Object.keys(tables)) {
+    const typeName = toPascalCase(tableKey);
+    lines.push(`export type ${typeName} = typeof ${tableKey}.$inferSelect;`);
+    lines.push(`export type New${typeName} = typeof ${tableKey}.$inferInsert;`);
+  }
+  return lines.join("\n");
+}
+function generateExtensionsFile() {
+  const lines = [];
+  lines.push("/**");
+  lines.push(" * Client extensions for auth schema - this file is PRESERVED during sync");
+  lines.push(" * Add your custom columns here");
+  lines.push(" *");
+  lines.push(" * Example:");
+  lines.push(" * export const userExtensions = {");
+  lines.push(" *   avatarUrl: varchar('avatar_url', { length: 500 }),");
+  lines.push(" *   stripeCustomerId: varchar('stripe_customer_id', { length: 255 }),");
+  lines.push(" * };");
+  lines.push(" */");
+  lines.push("");
+  lines.push("import type { PgColumnBuilderBase } from 'drizzle-orm/pg-core';");
+  lines.push("");
+  lines.push("export const userExtensions: Record<string, PgColumnBuilderBase> = {};");
+  lines.push("");
+  lines.push("export const sessionExtensions: Record<string, PgColumnBuilderBase> = {};");
+  lines.push("");
+  return lines.join("\n");
+}
+function generateIndexFile() {
+  const lines = [];
+  lines.push("/**");
+  lines.push(" * Schema Index");
+  lines.push(" * Exports all auth tables");
+  lines.push(" *");
+  lines.push(" * To add custom columns to auth tables, edit auth-extensions.ts");
+  lines.push(" * Those extensions will be merged during schema generation.");
+  lines.push(" */");
+  lines.push("");
+  lines.push("export * from './auth';");
+  lines.push("");
+  lines.push("// Re-export extension types if needed");
+  lines.push("export * from './auth-extensions';");
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/cli/utils/config.ts
+import * as fs from "fs";
+import * as path from "path";
+var CONFIG_FILENAME = "syncello-auth.json";
+function getConfigPath(cwd = process.cwd()) {
+  return path.join(cwd, CONFIG_FILENAME);
+}
+function configExists(cwd = process.cwd()) {
+  return fs.existsSync(getConfigPath(cwd));
+}
+function loadConfig(cwd = process.cwd()) {
+  const configPath = getConfigPath(cwd);
+  if (!fs.existsSync(configPath)) {
+    return null;
+  }
+  const content = fs.readFileSync(configPath, "utf-8");
+  return JSON.parse(content);
+}
+function saveConfig(config, cwd = process.cwd()) {
+  const configPath = getConfigPath(cwd);
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+function createInitialConfig(libraryVersion, schemaHash) {
+  return {
+    libraryVersion,
+    schemaVersion: SCHEMA_VERSION,
+    schemaHash,
+    lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    extensions: {
+      enabled: true,
+      file: "db/schema/auth-extensions.ts"
+    }
+  };
+}
+
+// src/cli/utils/hash.ts
+import * as crypto from "crypto";
+import * as fs2 from "fs";
+function hashContent(content) {
+  return crypto.createHash("sha256").update(content).digest("hex").slice(0, 16);
+}
+function hashFile(filePath) {
+  if (!fs2.existsSync(filePath)) {
+    return null;
+  }
+  const content = fs2.readFileSync(filePath, "utf-8");
+  return hashContent(content);
+}
+
+// src/cli/commands/init.ts
+function getLibraryVersion() {
+  try {
+    const pkgPath = path2.resolve(__dirname, "../../../package.json");
+    const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8"));
+    return pkg.version;
+  } catch {
+    return "0.0.0";
+  }
+}
+async function init(options) {
+  const cwd = process.cwd();
+  const outputDir = options.output || "db/schema";
+  const schemaDir = path2.join(cwd, outputDir);
+  if (configExists(cwd) && !options.force) {
+    console.log("\u274C @syncello/auth is already initialized in this project.");
+    console.log("   Use --force to reinitialize (this will overwrite auth.ts)");
+    process.exit(1);
+  }
+  if (!fs3.existsSync(schemaDir)) {
+    fs3.mkdirSync(schemaDir, { recursive: true });
+    console.log(`\u2713 Created ${outputDir}/`);
+  }
+  const authSchemaContent = generateSchemaFile();
+  const authSchemaPath = path2.join(schemaDir, "auth.ts");
+  fs3.writeFileSync(authSchemaPath, authSchemaContent);
+  console.log(`\u2713 Created ${outputDir}/auth.ts`);
+  const extensionsPath = path2.join(schemaDir, "auth-extensions.ts");
+  if (!fs3.existsSync(extensionsPath)) {
+    fs3.writeFileSync(extensionsPath, generateExtensionsFile());
+    console.log(`\u2713 Created ${outputDir}/auth-extensions.ts`);
+  } else {
+    console.log(`\u2713 Preserved existing ${outputDir}/auth-extensions.ts`);
+  }
+  const indexPath = path2.join(schemaDir, "index.ts");
+  if (!fs3.existsSync(indexPath)) {
+    fs3.writeFileSync(indexPath, generateIndexFile());
+    console.log(`\u2713 Created ${outputDir}/index.ts`);
+  } else {
+    console.log(`\u2713 Preserved existing ${outputDir}/index.ts`);
+  }
+  const schemaHash = hashContent(authSchemaContent);
+  const config = createInitialConfig(getLibraryVersion(), schemaHash);
+  config.extensions.file = `${outputDir}/auth-extensions.ts`;
+  saveConfig(config, cwd);
+  console.log(`\u2713 Created syncello-auth.json`);
+  console.log("");
+  console.log("\u2705 @syncello/auth initialized successfully!");
+  console.log("");
+  console.log("Next steps:");
+  console.log("  1. Run: pnpm drizzle-kit generate");
+  console.log("  2. Run: pnpm drizzle-kit migrate");
+  console.log("  3. Import schema in your app:");
+  console.log(`     import * as schema from './${outputDir}';`);
+}
+
+// src/cli/commands/sync.ts
+import * as fs4 from "fs";
+import * as path3 from "path";
+
+// src/cli/utils/diff.ts
+import * as Diff from "diff";
+import pc from "picocolors";
+function generateDiff(oldContent, newContent, options = {}) {
+  const { oldLabel = "current", newLabel = "updated", context = 3 } = options;
+  if (!oldContent) {
+    const lines2 = newContent.split("\n");
+    const output = [
+      pc.bold(pc.cyan(`--- /dev/null`)),
+      pc.bold(pc.cyan(`+++ ${newLabel}`)),
+      pc.cyan(`@@ -0,0 +1,${lines2.length} @@`),
+      ...lines2.map((line) => pc.green(`+ ${line}`))
+    ].join("\n");
+    return {
+      output,
+      stats: { additions: lines2.length, deletions: 0 },
+      hasChanges: true
+    };
+  }
+  const patch = Diff.structuredPatch(oldLabel, newLabel, oldContent, newContent, void 0, void 0, { context });
+  if (patch.hunks.length === 0) {
+    return {
+      output: "",
+      stats: { additions: 0, deletions: 0 },
+      hasChanges: false
+    };
+  }
+  const lines = [];
+  let additions = 0;
+  let deletions = 0;
+  lines.push(pc.bold(`--- ${oldLabel}`));
+  lines.push(pc.bold(`+++ ${newLabel}`));
+  for (const hunk of patch.hunks) {
+    const hunkHeader = `@@ -${hunk.oldStart},${hunk.oldLines} +${hunk.newStart},${hunk.newLines} @@`;
+    lines.push(pc.cyan(hunkHeader));
+    for (const line of hunk.lines) {
+      const prefix = line[0];
+      const content = line.slice(1);
+      switch (prefix) {
+        case "+":
+          lines.push(pc.green(`+ ${content}`));
+          additions++;
+          break;
+        case "-":
+          lines.push(pc.red(`- ${content}`));
+          deletions++;
+          break;
+        case " ":
+          lines.push(pc.dim(`  ${content}`));
+          break;
+        case "\\":
+          lines.push(pc.dim(`\\ ${content}`));
+          break;
+      }
+    }
+  }
+  return {
+    output: lines.join("\n"),
+    stats: { additions, deletions },
+    hasChanges: true
+  };
+}
+function formatStats(stats) {
+  const parts = [];
+  if (stats.additions > 0) {
+    parts.push(pc.green(`+${stats.additions}`));
+  }
+  if (stats.deletions > 0) {
+    parts.push(pc.red(`-${stats.deletions}`));
+  }
+  if (parts.length === 0) {
+    return pc.dim("No changes");
+  }
+  return parts.join(" ");
+}
+
+// src/cli/utils/breaking-changes.ts
+import pc2 from "picocolors";
+function parseGeneratedSchema(content) {
+  const result = { tables: {}, enums: {} };
+  const enumRegex = /export const \w+ = pgEnum\('(\w+)',\s*\[([^\]]+)\]\)/g;
+  let enumMatch;
+  while ((enumMatch = enumRegex.exec(content)) !== null) {
+    const enumName = enumMatch[1];
+    const valuesStr = enumMatch[2];
+    const values = valuesStr.match(/'([^']+)'/g)?.map((v) => v.replace(/'/g, "")) || [];
+    result.enums[enumName] = { values };
+  }
+  const tableRegex = /export const (\w+) = pgTable\(\s*'(\w+)',\s*\{([^}]+(?:\{[^}]*\}[^}]*)*)\}/gs;
+  let tableMatch;
+  while ((tableMatch = tableRegex.exec(content)) !== null) {
+    const tableName = tableMatch[2];
+    const columnsBlock = tableMatch[3];
+    result.tables[tableName] = { columns: parseColumns(columnsBlock) };
+  }
+  return result;
+}
+function parseColumns(block) {
+  const columns = {};
+  const lines = block.split("\n");
+  for (const line of lines) {
+    const colMatch = line.match(/(\w+):\s*(uuid|varchar|text|boolean|integer|bigint|timestamp|json|serial)\(/);
+    if (colMatch) {
+      const colName = colMatch[1];
+      const colType = colMatch[2];
+      const col = { type: colType };
+      const lengthMatch = line.match(/length:\s*(\d+)/);
+      if (lengthMatch) {
+        col.length = parseInt(lengthMatch[1], 10);
+      }
+      if (line.includes(".notNull()")) {
+        col.notNull = true;
+      }
+      if (line.includes(".unique()")) {
+        col.unique = true;
+      }
+      columns[colName] = col;
+    }
+  }
+  return columns;
+}
+function detectBreakingChanges(oldSchemaContent) {
+  const changes = [];
+  const oldSchema = parseGeneratedSchema(oldSchemaContent);
+  for (const tableName of Object.keys(oldSchema.tables)) {
+    const newTableKey = Object.entries(tables).find(
+      ([, def]) => def === tables[tableName]
+    )?.[0];
+    const tableExists = Object.values(tables).some(
+      (t) => t === tables[tableName]
+    );
+    const stillExists = tableName in getTableNameMapping();
+    if (!stillExists) {
+      changes.push({
+        type: "error",
+        category: "table",
+        message: `Table '${tableName}' has been removed`,
+        table: tableName
+      });
+    }
+  }
+  for (const [tableName, oldTable] of Object.entries(oldSchema.tables)) {
+    const newTable = getNewTableByName(tableName);
+    if (!newTable) continue;
+    for (const [colName, oldCol] of Object.entries(oldTable.columns)) {
+      const newCol = newTable.columns[colName];
+      if (!newCol) {
+        changes.push({
+          type: "error",
+          category: "column",
+          message: `Column '${colName}' removed from table '${tableName}'`,
+          table: tableName,
+          column: colName
+        });
+        continue;
+      }
+      if (normalizeType(oldCol.type) !== normalizeType(newCol.type)) {
+        changes.push({
+          type: "error",
+          category: "column",
+          message: `Column '${tableName}.${colName}' type changed: ${oldCol.type} \u2192 ${newCol.type}`,
+          table: tableName,
+          column: colName
+        });
+      }
+      if (oldCol.length && newCol.length && newCol.length < oldCol.length) {
+        changes.push({
+          type: "error",
+          category: "column",
+          message: `Column '${tableName}.${colName}' length reduced: ${oldCol.length} \u2192 ${newCol.length}`,
+          table: tableName,
+          column: colName
+        });
+      }
+      if (!oldCol.notNull && newCol.notNull && newCol.default === void 0) {
+        changes.push({
+          type: "error",
+          category: "constraint",
+          message: `Column '${tableName}.${colName}' made NOT NULL without default value`,
+          table: tableName,
+          column: colName
+        });
+      }
+      if (oldCol.unique && !newCol.unique) {
+        changes.push({
+          type: "warning",
+          category: "constraint",
+          message: `Column '${tableName}.${colName}' unique constraint removed`,
+          table: tableName,
+          column: colName
+        });
+      }
+    }
+  }
+  for (const [enumName, oldEnum] of Object.entries(oldSchema.enums)) {
+    const newEnum = Object.values(enums).find((e) => e.name === enumName);
+    if (!newEnum) {
+      changes.push({
+        type: "error",
+        category: "enum",
+        message: `Enum '${enumName}' has been removed`
+      });
+      continue;
+    }
+    for (const oldValue of oldEnum.values) {
+      if (!newEnum.values.includes(oldValue)) {
+        changes.push({
+          type: "error",
+          category: "enum",
+          message: `Value '${oldValue}' removed from enum '${enumName}'`
+        });
+      }
+    }
+  }
+  return {
+    changes,
+    hasErrors: changes.some((c) => c.type === "error"),
+    hasWarnings: changes.some((c) => c.type === "warning")
+  };
+}
+function getTableNameMapping() {
+  return {
+    users: "users",
+    sessions: "sessions",
+    user_2fa_methods: "user2faMethods",
+    user_backup_codes: "userBackupCodes",
+    user_trusted_devices: "userTrustedDevices",
+    email_verification_tokens: "emailVerificationTokens",
+    password_reset_tokens: "passwordResetTokens",
+    email_change_tokens: "emailChangeTokens",
+    email_events: "emailEvents",
+    failed_login_attempts: "failedLoginAttempts",
+    security_audit_log: "securityAuditLog",
+    oauth_accounts: "oauthAccounts"
+  };
+}
+function getNewTableByName(dbTableName) {
+  const mapping = getTableNameMapping();
+  const jsName = mapping[dbTableName];
+  if (!jsName) return void 0;
+  return tables[jsName];
+}
+function normalizeType(type) {
+  if (type.includes("_enum") || type === "two_factor_method" || type === "device_type") {
+    return "enum";
+  }
+  return type;
+}
+function formatBreakingChanges(result) {
+  if (result.changes.length === 0) {
+    return pc2.green("\u2713 No breaking changes detected");
+  }
+  const lines = [];
+  const errors = result.changes.filter((c) => c.type === "error");
+  const warnings = result.changes.filter((c) => c.type === "warning");
+  if (errors.length > 0) {
+    lines.push(pc2.red(pc2.bold("Breaking Changes:")));
+    for (const error of errors) {
+      lines.push(pc2.red(`  \u2717 ${error.message}`));
+    }
+  }
+  if (warnings.length > 0) {
+    if (errors.length > 0) lines.push("");
+    lines.push(pc2.yellow(pc2.bold("Warnings:")));
+    for (const warning of warnings) {
+      lines.push(pc2.yellow(`  \u26A0 ${warning.message}`));
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/cli/commands/sync.ts
+function getLibraryVersion2() {
+  try {
+    const pkgPath = path3.resolve(__dirname, "../../../package.json");
+    const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+    return pkg.version;
+  } catch {
+    return "0.0.0";
+  }
+}
+async function sync(options) {
+  const cwd = process.cwd();
+  if (!configExists(cwd)) {
+    console.log("\u274C @syncello/auth is not initialized in this project.");
+    console.log("   Run: npx @syncello/auth init");
+    process.exit(1);
+  }
+  const config = loadConfig(cwd);
+  const schemaDir = path3.dirname(path3.join(cwd, config.extensions.file));
+  const authSchemaPath = path3.join(schemaDir, "auth.ts");
+  const newSchemaContent = generateSchemaFile();
+  const newSchemaHash = hashContent(newSchemaContent);
+  const currentHash = hashFile(authSchemaPath);
+  const libraryVersion = getLibraryVersion2();
+  console.log(`Current version: ${config.libraryVersion} (schema ${config.schemaVersion})`);
+  console.log(`Available version: ${libraryVersion} (schema ${SCHEMA_VERSION})`);
+  console.log("");
+  if (currentHash && currentHash !== config.schemaHash && !options.force) {
+    console.log("\u26A0\uFE0F  Warning: auth.ts has been modified locally.");
+    console.log("   Use --force to overwrite local changes.");
+    if (!options.dryRun) {
+      process.exit(1);
+    }
+  }
+  const currentContent = fs4.existsSync(authSchemaPath) ? fs4.readFileSync(authSchemaPath, "utf-8") : "";
+  if (newSchemaHash === config.schemaHash && config.schemaVersion === SCHEMA_VERSION) {
+    console.log("\u2705 Schema is already up to date.");
+    return;
+  }
+  if (options.diff || options.dryRun) {
+    console.log("Schema changes:");
+    if (config.schemaVersion !== SCHEMA_VERSION) {
+      console.log(`  Schema version: ${config.schemaVersion} \u2192 ${SCHEMA_VERSION}`);
+    }
+    console.log("");
+    const diff = generateDiff(currentContent, newSchemaContent, {
+      oldLabel: "auth.ts (current)",
+      newLabel: "auth.ts (updated)",
+      context: 3
+    });
+    if (diff.hasChanges) {
+      console.log(diff.output);
+      console.log("");
+      console.log(`Summary: ${formatStats(diff.stats)}`);
+    } else {
+      console.log("  No content changes detected.");
+    }
+    console.log("");
+  }
+  if (currentContent) {
+    const breakingChanges = detectBreakingChanges(currentContent);
+    if (breakingChanges.hasErrors || breakingChanges.hasWarnings) {
+      console.log(formatBreakingChanges(breakingChanges));
+      console.log("");
+      if (breakingChanges.hasErrors && !options.force) {
+        console.log("\u274C Breaking changes detected. Migration required.");
+        console.log("   Use --force to sync anyway (not recommended).");
+        console.log("");
+        console.log("Recommended steps:");
+        console.log("  1. Review the breaking changes above");
+        console.log("  2. Create a migration plan for affected data");
+        console.log("  3. Run with --force after preparing migration");
+        process.exit(1);
+      }
+    } else {
+      console.log("\u2713 No breaking changes detected");
+      console.log("");
+    }
+  }
+  if (options.dryRun) {
+    console.log("Dry run complete. No files modified.");
+    return;
+  }
+  if (fs4.existsSync(authSchemaPath)) {
+    const backupPath = authSchemaPath + ".backup";
+    fs4.copyFileSync(authSchemaPath, backupPath);
+    console.log(`\u2713 Backed up auth.ts \u2192 auth.ts.backup`);
+  }
+  fs4.writeFileSync(authSchemaPath, newSchemaContent);
+  console.log(`\u2713 Updated auth.ts`);
+  config.libraryVersion = libraryVersion;
+  config.schemaVersion = SCHEMA_VERSION;
+  config.schemaHash = newSchemaHash;
+  config.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
+  saveConfig(config, cwd);
+  console.log(`\u2713 Updated syncello-auth.json`);
+  console.log("");
+  console.log("\u2705 Sync complete!");
+  console.log("");
+  console.log("Next steps:");
+  console.log("  1. Run: pnpm drizzle-kit generate");
+  console.log("  2. Review the migration");
+  console.log("  3. Run: pnpm drizzle-kit migrate");
+}
+
+// src/cli/commands/status.ts
+import * as fs5 from "fs";
+import * as path4 from "path";
+function getLibraryVersion3() {
+  try {
+    const pkgPath = path4.resolve(__dirname, "../../../package.json");
+    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
+    return pkg.version;
+  } catch {
+    return "0.0.0";
+  }
+}
+async function status() {
+  const cwd = process.cwd();
+  if (!configExists(cwd)) {
+    console.log("\u274C @syncello/auth is not initialized in this project.");
+    console.log("   Run: npx @syncello/auth init");
+    process.exit(1);
+  }
+  const config = loadConfig(cwd);
+  const libraryVersion = getLibraryVersion3();
+  const schemaDir = path4.dirname(path4.join(cwd, config.extensions.file));
+  const authSchemaPath = path4.join(schemaDir, "auth.ts");
+  console.log("@syncello/auth Status");
+  console.log("\u2500".repeat(40));
+  console.log("");
+  console.log("Installed:");
+  console.log(`  Library version:  ${config.libraryVersion}`);
+  console.log(`  Schema version:   ${config.schemaVersion}`);
+  console.log(`  Last synced:      ${config.lastSyncedAt}`);
+  console.log("");
+  console.log("Available:");
+  console.log(`  Library version:  ${libraryVersion}`);
+  console.log(`  Schema version:   ${SCHEMA_VERSION}`);
+  console.log("");
+  const currentHash = hashFile(authSchemaPath);
+  if (currentHash && currentHash !== config.schemaHash) {
+    console.log("\u26A0\uFE0F  auth.ts has local modifications");
+  }
+  if (config.schemaVersion !== SCHEMA_VERSION) {
+    console.log("\u{1F4E6} Schema update available!");
+    console.log("   Run: npx @syncello/auth sync");
+  } else if (config.libraryVersion !== libraryVersion) {
+    console.log("\u{1F4E6} Library update available");
+    console.log("   Run: pnpm update @syncello/auth");
+  } else {
+    console.log("\u2705 Up to date");
+  }
+}
+
+// src/cli/index.ts
+var program = new Command();
+program.name("syncello-auth").description("CLI for @syncello/auth schema management").version("0.0.0");
+program.command("init").description("Initialize @syncello/auth in your project").option("-o, --output <dir>", "Output directory for schema files", "db/schema").option("-f, --force", "Force reinitialize (overwrites auth.ts)").action(init);
+program.command("sync").description("Sync schema to latest version").option("-d, --dry-run", "Preview changes without modifying files").option("-f, --force", "Force sync even if local modifications exist").option("--diff", "Show detailed diff of changes").action(sync);
+program.command("status").description("Show current schema status").action(status);
+program.parse();