@authcore/core 0.7.0 → 0.12.0

package/dist/features/magicLink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLink.d.ts","sourceRoot":"","sources":["../../src/features/magicLink.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAS,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAOhG;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,4BAA4B,CAAA;AAExE;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,eAAe,CAAA;IACnB,aAAa,EAAE,YAAY,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC9E,GAAG,OAAO,CAAC,OAAO,CAAC,CA6CnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,eAAe,CAAA;CACpB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAqB1B"}

package/dist/features/magicLink.js

@@ -0,0 +1,88 @@
+import { generateOpaqueToken, hashToken } from '../utils/token.js';
+import { defaultMagicLinkTemplate } from './templates.js';
+const MAGIC_LINK_TTL_MS = 15 * 60 * 1000; // 15 minutes
+const MAGIC_LINK_TTL_MINUTES = 15;
+/**
+ * Sentinel passwordHash used when magic-link creates a brand-new user.
+ *
+ * Same shape as the OAuth sentinel — the user has no password initially and
+ * can claim one via the standard forgot-password flow. This means a magic-link
+ * signup is functionally identical to OAuth signup: an authenticated session
+ * with no password set, and the standard "set a password" recovery path open.
+ */
+export const MAGIC_LINK_NO_PASSWORD_SENTINEL = '!MAGIC_LINK_NO_PASSWORD';
+/**
+ * Send a magic-link email. Always returns successfully (whether the user
+ * exists or not) to prevent email enumeration.
+ *
+ * If `autoCreate` is true (the default) and no user exists for the email,
+ * a new user is created with a sentinel password hash. The user's email is
+ * marked verified — clicking a magic link from the inbox proves email
+ * ownership the same way clicking a verification link does.
+ *
+ * @returns `true` if an email was sent, `false` otherwise. Callers should
+ *   not surface this to the client — return 200 either way.
+ */
+export async function sendMagicLink(params) {
+    const { email, db, emailProvider, from, magicLinkUrl, autoCreate = true, defaultRole = 'user', template = defaultMagicLinkTemplate, } = params;
+    let user = await db.findUserByEmail(email);
+    if (!user) {
+        if (!autoCreate)
+            return false;
+        user = await db.createUser({
+            email,
+            passwordHash: MAGIC_LINK_NO_PASSWORD_SENTINEL,
+            role: defaultRole,
+        });
+        // Magic-link signup verifies the email by definition (the link arrives in
+        // the inbox, proving ownership). Mark verified up front so the user isn't
+        // gated on a second verification email.
+        user = await db.updateUser(user.id, { emailVerified: true });
+    }
+    const rawToken = generateOpaqueToken();
+    await db.createToken({
+        userId: user.id,
+        type: 'MAGIC_LINK',
+        token: hashToken(rawToken),
+        expiresAt: new Date(Date.now() + MAGIC_LINK_TTL_MS),
+    });
+    const link = `${magicLinkUrl}?token=${rawToken}`;
+    const rendered = template({ email, link, ttlMinutes: MAGIC_LINK_TTL_MINUTES });
+    await emailProvider.send({
+        from,
+        to: email,
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
+    });
+    return true;
+}
+/**
+ * Consume a magic-link token. Returns the user (still as a stored DB record).
+ * Caller is responsible for minting the session JWT + refresh token.
+ *
+ * Idempotency: tokens are single-use. After consumption the token row is
+ * deleted, so a second call with the same raw token throws.
+ *
+ * @throws Error if the token is invalid or expired
+ */
+export async function consumeMagicLink(params) {
+    const { rawToken, db } = params;
+    const tokenRecord = await db.findToken(rawToken, 'MAGIC_LINK');
+    if (!tokenRecord) {
+        throw new Error('Invalid or expired magic-link token');
+    }
+    if (tokenRecord.expiresAt < new Date()) {
+        await db.deleteToken(tokenRecord.id);
+        throw new Error('Invalid or expired magic-link token');
+    }
+    const user = await db.findUserById(tokenRecord.userId);
+    if (!user) {
+        await db.deleteToken(tokenRecord.id);
+        throw new Error('Invalid or expired magic-link token');
+    }
+    // Single-use: delete before returning so a replay returns the same error.
+    await db.deleteToken(tokenRecord.id);
+    return { user };
+}
+//# sourceMappingURL=magicLink.js.map

package/dist/features/magicLink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLink.js","sourceRoot":"","sources":["../../src/features/magicLink.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAEzD,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,aAAa;AACtD,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAEjC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAA;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAanC;IACC,MAAM,EACJ,KAAK,EACL,EAAE,EACF,aAAa,EACb,IAAI,EACJ,YAAY,EACZ,UAAU,GAAG,IAAI,EACjB,WAAW,GAAG,MAAM,EACpB,QAAQ,GAAG,wBAAwB,GACpC,GAAG,MAAM,CAAA;IAEV,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAA;QAC7B,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC;YACzB,KAAK;YACL,YAAY,EAAE,+BAA+B;YAC7C,IAAI,EAAE,WAAW;SAClB,CAAC,CAAA;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAA;IACtC,MAAM,EAAE,CAAC,WAAW,CAAC;QACnB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;KACpD,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,GAAG,YAAY,UAAU,QAAQ,EAAE,CAAA;IAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAE9E,MAAM,aAAa,CAAC,IAAI,CAAC;QACvB,IAAI;QACJ,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,MAAM,CAAA;IAE/B,MAAM,WAAW,GAAiB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC5E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,0EAA0E;IAC1E,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IACpC,OAAO,EAAE,IAAI,EAAE,CAAA;AACjB,CAAC"}

package/dist/features/oauth.d.ts

@@ -0,0 +1,39 @@
+import type { DatabaseAdapter, OAuthAccount, OAuthProvider, User } from '@authcore/types';
+/**
+ * Begin an OAuth Authorization Code + PKCE flow.
+ *
+ * Generates a state envelope (nonce, provider, PKCE verifier, redirectUri, issuedAt)
+ * HMAC-signed with the AuthCore secret so the callback can verify integrity without
+ * a DB round-trip. Returns the provider's authorization URL.
+ */
+export declare function startOAuth(params: {
+    provider: OAuthProvider;
+    redirectUri: string;
+    secret: string;
+}): Promise<{
+    authorizationUrl: string;
+    state: string;
+}>;
+/**
+ * Complete an OAuth callback. Verifies the HMAC-signed state, exchanges the code with
+ * the provider for tokens, fetches the user profile, and applies the auto-link policy:
+ *
+ *   - existing OAuthAccount (provider, providerId)         → load user, return.
+ *   - no OAuthAccount, no local user                       → create user (sentinel passwordHash) + link.
+ *   - no OAuthAccount, local user, emailVerified=true      → link to existing user.
+ *   - no OAuthAccount, local user, emailVerified=false     → throw EMAIL_NOT_VERIFIED_BY_PROVIDER (409).
+ */
+export declare function completeOAuth(params: {
+    provider: OAuthProvider;
+    state: string;
+    code: string;
+    redirectUri: string;
+    secret: string;
+    db: DatabaseAdapter;
+    defaultRole: string;
+}): Promise<{
+    user: User;
+    oauthAccount: OAuthAccount;
+    isNewUser: boolean;
+}>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/features/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/features/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EACZ,aAAa,EACb,IAAI,EACL,MAAM,iBAAiB,CAAA;AA0DxB;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE;IACvC,QAAQ,EAAE,aAAa,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,aAAa,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,eAAe,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAqF1E"}

package/dist/features/oauth.js

@@ -0,0 +1,161 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { generateOpaqueToken, generatePkceVerifier, pkceChallenge } from '../utils/token.js';
+const OAUTH_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+const OAUTH_NO_PASSWORD_SENTINEL = '!OAUTH_NO_PASSWORD';
+/** base64url(envelope) + '.' + base64url(hmac(envelope)) */
+function signEnvelope(env, secret) {
+    const json = JSON.stringify(env);
+    const payload = Buffer.from(json, 'utf8').toString('base64url');
+    const sig = createHmac('sha256', secret).update(payload).digest('base64url');
+    return `${payload}.${sig}`;
+}
+function verifyEnvelope(signed, secret) {
+    const dot = signed.lastIndexOf('.');
+    if (dot < 0)
+        return null;
+    const payload = signed.slice(0, dot);
+    const sig = signed.slice(dot + 1);
+    const expected = createHmac('sha256', secret).update(payload).digest('base64url');
+    // Timing-safe compare
+    const sigBuf = Buffer.from(sig, 'utf8');
+    const expBuf = Buffer.from(expected, 'utf8');
+    if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf))
+        return null;
+    try {
+        const env = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if (typeof env.nonce !== 'string' ||
+            typeof env.provider !== 'string' ||
+            typeof env.codeVerifier !== 'string' ||
+            typeof env.redirectUri !== 'string' ||
+            typeof env.issuedAt !== 'number')
+            return null;
+        return env;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Begin an OAuth Authorization Code + PKCE flow.
+ *
+ * Generates a state envelope (nonce, provider, PKCE verifier, redirectUri, issuedAt)
+ * HMAC-signed with the AuthCore secret so the callback can verify integrity without
+ * a DB round-trip. Returns the provider's authorization URL.
+ */
+export async function startOAuth(params) {
+    const { provider, redirectUri, secret } = params;
+    const env = {
+        nonce: generateOpaqueToken(),
+        provider: provider.id,
+        codeVerifier: generatePkceVerifier(),
+        redirectUri,
+        issuedAt: Date.now(),
+    };
+    const state = signEnvelope(env, secret);
+    const authorizationUrl = provider.authorize({
+        state,
+        codeChallenge: pkceChallenge(env.codeVerifier),
+        redirectUri,
+    });
+    return { authorizationUrl, state };
+}
+/**
+ * Complete an OAuth callback. Verifies the HMAC-signed state, exchanges the code with
+ * the provider for tokens, fetches the user profile, and applies the auto-link policy:
+ *
+ *   - existing OAuthAccount (provider, providerId)         → load user, return.
+ *   - no OAuthAccount, no local user                       → create user (sentinel passwordHash) + link.
+ *   - no OAuthAccount, local user, emailVerified=true      → link to existing user.
+ *   - no OAuthAccount, local user, emailVerified=false     → throw EMAIL_NOT_VERIFIED_BY_PROVIDER (409).
+ */
+export async function completeOAuth(params) {
+    const { provider, state, code, redirectUri, secret, db, defaultRole } = params;
+    // 1. Verify HMAC envelope
+    const env = verifyEnvelope(state, secret);
+    if (!env)
+        throw oauthError('Invalid OAuth state', 'INVALID_TOKEN', 401);
+    if (env.provider !== provider.id)
+        throw oauthError('OAuth state provider mismatch', 'INVALID_TOKEN', 401);
+    if (env.redirectUri !== redirectUri)
+        throw oauthError('OAuth state redirectUri mismatch', 'INVALID_TOKEN', 401);
+    if (Date.now() - env.issuedAt > OAUTH_STATE_TTL_MS) {
+        throw oauthError('OAuth state expired', 'INVALID_TOKEN', 401);
+    }
+    // 2. Exchange code for tokens
+    let tokens;
+    try {
+        tokens = await provider.exchangeCode({ code, codeVerifier: env.codeVerifier, redirectUri });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Provider exchange failed';
+        throw oauthError(message, 'OAUTH_EXCHANGE_FAILED', 502);
+    }
+    // 3. Fetch user info
+    let profile;
+    try {
+        profile = await provider.getUserInfo(tokens.accessToken, tokens.idToken);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Provider userinfo failed';
+        throw oauthError(message, 'OAUTH_USERINFO_FAILED', 502);
+    }
+    // 4. Existing OAuth account? Update tokens and return user.
+    const existing = await db.findOAuthAccount(provider.id, profile.id);
+    if (existing) {
+        const updated = await db.updateOAuthAccount(existing.id, {
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken ?? null,
+            expiresAt: tokens.expiresIn ? new Date(Date.now() + tokens.expiresIn * 1000) : null,
+        });
+        const user = await db.findUserById(existing.userId);
+        if (!user) {
+            throw oauthError('Linked user no longer exists', 'INVALID_TOKEN', 401);
+        }
+        return { user, oauthAccount: updated, isNewUser: false };
+    }
+    // 5. No OAuth account. Try to link by email.
+    const localUser = await db.findUserByEmail(profile.email);
+    if (localUser) {
+        if (!profile.emailVerified) {
+            throw oauthError('Email not verified by provider; sign in with your password to link this OAuth account', 'EMAIL_NOT_VERIFIED_BY_PROVIDER', 409);
+        }
+        const oauthAccount = await db.createOAuthAccount({
+            userId: localUser.id,
+            provider: provider.id,
+            providerAccountId: profile.id,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken ?? null,
+            expiresAt: tokens.expiresIn ? new Date(Date.now() + tokens.expiresIn * 1000) : null,
+        });
+        return { user: localUser, oauthAccount, isNewUser: false };
+    }
+    // 6. Brand new user — create with sentinel passwordHash.
+    const newUser = await db.createUser({
+        email: profile.email,
+        passwordHash: OAUTH_NO_PASSWORD_SENTINEL,
+        role: defaultRole,
+    });
+    if (profile.emailVerified) {
+        await db.updateUser(newUser.id, { emailVerified: true });
+        newUser.emailVerified = true;
+    }
+    const oauthAccount = await db.createOAuthAccount({
+        userId: newUser.id,
+        provider: provider.id,
+        providerAccountId: profile.id,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken ?? null,
+        expiresAt: tokens.expiresIn ? new Date(Date.now() + tokens.expiresIn * 1000) : null,
+    });
+    return { user: newUser, oauthAccount, isNewUser: true };
+}
+/** Local helper — kept decoupled from auth.ts's AuthError so feature stays portable. */
+function oauthError(message, code, statusCode) {
+    const err = new Error(message);
+    err.name = 'OAuthError';
+    err.code = code;
+    err.statusCode = statusCode;
+    err.isOAuthError = true;
+    return err;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/features/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/features/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAOzD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE5F,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,aAAa;AACvD,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAqBvD,4DAA4D;AAC5D,SAAS,YAAY,CAAC,GAAuB,EAAE,MAAc;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5E,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACjF,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgC,CAAA;QACzG,IACE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAChC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YACpC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;YACnC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAA;QACb,OAAO,GAAyB,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAIhC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAEhD,MAAM,GAAG,GAAuB;QAC9B,KAAK,EAAE,mBAAmB,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,YAAY,EAAE,oBAAoB,EAAE;QACpC,WAAW;QACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAA;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC1C,KAAK;QACL,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAC9C,WAAW;KACZ,CAAC,CAAA;IACF,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAQnC;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,MAAM,CAAA;IAE9E,0BAA0B;IAC1B,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,GAAG;QAAE,MAAM,UAAU,CAAC,qBAAqB,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE;QAAE,MAAM,UAAU,CAAC,+BAA+B,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IACzG,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;QAAE,MAAM,UAAU,CAAC,kCAAkC,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC/G,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACnD,MAAM,UAAU,CAAC,qBAAqB,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAA;QAC/E,MAAM,UAAU,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAA;IACzD,CAAC;IAED,qBAAqB;IACrB,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAA;QAC/E,MAAM,UAAU,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAA;IACzD,CAAC;IAED,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE;YACvD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;SACpF,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,UAAU,CAAC,8BAA8B,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,UAAU,CACd,uFAAuF,EACvF,gCAAgC,EAChC,GAAG,CACJ,CAAA;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC;YAC/C,MAAM,EAAE,SAAS,CAAC,EAAE;YACpB,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,iBAAiB,EAAE,OAAO,CAAC,EAAE;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;SACpF,CAAC,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC5D,CAAC;IAED,yDAAyD;IACzD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,0BAA0B;QACxC,IAAI,EAAE,WAAW;KAClB,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAA;IAC9B,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC;QAC/C,MAAM,EAAE,OAAO,CAAC,EAAE;QAClB,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,iBAAiB,EAAE,OAAO,CAAC,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACpF,CAAC,CAAA;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AACzD,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,UAAkB;IACnE,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAqE,CAAA;IAClG,GAAG,CAAC,IAAI,GAAG,YAAY,CAAA;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IACf,GAAG,CAAC,UAAU,GAAG,UAAU,CAAA;IAC3B,GAAG,CAAC,YAAY,GAAG,IAAI,CAAA;IACvB,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/features/passwordReset.d.ts

@@ -1,4 +1,4 @@
-import type { DatabaseAdapter, EmailAdapter } from '@authcore/types';
+import type { DatabaseAdapter, EmailAdapter, EmailTemplate } from '@authcore/types';
 /**
  * Initiate a password reset flow.
  * Always returns successfully even if the email is not found — prevents email enumeration.
@@ -10,6 +10,11 @@ export declare function createPasswordReset(params: {
     emailProvider: EmailAdapter;
     from: string;
     resetUrl: string;
+    template?: EmailTemplate<{
+        email: string;
+        link: string;
+        ttlHours: number;
+    }>;
 }): Promise<void>;
 /**
  * Complete a password reset using the raw token from the reset email.

package/dist/features/passwordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passwordReset.d.ts","sourceRoot":"","sources":["../../src/features/passwordReset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAS,MAAM,iBAAiB,CAAA;AAM3E;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,eAAe,CAAA;IACnB,aAAa,EAAE,YAAY,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,EAAE,EAAE,eAAe,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB"}
+{"version":3,"file":"passwordReset.d.ts","sourceRoot":"","sources":["../../src/features/passwordReset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAS,MAAM,iBAAiB,CAAA;AAQ1F;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,eAAe,CAAA;IACnB,aAAa,EAAE,YAAY,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5E,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BhB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,EAAE,EAAE,eAAe,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB"}

package/dist/features/passwordReset.js

@@ -1,13 +1,15 @@
 import { generateOpaqueToken, hashToken } from '../utils/token.js';
 import { hashPassword } from '../utils/password.js';
+import { defaultResetPasswordTemplate } from './templates.js';
 const PASSWORD_RESET_TTL_MS = 60 * 60 * 1000; // 1 hour
+const PASSWORD_RESET_TTL_HOURS = 1;
 /**
  * Initiate a password reset flow.
  * Always returns successfully even if the email is not found — prevents email enumeration.
  * Callers should catch and swallow errors from the email send step if needed.
  */
 export async function createPasswordReset(params) {
-    const { email, db, emailProvider, from, resetUrl } = params;
+    const { email, db, emailProvider, from, resetUrl, template = defaultResetPasswordTemplate } = params;
     // Always returns 200 — do not reveal whether the email exists
     const user = await db.findUserByEmail(email);
     if (!user)
@@ -21,18 +23,13 @@ export async function createPasswordReset(params) {
         expiresAt: new Date(Date.now() + PASSWORD_RESET_TTL_MS),
     });
     const link = `${resetUrl}?token=${rawToken}`;
+    const rendered = template({ email, link, ttlHours: PASSWORD_RESET_TTL_HOURS });
     await emailProvider.send({
         from,
         to: email,
-        subject: 'Reset your password',
-        html: `
-      <p>Hello,</p>
-      <p>We received a request to reset your password. Click the link below to proceed:</p>
-      <p><a href="${link}">${link}</a></p>
-      <p>This link expires in 1 hour.</p>
-      <p>If you did not request a password reset, you can ignore this email.</p>
-    `,
-        text: `Reset your password by visiting: ${link}\n\nThis link expires in 1 hour.`,
+        subject: rendered.subject,
+        html: rendered.html,
+        text: rendered.text,
     });
 }
 /**

package/dist/features/passwordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordReset.js","sourceRoot":"","sources":["../../src/features/passwordReset.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAEtD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAMzC;IACC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;IAE3D,8DAA8D;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAA;IACtC,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAEvC,MAAM,EAAE,CAAC,WAAW,CAAC;QACnB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,WAAW;QAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC;KACxD,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,GAAG,QAAQ,UAAU,QAAQ,EAAE,CAAA;IAE5C,MAAM,aAAa,CAAC,IAAI,CAAC;QACvB,IAAI;QACJ,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE;;;oBAGU,IAAI,KAAK,IAAI;;;KAG5B;QACD,IAAI,EAAE,oCAAoC,IAAI,kCAAkC;KACjF,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAKnC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IAExD,MAAM,WAAW,GAAiB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAEhF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAChE,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;AACtC,CAAC"}
+{"version":3,"file":"passwordReset.js","sourceRoot":"","sources":["../../src/features/passwordReset.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAE7D,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AACtD,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAElC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAOzC;IACC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,4BAA4B,EAAE,GAAG,MAAM,CAAA;IAEpG,8DAA8D;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAA;IACtC,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAEvC,MAAM,EAAE,CAAC,WAAW,CAAC;QACnB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,WAAW;QAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC;KACxD,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,GAAG,QAAQ,UAAU,QAAQ,EAAE,CAAA;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAE9E,MAAM,aAAa,CAAC,IAAI,CAAC;QACvB,IAAI;QACJ,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAKnC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IAExD,MAAM,WAAW,GAAiB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAEhF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAChE,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;AACtC,CAAC"}

package/dist/features/refresh.d.ts

@@ -0,0 +1,41 @@
+import type { DatabaseAdapter } from '@authcore/types';
+/**
+ * Issue a new refresh token for the given user.
+ * Returns the raw token (caller sends this to the client). The DB stores only the SHA-256 hash.
+ */
+export declare function issueRefreshToken(params: {
+    userId: string;
+    db: DatabaseAdapter;
+    ttlMs?: number;
+}): Promise<string>;
+/**
+ * Rotate a refresh token: validate the incoming raw token, delete it, and issue a fresh one.
+ * Throws on invalid/expired/already-rotated input — these are the same failure mode for the
+ * client (they need to re-authenticate).
+ */
+export declare function rotateRefreshToken(params: {
+    rawToken: string;
+    db: DatabaseAdapter;
+    ttlMs?: number;
+}): Promise<{
+    userId: string;
+    newRawToken: string;
+}>;
+/**
+ * Revoke a single refresh token by its raw value. Idempotent — if the token
+ * doesn't exist (already revoked or never issued), this is a no-op.
+ */
+export declare function revokeRefreshToken(params: {
+    rawToken: string;
+    db: DatabaseAdapter;
+}): Promise<void>;
+/**
+ * Revoke every outstanding refresh token for a user. Used by "log out everywhere"
+ * and by password-reset / security-event flows where you want to invalidate all
+ * device sessions.
+ */
+export declare function revokeAllRefreshTokensForUser(params: {
+    userId: string;
+    db: DatabaseAdapter;
+}): Promise<void>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/features/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/features/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAS,MAAM,iBAAiB,CAAA;AAK7D;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,eAAe,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAUlB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,eAAe,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBnD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,eAAe,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,eAAe,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB"}

package/dist/features/refresh.js

@@ -0,0 +1,58 @@
+import { generateOpaqueToken, hashToken } from '../utils/token.js';
+const DEFAULT_REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+/**
+ * Issue a new refresh token for the given user.
+ * Returns the raw token (caller sends this to the client). The DB stores only the SHA-256 hash.
+ */
+export async function issueRefreshToken(params) {
+    const { userId, db, ttlMs = DEFAULT_REFRESH_TTL_MS } = params;
+    const rawToken = generateOpaqueToken();
+    await db.createToken({
+        userId,
+        type: 'REFRESH',
+        token: hashToken(rawToken),
+        expiresAt: new Date(Date.now() + ttlMs),
+    });
+    return rawToken;
+}
+/**
+ * Rotate a refresh token: validate the incoming raw token, delete it, and issue a fresh one.
+ * Throws on invalid/expired/already-rotated input — these are the same failure mode for the
+ * client (they need to re-authenticate).
+ */
+export async function rotateRefreshToken(params) {
+    const { rawToken, db, ttlMs = DEFAULT_REFRESH_TTL_MS } = params;
+    const tokenRecord = await db.findToken(rawToken, 'REFRESH');
+    if (!tokenRecord) {
+        throw new Error('Invalid or expired refresh token');
+    }
+    if (tokenRecord.expiresAt < new Date()) {
+        await db.deleteToken(tokenRecord.id);
+        throw new Error('Invalid or expired refresh token');
+    }
+    // Rotate: delete old, issue new
+    await db.deleteToken(tokenRecord.id);
+    const newRawToken = await issueRefreshToken({ userId: tokenRecord.userId, db, ttlMs });
+    return { userId: tokenRecord.userId, newRawToken };
+}
+/**
+ * Revoke a single refresh token by its raw value. Idempotent — if the token
+ * doesn't exist (already revoked or never issued), this is a no-op.
+ */
+export async function revokeRefreshToken(params) {
+    const { rawToken, db } = params;
+    const tokenRecord = await db.findToken(rawToken, 'REFRESH');
+    if (tokenRecord) {
+        await db.deleteToken(tokenRecord.id);
+    }
+}
+/**
+ * Revoke every outstanding refresh token for a user. Used by "log out everywhere"
+ * and by password-reset / security-event flows where you want to invalidate all
+ * device sessions.
+ */
+export async function revokeAllRefreshTokensForUser(params) {
+    const { userId, db } = params;
+    await db.deleteTokensByUserAndType(userId, 'REFRESH');
+}
+//# sourceMappingURL=refresh.js.map

package/dist/features/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/features/refresh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElE,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,UAAU;AAElE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAIvC;IACC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,sBAAsB,EAAE,GAAG,MAAM,CAAA;IAC7D,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAA;IACtC,MAAM,EAAE,CAAC,WAAW,CAAC;QACnB,MAAM;QACN,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;KACxC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAIxC;IACC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,GAAG,sBAAsB,EAAE,GAAG,MAAM,CAAA;IAE/D,MAAM,WAAW,GAAiB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACzE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IAED,gCAAgC;IAChC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAEtF,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,CAAA;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAGxC;IACC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,MAAM,CAAA;IAC/B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,MAGnD;IACC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAA;IAC7B,MAAM,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;AACvD,CAAC"}

package/dist/features/templates.d.ts

@@ -0,0 +1,46 @@
+import type { EmailTemplate } from '@authcore/types';
+/**
+ * Default email-template render functions. These match the inline content
+ * shipped before 0.10 byte-for-byte so apps that don't override anything see
+ * no behavior change.
+ *
+ * Consumers override individual templates via `EmailConfig.templates`:
+ *
+ * ```ts
+ * createAuth({
+ *   email: {
+ *     provider: resendAdapter(...),
+ *     from: 'auth@app.com',
+ *     templates: {
+ *       resetPassword: ({ link, email, ttlHours }) => ({
+ *         subject: 'Reset your password',
+ *         html: `<p>Hi ${email},</p><p><a href="${link}">Reset</a></p>`,
+ *         text: `Reset your password: ${link}`,
+ *       }),
+ *     },
+ *   },
+ * })
+ * ```
+ */
+export declare const defaultVerifyEmailTemplate: EmailTemplate<{
+    email: string;
+    link: string;
+    ttlHours: number;
+}>;
+export declare const defaultResetPasswordTemplate: EmailTemplate<{
+    email: string;
+    link: string;
+    ttlHours: number;
+}>;
+export declare const defaultInvitationTemplate: EmailTemplate<{
+    email: string;
+    link: string;
+    ttlHours: number;
+    role: string;
+}>;
+export declare const defaultMagicLinkTemplate: EmailTemplate<{
+    email: string;
+    link: string;
+    ttlMinutes: number;
+}>;
+//# sourceMappingURL=templates.d.ts.map

package/dist/features/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/features/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAEpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC;IACrD,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,CAUC,CAAA;AAEF,eAAO,MAAM,4BAA4B,EAAE,aAAa,CAAC;IACvD,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,CAUC,CAAA;AAEF,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC;IACpD,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CASC,CAAA;AAEF,eAAO,MAAM,wBAAwB,EAAE,aAAa,CAAC;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;CACnB,CAUC,CAAA"}

package/dist/features/templates.js

@@ -0,0 +1,67 @@
+/**
+ * Default email-template render functions. These match the inline content
+ * shipped before 0.10 byte-for-byte so apps that don't override anything see
+ * no behavior change.
+ *
+ * Consumers override individual templates via `EmailConfig.templates`:
+ *
+ * ```ts
+ * createAuth({
+ *   email: {
+ *     provider: resendAdapter(...),
+ *     from: 'auth@app.com',
+ *     templates: {
+ *       resetPassword: ({ link, email, ttlHours }) => ({
+ *         subject: 'Reset your password',
+ *         html: `<p>Hi ${email},</p><p><a href="${link}">Reset</a></p>`,
+ *         text: `Reset your password: ${link}`,
+ *       }),
+ *     },
+ *   },
+ * })
+ * ```
+ */
+export const defaultVerifyEmailTemplate = ({ link, ttlHours }) => ({
+    subject: 'Verify your email address',
+    html: `
+      <p>Hello,</p>
+      <p>Please verify your email address by clicking the link below:</p>
+      <p><a href="${link}">${link}</a></p>
+      <p>This link expires in ${ttlHours} hours.</p>
+      <p>If you did not create an account, you can ignore this email.</p>
+    `,
+    text: `Please verify your email by visiting: ${link}\n\nThis link expires in ${ttlHours} hours.`,
+});
+export const defaultResetPasswordTemplate = ({ link, ttlHours }) => ({
+    subject: 'Reset your password',
+    html: `
+      <p>Hello,</p>
+      <p>We received a request to reset your password. Click the link below to proceed:</p>
+      <p><a href="${link}">${link}</a></p>
+      <p>This link expires in ${ttlHours} hour${ttlHours === 1 ? '' : 's'}.</p>
+      <p>If you did not request a password reset, you can ignore this email.</p>
+    `,
+    text: `Reset your password by visiting: ${link}\n\nThis link expires in ${ttlHours} hour${ttlHours === 1 ? '' : 's'}.`,
+});
+export const defaultInvitationTemplate = ({ link, ttlHours }) => ({
+    subject: 'You have been invited',
+    html: `
+      <p>Hello,</p>
+      <p>You have been invited to create an account. Click the link below to set your password:</p>
+      <p><a href="${link}">${link}</a></p>
+      <p>This link expires in ${ttlHours} hours.</p>
+    `,
+    text: `You have been invited. Set your password by visiting: ${link}\n\nThis link expires in ${ttlHours} hours.`,
+});
+export const defaultMagicLinkTemplate = ({ link, ttlMinutes }) => ({
+    subject: 'Sign in to your account',
+    html: `
+      <p>Hello,</p>
+      <p>Click the link below to sign in:</p>
+      <p><a href="${link}">${link}</a></p>
+      <p>This link expires in ${ttlMinutes} minutes and can only be used once.</p>
+      <p>If you did not request this email, you can safely ignore it.</p>
+    `,
+    text: `Sign in by visiting: ${link}\n\nThis link expires in ${ttlMinutes} minutes and can only be used once.\n\nIf you did not request this email, you can safely ignore it.`,
+});
+//# sourceMappingURL=templates.js.map

package/dist/features/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/features/templates.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAIlC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE,2BAA2B;IACpC,IAAI,EAAE;;;oBAGY,IAAI,KAAK,IAAI;gCACD,QAAQ;;KAEnC;IACH,IAAI,EAAE,yCAAyC,IAAI,4BAA4B,QAAQ,SAAS;CACjG,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAIpC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE,qBAAqB;IAC9B,IAAI,EAAE;;;oBAGY,IAAI,KAAK,IAAI;gCACD,QAAQ,QAAQ,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;;KAEpE;IACH,IAAI,EAAE,oCAAoC,IAAI,4BAA4B,QAAQ,QAAQ,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;CACvH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAKjC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE,uBAAuB;IAChC,IAAI,EAAE;;;oBAGY,IAAI,KAAK,IAAI;gCACD,QAAQ;KACnC;IACH,IAAI,EAAE,yDAAyD,IAAI,4BAA4B,QAAQ,SAAS;CACjH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAIhC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,EAAE,yBAAyB;IAClC,IAAI,EAAE;;;oBAGY,IAAI,KAAK,IAAI;gCACD,UAAU;;KAErC;IACH,IAAI,EAAE,wBAAwB,IAAI,4BAA4B,UAAU,qGAAqG;CAC9K,CAAC,CAAA"}