@braedonsaunders/appkit-auth 0.1.3

package/server.js

@@ -0,0 +1,191 @@
+import { betterAuth } from 'better-auth';
+import { magicLink } from 'better-auth/plugins';
+import { renderMagicLinkEmail, renderPasswordResetEmail } from './mail.js';
+/**
+ * Complete persisted authentication runtime extracted from the production
+ * reference: password sign-in/reset, hashed one-time magic links, invitation
+ * activation, durable sessions/accounts/verifications, client-compatible APIs,
+ * and optional social-provider extension. Product delivery and domain effects
+ * are injected.
+ */
+export function createAppkitAuth(options) {
+    const baseURL = normalizeBaseURL(options.baseURL);
+    const appName = options.appName.trim();
+    if (!appName)
+        throw new Error('Authentication appName is required.');
+    if (options.secret.length < 32) {
+        throw new Error('Authentication secret must contain at least 32 characters.');
+    }
+    const inviteTTL = options.inviteService?.ttlSeconds;
+    const magicTTL = options.magicLink?.expiresIn ?? inviteTTL ?? 15 * 60;
+    if (inviteTTL && magicTTL !== inviteTTL) {
+        throw new Error('Magic-link and invitation grant expiration must match.');
+    }
+    return betterAuth({
+        ...options.extend,
+        database: options.database,
+        baseURL,
+        secret: options.secret,
+        appName,
+        user: {
+            modelName: 'users',
+            fields: {
+                emailVerified: 'email_verified',
+                createdAt: 'created_at',
+                updatedAt: 'updated_at',
+            },
+            additionalFields: {
+                timezone: {
+                    type: 'string',
+                    fieldName: 'timezone',
+                    required: true,
+                    defaultValue: 'UTC',
+                },
+                isActive: {
+                    type: 'boolean',
+                    fieldName: 'is_active',
+                    required: true,
+                    defaultValue: true,
+                    input: false,
+                },
+                isSuperAdmin: {
+                    type: 'boolean',
+                    fieldName: 'is_super_admin',
+                    required: true,
+                    defaultValue: false,
+                    input: false,
+                },
+            },
+        },
+        session: {
+            modelName: 'sessions',
+            fields: {
+                userId: 'user_id',
+                expiresAt: 'expires_at',
+                ipAddress: 'ip_address',
+                userAgent: 'user_agent',
+                createdAt: 'created_at',
+                updatedAt: 'updated_at',
+            },
+            additionalFields: {
+                activeTenantId: { type: 'string', fieldName: 'active_tenant_id', required: false, input: false },
+                impersonatingUserId: { type: 'string', fieldName: 'impersonating_user_id', required: false, input: false },
+                impersonationTenantId: { type: 'string', fieldName: 'impersonation_tenant_id', required: false, input: false },
+                impersonationStartedAt: { type: 'date', fieldName: 'impersonation_started_at', required: false, input: false },
+                impersonationExpiresAt: { type: 'date', fieldName: 'impersonation_expires_at', required: false, input: false },
+                impersonationReason: { type: 'string', fieldName: 'impersonation_reason', required: false, input: false },
+            },
+            expiresIn: options.session?.expiresIn ?? 60 * 60 * 24 * 30,
+            updateAge: options.session?.updateAge ?? 60 * 60 * 24,
+            cookieCache: {
+                enabled: true,
+                maxAge: options.session?.cookieCacheMaxAge ?? 60 * 5,
+            },
+        },
+        account: {
+            modelName: 'accounts',
+            fields: {
+                userId: 'user_id',
+                accountId: 'account_id',
+                providerId: 'provider_id',
+                accessToken: 'access_token',
+                refreshToken: 'refresh_token',
+                idToken: 'id_token',
+                accessTokenExpiresAt: 'access_token_expires_at',
+                refreshTokenExpiresAt: 'refresh_token_expires_at',
+                createdAt: 'created_at',
+                updatedAt: 'updated_at',
+            },
+            encryptOAuthTokens: true,
+        },
+        verification: {
+            modelName: 'verifications',
+            fields: {
+                expiresAt: 'expires_at',
+                createdAt: 'created_at',
+                updatedAt: 'updated_at',
+            },
+        },
+        advanced: {
+            database: { generateId: 'uuid' },
+        },
+        emailAndPassword: {
+            enabled: true,
+            disableSignUp: options.password?.disableSignUp ?? true,
+            requireEmailVerification: options.password?.requireEmailVerification ?? false,
+            minPasswordLength: options.password?.minLength ?? 8,
+            autoSignIn: true,
+            resetPasswordTokenExpiresIn: options.password?.resetTokenExpiresIn ?? 60 * 60,
+            revokeSessionsOnPasswordReset: true,
+            sendResetPassword: async ({ user, url }) => {
+                const rendered = (options.renderEmail?.passwordReset ?? renderPasswordResetEmail)({
+                    appName,
+                    email: user.email,
+                    url,
+                });
+                await options.sendEmail({ kind: 'password-reset', to: user.email, ...rendered });
+            },
+        },
+        plugins: [
+            magicLink({
+                disableSignUp: options.magicLink?.disableSignUp ?? true,
+                expiresIn: magicTTL,
+                storeToken: 'hashed',
+                sendMagicLink: async ({ email, url, metadata }) => {
+                    const invitation = metadata?.flow === 'invite';
+                    const tenantName = typeof metadata?.tenantName === 'string' && metadata.tenantName.trim()
+                        ? metadata.tenantName.trim()
+                        : null;
+                    const rendered = (options.renderEmail?.magicLink ?? renderMagicLinkEmail)({
+                        appName,
+                        email,
+                        url,
+                        invitation,
+                        tenantName,
+                    });
+                    await options.sendEmail({
+                        kind: invitation ? 'invitation' : 'magic-link',
+                        to: email,
+                        ...rendered,
+                    });
+                },
+            }),
+        ],
+        hooks: {
+            after: async (rawContext) => {
+                const context = rawContext;
+                if (context.path !== '/magic-link/verify' || !options.inviteService)
+                    return {};
+                const sessionUserId = context.context.newSession?.user.id;
+                if (!sessionUserId)
+                    return {};
+                const grant = options.inviteService.inviteGrantFromCallbackURL(context.query?.callbackURL, baseURL);
+                if (!grant)
+                    return {};
+                // Preserve the valid session/callback if a downstream domain hook fails;
+                // the membership remains unchanged and the callback can show recovery.
+                await options.inviteService.acceptInviteAfterMagicLink(grant, sessionUserId).catch((error) => {
+                    if (options.onInviteAcceptanceError)
+                        options.onInviteAcceptanceError(error);
+                    else
+                        console.error('[appkit/auth] invitation acceptance failed', error);
+                });
+                return {};
+            },
+        },
+        trustedOrigins: options.trustedOrigins ?? [baseURL],
+    });
+}
+/** Lazy singleton pattern used by server runtimes that must import safely at build time. */
+export function createLazyAuth(factory) {
+    let instance;
+    return () => (instance ??= factory());
+}
+function normalizeBaseURL(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash) {
+        throw new Error('Authentication baseURL must be an origin without credentials, query, or hash.');
+    }
+    return url.origin;
+}
+//# sourceMappingURL=server.js.map

package/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAA;AAiDvE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,CAAA;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,SAAS,IAAI,EAAE,GAAG,EAAE,CAAA;IACrE,IAAI,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,UAAU,CAAC;QAChB,GAAG,OAAO,CAAC,MAAM;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE;YACJ,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE;gBACN,aAAa,EAAE,gBAAgB;gBAC/B,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;aACxB;YACD,gBAAgB,EAAE;gBAChB,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,UAAU;oBACrB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,KAAK;iBACpB;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,WAAW;oBACtB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,KAAK;iBACb;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,gBAAgB;oBAC3B,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,KAAK;iBACb;aACF;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE;gBACN,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;aACxB;YACD,gBAAgB,EAAE;gBAChB,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAChG,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC1G,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC9G,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC9G,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,0BAA0B,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC9G,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;aAC1G;YACD,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC1D,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE;YACrD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,CAAC;aACrD;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE;gBACN,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,YAAY;gBACvB,UAAU,EAAE,aAAa;gBACzB,WAAW,EAAE,cAAc;gBAC3B,YAAY,EAAE,eAAe;gBAC7B,OAAO,EAAE,UAAU;gBACnB,oBAAoB,EAAE,yBAAyB;gBAC/C,qBAAqB,EAAE,0BAA0B;gBACjD,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;aACxB;YACD,kBAAkB,EAAE,IAAI;SACzB;QACD,YAAY,EAAE;YACZ,SAAS,EAAE,eAAe;YAC1B,MAAM,EAAE;gBACN,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,YAAY;aACxB;SACF;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;SACjC;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI;YACtD,wBAAwB,EAAE,OAAO,CAAC,QAAQ,EAAE,wBAAwB,IAAI,KAAK;YAC7E,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,IAAI,CAAC;YACnD,UAAU,EAAE,IAAI;YAChB,2BAA2B,EAAE,OAAO,CAAC,QAAQ,EAAE,mBAAmB,IAAI,EAAE,GAAG,EAAE;YAC7E,6BAA6B,EAAE,IAAI;YACnC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,IAAI,wBAAwB,CAAC,CAAC;oBAChF,OAAO;oBACP,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG;iBACJ,CAAC,CAAA;gBACF,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;YAClF,CAAC;SACF;QACD,OAAO,EAAE;YACP,SAAS,CAAC;gBACR,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,IAAI,IAAI;gBACvD,SAAS,EAAE,QAAQ;gBACnB,UAAU,EAAE,QAAQ;gBACpB,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;oBAChD,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,KAAK,QAAQ,CAAA;oBAC9C,MAAM,UAAU,GACd,OAAO,QAAQ,EAAE,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE;wBACpE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE;wBAC5B,CAAC,CAAC,IAAI,CAAA;oBACV,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,IAAI,oBAAoB,CAAC,CAAC;wBACxE,OAAO;wBACP,KAAK;wBACL,GAAG;wBACH,UAAU;wBACV,UAAU;qBACX,CAAC,CAAA;oBACF,MAAM,OAAO,CAAC,SAAS,CAAC;wBACtB,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;wBAC9C,EAAE,EAAE,KAAK;wBACT,GAAG,QAAQ;qBACZ,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC;SACH;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC1B,MAAM,OAAO,GAAG,UAIf,CAAA;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,OAAO,CAAC,aAAa;oBAAE,OAAO,EAAE,CAAA;gBAC9E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAA;gBACzD,IAAI,CAAC,aAAa;oBAAE,OAAO,EAAE,CAAA;gBAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,0BAA0B,CAC5D,OAAO,CAAC,KAAK,EAAE,WAAW,EAC1B,OAAO,CACR,CAAA;gBACD,IAAI,CAAC,KAAK;oBAAE,OAAO,EAAE,CAAA;gBACrB,yEAAyE;gBACzE,uEAAuE;gBACvE,MAAM,OAAO,CAAC,aAAa,CAAC,0BAA0B,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC3F,IAAI,OAAO,CAAC,uBAAuB;wBAAE,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAA;;wBACtE,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAA;gBACzE,CAAC,CAAC,CAAA;gBACF,OAAO,EAAE,CAAA;YACX,CAAC;SACF;QACD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAID,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,OAAyB;IACtD,IAAI,QAAgC,CAAA;IACpC,OAAO,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC","sourcesContent":["import { betterAuth } from 'better-auth'\nimport { magicLink } from 'better-auth/plugins'\nimport type { AuthEmailRenderer, AuthEmailSender } from './mail'\nimport { renderMagicLinkEmail, renderPasswordResetEmail } from './mail'\nimport type { InviteService } from './invites'\n\ntype BetterAuthOptions = Parameters<typeof betterAuth>[0]\n\nexport type AppkitAuthOptions = {\n  database: NonNullable<BetterAuthOptions['database']>\n  baseURL: string\n  secret: string\n  appName: string\n  sendEmail: AuthEmailSender\n  renderEmail?: AuthEmailRenderer\n  inviteService?: InviteService\n  onInviteAcceptanceError?: (error: unknown) => void\n  trustedOrigins?: BetterAuthOptions['trustedOrigins']\n  session?: {\n    expiresIn?: number\n    updateAge?: number\n    cookieCacheMaxAge?: number\n  }\n  password?: {\n    disableSignUp?: boolean\n    requireEmailVerification?: boolean\n    minLength?: number\n    resetTokenExpiresIn?: number\n  }\n  magicLink?: {\n    expiresIn?: number\n    disableSignUp?: boolean\n  }\n  /** Additional upstream options such as social providers and database hooks. */\n  extend?: Omit<\n    BetterAuthOptions,\n    | 'database'\n    | 'baseURL'\n    | 'secret'\n    | 'appName'\n    | 'trustedOrigins'\n    | 'user'\n    | 'session'\n    | 'account'\n    | 'verification'\n    | 'emailAndPassword'\n    | 'plugins'\n    | 'hooks'\n    | 'advanced'\n  >\n}\n\n/**\n * Complete persisted authentication runtime extracted from the production\n * reference: password sign-in/reset, hashed one-time magic links, invitation\n * activation, durable sessions/accounts/verifications, client-compatible APIs,\n * and optional social-provider extension. Product delivery and domain effects\n * are injected.\n */\nexport function createAppkitAuth(options: AppkitAuthOptions) {\n  const baseURL = normalizeBaseURL(options.baseURL)\n  const appName = options.appName.trim()\n  if (!appName) throw new Error('Authentication appName is required.')\n  if (options.secret.length < 32) {\n    throw new Error('Authentication secret must contain at least 32 characters.')\n  }\n  const inviteTTL = options.inviteService?.ttlSeconds\n  const magicTTL = options.magicLink?.expiresIn ?? inviteTTL ?? 15 * 60\n  if (inviteTTL && magicTTL !== inviteTTL) {\n    throw new Error('Magic-link and invitation grant expiration must match.')\n  }\n\n  return betterAuth({\n    ...options.extend,\n    database: options.database,\n    baseURL,\n    secret: options.secret,\n    appName,\n    user: {\n      modelName: 'users',\n      fields: {\n        emailVerified: 'email_verified',\n        createdAt: 'created_at',\n        updatedAt: 'updated_at',\n      },\n      additionalFields: {\n        timezone: {\n          type: 'string',\n          fieldName: 'timezone',\n          required: true,\n          defaultValue: 'UTC',\n        },\n        isActive: {\n          type: 'boolean',\n          fieldName: 'is_active',\n          required: true,\n          defaultValue: true,\n          input: false,\n        },\n        isSuperAdmin: {\n          type: 'boolean',\n          fieldName: 'is_super_admin',\n          required: true,\n          defaultValue: false,\n          input: false,\n        },\n      },\n    },\n    session: {\n      modelName: 'sessions',\n      fields: {\n        userId: 'user_id',\n        expiresAt: 'expires_at',\n        ipAddress: 'ip_address',\n        userAgent: 'user_agent',\n        createdAt: 'created_at',\n        updatedAt: 'updated_at',\n      },\n      additionalFields: {\n        activeTenantId: { type: 'string', fieldName: 'active_tenant_id', required: false, input: false },\n        impersonatingUserId: { type: 'string', fieldName: 'impersonating_user_id', required: false, input: false },\n        impersonationTenantId: { type: 'string', fieldName: 'impersonation_tenant_id', required: false, input: false },\n        impersonationStartedAt: { type: 'date', fieldName: 'impersonation_started_at', required: false, input: false },\n        impersonationExpiresAt: { type: 'date', fieldName: 'impersonation_expires_at', required: false, input: false },\n        impersonationReason: { type: 'string', fieldName: 'impersonation_reason', required: false, input: false },\n      },\n      expiresIn: options.session?.expiresIn ?? 60 * 60 * 24 * 30,\n      updateAge: options.session?.updateAge ?? 60 * 60 * 24,\n      cookieCache: {\n        enabled: true,\n        maxAge: options.session?.cookieCacheMaxAge ?? 60 * 5,\n      },\n    },\n    account: {\n      modelName: 'accounts',\n      fields: {\n        userId: 'user_id',\n        accountId: 'account_id',\n        providerId: 'provider_id',\n        accessToken: 'access_token',\n        refreshToken: 'refresh_token',\n        idToken: 'id_token',\n        accessTokenExpiresAt: 'access_token_expires_at',\n        refreshTokenExpiresAt: 'refresh_token_expires_at',\n        createdAt: 'created_at',\n        updatedAt: 'updated_at',\n      },\n      encryptOAuthTokens: true,\n    },\n    verification: {\n      modelName: 'verifications',\n      fields: {\n        expiresAt: 'expires_at',\n        createdAt: 'created_at',\n        updatedAt: 'updated_at',\n      },\n    },\n    advanced: {\n      database: { generateId: 'uuid' },\n    },\n    emailAndPassword: {\n      enabled: true,\n      disableSignUp: options.password?.disableSignUp ?? true,\n      requireEmailVerification: options.password?.requireEmailVerification ?? false,\n      minPasswordLength: options.password?.minLength ?? 8,\n      autoSignIn: true,\n      resetPasswordTokenExpiresIn: options.password?.resetTokenExpiresIn ?? 60 * 60,\n      revokeSessionsOnPasswordReset: true,\n      sendResetPassword: async ({ user, url }) => {\n        const rendered = (options.renderEmail?.passwordReset ?? renderPasswordResetEmail)({\n          appName,\n          email: user.email,\n          url,\n        })\n        await options.sendEmail({ kind: 'password-reset', to: user.email, ...rendered })\n      },\n    },\n    plugins: [\n      magicLink({\n        disableSignUp: options.magicLink?.disableSignUp ?? true,\n        expiresIn: magicTTL,\n        storeToken: 'hashed',\n        sendMagicLink: async ({ email, url, metadata }) => {\n          const invitation = metadata?.flow === 'invite'\n          const tenantName =\n            typeof metadata?.tenantName === 'string' && metadata.tenantName.trim()\n              ? metadata.tenantName.trim()\n              : null\n          const rendered = (options.renderEmail?.magicLink ?? renderMagicLinkEmail)({\n            appName,\n            email,\n            url,\n            invitation,\n            tenantName,\n          })\n          await options.sendEmail({\n            kind: invitation ? 'invitation' : 'magic-link',\n            to: email,\n            ...rendered,\n          })\n        },\n      }),\n    ],\n    hooks: {\n      after: async (rawContext) => {\n        const context = rawContext as unknown as {\n          path?: string\n          query?: { callbackURL?: unknown }\n          context: { newSession?: { user: { id: string } } | null }\n        }\n        if (context.path !== '/magic-link/verify' || !options.inviteService) return {}\n        const sessionUserId = context.context.newSession?.user.id\n        if (!sessionUserId) return {}\n        const grant = options.inviteService.inviteGrantFromCallbackURL(\n          context.query?.callbackURL,\n          baseURL,\n        )\n        if (!grant) return {}\n        // Preserve the valid session/callback if a downstream domain hook fails;\n        // the membership remains unchanged and the callback can show recovery.\n        await options.inviteService.acceptInviteAfterMagicLink(grant, sessionUserId).catch((error) => {\n          if (options.onInviteAcceptanceError) options.onInviteAcceptanceError(error)\n          else console.error('[appkit/auth] invitation acceptance failed', error)\n        })\n        return {}\n      },\n    },\n    trustedOrigins: options.trustedOrigins ?? [baseURL],\n  })\n}\n\nexport type AppkitAuth = ReturnType<typeof createAppkitAuth>\n\n/** Lazy singleton pattern used by server runtimes that must import safely at build time. */\nexport function createLazyAuth(factory: () => AppkitAuth): () => AppkitAuth {\n  let instance: AppkitAuth | undefined\n  return () => (instance ??= factory())\n}\n\nfunction normalizeBaseURL(value: string): string {\n  const url = new URL(value)\n  if (url.username || url.password || url.search || url.hash) {\n    throw new Error('Authentication baseURL must be an origin without credentials, query, or hash.')\n  }\n  return url.origin\n}\n"]}