@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/session/lifecycle.js

@@ -0,0 +1,139 @@
+import { LOG_LEVELS } from "../../shared/log.js";
+import { getAuthenticatedSessionIdOrNull } from "../identity/claims.js";
+import { envOptionalNumber, readConfigSync } from "../env.js";
+import { queueAuthEvent } from "../events.js";
+import { authDb } from "../db.js";
+import { log, maybeRedact } from "../log.js";
+import { encodeRefreshToken, refreshTokenExpirationTime } from "../token/refresh.js";
+import { withSpan } from "../utils/span.js";
+import { generateToken } from "../tokens.js";
+
+//#region src/server/session/lifecycle.ts
+const DEFAULT_SESSION_TOTAL_DURATION_MS = 1e3 * 60 * 60 * 24 * 30;
+/**
+* Absolute expiration timestamp (ms) for a new session.
+*
+* Resolved from `config.session.totalDurationMs`, then the
+* `AUTH_SESSION_TOTAL_DURATION_MS` env var, defaulting to 30 days.
+*
+* @internal
+*/
+const sessionExpirationTime = (config, now = Date.now()) => now + (config.session?.totalDurationMs ?? readConfigSync(envOptionalNumber("AUTH_SESSION_TOTAL_DURATION_MS")) ?? DEFAULT_SESSION_TOTAL_DURATION_MS);
+/**
+* Build the JWT identity-claim set for a session from the user document.
+*
+* Shared by {@link issueSession} and the refresh exchange so both mint
+* identical claims from the same user fields.
+*
+* @internal
+*/
+function buildSessionIdentity(userId, sessionId, user) {
+	return {
+		subject: userId,
+		sessionId,
+		...typeof user?.name === "string" ? { name: user.name } : null,
+		...typeof user?.email === "string" ? { email: user.email } : null,
+		...user?.emailVerificationTime !== void 0 ? { emailVerified: true } : user?.email !== void 0 ? { emailVerified: false } : null,
+		...typeof user?.image === "string" ? { picture: user.image } : null,
+		...typeof user?.phone === "string" ? { phoneNumber: user.phone } : null,
+		...user?.phoneVerificationTime !== void 0 ? { phoneNumberVerified: true } : user?.phone !== void 0 ? { phoneNumberVerified: false } : null
+	};
+}
+/**
+* Convert a {@link SessionIssuance} returned from a mutation into the
+* external `SessionInfo` shape by signing the JWT on the action side.
+*
+* Must be called from an action context because `generateToken` performs
+* RSA-2048 JWT signing that would otherwise block the mutation commit.
+*
+* @internal
+*/
+async function finalizeSessionIssuance(config, issuance) {
+	return withSpan("convex-auth.session.finalize", { hasRefreshToken: issuance.refreshToken !== null }, async () => {
+		if (issuance.refreshToken === null) return {
+			userId: issuance.userId,
+			sessionId: issuance.sessionId,
+			tokens: null
+		};
+		const token = await generateToken({ identity: issuance.identity }, config);
+		log(LOG_LEVELS.DEBUG, `Generated token ${maybeRedact(token)} and refresh token ${maybeRedact(issuance.refreshToken)} for session ${maybeRedact(issuance.sessionId)}`);
+		return {
+			userId: issuance.userId,
+			sessionId: issuance.sessionId,
+			tokens: {
+				token,
+				refreshToken: issuance.refreshToken
+			}
+		};
+	});
+}
+/**
+* Create (or extend/replace) a session and its refresh-token row, returning the
+* mutation-side {@link SessionIssuance} for later JWT finalization.
+*
+* @param args.generateTokens - When `false`, no refresh token is issued
+*   (e.g. TOTP step-up that defers token issuance to a second factor).
+* @internal
+*/
+async function issueSession(ctx, config, args) {
+	const issued = await authDb(ctx, config).sessions.create({
+		userId: args.userId,
+		sessionId: args.existingSessionId,
+		replaceSessionId: args.replaceSessionId,
+		sessionExpirationTime: sessionExpirationTime(config),
+		refreshTokenExpirationTime: args.generateTokens ? refreshTokenExpirationTime(config) : void 0
+	});
+	const sessionId = issued.sessionId;
+	const refreshTokenId = issued.refreshTokenId;
+	if (issued.replacedSessionId !== void 0) {
+		const replacedSessionId = issued.replacedSessionId;
+		await queueAuthEvent(ctx, config, {
+			kind: "session.invalidated",
+			actor: { type: "system" },
+			subject: {
+				type: "session",
+				id: replacedSessionId
+			},
+			targets: [{
+				kind: "user",
+				id: issued.userId
+			}, {
+				kind: "session",
+				id: replacedSessionId
+			}],
+			outcome: "success",
+			data: {
+				userId: issued.userId,
+				reason: "replaced"
+			}
+		});
+	}
+	return {
+		userId: issued.userId,
+		sessionId,
+		identity: buildSessionIdentity(issued.userId, sessionId, issued.user),
+		refreshToken: args.generateTokens && refreshTokenId !== void 0 ? encodeRefreshToken(refreshTokenId, sessionId) : null
+	};
+}
+/**
+* Delete a session and all of its refresh tokens.
+*
+* @internal
+*/
+async function deleteSession(ctx, session, config) {
+	const db = authDb(ctx, config);
+	await db.sessions.delete(session._id);
+	await db.refreshTokens.deleteAll(session._id);
+}
+/**
+* Return the current session ID from the auth identity subject.
+*
+* @internal
+*/
+async function getAuthSessionId(ctx) {
+	return await getAuthenticatedSessionIdOrNull(ctx);
+}
+
+//#endregion
+export { buildSessionIdentity, deleteSession, finalizeSessionIssuance, getAuthSessionId, issueSession, sessionExpirationTime };
+//# sourceMappingURL=lifecycle.js.map

package/dist/server/signin/flow.js

@@ -0,0 +1,359 @@
+import { authUrlFromEnv } from "../url.js";
+import { generateRandomString } from "../random.js";
+import { log } from "../log.js";
+import { withSpan } from "../utils/span.js";
+import { finalizeSessionIssuance } from "../session/lifecycle.js";
+import { authFlowError } from "../../shared/errors.js";
+import { toConvexError } from "../errors.js";
+import { callCreateVerificationCode } from "../mutations/code.js";
+import { callRefreshSession } from "../mutations/refresh.js";
+import { callSignIn } from "../mutations/signin.js";
+import { callVerifier } from "../mutations/verifier.js";
+import { callVerifyCodeAndSignIn } from "../mutations/verify.js";
+import { redirectAbsoluteUrl, setURLSearchParam } from "../redirects.js";
+import { assertNever } from "../../shared/brand.js";
+import { queryTotpVerifiedByUserId } from "../component/factor/db.js";
+import { handleDevice } from "../device.js";
+import { handleWebAuthn } from "../webauthn.js";
+import { handleTotp } from "../totp.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/signin/flow.ts
+const DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S = 3600 * 24;
+const normalizeVerificationParams = (params) => {
+	const value = params ?? {};
+	return {
+		email: typeof value.email === "string" ? value.email : void 0,
+		phone: typeof value.phone === "string" ? value.phone : void 0,
+		redirectTo: value.redirectTo,
+		connectionId: value.connectionId,
+		loginHint: value.loginHint,
+		protocol: value.protocol,
+		code: value.code
+	};
+};
+const describeUnknown = (value) => {
+	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint" || value === null) return String(value);
+	return JSON.stringify(value) ?? Object.prototype.toString.call(value);
+};
+const asConvexError = (error, code, message) => {
+	if (error instanceof ConvexError) return error;
+	if (error instanceof Error) return toConvexError(authFlowError(code, error.message || message));
+	return toConvexError(authFlowError(code, `${message} ${describeUnknown(error)}`.trim()));
+};
+const asCredentialsError = (error) => {
+	if (error instanceof ConvexError) return error;
+	if (error instanceof Error) return new ConvexError({
+		code: error.message.startsWith("Missing `") ? "INVALID_PARAMETERS" : "INVALID_CREDENTIALS",
+		message: error.message
+	});
+	return toConvexError(authFlowError("INTERNAL_ERROR", "Failed to authorize credentials."));
+};
+/**
+* Entry point for all sign-in flows.
+*
+* Refreshes a session (when only `refreshToken` is given), verifies a sign-in
+* code (when only `params.code` is given), or dispatches to the matching
+* provider handler based on `provider.type`.
+*
+* @param provider - The resolved provider, or `null` for refresh/code-only calls.
+* @returns The flow result: `signedIn`, `started`, `redirect`, `totpRequired`, etc.
+*/
+async function signInImpl(ctx, provider, args, options) {
+	return withSpan("convex-auth.signin", {
+		hasProvider: provider !== null,
+		hasCode: args.params?.code !== void 0,
+		hasRefreshToken: args.refreshToken !== void 0
+	}, async () => {
+		if (provider === null && args.refreshToken) try {
+			const session = await callRefreshSession(ctx, { refreshToken: args.refreshToken });
+			if (session === null) return {
+				kind: "signedIn",
+				session: null
+			};
+			return {
+				kind: "signedIn",
+				session
+			};
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to refresh session.");
+		}
+		if (provider === null && args.params?.code !== void 0) try {
+			return {
+				kind: "signedIn",
+				session: await callVerifyCodeAndSignIn(ctx, {
+					params: args.params,
+					verifier: args.verifier,
+					generateTokens: true,
+					allowExtraProviders: options.allowExtraProviders
+				})
+			};
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to verify sign-in code.");
+		}
+		const resolvedProvider = provider;
+		if (resolvedProvider === null) throw toConvexError(authFlowError("SIGN_IN_MISSING_PARAMS", "Cannot sign in: missing provider, code, or refresh token."));
+		/** Exhaustive narrowing dispatch: each case narrows `resolvedProvider` to its concrete config so the handler receives the typed variant without a cast. */
+		switch (resolvedProvider.type) {
+			case "email":
+			case "phone": return handleEmailAndPhoneProvider(ctx, resolvedProvider, args, options);
+			case "credentials": return handleCredentials(ctx, resolvedProvider, args, options);
+			case "oauth": return handleOAuthProvider(ctx, resolvedProvider, args, options);
+			case "webauthn": return handleWebAuthn(ctx, resolvedProvider, args);
+			case "totp": return handleTotp(ctx, resolvedProvider, args);
+			case "device": return handleDevice(ctx, resolvedProvider, args);
+			case "connection": return handleConnectionProvider(ctx, args, options);
+			default: return assertNever(resolvedProvider, "Unknown provider type");
+		}
+	});
+}
+async function handleEmailAndPhoneProvider(ctx, provider, args, options) {
+	return withSpan(`convex-auth.signin.${provider.type}`, {}, async () => {
+		const normalizedParams = normalizeVerificationParams(args.params);
+		if (args.params?.code !== void 0) {
+			let result;
+			try {
+				result = await callVerifyCodeAndSignIn(ctx, {
+					params: args.params,
+					provider: provider.id,
+					generateTokens: options.generateTokens,
+					allowExtraProviders: options.allowExtraProviders
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to verify email or phone code.");
+			}
+			if (result === null) throw toConvexError(authFlowError("INVALID_VERIFICATION_CODE", "Invalid or expired verification code."));
+			return {
+				kind: "signedIn",
+				session: result
+			};
+		}
+		const alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+		let code;
+		if (provider.generateVerificationToken) try {
+			code = await provider.generateVerificationToken();
+		} catch {
+			throw toConvexError(authFlowError("INTERNAL_ERROR", "Failed to generate verification token"));
+		}
+		else code = generateRandomString(32, alphabet);
+		const expirationTime = Date.now() + (provider.maxAge ?? DEFAULT_EMAIL_VERIFICATION_CODE_DURATION_S) * 1e3;
+		let identifier;
+		try {
+			identifier = await callCreateVerificationCode(ctx, {
+				provider: provider.id,
+				accountId: args.accountId,
+				email: normalizedParams.email,
+				phone: normalizedParams.phone,
+				code,
+				expirationTime,
+				allowExtraProviders: options.allowExtraProviders
+			});
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verification code.");
+		}
+		let destination;
+		try {
+			destination = await redirectAbsoluteUrl(ctx, ctx.auth.config, args.params ?? {});
+		} catch (error) {
+			throw asConvexError(error, "INVALID_REDIRECT", "Failed to resolve redirect URL.");
+		}
+		const verificationArgs = {
+			identifier,
+			url: setURLSearchParam(destination, "code", code),
+			token: code,
+			expires: new Date(expirationTime)
+		};
+		if (provider.type === "email") try {
+			await provider.sendVerificationRequest({
+				...verificationArgs,
+				provider,
+				request: new Request("http://localhost")
+			}, ctx);
+		} catch {
+			throw toConvexError(authFlowError("INTERNAL_ERROR", "Failed to send email code"));
+		}
+		else try {
+			await provider.sendVerificationRequest({
+				...verificationArgs,
+				provider
+			}, ctx);
+		} catch {
+			throw toConvexError(authFlowError("INTERNAL_ERROR", "Failed to send phone code"));
+		}
+		return { kind: "started" };
+	});
+}
+async function handleCredentials(ctx, provider, args, options) {
+	return withSpan("convex-auth.signin.credentials", {}, async () => {
+		let result;
+		try {
+			result = await withSpan("convex-auth.signin.credentials.authorize", { providerId: provider.id }, () => provider.authorize(args.params ?? {}, ctx));
+		} catch (error) {
+			throw asCredentialsError(error);
+		}
+		if (result === null) return {
+			kind: "signedIn",
+			session: null
+		};
+		if (typeof result === "object" && "kind" in result)
+ /**
+		* `authorize` may return any non-signedIn flow result, a superset of this
+		* function's declared return; the two share only `totpRequired`, so the
+		* pass-through needs one typed assertion to the narrower return type.
+		*/
+		return result;
+		if ("provision" in result) {
+			const { provision, hasTotp } = result;
+			try {
+				result = {
+					userId: (await withSpan("convex-auth.signin.credentials.provision", { providerId: provider.id }, () => ctx.auth.account.create(ctx, {
+						provider: provider.id,
+						account: provision.account,
+						profile: provision.profile,
+						shouldLinkViaEmail: provision.match?.includes("email"),
+						shouldLinkViaPhone: provision.match?.includes("phone")
+					}))).account.userId,
+					hasTotp
+				};
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to provision credentials account.");
+			}
+		}
+		const hintedHasTotp = result.hasTotp;
+		const preIssuedIssuance = result.issuance;
+		let hasTotpEnrolled;
+		if (hintedHasTotp === false) hasTotpEnrolled = false;
+		else if (hintedHasTotp === true) hasTotpEnrolled = true;
+		else if (preIssuedIssuance !== void 0 && preIssuedIssuance.refreshToken === null) hasTotpEnrolled = true;
+		else try {
+			hasTotpEnrolled = await withSpan("convex-auth.signin.credentials.totp-check", { hinted: hintedHasTotp ?? "unknown" }, () => queryTotpVerifiedByUserId(ctx, result.userId)) !== null;
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to load TOTP enrollment.");
+		}
+		if (hasTotpEnrolled) {
+			let verifier;
+			try {
+				verifier = await callVerifier(ctx, JSON.stringify({ userId: result.userId }));
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verifier.");
+			}
+			return {
+				kind: "totpRequired",
+				verifier
+			};
+		}
+		if (preIssuedIssuance !== void 0) try {
+			return {
+				kind: "signedIn",
+				session: await withSpan("convex-auth.signin.credentials.finalize", {
+					generateTokens: options.generateTokens,
+					fromAuthorize: true
+				}, () => finalizeSessionIssuance(ctx.auth.config, {
+					...preIssuedIssuance,
+					refreshToken: options.generateTokens ? preIssuedIssuance.refreshToken : null
+				}))
+			};
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to finalize sign-in.");
+		}
+		let idsAndTokens;
+		try {
+			idsAndTokens = await withSpan("convex-auth.signin.credentials.issue-session", { generateTokens: options.generateTokens }, () => callSignIn(ctx, {
+				userId: result.userId,
+				sessionId: result.sessionId,
+				generateTokens: options.generateTokens
+			}));
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to complete sign-in.");
+		}
+		return {
+			kind: "signedIn",
+			session: idsAndTokens
+		};
+	});
+}
+async function handleOAuthProvider(ctx, provider, args, options) {
+	return withSpan(`convex-auth.signin.oauth`, { provider: provider.id }, async () => {
+		if (args.params?.code !== void 0) {
+			let result;
+			try {
+				result = await callVerifyCodeAndSignIn(ctx, {
+					params: args.params,
+					verifier: args.verifier,
+					generateTokens: true,
+					allowExtraProviders: options.allowExtraProviders
+				});
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to verify OAuth sign-in.");
+			}
+			return {
+				kind: "signedIn",
+				session: result
+			};
+		}
+		const authSiteUrl = options.authSiteUrl ?? authUrlFromEnv();
+		const redirect = new URL(`${authSiteUrl.replace(/\/$/, "")}/signin/${provider.id}`);
+		let verifier;
+		try {
+			verifier = await callVerifier(ctx);
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verifier.");
+		}
+		redirect.searchParams.set("code", verifier);
+		if (args.params?.redirectTo !== void 0) {
+			if (typeof args.params.redirectTo !== "string") throw toConvexError(authFlowError("INVALID_REDIRECT", `Expected \`redirectTo\` to be a string, got ${describeUnknown(args.params.redirectTo)}`));
+			redirect.searchParams.set("redirectTo", args.params.redirectTo);
+		}
+		return {
+			kind: "redirect",
+			redirect: redirect.toString(),
+			verifier
+		};
+	});
+}
+async function handleConnectionProvider(ctx, args, options) {
+	return withSpan("convex-auth.signin.connection", {}, async () => {
+		const normalizedParams = normalizeVerificationParams(args.params);
+		const connectionId = normalizedParams.connectionId;
+		if (!connectionId || typeof connectionId !== "string") throw toConvexError(authFlowError("SIGN_IN_MISSING_PARAMS", "connectionId is required for Connection sign-in."));
+		let protocol = (normalizedParams.protocol === "oidc" || normalizedParams.protocol === "saml" ? normalizedParams.protocol : void 0) ?? (options.resolveConnectionProtocol ? await (async () => {
+			try {
+				return await options.resolveConnectionProtocol(ctx, connectionId);
+			} catch (error) {
+				throw asConvexError(error, "INTERNAL_ERROR", "Failed to resolve Connection protocol.");
+			}
+		})() : "oidc");
+		log("DEBUG", "[group-connection] signin:resolved", {
+			connectionId,
+			protocol,
+			redirectTo: typeof args.params?.redirectTo === "string" ? args.params.redirectTo : void 0
+		});
+		if (protocol !== "oidc" && protocol !== "saml") throw toConvexError(authFlowError("SIGN_IN_MISSING_PARAMS", `Invalid Connection protocol: ${protocol}. Expected "oidc" or "saml".`));
+		let verifier;
+		try {
+			verifier = await callVerifier(ctx);
+		} catch (error) {
+			throw asConvexError(error, "INTERNAL_ERROR", "Failed to create verifier.");
+		}
+		const siteUrl = options.authSiteUrl ?? authUrlFromEnv();
+		const redirect = new URL(`${siteUrl.replace(/\/$/, "")}/connections/${connectionId}/${protocol}/signin`);
+		redirect.searchParams.set("code", verifier);
+		if (typeof args.params?.redirectTo === "string") redirect.searchParams.set("redirectTo", args.params.redirectTo);
+		if (typeof normalizedParams.loginHint === "string") redirect.searchParams.set("loginHint", normalizedParams.loginHint);
+		log("DEBUG", "[group-connection] signin:redirect", {
+			connectionId,
+			protocol,
+			redirect: redirect.toString()
+		});
+		return {
+			kind: "redirect",
+			redirect: redirect.toString(),
+			verifier
+		};
+	});
+}
+
+//#endregion
+export { signInImpl };
+//# sourceMappingURL=flow.js.map

package/dist/server/telemetry.js

@@ -0,0 +1,68 @@
+import { envOptionalString, readConfigSync } from "./env.js";
+import { authDb } from "./db.js";
+
+//#region src/server/telemetry.ts
+function tokenIdentifierForUser(userId) {
+	const issuer = readConfigSync(envOptionalString("CONVEX_SITE_URL"));
+	return typeof issuer === "string" && issuer.length > 0 ? `${userId}${issuer}` : userId;
+}
+const AUTH_IDENTITY_ATTRIBUTE_KEYS = {
+	userId: "auth.user.id",
+	sessionId: "auth.session.id",
+	refreshTokenId: "auth.refresh_token.id",
+	email: "auth.user.email",
+	tokenIdentifier: "auth.token_identifier"
+};
+function projectIdentityValue(config, field, value) {
+	if (value === void 0) return;
+	const mode = config.telemetry?.includeIdentity ?? "none";
+	if (mode === "none") return;
+	if (mode === "hashed") return config.telemetry?.hashIdentity?.(value, field);
+	return value;
+}
+async function buildAuthIdentityAttributes(ctx, config, args) {
+	const fields = config.telemetry?.identityFields ?? {};
+	if ((config.telemetry?.includeIdentity ?? "none") === "none") return {};
+	let email;
+	if (fields.email) {
+		const user = await authDb(ctx, config).users.get({ id: args.userId });
+		if (typeof user?.email === "string") email = user.email;
+	}
+	return buildKnownAuthIdentityAttributes(config, args, email);
+}
+function buildKnownAuthIdentityAttributes(config, args, email) {
+	const fields = config.telemetry?.identityFields ?? {};
+	const mode = config.telemetry?.includeIdentity ?? "none";
+	if (mode === "none") return {};
+	const values = {
+		userId: args.userId,
+		sessionId: args.sessionId,
+		tokenIdentifier: tokenIdentifierForUser(args.userId),
+		...args.refreshTokenId === void 0 ? {} : { refreshTokenId: args.refreshTokenId },
+		...email === void 0 ? {} : { email }
+	};
+	const attributes = {};
+	for (const field of Object.keys(fields)) {
+		if (!fields[field]) continue;
+		const projected = projectIdentityValue(config, field, values[field]);
+		if (projected !== void 0) attributes[AUTH_IDENTITY_ATTRIBUTE_KEYS[field]] = projected;
+	}
+	if (Object.keys(attributes).length > 0) attributes["auth.identity.mode"] = mode;
+	return attributes;
+}
+/** Build refresh span attributes from the user returned by token rotation. @internal */
+function buildKnownRefreshIdentityAttributes(config, args, email) {
+	return buildKnownAuthIdentityAttributes(config, args, email);
+}
+/** Build sign-in span attributes from a user already loaded by the session transaction. @internal */
+function buildKnownSignInIdentityAttributes(config, args, email) {
+	return buildKnownAuthIdentityAttributes(config, args, email);
+}
+/** @internal */
+async function buildSignOutIdentityAttributes(ctx, config, args) {
+	return await buildAuthIdentityAttributes(ctx, config, args);
+}
+
+//#endregion
+export { buildKnownRefreshIdentityAttributes, buildKnownSignInIdentityAttributes, buildSignOutIdentityAttributes };
+//# sourceMappingURL=telemetry.js.map

package/dist/server/templates.js

@@ -0,0 +1,91 @@
+//#region src/server/templates.ts
+/**
+* Default email templates generated by the Auth library.
+*
+* These are used when the library sends emails on behalf of the developer
+* (for example magic links). The developer provides the transport via
+* `email.send`; the library provides the content.
+*
+* @module
+*/
+/**
+* Default magic link email template.
+*
+* Clean, minimal design that works across email clients.
+* Used by the auto-registered `email` provider when `email` is
+* configured in `defineAuth(...)`.
+*/
+const HTML_ENTITIES = {
+	"&": "&",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+};
+/** Escape a value for safe interpolation into HTML text and double-quoted attributes. */
+function escapeHtml(value) {
+	return value.replace(/[&<>"']/g, (c) => HTML_ENTITIES[c]);
+}
+/** @internal */
+function defaultMagicLinkEmail(url, host) {
+	const escapedHost = escapeHtml(host);
+	const escapedUrl = escapeHtml(url);
+	return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Sign in to ${escapedHost}</title>
+</head>
+<body style="margin:0;padding:0;background-color:#f9fafb;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;">
+  <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background-color:#f9fafb;padding:40px 16px;">
+    <tr>
+      <td align="center">
+        <table role="presentation" width="480" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #e5e7eb;border-radius:8px;overflow:hidden;">
+          <tr>
+            <td style="padding:32px 32px 0 32px;text-align:center;">
+              <h1 style="margin:0 0 8px 0;font-size:20px;font-weight:600;color:#111827;line-height:1.3;">
+                Sign in to ${escapedHost}
+              </h1>
+            </td>
+          </tr>
+          <tr>
+            <td style="padding:24px 32px;">
+              <p style="margin:0 0 24px 0;font-size:15px;line-height:1.6;color:#4b5563;text-align:center;">
+                Click the button below to sign in. This link will expire shortly.
+              </p>
+              <table role="presentation" width="100%" cellpadding="0" cellspacing="0">
+                <tr>
+                  <td align="center" style="padding:0 0 24px 0;">
+                    <a href="${escapedUrl}" target="_blank" style="display:inline-block;background-color:#111827;color:#ffffff;font-size:15px;font-weight:600;text-decoration:none;padding:12px 32px;border-radius:6px;line-height:1;">
+                      Sign in
+                    </a>
+                  </td>
+                </tr>
+              </table>
+              <p style="margin:0 0 12px 0;font-size:13px;line-height:1.6;color:#9ca3af;">
+                If the button doesn't work, copy and paste this URL into your browser:
+              </p>
+              <p style="margin:0;font-size:13px;line-height:1.5;color:#6b7280;word-break:break-all;">
+                ${escapedUrl}
+              </p>
+            </td>
+          </tr>
+          <tr>
+            <td style="padding:20px 32px;border-top:1px solid #e5e7eb;">
+              <p style="margin:0;font-size:12px;line-height:1.5;color:#9ca3af;text-align:center;">
+                If you didn't request this email, you can safely ignore it.
+              </p>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>`;
+}
+
+//#endregion
+export { defaultMagicLinkEmail };
+//# sourceMappingURL=templates.js.map