@bitbaum/accountkit 0.9.2 → 0.11.0

package/README.md

@@ -249,3 +249,53 @@ under the same stable user ids. The runtime then verifies plain bcrypt and
 resets write native scrypt; reset still revokes existing sessions. Identity and
 role mapping, migration verification and product journeys remain the consumer's
 responsibility. This option alone does not migrate any data.
+
+
+### Domain credentials during migration
+
+`createAuthRuntime` and `createAuthInstance` accept an optional
+`domainCredentials.verify(credential)` callback. It returns `null` for an invalid
+proof, or `{ userId, bindSession? }` for an existing shared user. This enables
+`POST /api/auth/sign-in/domain` with `{ credential }`; use the runtime's `POST`
+handler so the shared credential limiter applies. Never accept a user id from
+the request as the verification result.
+
+`bindSession(sessionId)` persists product-owned restrictions before the session
+cookie is set. For example, a staff code of a dual-identity account grants only
+the staff surface. Store that scope against the shared session id with cascade
+deletion and read it on every product request. A failed binding revokes the new
+session. Domain sessions have fixed expiry and cannot enroll credentials,
+change account security or list other sessions. Show a password/passkey/provider
+sign-in action before offering account management. An account with an enabled
+second factor must use another configured primary method; domain proof alone
+never bypasses MFA. The shared tables require no change for this option.
+
+### First passwords and linking a second identity
+
+A product that created people before they had a password (an invitation, a
+login code) passes `provisioning.resolve(credential)`. It returns `null`, or
+`{ userId, link?, complete?, release? }` for the shared user that holds the
+identity the proof names. This enables `POST /api/auth/provision/claim` with
+`{ credential, email, password, name?, callbackURL? }`, rate limited as a
+credential. Take a single-use proof inside `resolve` and give it back in
+`release`, which runs on every failure after it.
+
+- A user with no password gets one, under its existing id, at the address typed.
+  An address that cannot receive mail (`.invalid`) is refused. A verified
+  address is never replaced; the same address keeps its verification, a new
+  one starts unverified.
+- An address that belongs to another account joins this identity to it only on
+  that account's own password, then calls `link(targetUserId)`. Without `link`
+  the claim is refused. If that account has no password yet (invited, never
+  claimed), the claim is refused with `CLAIM_EMAIL_NEEDS_RECOVERY`: recovery
+  through its mailbox comes first.
+- An identity that already has a password is refused; sign in or recover.
+- With mail configured an unverified address gets a verification link and no
+  session (`status: "verify_email"`); the link signs them in. An account with a
+  second factor is linked but must still sign in (`status: "sign_in"`).
+
+Refusals carry the codes in `CLAIM_ERRORS` (`@bitbaum/accountkit/auth`).
+
+A used password-reset link verifies the address it was sent to, unless the
+account's address changed after it was sent. Recovery therefore leaves an
+imported or invited account with a usable sign-in when mail is configured.

package/dist/auth/claim-errors.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Why a claim (./provisioning) was refused, as stable codes a product's screen
+ * turns into its own words. Safe to import in the browser.
+ */
+export declare const CLAIM_ERRORS: {
+    readonly invalid: "CLAIM_INVALID";
+    readonly alreadyClaimed: "CLAIM_ALREADY_CLAIMED";
+    readonly emailTaken: "CLAIM_EMAIL_TAKEN";
+    readonly emailNeedsRecovery: "CLAIM_EMAIL_NEEDS_RECOVERY";
+    readonly linkPasswordMismatch: "CLAIM_LINK_PASSWORD_MISMATCH";
+    readonly verifiedEmailMismatch: "CLAIM_VERIFIED_EMAIL_MISMATCH";
+};
+export type ClaimError = (typeof CLAIM_ERRORS)[keyof typeof CLAIM_ERRORS];
+/** What a successful claim did: a session, a verification mail, or a sign-in still owed (2FA). */
+export type ClaimResult = {
+    status: "signed_in";
+    userId: string;
+} | {
+    status: "verify_email";
+    userId: string;
+} | {
+    status: "sign_in";
+    userId: string;
+};
+//# sourceMappingURL=claim-errors.d.ts.map

package/dist/auth/claim-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-errors.d.ts","sourceRoot":"","sources":["../../src/auth/claim-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;CAOf,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE1E,kGAAkG;AAClG,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/auth/claim-errors.js

@@ -0,0 +1,13 @@
+/**
+ * Why a claim (./provisioning) was refused, as stable codes a product's screen
+ * turns into its own words. Safe to import in the browser.
+ */
+export const CLAIM_ERRORS = {
+    invalid: "CLAIM_INVALID",
+    alreadyClaimed: "CLAIM_ALREADY_CLAIMED",
+    emailTaken: "CLAIM_EMAIL_TAKEN",
+    emailNeedsRecovery: "CLAIM_EMAIL_NEEDS_RECOVERY",
+    linkPasswordMismatch: "CLAIM_LINK_PASSWORD_MISMATCH",
+    verifiedEmailMismatch: "CLAIM_VERIFIED_EMAIL_MISMATCH",
+};
+//# sourceMappingURL=claim-errors.js.map

package/dist/auth/claim-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-errors.js","sourceRoot":"","sources":["../../src/auth/claim-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,eAAe;IACxB,cAAc,EAAE,uBAAuB;IACvC,UAAU,EAAE,mBAAmB;IAC/B,kBAAkB,EAAE,4BAA4B;IAChD,oBAAoB,EAAE,8BAA8B;IACpD,qBAAqB,EAAE,+BAA+B;CAC9C,CAAC"}

package/dist/auth/domain-credentials.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+/** Product-owned identity proof, with shared session lifecycle and cookies. */
+export interface DomainCredentials {
+    verify(credential: string): Promise<{
+        /** An existing shared account user; never an email or a client-supplied id. */
+        userId: string;
+        /**
+         * Persist product restrictions (for example, which of two identities a code
+         * grants) before exposing the session. Throwing revokes it and fails closed.
+         * Store restrictions against the session id, with cascade deletion.
+         */
+        bindSession?: (sessionId: string) => Promise<void>;
+    } | null>;
+}
+export declare function domainCredentialsPlugin(credentials: DomainCredentials): {
+    id: string;
+    hooks: {
+        before: {
+            matcher: () => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        }[];
+    };
+    endpoints: {
+        signInDomain: import("better-auth").StrictEndpoint<"/sign-in/domain", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
+            body: z.ZodObject<{
+                credential: z.ZodString;
+            }, z.core.$strip>;
+        }, {
+            success: boolean;
+            user: {
+                id: string;
+            };
+        }>;
+    };
+};
+//# sourceMappingURL=domain-credentials.d.ts.map

package/dist/auth/domain-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-credentials.d.ts","sourceRoot":"","sources":["../../src/auth/domain-credentials.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAClC,+EAA+E;QAC/E,MAAM,EAAE,MAAM,CAAC;QACf;;;;WAIG;QACH,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACpD,GAAG,IAAI,CAAC,CAAC;CACX;AAED,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,iBAAiB;;;;;;;;;;;;;;;;;;;;;;EAgHrE"}

package/dist/auth/domain-credentials.js

@@ -0,0 +1,106 @@
+import { APIError, createAuthEndpoint, createAuthMiddleware, formCsrfMiddleware, getSessionFromCtx, originCheckMiddleware, setShouldSkipSessionRefresh, } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { z } from "zod";
+export function domainCredentialsPlugin(credentials) {
+    const marker = (id) => `accountkit-domain-session:${id}`;
+    const proofRoutes = new Set([
+        "/get-session",
+        "/sign-out",
+        "/sign-up/email",
+        "/provision/claim",
+        "/request-password-reset",
+        "/forget-password",
+        "/reset-password",
+        "/verify-email",
+        "/send-verification-email",
+        "/magic-link/verify",
+        "/passkey/generate-authenticate-options",
+        "/passkey/verify-authentication",
+        "/two-factor/verify-totp",
+        "/two-factor/verify-otp",
+        "/two-factor/verify-backup-code",
+    ]);
+    return {
+        id: "accountkit-domain-credentials",
+        hooks: {
+            before: [
+                {
+                    matcher: () => true,
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const current = await getSessionFromCtx(ctx, {
+                            disableRefresh: true,
+                        });
+                        if (!current)
+                            return;
+                        const proof = await ctx.context.internalAdapter.findVerificationValue(marker(current.session.id));
+                        if (proof && proof.expiresAt > new Date()) {
+                            // The restriction must not expire before a sliding session does.
+                            // Domain sessions have a fixed lifetime; authenticate again to
+                            // renew rather than silently extending beyond the marker.
+                            await setShouldSkipSessionRefresh(true);
+                            if (proofRoutes.has(ctx.path ?? "") ||
+                                ctx.path?.startsWith("/sign-in/") ||
+                                ctx.path?.startsWith("/callback/") ||
+                                ctx.path?.startsWith("/oauth2/callback/"))
+                                return;
+                            throw new APIError("FORBIDDEN", {
+                                code: "SESSION_EXPIRED",
+                                message: "Sign in with a password, passkey or configured provider before managing account security",
+                            });
+                        }
+                    }),
+                },
+            ],
+        },
+        endpoints: {
+            signInDomain: createAuthEndpoint("/sign-in/domain", {
+                method: "POST",
+                use: [formCsrfMiddleware, originCheckMiddleware],
+                body: z.object({ credential: z.string().min(1).max(1024) }),
+            }, async (ctx) => {
+                const identity = await credentials.verify(ctx.body.credential);
+                const user = identity
+                    ? await ctx.context.internalAdapter.findUserById(identity.userId)
+                    : null;
+                if (!identity || !user)
+                    throw new APIError("UNAUTHORIZED", {
+                        message: "Invalid credential",
+                    });
+                // A domain proof cannot stand in for an enrolled second factor. Its
+                // product context cannot yet survive the native MFA session replacement.
+                // Refuse before creating a session, and offer another configured method.
+                if ("twoFactorEnabled" in user && user.twoFactorEnabled) {
+                    throw new APIError("FORBIDDEN", {
+                        message: "Use another configured sign-in method to complete your second factor",
+                        code: "DOMAIN_CREDENTIAL_REQUIRES_ANOTHER_METHOD",
+                    });
+                }
+                const session = await ctx.context.internalAdapter.createSession(user.id);
+                if (!session)
+                    throw new APIError("INTERNAL_SERVER_ERROR", {
+                        message: "Unable to create session",
+                    });
+                try {
+                    await identity.bindSession?.(session.id);
+                    // Domain proof is deliberately narrower than mailbox, password or
+                    // passkey control. It cannot enroll credentials, change email,
+                    // enable MFA or expose other sessions of a dual-identity account.
+                    await ctx.context.internalAdapter.createVerificationValue({
+                        identifier: marker(session.id),
+                        value: user.id,
+                        expiresAt: session.expiresAt,
+                    });
+                }
+                catch {
+                    await ctx.context.internalAdapter.deleteSession(session.token);
+                    throw new APIError("INTERNAL_SERVER_ERROR", {
+                        message: "Unable to establish identity context",
+                    });
+                }
+                await setSessionCookie(ctx, { session, user });
+                return ctx.json({ success: true, user: { id: user.id } });
+            }),
+        },
+    };
+}
+//# sourceMappingURL=domain-credentials.js.map

package/dist/auth/domain-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-credentials.js","sourceRoot":"","sources":["../../src/auth/domain-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB,MAAM,UAAU,uBAAuB,CAAC,WAA8B;IACpE,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,6BAA6B,EAAE,EAAE,CAAC;IACjE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;QAC1B,cAAc;QACd,WAAW;QACX,gBAAgB;QAChB,kBAAkB;QAClB,yBAAyB;QACzB,kBAAkB;QAClB,iBAAiB;QACjB,eAAe;QACf,0BAA0B;QAC1B,oBAAoB;QACpB,wCAAwC;QACxC,gCAAgC;QAChC,yBAAyB;QACzB,wBAAwB;QACxB,gCAAgC;KACjC,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE;YACL,MAAM,EAAE;gBACN;oBACE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;oBACnB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE;4BAC3C,cAAc,EAAE,IAAI;yBACrB,CAAC,CAAC;wBACH,IAAI,CAAC,OAAO;4BAAE,OAAO;wBACrB,MAAM,KAAK,GACT,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CACrD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAC3B,CAAC;wBACJ,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;4BAC1C,iEAAiE;4BACjE,+DAA+D;4BAC/D,0DAA0D;4BAC1D,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;4BACxC,IACE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gCAC/B,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC;gCACjC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;gCAClC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,mBAAmB,CAAC;gCAEzC,OAAO;4BACT,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE;gCAC9B,IAAI,EAAE,iBAAiB;gCACvB,OAAO,EACL,0FAA0F;6BAC7F,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC,CAAC;iBACH;aACF;SACF;QACD,SAAS,EAAE;YACT,YAAY,EAAE,kBAAkB,CAC9B,iBAAiB,EACjB;gBACE,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;aAC5D,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,QAAQ;oBACnB,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACjE,CAAC,CAAC,IAAI,CAAC;gBACT,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;oBACpB,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE;wBACjC,OAAO,EAAE,oBAAoB;qBAC9B,CAAC,CAAC;gBACL,oEAAoE;gBACpE,yEAAyE;gBACzE,yEAAyE;gBACzE,IAAI,kBAAkB,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACxD,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE;wBAC9B,OAAO,EACL,sEAAsE;wBACxE,IAAI,EAAE,2CAA2C;qBAClD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAC7D,IAAI,CAAC,EAAE,CACR,CAAC;gBACF,IAAI,CAAC,OAAO;oBACV,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE;wBAC1C,OAAO,EAAE,0BAA0B;qBACpC,CAAC,CAAC;gBACL,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACzC,kEAAkE;oBAClE,+DAA+D;oBAC/D,kEAAkE;oBAClE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC;wBACxD,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC9B,KAAK,EAAE,IAAI,CAAC,EAAE;wBACd,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC/D,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE;wBAC1C,OAAO,EAAE,sCAAsC;qBAChD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5D,CAAC,CACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -4,4 +4,5 @@ export { MAX_PASSWORD_LENGTH, MIN_PASSWORD_LENGTH, passwordProblem, } from "./pa
 export { authBucket, authLimits, type AuthBucket } from "./limits.js";
 export { DEFAULT_AUTH_LABELS, DEFAULT_RECOVERY_LABELS, authErrorText, fill, type AuthError, type AuthLabels, type RecoveryLabels, } from "./labels.js";
 export { AUTH_LABEL_LOCALES, authLabelsFor } from "./translations.js";
+export { CLAIM_ERRORS, type ClaimError, type ClaimResult, } from "./claim-errors.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,IAAI,EACJ,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,IAAI,EACJ,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC"}

package/dist/auth/index.js

@@ -4,4 +4,5 @@ export { MAX_PASSWORD_LENGTH, MIN_PASSWORD_LENGTH, passwordProblem, } from "./pa
 export { authBucket, authLimits } from "./limits.js";
 export { DEFAULT_AUTH_LABELS, DEFAULT_RECOVERY_LABELS, authErrorText, fill, } from "./labels.js";
 export { AUTH_LABEL_LOCALES, authLabelsFor } from "./translations.js";
+export { CLAIM_ERRORS, } from "./claim-errors.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,IAAI,GAIL,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,IAAI,GAIL,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,YAAY,GAGb,MAAM,mBAAmB,CAAC"}

package/dist/auth/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/auth/limits.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;IACrB,0DAA0D;;IAE1D,2EAA2E;;IAE3E,uEAAuE;;IAEvE,0EAA0E;;CAE3E,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAwBxD,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKnD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAQrD;AAeD,oFAAoF;AACpF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAgB1B"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/auth/limits.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;IACrB,0DAA0D;;IAE1D,2EAA2E;;IAE3E,uEAAuE;;IAEvE,0EAA0E;;CAE3E,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AA0BxD,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKnD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAQrD;AAeD,oFAAoF;AACpF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAgB1B"}

package/dist/auth/limits.js

@@ -27,6 +27,8 @@ const MAIL = new Set([
 ]);
 const CREDENTIAL_PREFIXES = [
     "/sign-in/email",
+    "/sign-in/domain",
+    "/provision/claim",
     "/sign-in/social",
     "/reset-password",
     "/change-password",

package/dist/auth/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/auth/limits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,UAAU,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,0DAA0D;IAC1D,UAAU,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/D,2EAA2E;IAC3E,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IACxD,uEAAuE;IACvE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1D,0EAA0E;IAC1E,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;CAC3D,CAAC;AAIF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,gBAAgB;IAChB,qBAAqB;IACrB,0BAA0B;IAC1B,yBAAyB;IACzB,kBAAkB;IAClB,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC1B,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,gCAAgC;IAChC,wCAAwC;IACxC,oBAAoB;IACpB,cAAc;CACf,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,YAAY,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,KAAa;IACvD,OAAO,GAAG,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAmB;IACzC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EACtE;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;KAC/D,CACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAI,IAAgD,IAAI,EAAE,CAAC;QACvE,MAAM,KAAK,GACT,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC9E,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CACvC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/auth/limits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,UAAU,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,0DAA0D;IAC1D,UAAU,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/D,2EAA2E;IAC3E,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IACxD,uEAAuE;IACvE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1D,0EAA0E;IAC1E,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;CAC3D,CAAC;AAIF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,gBAAgB;IAChB,qBAAqB;IACrB,0BAA0B;IAC1B,yBAAyB;IACzB,kBAAkB;IAClB,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC1B,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,gCAAgC;IAChC,wCAAwC;IACxC,oBAAoB;IACpB,cAAc;CACf,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,YAAY,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,KAAa;IACvD,OAAO,GAAG,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAmB;IACzC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EACtE;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;KAC/D,CACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAI,IAAgD,IAAI,EAAE,CAAC;QACvE,MAAM,KAAK,GACT,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC9E,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CACvC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/next.d.ts

@@ -2,6 +2,8 @@ import { type Auth, type CreateAuthOptions, type AuthSite, type AuthMailer, type
 export interface AuthRuntimeOptions {
     site: AuthSite;
     mail: AuthMailer;
+    /** Map an existing deployment's secret/config names without mutating process.env. */
+    env?: NodeJS.ProcessEnv;
     /** Whether the product has a database to keep accounts in. */
     isDatabaseConfigured: (env: NodeJS.ProcessEnv) => boolean;
     /** The Drizzle database. Called on first use, never at import. */
@@ -10,6 +12,9 @@ export interface AuthRuntimeOptions {
     schema?: Record<string, unknown>;
     /** See CreateAuthOptions.legacyBcrypt; only needed for imported credentials. */
     legacyBcrypt?: CreateAuthOptions["legacyBcrypt"];
+    domainCredentials?: CreateAuthOptions["domainCredentials"];
+    /** See CreateAuthOptions.provisioning: first passwords and identity linking. */
+    provisioning?: CreateAuthOptions["provisioning"];
     /**
      * For a product whose rows were keyed on an OIDC subject before it had
      * accounts (an OrangeCat actor id). A person who FIRST came in through that

package/dist/auth/next.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../../src/auth/next.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,IAAI,EACT,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,8DAA8D;IAC9D,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IAC1D,kEAAkE;IAClE,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gFAAgF;IAChF,YAAY,CAAC,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAED,KAAK,WAAW,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB;mBAEvC,IAAI;uBAWC,MAAM,CAAC,UAAU,KAAiB,UAAU;sBA2DxC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;iCAdtC,OAAO,KACtB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;2BA6BnB,OAAO,KACf,OAAO,CACN;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;KAAE,GACvC;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACvC;mBAsCsB,OAAO;oBAEN,OAAO;EAGhC;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,oGAAoG;QACpG,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;CAC1C"}
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../../src/auth/next.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,IAAI,EACT,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8DAA8D;IAC9D,oBAAoB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IAC1D,kEAAkE;IAClE,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gFAAgF;IAChF,YAAY,CAAC,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACjD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IAC3D,gFAAgF;IAChF,YAAY,CAAC,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAED,KAAK,WAAW,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB;mBAEvC,IAAI;uBAejB,MAAM,CAAC,UAAU,KACrB,UAAU;sBA0DgB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;iCAdtC,OAAO,KACtB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;2BA6BnB,OAAO,KACf,OAAO,CACN;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;KAAE,GACvC;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACvC;mBAsCsB,OAAO;oBAEN,OAAO;EAGhC;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,oGAAoG;QACpG,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;CAC1C"}

package/dist/auth/next.js

@@ -23,12 +23,15 @@ export function createAuthRuntime(options) {
             mail: options.mail,
             schema: options.schema,
             legacyBcrypt: options.legacyBcrypt,
+            domainCredentials: options.domainCredentials,
+            provisioning: options.provisioning,
+            env: options.env,
             onAccountCreated: options.onAccountCreated,
             database: options.getDatabase(),
         });
         return instance;
     };
-    const authStatus = (env = process.env) => authStatusFor(options.isDatabaseConfigured(env), env);
+    const authStatus = (env = options.env ?? process.env) => authStatusFor(options.isDatabaseConfigured(env), env);
     const noStore = { "Cache-Control": "no-store" };
     const actorIds = new Map();
     /** The id the product's own rows use for this person. */

package/dist/auth/next.js.map

@@ -1 +1 @@
-{"version":3,"file":"next.js","sourceRoot":"","sources":["../../src/auth/next.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AA2BrB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,IAAI,QAAQ,GAAgB,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,QAAQ,KAAK,kBAAkB,CAAC;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAc,EAAE,CACtE,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,yDAAyD;IACzD,KAAK,UAAU,SAAS,CAAC,IAGxB;QACC,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO;YACpC,UAAU,CAAC,OAAO,CAA8B,CAAC;QACnD,8DAA8D;QAC9D,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAS,CAAC;QACxC,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,IAAI,GAAgD,MAAM,EAAE;aAC/D,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;aAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,UAAU,CACvB,cAAuB;QAEvB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;YAC9C,OAAO,EAAE,cAAc;SACxB,CAAC,CAAuB,CAAC;QAC1B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,GAAG,OAAO;YACV,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,KAAK,UAAU,UAAU;QACvB,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,cAAc,GAAG,MAAM,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAAgC,KAAe,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,WAAW,CACxB,OAAgB;QAKhB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACrB,EAAE,KAAK,EAAE,sBAAsB,EAAE,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACrB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAC7B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACxD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC,CAAC;QACJ,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU;QACV,UAAU;QACV,UAAU;QACV,WAAW;QACX,GAAG,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC9B,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACnE,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC/B,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"next.js","sourceRoot":"","sources":["../../src/auth/next.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AAgCrB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,IAAI,QAAQ,GAAgB,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,QAAQ,KAAK,kBAAkB,CAAC;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CACjB,MAAyB,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EACvC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,yDAAyD;IACzD,KAAK,UAAU,SAAS,CAAC,IAGxB;QACC,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO;YACpC,UAAU,CAAC,OAAO,CAA8B,CAAC;QACnD,8DAA8D;QAC9D,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAS,CAAC;QACxC,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,IAAI,GAAgD,MAAM,EAAE;aAC/D,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;aACpE,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;aAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,UAAU,CACvB,cAAuB;QAEvB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;YAC9C,OAAO,EAAE,cAAc;SACxB,CAAC,CAAuB,CAAC;QAC1B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,GAAG,OAAO;YACV,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,KAAK,UAAU,UAAU;QACvB,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,cAAc,GAAG,MAAM,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAAgC,KAAe,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,WAAW,CACxB,OAAgB;QAKhB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACrB,EAAE,KAAK,EAAE,sBAAsB,EAAE,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACrB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAC7B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACxD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAClC,CAAC;QACJ,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU;QACV,UAAU;QACV,UAAU;QACV,WAAW;QACX,GAAG,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC9B,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACnE,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC/B,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;KACrE,CAAC;AACJ,CAAC"}

package/dist/auth/provisioning.d.ts

@@ -0,0 +1,63 @@
+import { z } from "zod";
+/**
+ * A product identity that exists before its person has a password: an invited
+ * colleague, a resident who signs in with a code, a placeholder profile.
+ *
+ * The product proves WHICH identity (a single-use invitation, an exact login
+ * code). AccountKit owns everything about the credential: the first password,
+ * the address it is attached to, its verification, and the proof of an
+ * existing account before a second identity joins it.
+ */
+export interface ProvisionedIdentity {
+    /** The shared user that holds this identity now. Never derived from an email. */
+    userId: string;
+    /**
+     * Move this identity onto another shared user, AFTER AccountKit verified that
+     * user's own password. Omit to refuse linking: an address already in use
+     * then fails the claim. Must be idempotent, and must not touch credentials.
+     */
+    link?: (targetUserId: string) => Promise<void>;
+    /** Called once the claim succeeded, with the user now holding the identity (consume a single-use proof here). */
+    complete?: (userId: string) => Promise<void>;
+    /** Called when the claim fails after `resolve`: give back a proof taken for it. */
+    release?: () => Promise<void>;
+}
+export interface AccountProvisioning {
+    /**
+     * Resolve a product proof to the identity it names, or null. A single-use
+     * proof should be TAKEN here (and given back in `release`) so that two
+     * concurrent claims cannot both succeed.
+     */
+    resolve(credential: string): Promise<ProvisionedIdentity | null>;
+}
+export declare function provisioningPlugin(provisioning: AccountProvisioning, options: {
+    requireEmailVerification: boolean;
+}): {
+    id: string;
+    endpoints: {
+        claimAccount: import("better-auth").StrictEndpoint<"/provision/claim", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
+            body: z.ZodObject<{
+                credential: z.ZodString;
+                email: z.ZodEmail;
+                password: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+                callbackURL: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        }, {
+            status: "signed_in";
+            userId: string;
+            success: boolean;
+        } | {
+            status: "verify_email";
+            userId: string;
+            success: boolean;
+        } | {
+            status: "sign_in";
+            userId: string;
+            success: boolean;
+        }>;
+    };
+};
+//# sourceMappingURL=provisioning.d.ts.map

package/dist/auth/provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../src/auth/provisioning.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,iHAAiH;IACjH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CAClE;AAED,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,mBAAmB,EACjC,OAAO,EAAE;IAAE,wBAAwB,EAAE,OAAO,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2J/C"}

package/dist/auth/provisioning.js

@@ -0,0 +1,121 @@
+import { APIError, createAuthEndpoint, formCsrfMiddleware, originCheckMiddleware, sendVerificationEmailFn, } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { z } from "zod";
+import { CLAIM_ERRORS } from "./claim-errors.js";
+import { isDeliverable } from "./methods.js";
+import { MAX_PASSWORD_LENGTH, MIN_PASSWORD_LENGTH } from "./password.js";
+export function provisioningPlugin(provisioning, options) {
+    return {
+        id: "accountkit-provisioning",
+        endpoints: {
+            claimAccount: createAuthEndpoint("/provision/claim", {
+                method: "POST",
+                use: [formCsrfMiddleware, originCheckMiddleware],
+                body: z.object({
+                    credential: z.string().min(1).max(1024),
+                    email: z.email().max(320),
+                    password: z
+                        .string()
+                        .min(MIN_PASSWORD_LENGTH)
+                        .max(MAX_PASSWORD_LENGTH),
+                    name: z.string().max(120).optional(),
+                    callbackURL: z.string().max(2048).optional(),
+                }),
+            }, async (ctx) => {
+                const email = ctx.body.email.trim().toLowerCase();
+                const fail = (status, code, message) => new APIError(status, { code, message });
+                // An address that cannot receive mail is never a sign-in address.
+                if (!isDeliverable(email))
+                    throw fail("FORBIDDEN", CLAIM_ERRORS.invalid, "Use an address that can receive mail");
+                const identity = await provisioning.resolve(ctx.body.credential);
+                if (!identity)
+                    throw fail("UNAUTHORIZED", CLAIM_ERRORS.invalid, "Invalid claim");
+                let completed = false;
+                try {
+                    const adapter = ctx.context.internalAdapter;
+                    const target = await adapter.findUserById(identity.userId);
+                    if (!target)
+                        throw fail("UNAUTHORIZED", CLAIM_ERRORS.invalid, "Invalid claim");
+                    // A finished account recovers its password; it is never claimed again.
+                    if (await adapter.findCredentialAccount(target.id))
+                        throw fail("CONFLICT", CLAIM_ERRORS.alreadyClaimed, "This identity already has a password: sign in or reset it");
+                    const owner = await adapter.findUserByEmail(email);
+                    let result;
+                    if (owner && owner.user.id !== target.id) {
+                        // The address belongs to another person's account. It may absorb
+                        // this identity only on proof of THAT account, never because the
+                        // claimant typed its address.
+                        if (!identity.link)
+                            throw fail("CONFLICT", CLAIM_ERRORS.emailTaken, "This address belongs to another account");
+                        const existing = await adapter.findCredentialAccount(owner.user.id);
+                        if (!existing?.password)
+                            // Invited, never claimed: its mailbox is the only proof there
+                            // is. Recover that account first, then claim with its password.
+                            throw fail("CONFLICT", CLAIM_ERRORS.emailNeedsRecovery, "Set this address's password through recovery, then claim again");
+                        const valid = await ctx.context.password.verify({
+                            hash: existing.password,
+                            password: ctx.body.password,
+                        });
+                        if (!valid)
+                            throw fail("UNAUTHORIZED", CLAIM_ERRORS.linkPasswordMismatch, "Enter the existing account's password to link it");
+                        await identity.link(owner.user.id);
+                        await identity.complete?.(owner.user.id);
+                        completed = true;
+                        result =
+                            "twoFactorEnabled" in owner.user && owner.user.twoFactorEnabled
+                                ? // A password is one factor; the session is the sign-in's job.
+                                    { status: "sign_in", userId: owner.user.id }
+                                : await finish(owner.user.id);
+                        return ctx.json({ success: true, ...result });
+                    }
+                    const sameAddress = target.email.toLowerCase() === email;
+                    if (!sameAddress &&
+                        isDeliverable(target.email) &&
+                        target.emailVerified)
+                        // A verified mailbox is not moved by whoever holds the identity proof.
+                        throw fail("CONFLICT", CLAIM_ERRORS.verifiedEmailMismatch, "Claim with the address this account already uses");
+                    await adapter.updateUser(target.id, {
+                        email,
+                        emailVerified: sameAddress && target.emailVerified,
+                        ...(ctx.body.name && !target.name
+                            ? { name: ctx.body.name.trim() }
+                            : {}),
+                    });
+                    await adapter.createAccount({
+                        userId: target.id,
+                        providerId: "credential",
+                        accountId: target.id,
+                        password: await ctx.context.password.hash(ctx.body.password),
+                    });
+                    await identity.complete?.(target.id);
+                    completed = true;
+                    result = await finish(target.id);
+                    return ctx.json({ success: true, ...result });
+                }
+                finally {
+                    if (!completed)
+                        await identity.release?.();
+                }
+                async function finish(userId) {
+                    const user = await ctx.context.internalAdapter.findUserById(userId);
+                    if (!user)
+                        throw fail("UNAUTHORIZED", CLAIM_ERRORS.invalid, "Invalid claim");
+                    if (options.requireEmailVerification && !user.emailVerified) {
+                        // The same rule as a password sign-in: the mailbox proves the
+                        // address before it signs anyone in. The link signs them in.
+                        await sendVerificationEmailFn(ctx, user);
+                        return { status: "verify_email", userId };
+                    }
+                    const session = await ctx.context.internalAdapter.createSession(userId);
+                    if (!session)
+                        throw new APIError("INTERNAL_SERVER_ERROR", {
+                            message: "Unable to create session",
+                        });
+                    await setSessionCookie(ctx, { session, user });
+                    return { status: "signed_in", userId };
+                }
+            }),
+        },
+    };
+}
+//# sourceMappingURL=provisioning.js.map

package/dist/auth/provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../src/auth/provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAoB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAmCzE,MAAM,UAAU,kBAAkB,CAChC,YAAiC,EACjC,OAA8C;IAE9C,OAAO;QACL,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE;YACT,YAAY,EAAE,kBAAkB,CAC9B,kBAAkB,EAClB;gBACE,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;oBACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;oBACvC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;oBACzB,QAAQ,EAAE,CAAC;yBACR,MAAM,EAAE;yBACR,GAAG,CAAC,mBAAmB,CAAC;yBACxB,GAAG,CAAC,mBAAmB,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;oBACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;iBAC7C,CAAC;aACH,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,CACX,MAAiD,EACjD,IAAY,EACZ,OAAe,EACf,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7C,kEAAkE;gBAClE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;oBACvB,MAAM,IAAI,CACR,WAAW,EACX,YAAY,CAAC,OAAO,EACpB,sCAAsC,CACvC,CAAC;gBAEJ,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACjE,IAAI,CAAC,QAAQ;oBACX,MAAM,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBAEpE,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;oBAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC3D,IAAI,CAAC,MAAM;wBACT,MAAM,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;oBACpE,uEAAuE;oBACvE,IAAI,MAAM,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;wBAChD,MAAM,IAAI,CACR,UAAU,EACV,YAAY,CAAC,cAAc,EAC3B,2DAA2D,CAC5D,CAAC;oBAEJ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,MAAmB,CAAC;oBAExB,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;wBACzC,iEAAiE;wBACjE,iEAAiE;wBACjE,8BAA8B;wBAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI;4BAChB,MAAM,IAAI,CACR,UAAU,EACV,YAAY,CAAC,UAAU,EACvB,yCAAyC,CAC1C,CAAC;wBACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CACd,CAAC;wBACF,IAAI,CAAC,QAAQ,EAAE,QAAQ;4BACrB,8DAA8D;4BAC9D,gEAAgE;4BAChE,MAAM,IAAI,CACR,UAAU,EACV,YAAY,CAAC,kBAAkB,EAC/B,gEAAgE,CACjE,CAAC;wBACJ,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;4BAC9C,IAAI,EAAE,QAAQ,CAAC,QAAQ;4BACvB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;yBAC5B,CAAC,CAAC;wBACH,IAAI,CAAC,KAAK;4BACR,MAAM,IAAI,CACR,cAAc,EACd,YAAY,CAAC,oBAAoB,EACjC,kDAAkD,CACnD,CAAC;wBACJ,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACnC,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACzC,SAAS,GAAG,IAAI,CAAC;wBACjB,MAAM;4BACJ,kBAAkB,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB;gCAC7D,CAAC,CAAC,8DAA8D;oCAC9D,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE;gCAC9C,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBAClC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;oBAChD,CAAC;oBAED,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;oBACzD,IACE,CAAC,WAAW;wBACZ,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC3B,MAAM,CAAC,aAAa;wBAEpB,uEAAuE;wBACvE,MAAM,IAAI,CACR,UAAU,EACV,YAAY,CAAC,qBAAqB,EAClC,kDAAkD,CACnD,CAAC;oBACJ,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE;wBAClC,KAAK;wBACL,aAAa,EAAE,WAAW,IAAI,MAAM,CAAC,aAAa;wBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;4BAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;4BAChC,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC,CAAC;oBACH,MAAM,OAAO,CAAC,aAAa,CAAC;wBAC1B,MAAM,EAAE,MAAM,CAAC,EAAE;wBACjB,UAAU,EAAE,YAAY;wBACxB,SAAS,EAAE,MAAM,CAAC,EAAE;wBACpB,QAAQ,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;qBAC7D,CAAC,CAAC;oBACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACrC,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;gBAChD,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,SAAS;wBAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC7C,CAAC;gBAED,KAAK,UAAU,MAAM,CAAC,MAAc;oBAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBACpE,IAAI,CAAC,IAAI;wBACP,MAAM,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;oBACpE,IAAI,OAAO,CAAC,wBAAwB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;wBAC5D,8DAA8D;wBAC9D,6DAA6D;wBAC7D,MAAM,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;wBACzC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;oBAC5C,CAAC;oBACD,MAAM,OAAO,GACX,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;oBAC1D,IAAI,CAAC,OAAO;wBACV,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE;4BAC1C,OAAO,EAAE,0BAA0B;yBACpC,CAAC,CAAC;oBACL,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;gBACzC,CAAC;YACH,CAAC,CACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/recovery-verification.d.ts

@@ -0,0 +1,23 @@
+export interface RecordResetAddress {
+    createVerificationValue(data: {
+        identifier: string;
+        value: string;
+        expiresAt: Date;
+    }): Promise<unknown>;
+}
+export declare function recordResetAddress(adapter: RecordResetAddress, token: string, user: {
+    id: string;
+    email: string;
+}): Promise<void>;
+export declare function recoveryVerificationPlugin(): {
+    id: string;
+    hooks: {
+        after: {
+            matcher: (ctx: {
+                path?: string;
+            }) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        }[];
+    };
+};
+//# sourceMappingURL=recovery-verification.d.ts.map

package/dist/auth/recovery-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-verification.d.ts","sourceRoot":"","sources":["../../src/auth/recovery-verification.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,kBAAkB;IACjC,uBAAuB,CAAC,IAAI,EAAE;QAC5B,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,IAAI,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,0BAA0B;;;;2BAMjB;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE;;;;EA4BzC"}

package/dist/auth/recovery-verification.js

@@ -0,0 +1,53 @@
+import { createAuthMiddleware, isAPIError } from "better-auth/api";
+/**
+ * A completed password reset proves control of the mailbox the link was sent
+ * to, so it verifies that address. better-auth does not: an imported or
+ * invited account with an unverified address would set its password and then
+ * be refused at sign-in, with mail configured, for the very address it just
+ * proved.
+ *
+ * The address is recorded when the link is SENT and compared when it is used:
+ * if the account's address changed in between, nothing is verified.
+ */
+const marker = (token) => `accountkit-reset-address:${token}`;
+const RESET_LINK_SECONDS = 60 * 60;
+export async function recordResetAddress(adapter, token, user) {
+    await adapter.createVerificationValue({
+        identifier: marker(token),
+        value: JSON.stringify({ userId: user.id, email: user.email }),
+        expiresAt: new Date(Date.now() + RESET_LINK_SECONDS * 1000),
+    });
+}
+export function recoveryVerificationPlugin() {
+    return {
+        id: "accountkit-recovery-verification",
+        hooks: {
+            after: [
+                {
+                    matcher: (ctx) => ctx.path === "/reset-password",
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const token = ctx.body?.token ??
+                            ctx.query?.token;
+                        if (!token)
+                            return;
+                        const adapter = ctx.context.internalAdapter;
+                        const recorded = await adapter.findVerificationValue(marker(token));
+                        if (!recorded)
+                            return;
+                        await adapter.deleteVerificationByIdentifier(marker(token));
+                        if (isAPIError(ctx.context.returned))
+                            return;
+                        const sent = JSON.parse(recorded.value);
+                        const user = await adapter.findUserById(sent.userId);
+                        if (!user ||
+                            user.emailVerified ||
+                            user.email.toLowerCase() !== sent.email.toLowerCase())
+                            return;
+                        await adapter.updateUser(user.id, { emailVerified: true });
+                    }),
+                },
+            ],
+        },
+    };
+}
+//# sourceMappingURL=recovery-verification.js.map

package/dist/auth/recovery-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-verification.js","sourceRoot":"","sources":["../../src/auth/recovery-verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEnE;;;;;;;;;GASG;AACH,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,4BAA4B,KAAK,EAAE,CAAC;AACtE,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAC;AAUnC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAC3B,KAAa,EACb,IAAmC;IAEnC,MAAM,OAAO,CAAC,uBAAuB,CAAC;QACpC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;QACzB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,GAAG,IAAI,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,EAAE,EAAE,kCAAkC;QACtC,KAAK,EAAE;YACL,KAAK,EAAE;gBACL;oBACE,OAAO,EAAE,CAAC,GAAsB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB;oBACnE,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,KAAK,GACR,GAAG,CAAC,IAAuC,EAAE,KAAK;4BAClD,GAAG,CAAC,KAAwC,EAAE,KAAK,CAAC;wBACvD,IAAI,CAAC,KAAK;4BAAE,OAAO;wBACnB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;wBAC5C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;wBACpE,IAAI,CAAC,QAAQ;4BAAE,OAAO;wBACtB,MAAM,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5D,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;4BAAE,OAAO;wBAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAGrC,CAAC;wBACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACrD,IACE,CAAC,IAAI;4BACL,IAAI,CAAC,aAAa;4BAClB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;4BAErD,OAAO;wBACT,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7D,CAAC,CAAC;iBACH;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/server.d.ts

@@ -2,6 +2,10 @@ import { betterAuth } from "better-auth";
 import type { GenericOAuthConfig } from "better-auth/plugins";
 import { type OidcClient } from "./methods.js";
 import { type BcryptLike } from "./hash.js";
+import { type DomainCredentials } from "./domain-credentials.js";
+import { type AccountProvisioning } from "./provisioning.js";
+export type { DomainCredentials } from "./domain-credentials.js";
+export type { AccountProvisioning, ProvisionedIdentity, } from "./provisioning.js";
 export type AuthMailKind = "verify" | "magicLink" | "reset";
 export interface AuthMailer {
     /** Whether mail can be sent at all. Without it the methods that need mail are hidden. */
@@ -29,6 +33,14 @@ export interface CreateAuthOptions {
      * retain their existing user ids and copy hashes without decrypting them.
      */
     legacyBcrypt?: BcryptLike;
+    /** Optional domain proof (for example an existing housing login code). */
+    domainCredentials?: DomainCredentials;
+    /**
+     * First password for an identity the product created without one (an
+     * invitation, a login code), and linking a second identity to an existing
+     * account on that account's own password. See ./provisioning.
+     */
+    provisioning?: AccountProvisioning;
     mail: AuthMailer;
     env?: NodeJS.ProcessEnv;
     /**

package/dist/auth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAWlE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,yFAAyF;IACzF,UAAU,EAAE,OAAO,CAAC;IACpB,uEAAuE;IACvE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,QAAQ;IACvB,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED,MAAM,MAAM,UAAU,GACpB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEzD;AAED,wBAAgB,aAAa,CAC3B,kBAAkB,EAAE,OAAO,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,UAAU,CAOZ;AAaD,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB,CAiCnE;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEjD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CA4KnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAe3B,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EACV,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,yFAAyF;IACzF,UAAU,EAAE,OAAO,CAAC;IACpB,uEAAuE;IACvE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,QAAQ;IACvB,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED,MAAM,MAAM,UAAU,GACpB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEzD;AAED,wBAAgB,aAAa,CAC3B,kBAAkB,EAAE,OAAO,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,UAAU,CAOZ;AAaD,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB,CAiCnE;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEjD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAgMnE"}

package/dist/auth/server.js

@@ -10,6 +10,9 @@ import { DEFAULT_ROLE } from "./roles.js";
 import { authSchema } from "./schema.js";
 import { factorForAllMethods } from "./factor.js";
 import { createPasswordHasher } from "./hash.js";
+import { domainCredentialsPlugin, } from "./domain-credentials.js";
+import { provisioningPlugin, } from "./provisioning.js";
+import { recordResetAddress, recoveryVerificationPlugin, } from "./recovery-verification.js";
 /**
  * Accounts for a bitbaum product: better-auth 1.x on Drizzle + pg, configured
  * the same way everywhere (fleet STACK.md, "Identity"). A product passes in
@@ -211,7 +214,12 @@ export function createAuthInstance(options) {
             requireEmailVerification: methods.verifyEmail,
             revokeSessionsOnPasswordReset: true,
             sendResetPassword: mail.configured
-                ? async ({ user, url }) => mail.send("reset", user.email, url)
+                ? async ({ user, url, token }) => {
+                    // Remember which address the link went to, so using it verifies
+                    // that address (./recovery-verification).
+                    await recordResetAddress((await auth.$context).internalAdapter, token, user);
+                    await mail.send("reset", user.email, url);
+                }
                 : undefined,
         },
         emailVerification: {
@@ -220,6 +228,17 @@ export function createAuthInstance(options) {
             sendVerificationEmail: async ({ user, url }) => mail.send("verify", user.email, url),
         },
         plugins: [
+            ...(options.domainCredentials
+                ? [domainCredentialsPlugin(options.domainCredentials)]
+                : []),
+            ...(options.provisioning
+                ? [
+                    provisioningPlugin(options.provisioning, {
+                        requireEmailVerification: methods.verifyEmail,
+                    }),
+                ]
+                : []),
+            recoveryVerificationPlugin(),
             // allowPasswordless: someone who signs in only by passkey, link or OIDC can
             // still add a second factor (with a fresh session instead of a password).
             factorForAllMethods(site),

package/dist/auth/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAmB,MAAM,WAAW,CAAC;AAElE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,UAAU,GAAG,uDAAuD,CAAC;AAkD3E;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAsB;IAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,kBAA2B,EAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,0EAA0E;QAC1E,qEAAqE;QACrE,yCAAyC;QACzC,0BAA0B,EAAE,IAAI;QAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,yEAAyE;QACzE,2EAA2E;QAC3E,mEAAmE;QACnE,iBAAiB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;QACnD,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QACtC,qEAAqE;QACrE,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO;gBACV,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,uBAAuB,CAAC,CAAC;YAC/D,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;gBAC5C,CAAC,CAAC,OAAO,CAAC,kBAAkB;gBAC5B,CAAC,CAAC,EAAE,CAAC;YACT,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC3C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;gBACnD,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,SAAS;aACjB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY;QAC1C,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC;QACvB,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,EAAE,IAAI,CAAC,GAAG;QACjB,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/B,8DAA8D;QAC9D,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAe,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B;SACF,CAAC;QACF,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,0EAA0E;QAC1E,2EAA2E;QAC3E,4BAA4B;QAC5B,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,gBAAgB,EAAE,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC/C,8EAA8E;YAC9E,SAAS,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;YACtC,YAAY,EAAE,IAAI,CAAC,IAAI;SACxB;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;YACvB,2EAA2E;YAC3E,QAAQ,EAAE,EAAE,GAAG,EAAE;SAClB;QACD,IAAI,EAAE;YACJ,gBAAgB,EAAE;gBAChB,oFAAoF;gBACpF,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb;aACF;YACD,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;SAC1C;QACD,OAAO,EAAE;YACP,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,iEAAiE;gBACjE,2EAA2E;gBAC3E,sBAAsB,EAAE,IAAI;gBAC5B,oBAAoB,EAAE,IAAI;aAC3B;YACD,kBAAkB,EAAE,IAAI;SACzB;QACD,aAAa,EAAE;YACb,OAAO,EAAE;gBACP,sEAAsE;gBACtE,0EAA0E;gBAC1E,MAAM,EAAE;oBACN,mEAAmE;oBACnE,qEAAqE;oBACrE,6DAA6D;oBAC7D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACrB,IAAI,CAAC;4BACH,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;gCAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gCAC3B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gCACnC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;6BAClC,CAAC,CAAC;wBACL,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,KAAK,CACX,mCAAoC,KAAe,CAAC,IAAI,EAAE,CAC3D,CAAC;wBACJ,CAAC;wBACD,OAAO;4BACL,IAAI,EAAE;gCACJ,GAAG,IAAI;gCACP,WAAW,EAAE,IAAI;gCACjB,YAAY,EAAE,IAAI;gCAClB,OAAO,EAAE,IAAI;6BACd;yBACF,CAAC;oBACJ,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE;4BACJ,GAAG,IAAI;4BACP,WAAW,EAAE,IAAI;4BACjB,YAAY,EAAE,IAAI;4BAClB,OAAO,EAAE,IAAI;yBACd;qBACF,CAAC;iBACH;aACF;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,eAAe;gBACjB,CAAC,CAAC;oBACE,QAAQ,EAAE;wBACR,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,KAAK,EAAE,KAAyC,EAAE,EAAE;4BAC1D,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC/C,OAAO,CACL,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CACzD,CAAC,KAAK,CAAC;4BACV,CAAC;4BACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;wBAC/B,CAAC;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,iBAAiB,EAAE,mBAAmB;YACtC,iBAAiB,EAAE,mBAAmB;YACtC,UAAU,EAAE,CAAC,OAAO,CAAC,WAAW;YAChC,qEAAqE;YACrE,sCAAsC;YACtC,wBAAwB,EAAE,OAAO,CAAC,WAAW;YAC7C,6BAA6B,EAAE,IAAI;YACnC,iBAAiB,EAAE,IAAI,CAAC,UAAU;gBAChC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;gBAC9D,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;SACvC;QACD,OAAO,EAAE;YACP,4EAA4E;YAC5E,0EAA0E;YAC1E,mBAAmB,CAAC,IAAI,CAAC;YACzB,OAAO,CAAC;gBACN,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,IAAI,CAAC,KAAK;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC;oBACE,SAAS,CAAC;wBACR,SAAS,EAAE,EAAE,GAAG,EAAE;wBAClB,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC;qBACrC,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,iDAAiD;YACjD,WAAW,EAAE;SACd;KACF,CAAC,CAAC;IACH,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,IAAuB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAmB,MAAM,WAAW,CAAC;AAClE,OAAO,EACL,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,UAAU,GAAG,uDAAuD,CAAC;AAgE3E;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAsB;IAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,kBAA2B,EAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,0EAA0E;QAC1E,qEAAqE;QACrE,yCAAyC;QACzC,0BAA0B,EAAE,IAAI;QAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,yEAAyE;QACzE,2EAA2E;QAC3E,mEAAmE;QACnE,iBAAiB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;QACnD,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QACtC,qEAAqE;QACrE,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO;gBACV,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,uBAAuB,CAAC,CAAC;YAC/D,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;gBAC5C,CAAC,CAAC,OAAO,CAAC,kBAAkB;gBAC5B,CAAC,CAAC,EAAE,CAAC;YACT,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC3C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;gBACnD,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,SAAS;aACjB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY;QAC1C,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC;QACvB,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,EAAE,IAAI,CAAC,GAAG;QACjB,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/B,8DAA8D;QAC9D,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAe,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B;SACF,CAAC;QACF,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,0EAA0E;QAC1E,2EAA2E;QAC3E,4BAA4B;QAC5B,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,gBAAgB,EAAE,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC/C,8EAA8E;YAC9E,SAAS,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;YACtC,YAAY,EAAE,IAAI,CAAC,IAAI;SACxB;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;YACvB,2EAA2E;YAC3E,QAAQ,EAAE,EAAE,GAAG,EAAE;SAClB;QACD,IAAI,EAAE;YACJ,gBAAgB,EAAE;gBAChB,oFAAoF;gBACpF,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb;aACF;YACD,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;SAC1C;QACD,OAAO,EAAE;YACP,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,iEAAiE;gBACjE,2EAA2E;gBAC3E,sBAAsB,EAAE,IAAI;gBAC5B,oBAAoB,EAAE,IAAI;aAC3B;YACD,kBAAkB,EAAE,IAAI;SACzB;QACD,aAAa,EAAE;YACb,OAAO,EAAE;gBACP,sEAAsE;gBACtE,0EAA0E;gBAC1E,MAAM,EAAE;oBACN,mEAAmE;oBACnE,qEAAqE;oBACrE,6DAA6D;oBAC7D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACrB,IAAI,CAAC;4BACH,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;gCAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gCAC3B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gCACnC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;6BAClC,CAAC,CAAC;wBACL,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,KAAK,CACX,mCAAoC,KAAe,CAAC,IAAI,EAAE,CAC3D,CAAC;wBACJ,CAAC;wBACD,OAAO;4BACL,IAAI,EAAE;gCACJ,GAAG,IAAI;gCACP,WAAW,EAAE,IAAI;gCACjB,YAAY,EAAE,IAAI;gCAClB,OAAO,EAAE,IAAI;6BACd;yBACF,CAAC;oBACJ,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE;4BACJ,GAAG,IAAI;4BACP,WAAW,EAAE,IAAI;4BACjB,YAAY,EAAE,IAAI;4BAClB,OAAO,EAAE,IAAI;yBACd;qBACF,CAAC;iBACH;aACF;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,eAAe;gBACjB,CAAC,CAAC;oBACE,QAAQ,EAAE;wBACR,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,KAAK,EAAE,KAAyC,EAAE,EAAE;4BAC1D,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC/C,OAAO,CACL,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CACzD,CAAC,KAAK,CAAC;4BACV,CAAC;4BACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;wBAC/B,CAAC;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,iBAAiB,EAAE,mBAAmB;YACtC,iBAAiB,EAAE,mBAAmB;YACtC,UAAU,EAAE,CAAC,OAAO,CAAC,WAAW;YAChC,qEAAqE;YACrE,sCAAsC;YACtC,wBAAwB,EAAE,OAAO,CAAC,WAAW;YAC7C,6BAA6B,EAAE,IAAI;YACnC,iBAAiB,EAAE,IAAI,CAAC,UAAU;gBAChC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;oBAC7B,gEAAgE;oBAChE,0CAA0C;oBAC1C,MAAM,kBAAkB,CACtB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,eAAe,EACrC,KAAK,EACL,IAAI,CACL,CAAC;oBACF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC5C,CAAC;gBACH,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;SACvC;QACD,OAAO,EAAE;YACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;gBAC3B,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,YAAY;gBACtB,CAAC,CAAC;oBACE,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE;wBACvC,wBAAwB,EAAE,OAAO,CAAC,WAAW;qBAC9C,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,0BAA0B,EAAE;YAC5B,4EAA4E;YAC5E,0EAA0E;YAC1E,mBAAmB,CAAC,IAAI,CAAC;YACzB,OAAO,CAAC;gBACN,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,IAAI,CAAC,KAAK;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC;oBACE,SAAS,CAAC;wBACR,SAAS,EAAE,EAAE,GAAG,EAAE;wBAClB,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC;qBACrC,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,iDAAiD;YACjD,WAAW,EAAE;SACd;KACF,CAAC,CAAC;IACH,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,IAAuB,CAAC;AACjC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitbaum/accountkit",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "description": "One account for every bitbaum product: the account menu, accounts themselves (better-auth: password, magic link, passkeys, 2FA, OIDC) and Sign in with OrangeCat. Styled from @bitbaum/design-tokens.",
   "license": "MIT",
   "author": "Cato",
@@ -167,6 +167,7 @@
     }
   },
   "dependencies": {
-    "limitkit": "^0.2.1"
+    "limitkit": "^0.2.1",
+    "zod": "^4.6.7"
   }
 }