@checodo/better-auth-authentication 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @checodo/better-auth-authentication
+
+## 0.1.0
+
+### Minor Changes
+
+- 5f427b0: First release: sign in with Steam, Epic Games, and Xbox through better-auth's own `signIn.social`, like any built-in social provider.

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clas Heinemeyer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,45 @@
-# Temporary Holding Version
+# @checodo/better-auth-authentication
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign in with Steam, Epic Games, and Xbox in [better-auth](https://better-auth.com), through `signIn.social` like any built-in social provider.
+
+A community plugin, not made by the better-auth team. It looks and works
+like better-auth's own plugins: a server plugin, a typed client plugin,
+error codes.
+
+## Install
+
+```bash
+npm install @checodo/better-auth-authentication
+```
+
+Requires `better-auth` and `@better-auth/core` 1.7.20 or a later 1.x
+release (peer dependencies). ESM only.
+
+## Usage
+
+```ts
+// auth.ts
+import { betterAuth } from "better-auth";
+import { authentication } from "@checodo/better-auth-authentication";
+
+export const auth = betterAuth({
+  plugins: [
+    authentication({
+      steam: { apiKey: process.env.STEAM_API_KEY },
+    }),
+  ],
+});
+```
+
+```ts
+// auth-client.ts
+import { createAuthClient } from "better-auth/client";
+import { authenticationClient } from "@checodo/better-auth-authentication/client";
+
+export const authClient = createAuthClient({ plugins: [authenticationClient()] });
+```
+
+## Documentation
+
+Every option, endpoint, error code, and table:
+[docs](https://github.com/checodo/better-auth-plugins/blob/main/apps/docs/content/docs/authentication/index.mdx).

package/dist/client.d.ts

@@ -0,0 +1,25 @@
+import { i as AUTHENTICATION_ERROR_CODES, r as AUTHENTICATION_CALLBACK_ERRORS, t as AuthenticationPlugin } from "./index-B-TXlJI5.js";
+/**
+ * Client companion to `authentication()`. The providers need no client
+ * methods of their own: sign in with better-auth's `signIn.social` and link
+ * with `linkSocial`. This adds the plugin's error codes to the client.
+ *
+ * @example
+ * ```ts
+ * import { createAuthClient } from "better-auth/client";
+ * import { authenticationClient } from "@checodo/better-auth-authentication/client";
+ *
+ * export const authClient = createAuthClient({ plugins: [authenticationClient()] });
+ *
+ * await authClient.signIn.social({ provider: "epic", callbackURL: "/dashboard" });
+ * ```
+ */
+export declare const authenticationClient: () => {
+  id: "authentication";
+  $InferServerPlugin: AuthenticationPlugin;
+  $ERROR_CODES: {
+    EMAIL_DOMAIN_RESERVED: import("better-auth").RawError<"EMAIL_DOMAIN_RESERVED">;
+  };
+};
+export { AUTHENTICATION_CALLBACK_ERRORS, AUTHENTICATION_ERROR_CODES };
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;;;;;;;qBAmBa;;EAGiB,oBAAA"}

package/dist/client.js

@@ -0,0 +1,27 @@
+import { n as AUTHENTICATION_ERROR_CODES, t as AUTHENTICATION_CALLBACK_ERRORS } from "./error-codes-CVA2nmg9.js";
+// src/client.ts
+/**
+* Client companion to `authentication()`. The providers need no client
+* methods of their own: sign in with better-auth's `signIn.social` and link
+* with `linkSocial`. This adds the plugin's error codes to the client.
+*
+* @example
+* ```ts
+* import { createAuthClient } from "better-auth/client";
+* import { authenticationClient } from "@checodo/better-auth-authentication/client";
+*
+* export const authClient = createAuthClient({ plugins: [authenticationClient()] });
+*
+* await authClient.signIn.social({ provider: "epic", callbackURL: "/dashboard" });
+* ```
+*/
+const authenticationClient = () => {
+	return {
+		id: "authentication",
+		$InferServerPlugin: {},
+		$ERROR_CODES: AUTHENTICATION_ERROR_CODES
+	};
+};
+export { AUTHENTICATION_CALLBACK_ERRORS, AUTHENTICATION_ERROR_CODES, authenticationClient };
+
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type { BetterAuthClientPlugin } from \"better-auth/client\";\nimport { AUTHENTICATION_ERROR_CODES } from \"./error-codes\";\nimport type { AuthenticationPlugin } from \"./index\";\n\n/**\n * Client companion to `authentication()`. The providers need no client\n * methods of their own: sign in with better-auth's `signIn.social` and link\n * with `linkSocial`. This adds the plugin's error codes to the client.\n *\n * @example\n * ```ts\n * import { createAuthClient } from \"better-auth/client\";\n * import { authenticationClient } from \"@checodo/better-auth-authentication/client\";\n *\n * export const authClient = createAuthClient({ plugins: [authenticationClient()] });\n *\n * await authClient.signIn.social({ provider: \"epic\", callbackURL: \"/dashboard\" });\n * ```\n */\nexport const authenticationClient = () => {\n  return {\n    id: \"authentication\",\n    $InferServerPlugin: {} as AuthenticationPlugin,\n    $ERROR_CODES: AUTHENTICATION_ERROR_CODES,\n  } satisfies BetterAuthClientPlugin;\n};\n\nexport { AUTHENTICATION_CALLBACK_ERRORS, AUTHENTICATION_ERROR_CODES } from \"./error-codes\";\n"],"mappings":";;;;;;;;;;;;;;;;;AAmBA,MAAa,6BAA6B;CACxC,OAAO;EACL,IAAI;EACJ,oBAAoB,CAAC;EACrB,cAAc;CAChB;AACF"}

package/dist/error-codes-CVA2nmg9.js

@@ -0,0 +1,16 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+// src/error-codes.ts
+const AUTHENTICATION_ERROR_CODES = defineErrorCodes({ EMAIL_DOMAIN_RESERVED: "This email domain is reserved for accounts from a sign-in provider and can't be used" });
+/**
+* `error` values in the query of the error page a failed sign-in redirects
+* to (better-auth's `/error`, or `errorCallbackURL`), besides better-auth's own.
+*/
+const AUTHENTICATION_CALLBACK_ERRORS = {
+	/** The player cancelled on Steam's sign-in page. */
+	STEAM_SIGN_IN_CANCELLED: "steam_sign_in_cancelled",
+	/** Steam's answer didn't check out, or Steam couldn't confirm it. */
+	STEAM_VERIFICATION_FAILED: "steam_verification_failed"
+};
+export { AUTHENTICATION_ERROR_CODES as n, AUTHENTICATION_CALLBACK_ERRORS as t };
+
+//# sourceMappingURL=error-codes-CVA2nmg9.js.map

package/dist/error-codes-CVA2nmg9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes-CVA2nmg9.js","names":[],"sources":["../src/error-codes.ts"],"sourcesContent":["import { defineErrorCodes } from \"@better-auth/core/utils/error-codes\";\n\nexport const AUTHENTICATION_ERROR_CODES = defineErrorCodes({\n  EMAIL_DOMAIN_RESERVED:\n    \"This email domain is reserved for accounts from a sign-in provider and can't be used\",\n});\n\nexport type AuthenticationErrorCode = keyof typeof AUTHENTICATION_ERROR_CODES;\n\n/**\n * `error` values in the query of the error page a failed sign-in redirects\n * to (better-auth's `/error`, or `errorCallbackURL`), besides better-auth's own.\n */\nexport const AUTHENTICATION_CALLBACK_ERRORS = {\n  /** The player cancelled on Steam's sign-in page. */\n  STEAM_SIGN_IN_CANCELLED: \"steam_sign_in_cancelled\",\n  /** Steam's answer didn't check out, or Steam couldn't confirm it. */\n  STEAM_VERIFICATION_FAILED: \"steam_verification_failed\",\n} as const;\n"],"mappings":";;AAEA,MAAa,6BAA6B,iBAAiB,EACzD,uBACE,uFACJ,CAAC;;;;;AAQD,MAAa,iCAAiC;;CAE5C,yBAAyB;;CAEzB,2BAA2B;AAC7B"}

package/dist/index-B-TXlJI5.d.ts

@@ -0,0 +1,327 @@
+import { OAuthMappedUser, ProviderOptions } from "@better-auth/core/oauth2";
+/** Like better-auth's `mapProfileToUser`: changes the user created from a profile. */
+type ProfileMapper<Profile extends object> = (profile: Profile) => OAuthMappedUser | Promise<OAuthMappedUser>;
+/**
+ * What every provider accepts, like better-auth's built-in providers:
+ * sign-up control and profile mapping.
+ */
+interface CommonProviderOptions<Profile extends object> {
+  /** Only existing users can sign in; new users get an error. */
+  disableSignUp?: boolean | undefined;
+  /** New users must sign in with `requestSignUp: true`. */
+  disableImplicitSignUp?: boolean | undefined;
+  /** Update the user's name and image from the provider on every sign-in. */
+  overrideUserInfoOnSignIn?: boolean | undefined;
+  /** Change the user created from the provider's profile. */
+  mapProfileToUser?: ProfileMapper<Profile> | undefined;
+  /**
+   * Domain of the placeholder email for users the provider gives no email
+   * (`<account id>@<domain>`). Defaults to `<provider id>.invalid`, a domain
+   * that can never receive email. Sign-ups with this domain are refused
+   * everywhere else, so nobody can claim a player's placeholder.
+   */
+  emailDomain?: string | undefined;
+}
+/** OAuth options shared by Epic and Xbox, like `github({ ... })`. */
+type OAuthClientOptions = Pick<ProviderOptions, "clientSecret" | "scope" | "disableDefaultScope" | "redirectURI" | "prompt"> & {
+  clientId: string;
+  clientSecret: string;
+};
+/** The Steam player, from the Steam Web API's `GetPlayerSummaries`. */
+interface SteamProfile {
+  /** 64-bit SteamID, as a string. */
+  steamid: string;
+  personaname?: string | undefined;
+  profileurl?: string | undefined;
+  avatar?: string | undefined;
+  avatarmedium?: string | undefined;
+  avatarfull?: string | undefined;
+  /** Only for public profiles. */
+  realname?: string | undefined;
+  /** Only for public profiles. */
+  loccountrycode?: string | undefined;
+  [key: string]: unknown;
+}
+interface SteamOptions extends CommonProviderOptions<SteamProfile> {
+  /**
+   * A Steam Web API key (https://steamcommunity.com/dev/apikey), to load
+   * the player's name and avatar. Without it, users are named after their
+   * SteamID. Never logged.
+   */
+  apiKey?: string | undefined;
+  /**
+   * Web API host. Defaults to `https://api.steampowered.com`; publisher keys
+   * use `https://partner.steam-api.com`.
+   */
+  apiBaseURL?: string | undefined;
+}
+/** The Epic Games account, from the ID token. */
+interface EpicProfile {
+  /** The Epic account id. */
+  sub: string;
+  /** The display name. */
+  dn?: string | undefined;
+  [key: string]: unknown;
+}
+type EpicOptions = OAuthClientOptions & CommonProviderOptions<EpicProfile> & {
+  /**
+   * Send a PKCE challenge. Epic doesn't document PKCE for web sign-in, so
+   * it is off by default.
+   */
+  pkce?: boolean | undefined;
+};
+/** The Xbox player, from the XSTS token's display claims. */
+interface XboxProfile {
+  /** The Xbox user id (XUID). */
+  xid: string;
+  /** The gamertag. */
+  gtg?: string | undefined;
+  /** User hash. */
+  uhs?: string | undefined;
+  [key: string]: unknown;
+}
+type XboxOptions = Omit<OAuthClientOptions, "scope" | "disableDefaultScope"> & CommonProviderOptions<XboxProfile> & {
+  /**
+   * The XSTS relying party. Defaults to `http://xboxlive.com`, which
+   * returns the XUID and gamertag; Xbox partners can use their own.
+   */
+  relyingParty?: string | undefined;
+  /** XSTS sandbox. Defaults to `RETAIL`. */
+  sandboxId?: string | undefined;
+  /** Request `xboxlive.offline_access` for a refresh token. Defaults to `false`. */
+  offlineAccess?: boolean | undefined;
+};
+interface AuthenticationOptions {
+  /** Sign in with Steam (OpenID 2.0). */
+  steam?: SteamOptions | undefined;
+  /** Sign in with Epic Games (Epic Account Services, OpenID Connect). */
+  epic?: EpicOptions | undefined;
+  /** Sign in with Xbox (Microsoft account, then Xbox Live). Needs Xbox developer access. */
+  xbox?: XboxOptions | undefined;
+}
+/** The provider ids this plugin adds. */
+type AuthenticationProviderId = "steam" | "epic" | "xbox";
+declare const AUTHENTICATION_ERROR_CODES: {
+  EMAIL_DOMAIN_RESERVED: import("better-auth").RawError<"EMAIL_DOMAIN_RESERVED">;
+};
+type AuthenticationErrorCode = keyof typeof AUTHENTICATION_ERROR_CODES;
+/**
+ * `error` values in the query of the error page a failed sign-in redirects
+ * to (better-auth's `/error`, or `errorCallbackURL`), besides better-auth's own.
+ */
+declare const AUTHENTICATION_CALLBACK_ERRORS: {
+  /** The player cancelled on Steam's sign-in page. */
+  readonly STEAM_SIGN_IN_CANCELLED: "steam_sign_in_cancelled";
+  /** Steam's answer didn't check out, or Steam couldn't confirm it. */
+  readonly STEAM_VERIFICATION_FAILED: "steam_verification_failed";
+};
+/**
+ * Adds Steam, Epic Games, and Xbox as social providers. They are used like
+ * better-auth's built-in ones: `signIn.social({ provider: "steam" })`,
+ * `linkSocial`, callbacks at `/callback/<provider>`, account linking,
+ * `callbackURL` checks, and sign-up options all work the same way.
+ *
+ * @example
+ * ```ts
+ * import { betterAuth } from "better-auth";
+ * import { authentication } from "@checodo/better-auth-authentication";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     authentication({
+ *       steam: { apiKey: process.env.STEAM_API_KEY },
+ *       epic: { clientId: "...", clientSecret: "..." },
+ *     }),
+ *   ],
+ * });
+ *
+ * // client
+ * await authClient.signIn.social({ provider: "steam", callbackURL: "/dashboard" });
+ * ```
+ */
+declare const authentication: (options: AuthenticationOptions) => {
+  id: "authentication";
+  version: string;
+  init(ctx: import("better-auth").AuthContext): {
+    context: {
+      socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+    };
+    options: {
+      databaseHooks: {
+        user?: {
+          create?: {
+            before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                email?: string | undefined;
+                emailVerified?: boolean | undefined;
+                name?: string | undefined;
+                image?: string | null | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (user: Partial<import("better-auth").User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                email?: string | undefined;
+                emailVerified?: boolean | undefined;
+                name?: string | undefined;
+                image?: string | null | undefined;
+              };
+            }>;
+            after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+        session?: {
+          create?: {
+            before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                userId?: string | undefined;
+                expiresAt?: Date | undefined;
+                token?: string | undefined;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                userId?: string | undefined;
+                expiresAt?: Date | undefined;
+                token?: string | undefined;
+                ipAddress?: string | null | undefined;
+                userAgent?: string | null | undefined;
+              };
+            }>;
+            after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+        account?: {
+          create?: {
+            before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                providerId?: string | undefined;
+                accountId?: string | undefined;
+                userId?: string | undefined;
+                accessToken?: string | null | undefined;
+                refreshToken?: string | null | undefined;
+                idToken?: string | null | undefined;
+                accessTokenExpiresAt?: Date | null | undefined;
+                refreshTokenExpiresAt?: Date | null | undefined;
+                scope?: string | null | undefined;
+                password?: string | null | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                providerId?: string | undefined;
+                accountId?: string | undefined;
+                userId?: string | undefined;
+                accessToken?: string | null | undefined;
+                refreshToken?: string | null | undefined;
+                idToken?: string | null | undefined;
+                accessTokenExpiresAt?: Date | null | undefined;
+                refreshTokenExpiresAt?: Date | null | undefined;
+                scope?: string | null | undefined;
+                password?: string | null | undefined;
+              };
+            }>;
+            after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+        verification?: {
+          create?: {
+            before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                value?: string | undefined;
+                expiresAt?: Date | undefined;
+                identifier?: string | undefined;
+              } & Record<string, any>;
+            }>;
+            after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          update?: {
+            before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+              data: {
+                [x: string]: any;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                value?: string | undefined;
+                expiresAt?: Date | undefined;
+                identifier?: string | undefined;
+              };
+            }>;
+            after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+          delete?: {
+            before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+            after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+          };
+        };
+      } | undefined;
+    };
+  };
+  hooks: {
+    before: {
+      matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+      handler: import("better-auth/api").AuthMiddleware;
+    }[];
+  };
+  $ERROR_CODES: {
+    EMAIL_DOMAIN_RESERVED: import("better-auth").RawError<"EMAIL_DOMAIN_RESERVED">;
+  };
+  options: AuthenticationOptions;
+};
+type AuthenticationPlugin = ReturnType<typeof authentication>;
+/** Lets `auth.$context.getPlugin("authentication")` infer this plugin's exact type. */
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    authentication: {
+      creator: typeof authentication;
+    };
+  }
+}
+export { AuthenticationErrorCode as a, CommonProviderOptions as c, SteamOptions as d, SteamProfile as f, AUTHENTICATION_ERROR_CODES as i, EpicOptions as l, XboxProfile as m, authentication as n, AuthenticationOptions as o, XboxOptions as p, AUTHENTICATION_CALLBACK_ERRORS as r, AuthenticationProviderId as s, AuthenticationPlugin as t, EpicProfile as u };
+//# sourceMappingURL=index-B-TXlJI5.d.ts.map

package/dist/index-B-TXlJI5.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-B-TXlJI5.d.ts","names":[],"sources":["../src/types.ts","../src/error-codes.ts","../src/index.ts"],"mappings":";;KAGY,cAAc,2BACxB,SAAS,YACN,kBAAkB,QAAQ;;;;;UAMd,sBAAsB;;EAErC;;EAEA;;EAEA;;EAEA,mBAAmB,cAAc;;;;;;;EAOjC;;;KAIU,qBAAqB,KAC/B;EAGA;EACA;;;UAIe;;EAEf;EACA;EACA;EACA;EACA;EACA;;EAEA;;EAEA;GACC;;UAGc,qBAAqB,sBAAsB;;;;;;EAM1D;;;;;EAKA;;;UAIe;;EAEf;;EAEA;GACC;;KAGS,cAAc,qBACxB,sBAAsB;;;;;EAKpB;;;UAIa;;EAEf;;EAEA;;EAEA;GACC;;KAGS,cAAc,KAAK,uDAC7B,sBAAsB;;;;;EAKpB;;EAEA;;EAEA;;UAGa;;EAEf,QAAQ;;EAER,OAAO;;EAEP,OAAO;;;KAIG;cCtHC;;;KAKD,uCAAuC;;;;;cAMtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCmCA,iBAAkB,SAAS;;;;;;;;;;UA0Cs7uC;YAA6P,UAAC,4BAAA,OAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;;YAA8Q,SAAC,4BAAA,OAAA,yBAAA,+BAAA,kCAAA;;UAAwH;YAA6P,UAAC,MAAA,8BAAA,QAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;;;YAAuR,SAAC,4BAAA,OAAA,yBAAA,+BAAA,kCAAA;;UAAwH;YAAwK,UAAC,4BAAA,OAAA,yBAAA,+BAAA,kCAAA;YAA0M,SAAC,4BAAA,OAAA,yBAAA,+BAAA,kCAAA;;;;UAAmL;YAAmQ,UAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;;;YAA0R,SAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;;UAAuK;YAAgQ,UAAC,SAAA,8BAAA,WAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;;;;YAAmS,SAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;;UAA8H;YAA8K,UAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;YAAmN,SAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;;;;UAAyL;YAAmQ,UAAC,+BAAA,SAAA,+BAAA,kCAAA;;;;;;;;;;;;;;;;;YAAgQ,SAAC,+BAAA,SAAA,+BAAA,kCAAA;;UAA6I;YAA+P,UAAC,SAAA,8BAAA,WAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;;;;;;;;;YAAmS,SAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;;UAA8H;YAA+K,UAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;YAAoN,SAAC,+BAAA,UAAA,yBAAA,+BAAA,kCAAA;;;;UAAmM;YAA6Q,UAAC,oCAAA,eAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;YAA8S,SAAC,oCAAA,eAAA,yBAAA,+BAAA,kCAAA;;UAAwI;YAA6Q,UAAC,cAAA,8BAAA,gBAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;;YAAuT,SAAC,oCAAA,eAAA,yBAAA,+BAAA,kCAAA;;UAAwI;YAAwL,UAAC,oCAAA,eAAA,yBAAA,+BAAA,kCAAA;YAAkO,SAAC,oCAAA,eAAA,yBAAA,+BAAA,kCAAA;;;;;;;;;;;;;;;;;KAV519C,uBAAuB,kBAAkB;;;YAIzC,yBAAyB,aAAa;IAC9C;MACE,gBAAgB"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+import { a as AuthenticationErrorCode, c as CommonProviderOptions, d as SteamOptions, f as SteamProfile, i as AUTHENTICATION_ERROR_CODES, l as EpicOptions, m as XboxProfile, n as authentication, o as AuthenticationOptions, p as XboxOptions, r as AUTHENTICATION_CALLBACK_ERRORS, s as AuthenticationProviderId, t as AuthenticationPlugin, u as EpicProfile } from "./index-B-TXlJI5.js";
+export { AUTHENTICATION_CALLBACK_ERRORS, AUTHENTICATION_ERROR_CODES, type AuthenticationErrorCode, type AuthenticationOptions, AuthenticationPlugin, type AuthenticationProviderId, type CommonProviderOptions, type EpicOptions, type EpicProfile, type SteamOptions, type SteamProfile, type XboxOptions, type XboxProfile, authentication };

package/dist/index.js

@@ -0,0 +1,578 @@
+import { n as AUTHENTICATION_ERROR_CODES, t as AUTHENTICATION_CALLBACK_ERRORS } from "./error-codes-CVA2nmg9.js";
+import { getCurrentAdapter, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { createAuthorizationURL, refreshAccessToken, validateAuthorizationCode, validateToken } from "@better-auth/core/oauth2";
+import { generateRandomString } from "better-auth/crypto";
+// package.json
+var version = "0.1.0";
+// src/utils/email.ts
+/** Hostname labels: letters, digits, hyphens; at least two labels. */
+const DOMAIN = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9-]{2,63}$/;
+function isValidEmailDomain(domain) {
+	return DOMAIN.test(domain);
+}
+/**
+* A placeholder email for a user the provider gives no email:
+* `<account id>@<domain>`. Unique per account, and on a domain that can't
+* receive email (`.invalid` by default).
+*/
+function placeholderEmail(accountId, domain) {
+	return `${accountId.toLowerCase()}@${domain}`;
+}
+function hasDomain(email, domain) {
+	return email.toLowerCase().endsWith(`@${domain}`);
+}
+// src/hooks/reserved-email.ts
+/**
+* Placeholder emails (`<account id>@steam.invalid`) belong to the provider
+* they came from:
+*
+* - If anyone could sign up with one, they could take a player's
+*   placeholder first and block (or, with careless account linking, take
+*   over) that player's sign-in. So users with these domains can only be
+*   created or changed by that provider's own callback, or by server code
+*   outside a request.
+* - With `overrideUserInfoOnSignIn`, better-auth writes the provider's
+*   email back on every sign-in. For a user with a real email (who linked
+*   the provider account, or changed their email later) that would replace
+*   it with the placeholder; the email change is dropped instead.
+*/
+function createReservedEmailHooks(definitions) {
+	/** The provider whose placeholder `email` is, if the request is that provider's callback; throws otherwise. */
+	const ownerOf = (email, context) => {
+		if (typeof email !== "string" || !context) return null;
+		const owner = definitions.find((definition) => hasDomain(email, definition.emailDomain));
+		if (!owner) return null;
+		const params = context.params;
+		if (context.path !== "/callback/:id" || params?.id !== owner.provider.id) throw APIError.from("BAD_REQUEST", AUTHENTICATION_ERROR_CODES.EMAIL_DOMAIN_RESERVED);
+		return owner;
+	};
+	return { user: {
+		create: { before: async (user, context) => {
+			ownerOf(user.email, context);
+		} },
+		update: { before: async (data, context) => {
+			if (!ownerOf(data.email, context) || !context) return;
+			if (!await (await getCurrentAdapter(context.context.adapter)).findOne({
+				model: "user",
+				where: [{
+					field: "email",
+					value: data.email.toLowerCase()
+				}]
+			})) return { data: {
+				email: void 0,
+				emailVerified: void 0
+			} };
+		} }
+	} };
+}
+// ../plugin-utils/src/options.ts
+/**
+* Returns a function that throws an option error prefixed with the plugin
+* id, `[referral] "codeLength" must be ...`, for validating options at
+* plugin creation.
+*/
+function createFail(pluginId) {
+	return (message) => {
+		throw new Error(`[${pluginId}] ${message}`);
+	};
+}
+// src/providers/epic.ts
+/**
+* From Epic's discovery document,
+* https://api.epicgames.dev/epic/oauth/v1/.well-known/openid-configuration
+*/
+const EPIC_ISSUER = "https://api.epicgames.dev/epic/oauth/v1";
+const EPIC_AUTHORIZATION_ENDPOINT = "https://www.epicgames.com/id/authorize";
+const EPIC_TOKEN_ENDPOINT = "https://api.epicgames.dev/epic/oauth/v1/token";
+const EPIC_JWKS_ENDPOINT = "https://api.epicgames.dev/epic/oauth/v1/.well-known/jwks.json";
+/** `basic_profile` is required by Epic Account Services; `openid` returns an ID token. */
+const DEFAULT_SCOPES = ["basic_profile", "openid"];
+/**
+* Epic Games (Epic Account Services) over OpenID Connect. The player is
+* identified by the ID token, verified against Epic's keys, issuer, and
+* this client id. Epic shares no email address.
+*/
+function epic(options, emailDomain) {
+	return {
+		provider: {
+			id: "epic",
+			name: "Epic Games",
+			issuer: EPIC_ISSUER,
+			accountSubject: ({ profile }) => profile.sub,
+			createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
+				const allScopes = options.disableDefaultScope ? [] : [...DEFAULT_SCOPES];
+				if (options.scope) allScopes.push(...options.scope);
+				if (scopes) allScopes.push(...scopes);
+				return createAuthorizationURL({
+					id: "epic",
+					options,
+					authorizationEndpoint: EPIC_AUTHORIZATION_ENDPOINT,
+					scopes: [...new Set(allScopes)],
+					state,
+					codeVerifier: options.pkce ? codeVerifier : void 0,
+					redirectURI,
+					prompt: options.prompt,
+					additionalParams
+				});
+			},
+			validateAuthorizationCode({ code, codeVerifier, redirectURI }) {
+				return validateAuthorizationCode({
+					code,
+					codeVerifier: options.pkce ? codeVerifier : void 0,
+					redirectURI,
+					options,
+					tokenEndpoint: EPIC_TOKEN_ENDPOINT,
+					authentication: "basic"
+				});
+			},
+			refreshAccessToken: (refreshToken) => refreshAccessToken({
+				refreshToken,
+				options: {
+					clientId: options.clientId,
+					clientSecret: options.clientSecret
+				},
+				tokenEndpoint: EPIC_TOKEN_ENDPOINT,
+				authentication: "basic"
+			}),
+			async getUserInfo(tokens) {
+				if (!tokens.idToken) {
+					tryGetCurrentAuthEndpointContext()?.context.logger.error("[authentication] Epic returned no ID token; keep the \"openid\" scope");
+					return null;
+				}
+				let payload;
+				try {
+					({payload} = await validateToken(tokens.idToken, EPIC_JWKS_ENDPOINT, {
+						issuer: EPIC_ISSUER,
+						audience: options.clientId,
+						requiredClaims: ["sub"]
+					}));
+				} catch (error) {
+					tryGetCurrentAuthEndpointContext()?.context.logger.error("[authentication] Epic's ID token didn't verify", error);
+					return null;
+				}
+				const mapped = await options.mapProfileToUser?.(payload);
+				return {
+					user: {
+						name: payload.dn || `Epic ${payload.sub}`,
+						email: placeholderEmail(payload.sub, emailDomain),
+						emailVerified: false,
+						...mapped
+					},
+					data: payload
+				};
+			},
+			disableSignUp: options.disableSignUp,
+			disableImplicitSignUp: options.disableImplicitSignUp,
+			options: {
+				clientId: options.clientId,
+				clientSecret: options.clientSecret,
+				redirectURI: options.redirectURI,
+				disableSignUp: options.disableSignUp,
+				disableImplicitSignUp: options.disableImplicitSignUp,
+				overrideUserInfoOnSignIn: options.overrideUserInfoOnSignIn
+			}
+		},
+		emailDomain
+	};
+}
+// src/providers/steam.ts
+const STEAM_OPENID_ENDPOINT = "https://steamcommunity.com/openid/login";
+const OPENID_NS = "http://specs.openid.net/auth/2.0";
+const IDENTIFIER_SELECT = "http://specs.openid.net/auth/2.0/identifier_select";
+const CLAIMED_ID = /^https:\/\/steamcommunity\.com\/openid\/id\/(\d{17})$/;
+/** OpenID 2.0 requires these to be signed in a positive assertion. */
+const REQUIRED_SIGNED = [
+	"op_endpoint",
+	"return_to",
+	"response_nonce",
+	"assoc_handle",
+	"claimed_id",
+	"identity"
+];
+/** How long the one-time code from the callback hook is valid. */
+const CODE_TTL_MS = 6e4;
+const STEAM_TIMEOUT_MS = 1e4;
+const codeIdentifier = (code) => `steam-openid:${code}`;
+/** Where Steam sends the player back: better-auth's own callback, with the OAuth state. */
+function steamReturnTo(redirectURI, state) {
+	const url = new URL(redirectURI);
+	url.searchParams.set("state", state);
+	return url.toString();
+}
+/** Steam's sign-in page for an OpenID 2.0 `checkid_setup` request. */
+function steamAuthorizationURL(returnTo) {
+	const url = new URL(STEAM_OPENID_ENDPOINT);
+	url.searchParams.set("openid.ns", OPENID_NS);
+	url.searchParams.set("openid.mode", "checkid_setup");
+	url.searchParams.set("openid.return_to", returnTo);
+	url.searchParams.set("openid.realm", new URL(returnTo).origin);
+	url.searchParams.set("openid.identity", IDENTIFIER_SELECT);
+	url.searchParams.set("openid.claimed_id", IDENTIFIER_SELECT);
+	return url;
+}
+/** Parses OpenID's key-value form (`key:value` lines). */
+function parseKeyValue(text) {
+	const result = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		const separator = line.indexOf(":");
+		if (separator > 0) result.set(line.slice(0, separator), line.slice(separator + 1).trim());
+	}
+	return result;
+}
+/**
+* Checks Steam's positive assertion and returns the SteamID64, or `null`.
+* Everything in the query is untrusted until Steam confirms it: the
+* fields are checked against what this request expects, then sent back to
+* Steam (`check_authentication`), which verifies the signature and that
+* the nonce wasn't used before.
+*/
+async function verifySteamAssertion(query, expectedReturnTo) {
+	const get = (key) => {
+		const value = query[`openid.${key}`];
+		return typeof value === "string" ? value : void 0;
+	};
+	if (get("ns") !== OPENID_NS || get("mode") !== "id_res") return null;
+	if (get("op_endpoint") !== "https://steamcommunity.com/openid/login") return null;
+	if (get("return_to") !== expectedReturnTo) return null;
+	const claimedId = get("claimed_id");
+	const steamId = claimedId ? CLAIMED_ID.exec(claimedId)?.[1] : void 0;
+	if (!steamId || get("identity") !== claimedId) return null;
+	const signed = new Set((get("signed") ?? "").split(","));
+	if (!REQUIRED_SIGNED.every((field) => signed.has(field)) || !get("sig")) return null;
+	const body = new URLSearchParams();
+	for (const [key, value] of Object.entries(query)) if (key.startsWith("openid.") && typeof value === "string") body.set(key, value);
+	body.set("openid.mode", "check_authentication");
+	const response = await fetch(STEAM_OPENID_ENDPOINT, {
+		method: "POST",
+		body,
+		redirect: "error",
+		signal: AbortSignal.timeout(STEAM_TIMEOUT_MS)
+	});
+	if (!response.ok) return null;
+	const answer = parseKeyValue(await response.text());
+	return answer.get("ns") === OPENID_NS && answer.get("is_valid") === "true" ? steamId : null;
+}
+/** Loads the player's public profile; `null` if it can't be loaded. */
+async function fetchSteamProfile(steamId, apiKey, apiBaseURL) {
+	const url = new URL("/ISteamUser/GetPlayerSummaries/v2/", apiBaseURL);
+	url.searchParams.set("key", apiKey);
+	url.searchParams.set("steamids", steamId);
+	const response = await fetch(url, { signal: AbortSignal.timeout(STEAM_TIMEOUT_MS) });
+	if (!response.ok) return null;
+	return (await response.json()).response?.players?.find((p) => p.steamid === steamId) ?? null;
+}
+/**
+* Steam uses OpenID 2.0, not OAuth: it sends the player back with a signed
+* assertion instead of a code. Steam's `return_to` is better-auth's own
+* `/callback/steam`; a before-hook there verifies the assertion and swaps
+* it for a one-time `code`, which `validateAuthorizationCode` redeems. The
+* rest is better-auth's callback, like for any provider: state and CSRF
+* check, user and account, session, redirect.
+*/
+function steam(options, emailDomain) {
+	const apiBaseURL = options.apiBaseURL ?? "https://api.steampowered.com";
+	return {
+		provider: {
+			id: "steam",
+			name: "Steam",
+			accountSubject: ({ profile }) => profile.steamid,
+			createAuthorizationURL({ state, redirectURI }) {
+				return steamAuthorizationURL(steamReturnTo(redirectURI, state));
+			},
+			async validateAuthorizationCode({ code }) {
+				const ctx = tryGetCurrentAuthEndpointContext();
+				if (!ctx) return null;
+				const verified = await ctx.context.internalAdapter.consumeVerificationValue(codeIdentifier(code));
+				if (!verified || new Date(verified.expiresAt).getTime() < Date.now()) return null;
+				return {
+					tokenType: "steam-openid",
+					raw: { steamid: verified.value }
+				};
+			},
+			async getUserInfo(tokens) {
+				const steamid = tokens.raw?.steamid;
+				if (typeof steamid !== "string") return null;
+				let profile = { steamid };
+				if (options.apiKey) try {
+					profile = await fetchSteamProfile(steamid, options.apiKey, apiBaseURL) ?? profile;
+				} catch {
+					tryGetCurrentAuthEndpointContext()?.context.logger.warn("[authentication] could not load the Steam profile");
+				}
+				const mapped = await options.mapProfileToUser?.(profile);
+				return {
+					user: {
+						name: profile.personaname || `Steam ${steamid}`,
+						email: placeholderEmail(steamid, emailDomain),
+						emailVerified: false,
+						image: profile.avatarfull,
+						...mapped
+					},
+					data: profile
+				};
+			},
+			disableSignUp: options.disableSignUp,
+			disableImplicitSignUp: options.disableImplicitSignUp,
+			options: {
+				disableSignUp: options.disableSignUp,
+				disableImplicitSignUp: options.disableImplicitSignUp,
+				overrideUserInfoOnSignIn: options.overrideUserInfoOnSignIn
+			}
+		},
+		emailDomain,
+		hooks: { before: [{
+			matcher: (context) => context.path === "/callback/:id" && context.params?.id === "steam",
+			handler: createAuthMiddleware(async (ctx) => {
+				const query = ctx.query ?? {};
+				const state = typeof query.state === "string" ? query.state : void 0;
+				const fail = (error) => ({ context: { query: {
+					state,
+					code: "",
+					error
+				} } });
+				if (!state || ctx.method !== "GET") return fail(AUTHENTICATION_CALLBACK_ERRORS.STEAM_VERIFICATION_FAILED);
+				if (query["openid.mode"] === "cancel") return fail(AUTHENTICATION_CALLBACK_ERRORS.STEAM_SIGN_IN_CANCELLED);
+				let steamId = null;
+				try {
+					steamId = await verifySteamAssertion(query, steamReturnTo(`${ctx.context.baseURL}/callback/steam`, state));
+				} catch (error) {
+					ctx.context.logger.error("[authentication] Steam verification failed", error);
+				}
+				if (!steamId) return fail(AUTHENTICATION_CALLBACK_ERRORS.STEAM_VERIFICATION_FAILED);
+				const code = generateRandomString(32);
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: codeIdentifier(code),
+					value: steamId,
+					expiresAt: new Date(Date.now() + CODE_TTL_MS)
+				});
+				return { context: { query: {
+					state,
+					code
+				} } };
+			})
+		}] }
+	};
+}
+// src/providers/xbox.ts
+/**
+* Microsoft's documented flow for Xbox sign-in on websites ("Xbox services
+* sign-in for title websites", Microsoft Game Development Kit): Microsoft
+* account OAuth on the `consumers` tenant with `xboxlive.signin`, then an
+* Xbox user token, then an XSTS token whose claims name the player.
+*/
+const XBOX_AUTHORIZATION_ENDPOINT = "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize";
+const XBOX_TOKEN_ENDPOINT = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token";
+const XBOX_USER_AUTH_ENDPOINT = "https://user.auth.xboxlive.com/user/authenticate";
+const XBOX_XSTS_ENDPOINT = "https://xsts.auth.xboxlive.com/xsts/authorize";
+const XBOX_TIMEOUT_MS = 1e4;
+async function postXbox(url, body) {
+	const response = await fetch(url, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			accept: "application/json",
+			"x-xbl-contract-version": "1"
+		},
+		body: JSON.stringify(body),
+		redirect: "error",
+		signal: AbortSignal.timeout(XBOX_TIMEOUT_MS)
+	});
+	if (!response.ok) {
+		const xErr = response.headers.get("x-err") ?? "none";
+		tryGetCurrentAuthEndpointContext()?.context.logger.error(`[authentication] Xbox token request to ${new URL(url).host} failed (${response.status}, XErr ${xErr})`);
+		return null;
+	}
+	try {
+		return await response.json();
+	} catch {
+		tryGetCurrentAuthEndpointContext()?.context.logger.error(`[authentication] Xbox token response from ${new URL(url).host} isn't JSON`);
+		return null;
+	}
+}
+/** Exchanges a Microsoft access token for the player's XSTS claims (XUID, gamertag). */
+async function fetchXboxProfile(accessToken, { relyingParty, sandboxId }) {
+	const user = await postXbox(XBOX_USER_AUTH_ENDPOINT, {
+		RelyingParty: "http://auth.xboxlive.com",
+		TokenType: "JWT",
+		Properties: {
+			AuthMethod: "RPS",
+			SiteName: "user.auth.xboxlive.com",
+			RpsTicket: `d=${accessToken}`
+		}
+	});
+	if (!user?.Token) return null;
+	const xsts = await postXbox(XBOX_XSTS_ENDPOINT, {
+		RelyingParty: relyingParty,
+		TokenType: "JWT",
+		Properties: {
+			SandboxId: sandboxId,
+			UserTokens: [user.Token]
+		}
+	});
+	const claims = xsts?.DisplayClaims?.xui?.[0];
+	if (!claims?.xid) {
+		if (xsts) tryGetCurrentAuthEndpointContext()?.context.logger.error("[authentication] the XSTS token has no XUID (xid claim); check the relying party");
+		return null;
+	}
+	return claims;
+}
+/**
+* Xbox, for apps enrolled in the Xbox developer program (Microsoft only
+* grants `xboxlive.signin` to them). The player is identified by the XUID
+* from XSTS; Xbox shares no email address.
+*/
+function xbox(options, emailDomain) {
+	const relyingParty = options.relyingParty ?? "http://xboxlive.com";
+	const sandboxId = options.sandboxId ?? "RETAIL";
+	const scopes = ["xboxlive.signin", ...options.offlineAccess ? ["xboxlive.offline_access"] : []];
+	return {
+		provider: {
+			id: "xbox",
+			name: "Xbox",
+			accountSubject: ({ profile }) => profile.xid,
+			createAuthorizationURL({ state, codeVerifier, redirectURI, additionalParams }) {
+				return createAuthorizationURL({
+					id: "xbox",
+					options,
+					authorizationEndpoint: XBOX_AUTHORIZATION_ENDPOINT,
+					scopes,
+					state,
+					codeVerifier,
+					redirectURI,
+					prompt: options.prompt,
+					additionalParams
+				});
+			},
+			validateAuthorizationCode({ code, codeVerifier, redirectURI }) {
+				return validateAuthorizationCode({
+					code,
+					codeVerifier,
+					redirectURI,
+					options,
+					tokenEndpoint: XBOX_TOKEN_ENDPOINT,
+					authentication: "post"
+				});
+			},
+			refreshAccessToken: (refreshToken) => refreshAccessToken({
+				refreshToken,
+				options: {
+					clientId: options.clientId,
+					clientSecret: options.clientSecret
+				},
+				tokenEndpoint: XBOX_TOKEN_ENDPOINT,
+				authentication: "post"
+			}),
+			async getUserInfo(tokens) {
+				if (!tokens.accessToken) return null;
+				let profile = null;
+				try {
+					profile = await fetchXboxProfile(tokens.accessToken, {
+						relyingParty,
+						sandboxId
+					});
+				} catch (error) {
+					tryGetCurrentAuthEndpointContext()?.context.logger.error("[authentication] Xbox Live couldn't be reached", error);
+				}
+				if (!profile) return null;
+				const mapped = await options.mapProfileToUser?.(profile);
+				return {
+					user: {
+						name: profile.gtg || `Xbox ${profile.xid}`,
+						email: placeholderEmail(profile.xid, emailDomain),
+						emailVerified: false,
+						...mapped
+					},
+					data: profile
+				};
+			},
+			disableSignUp: options.disableSignUp,
+			disableImplicitSignUp: options.disableImplicitSignUp,
+			options: {
+				clientId: options.clientId,
+				clientSecret: options.clientSecret,
+				redirectURI: options.redirectURI,
+				disableSignUp: options.disableSignUp,
+				disableImplicitSignUp: options.disableImplicitSignUp,
+				overrideUserInfoOnSignIn: options.overrideUserInfoOnSignIn
+			}
+		},
+		emailDomain
+	};
+}
+// src/options.ts
+const fail = createFail("authentication");
+function emailDomain(providerId, domain) {
+	const resolved = (domain ?? `${providerId}.invalid`).toLowerCase();
+	if (!isValidEmailDomain(resolved)) fail(`"${providerId}.emailDomain" must be a domain name, got ${JSON.stringify(domain)}.`);
+	return resolved;
+}
+function requireClient(providerId, options) {
+	if (typeof options.clientId !== "string" || options.clientId === "") fail(`"${providerId}.clientId" is required.`);
+	if (typeof options.clientSecret !== "string" || options.clientSecret === "") fail(`"${providerId}.clientSecret" is required.`);
+}
+/** Validates the options once, at creation, and builds the providers. */
+function resolveProviders(options) {
+	const definitions = [];
+	if (options.steam) {
+		if (options.steam.apiKey !== void 0 && options.steam.apiKey.trim() === "") fail("\"steam.apiKey\" is empty; leave it out to sign in without loading profiles.");
+		definitions.push(steam(options.steam, emailDomain("steam", options.steam.emailDomain)));
+	}
+	if (options.epic) {
+		requireClient("epic", options.epic);
+		definitions.push(epic(options.epic, emailDomain("epic", options.epic.emailDomain)));
+	}
+	if (options.xbox) {
+		requireClient("xbox", options.xbox);
+		definitions.push(xbox(options.xbox, emailDomain("xbox", options.xbox.emailDomain)));
+	}
+	if (definitions.length === 0) fail("Configure at least one provider: steam, epic, or xbox.");
+	const domains = definitions.map((definition) => definition.emailDomain);
+	if (new Set(domains).size !== domains.length) fail("Each provider needs an email domain of its own.");
+	return definitions;
+}
+// src/index.ts
+/**
+* Adds Steam, Epic Games, and Xbox as social providers. They are used like
+* better-auth's built-in ones: `signIn.social({ provider: "steam" })`,
+* `linkSocial`, callbacks at `/callback/<provider>`, account linking,
+* `callbackURL` checks, and sign-up options all work the same way.
+*
+* @example
+* ```ts
+* import { betterAuth } from "better-auth";
+* import { authentication } from "@checodo/better-auth-authentication";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     authentication({
+*       steam: { apiKey: process.env.STEAM_API_KEY },
+*       epic: { clientId: "...", clientSecret: "..." },
+*     }),
+*   ],
+* });
+*
+* // client
+* await authClient.signIn.social({ provider: "steam", callbackURL: "/dashboard" });
+* ```
+*/
+const authentication = (options) => {
+	const definitions = resolveProviders(options);
+	return {
+		id: "authentication",
+		version,
+		init(ctx) {
+			const ids = new Set(definitions.map((definition) => definition.provider.id));
+			for (const existing of ctx.socialProviders) if (ids.has(existing.id)) ctx.logger.warn(`[authentication] the "${existing.id}" provider replaces a social provider with the same id`);
+			return {
+				context: { socialProviders: [...definitions.map((definition) => definition.provider), ...ctx.socialProviders.filter((provider) => !ids.has(provider.id))] },
+				options: { databaseHooks: createReservedEmailHooks(definitions) }
+			};
+		},
+		hooks: { before: definitions.flatMap((definition) => definition.hooks?.before ?? []) },
+		$ERROR_CODES: AUTHENTICATION_ERROR_CODES,
+		options
+	};
+};
+export { AUTHENTICATION_CALLBACK_ERRORS, AUTHENTICATION_ERROR_CODES, authentication };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../package.json","../src/utils/email.ts","../src/hooks/reserved-email.ts","../../plugin-utils/src/options.ts","../src/providers/epic.ts","../src/providers/steam.ts","../src/providers/xbox.ts","../src/options.ts","../src/index.ts"],"sourcesContent":["","/** Hostname labels: letters, digits, hyphens; at least two labels. */\nconst DOMAIN = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z0-9-]{2,63}$/;\n\nexport function isValidEmailDomain(domain: string): boolean {\n  return DOMAIN.test(domain);\n}\n\n/**\n * A placeholder email for a user the provider gives no email:\n * `<account id>@<domain>`. Unique per account, and on a domain that can't\n * receive email (`.invalid` by default).\n */\nexport function placeholderEmail(accountId: string, domain: string): string {\n  return `${accountId.toLowerCase()}@${domain}`;\n}\n\nexport function hasDomain(email: string, domain: string): boolean {\n  return email.toLowerCase().endsWith(`@${domain}`);\n}\n","import type { BetterAuthOptions, GenericEndpointContext } from \"@better-auth/core\";\nimport { getCurrentAdapter } from \"@better-auth/core/context\";\nimport { APIError } from \"better-auth/api\";\nimport { AUTHENTICATION_ERROR_CODES } from \"../error-codes\";\nimport type { ProviderDefinition } from \"../providers/types\";\nimport { hasDomain } from \"../utils/email\";\n\ntype Context = GenericEndpointContext | null | undefined;\n\n/**\n * Placeholder emails (`<account id>@steam.invalid`) belong to the provider\n * they came from:\n *\n * - If anyone could sign up with one, they could take a player's\n *   placeholder first and block (or, with careless account linking, take\n *   over) that player's sign-in. So users with these domains can only be\n *   created or changed by that provider's own callback, or by server code\n *   outside a request.\n * - With `overrideUserInfoOnSignIn`, better-auth writes the provider's\n *   email back on every sign-in. For a user with a real email (who linked\n *   the provider account, or changed their email later) that would replace\n *   it with the placeholder; the email change is dropped instead.\n */\nexport function createReservedEmailHooks(\n  definitions: ProviderDefinition[],\n): BetterAuthOptions[\"databaseHooks\"] {\n  /** The provider whose placeholder `email` is, if the request is that provider's callback; throws otherwise. */\n  const ownerOf = (email: unknown, context: Context): ProviderDefinition | null => {\n    if (typeof email !== \"string\" || !context) return null;\n    const owner = definitions.find((definition) => hasDomain(email, definition.emailDomain));\n    if (!owner) return null;\n    const params = context.params as { id?: unknown } | undefined;\n    if (context.path !== \"/callback/:id\" || params?.id !== owner.provider.id) {\n      throw APIError.from(\"BAD_REQUEST\", AUTHENTICATION_ERROR_CODES.EMAIL_DOMAIN_RESERVED);\n    }\n    return owner;\n  };\n\n  return {\n    user: {\n      create: {\n        before: async (user, context) => {\n          ownerOf(user.email, context);\n        },\n      },\n      update: {\n        before: async (data, context) => {\n          if (!ownerOf(data.email, context) || !context) return;\n          // Emails are unique: if no user has the placeholder, this update\n          // would replace another email with it.\n          const adapter = await getCurrentAdapter(context.context.adapter);\n          const holder = await adapter.findOne({\n            model: \"user\",\n            where: [{ field: \"email\", value: (data.email as string).toLowerCase() }],\n          });\n          if (!holder) return { data: { email: undefined, emailVerified: undefined } };\n        },\n      },\n    },\n  };\n}\n","/**\n * Returns a function that throws an option error prefixed with the plugin\n * id, `[referral] \"codeLength\" must be ...`, for validating options at\n * plugin creation.\n */\nexport function createFail(pluginId: string): (message: string) => never {\n  return (message) => {\n    throw new Error(`[${pluginId}] ${message}`);\n  };\n}\n","import { tryGetCurrentAuthEndpointContext } from \"@better-auth/core/context\";\nimport type { OAuthProvider } from \"@better-auth/core/oauth2\";\nimport {\n  createAuthorizationURL,\n  refreshAccessToken,\n  validateAuthorizationCode,\n  validateToken,\n} from \"@better-auth/core/oauth2\";\nimport type { EpicOptions, EpicProfile } from \"../types\";\nimport { placeholderEmail } from \"../utils/email\";\nimport type { ProviderDefinition } from \"./types\";\n\n/**\n * From Epic's discovery document,\n * https://api.epicgames.dev/epic/oauth/v1/.well-known/openid-configuration\n */\nexport const EPIC_ISSUER = \"https://api.epicgames.dev/epic/oauth/v1\";\nexport const EPIC_AUTHORIZATION_ENDPOINT = \"https://www.epicgames.com/id/authorize\";\nexport const EPIC_TOKEN_ENDPOINT = \"https://api.epicgames.dev/epic/oauth/v1/token\";\nexport const EPIC_JWKS_ENDPOINT = \"https://api.epicgames.dev/epic/oauth/v1/.well-known/jwks.json\";\n/** `basic_profile` is required by Epic Account Services; `openid` returns an ID token. */\nconst DEFAULT_SCOPES = [\"basic_profile\", \"openid\"];\n\n/**\n * Epic Games (Epic Account Services) over OpenID Connect. The player is\n * identified by the ID token, verified against Epic's keys, issuer, and\n * this client id. Epic shares no email address.\n */\nexport function epic(options: EpicOptions, emailDomain: string): ProviderDefinition {\n  const provider: OAuthProvider<EpicProfile> = {\n    id: \"epic\",\n    name: \"Epic Games\",\n    issuer: EPIC_ISSUER,\n    accountSubject: ({ profile }) => profile.sub,\n    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {\n      const allScopes = options.disableDefaultScope ? [] : [...DEFAULT_SCOPES];\n      if (options.scope) allScopes.push(...options.scope);\n      if (scopes) allScopes.push(...scopes);\n      return createAuthorizationURL({\n        id: \"epic\",\n        options,\n        authorizationEndpoint: EPIC_AUTHORIZATION_ENDPOINT,\n        scopes: [...new Set(allScopes)],\n        state,\n        codeVerifier: options.pkce ? codeVerifier : undefined,\n        redirectURI,\n        prompt: options.prompt,\n        additionalParams,\n      });\n    },\n    validateAuthorizationCode({ code, codeVerifier, redirectURI }) {\n      return validateAuthorizationCode({\n        code,\n        codeVerifier: options.pkce ? codeVerifier : undefined,\n        redirectURI,\n        options,\n        tokenEndpoint: EPIC_TOKEN_ENDPOINT,\n        authentication: \"basic\",\n      });\n    },\n    refreshAccessToken: (refreshToken) =>\n      refreshAccessToken({\n        refreshToken,\n        options: { clientId: options.clientId, clientSecret: options.clientSecret },\n        tokenEndpoint: EPIC_TOKEN_ENDPOINT,\n        authentication: \"basic\",\n      }),\n    async getUserInfo(tokens) {\n      if (!tokens.idToken) {\n        tryGetCurrentAuthEndpointContext()?.context.logger.error(\n          '[authentication] Epic returned no ID token; keep the \"openid\" scope',\n        );\n        return null;\n      }\n      let payload: EpicProfile;\n      try {\n        ({ payload } = await validateToken<EpicProfile>(tokens.idToken, EPIC_JWKS_ENDPOINT, {\n          issuer: EPIC_ISSUER,\n          audience: options.clientId,\n          requiredClaims: [\"sub\"],\n        }));\n      } catch (error) {\n        // `null` fails the sign-in with better-auth's error redirect, not a 500.\n        tryGetCurrentAuthEndpointContext()?.context.logger.error(\n          \"[authentication] Epic's ID token didn't verify\",\n          error,\n        );\n        return null;\n      }\n      const mapped = await options.mapProfileToUser?.(payload);\n      return {\n        user: {\n          name: payload.dn || `Epic ${payload.sub}`,\n          email: placeholderEmail(payload.sub, emailDomain),\n          emailVerified: false,\n          ...mapped,\n        },\n        data: payload,\n      };\n    },\n    disableSignUp: options.disableSignUp,\n    disableImplicitSignUp: options.disableImplicitSignUp,\n    options: {\n      clientId: options.clientId,\n      clientSecret: options.clientSecret,\n      redirectURI: options.redirectURI,\n      disableSignUp: options.disableSignUp,\n      disableImplicitSignUp: options.disableImplicitSignUp,\n      overrideUserInfoOnSignIn: options.overrideUserInfoOnSignIn,\n    },\n  };\n  return { provider: provider as unknown as OAuthProvider, emailDomain };\n}\n","import type { HookEndpointContext } from \"@better-auth/core\";\nimport { tryGetCurrentAuthEndpointContext } from \"@better-auth/core/context\";\nimport type { OAuth2Tokens, OAuthProvider } from \"@better-auth/core/oauth2\";\nimport { createAuthMiddleware } from \"better-auth/api\";\nimport { generateRandomString } from \"better-auth/crypto\";\nimport { AUTHENTICATION_CALLBACK_ERRORS } from \"../error-codes\";\nimport type { SteamOptions, SteamProfile } from \"../types\";\nimport { placeholderEmail } from \"../utils/email\";\nimport type { ProviderDefinition } from \"./types\";\n\nexport const STEAM_OPENID_ENDPOINT = \"https://steamcommunity.com/openid/login\";\nconst OPENID_NS = \"http://specs.openid.net/auth/2.0\";\nconst IDENTIFIER_SELECT = \"http://specs.openid.net/auth/2.0/identifier_select\";\nconst CLAIMED_ID = /^https:\\/\\/steamcommunity\\.com\\/openid\\/id\\/(\\d{17})$/;\n/** OpenID 2.0 requires these to be signed in a positive assertion. */\nconst REQUIRED_SIGNED = [\n  \"op_endpoint\",\n  \"return_to\",\n  \"response_nonce\",\n  \"assoc_handle\",\n  \"claimed_id\",\n  \"identity\",\n];\n/** How long the one-time code from the callback hook is valid. */\nconst CODE_TTL_MS = 60_000;\nconst STEAM_TIMEOUT_MS = 10_000;\n\nconst codeIdentifier = (code: string) => `steam-openid:${code}`;\n\n/** Where Steam sends the player back: better-auth's own callback, with the OAuth state. */\nexport function steamReturnTo(redirectURI: string, state: string): string {\n  const url = new URL(redirectURI);\n  url.searchParams.set(\"state\", state);\n  return url.toString();\n}\n\n/** Steam's sign-in page for an OpenID 2.0 `checkid_setup` request. */\nexport function steamAuthorizationURL(returnTo: string): URL {\n  const url = new URL(STEAM_OPENID_ENDPOINT);\n  url.searchParams.set(\"openid.ns\", OPENID_NS);\n  url.searchParams.set(\"openid.mode\", \"checkid_setup\");\n  url.searchParams.set(\"openid.return_to\", returnTo);\n  url.searchParams.set(\"openid.realm\", new URL(returnTo).origin);\n  url.searchParams.set(\"openid.identity\", IDENTIFIER_SELECT);\n  url.searchParams.set(\"openid.claimed_id\", IDENTIFIER_SELECT);\n  return url;\n}\n\n/** Parses OpenID's key-value form (`key:value` lines). */\nfunction parseKeyValue(text: string): Map<string, string> {\n  const result = new Map<string, string>();\n  for (const line of text.split(\"\\n\")) {\n    const separator = line.indexOf(\":\");\n    if (separator > 0) result.set(line.slice(0, separator), line.slice(separator + 1).trim());\n  }\n  return result;\n}\n\n/**\n * Checks Steam's positive assertion and returns the SteamID64, or `null`.\n * Everything in the query is untrusted until Steam confirms it: the\n * fields are checked against what this request expects, then sent back to\n * Steam (`check_authentication`), which verifies the signature and that\n * the nonce wasn't used before.\n */\nexport async function verifySteamAssertion(\n  query: Record<string, unknown>,\n  expectedReturnTo: string,\n): Promise<string | null> {\n  const get = (key: string) => {\n    const value = query[`openid.${key}`];\n    return typeof value === \"string\" ? value : undefined;\n  };\n  if (get(\"ns\") !== OPENID_NS || get(\"mode\") !== \"id_res\") return null;\n  if (get(\"op_endpoint\") !== STEAM_OPENID_ENDPOINT) return null;\n  if (get(\"return_to\") !== expectedReturnTo) return null;\n  const claimedId = get(\"claimed_id\");\n  const steamId = claimedId ? CLAIMED_ID.exec(claimedId)?.[1] : undefined;\n  if (!steamId || get(\"identity\") !== claimedId) return null;\n  const signed = new Set((get(\"signed\") ?? \"\").split(\",\"));\n  if (!REQUIRED_SIGNED.every((field) => signed.has(field)) || !get(\"sig\")) return null;\n\n  const body = new URLSearchParams();\n  for (const [key, value] of Object.entries(query)) {\n    if (key.startsWith(\"openid.\") && typeof value === \"string\") body.set(key, value);\n  }\n  body.set(\"openid.mode\", \"check_authentication\");\n  const response = await fetch(STEAM_OPENID_ENDPOINT, {\n    method: \"POST\",\n    body,\n    redirect: \"error\",\n    signal: AbortSignal.timeout(STEAM_TIMEOUT_MS),\n  });\n  if (!response.ok) return null;\n  const answer = parseKeyValue(await response.text());\n  return answer.get(\"ns\") === OPENID_NS && answer.get(\"is_valid\") === \"true\" ? steamId : null;\n}\n\n/** Loads the player's public profile; `null` if it can't be loaded. */\nasync function fetchSteamProfile(\n  steamId: string,\n  apiKey: string,\n  apiBaseURL: string,\n): Promise<SteamProfile | null> {\n  const url = new URL(\"/ISteamUser/GetPlayerSummaries/v2/\", apiBaseURL);\n  url.searchParams.set(\"key\", apiKey);\n  url.searchParams.set(\"steamids\", steamId);\n  const response = await fetch(url, { signal: AbortSignal.timeout(STEAM_TIMEOUT_MS) });\n  if (!response.ok) return null;\n  const data = (await response.json()) as { response?: { players?: SteamProfile[] } };\n  const player = data.response?.players?.find((p) => p.steamid === steamId);\n  return player ?? null;\n}\n\n/**\n * Steam uses OpenID 2.0, not OAuth: it sends the player back with a signed\n * assertion instead of a code. Steam's `return_to` is better-auth's own\n * `/callback/steam`; a before-hook there verifies the assertion and swaps\n * it for a one-time `code`, which `validateAuthorizationCode` redeems. The\n * rest is better-auth's callback, like for any provider: state and CSRF\n * check, user and account, session, redirect.\n */\nexport function steam(options: SteamOptions, emailDomain: string): ProviderDefinition {\n  const apiBaseURL = options.apiBaseURL ?? \"https://api.steampowered.com\";\n\n  const provider: OAuthProvider<SteamProfile> = {\n    id: \"steam\",\n    name: \"Steam\",\n    accountSubject: ({ profile }) => profile.steamid,\n    createAuthorizationURL({ state, redirectURI }) {\n      return steamAuthorizationURL(steamReturnTo(redirectURI, state));\n    },\n    async validateAuthorizationCode({ code }): Promise<OAuth2Tokens | null> {\n      const ctx = tryGetCurrentAuthEndpointContext();\n      if (!ctx) return null;\n      const verified = await ctx.context.internalAdapter.consumeVerificationValue(\n        codeIdentifier(code),\n      );\n      if (!verified || new Date(verified.expiresAt).getTime() < Date.now()) return null;\n      return { tokenType: \"steam-openid\", raw: { steamid: verified.value } };\n    },\n    async getUserInfo(tokens) {\n      const steamid = tokens.raw?.steamid;\n      if (typeof steamid !== \"string\") return null;\n      let profile: SteamProfile = { steamid };\n      if (options.apiKey) {\n        try {\n          profile = (await fetchSteamProfile(steamid, options.apiKey, apiBaseURL)) ?? profile;\n        } catch {\n          // The profile is cosmetic; the sign-in is verified without it.\n          // Not logged in detail: the request URL contains the API key.\n          tryGetCurrentAuthEndpointContext()?.context.logger.warn(\n            \"[authentication] could not load the Steam profile\",\n          );\n        }\n      }\n      const mapped = await options.mapProfileToUser?.(profile);\n      return {\n        user: {\n          name: profile.personaname || `Steam ${steamid}`,\n          email: placeholderEmail(steamid, emailDomain),\n          emailVerified: false,\n          image: profile.avatarfull,\n          ...mapped,\n        },\n        data: profile,\n      };\n    },\n    disableSignUp: options.disableSignUp,\n    disableImplicitSignUp: options.disableImplicitSignUp,\n    options: {\n      disableSignUp: options.disableSignUp,\n      disableImplicitSignUp: options.disableImplicitSignUp,\n      overrideUserInfoOnSignIn: options.overrideUserInfoOnSignIn,\n    },\n  };\n\n  const callbackHook = {\n    matcher: (context: HookEndpointContext) =>\n      context.path === \"/callback/:id\" && (context.params as { id?: unknown })?.id === \"steam\",\n    handler: createAuthMiddleware(async (ctx) => {\n      const query = (ctx.query ?? {}) as Record<string, unknown>;\n      const state = typeof query.state === \"string\" ? query.state : undefined;\n      // A `code` in the query never reaches the callback: on failure it is\n      // blanked (and `error` makes the callback stop first), on success\n      // replaced by the hook's own.\n      const fail = (error: string) => ({ context: { query: { state, code: \"\", error } } });\n      // Steam always returns with GET. better-auth turns a POST to the\n      // callback into a GET redirect, which comes back here.\n      if (!state || ctx.method !== \"GET\") {\n        return fail(AUTHENTICATION_CALLBACK_ERRORS.STEAM_VERIFICATION_FAILED);\n      }\n      if (query[\"openid.mode\"] === \"cancel\") {\n        return fail(AUTHENTICATION_CALLBACK_ERRORS.STEAM_SIGN_IN_CANCELLED);\n      }\n\n      let steamId: string | null = null;\n      try {\n        const expected = steamReturnTo(`${ctx.context.baseURL}/callback/steam`, state);\n        steamId = await verifySteamAssertion(query, expected);\n      } catch (error) {\n        ctx.context.logger.error(\"[authentication] Steam verification failed\", error);\n      }\n      if (!steamId) return fail(AUTHENTICATION_CALLBACK_ERRORS.STEAM_VERIFICATION_FAILED);\n\n      const code = generateRandomString(32);\n      await ctx.context.internalAdapter.createVerificationValue({\n        identifier: codeIdentifier(code),\n        value: steamId,\n        expiresAt: new Date(Date.now() + CODE_TTL_MS),\n      });\n      return { context: { query: { state, code } } };\n    }),\n  };\n\n  return {\n    provider: provider as unknown as OAuthProvider,\n    emailDomain,\n    hooks: { before: [callbackHook] },\n  };\n}\n","import { tryGetCurrentAuthEndpointContext } from \"@better-auth/core/context\";\nimport type { OAuthProvider } from \"@better-auth/core/oauth2\";\nimport {\n  createAuthorizationURL,\n  refreshAccessToken,\n  validateAuthorizationCode,\n} from \"@better-auth/core/oauth2\";\nimport type { XboxOptions, XboxProfile } from \"../types\";\nimport { placeholderEmail } from \"../utils/email\";\nimport type { ProviderDefinition } from \"./types\";\n\n/**\n * Microsoft's documented flow for Xbox sign-in on websites (\"Xbox services\n * sign-in for title websites\", Microsoft Game Development Kit): Microsoft\n * account OAuth on the `consumers` tenant with `xboxlive.signin`, then an\n * Xbox user token, then an XSTS token whose claims name the player.\n */\nexport const XBOX_AUTHORIZATION_ENDPOINT =\n  \"https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize\";\nexport const XBOX_TOKEN_ENDPOINT = \"https://login.microsoftonline.com/consumers/oauth2/v2.0/token\";\nexport const XBOX_USER_AUTH_ENDPOINT = \"https://user.auth.xboxlive.com/user/authenticate\";\nexport const XBOX_XSTS_ENDPOINT = \"https://xsts.auth.xboxlive.com/xsts/authorize\";\nconst XBOX_TIMEOUT_MS = 10_000;\n\ninterface XboxTokenResponse {\n  Token?: string;\n  DisplayClaims?: { xui?: Record<string, string>[] };\n}\n\nasync function postXbox(url: string, body: unknown): Promise<XboxTokenResponse | null> {\n  const response = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      \"content-type\": \"application/json\",\n      accept: \"application/json\",\n      \"x-xbl-contract-version\": \"1\",\n    },\n    body: JSON.stringify(body),\n    redirect: \"error\",\n    signal: AbortSignal.timeout(XBOX_TIMEOUT_MS),\n  });\n  if (!response.ok) {\n    // XErr names the reason, e.g. 2148916233: the account has no Xbox\n    // profile. Only the status and that code are logged, never the body.\n    const xErr = response.headers.get(\"x-err\") ?? \"none\";\n    tryGetCurrentAuthEndpointContext()?.context.logger.error(\n      `[authentication] Xbox token request to ${new URL(url).host} failed (${response.status}, XErr ${xErr})`,\n    );\n    return null;\n  }\n  try {\n    return (await response.json()) as XboxTokenResponse;\n  } catch {\n    tryGetCurrentAuthEndpointContext()?.context.logger.error(\n      `[authentication] Xbox token response from ${new URL(url).host} isn't JSON`,\n    );\n    return null;\n  }\n}\n\n/** Exchanges a Microsoft access token for the player's XSTS claims (XUID, gamertag). */\nexport async function fetchXboxProfile(\n  accessToken: string,\n  { relyingParty, sandboxId }: { relyingParty: string; sandboxId: string },\n): Promise<XboxProfile | null> {\n  const user = await postXbox(XBOX_USER_AUTH_ENDPOINT, {\n    RelyingParty: \"http://auth.xboxlive.com\",\n    TokenType: \"JWT\",\n    Properties: {\n      AuthMethod: \"RPS\",\n      SiteName: \"user.auth.xboxlive.com\",\n      RpsTicket: `d=${accessToken}`,\n    },\n  });\n  if (!user?.Token) return null;\n  const xsts = await postXbox(XBOX_XSTS_ENDPOINT, {\n    RelyingParty: relyingParty,\n    TokenType: \"JWT\",\n    Properties: { SandboxId: sandboxId, UserTokens: [user.Token] },\n  });\n  const claims = xsts?.DisplayClaims?.xui?.[0];\n  if (!claims?.xid) {\n    if (xsts) {\n      tryGetCurrentAuthEndpointContext()?.context.logger.error(\n        \"[authentication] the XSTS token has no XUID (xid claim); check the relying party\",\n      );\n    }\n    return null;\n  }\n  return claims as XboxProfile;\n}\n\n/**\n * Xbox, for apps enrolled in the Xbox developer program (Microsoft only\n * grants `xboxlive.signin` to them). The player is identified by the XUID\n * from XSTS; Xbox shares no email address.\n */\nexport function xbox(options: XboxOptions, emailDomain: string): ProviderDefinition {\n  const relyingParty = options.relyingParty ?? \"http://xboxlive.com\";\n  const sandboxId = options.sandboxId ?? \"RETAIL\";\n  // Microsoft allows no other scopes in this request.\n  const scopes = [\"xboxlive.signin\", ...(options.offlineAccess ? [\"xboxlive.offline_access\"] : [])];\n\n  const provider: OAuthProvider<XboxProfile> = {\n    id: \"xbox\",\n    name: \"Xbox\",\n    accountSubject: ({ profile }) => profile.xid,\n    createAuthorizationURL({ state, codeVerifier, redirectURI, additionalParams }) {\n      return createAuthorizationURL({\n        id: \"xbox\",\n        options,\n        authorizationEndpoint: XBOX_AUTHORIZATION_ENDPOINT,\n        scopes,\n        state,\n        codeVerifier,\n        redirectURI,\n        prompt: options.prompt,\n        additionalParams,\n      });\n    },\n    validateAuthorizationCode({ code, codeVerifier, redirectURI }) {\n      return validateAuthorizationCode({\n        code,\n        codeVerifier,\n        redirectURI,\n        options,\n        tokenEndpoint: XBOX_TOKEN_ENDPOINT,\n        authentication: \"post\",\n      });\n    },\n    refreshAccessToken: (refreshToken) =>\n      refreshAccessToken({\n        refreshToken,\n        options: { clientId: options.clientId, clientSecret: options.clientSecret },\n        tokenEndpoint: XBOX_TOKEN_ENDPOINT,\n        authentication: \"post\",\n      }),\n    async getUserInfo(tokens) {\n      if (!tokens.accessToken) return null;\n      let profile: XboxProfile | null = null;\n      try {\n        profile = await fetchXboxProfile(tokens.accessToken, { relyingParty, sandboxId });\n      } catch (error) {\n        // Network failure or timeout: fail the sign-in like any other refusal.\n        tryGetCurrentAuthEndpointContext()?.context.logger.error(\n          \"[authentication] Xbox Live couldn't be reached\",\n          error,\n        );\n      }\n      if (!profile) return null;\n      const mapped = await options.mapProfileToUser?.(profile);\n      return {\n        user: {\n          name: profile.gtg || `Xbox ${profile.xid}`,\n          email: placeholderEmail(profile.xid, emailDomain),\n          emailVerified: false,\n          ...mapped,\n        },\n        data: profile,\n      };\n    },\n    disableSignUp: options.disableSignUp,\n    disableImplicitSignUp: options.disableImplicitSignUp,\n    options: {\n      clientId: options.clientId,\n      clientSecret: options.clientSecret,\n      redirectURI: options.redirectURI,\n      disableSignUp: options.disableSignUp,\n      disableImplicitSignUp: options.disableImplicitSignUp,\n      overrideUserInfoOnSignIn: options.overrideUserInfoOnSignIn,\n    },\n  };\n  return { provider: provider as unknown as OAuthProvider, emailDomain };\n}\n","import { createFail } from \"@repo/plugin-utils/options\";\nimport { epic } from \"./providers/epic\";\nimport { steam } from \"./providers/steam\";\nimport type { ProviderDefinition } from \"./providers/types\";\nimport { xbox } from \"./providers/xbox\";\nimport type { AuthenticationOptions } from \"./types\";\nimport { isValidEmailDomain } from \"./utils/email\";\n\nconst fail = createFail(\"authentication\");\n\nfunction emailDomain(providerId: string, domain: string | undefined): string {\n  const resolved = (domain ?? `${providerId}.invalid`).toLowerCase();\n  if (!isValidEmailDomain(resolved)) {\n    fail(`\"${providerId}.emailDomain\" must be a domain name, got ${JSON.stringify(domain)}.`);\n  }\n  return resolved;\n}\n\nfunction requireClient(\n  providerId: string,\n  options: { clientId?: unknown; clientSecret?: unknown },\n) {\n  if (typeof options.clientId !== \"string\" || options.clientId === \"\") {\n    fail(`\"${providerId}.clientId\" is required.`);\n  }\n  if (typeof options.clientSecret !== \"string\" || options.clientSecret === \"\") {\n    fail(`\"${providerId}.clientSecret\" is required.`);\n  }\n}\n\n/** Validates the options once, at creation, and builds the providers. */\nexport function resolveProviders(options: AuthenticationOptions): ProviderDefinition[] {\n  const definitions: ProviderDefinition[] = [];\n  if (options.steam) {\n    if (options.steam.apiKey !== undefined && options.steam.apiKey.trim() === \"\") {\n      fail('\"steam.apiKey\" is empty; leave it out to sign in without loading profiles.');\n    }\n    definitions.push(steam(options.steam, emailDomain(\"steam\", options.steam.emailDomain)));\n  }\n  if (options.epic) {\n    requireClient(\"epic\", options.epic);\n    definitions.push(epic(options.epic, emailDomain(\"epic\", options.epic.emailDomain)));\n  }\n  if (options.xbox) {\n    requireClient(\"xbox\", options.xbox);\n    definitions.push(xbox(options.xbox, emailDomain(\"xbox\", options.xbox.emailDomain)));\n  }\n  if (definitions.length === 0) fail(\"Configure at least one provider: steam, epic, or xbox.\");\n\n  const domains = definitions.map((definition) => definition.emailDomain);\n  if (new Set(domains).size !== domains.length) {\n    fail(\"Each provider needs an email domain of its own.\");\n  }\n  return definitions;\n}\n","import type { BetterAuthPlugin } from \"@better-auth/core\";\nimport { version } from \"../package.json\";\nimport { AUTHENTICATION_ERROR_CODES } from \"./error-codes\";\nimport { createReservedEmailHooks } from \"./hooks/reserved-email\";\nimport { resolveProviders } from \"./options\";\nimport type { AuthenticationOptions } from \"./types\";\n\nexport {\n  AUTHENTICATION_CALLBACK_ERRORS,\n  AUTHENTICATION_ERROR_CODES,\n  type AuthenticationErrorCode,\n} from \"./error-codes\";\nexport type {\n  AuthenticationOptions,\n  AuthenticationProviderId,\n  CommonProviderOptions,\n  EpicOptions,\n  EpicProfile,\n  SteamOptions,\n  SteamProfile,\n  XboxOptions,\n  XboxProfile,\n} from \"./types\";\n\n/**\n * Adds Steam, Epic Games, and Xbox as social providers. They are used like\n * better-auth's built-in ones: `signIn.social({ provider: \"steam\" })`,\n * `linkSocial`, callbacks at `/callback/<provider>`, account linking,\n * `callbackURL` checks, and sign-up options all work the same way.\n *\n * @example\n * ```ts\n * import { betterAuth } from \"better-auth\";\n * import { authentication } from \"@checodo/better-auth-authentication\";\n *\n * export const auth = betterAuth({\n *   plugins: [\n *     authentication({\n *       steam: { apiKey: process.env.STEAM_API_KEY },\n *       epic: { clientId: \"...\", clientSecret: \"...\" },\n *     }),\n *   ],\n * });\n *\n * // client\n * await authClient.signIn.social({ provider: \"steam\", callbackURL: \"/dashboard\" });\n * ```\n */\nexport const authentication = (options: AuthenticationOptions) => {\n  const definitions = resolveProviders(options);\n  const before = definitions.flatMap((definition) => definition.hooks?.before ?? []);\n\n  return {\n    id: \"authentication\",\n    version,\n    init(ctx) {\n      const ids = new Set(definitions.map((definition) => definition.provider.id));\n      for (const existing of ctx.socialProviders) {\n        if (ids.has(existing.id)) {\n          ctx.logger.warn(\n            `[authentication] the \"${existing.id}\" provider replaces a social provider with the same id`,\n          );\n        }\n      }\n      return {\n        context: {\n          socialProviders: [\n            ...definitions.map((definition) => definition.provider),\n            ...ctx.socialProviders.filter((provider) => !ids.has(provider.id)),\n          ],\n        },\n        options: { databaseHooks: createReservedEmailHooks(definitions) },\n      };\n    },\n    hooks: { before },\n    $ERROR_CODES: AUTHENTICATION_ERROR_CODES,\n    options,\n  } satisfies BetterAuthPlugin;\n};\n\nexport type AuthenticationPlugin = ReturnType<typeof authentication>;\n\n/** Lets `auth.$context.getPlugin(\"authentication\")` infer this plugin's exact type. */\ndeclare module \"@better-auth/core\" {\n  interface BetterAuthPluginRegistry<AuthOptions, Options> {\n    authentication: {\n      creator: typeof authentication;\n    };\n  }\n}\n"],"mappings":";;;;;;;;;ACCA,MAAM,SAAS;AAEf,SAAgB,mBAAmB,QAAyB;CAC1D,OAAO,OAAO,KAAK,MAAM;AAC3B;;;;;;AAOA,SAAgB,iBAAiB,WAAmB,QAAwB;CAC1E,OAAO,GAAG,UAAU,YAAY,EAAE,GAAG;AACvC;AAEA,SAAgB,UAAU,OAAe,QAAyB;CAChE,OAAO,MAAM,YAAY,CAAC,CAAC,SAAS,IAAI,QAAQ;AAClD;;;;;;;;;;;;;;;;ACKA,SAAgB,yBACd,aACoC;;CAEpC,MAAM,WAAW,OAAgB,YAAgD;EAC/E,IAAI,OAAO,UAAU,YAAY,CAAC,SAAS,OAAO;EAClD,MAAM,QAAQ,YAAY,MAAM,eAAe,UAAU,OAAO,WAAW,WAAW,CAAC;EACvF,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,SAAS,QAAQ;EACvB,IAAI,QAAQ,SAAS,mBAAmB,QAAQ,OAAO,MAAM,SAAS,IACpE,MAAM,SAAS,KAAK,eAAe,2BAA2B,qBAAqB;EAErF,OAAO;CACT;CAEA,OAAO,EACL,MAAM;EACJ,QAAQ,EACN,QAAQ,OAAO,MAAM,YAAY;GAC/B,QAAQ,KAAK,OAAO,OAAO;EAC7B,EACF;EACA,QAAQ,EACN,QAAQ,OAAO,MAAM,YAAY;GAC/B,IAAI,CAAC,QAAQ,KAAK,OAAO,OAAO,KAAK,CAAC,SAAS;GAQ/C,IAAI,CAAC,OAJgB,MADC,kBAAkB,QAAQ,QAAQ,OAAO,EAAA,CAClC,QAAQ;IACnC,OAAO;IACP,OAAO,CAAC;KAAE,OAAO;KAAS,OAAQ,KAAK,MAAiB,YAAY;IAAE,CAAC;GACzE,CAAC,GACY,OAAO,EAAE,MAAM;IAAE,OAAO,KAAA;IAAW,eAAe,KAAA;GAAU,EAAE;EAC7E,EACF;CACF,EACF;AACF;;;;;;;ACvDA,SAAgB,WAAW,UAA8C;CACvE,QAAQ,YAAY;EAClB,MAAM,IAAI,MAAM,IAAI,SAAS,IAAI,SAAS;CAC5C;AACF;;;;;;ACOA,MAAa,cAAc;AAC3B,MAAa,8BAA8B;AAC3C,MAAa,sBAAsB;AACnC,MAAa,qBAAqB;;AAElC,MAAM,iBAAiB,CAAC,iBAAiB,QAAQ;;;;;;AAOjD,SAAgB,KAAK,SAAsB,aAAyC;CAmFlF,OAAO;EAAE,UAAU;GAjFjB,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,iBAAiB,EAAE,cAAc,QAAQ;GACzC,uBAAuB,EAAE,OAAO,QAAQ,cAAc,aAAa,oBAAoB;IACrF,MAAM,YAAY,QAAQ,sBAAsB,CAAC,IAAI,CAAC,GAAG,cAAc;IACvE,IAAI,QAAQ,OAAO,UAAU,KAAK,GAAG,QAAQ,KAAK;IAClD,IAAI,QAAQ,UAAU,KAAK,GAAG,MAAM;IACpC,OAAO,uBAAuB;KAC5B,IAAI;KACJ;KACA,uBAAuB;KACvB,QAAQ,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;KAC9B;KACA,cAAc,QAAQ,OAAO,eAAe,KAAA;KAC5C;KACA,QAAQ,QAAQ;KAChB;IACF,CAAC;GACH;GACA,0BAA0B,EAAE,MAAM,cAAc,eAAe;IAC7D,OAAO,0BAA0B;KAC/B;KACA,cAAc,QAAQ,OAAO,eAAe,KAAA;KAC5C;KACA;KACA,eAAe;KACf,gBAAgB;IAClB,CAAC;GACH;GACA,qBAAqB,iBACnB,mBAAmB;IACjB;IACA,SAAS;KAAE,UAAU,QAAQ;KAAU,cAAc,QAAQ;IAAa;IAC1E,eAAe;IACf,gBAAgB;GAClB,CAAC;GACH,MAAM,YAAY,QAAQ;IACxB,IAAI,CAAC,OAAO,SAAS;KACnB,iCAAiC,CAAC,EAAE,QAAQ,OAAO,MACjD,uEACF;KACA,OAAO;IACT;IACA,IAAI;IACJ,IAAI;KACF,CAAC,CAAE,WAAY,MAAM,cAA2B,OAAO,SAAS,oBAAoB;MAClF,QAAQ;MACR,UAAU,QAAQ;MAClB,gBAAgB,CAAC,KAAK;KACxB,CAAC;IACH,SAAS,OAAO;KAEd,iCAAiC,CAAC,EAAE,QAAQ,OAAO,MACjD,kDACA,KACF;KACA,OAAO;IACT;IACA,MAAM,SAAS,MAAM,QAAQ,mBAAmB,OAAO;IACvD,OAAO;KACL,MAAM;MACJ,MAAM,QAAQ,MAAM,QAAQ,QAAQ;MACpC,OAAO,iBAAiB,QAAQ,KAAK,WAAW;MAChD,eAAe;MACf,GAAG;KACL;KACA,MAAM;IACR;GACF;GACA,eAAe,QAAQ;GACvB,uBAAuB,QAAQ;GAC/B,SAAS;IACP,UAAU,QAAQ;IAClB,cAAc,QAAQ;IACtB,aAAa,QAAQ;IACrB,eAAe,QAAQ;IACvB,uBAAuB,QAAQ;IAC/B,0BAA0B,QAAQ;GACpC;EAEwB;EAA+B;CAAY;AACvE;;ACtGA,MAAa,wBAAwB;AACrC,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,aAAa;;AAEnB,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;AACF;;AAEA,MAAM,cAAc;AACpB,MAAM,mBAAmB;AAEzB,MAAM,kBAAkB,SAAiB,gBAAgB;;AAGzD,SAAgB,cAAc,aAAqB,OAAuB;CACxE,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,IAAI,aAAa,IAAI,SAAS,KAAK;CACnC,OAAO,IAAI,SAAS;AACtB;;AAGA,SAAgB,sBAAsB,UAAuB;CAC3D,MAAM,MAAM,IAAI,IAAI,qBAAqB;CACzC,IAAI,aAAa,IAAI,aAAa,SAAS;CAC3C,IAAI,aAAa,IAAI,eAAe,eAAe;CACnD,IAAI,aAAa,IAAI,oBAAoB,QAAQ;CACjD,IAAI,aAAa,IAAI,gBAAgB,IAAI,IAAI,QAAQ,CAAC,CAAC,MAAM;CAC7D,IAAI,aAAa,IAAI,mBAAmB,iBAAiB;CACzD,IAAI,aAAa,IAAI,qBAAqB,iBAAiB;CAC3D,OAAO;AACT;;AAGA,SAAS,cAAc,MAAmC;CACxD,MAAM,yBAAS,IAAI,IAAoB;CACvC,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;EACnC,MAAM,YAAY,KAAK,QAAQ,GAAG;EAClC,IAAI,YAAY,GAAG,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,GAAG,KAAK,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;CAC1F;CACA,OAAO;AACT;;;;;;;;AASA,eAAsB,qBACpB,OACA,kBACwB;CACxB,MAAM,OAAO,QAAgB;EAC3B,MAAM,QAAQ,MAAM,UAAU;EAC9B,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;CAC7C;CACA,IAAI,IAAI,IAAI,MAAM,aAAa,IAAI,MAAM,MAAM,UAAU,OAAO;CAChE,IAAI,IAAI,aAAa,MAAA,2CAA6B,OAAO;CACzD,IAAI,IAAI,WAAW,MAAM,kBAAkB,OAAO;CAClD,MAAM,YAAY,IAAI,YAAY;CAClC,MAAM,UAAU,YAAY,WAAW,KAAK,SAAS,CAAC,GAAG,KAAK,KAAA;CAC9D,IAAI,CAAC,WAAW,IAAI,UAAU,MAAM,WAAW,OAAO;CACtD,MAAM,SAAS,IAAI,KAAK,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,CAAC;CACvD,IAAI,CAAC,gBAAgB,OAAO,UAAU,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO;CAEhF,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,IAAI,WAAW,SAAS,KAAK,OAAO,UAAU,UAAU,KAAK,IAAI,KAAK,KAAK;CAEjF,KAAK,IAAI,eAAe,sBAAsB;CAC9C,MAAM,WAAW,MAAM,MAAM,uBAAuB;EAClD,QAAQ;EACR;EACA,UAAU;EACV,QAAQ,YAAY,QAAQ,gBAAgB;CAC9C,CAAC;CACD,IAAI,CAAC,SAAS,IAAI,OAAO;CACzB,MAAM,SAAS,cAAc,MAAM,SAAS,KAAK,CAAC;CAClD,OAAO,OAAO,IAAI,IAAI,MAAM,aAAa,OAAO,IAAI,UAAU,MAAM,SAAS,UAAU;AACzF;;AAGA,eAAe,kBACb,SACA,QACA,YAC8B;CAC9B,MAAM,MAAM,IAAI,IAAI,sCAAsC,UAAU;CACpE,IAAI,aAAa,IAAI,OAAO,MAAM;CAClC,IAAI,aAAa,IAAI,YAAY,OAAO;CACxC,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,gBAAgB,EAAE,CAAC;CACnF,IAAI,CAAC,SAAS,IAAI,OAAO;CAGzB,QADe,MADK,SAAS,KAAK,EAAA,CACd,UAAU,SAAS,MAAM,MAAM,EAAE,YAAY,OAAO,KACvD;AACnB;;;;;;;;;AAUA,SAAgB,MAAM,SAAuB,aAAyC;CACpF,MAAM,aAAa,QAAQ,cAAc;CA4FzC,OAAO;EACL,UAAU;GA1FV,IAAI;GACJ,MAAM;GACN,iBAAiB,EAAE,cAAc,QAAQ;GACzC,uBAAuB,EAAE,OAAO,eAAe;IAC7C,OAAO,sBAAsB,cAAc,aAAa,KAAK,CAAC;GAChE;GACA,MAAM,0BAA0B,EAAE,QAAsC;IACtE,MAAM,MAAM,iCAAiC;IAC7C,IAAI,CAAC,KAAK,OAAO;IACjB,MAAM,WAAW,MAAM,IAAI,QAAQ,gBAAgB,yBACjD,eAAe,IAAI,CACrB;IACA,IAAI,CAAC,YAAY,IAAI,KAAK,SAAS,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI,GAAG,OAAO;IAC7E,OAAO;KAAE,WAAW;KAAgB,KAAK,EAAE,SAAS,SAAS,MAAM;IAAE;GACvE;GACA,MAAM,YAAY,QAAQ;IACxB,MAAM,UAAU,OAAO,KAAK;IAC5B,IAAI,OAAO,YAAY,UAAU,OAAO;IACxC,IAAI,UAAwB,EAAE,QAAQ;IACtC,IAAI,QAAQ,QACV,IAAI;KACF,UAAW,MAAM,kBAAkB,SAAS,QAAQ,QAAQ,UAAU,KAAM;IAC9E,QAAQ;KAGN,iCAAiC,CAAC,EAAE,QAAQ,OAAO,KACjD,mDACF;IACF;IAEF,MAAM,SAAS,MAAM,QAAQ,mBAAmB,OAAO;IACvD,OAAO;KACL,MAAM;MACJ,MAAM,QAAQ,eAAe,SAAS;MACtC,OAAO,iBAAiB,SAAS,WAAW;MAC5C,eAAe;MACf,OAAO,QAAQ;MACf,GAAG;KACL;KACA,MAAM;IACR;GACF;GACA,eAAe,QAAQ;GACvB,uBAAuB,QAAQ;GAC/B,SAAS;IACP,eAAe,QAAQ;IACvB,uBAAuB,QAAQ;IAC/B,0BAA0B,QAAQ;GACpC;EA0CiB;EACjB;EACA,OAAO,EAAE,QAAQ,CAAC;GAxClB,UAAU,YACR,QAAQ,SAAS,mBAAoB,QAAQ,QAA6B,OAAO;GACnF,SAAS,qBAAqB,OAAO,QAAQ;IAC3C,MAAM,QAAS,IAAI,SAAS,CAAC;IAC7B,MAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,KAAA;IAI9D,MAAM,QAAQ,WAAmB,EAAE,SAAS,EAAE,OAAO;KAAE;KAAO,MAAM;KAAI;IAAM,EAAE,EAAE;IAGlF,IAAI,CAAC,SAAS,IAAI,WAAW,OAC3B,OAAO,KAAK,+BAA+B,yBAAyB;IAEtE,IAAI,MAAM,mBAAmB,UAC3B,OAAO,KAAK,+BAA+B,uBAAuB;IAGpE,IAAI,UAAyB;IAC7B,IAAI;KAEF,UAAU,MAAM,qBAAqB,OADpB,cAAc,GAAG,IAAI,QAAQ,QAAQ,kBAAkB,KACrB,CAAC;IACtD,SAAS,OAAO;KACd,IAAI,QAAQ,OAAO,MAAM,8CAA8C,KAAK;IAC9E;IACA,IAAI,CAAC,SAAS,OAAO,KAAK,+BAA+B,yBAAyB;IAElF,MAAM,OAAO,qBAAqB,EAAE;IACpC,MAAM,IAAI,QAAQ,gBAAgB,wBAAwB;KACxD,YAAY,eAAe,IAAI;KAC/B,OAAO;KACP,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW;IAC9C,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO;KAAE;KAAO;IAAK,EAAE,EAAE;GAC/C,CAAC;EAM4B,CAAC,EAAE;CAClC;AACF;;;;;;;;AC3MA,MAAa,8BACX;AACF,MAAa,sBAAsB;AACnC,MAAa,0BAA0B;AACvC,MAAa,qBAAqB;AAClC,MAAM,kBAAkB;AAOxB,eAAe,SAAS,KAAa,MAAkD;CACrF,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,QAAQ;GACR,0BAA0B;EAC5B;EACA,MAAM,KAAK,UAAU,IAAI;EACzB,UAAU;EACV,QAAQ,YAAY,QAAQ,eAAe;CAC7C,CAAC;CACD,IAAI,CAAC,SAAS,IAAI;EAGhB,MAAM,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK;EAC9C,iCAAiC,CAAC,EAAE,QAAQ,OAAO,MACjD,0CAA0C,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,WAAW,SAAS,OAAO,SAAS,KAAK,EACvG;EACA,OAAO;CACT;CACA,IAAI;EACF,OAAQ,MAAM,SAAS,KAAK;CAC9B,QAAQ;EACN,iCAAiC,CAAC,EAAE,QAAQ,OAAO,MACjD,6CAA6C,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,YACjE;EACA,OAAO;CACT;AACF;;AAGA,eAAsB,iBACpB,aACA,EAAE,cAAc,aACa;CAC7B,MAAM,OAAO,MAAM,SAAS,yBAAyB;EACnD,cAAc;EACd,WAAW;EACX,YAAY;GACV,YAAY;GACZ,UAAU;GACV,WAAW,KAAK;EAClB;CACF,CAAC;CACD,IAAI,CAAC,MAAM,OAAO,OAAO;CACzB,MAAM,OAAO,MAAM,SAAS,oBAAoB;EAC9C,cAAc;EACd,WAAW;EACX,YAAY;GAAE,WAAW;GAAW,YAAY,CAAC,KAAK,KAAK;EAAE;CAC/D,CAAC;CACD,MAAM,SAAS,MAAM,eAAe,MAAM;CAC1C,IAAI,CAAC,QAAQ,KAAK;EAChB,IAAI,MACF,iCAAiC,CAAC,EAAE,QAAQ,OAAO,MACjD,kFACF;EAEF,OAAO;CACT;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,KAAK,SAAsB,aAAyC;CAClF,MAAM,eAAe,QAAQ,gBAAgB;CAC7C,MAAM,YAAY,QAAQ,aAAa;CAEvC,MAAM,SAAS,CAAC,mBAAmB,GAAI,QAAQ,gBAAgB,CAAC,yBAAyB,IAAI,CAAC,CAAE;CAuEhG,OAAO;EAAE,UAAU;GApEjB,IAAI;GACJ,MAAM;GACN,iBAAiB,EAAE,cAAc,QAAQ;GACzC,uBAAuB,EAAE,OAAO,cAAc,aAAa,oBAAoB;IAC7E,OAAO,uBAAuB;KAC5B,IAAI;KACJ;KACA,uBAAuB;KACvB;KACA;KACA;KACA;KACA,QAAQ,QAAQ;KAChB;IACF,CAAC;GACH;GACA,0BAA0B,EAAE,MAAM,cAAc,eAAe;IAC7D,OAAO,0BAA0B;KAC/B;KACA;KACA;KACA;KACA,eAAe;KACf,gBAAgB;IAClB,CAAC;GACH;GACA,qBAAqB,iBACnB,mBAAmB;IACjB;IACA,SAAS;KAAE,UAAU,QAAQ;KAAU,cAAc,QAAQ;IAAa;IAC1E,eAAe;IACf,gBAAgB;GAClB,CAAC;GACH,MAAM,YAAY,QAAQ;IACxB,IAAI,CAAC,OAAO,aAAa,OAAO;IAChC,IAAI,UAA8B;IAClC,IAAI;KACF,UAAU,MAAM,iBAAiB,OAAO,aAAa;MAAE;MAAc;KAAU,CAAC;IAClF,SAAS,OAAO;KAEd,iCAAiC,CAAC,EAAE,QAAQ,OAAO,MACjD,kDACA,KACF;IACF;IACA,IAAI,CAAC,SAAS,OAAO;IACrB,MAAM,SAAS,MAAM,QAAQ,mBAAmB,OAAO;IACvD,OAAO;KACL,MAAM;MACJ,MAAM,QAAQ,OAAO,QAAQ,QAAQ;MACrC,OAAO,iBAAiB,QAAQ,KAAK,WAAW;MAChD,eAAe;MACf,GAAG;KACL;KACA,MAAM;IACR;GACF;GACA,eAAe,QAAQ;GACvB,uBAAuB,QAAQ;GAC/B,SAAS;IACP,UAAU,QAAQ;IAClB,cAAc,QAAQ;IACtB,aAAa,QAAQ;IACrB,eAAe,QAAQ;IACvB,uBAAuB,QAAQ;IAC/B,0BAA0B,QAAQ;GACpC;EAEwB;EAA+B;CAAY;AACvE;;ACrKA,MAAM,OAAO,WAAW,gBAAgB;AAExC,SAAS,YAAY,YAAoB,QAAoC;CAC3E,MAAM,YAAY,UAAU,GAAG,WAAW,UAAA,CAAW,YAAY;CACjE,IAAI,CAAC,mBAAmB,QAAQ,GAC9B,KAAK,IAAI,WAAW,2CAA2C,KAAK,UAAU,MAAM,EAAE,EAAE;CAE1F,OAAO;AACT;AAEA,SAAS,cACP,YACA,SACA;CACA,IAAI,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa,IAC/D,KAAK,IAAI,WAAW,wBAAwB;CAE9C,IAAI,OAAO,QAAQ,iBAAiB,YAAY,QAAQ,iBAAiB,IACvE,KAAK,IAAI,WAAW,4BAA4B;AAEpD;;AAGA,SAAgB,iBAAiB,SAAsD;CACrF,MAAM,cAAoC,CAAC;CAC3C,IAAI,QAAQ,OAAO;EACjB,IAAI,QAAQ,MAAM,WAAW,KAAA,KAAa,QAAQ,MAAM,OAAO,KAAK,MAAM,IACxE,KAAK,8EAA4E;EAEnF,YAAY,KAAK,MAAM,QAAQ,OAAO,YAAY,SAAS,QAAQ,MAAM,WAAW,CAAC,CAAC;CACxF;CACA,IAAI,QAAQ,MAAM;EAChB,cAAc,QAAQ,QAAQ,IAAI;EAClC,YAAY,KAAK,KAAK,QAAQ,MAAM,YAAY,QAAQ,QAAQ,KAAK,WAAW,CAAC,CAAC;CACpF;CACA,IAAI,QAAQ,MAAM;EAChB,cAAc,QAAQ,QAAQ,IAAI;EAClC,YAAY,KAAK,KAAK,QAAQ,MAAM,YAAY,QAAQ,QAAQ,KAAK,WAAW,CAAC,CAAC;CACpF;CACA,IAAI,YAAY,WAAW,GAAG,KAAK,wDAAwD;CAE3F,MAAM,UAAU,YAAY,KAAK,eAAe,WAAW,WAAW;CACtE,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,QAAQ,QACpC,KAAK,iDAAiD;CAExD,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;ACNA,MAAa,kBAAkB,YAAmC;CAChE,MAAM,cAAc,iBAAiB,OAAO;CAG5C,OAAO;EACL,IAAI;EACJ;EACA,KAAK,KAAK;GACR,MAAM,MAAM,IAAI,IAAI,YAAY,KAAK,eAAe,WAAW,SAAS,EAAE,CAAC;GAC3E,KAAK,MAAM,YAAY,IAAI,iBACzB,IAAI,IAAI,IAAI,SAAS,EAAE,GACrB,IAAI,OAAO,KACT,yBAAyB,SAAS,GAAG,uDACvC;GAGJ,OAAO;IACL,SAAS,EACP,iBAAiB,CACf,GAAG,YAAY,KAAK,eAAe,WAAW,QAAQ,GACtD,GAAG,IAAI,gBAAgB,QAAQ,aAAa,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CACnE,EACF;IACA,SAAS,EAAE,eAAe,yBAAyB,WAAW,EAAE;GAClE;EACF;EACA,OAAO,EAAE,QAxBI,YAAY,SAAS,eAAe,WAAW,OAAO,UAAU,CAAC,CAwBrE,EAAO;EAChB,cAAc;EACd;CACF;AACF"}

package/package.json

@@ -1,6 +1,78 @@
 {
   "name": "@checodo/better-auth-authentication",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Sign in with Steam, Epic Games, and Xbox in better-auth, like any built-in social provider.",
+  "type": "module",
+  "license": "MIT",
+  "author": {
+    "name": "Clas Heinemeyer",
+    "email": "the.checodo@gmail.com",
+    "url": "https://checodo.dev"
+  },
+  "homepage": "https://github.com/checodo/better-auth-plugins/tree/main/packages/authentication",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/checodo/better-auth-plugins.git",
+    "directory": "packages/authentication"
+  },
+  "bugs": {
+    "url": "https://github.com/checodo/better-auth-plugins/issues"
+  },
+  "keywords": [
+    "better-auth",
+    "better-auth-plugin",
+    "oauth",
+    "steam",
+    "epic-games",
+    "xbox",
+    "auth"
+  ],
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "CHANGELOG.md"
+  ],
+  "peerDependencies": {
+    "@better-auth/core": "^1.7.20",
+    "better-auth": "^1.7.20"
+  },
+  "dependencies": {
+    "zod": "^4.5.4"
+  },
+  "devDependencies": {
+    "@better-auth/core": "^1.7.20",
+    "@checodo/better-auth-waitlist": "0.1.0",
+    "@repo/plugin-utils": "0.0.0",
+    "@repo/tooling": "0.0.0",
+    "@types/node": "^24.19.2",
+    "better-auth": "^1.7.20",
+    "tsdown": "^0.23.7",
+    "typescript": "^5.9.3",
+    "vitest": "^5.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch --no-clean",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist .turbo",
+    "lint:package": "publint && attw --pack . --profile esm-only"
+  }
 }