@connextar/house 0.13.2 → 0.14.1

package/README.md

@@ -174,6 +174,8 @@ link or a social sign-in now ends up exactly where a password sign-in does:
 
 Passkeys stay a single step. A passkey proves possession of a device and resists
 phishing, so it is excluded and cannot be added to the list.
+Adding a passkey is another matter: see
+[`auth/step-up`](#connextarhouseauthstep-up-authstep-upclient).
 
 **How it works.** This module copies none of Better Auth's pending-state
 internals: no cookie names, no signing, no identifiers. On these routes it runs
@@ -321,6 +323,231 @@ PharmaLine (1.6.33). All of them already use `/auth/two-factor` and `?next=`.
    proof.
 8. Optional: the confirm page for link scanners.
 
+### `@connextar/house/auth/step-up`, `/auth/step-up/client`
+
+A new way in needs a recent proof of an existing one.
+
+`@better-auth/passkey` lets any session under a day old add a passkey.
+`/passkey/generate-register-options` and `/passkey/verify-registration` check
+only `freshSessionMiddleware` (`session.freshAge`, one day by default): no
+password, no code. A passkey then signs in in one step, because it is left out
+of the second-factor challenge on purpose. So a stolen or borrowed session
+becomes a lasting way in that skips two-factor, and a password reset does not
+remove it, because a reset revokes sessions, not passkeys. Think of a shared
+computer left signed in, a cookie taken through XSS, or a trusted-device sign-in
+that skipped the code. All seven house apps with passkeys had this hole. Their
+own "second factor proven" plugins closed it for platform administrators only.
+
+Two-factor management is not part of this hole. Better Auth's
+`/two-factor/enable`, `/two-factor/disable` and `/two-factor/generate-backup-codes`
+already ask for the password.
+
+`stepUp()` refuses both passkey registration routes until the session holds a
+confirmation younger than the window (ten minutes by default). What counts as a
+confirmation depends on the account:
+
+| The account has                     | `needs`          | What confirms it                                                                                                                                                        |
+| ----------------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| two-factor on                       | `code`           | The authenticator code or a backup code, entered now. The client calls Better Auth's own `/two-factor/verify-totp` or `/two-factor/verify-backup-code` while signed in. |
+| no two-factor, a password           | `password`       | The password, sent to `POST /step-up/password`.                                                                                                                         |
+| neither (email link or social only) | `recent-sign-in` | A sign-in within the window: the session itself is younger than `windowSeconds`. There is nothing to type, so the screen asks them to sign in again.                    |
+
+- **A confirmation belongs to one session.** It is a row in Better Auth's
+  `verification` table (`step-up:<session id>`, with the user id as its value,
+  expiring after the window). A confirmation made by another session, or
+  recorded for another user, never counts. Using it does not spend it: the
+  options call and the verify call both need it, and a second passkey added
+  inside the window needs nothing more.
+- **The session is read from the session store,** never from the cookie cache.
+  A revoked session gets a 401 even while its cached cookie is still valid.
+- **The refusal** is `403` with
+  `{ code: "STEP_UP_REQUIRED", message: "Confirm it's you before adding a passkey.", needs }`,
+  so the client knows which prompt to show.
+- **Wrong answers.** Better Auth's two-factor lockout and attempt limit apply
+  only to a sign-in. A code checked with a live session is held back by the rate
+  limiter and nothing else. So each session gets `maxAttempts` wrong answers
+  (five by default, codes and passwords together). After that it has to sign in
+  again, and its live code checks are refused too (`403 STEP_UP_LOCKED`). A
+  stolen session cannot keep guessing.
+- **Deleting a passkey is not gated.** Removing a way in does not add one.
+- **The apps' administrator rule is unchanged** and still applies on top of
+  this. An administrator's passkey needs both a second-factor-proven session
+  and a step-up confirmation. Either refusal can stop it, and neither breaks the
+  other.
+
+**How the code path works.** None of the two-factor plugin is copied: no secret,
+no decryption. Called with a live session, Better Auth's verify routes check the
+code and create nothing. They answer with the token of the session they were
+called with. When such a call succeeds, this plugin records a confirmation for
+that session. It does this only if the account already had two-factor on
+_before_ the call. On an account still enrolling, the same call ends enrolment
+and replaces the session, and it proves only that the person holds the
+authenticator they just added. A code that finishes a sign-in does not count either: it
+created the session rather than confirming one, so the person confirms once
+more before adding a passkey. `step-up.test.ts` pins each of these
+facts, and `init` refuses to start if the two-factor plugin is installed without
+its verify routes, or the passkey plugin without its registration routes.
+
+On an account with two-factor on, someone who has the session _and_ the password
+can re-key the authenticator (Better Auth's `/two-factor/enable`) and then
+produce codes. So for those accounts the real bar is "the code, or the
+password". It is never the session alone. That only stops holding under
+`twoFactor({ allowPasswordless: true })`, which no house app sets, and `init`
+warns if one does.
+
+The tests run a real Better Auth instance: memory adapter, the real `twoFactor`,
+`passkey` and `magicLink` plugins, a software authenticator, and requests through
+`auth.handler` with a cookie jar. They run against **1.7.2** with
+`@better-auth/passkey` 1.7.2 and against **1.6.33** with
+`@better-auth/passkey` 1.6.33 (`better-auth-passkey-1-6`, re-pointed by the
+`better-auth-1.6` Vitest project, the same way as second-factor).
+
+#### Server
+
+```ts
+import { stepUp } from "@connextar/house/auth/step-up";
+
+plugins: [
+  twoFactor({ … }),
+  passkey({ … }),
+  secondFactorSessions(),          // the app's own admin proof: unchanged
+  secondFactorEverywhere(),
+  stepUp({                         // after twoFactor() and passkey(), before nextCookies()
+    onPasskeyAdded: ({ user, passkey }) => sendPasskeyAddedEmail(user.email, passkey.name),
+  }),
+  magicLink({ … }),
+],
+```
+
+| Option           | Default                  | What it does                                                                                                                                                                                                                                                               |
+| ---------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `windowSeconds`  | `600`                    | How long a confirmation lasts, and how young a session must be to count as a recent sign-in.                                                                                                                                                                               |
+| `routes`         | `STEP_UP_PASSKEY_ROUTES` | The routes that need a confirmation. To add one, keep the defaults: `[...STEP_UP_PASSKEY_ROUTES, "/my/route"]`. Other routes get a plain message. Router endpoints only: a server-only method such as `setPassword` has no path, so listing it guards nothing (see below). |
+| `maxAttempts`    | `5`                      | Wrong codes and passwords one session may give before it has to sign in again.                                                                                                                                                                                             |
+| `onPasskeyAdded` | none                     | Called after `/passkey/verify-registration` succeeds. See below.                                                                                                                                                                                                           |
+| `enabled`        | `true`                   | `false` turns the refusal off and keeps the endpoints, so a client that asks for status still gets an answer. `onPasskeyAdded` still runs.                                                                                                                                 |
+
+`POST /step-up/password` is rate-limited the same way as Better Auth's own
+two-factor routes: three tries in ten seconds, wherever the app's rate limiter
+is on. A wrong password gets Better Auth's own `400 INVALID_PASSWORD`. An account
+that does not confirm with a password gets `400 STEP_UP_PASSWORD_NOT_ACCEPTED`
+with its `needs`.
+
+A passkey-first sign-up (`passkey({ registration: { requireSession: false } })`)
+is let through when there is no session, because there is no existing way in to
+prove. With a session, the rule applies as usual.
+
+#### The client
+
+```ts
+import { stepUpClient } from "@connextar/house/auth/step-up/client";
+
+export const authClient = createAuthClient({ plugins: [twoFactorClient(), passkeyClient(), stepUpClient()] });
+```
+
+`authClient.stepUp.status()` answers `{ needs, confirmed, confirmedUntil, locked, sessionFresh }`,
+and `authClient.stepUp.password({ password })` gives the same shape on success.
+Better Auth's client parser turns `confirmedUntil` into a `Date`. The
+client entry imports nothing from Better Auth at runtime. The helpers are also
+on `@connextar/house/auth`.
+
+The flow for "Add a passkey":
+
+1. `status()`. If `sessionFresh` is false, show the sign-in-again message and
+   stop: the passkey plugin refuses a session older than Better Auth's
+   `session.freshAge` (a day by default) whatever it confirms, and with
+   month-long sessions that is most people. Asking for a password first and
+   then saying "sign in again" is the thing to avoid. If `confirmed`, go to
+   step 3. (Setting a first password has no such limit; that screen can ignore
+   `sessionFresh`.)
+2. Show the prompt that `needs` asks for, in the app's own dialog with its own
+   `PasswordInput`:
+   - `code`: a code field, then `authClient.twoFactor.verifyTotp({ code })`, or
+     `verifyBackupCode({ code })` behind "Use a backup code".
+   - `password`: a password field, then `authClient.stepUp.password({ password })`.
+   - `recent-sign-in`: "For your security, sign in again to add a passkey", with
+     a button that signs out and returns to the sign-in page with `?next=` back
+     here.
+   - `locked`: the same sign-in-again message.
+3. `authClient.passkey.addPasskey({ name })`.
+4. If that answers `STEP_UP_REQUIRED` (the window ran out while the person was
+   at the browser's passkey sheet), prompt and retry once:
+
+```ts
+import { isStepUpRequired, stepUpNeedsOf } from "@connextar/house/auth/step-up/client";
+
+let result = await authClient.passkey.addPasskey({ name });
+if (isStepUpRequired(result.error) && (await confirmItsYou(stepUpNeedsOf(result.error)))) {
+  result = await authClient.passkey.addPasskey({ name });
+}
+```
+
+There is no React component here. Each app already has its own dialog, its own
+`PasswordInput` and its own code field.
+
+#### The email
+
+`onPasskeyAdded({ user, passkey: { id, name?, createdAt? }, request? })` runs once
+for each passkey added, after the passkey is stored. Use it to send "A passkey
+was added to your account" through the app's own mailer. The email should say
+when, give the name if there is one, and include "If this wasn't you, remove it
+in Settings → Security and change your password". The callback cannot fail or
+undo the add: an error is logged and the passkey stays. If Better Auth's
+`advanced.backgroundTasks` is set (for example `waitUntil` on Vercel), the
+callback runs in the background. Otherwise the response waits for it. `request`
+is there for the app's own audit line (IP address, user agent).
+
+#### Setting a first password is the same hole
+
+An account that signs in by email link or Google has no password, and the house
+apps let it add one from Settings through their own `POST /api/auth/set-password`,
+which calls Better Auth's `setPassword`. A session alone was enough, so a
+borrowed session could add a password: a new way in, exactly like a passkey.
+
+`routes` cannot guard it. `setPassword` is server-only and has no path (checked
+on 1.7.2 by senco's adoption, which pins `auth.api.setPassword.path` as
+undefined), so a hook never sees it. Check in the route instead:
+
+```ts
+const status = await auth.api.stepUpStatus({ headers: request.headers });
+if (!status.confirmed) {
+  return Response.json(
+    { code: "STEP_UP_REQUIRED", message: "Confirm it's you before adding a password.", needs: status.needs },
+    { status: 403 },
+  );
+}
+await auth.api.setPassword({ body: { newPassword }, headers: request.headers });
+// then email "A password was added to your account", never failing the request
+```
+
+The answer has the same shape as the plugin's refusal, so `isStepUpRequired`
+recognises it and the same dialog serves both. Such an account has no password
+to type, so `needs` is `recent-sign-in`, or `code` if it has two-factor.
+
+#### Adopting it in an app
+
+This applies to AltEd, Quickie, PM Tool, senco, KRP, FB Web (1.7.2) and
+PharmaLine (1.6.33).
+
+1. Bump `@connextar/house` to 0.14.0.
+2. In `auth.ts`, add `stepUp({ onPasskeyAdded })` after `twoFactor()` and
+   `passkey()`, and before `nextCookies()`.
+3. Write `sendPasskeyAddedEmail` next to the app's other auth emails, and pass
+   it in `onPasskeyAdded`.
+4. Add `stepUpClient()` to the auth client.
+5. In the "Add a passkey" flow, call `status()` first, show the prompt that
+   `needs` asks for, then `addPasskey`. Retry once on `isStepUpRequired`. The
+   code prompt calls `twoFactor.verifyTotp` or `verifyBackupCode` while signed in.
+   Do not route it through the sign-in code screen.
+6. Leave the admin second-factor proof rule (`second-factor-session.ts`, AltEd
+   `admin-second-factor.ts`) as it is. Update only its comment that says
+   "Better Auth lets any fresh session register a passkey": that is now true
+   only for administrators who have confirmed.
+7. Add an app test: a signed-in session cannot get passkey registration options
+   until it confirms, and then it can.
+8. Copy: the security settings should say that adding a passkey asks for the
+   code, the password, or a fresh sign-in, and that an email follows.
+
 ### `@connextar/house/account`
 
 The contract for "your data" and "delete my account" — types, the export notice,

package/dist/auth/index.d.ts

@@ -1,4 +1,5 @@
 export { TWO_FACTOR_BLOCKED_MESSAGE, TWO_FACTOR_BLOCKED_PATHS, isTwoFactorBlockedPath, magicLinkRefusalRetired, shouldBlockForTwoFactor, totpSecretFromUri, type AuthContextLike, type TwoFactorBlockedPath, type TwoFactorLookup, } from "./two-factor-policy.js";
 export { DEFAULT_CODE_SCREEN_PATH, DEFAULT_NEXT_PARAM, SECOND_FACTOR_CHALLENGE_ROUTES, SECOND_FACTOR_EVERYWHERE_ID, type SecondFactorChallengeRoute, } from "./second-factor-routes.js";
 export { magicLinkConfirmHref, magicLinkVerifyHref, safeNextPath, secondFactorNext } from "./second-factor-next.js";
+export { DEFAULT_STEP_UP_WINDOW_SECONDS, STEP_UP_ERROR_CODES, STEP_UP_ID, STEP_UP_PASSKEY_ROUTES, isStepUpRequired, stepUpNeedsOf, type StepUpErrorCode, type StepUpNeeds, type StepUpStatus, } from "./step-up-routes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,EAC3B,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,EAC3B,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACpH,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,UAAU,EACV,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC"}

package/dist/auth/index.js

@@ -1,4 +1,5 @@
 export { TWO_FACTOR_BLOCKED_MESSAGE, TWO_FACTOR_BLOCKED_PATHS, isTwoFactorBlockedPath, magicLinkRefusalRetired, shouldBlockForTwoFactor, totpSecretFromUri, } from "./two-factor-policy.js";
 export { DEFAULT_CODE_SCREEN_PATH, DEFAULT_NEXT_PARAM, SECOND_FACTOR_CHALLENGE_ROUTES, SECOND_FACTOR_EVERYWHERE_ID, } from "./second-factor-routes.js";
 export { magicLinkConfirmHref, magicLinkVerifyHref, safeNextPath, secondFactorNext } from "./second-factor-next.js";
+export { DEFAULT_STEP_UP_WINDOW_SECONDS, STEP_UP_ERROR_CODES, STEP_UP_ID, STEP_UP_PASSKEY_ROUTES, isStepUpRequired, stepUpNeedsOf, } from "./step-up-routes.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,GAIlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,GAIlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACpH,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,UAAU,EACV,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,GAId,MAAM,qBAAqB,CAAC"}

package/dist/auth/step-up-client-index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@connextar/house/auth/step-up/client` — the client half: a Better Auth client plugin, and the helpers a dialog
+ * needs to recognise the refusal. Nothing here imports Better Auth at runtime.
+ */
+export { stepUpClient } from "./step-up-client.js";
+export { STEP_UP_ERROR_CODES, isStepUpRequired, stepUpNeedsOf, type StepUpErrorCode, type StepUpNeeds, type StepUpStatus, } from "./step-up-routes.js";
+//# sourceMappingURL=step-up-client-index.d.ts.map

package/dist/auth/step-up-client-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-client-index.d.ts","sourceRoot":"","sources":["../../src/auth/step-up-client-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC"}

package/dist/auth/step-up-client-index.js

@@ -0,0 +1,7 @@
+/**
+ * `@connextar/house/auth/step-up/client` — the client half: a Better Auth client plugin, and the helpers a dialog
+ * needs to recognise the refusal. Nothing here imports Better Auth at runtime.
+ */
+export { stepUpClient } from "./step-up-client.js";
+export { STEP_UP_ERROR_CODES, isStepUpRequired, stepUpNeedsOf, } from "./step-up-routes.js";
+//# sourceMappingURL=step-up-client-index.js.map

package/dist/auth/step-up-client-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-client-index.js","sourceRoot":"","sources":["../../src/auth/step-up-client-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,GAId,MAAM,qBAAqB,CAAC"}

package/dist/auth/step-up-client.d.ts

@@ -0,0 +1,31 @@
+import type { stepUp } from "./step-up.js";
+/**
+ * The client half of `stepUp()`: `authClient.stepUp.status()` and `authClient.stepUp.password({ password })`, typed
+ * from the server plugin. A code confirms through Better Auth's own `authClient.twoFactor.verifyTotp({ code })` (or
+ * `verifyBackupCode`), called while signed in; nothing here wraps it.
+ *
+ * Imports nothing from Better Auth at runtime, so it costs a client bundle only its own few lines.
+ */
+export declare function stepUpClient(): {
+    id: "step-up";
+    $InferServerPlugin: ReturnType<typeof stepUp>;
+    pathMethods: {
+        "/step-up/status": "GET";
+        "/step-up/password": "POST";
+    };
+    $ERROR_CODES: {
+        readonly STEP_UP_REQUIRED: {
+            readonly code: "STEP_UP_REQUIRED";
+            readonly message: "Confirm it's you before adding a passkey.";
+        };
+        readonly STEP_UP_LOCKED: {
+            readonly code: "STEP_UP_LOCKED";
+            readonly message: "Too many wrong attempts. Sign in again, then confirm it's you.";
+        };
+        readonly STEP_UP_PASSWORD_NOT_ACCEPTED: {
+            readonly code: "STEP_UP_PASSWORD_NOT_ACCEPTED";
+            readonly message: "This account doesn't confirm with a password.";
+        };
+    };
+};
+//# sourceMappingURL=step-up-client.d.ts.map

package/dist/auth/step-up-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-client.d.ts","sourceRoot":"","sources":["../../src/auth/step-up-client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C;;;;;;GAMG;AACH,wBAAgB,YAAY;;wBAGE,UAAU,CAAC,OAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;EAOtD"}

package/dist/auth/step-up-client.js

@@ -0,0 +1,20 @@
+import { STEP_UP_ERROR_CODES, STEP_UP_ID } from "./step-up-routes.js";
+/**
+ * The client half of `stepUp()`: `authClient.stepUp.status()` and `authClient.stepUp.password({ password })`, typed
+ * from the server plugin. A code confirms through Better Auth's own `authClient.twoFactor.verifyTotp({ code })` (or
+ * `verifyBackupCode`), called while signed in; nothing here wraps it.
+ *
+ * Imports nothing from Better Auth at runtime, so it costs a client bundle only its own few lines.
+ */
+export function stepUpClient() {
+    return {
+        id: STEP_UP_ID,
+        $InferServerPlugin: {},
+        pathMethods: {
+            "/step-up/status": "GET",
+            "/step-up/password": "POST",
+        },
+        $ERROR_CODES: STEP_UP_ERROR_CODES,
+    };
+}
+//# sourceMappingURL=step-up-client.js.map

package/dist/auth/step-up-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-client.js","sourceRoot":"","sources":["../../src/auth/step-up-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,EAAE,EAAE,UAAU;QACd,kBAAkB,EAAE,EAA+B;QACnD,WAAW,EAAE;YACX,iBAAiB,EAAE,KAAK;YACxB,mBAAmB,EAAE,MAAM;SAC5B;QACD,YAAY,EAAE,mBAAmB;KACD,CAAC;AACrC,CAAC"}

package/dist/auth/step-up-index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `@connextar/house/auth/step-up` — the server half: a Better Auth plugin. Kept off `@connextar/house/auth` so that
+ * entry point stays free of any Better Auth import and safe for client components; the client plugin is
+ * `@connextar/house/auth/step-up/client`.
+ */
+export { stepUp, type PasskeyAddedData, type StepUpOptions } from "./step-up.js";
+export { DEFAULT_STEP_UP_MAX_ATTEMPTS, DEFAULT_STEP_UP_WINDOW_SECONDS, STEP_UP_CODE_ROUTES, STEP_UP_ERROR_CODES, STEP_UP_ID, STEP_UP_PASSKEY_ROUTES, isStepUpRequired, stepUpNeedsOf, type StepUpErrorCode, type StepUpNeeds, type StepUpStatus, } from "./step-up-routes.js";
+//# sourceMappingURL=step-up-index.d.ts.map

package/dist/auth/step-up-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-index.d.ts","sourceRoot":"","sources":["../../src/auth/step-up-index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC"}

package/dist/auth/step-up-index.js

@@ -0,0 +1,8 @@
+/**
+ * `@connextar/house/auth/step-up` — the server half: a Better Auth plugin. Kept off `@connextar/house/auth` so that
+ * entry point stays free of any Better Auth import and safe for client components; the client plugin is
+ * `@connextar/house/auth/step-up/client`.
+ */
+export { stepUp } from "./step-up.js";
+export { DEFAULT_STEP_UP_MAX_ATTEMPTS, DEFAULT_STEP_UP_WINDOW_SECONDS, STEP_UP_CODE_ROUTES, STEP_UP_ERROR_CODES, STEP_UP_ID, STEP_UP_PASSKEY_ROUTES, isStepUpRequired, stepUpNeedsOf, } from "./step-up-routes.js";
+//# sourceMappingURL=step-up-index.js.map

package/dist/auth/step-up-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-index.js","sourceRoot":"","sources":["../../src/auth/step-up-index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAA6C,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,GAId,MAAM,qBAAqB,CAAC"}

package/dist/auth/step-up-routes.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The vocabulary shared by the step-up server plugin (`@connextar/house/auth/step-up`), its client plugin
+ * (`@connextar/house/auth/step-up/client`) and the pure helpers in `@connextar/house/auth`. Kept free of any Better
+ * Auth import so a client component can recognise a refusal without pulling the server in.
+ */
+/** The Better Auth plugin id of `stepUp()` and `stepUpClient()`. */
+export declare const STEP_UP_ID = "step-up";
+/**
+ * The routes that add a passkey — a new way in. `@better-auth/passkey` guards both with nothing but a session under
+ * a day old (`session.freshAge`); `stepUp()` puts a recent proof of an existing way in in front of them.
+ */
+export declare const STEP_UP_PASSKEY_ROUTES: readonly ["/passkey/generate-register-options", "/passkey/verify-registration"];
+/**
+ * Better Auth's own code checks. Called with a live session on an account that already has two-factor on, they check
+ * the code and create nothing — which is what `stepUp()` records as a confirmation.
+ */
+export declare const STEP_UP_CODE_ROUTES: readonly ["/two-factor/verify-totp", "/two-factor/verify-backup-code"];
+/** How long a confirmation lasts unless an app says otherwise: ten minutes. */
+export declare const DEFAULT_STEP_UP_WINDOW_SECONDS = 600;
+/** How many wrong answers one session may give before it has to sign in again. */
+export declare const DEFAULT_STEP_UP_MAX_ATTEMPTS = 5;
+/**
+ * What confirms "it's you" for this account:
+ *
+ * - `code` — two-factor is on: the authenticator code or a backup code, entered now.
+ * - `password` — no two-factor, but a password: the password.
+ * - `recent-sign-in` — neither (email link or social sign-in only): a sign-in within the window. Nothing to type;
+ *   the screen asks them to sign in again.
+ */
+export type StepUpNeeds = "code" | "password" | "recent-sign-in";
+/** `GET /step-up/status`, and what `POST /step-up/password` answers on success. */
+export interface StepUpStatus {
+    needs: StepUpNeeds;
+    /** Whether this session may add a passkey now. */
+    confirmed: boolean;
+    /** When the confirmation lapses (ISO 8601), or null when there is none. */
+    confirmedUntil: string | null;
+    /** Too many wrong answers on this session: it has to sign in again before it can confirm. */
+    locked: boolean;
+    /**
+     * Whether the session is young enough for Better Auth to let it add a passkey at all (`session.freshAge`, a day
+     * by default; always true when that check is off). When false, confirming changes nothing: the passkey plugin
+     * answers SESSION_NOT_FRESH whatever this session proves. Ask them to sign in again before asking for anything.
+     * Setting a first password has no such limit, so a set-password screen can ignore it.
+     */
+    sessionFresh: boolean;
+}
+/** The error codes the plugin answers with. Shaped as Better Auth's own `$ERROR_CODES`. */
+export declare const STEP_UP_ERROR_CODES: {
+    readonly STEP_UP_REQUIRED: {
+        readonly code: "STEP_UP_REQUIRED";
+        readonly message: "Confirm it's you before adding a passkey.";
+    };
+    readonly STEP_UP_LOCKED: {
+        readonly code: "STEP_UP_LOCKED";
+        readonly message: "Too many wrong attempts. Sign in again, then confirm it's you.";
+    };
+    readonly STEP_UP_PASSWORD_NOT_ACCEPTED: {
+        readonly code: "STEP_UP_PASSWORD_NOT_ACCEPTED";
+        readonly message: "This account doesn't confirm with a password.";
+    };
+};
+export type StepUpErrorCode = keyof typeof STEP_UP_ERROR_CODES;
+/** The refusal's message on a route that is not a passkey route (one an app added to `routes`). */
+export declare const STEP_UP_REQUIRED_GENERIC_MESSAGE = "Confirm it's you before making this change.";
+/**
+ * True when `error` is the step-up refusal: `{ code: "STEP_UP_REQUIRED" }` as Better Auth's client returns it in
+ * `{ error }`, as a thrown `APIError` carries it in `.body`, or wrapped once more in `.error`.
+ */
+export declare function isStepUpRequired(error: unknown): boolean;
+/** What the refusal (or a `STEP_UP_PASSWORD_NOT_ACCEPTED`) says confirms this account, or null if it says nothing. */
+export declare function stepUpNeedsOf(error: unknown): StepUpNeeds | null;
+//# sourceMappingURL=step-up-routes.d.ts.map

package/dist/auth/step-up-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-routes.d.ts","sourceRoot":"","sources":["../../src/auth/step-up-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oEAAoE;AACpE,eAAO,MAAM,UAAU,YAAY,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,sBAAsB,iFAAkF,CAAC;AAEtH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,wEAAyE,CAAC;AAE1G,+EAA+E;AAC/E,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEjE,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,WAAW,CAAC;IACnB,kDAAkD;IAClD,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6FAA6F;IAC7F,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;CAUtB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE/D,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,gDAAgD,CAAC;AAa9F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAExD;AAED,sHAAsH;AACtH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAKhE"}

package/dist/auth/step-up-routes.js

@@ -0,0 +1,59 @@
+/**
+ * The vocabulary shared by the step-up server plugin (`@connextar/house/auth/step-up`), its client plugin
+ * (`@connextar/house/auth/step-up/client`) and the pure helpers in `@connextar/house/auth`. Kept free of any Better
+ * Auth import so a client component can recognise a refusal without pulling the server in.
+ */
+/** The Better Auth plugin id of `stepUp()` and `stepUpClient()`. */
+export const STEP_UP_ID = "step-up";
+/**
+ * The routes that add a passkey — a new way in. `@better-auth/passkey` guards both with nothing but a session under
+ * a day old (`session.freshAge`); `stepUp()` puts a recent proof of an existing way in in front of them.
+ */
+export const STEP_UP_PASSKEY_ROUTES = ["/passkey/generate-register-options", "/passkey/verify-registration"];
+/**
+ * Better Auth's own code checks. Called with a live session on an account that already has two-factor on, they check
+ * the code and create nothing — which is what `stepUp()` records as a confirmation.
+ */
+export const STEP_UP_CODE_ROUTES = ["/two-factor/verify-totp", "/two-factor/verify-backup-code"];
+/** How long a confirmation lasts unless an app says otherwise: ten minutes. */
+export const DEFAULT_STEP_UP_WINDOW_SECONDS = 600;
+/** How many wrong answers one session may give before it has to sign in again. */
+export const DEFAULT_STEP_UP_MAX_ATTEMPTS = 5;
+/** The error codes the plugin answers with. Shaped as Better Auth's own `$ERROR_CODES`. */
+export const STEP_UP_ERROR_CODES = {
+    STEP_UP_REQUIRED: { code: "STEP_UP_REQUIRED", message: "Confirm it's you before adding a passkey." },
+    STEP_UP_LOCKED: {
+        code: "STEP_UP_LOCKED",
+        message: "Too many wrong attempts. Sign in again, then confirm it's you.",
+    },
+    STEP_UP_PASSWORD_NOT_ACCEPTED: {
+        code: "STEP_UP_PASSWORD_NOT_ACCEPTED",
+        message: "This account doesn't confirm with a password.",
+    },
+};
+/** The refusal's message on a route that is not a passkey route (one an app added to `routes`). */
+export const STEP_UP_REQUIRED_GENERIC_MESSAGE = "Confirm it's you before making this change.";
+const NEEDS = ["code", "password", "recent-sign-in"];
+/** The error body, wherever the caller's library put it: the object itself, `.error` (Better Auth's client) or `.body`. */
+function errorBodies(error) {
+    if (!error || typeof error !== "object")
+        return [];
+    const outer = error;
+    return [outer, outer.error, outer.body].filter((body) => !!body && typeof body === "object");
+}
+/**
+ * True when `error` is the step-up refusal: `{ code: "STEP_UP_REQUIRED" }` as Better Auth's client returns it in
+ * `{ error }`, as a thrown `APIError` carries it in `.body`, or wrapped once more in `.error`.
+ */
+export function isStepUpRequired(error) {
+    return errorBodies(error).some((body) => body.code === STEP_UP_ERROR_CODES.STEP_UP_REQUIRED.code);
+}
+/** What the refusal (or a `STEP_UP_PASSWORD_NOT_ACCEPTED`) says confirms this account, or null if it says nothing. */
+export function stepUpNeedsOf(error) {
+    for (const body of errorBodies(error)) {
+        if (typeof body.needs === "string" && NEEDS.includes(body.needs))
+            return body.needs;
+    }
+    return null;
+}
+//# sourceMappingURL=step-up-routes.js.map

package/dist/auth/step-up-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-routes.js","sourceRoot":"","sources":["../../src/auth/step-up-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,oCAAoC,EAAE,8BAA8B,CAAU,CAAC;AAEtH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,yBAAyB,EAAE,gCAAgC,CAAU,CAAC;AAE1G,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AA8B9C,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,gBAAgB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACpG,cAAc,EAAE;QACd,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gEAAgE;KAC1E;IACD,6BAA6B,EAAE;QAC7B,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,+CAA+C;KACzD;CACO,CAAC;AAIX,mGAAmG;AACnG,MAAM,CAAC,MAAM,gCAAgC,GAAG,6CAA6C,CAAC;AAE9F,MAAM,KAAK,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAyB,CAAC;AAEhG,2HAA2H;AAC3H,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAC5C,CAAC,IAAI,EAAmC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAC9E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAoB,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/step-up.d.ts

@@ -0,0 +1,179 @@
+import type { User } from "better-auth";
+import * as z from "zod";
+import { type StepUpNeeds, type StepUpStatus } from "./step-up-routes.js";
+/**
+ * A new way in needs a recent proof of an existing one.
+ *
+ * `@better-auth/passkey` lets any session under a day old (`session.freshAge`) register a passkey — no password, no
+ * code. A passkey then signs in in one step, skips the second factor on purpose, and survives a password reset
+ * (which revokes sessions, not passkeys). So a stolen or borrowed session becomes a durable way in. `stepUp()` puts a
+ * recent confirmation in front of `/passkey/generate-register-options` and `/passkey/verify-registration`. What
+ * confirms depends on the account:
+ *
+ * - **two-factor on** → the authenticator code or a backup code, entered now. The client calls Better Auth's own
+ *   `/two-factor/verify-totp` or `/two-factor/verify-backup-code` with its live session: Better Auth checks the code
+ *   and creates nothing, and this plugin records a confirmation for that session when the check succeeds. Nothing of
+ *   the two-factor plugin is copied — no secret, no decryption. Only an account that already had two-factor on
+ *   before the call counts: on an unenrolled account the same call is the end of enrolment, which proves only that
+ *   the person holds the authenticator they have just added.
+ * - **no two-factor, a password** → the password, at `POST /step-up/password`, checked by Better Auth's own
+ *   `ctx.context.password.checkPassword`.
+ * - **neither** (email link or social only) → a sign-in within the window: the session itself is younger than
+ *   `windowSeconds`. Nothing to type; the screen asks them to sign in again.
+ *
+ * A confirmation is a row in Better Auth's `verification` table (`step-up:<session id>`, the user id as its value,
+ * expiring after the window). It belongs to that one session, is not used up by the routes it unlocks, and never
+ * counts for another session or another user.
+ *
+ * **Wrong answers.** Better Auth's two-factor lockout and attempt limit apply only to a sign-in; a code checked with a
+ * live session is limited by nothing but the rate limiter. So one session gets `maxAttempts` wrong answers, codes and
+ * passwords together, before it has to sign in again — and once it has spent them, its live code checks are refused
+ * too, so a stolen session cannot keep guessing.
+ *
+ * Passkey deletion is not gated: removing a way in is not a new one. An app's own administrator second-factor proof
+ * (`second-factor-session`) is unchanged and applies on top; either refusal can stop a registration.
+ *
+ * **Order**: list it after `twoFactor()` and `passkey()`, and before `nextCookies()`.
+ */
+export interface StepUpOptions {
+    /** Turn the refusal off for this app (`false`) while keeping the plugin and its endpoints. Default `true`. */
+    enabled?: boolean;
+    /** How long a confirmation lasts, and how young a session must be to count as a recent sign-in. Default 600. */
+    windowSeconds?: number;
+    /**
+     * The routes that need a confirmation. Default {@link STEP_UP_PASSKEY_ROUTES}; to add a route, keep those:
+     * `routes: [...STEP_UP_PASSKEY_ROUTES, "/my/route"]`.
+     *
+     * Only endpoints reached through Better Auth's router have a path to match. A server-only method has none —
+     * `auth.api.setPassword` among them — so listing "/set-password" here matches nothing and guards nothing. Check
+     * in the caller instead: `auth.api.stepUpStatus({ headers })` before the call, and refuse when not confirmed.
+     */
+    routes?: readonly string[];
+    /** Wrong answers (codes and passwords together) one session may give before it must sign in again. Default 5. */
+    maxAttempts?: number;
+    /**
+     * Called once a passkey has been added (`/passkey/verify-registration` succeeded) — to email "A passkey was added
+     * to your account" with the app's own mailer. It cannot fail or undo the registration: an error is logged and the
+     * passkey stays. With Better Auth's `advanced.backgroundTasks` set, it runs in the background.
+     */
+    onPasskeyAdded?: (data: PasskeyAddedData) => Promise<void> | void;
+}
+export interface PasskeyAddedData {
+    user: User;
+    passkey: {
+        id: string;
+        name?: string;
+        createdAt?: Date;
+    };
+    /** The registration request, when there was one (not for a server-side `auth.api` call). */
+    request?: Request;
+}
+export declare function stepUp(options?: StepUpOptions): {
+    id: "step-up";
+    options: {
+        enabled: boolean;
+        windowSeconds: number;
+        maxAttempts: number;
+        routes: string[];
+        /**
+         * Called once a passkey has been added (`/passkey/verify-registration` succeeded) — to email "A passkey was added
+         * to your account" with the app's own mailer. It cannot fail or undo the registration: an error is logged and the
+         * passkey stays. With Better Auth's `advanced.backgroundTasks` set, it runs in the background.
+         */
+        onPasskeyAdded?: (data: PasskeyAddedData) => Promise<void> | void;
+    };
+    init(ctx: import("better-auth").AuthContext): void;
+    endpoints: {
+        stepUpStatus: import("better-auth").StrictEndpoint<"/step-up/status", {
+            method: "GET";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, StepUpStatus>;
+        stepUpPassword: import("better-auth").StrictEndpoint<"/step-up/password", {
+            method: "POST";
+            body: z.ZodObject<{
+                password: z.ZodString;
+            }, z.core.$strip>;
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            confirmed: true;
+            confirmedUntil: string;
+            locked: false;
+            needs: StepUpNeeds;
+            sessionFresh: boolean;
+        }>;
+    };
+    hooks: {
+        before: {
+            matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth/api").AuthMiddleware;
+        }[];
+        after: {
+            matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth/api").AuthMiddleware;
+        }[];
+    };
+    rateLimit: {
+        pathMatcher: (path: string) => path is "/step-up/password";
+        window: number;
+        max: number;
+    }[];
+    $ERROR_CODES: {
+        readonly STEP_UP_REQUIRED: {
+            readonly code: "STEP_UP_REQUIRED";
+            readonly message: "Confirm it's you before adding a passkey.";
+        };
+        readonly STEP_UP_LOCKED: {
+            readonly code: "STEP_UP_LOCKED";
+            readonly message: "Too many wrong attempts. Sign in again, then confirm it's you.";
+        };
+        readonly STEP_UP_PASSWORD_NOT_ACCEPTED: {
+            readonly code: "STEP_UP_PASSWORD_NOT_ACCEPTED";
+            readonly message: "This account doesn't confirm with a password.";
+        };
+    };
+};
+//# sourceMappingURL=step-up.d.ts.map

package/dist/auth/step-up.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.d.ts","sourceRoot":"","sources":["../../src/auth/step-up.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,IAAI,EAAE,MAAM,aAAa,CAAC;AAS1D,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,WAAW,aAAa;IAC5B,8GAA8G;IAC9G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gHAAgH;IAChH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iHAAiH;IACjH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IACzD,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAwCD,wBAAgB,MAAM,CAAC,OAAO,GAAE,aAAkB;;;;;;;QArDhD;;;;WAIG;yBACc,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;;;;;;;;;;;;;;;iCAOhD,CAAC;iCAGoB,CAAC;;;;;;;;;6BAIxB,CAAA;;;;;;;;;;;;;;;;;;;iCAPE,CAAC;iCAGoB,CAAC;;;;;;;;;6BAIxB,CAAA;;;;;;;;;;;;;;;;;;;;;;;4BA4UqB,MAAM;;;;;;;;;;;;;;;;;;EAG3C"}

package/dist/auth/step-up.js

@@ -0,0 +1,308 @@
+import { APIError, createAuthEndpoint, createAuthMiddleware, getAuthoritativeSessionFromCtx, isAPIError, sensitiveSessionMiddleware, } from "better-auth/api";
+import * as z from "zod";
+import { DEFAULT_STEP_UP_MAX_ATTEMPTS, DEFAULT_STEP_UP_WINDOW_SECONDS, STEP_UP_CODE_ROUTES, STEP_UP_ERROR_CODES, STEP_UP_ID, STEP_UP_PASSKEY_ROUTES, STEP_UP_REQUIRED_GENERIC_MESSAGE, } from "./step-up-routes.js";
+const confirmationKey = (sessionId) => `${STEP_UP_ID}:${sessionId}`;
+const attemptsKey = (sessionId) => `${STEP_UP_ID}-attempts:${sessionId}`;
+const PASSKEY_VERIFY_REGISTRATION = "/passkey/verify-registration";
+function jsonBody(response) {
+    // `ctx.json()` answers the plain object inside hooks, and a `{ _flag: "json", body }` wrapper when the caller
+    // asked for a Response; accept either.
+    if (response && typeof response === "object" && response._flag === "json") {
+        return response.body;
+    }
+    return response;
+}
+const toDate = (value) => (value instanceof Date ? value : new Date(value));
+function endpointPaths(plugin) {
+    return new Set(Object.values(plugin?.endpoints ?? {}).map((endpoint) => endpoint?.path ?? ""));
+}
+export function stepUp(options = {}) {
+    const enabled = options.enabled !== false;
+    const windowSeconds = options.windowSeconds ?? DEFAULT_STEP_UP_WINDOW_SECONDS;
+    const maxAttempts = options.maxAttempts ?? DEFAULT_STEP_UP_MAX_ATTEMPTS;
+    const routes = new Set(options.routes ?? STEP_UP_PASSKEY_ROUTES);
+    const passkeyRoutes = STEP_UP_PASSKEY_ROUTES;
+    const codeRoutes = STEP_UP_CODE_ROUTES;
+    if (!Number.isFinite(windowSeconds) || windowSeconds <= 0) {
+        throw new Error(`[step-up] windowSeconds must be a positive number of seconds, got ${String(windowSeconds)}.`);
+    }
+    if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {
+        throw new Error(`[step-up] maxAttempts must be a whole number of at least 1, got ${String(maxAttempts)}.`);
+    }
+    /** Code checks under way, keyed by the request's own context object (shared by its before- and after-hooks). */
+    const pending = new WeakMap();
+    function twoFactorInstalled(context) {
+        return (context.options.plugins ?? []).some((plugin) => plugin.id === "two-factor");
+    }
+    async function needsFor(context, user) {
+        if (user.twoFactorEnabled === true && twoFactorInstalled(context))
+            return "code";
+        // `findAccounts` rather than 1.7's `findCredentialAccount`: 1.6 has only the former.
+        const accounts = await context.internalAdapter.findAccounts(user.id);
+        if (accounts.some((account) => account.providerId === "credential" && !!account.password))
+            return "password";
+        return "recent-sign-in";
+    }
+    async function attemptsUsed(context, sessionId) {
+        const row = await context.internalAdapter.findVerificationValue(attemptsKey(sessionId));
+        if (!row || toDate(row.expiresAt).getTime() <= Date.now())
+            return 0;
+        const used = Number(row.value);
+        return Number.isInteger(used) && used > 0 ? used : 0;
+    }
+    async function recordWrongAnswer(context, session) {
+        const used = await attemptsUsed(context, session.id);
+        await context.internalAdapter.deleteVerificationByIdentifier(attemptsKey(session.id));
+        // Kept as long as the session was going to last when it was spent, so the budget does not refill while it lives.
+        const lasts = Math.max(toDate(session.expiresAt).getTime(), Date.now() + windowSeconds * 1000);
+        await context.internalAdapter.createVerificationValue({
+            identifier: attemptsKey(session.id),
+            value: String(used + 1),
+            expiresAt: new Date(lasts),
+        });
+    }
+    async function recordConfirmation(context, session) {
+        const expiresAt = new Date(Date.now() + windowSeconds * 1000);
+        await context.internalAdapter.deleteVerificationByIdentifier(confirmationKey(session.id));
+        await context.internalAdapter.createVerificationValue({
+            identifier: confirmationKey(session.id),
+            value: session.userId,
+            expiresAt,
+        });
+        return expiresAt;
+    }
+    async function statusFor(context, live) {
+        const needs = await needsFor(context, live.user);
+        const locked = needs !== "recent-sign-in" && (await attemptsUsed(context, live.session.id)) >= maxAttempts;
+        const now = Date.now();
+        // The passkey plugin's own freshSessionMiddleware rule, so a screen can say "sign in again" before it asks
+        // for a password the passkey routes would then refuse anyway.
+        const freshAge = context.sessionConfig.freshAge;
+        const sessionFresh = freshAge === 0 || now - toDate(live.session.createdAt).getTime() < freshAge * 1000;
+        const row = await context.internalAdapter.findVerificationValue(confirmationKey(live.session.id));
+        if (row && row.value === live.session.userId && row.value === live.user.id) {
+            const until = toDate(row.expiresAt);
+            if (until.getTime() > now) {
+                return { needs, confirmed: true, confirmedUntil: until.toISOString(), locked, sessionFresh };
+            }
+        }
+        if (needs === "recent-sign-in") {
+            const until = new Date(toDate(live.session.createdAt).getTime() + windowSeconds * 1000);
+            if (until.getTime() > now) {
+                return { needs, confirmed: true, confirmedUntil: until.toISOString(), locked, sessionFresh };
+            }
+        }
+        return { needs, confirmed: false, confirmedUntil: null, locked, sessionFresh };
+    }
+    /** The session as the session store has it now — never the cookie cache, which can outlive a revoked session. */
+    async function liveSession(ctx) {
+        const current = (await getAuthoritativeSessionFromCtx(ctx));
+        return current?.session ? current : null;
+    }
+    function passkeyFirstRegistration(context, path) {
+        if (!passkeyRoutes.includes(path))
+            return false;
+        const passkey = (context.options.plugins ?? []).find((plugin) => plugin.id === "passkey");
+        return passkey?.options?.registration?.requireSession === false;
+    }
+    const gate = {
+        matcher: (ctx) => enabled && routes.has(ctx.path ?? ""),
+        handler: createAuthMiddleware(async (ctx) => {
+            const live = await liveSession(ctx);
+            if (!live) {
+                // A passkey-first sign-up (`registration.requireSession: false`) adds a passkey to an account that has no
+                // other way in yet: there is nothing to prove, and the passkey plugin's own rules apply.
+                if (passkeyFirstRegistration(ctx.context, ctx.path))
+                    return;
+                // Refuse here rather than leave it to the route, whose own check accepts the session cookie cache for a few
+                // minutes — long enough for a just-revoked session to slip a passkey through.
+                throw new APIError("UNAUTHORIZED", { message: "Unauthorized", code: "UNAUTHORIZED" });
+            }
+            const status = await statusFor(ctx.context, live);
+            if (status.confirmed)
+                return;
+            throw new APIError("FORBIDDEN", {
+                code: STEP_UP_ERROR_CODES.STEP_UP_REQUIRED.code,
+                message: passkeyRoutes.includes(ctx.path)
+                    ? STEP_UP_ERROR_CODES.STEP_UP_REQUIRED.message
+                    : STEP_UP_REQUIRED_GENERIC_MESSAGE,
+                needs: status.needs,
+            });
+        }),
+    };
+    const beforeCodeCheck = {
+        matcher: (ctx) => enabled && codeRoutes.includes(ctx.path ?? ""),
+        handler: createAuthMiddleware(async (ctx) => {
+            const live = await liveSession(ctx);
+            // No live session: a sign-in finishing with its code. Two-factor off: enrolment. Neither confirms anything.
+            if (!live || live.user.twoFactorEnabled !== true)
+                return;
+            if ((await attemptsUsed(ctx.context, live.session.id)) >= maxAttempts) {
+                throw new APIError("FORBIDDEN", { ...STEP_UP_ERROR_CODES.STEP_UP_LOCKED, needs: "code" });
+            }
+            pending.set(ctx.context, { session: live.session });
+        }),
+    };
+    const afterCodeCheck = {
+        matcher: (ctx) => enabled && codeRoutes.includes(ctx.path ?? ""),
+        handler: createAuthMiddleware(async (ctx) => {
+            const check = pending.get(ctx.context);
+            if (!check)
+                return;
+            pending.delete(ctx.context);
+            try {
+                const returned = ctx.context.returned;
+                if (isAPIError(returned)) {
+                    // In the live-session branch a 401 means one thing: the code was wrong.
+                    const wrong = returned.statusCode === 401;
+                    if (wrong)
+                        await recordWrongAnswer(ctx.context, check.session);
+                    return;
+                }
+                // Better Auth's live-session branch answers with the session it was called with, and creates none. Anything
+                // else (a new session, a different token) is not the call this was told about: it proves nothing here.
+                const token = jsonBody(returned)?.token;
+                if (token !== check.session.token)
+                    return;
+                await recordConfirmation(ctx.context, check.session);
+            }
+            catch (error) {
+                // Failing to record only means being asked again — the safe way round — and must not fail the code check.
+                ctx.context.logger.error("[step-up] could not record a code check", error);
+            }
+        }),
+    };
+    const afterPasskeyAdded = {
+        matcher: (ctx) => !!options.onPasskeyAdded && ctx.path === PASSKEY_VERIFY_REGISTRATION,
+        handler: createAuthMiddleware(async (ctx) => {
+            const notify = options.onPasskeyAdded;
+            if (!notify || isAPIError(ctx.context.returned))
+                return;
+            try {
+                // Both lines answer with the stored row (1.7 adds `session` and `user` when asked to create a session).
+                let row = jsonBody(ctx.context.returned);
+                if (typeof row?.id !== "string" || typeof row.userId !== "string") {
+                    const userId = ctx.context.session?.user?.id;
+                    if (!userId)
+                        return;
+                    const [newest] = await ctx.context.adapter.findMany({
+                        model: "passkey",
+                        where: [{ field: "userId", value: userId }],
+                        sortBy: { field: "createdAt", direction: "desc" },
+                        limit: 1,
+                    });
+                    row = newest;
+                }
+                if (typeof row?.id !== "string" || typeof row.userId !== "string")
+                    return;
+                const user = await ctx.context.internalAdapter.findUserById(row.userId);
+                if (!user)
+                    return;
+                const createdAt = row.createdAt instanceof Date || typeof row.createdAt === "string" ? toDate(row.createdAt) : undefined;
+                const passkey = {
+                    id: row.id,
+                    ...(typeof row.name === "string" && row.name ? { name: row.name } : {}),
+                    ...(createdAt ? { createdAt } : {}),
+                };
+                const logger = ctx.context.logger;
+                const run = (async () => {
+                    try {
+                        await notify({ user, passkey, ...(ctx.request ? { request: ctx.request } : {}) });
+                    }
+                    catch (error) {
+                        logger.error("[step-up] onPasskeyAdded failed; the passkey was added", error);
+                    }
+                })();
+                await ctx.context.runInBackgroundOrAwait(run);
+            }
+            catch (error) {
+                ctx.context.logger.error("[step-up] could not read the passkey that was added", error);
+            }
+        }),
+    };
+    return {
+        id: STEP_UP_ID,
+        options: { ...options, enabled, windowSeconds, maxAttempts, routes: [...routes] },
+        init(ctx) {
+            if (!enabled)
+                return;
+            const plugins = ctx.options.plugins ?? [];
+            const twoFactor = plugins.find((plugin) => plugin.id === "two-factor");
+            if (twoFactor) {
+                const paths = endpointPaths(twoFactor);
+                const missing = codeRoutes.filter((path) => !paths.has(path));
+                if (missing.length) {
+                    throw new Error(`[step-up] Better Auth's twoFactor() plugin no longer exposes ${missing.join(" and ")}, which is how an ` +
+                        "account with two-factor on confirms it's them. This Better Auth version changed it — check " +
+                        "@connextar/house's supported Better Auth range.");
+                }
+            }
+            if (twoFactor?.options?.allowPasswordless) {
+                ctx.logger.warn("[step-up] twoFactor({ allowPasswordless: true }) lets a session alone re-key two-factor on an account " +
+                    "without a password, so for those accounts a code proves no more than the session does.");
+            }
+            const passkey = plugins.find((plugin) => plugin.id === "passkey");
+            if (passkey) {
+                const paths = endpointPaths(passkey);
+                const missing = passkeyRoutes.filter((path) => !paths.has(path));
+                if (missing.length) {
+                    throw new Error(`[step-up] the passkey plugin no longer registers passkeys at ${missing.join(" and ")}, so the refusal ` +
+                        "would guard nothing. Check @connextar/house's supported Better Auth range.");
+                }
+            }
+            else if (passkeyRoutes.some((path) => routes.has(path))) {
+                ctx.logger.warn("[step-up] no passkey() plugin is installed, so there is no passkey registration to guard.");
+            }
+            const ownIndex = plugins.findIndex((plugin) => plugin.id === STEP_UP_ID);
+            const nextCookiesIndex = plugins.findIndex((plugin) => plugin.id === "next-cookies");
+            if (nextCookiesIndex !== -1 && nextCookiesIndex < ownIndex) {
+                ctx.logger.warn("[step-up] is listed after nextCookies(); list it before, so the cookies it sets reach Next.");
+            }
+        },
+        endpoints: {
+            stepUpStatus: createAuthEndpoint("/step-up/status", { method: "GET", use: [sensitiveSessionMiddleware] }, async (ctx) => ctx.json(await statusFor(ctx.context, ctx.context.session))),
+            stepUpPassword: createAuthEndpoint("/step-up/password", { method: "POST", body: z.object({ password: z.string() }), use: [sensitiveSessionMiddleware] }, async (ctx) => {
+                const live = ctx.context.session;
+                const needs = await needsFor(ctx.context, live.user);
+                if (needs !== "password") {
+                    throw new APIError("BAD_REQUEST", {
+                        code: STEP_UP_ERROR_CODES.STEP_UP_PASSWORD_NOT_ACCEPTED.code,
+                        message: needs === "code"
+                            ? "Enter the code from your authenticator app instead."
+                            : "This account has no password. Sign in again to confirm it's you.",
+                        needs,
+                    });
+                }
+                if ((await attemptsUsed(ctx.context, live.session.id)) >= maxAttempts) {
+                    throw new APIError("FORBIDDEN", { ...STEP_UP_ERROR_CODES.STEP_UP_LOCKED, needs });
+                }
+                try {
+                    // Better Auth's own check: the credential account's hash, its configured verifier, a constant-time
+                    // answer when there is none, and a 400 INVALID_PASSWORD when it does not match.
+                    await ctx.context.password.checkPassword(live.user.id, ctx);
+                }
+                catch (error) {
+                    if (isAPIError(error))
+                        await recordWrongAnswer(ctx.context, live.session);
+                    throw error;
+                }
+                const until = await recordConfirmation(ctx.context, live.session);
+                return ctx.json({
+                    ...(await statusFor(ctx.context, live)),
+                    confirmed: true,
+                    confirmedUntil: until.toISOString(),
+                    locked: false,
+                });
+            }),
+        },
+        hooks: {
+            before: [gate, beforeCodeCheck],
+            after: [afterCodeCheck, afterPasskeyAdded],
+        },
+        // As strict as Better Auth's own two-factor routes: three tries in ten seconds. Better Auth applies it only where
+        // its rate limiter is on (production, by default).
+        rateLimit: [{ pathMatcher: (path) => path === "/step-up/password", window: 10, max: 3 }],
+        $ERROR_CODES: STEP_UP_ERROR_CODES,
+    };
+}
+//# sourceMappingURL=step-up.js.map

package/dist/auth/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../src/auth/step-up.ts"],"names":[],"mappings":"AACA,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,oBAAoB,EACpB,8BAA8B,EAC9B,UAAU,EACV,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,sBAAsB,EACtB,gCAAgC,GAGjC,MAAM,qBAAqB,CAAC;AAmF7B,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;AAC5E,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,GAAG,UAAU,aAAa,SAAS,EAAE,CAAC;AAEjF,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAEnE,SAAS,QAAQ,CAAC,QAAiB;IACjC,8GAA8G;IAC9G,uCAAuC;IACvC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAK,QAAgC,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QACnG,OAAQ,QAA+B,CAAC,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAE3F,SAAS,aAAa,CAAC,MAAoC;IACzD,OAAO,IAAI,GAAG,CACZ,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAE,QAA0C,EAAE,IAAI,IAAI,EAAE,CAAC,CAClH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,UAAyB,EAAE;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;IAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,8BAA8B,CAAC;IAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;IACzE,MAAM,aAAa,GAAsB,sBAAsB,CAAC;IAChE,MAAM,UAAU,GAAsB,mBAAmB,CAAC;IAE1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qEAAqE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,mEAAmE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,gHAAgH;IAChH,MAAM,OAAO,GAAG,IAAI,OAAO,EAA4B,CAAC;IAExD,SAAS,kBAAkB,CAAC,OAAoB;QAC9C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAoB,EAAE,IAAyB;QACrE,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,kBAAkB,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC;QACjF,qFAAqF;QACrF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,UAAU,CAAC;QAC7G,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,OAAoB,EAAE,SAAiB;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,OAAoB,EAAE,OAA+B;QACpF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,iHAAiH;QACjH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC;QAC/F,MAAM,OAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC;YACpD,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;YACvB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,OAAoB,EAAE,OAA+B;QACrF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,OAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC;YACpD,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,SAAS;SACV,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,OAAoB,EAAE,IAAiB;QAC9D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,KAAK,KAAK,gBAAgB,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC;QAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,2GAA2G;QAC3G,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;QAChD,MAAM,YAAY,GAAG,QAAQ,KAAK,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC;QAExG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACjF,CAAC;IAED,iHAAiH;IACjH,KAAK,UAAU,WAAW,CAAC,GAAgB;QACzC,MAAM,OAAO,GAAG,CAAC,MAAM,8BAA8B,CAAC,GAAG,CAAC,CAAuB,CAAC;QAClF,OAAO,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,SAAS,wBAAwB,CAAC,OAAoB,EAAE,IAAY;QAClE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CACb,CAAC;QAC5E,OAAO,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,KAAK,KAAK,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAe;QACvB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,0GAA0G;gBAC1G,yFAAyF;gBACzF,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAC5D,4GAA4G;gBAC5G,8EAA8E;gBAC9E,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC7B,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE;gBAC9B,IAAI,EAAE,mBAAmB,CAAC,gBAAgB,CAAC,IAAI;gBAC/C,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACvC,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,OAAO;oBAC9C,CAAC,CAAC,gCAAgC;gBACpC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC;IAEF,MAAM,eAAe,GAAe;QAClC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,4GAA4G;YAC5G,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI;gBAAE,OAAO;YACzD,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;gBACtE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,mBAAmB,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC;KACH,CAAC;IAEF,MAAM,cAAc,GAAc;QAChC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACtC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzB,wEAAwE;oBACxE,MAAM,KAAK,GAAI,QAAoC,CAAC,UAAU,KAAK,GAAG,CAAC;oBACvE,IAAI,KAAK;wBAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,4GAA4G;gBAC5G,uGAAuG;gBACvG,MAAM,KAAK,GAAI,QAAQ,CAAC,QAAQ,CAA4C,EAAE,KAAK,CAAC;gBACpF,IAAI,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO;gBAC1C,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0GAA0G;gBAC1G,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC,CAAC;KACH,CAAC;IAEF,MAAM,iBAAiB,GAAc;QACnC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B;QACtF,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YACtC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO;YACxD,IAAI,CAAC;gBAEH,wGAAwG;gBACxG,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAkC,CAAC;gBAC1E,IAAI,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAClE,MAAM,MAAM,GAAI,GAAG,CAAC,OAAO,CAAC,OAA8B,EAAE,IAAI,EAAE,EAAE,CAAC;oBACrE,IAAI,CAAC,MAAM;wBAAE,OAAO;oBACpB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAa;wBAC9D,KAAK,EAAE,SAAS;wBAChB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;wBAC3C,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;wBACjD,KAAK,EAAE,CAAC;qBACT,CAAC,CAAC;oBACH,GAAG,GAAG,MAAM,CAAC;gBACf,CAAC;gBACD,IAAI,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO;gBAC1E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxE,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,SAAS,GACb,GAAG,CAAC,SAAS,YAAY,IAAI,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzG,MAAM,OAAO,GAAG;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpC,CAAC;gBACF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClC,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;oBACtB,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;oBACpF,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE,KAAK,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;gBACL,MAAM,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;YACzF,CAAC;QACH,CAAC,CAAC;KACH,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE;QACjF,IAAI,CAAC,GAAG;YACN,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YACvE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB;wBACvG,6FAA6F;wBAC7F,iDAAiD,CACpD,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAK,SAAS,EAAE,OAAuD,EAAE,iBAAiB,EAAE,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,wGAAwG;oBACtG,wFAAwF,CAC3F,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;YAClE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACrC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB;wBACtG,4EAA4E,CAC/E,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC;YACrF,IAAI,gBAAgB,KAAK,CAAC,CAAC,IAAI,gBAAgB,GAAG,QAAQ,EAAE,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;QACD,SAAS,EAAE;YACT,YAAY,EAAE,kBAAkB,CAC9B,iBAAiB,EACjB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,0BAA0B,CAAC,EAAE,EACpD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAsB,CAAC,CAAC,CAC1F;YACD,cAAc,EAAE,kBAAkB,CAChC,mBAAmB,EACnB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,0BAA0B,CAAC,EAAE,EAC/F,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,OAAsB,CAAC;gBAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;oBACzB,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE;wBAChC,IAAI,EAAE,mBAAmB,CAAC,6BAA6B,CAAC,IAAI;wBAC5D,OAAO,EACL,KAAK,KAAK,MAAM;4BACd,CAAC,CAAC,qDAAqD;4BACvD,CAAC,CAAC,kEAAkE;wBACxE,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;oBACtE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,mBAAmB,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,IAAI,CAAC;oBACH,mGAAmG;oBACnG,gFAAgF;oBAChF,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,UAAU,CAAC,KAAK,CAAC;wBAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC1E,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAClE,OAAO,GAAG,CAAC,IAAI,CAAC;oBACd,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACvC,SAAS,EAAE,IAAI;oBACf,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE;oBACnC,MAAM,EAAE,KAAK;iBACS,CAAC,CAAC;YAC5B,CAAC,CACF;SACF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;YAC/B,KAAK,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;SAC3C;QACD,kHAAkH;QAClH,mDAAmD;QACnD,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,mBAAmB,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAChG,YAAY,EAAE,mBAAmB;KACP,CAAC;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@connextar/house",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "The pieces every app we build needs and none of them should own a copy of.",
   "license": "MIT",
   "repository": {
@@ -34,6 +34,14 @@
       "types": "./dist/auth/second-factor-index.d.ts",
       "default": "./dist/auth/second-factor-index.js"
     },
+    "./auth/step-up": {
+      "types": "./dist/auth/step-up-index.d.ts",
+      "default": "./dist/auth/step-up-index.js"
+    },
+    "./auth/step-up/client": {
+      "types": "./dist/auth/step-up-client-index.d.ts",
+      "default": "./dist/auth/step-up-client-index.js"
+    },
     "./account": {
       "types": "./dist/account/index.d.ts",
       "default": "./dist/account/index.js"
@@ -158,6 +166,8 @@
   },
   "devDependencies": {
     "@anthropic-ai/sdk": "^0.128.0",
+    "@better-auth/core": "1.7.2",
+    "@better-auth/passkey": "1.7.2",
     "@eslint/js": "^9.39.5",
     "@testing-library/react": "^16.3.3",
     "@types/node": "^26.4.1",
@@ -167,6 +177,7 @@
     "@typescript-eslint/parser": "^8.0.0",
     "better-auth": "1.7.2",
     "better-auth-1-6": "npm:better-auth@1.6.33",
+    "better-auth-passkey-1-6": "npm:@better-auth/passkey@1.6.33",
     "eslint": "^9.0.0",
     "jsdom": "^27.4.0",
     "next": "^16.3.3",