@growth-labs/auth 0.4.0 → 0.5.0

package/README.md

@@ -12,7 +12,8 @@ OpenAuth **client** package for Astro + Cloudflare. Verifies JWTs, manages sessi
 import auth from '@growth-labs/auth'
 
 auth({
-  issuer: 'https://auth.fedweek.com',           // OpenAuth issuer URL (separate Worker)
+  issuer: 'https://auth.fedweek.com',           // Browser-facing OpenAuth issuer URL
+  issuerInternal: 'https://auth-internal.example.com', // Optional back-channel issuer URL
   clientId: 'fedweek-prod',                      // Optional; defaults to request hostname
   clientSecret: 'AUTH_CLIENT_SECRET',            // Worker secret binding name, resolved at request time
   resource: 'https://fedweek.com',               // RFC 8707 resource/audience URI
@@ -22,6 +23,8 @@ auth({
   loginPath: '/login',                           // Redirect target for unauthenticated users
   logoutRedirect: '/',
   callbackPath: '/api/auth/callback',
+  passwordPath: '/password',                     // Local branded password form when renderers.password is set
+  verifyCodePath: '/verify-code',                // Local branded magic-code form when renderers.verifyCode is set
   providers: ['google', 'password', 'email-code'],
   loginPage: {
     title: 'Sign in',
@@ -32,6 +35,8 @@ auth({
     // Optional all-or-nothing UI overrides per auth surface.
     // Flow logic, cookies, callback exchange, and issuer URLs remain package-owned.
     login: { module: '/src/auth/auth-render', export: 'renderLogin' },
+    password: { module: '/src/auth/auth-render', export: 'renderPassword' },
+    verifyCode: { module: '/src/auth/auth-render', export: 'renderVerifyCode' },
   },
   accessTokenMaxAge: 900,                        // 15 min (seconds)
   refreshTokenMaxAge: 2592000,                   // 30 days
@@ -42,28 +47,60 @@ auth({
 
 **Middleware** (runs on every request):
 1. Reads `{cookiePrefix}_at` and `{cookiePrefix}_rt` cookies
-2. Verifies access token JWT against issuer's JWKS (`{issuer}/.well-known/jwks.json`, cached in Worker memory)
+2. Verifies access token JWT against the internal issuer's JWKS (`{issuerInternal ?? issuer}/.well-known/jwks.json`, cached in Worker memory)
 3. If expired but refresh token valid → silent refresh, set new cookies
 4. Populates `context.locals.user` as `User | null`
 5. If path matches `gatedPaths` and `user` is null → redirect to `loginPath`
 
 **Routes:**
 - `GET /login` — provider-selection page; `?provider=google|password|email-code` starts auth locally and redirects into the issuer's generic `/authorize` endpoint
-- `GET /logout` — clears cookies, revokes refresh token at issuer, redirects
+- `GET /logout` — clears cookies, revokes refresh token at the internal issuer, redirects
 - `GET /api/auth/callback` — OAuth callback handler (PKCE code exchange, cookie setting)
-- `GET /forgot-password` / `GET /reset-password` — local redirects to issuer-owned password UI
+- `GET /forgot-password` / `GET /reset-password` — local redirects to issuer-owned password UI unless renderers are configured
+- `GET /password` / `GET /verify-code` — local branded password and magic-code views when `renderers.password` / `renderers.verifyCode` are configured
+- `POST /api/auth/password/verify`, `/api/auth/code/request`, `/api/auth/code/verify`, `/api/auth/password/reset/request`, `/api/auth/password/reset/confirm` — package-owned back-channel form handlers that call the issuer JSON API through `issuerInternal`
 
 ## Branded Auth UI
 
 Consumers can supply `renderers.login`, `renderers.forgotPassword`, and
-`renderers.resetPassword` in `auth()` options. Each renderer receives a
-typed payload from `@growth-labs/auth/types` with package-built provider
-or issuer URLs and brand values, then returns either an HTML string or a
-`Response`.
+`renderers.resetPassword` in `auth()` options. Consumers that want every
+password and magic-code step to stay on their own domain can also supply
+`renderers.password` and `renderers.verifyCode`. Each renderer receives a
+typed payload from `@growth-labs/auth/types` with package-built local form
+actions, provider or issuer URLs, and brand values, then returns either an
+HTML string or a `Response`.
+
+Renderers replace only GET form views. Callback, logout, token exchange,
+cookies, PKCE/state, and issuer communication remain package-owned. When
+`renderers.password` or `renderers.verifyCode` is configured, `/login`
+links those provider buttons to the local branded routes; otherwise it
+keeps the existing issuer-hosted OpenAuth UI flow.
+
+Forgot/reset renderers receive both the historical issuer URL and the new
+local API form target. Use `passwordResetRequestUrl` and
+`passwordResetConfirmUrl` for consumer-hosted reset forms.
+
+## Server SDK
+
+```ts
+import { authClient } from '@growth-labs/auth/server'
+
+const client = authClient(context)
+
+await client.password.verify({ email, password })
+await client.code.request({ email })
+await client.code.verify({ email, code })
+await client.password.reset.request({ email })
+await client.password.reset.confirm({ token, newPassword })
+```
 
-Renderers replace only GET form views. `/login?provider=...`, callback,
-logout, token exchange, cookies, and issuer redirects remain package-owned.
-If a renderer is omitted, the current default behavior is unchanged.
+`authClient(context)` reads the resolved integration config and Worker
+bindings, posts to `{issuerInternal ?? issuer}/api/v1/auth/*`, resolves
+`clientSecret` binding names at request time, sends `client_secret_basic`
+for confidential clients, and includes `client_id`, `redirect_uri`, PKCE
+`code_challenge`, `state`, and `resource` for authorization-code issuing
+calls. The package-owned POST routes use this SDK directly; consumers can
+also use it from custom server routes.
 
 ## Using `context.locals.user`
 
@@ -116,10 +153,10 @@ internal package-test helper and is not exported from
 
 ## OAuth Flow Summary
 
-1. User clicks a provider on the local login page → browser hits `/login?provider=...`
+1. User clicks a provider on the local login page → browser hits `/login?provider=...` or a local branded `/password` / `/verify-code` route when that renderer is configured
 2. The local `/login` start route stores PKCE/state/redirect/provider cookies and redirects to `{issuer}/authorize?provider=...`; configured `resource` is sent as the RFC 8707 resource indicator
-3. Issuer authenticates → redirects to `/api/auth/callback?code=...&state=...`
-4. Callback exchanges code for tokens via PKCE, sends `Authorization: Basic base64(client_id:client_secret)` when `clientSecret` is configured, includes `resource`, reads `properties.isNewUser` from the JWT payload with fallback to top-level `isNewUser` for legacy issuers, uses the `{cookiePrefix}_provider` auth-flow cookie set at login start for provider attribution, sets session cookies, sets `gl_id` when `GL_IDENTITY_SECRET` is configured, and redirects to the original page
+3. For consumer-hosted password or magic-code flows, package-owned POST routes call `{issuerInternal ?? issuer}/api/v1/auth/*` and redirect to `/api/auth/callback?code=...&state=...`
+4. Issuer authenticates or issues a JSON authorization code → callback exchanges code at `{issuerInternal ?? issuer}/token` via PKCE, sends `Authorization: Basic base64(client_id:client_secret)` when `clientSecret` is configured, includes `resource`, reads `properties.isNewUser` from the JWT payload with fallback to top-level `isNewUser` for legacy issuers, uses the `{cookiePrefix}_provider` auth-flow cookie set at login start for provider attribution, sets session cookies, sets `gl_id` when `GL_IDENTITY_SECRET` is configured, and redirects to the original page
 
 ## Signed Identity Cookie
 
@@ -160,12 +197,13 @@ in their app.
 - Virtual module: `virtual:growth-labs/auth/config` (slash, not hyphen)
 - Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`, `{cookiePrefix}_provider`, `gl_id`
 - PKCE flow with `code_verifier` / `code_challenge` (S256); `{cookiePrefix}_pkce` is scoped to `callbackPath`
+- `issuer` is browser-facing; optional `issuerInternal` is used for token exchange, silent refresh, JWT verification/JWKS lookup, and revocation. If omitted, `issuerInternal` falls back to `issuer`.
 - Confidential OAuth clients use `client_secret_basic` on token exchange and refresh when `clientSecret` is configured. Prefer a Worker secret binding name such as `AUTH_CLIENT_SECRET`; runtime code resolves that binding before calling the issuer.
 - RFC 8707 `resource` is sent on authorize, token exchange, and refresh when configured
 - `email-code` is a client-side alias for the issuer's OpenAuth `code` provider
 - CSRF state parameter verified on callback
 - Access-token user claims live under `payload.properties.*`; the client falls back to top-level `payload.email`, `payload.name`, `payload.image`, and `payload.isNewUser` for legacy issuers
-- Forgot/reset password routes are issuer-owned redirects, not local form UIs
+- Forgot/reset password routes can remain issuer-owned redirects or use renderer-provided local API form targets
 - Branded auth screens use `renderers`, not consumer-local shadow routes
 - No `aud` claim validation in this package — single client per issuer assumed
 - `.astro` component files ship as source, not compiled

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,UAAU,gBAAgB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACN,oBAAoB,EAAE,CAAC,MAAM,EAAE;YAC9B,aAAa,EAAE,CAAC,IAAI,EAAE;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;aAAE,KAAK,IAAI,CAAA;YAC5E,WAAW,EAAE,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,CAAC,EAAE,OAAO,CAAA;aAAE,KAAK,IAAI,CAAA;YACzF,YAAY,EAAE,CAAC,MAAM,EAAE;gBACtB,IAAI,CAAC,EAAE;oBAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;iBAAE,CAAA;aAC/D,KAAK,IAAI,CAAA;SACV,KAAK,IAAI,CAAA;KACV,CAAA;CACD;AAQD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAuBjE;AAWD,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,gBAAgB,CAyDvE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,UAAU,gBAAgB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACN,oBAAoB,EAAE,CAAC,MAAM,EAAE;YAC9B,aAAa,EAAE,CAAC,IAAI,EAAE;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;aAAE,KAAK,IAAI,CAAA;YAC5E,WAAW,EAAE,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,CAAC,EAAE,OAAO,CAAA;aAAE,KAAK,IAAI,CAAA;YACzF,YAAY,EAAE,CAAC,MAAM,EAAE;gBACtB,IAAI,CAAC,EAAE;oBAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;iBAAE,CAAA;aAC/D,KAAK,IAAI,CAAA;SACV,KAAK,IAAI,CAAA;KACV,CAAA;CACD;AAQD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAuBjE;AAWD,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,gBAAgB,CAyGvE"}

package/dist/index.js

@@ -89,6 +89,47 @@ export default function auth(userOptions) {
                         entrypoint: resolveEntrypoint('./routes/reset-password'),
                         prerender: false,
                     });
+                    injectRoute({
+                        pattern: options.passwordVerifyPath,
+                        entrypoint: resolveEntrypoint('./routes/api/password-verify'),
+                        prerender: false,
+                    });
+                    injectRoute({
+                        pattern: options.passwordResetRequestPath,
+                        entrypoint: resolveEntrypoint('./routes/api/password-reset-request'),
+                        prerender: false,
+                    });
+                    injectRoute({
+                        pattern: options.passwordResetConfirmPath,
+                        entrypoint: resolveEntrypoint('./routes/api/password-reset-confirm'),
+                        prerender: false,
+                    });
+                    if (options.renderers.password) {
+                        injectRoute({
+                            pattern: options.passwordPath,
+                            entrypoint: resolveEntrypoint('./routes/password'),
+                            prerender: false,
+                        });
+                    }
+                }
+                if (options.providers.includes('email-code')) {
+                    injectRoute({
+                        pattern: options.codeRequestPath,
+                        entrypoint: resolveEntrypoint('./routes/api/code-request'),
+                        prerender: false,
+                    });
+                    injectRoute({
+                        pattern: options.codeVerifyPath,
+                        entrypoint: resolveEntrypoint('./routes/api/code-verify'),
+                        prerender: false,
+                    });
+                    if (options.renderers.verifyCode) {
+                        injectRoute({
+                            pattern: options.verifyCodePath,
+                            entrypoint: resolveEntrypoint('./routes/verify-code'),
+                            prerender: false,
+                        });
+                    }
                 }
             },
         },

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAgBhD,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;AAE5E,SAAS,iBAAiB,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,oBAAoB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,SAAwB;IACvD,OAAO;QACN,IAAI,EAAE,6BAA6B;QACnC,SAAS,CAAC,EAAU;YACnB,IAAI,EAAE,KAAK,oCAAoC;gBAAE,OAAO,sCAAsC,CAAA;QAC/F,CAAC;QACD,IAAI,CAAC,EAAU;YACd,IAAI,EAAE,KAAK,sCAAsC;gBAAE,OAAM;YAEzD,MAAM,WAAW,GAAa,EAAE,CAAA;YAChC,MAAM,UAAU,GAAa,EAAE,CAAA;YAC/B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBACxC,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,EAAE,CAAA;gBACzC,WAAW,CAAC,IAAI,CACf,YAAY,IAAI,CAAC,MAAM,OAAO,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAC5E,CAAA;gBACD,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,CAAC,GAAG,WAAW,EAAE,4BAA4B,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1F,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QAC1D,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ,CAC1D,CAAA;AACF,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAwB;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACpD,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,mBAAmB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAEzD,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE;YACN,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;gBACtE,YAAY,CAAC;oBACZ,IAAI,EAAE;wBACL,MAAM,EAAE;4BACP,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBACpE;wBACD,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;qBAC7C;iBACD,CAAC,CAAA;gBAEF,aAAa,CAAC;oBACb,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,KAAK;iBACZ,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,SAAS;oBAC1B,UAAU,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;oBAC/C,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;oBAChD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,YAAY;oBAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,iBAAiB;wBAClC,UAAU,EAAE,iBAAiB,CAAC,yBAAyB,CAAC;wBACxD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;SACD;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAgBhD,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;AAE5E,SAAS,iBAAiB,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,oBAAoB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,SAAwB;IACvD,OAAO;QACN,IAAI,EAAE,6BAA6B;QACnC,SAAS,CAAC,EAAU;YACnB,IAAI,EAAE,KAAK,oCAAoC;gBAAE,OAAO,sCAAsC,CAAA;QAC/F,CAAC;QACD,IAAI,CAAC,EAAU;YACd,IAAI,EAAE,KAAK,sCAAsC;gBAAE,OAAM;YAEzD,MAAM,WAAW,GAAa,EAAE,CAAA;YAChC,MAAM,UAAU,GAAa,EAAE,CAAA;YAC/B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBACxC,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,EAAE,CAAA;gBACzC,WAAW,CAAC,IAAI,CACf,YAAY,IAAI,CAAC,MAAM,OAAO,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAC5E,CAAA;gBACD,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,CAAC,GAAG,WAAW,EAAE,4BAA4B,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1F,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QAC1D,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ,CAC1D,CAAA;AACF,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAwB;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACpD,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,mBAAmB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAEzD,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE;YACN,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;gBACtE,YAAY,CAAC;oBACZ,IAAI,EAAE;wBACL,MAAM,EAAE;4BACP,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBACpE;wBACD,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;qBAC7C;iBACD,CAAC,CAAA;gBAEF,aAAa,CAAC;oBACb,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,KAAK;iBACZ,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,SAAS;oBAC1B,UAAU,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;oBAC/C,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;oBAChD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,YAAY;oBAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,iBAAiB;wBAClC,UAAU,EAAE,iBAAiB,CAAC,yBAAyB,CAAC;wBACxD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,8BAA8B,CAAC;wBAC7D,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,wBAAwB;wBACzC,UAAU,EAAE,iBAAiB,CAAC,qCAAqC,CAAC;wBACpE,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,wBAAwB;wBACzC,UAAU,EAAE,iBAAiB,CAAC,qCAAqC,CAAC;wBACpE,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;wBAChC,WAAW,CAAC;4BACX,OAAO,EAAE,OAAO,CAAC,YAAY;4BAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;4BAClD,SAAS,EAAE,KAAK;yBAChB,CAAC,CAAA;oBACH,CAAC;gBACF,CAAC;gBAED,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,eAAe;wBAChC,UAAU,EAAE,iBAAiB,CAAC,2BAA2B,CAAC;wBAC1D,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,cAAc;wBAC/B,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;wBAClC,WAAW,CAAC;4BACX,OAAO,EAAE,OAAO,CAAC,cAAc;4BAC/B,UAAU,EAAE,iBAAiB,CAAC,sBAAsB,CAAC;4BACrD,SAAS,EAAE,KAAK;yBAChB,CAAC,CAAA;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;SACD;KACD,CAAA;AACF,CAAC"}

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAMA,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAuEnB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAOA,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAkEnB"}

package/dist/middleware/auth.js

@@ -1,9 +1,11 @@
 import { getConfig } from '../config-store.js';
 import { resolveClientSecret } from '../utils/client-secret.js';
 import { getCookie, setTokenCookies } from '../utils/cookies.js';
+import { resolveInternalIssuer } from '../utils/issuer.js';
 import { refreshTokens, verifyAccessToken } from '../utils/tokens.js';
 export async function onRequest(context, next) {
     const options = getConfig();
+    const issuer = resolveInternalIssuer(options);
     const { request } = context;
     // 1. Read tokens from cookies
     const accessToken = getCookie(request, `${options.cookiePrefix}_at`);
@@ -12,7 +14,7 @@ export async function onRequest(context, next) {
     let user = null;
     let refreshed = null;
     if (accessToken) {
-        const verified = await verifyAccessToken(options.issuer, accessToken);
+        const verified = await verifyAccessToken(issuer, accessToken);
         if (verified) {
             user = {
                 id: verified.sub,
@@ -25,7 +27,7 @@ export async function onRequest(context, next) {
     if (!user && refreshToken) {
         const clientId = options.clientId || context.url.hostname;
         const clientSecret = resolveClientSecret(options.clientSecret);
-        refreshed = await refreshTokens(options.issuer, refreshToken, clientId, clientSecret, options.resource);
+        refreshed = await refreshTokens(issuer, refreshToken, clientId, clientSecret, options.resource);
         if (refreshed) {
             user = {
                 id: refreshed.claims.sub,

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,SAAS,GAAG,MAAM,aAAa,CAC9B,OAAO,CAAC,MAAM,EACd,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,OAAO,CAAC,QAAQ,CAChB,CAAA;QACD,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/F,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/options.d.ts

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import type { AuthRenderers } from './types.js';
 export declare const authOptionsSchema: z.ZodObject<{
     issuer: z.ZodString;
+    issuerInternal: z.ZodOptional<z.ZodString>;
     clientId: z.ZodOptional<z.ZodString>;
     clientSecret: z.ZodOptional<z.ZodString>;
     resource: z.ZodOptional<z.ZodString>;
@@ -13,8 +14,15 @@ export declare const authOptionsSchema: z.ZodObject<{
     loginPath: z.ZodDefault<z.ZodString>;
     logoutRedirect: z.ZodDefault<z.ZodString>;
     callbackPath: z.ZodDefault<z.ZodString>;
+    passwordPath: z.ZodDefault<z.ZodString>;
+    verifyCodePath: z.ZodDefault<z.ZodString>;
     forgotPasswordPath: z.ZodDefault<z.ZodString>;
     resetPasswordPath: z.ZodDefault<z.ZodString>;
+    passwordVerifyPath: z.ZodDefault<z.ZodString>;
+    codeRequestPath: z.ZodDefault<z.ZodString>;
+    codeVerifyPath: z.ZodDefault<z.ZodString>;
+    passwordResetRequestPath: z.ZodDefault<z.ZodString>;
+    passwordResetConfirmPath: z.ZodDefault<z.ZodString>;
     providers: z.ZodDefault<z.ZodArray<z.ZodEnum<["google", "password", "email-code"]>, "many">>;
     loginPage: z.ZodDefault<z.ZodObject<{
         title: z.ZodDefault<z.ZodString>;
@@ -39,8 +47,15 @@ export declare const authOptionsSchema: z.ZodObject<{
     loginPath: string;
     logoutRedirect: string;
     callbackPath: string;
+    passwordPath: string;
+    verifyCodePath: string;
     forgotPasswordPath: string;
     resetPasswordPath: string;
+    passwordVerifyPath: string;
+    codeRequestPath: string;
+    codeVerifyPath: string;
+    passwordResetRequestPath: string;
+    passwordResetConfirmPath: string;
     providers: ("google" | "password" | "email-code")[];
     loginPage: {
         title: string;
@@ -48,6 +63,7 @@ export declare const authOptionsSchema: z.ZodObject<{
         logoUrl?: string | undefined;
     };
     renderers: AuthRenderers;
+    issuerInternal?: string | undefined;
     clientId?: string | undefined;
     clientSecret?: string | undefined;
     resource?: string | undefined;
@@ -55,6 +71,7 @@ export declare const authOptionsSchema: z.ZodObject<{
 }, {
     issuer: string;
     cookiePrefix: string;
+    issuerInternal?: string | undefined;
     clientId?: string | undefined;
     clientSecret?: string | undefined;
     resource?: string | undefined;
@@ -65,8 +82,15 @@ export declare const authOptionsSchema: z.ZodObject<{
     loginPath?: string | undefined;
     logoutRedirect?: string | undefined;
     callbackPath?: string | undefined;
+    passwordPath?: string | undefined;
+    verifyCodePath?: string | undefined;
     forgotPasswordPath?: string | undefined;
     resetPasswordPath?: string | undefined;
+    passwordVerifyPath?: string | undefined;
+    codeRequestPath?: string | undefined;
+    codeVerifyPath?: string | undefined;
+    passwordResetRequestPath?: string | undefined;
+    passwordResetConfirmPath?: string | undefined;
     providers?: ("google" | "password" | "email-code")[] | undefined;
     loginPage?: {
         title?: string | undefined;

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyC5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiD5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA"}

package/dist/options.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 export const authOptionsSchema = z.object({
-    // ─── Required ───
+    // ─── Issuer URLs ───
     issuer: z.string().url(),
+    issuerInternal: z.string().url().optional(),
     // ─── Client identity ───
     clientId: z.string().optional(),
     clientSecret: z.string().optional(),
@@ -17,8 +18,15 @@ export const authOptionsSchema = z.object({
     loginPath: z.string().default('/login'),
     logoutRedirect: z.string().default('/'),
     callbackPath: z.string().default('/api/auth/callback'),
+    passwordPath: z.string().default('/password'),
+    verifyCodePath: z.string().default('/verify-code'),
     forgotPasswordPath: z.string().default('/forgot-password'),
     resetPasswordPath: z.string().default('/reset-password'),
+    passwordVerifyPath: z.string().default('/api/auth/password/verify'),
+    codeRequestPath: z.string().default('/api/auth/code/request'),
+    codeVerifyPath: z.string().default('/api/auth/code/verify'),
+    passwordResetRequestPath: z.string().default('/api/auth/password/reset/request'),
+    passwordResetConfirmPath: z.string().default('/api/auth/password/reset/confirm'),
     // ─── Providers ───
     providers: z
         .array(z.enum(['google', 'password', 'email-code']))

package/dist/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,mBAAmB;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAExB,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAErC,+BAA+B;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAExD,oBAAoB;IACpB,SAAS,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,mCAAmC;IACnC,SAAS,EAAE,CAAC;SACV,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sBAAsB;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3C,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAErC,+BAA+B;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAChF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAEhF,oBAAoB;IACpB,SAAS,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,mCAAmC;IACnC,SAAS,EAAE,CAAC;SACV,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA"}

package/dist/renderers.d.ts

@@ -1,4 +1,4 @@
-import type { AuthRendererBrand, AuthRendererResult, ForgotPasswordRendererPayload, LoginRendererPayload, ResetPasswordRendererPayload, ResolvedAuthRenderers } from './types.js';
+import type { AuthRendererBrand, AuthRendererResult, ForgotPasswordRendererPayload, LoginRendererPayload, PasswordRendererPayload, ResetPasswordRendererPayload, ResolvedAuthRenderers, VerifyCodeRendererPayload } from './types.js';
 /**
  * Look up the bundled renderer for a surface. After 0.3.7 the lookup is
  * build-time only — renderers are resolved into the virtual module by the
@@ -24,11 +24,15 @@ export declare function loginRendererPayload(options: {
         logoUrl?: string;
     };
     loginPath: string;
+    passwordPath: string;
+    verifyCodePath: string;
     providers: string[];
 }, data: {
     redirectPath: string;
     error: string | null;
     reset: string | null;
+    useLocalPassword?: boolean;
+    useLocalVerifyCode?: boolean;
 }): LoginRendererPayload;
 export declare function forgotPasswordRendererPayload(options: {
     loginPage: {
@@ -37,6 +41,7 @@ export declare function forgotPasswordRendererPayload(options: {
         logoUrl?: string;
     };
     loginPath: string;
+    passwordResetRequestPath: string;
 }, data: {
     forgotPasswordUrl: string;
     error: string | null;
@@ -49,9 +54,39 @@ export declare function resetPasswordRendererPayload(options: {
         logoUrl?: string;
     };
     loginPath: string;
+    passwordResetConfirmPath: string;
 }, data: {
     resetPasswordUrl: string;
     error: string | null;
     token: string | null;
 }): ResetPasswordRendererPayload;
+export declare function passwordRendererPayload(options: {
+    loginPage: {
+        title: string;
+        brandName?: string;
+        logoUrl?: string;
+    };
+    loginPath: string;
+    forgotPasswordPath: string;
+    passwordVerifyPath: string;
+}, data: {
+    email: string | null;
+    error: string | null;
+    redirectPath: string;
+}): PasswordRendererPayload;
+export declare function verifyCodeRendererPayload(options: {
+    loginPage: {
+        title: string;
+        brandName?: string;
+        logoUrl?: string;
+    };
+    loginPath: string;
+    codeRequestPath: string;
+    codeVerifyPath: string;
+}, data: {
+    email: string | null;
+    error: string | null;
+    sent: string | null;
+    redirectPath: string;
+}): VerifyCodeRendererPayload;
 //# sourceMappingURL=renderers.d.ts.map

package/dist/renderers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderers.d.ts","sourceRoot":"","sources":["../src/renderers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,6BAA6B,EAC7B,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,qBAAqB,EAChE,OAAO,EAAE,CAAC,GACR,qBAAqB,CAAC,CAAC,CAAC,GAAG,SAAS,CAEtC;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQtF;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACtC,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClE,GAAG,iBAAiB,CAMpB;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,EAAE,CAAA;CACnB,EACD,IAAI,EAAE;IACL,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB,GACC,oBAAoB,CAetB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;CACjB,EACD,IAAI,EAAE;IACL,iBAAiB,EAAE,MAAM,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB,GACC,6BAA6B,CAQ/B;AAED,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;CACjB,EACD,IAAI,EAAE;IACL,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB,GACC,4BAA4B,CAQ9B"}
+{"version":3,"file":"renderers.d.ts","sourceRoot":"","sources":["../src/renderers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,yBAAyB,EACzB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,qBAAqB,EAChE,OAAO,EAAE,CAAC,GACR,qBAAqB,CAAC,CAAC,CAAC,GAAG,SAAS,CAEtC;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQtF;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACtC,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClE,GAAG,iBAAiB,CAMpB;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,EAAE,CAAA;CACnB,EACD,IAAI,EAAE;IACL,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B,GACC,oBAAoB,CAyBtB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,MAAM,CAAA;CAChC,EACD,IAAI,EAAE;IACL,iBAAiB,EAAE,MAAM,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB,GACC,6BAA6B,CAS/B;AAED,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,MAAM,CAAA;CAChC,EACD,IAAI,EAAE;IACL,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB,GACC,4BAA4B,CAS9B;AAED,wBAAgB,uBAAuB,CACtC,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,MAAM,CAAA;CAC1B,EACD,IAAI,EAAE;IACL,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;CACpB,GACC,uBAAuB,CAUzB;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE;IACR,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACtB,EACD,IAAI,EAAE;IACL,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACpB,GACC,yBAAyB,CAW3B"}

package/dist/renderers.js

@@ -28,12 +28,21 @@ export function rendererBrand(options) {
     };
 }
 export function loginRendererPayload(options, data) {
-    const makeStartUrl = (provider) => `${options.loginPath}?provider=${encodeURIComponent(provider)}&redirect=${encodeURIComponent(data.redirectPath)}`;
+    const makeLoginStartUrl = (provider) => `${options.loginPath}?provider=${encodeURIComponent(provider)}&redirect=${encodeURIComponent(data.redirectPath)}`;
+    const makeSurfaceUrl = (path) => `${path}?redirect=${encodeURIComponent(data.redirectPath)}`;
     return {
         providerUrls: {
-            google: options.providers.includes('google') ? makeStartUrl('google') : undefined,
-            password: options.providers.includes('password') ? makeStartUrl('password') : undefined,
-            emailCode: options.providers.includes('email-code') ? makeStartUrl('email-code') : undefined,
+            google: options.providers.includes('google') ? makeLoginStartUrl('google') : undefined,
+            password: options.providers.includes('password')
+                ? data.useLocalPassword
+                    ? makeSurfaceUrl(options.passwordPath)
+                    : makeLoginStartUrl('password')
+                : undefined,
+            emailCode: options.providers.includes('email-code')
+                ? data.useLocalVerifyCode
+                    ? makeSurfaceUrl(options.verifyCodePath)
+                    : makeLoginStartUrl('email-code')
+                : undefined,
         },
         errorCode: data.error ?? undefined,
         reset: data.reset ? true : undefined,
@@ -44,6 +53,7 @@ export function loginRendererPayload(options, data) {
 export function forgotPasswordRendererPayload(options, data) {
     return {
         forgotPasswordUrl: data.forgotPasswordUrl,
+        passwordResetRequestUrl: options.passwordResetRequestPath,
         errorCode: data.error ?? undefined,
         sent: data.sent ? true : undefined,
         loginUrl: options.loginPath,
@@ -53,10 +63,34 @@ export function forgotPasswordRendererPayload(options, data) {
 export function resetPasswordRendererPayload(options, data) {
     return {
         resetPasswordUrl: data.resetPasswordUrl,
+        passwordResetConfirmUrl: options.passwordResetConfirmPath,
         errorCode: data.error ?? undefined,
         token: data.token ?? undefined,
         loginUrl: options.loginPath,
         brand: rendererBrand(options),
     };
 }
+export function passwordRendererPayload(options, data) {
+    return {
+        passwordVerifyUrl: options.passwordVerifyPath,
+        forgotPasswordUrl: options.forgotPasswordPath,
+        email: data.email ?? undefined,
+        errorCode: data.error ?? undefined,
+        redirect: data.redirectPath,
+        loginUrl: options.loginPath,
+        brand: rendererBrand(options),
+    };
+}
+export function verifyCodeRendererPayload(options, data) {
+    return {
+        codeRequestUrl: options.codeRequestPath,
+        codeVerifyUrl: options.codeVerifyPath,
+        email: data.email ?? undefined,
+        errorCode: data.error ?? undefined,
+        sent: data.sent ? true : undefined,
+        redirect: data.redirectPath,
+        loginUrl: options.loginPath,
+        brand: rendererBrand(options),
+    };
+}
 //# sourceMappingURL=renderers.js.map

package/dist/renderers.js.map

@@ -1 +1 @@
-{"version":3,"file":"renderers.js","sourceRoot":"","sources":["../src/renderers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAUlF;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAC1B,OAAU;IAEV,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAA0B;IAClE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAA;IAC7B,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAA;IAChB,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAE7B;IACA,OAAO;QACN,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE;KACxC,CAAA;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAIC,EACD,IAIC;IAED,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,EAAE,CACzC,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,QAAQ,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAA;IAElH,OAAO;QACN,YAAY,EAAE;YACb,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YACjF,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5F;QACD,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACpC,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,OAGC,EACD,IAIC;IAED,OAAO;QACN,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClC,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,OAGC,EACD,IAIC;IAED,OAAO;QACN,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC"}
+{"version":3,"file":"renderers.js","sourceRoot":"","sources":["../src/renderers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAYlF;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAC1B,OAAU;IAEV,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAA0B;IAClE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAA;IAC7B,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAA;IAChB,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAE7B;IACA,OAAO;QACN,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE;KACxC,CAAA;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAMC,EACD,IAMC;IAED,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC9C,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,QAAQ,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAA;IAClH,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CACvC,GAAG,IAAI,aAAa,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAA;IAE5D,OAAO;QACN,YAAY,EAAE;YACb,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YACtF,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACtB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC;gBAChC,CAAC,CAAC,SAAS;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAC,kBAAkB;oBACxB,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC;oBACxC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAClC,CAAC,CAAC,SAAS;SACZ;QACD,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACpC,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,OAIC,EACD,IAIC;IAED,OAAO;QACN,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,uBAAuB,EAAE,OAAO,CAAC,wBAAwB;QACzD,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClC,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,OAIC,EACD,IAIC;IAED,OAAO;QACN,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,uBAAuB,EAAE,OAAO,CAAC,wBAAwB;QACzD,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,OAKC,EACD,IAIC;IAED,OAAO;QACN,iBAAiB,EAAE,OAAO,CAAC,kBAAkB;QAC7C,iBAAiB,EAAE,OAAO,CAAC,kBAAkB;QAC7C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,OAKC,EACD,IAKC;IAED,OAAO;QACN,cAAc,EAAE,OAAO,CAAC,eAAe;QACvC,aAAa,EAAE,OAAO,CAAC,cAAc;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClC,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;KAC7B,CAAA;AACF,CAAC"}

package/dist/routes/api/code-request.d.ts

@@ -0,0 +1,3 @@
+import { type RouteContext } from './shared.js';
+export declare function POST(context: RouteContext): Promise<Response>;
+//# sourceMappingURL=code-request.d.ts.map

package/dist/routes/api/code-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAIjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmBnE"}

package/dist/routes/api/code-request.js

@@ -0,0 +1,13 @@
+import { authClient, getConfig, readForm, readFormString, statusRedirect, } from './shared.js';
+export async function POST(context) {
+    const options = getConfig();
+    if (!options.providers.includes('email-code')) {
+        return new Response('Not found', { status: 404 });
+    }
+    const form = await readForm(context);
+    const email = await readFormString(form, 'email');
+    const redirect = form.get('redirect')?.toString();
+    const result = await authClient(context).code.request({ email });
+    return statusRedirect(context, result, options.verifyCodePath, { email, sent: '1', redirect }, options.verifyCodePath, { email, redirect });
+}
+//# sourceMappingURL=code-request.js.map

package/dist/routes/api/code-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-request.js","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,cAAc,EACtB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC9B,OAAO,CAAC,cAAc,EACtB,EAAE,KAAK,EAAE,QAAQ,EAAE,CACnB,CAAA;AACF,CAAC"}

package/dist/routes/api/code-verify.d.ts

@@ -0,0 +1,3 @@
+import { type RouteContext } from './shared.js';
+export declare function POST(context: RouteContext): Promise<Response>;
+//# sourceMappingURL=code-verify.d.ts.map

package/dist/routes/api/code-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-verify.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,YAAY,EAGjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAenE"}

package/dist/routes/api/code-verify.js

@@ -0,0 +1,16 @@
+import { authClient, callbackRedirect, getConfig, readForm, readFormString, } from './shared.js';
+export async function POST(context) {
+    const options = getConfig();
+    if (!options.providers.includes('email-code')) {
+        return new Response('Not found', { status: 404 });
+    }
+    const form = await readForm(context);
+    const email = await readFormString(form, 'email');
+    const code = await readFormString(form, 'code');
+    const result = await authClient(context).code.verify({ email, code });
+    return callbackRedirect(context, result, options.verifyCodePath, {
+        email,
+        redirect: form.get('redirect')?.toString(),
+    });
+}
+//# sourceMappingURL=code-verify.js.map

package/dist/routes/api/code-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-verify.js","sourceRoot":"","sources":["../../../src/routes/api/code-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,gBAAgB,EAChB,SAAS,EAET,QAAQ,EACR,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAErE,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE;QAChE,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;KAC1C,CAAC,CAAA;AACH,CAAC"}

package/dist/routes/api/password-reset-confirm.d.ts

@@ -0,0 +1,3 @@
+import { type RouteContext } from './shared.js';
+export declare function POST(context: RouteContext): Promise<Response>;
+//# sourceMappingURL=password-reset-confirm.d.ts.map

package/dist/routes/api/password-reset-confirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-confirm.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAIjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBnE"}

package/dist/routes/api/password-reset-confirm.js

@@ -0,0 +1,16 @@
+import { authClient, getConfig, readForm, readFormString, statusRedirect, } from './shared.js';
+export async function POST(context) {
+    const options = getConfig();
+    if (!options.providers.includes('password')) {
+        return new Response('Not found', { status: 404 });
+    }
+    const form = await readForm(context);
+    const token = await readFormString(form, 'token');
+    const password = await readFormString(form, 'password', { trim: false });
+    const result = await authClient(context).password.reset.confirm({
+        token,
+        newPassword: password,
+    });
+    return statusRedirect(context, result, options.loginPath, { reset: 'success' }, options.resetPasswordPath, { token });
+}
+//# sourceMappingURL=password-reset-confirm.js.map