@ingram-tech/nk-auth 0.7.6 → 0.9.0

package/README.md

@@ -6,23 +6,23 @@ composable presets each Ingram Next.js site spreads into its *own*
 plain Better Auth (prime directive), keeping full plugin type inference. Import
 only what you need from focused subpaths.
 
-`better-auth`, `pg`, `@better-auth/passkey`, `@supabase/supabase-js` are
-**peer dependencies** so there's exactly one Better Auth copy in the app.
+`better-auth`, `pg`, `@better-auth/passkey` are **peer dependencies** so there's
+exactly one Better Auth copy in the app.
 
 | Export (subpath) | For |
 | --- | --- |
-| `rlsJwtOptions` (`./jwt`) | Supabase RLS bridge token (`role:"authenticated"`) |
 | `backendJwtOptions` / `verifyBackendJwt` (`./jwt`) | a JWT for the site's own backend API (custom `audience`) |
 | `nkOrganizationDefaults`, `lastActiveOrganizationHooks`, `lastActiveOrganizationUserField` (`./organization`) | org-plugin defaults + active-org restore/persist |
 | `createAuthPool` (`./pool`) | `pg` Pool with optional SSL CA verification |
-| `bcryptPassword`, `makeEmailSenders`, `makePasskeyOptions`, `uuidGenerateId` (`./`) | password migration, email hooks, passkeys, UUID ids |
-| `createServerSupabase` (`./`) | RLS-aware supabase-js client (attaches the session JWT) |
+| `makeEmailSenders`, `makePasskeyOptions`, `passkeyOptionsForBaseUrl`, `uuidGenerateId` (`./`) | email hooks, passkeys (`passkeyOptionsForBaseUrl` derives `rpID`/`origin` from a single base URL), UUID ids |
+| `bcryptPassword` (`./`) | **legacy only** — bcrypt verifier for sites with pre-existing bcrypt hashes. New sites omit it (Better Auth defaults to scrypt). See [Migrating bcrypt passwords to scrypt](#migrating-bcrypt-passwords-to-scrypt) |
 | `createAuthHelpers`, `safeNext` (`./server`) | validated App Router session helpers (`getSession` / `getUser` / `requireSession` / `requireUser` / `redirectIfAuthenticated`) with automatic `next` + stale-cookie signalling; `safeNext` validates a `?next=` param |
 | `createAuthMiddleware` (`./middleware`) | loop-safe edge middleware: gates unauthenticated users off protected paths, preserves `next`, and clears a stale session cookie so a bad session self-heals |
 
-> **Supabase Auth → Better Auth + RLS migration?** Read
-> [`docs/better-auth-migration.md`](../../docs/better-auth-migration.md) — the
-> RLS bridge, the migration runbook, and the gotchas.
+> **Data access + RLS** is owned by [`@ingram-tech/nk-db`](../nk-db): query over a
+> direct `pg` connection and enforce per-request Row Level Security with
+> `withRls` / `withRlsTransaction` (claims taken from the Better Auth session — no
+> JWT minting, no REST proxy).
 >
 > **Backend-JWT + org sites** (a backend API plus the org plugin): compose `createAuthPool`,
 > `backendJwtOptions({ audience })`, `nkOrganizationDefaults`, and
@@ -37,7 +37,7 @@ only what you need from focused subpaths.
 ## Install
 
 ```bash
-bun add @ingram-tech/nk-auth @supabase/supabase-js better-auth @better-auth/passkey pg bcrypt
+bun add @ingram-tech/nk-auth better-auth @better-auth/passkey pg bcrypt
 ```
 
 Set the env contract (validated by `keys.ts`):
@@ -45,46 +45,41 @@ Set the env contract (validated by `keys.ts`):
 ```dotenv
 BETTER_AUTH_SECRET=…            # openssl rand -hex 32
 BETTER_AUTH_URL=https://example.com
-DATABASE_URL=…                  # DIRECT Postgres (session pooler / :5432), NOT PostgREST
-NEXT_PUBLIC_SUPABASE_URL=…
-NEXT_PUBLIC_SUPABASE_ANON_KEY=…
+DATABASE_URL=…                  # direct Postgres connection (:5432)
 ```
 
 ## 1. Apply the schema
 
 ```bash
 cp node_modules/@ingram-tech/nk-auth/migrations/0001_better_auth.sql \
-   supabase/migrations/$(date +%Y%m%d%H%M%S)_better_auth.sql
+   migrations/$(date +%Y%m%d%H%M%S)_better_auth.sql
 ```
 
 It creates Better Auth's tables (`user`, `session`, `account`, `verification`,
 `jwks`, `passkey`), defaults new user ids to UUIDs, and puts **deny-all RLS** on
-all of them (they're exposed via PostgREST; Better Auth uses its own privileged
-connection). Reconcile against your pinned `better-auth` with
-`npx @better-auth/cli generate` after upgrades.
+all of them (Better Auth reaches them through its own privileged connection).
+Reconcile against your pinned `better-auth` with `npx @better-auth/cli generate`
+after upgrades.
 
 ## 2. Configure the server
 
 This package is **not** a `betterAuth()` wrapper — your site calls `betterAuth`
 itself and spreads in our presets. That keeps full Better Auth type inference at
 the call site (so `auth.api.*` stays typed) and keeps the site plain Better Auth,
-per the prime directive. The presets carry the RLS-preserving bits.
+per the prime directive.
 
 ```ts
 // lib/auth.ts
 import { passkey } from "@better-auth/passkey";
-import { fromAddress, sendEmail } from "@ingram-tech/email";
+import { fromAddress, sendEmail } from "@ingram-tech/nk-email";
 import {
 	authBasePath,
 	authEnv,
-	bcryptPassword,
 	makeEmailSenders,
-	makePasskeyOptions,
-	rlsJwtOptions,
+	passkeyOptionsForBaseUrl,
 	uuidGenerateId,
 } from "@ingram-tech/nk-auth";
 import { betterAuth } from "better-auth";
-import { jwt } from "better-auth/plugins/jwt";
 import { Pool } from "pg";
 
 const env = authEnv();
@@ -98,14 +93,15 @@ export const auth = betterAuth({
 	baseURL: env.baseURL,
 	basePath: authBasePath, // mount at /auth, not the framework default /api/auth
 	advanced: { database: { generateId: uuidGenerateId } }, // UUIDv7 ids
-	// ^ stored as hyphenated UUIDv7 (uuid columns / Supabase RLS stay valid).
+	// ^ stored as hyphenated UUIDv7 (uuid columns / RLS policies stay valid).
 	// To show those same ids as prefixed base58 on the wire/UI — `team_…`,
 	// matching the Ingram Cloud API's `agt_`/`smt_` ids — skin them with
 	// `toPrefixedId(uuid, "team")` / recover with `fromPrefixedId`. `base58Id`
 	// mints a fresh one directly for text-id sites. All from `@ingram-tech/nk-auth`.
 	emailAndPassword: {
 		enabled: true,
-		password: bcryptPassword, // verifies migrated Supabase bcrypt hashes
+		// Better Auth hashes with scrypt by default. Only sites carrying
+		// pre-existing bcrypt hashes set `password: bcryptPassword` (legacy).
 		sendResetPassword: email.sendResetPassword,
 	},
 	emailVerification: { sendVerificationEmail: email.sendVerificationEmail },
@@ -116,8 +112,10 @@ export const auth = betterAuth({
 		},
 	},
 	plugins: [
-		jwt(rlsJwtOptions), // the RLS bridge
-		passkey(makePasskeyOptions({ rpId: "example.com", rpName: "Example", origin: env.baseURL })),
+		// Single sign-in origin: derive rpID (host) + origin from the base URL.
+		// For multi-origin / parent-domain sites use makePasskeyOptions({ rpId,
+		// rpName, origin }) and pass the registrable domain explicitly.
+		passkey(passkeyOptionsForBaseUrl(env.baseURL, "Example")),
 	],
 });
 ```
@@ -132,29 +130,11 @@ export const { GET, POST } = auth.handler;
 
 ## 3. Query data with RLS intact
 
-Always go through `createServerSupabase` instead of constructing supabase-js
-yourself — it attaches the Better Auth JWT so `auth.uid()` keeps working. Wire
-`getToken` to your instance's jwt endpoint (fully typed because *your* site owns
-the `betterAuth` call):
-
-```ts
-import { authEnv, createServerSupabase } from "@ingram-tech/nk-auth";
-import { auth } from "@/lib/auth";
-
-export async function GET(request: Request) {
-	const env = authEnv();
-	const supabase = createServerSupabase({
-		getToken: async () =>
-			(await auth.api.getToken({ headers: request.headers }))?.token ?? null,
-		supabaseUrl: env.supabaseUrl,
-		supabaseAnonKey: env.supabaseAnonKey,
-	});
-	// Reads/writes run as the signed-in user; existing RLS policies apply.
-	const { data, error } = await supabase.from("notes").select("*");
-	if (error) throw new Error(error.message);
-	return Response.json(data);
-}
-```
+Data access lives in [`@ingram-tech/nk-db`](../nk-db), not here. Query over the
+direct `pg` connection and wrap reads/writes in `withRls` / `withRlsTransaction`,
+which set `request.jwt.claims` + `SET LOCAL ROLE` per transaction from the Better
+Auth session — so `auth.uid()` policies fire unchanged, with no JWT minting and
+no REST proxy. See its README for the pattern.
 
 ## 4. Client
 
@@ -264,11 +244,48 @@ middleware injects — so the self-heal (next + clearing) needs the middleware.
 Sites that skip middleware still get validated gating from the server helpers,
 just without automatic `next`/clearing.
 
-## RLS bridge (the important part)
-
-`auth.uid()` reads the `sub` claim of the JWT PostgREST receives. The `jwt`
-plugin (configured here) mints an asymmetric token with `sub` = the user's UUID
-and `role: "authenticated"`, exposed at `/auth/jwks`. Register that JWKS URL
-as a Supabase **third-party auth** issuer, and every existing policy works
-unchanged. Full rationale and the HS256 fallback:
-[`docs/better-auth-migration.md`](../../docs/better-auth-migration.md).
+## Migrating bcrypt passwords to scrypt
+
+`bcryptPassword` is **legacy support only** (see its `@deprecated` note). It
+exists so sites whose `account.password` hashes are bcrypt keep verifying. Better
+Auth's default hasher is **scrypt** (`<salt-hex>:<key-hex>`), and bcrypt hashes
+are trivially distinguishable (they start with `$2a$` / `$2b$` / `$2y$`), so a
+clean migration is possible without a schema change.
+
+**What Better Auth gives you natively (v1.6):**
+
+- A custom `emailAndPassword.password.verify` / `.hash` — but `verify` only
+  receives `{ hash, password }`; it gets **no** `userId`/adapter, so it can't
+  persist an upgraded hash by itself.
+- The full **password-reset flow** — `requestPasswordReset` → email →
+  `resetPassword`, which re-hashes with the configured (scrypt) hasher. We
+  already wire `sendResetPassword` via `makeEmailSenders`.
+- Admin `setUserPassword` (admin plugin) for out-of-band overrides.
+
+**What it does NOT have (we'd build it):**
+
+- **Rehash-on-login.** Better Auth never re-hashes a password on successful
+  sign-in. There is no `needsRehash`.
+- **A "must reset password" gate.** No native flag blocks sign-in until a user
+  resets; that's an extra `user` field + a `before` sign-in hook if you want it.
+
+**The plan.** Replace `bcryptPassword` with a **dual-format verifier** (override
+only `verify`, leaving `hash` as the scrypt default): branch on
+`hash.startsWith("$2")` → bcrypt compare, else fall through to Better Auth's
+scrypt verify. Old hashes keep working; every new signup, password change, and
+reset is written as scrypt. Then upgrade existing hashes by one of:
+
+1. **Lazy (preferred):** wrap the sign-in route (an nk-auth plugin endpoint or a
+   thin site route) so that, after a successful bcrypt verify, it re-hashes the
+   submitted plaintext with scrypt and persists it via
+   `internalAdapter.updatePassword(userId, newHash)`. This reconstructs the
+   rehash-on-login that core lacks, using only supported adapter calls — the
+   plaintext is only available here, at the sign-in request.
+2. **Eager:** run a `requestPasswordReset` campaign for all bcrypt users; their
+   next reset writes scrypt. Pair with the dual-format verifier as the bridge
+   (there's no native "must reset" gate, so un-migrated users still log in via
+   bcrypt until they reset).
+
+Either way the dual-format verifier is the one piece nk-auth should standardize;
+the forced-reset gate is only worth building if a site needs a hard cutover.
+**Status: proposed** — not yet shipped; `bcryptPassword` remains the stopgap.

package/dist/client.d.ts

@@ -13,7 +13,7 @@
  *     plugins: [jwtClient(), passkeyClient()],
  *   });
  *
- * This exposes the call surface that replaces `supabase.auth.*`:
+ * This exposes the client auth call surface:
  *   signUp.email / signIn.email / signIn.social / signOut / useSession,
  *   plus passkey.* (register / authenticate).
  */

package/dist/client.js

@@ -13,7 +13,7 @@
  *     plugins: [jwtClient(), passkeyClient()],
  *   });
  *
- * This exposes the call surface that replaces `supabase.auth.*`:
+ * This exposes the client auth call surface:
  *   signUp.email / signIn.email / signIn.social / signOut / useSession,
  *   plus passkey.* (register / authenticate).
  */

package/dist/index.d.ts

@@ -1,9 +1,8 @@
-export { type BackendJwtConfig, backendJwtOptions, rlsJwtOptions, verifyBackendJwt, } from "./jwt.js";
+export { type BackendJwtConfig, backendJwtOptions, verifyBackendJwt } from "./jwt.js";
 export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js";
 export { type AuthEnv, authEnv, isConfigured } from "./keys.js";
-export { bcryptPassword, makeEmailSenders, makePasskeyOptions, type PasskeyConfig, type SendEmail, } from "./options.js";
+export { bcryptPassword, makeEmailSenders, makePasskeyOptions, type PasskeyConfig, passkeyOptionsForBaseUrl, type SendEmail, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";
-export { createServerSupabase, type ServerSupabaseConfig } from "./supabase.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACN,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,wBAAwB,EACxB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -1,13 +1,12 @@
 // Server entry — the Ingram Better Auth foundation. Browser re-exports live at
 // "@ingram-tech/nk-auth/client" so importing the server presets never pulls in
 // React. Focused subpaths (./jwt, ./organization, ./pool) let a site import
-// only what it needs (e.g. avoid bcrypt/supabase when it uses neither).
-export { backendJwtOptions, rlsJwtOptions, verifyBackendJwt, } from "./jwt.js";
+// only what it needs (e.g. avoid bcrypt when it doesn't use passwords).
+export { backendJwtOptions, verifyBackendJwt } from "./jwt.js";
 export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js";
 export { authEnv, isConfigured } from "./keys.js";
-export { bcryptPassword, makeEmailSenders, makePasskeyOptions, } from "./options.js";
+export { bcryptPassword, makeEmailSenders, makePasskeyOptions, passkeyOptionsForBaseUrl, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";
-export { createServerSupabase } from "./supabase.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAEN,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAA6B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAAyB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAElB,wBAAwB,GAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/jwt.d.ts

@@ -1,19 +1,11 @@
 import type { JwtOptions } from "better-auth/plugins/jwt";
 import { type JWTPayload } from "jose";
 /**
- * `jwt` plugin presets. Two shapes, because Ingram sites mint JWTs for two
- * different audiences:
- *
- *   - `rlsJwtOptions` — a Supabase RLS bridge token (`role: "authenticated"`),
- *     so PostgREST's `auth.uid()` keeps working. See docs/better-auth-migration.md.
- *   - `backendJwtOptions` — a short-lived token for a site's OWN backend API
- *     (a specific `audience`), typically carrying extra claims the site adds via
- *     `auth.api.signJWT`.
- *
- * Both default to EdDSA (Better Auth's default), exposed at `/api/auth/jwks`.
+ * `jwt` plugin preset for a site's OWN backend API: a short-lived token with a
+ * specific `audience`, typically carrying extra claims the site adds via
+ * `auth.api.signJWT`. Defaults to EdDSA (Better Auth's default), with the JWKS
+ * exposed at `/api/auth/jwks` so the backend can verify it (`verifyBackendJwt`).
  */
-/** Supabase RLS bridge: mints `sub` = user id, `role`/`aud` = "authenticated". */
-export declare const rlsJwtOptions: JwtOptions;
 export interface BackendJwtConfig {
     /** Expected audience of the site's backend, e.g. "ingram-wiki-backend". */
     audience: string;

package/dist/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE;;;;;;;;;;;GAWG;AAEH,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,UAS3B,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAerB,CAAC"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAerB,CAAC"}

package/dist/jwt.js

@@ -1,27 +1,4 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
-/**
- * `jwt` plugin presets. Two shapes, because Ingram sites mint JWTs for two
- * different audiences:
- *
- *   - `rlsJwtOptions` — a Supabase RLS bridge token (`role: "authenticated"`),
- *     so PostgREST's `auth.uid()` keeps working. See docs/better-auth-migration.md.
- *   - `backendJwtOptions` — a short-lived token for a site's OWN backend API
- *     (a specific `audience`), typically carrying extra claims the site adds via
- *     `auth.api.signJWT`.
- *
- * Both default to EdDSA (Better Auth's default), exposed at `/api/auth/jwks`.
- */
-/** Supabase RLS bridge: mints `sub` = user id, `role`/`aud` = "authenticated". */
-export const rlsJwtOptions = {
-    jwks: { keyPairConfig: { alg: "EdDSA" } },
-    jwt: {
-        definePayload: ({ user }) => ({
-            sub: user.id,
-            role: "authenticated",
-            aud: "authenticated",
-        }),
-    },
-};
 /** `jwt` plugin options for a backend-API token (custom audience). */
 export const backendJwtOptions = (config) => ({
     disableSettingJwtHeader: config.disableSettingJwtHeader,

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAmB,SAAS,EAAE,MAAM,MAAM,CAAC;AAEtE;;;;;;;;;;;GAWG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAe;IACxC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IACzC,GAAG,EAAE;QACJ,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7B,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,eAAe;SACpB,CAAC;KACF;CACD,CAAC;AAcF,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAmB,SAAS,EAAE,MAAM,MAAM,CAAC;AAqBtE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC"}

package/dist/keys.d.ts

@@ -4,22 +4,17 @@
  * Following the "each package owns its own env validation" pattern. Env vars are
  * external input, so we parse them with Zod (per docs/code-style.md) rather than
  * reading `process.env` ad hoc. `authEnv()` returns a validated, config-shaped
- * object you can spread straight into `createAuth` / `createServerSupabase`.
+ * object you can spread straight into your `betterAuth()` call.
  *
  * Required:
- *   BETTER_AUTH_SECRET             — session/CSRF signing key (`openssl rand -hex 32`)
- *   BETTER_AUTH_URL                — canonical site origin, e.g. "https://example.com"
- *   DATABASE_URL                   — DIRECT Postgres connection for Better Auth
- *                                    (session-mode pooler or :5432, NOT PostgREST)
- *   NEXT_PUBLIC_SUPABASE_URL       — Supabase project URL (for the data client)
- *   NEXT_PUBLIC_SUPABASE_ANON_KEY  — Supabase anon key (RLS still enforced)
+ *   BETTER_AUTH_SECRET  — session/CSRF signing key (`openssl rand -hex 32`)
+ *   BETTER_AUTH_URL     — canonical site origin, e.g. "https://example.com"
+ *   DATABASE_URL        — direct Postgres connection for Better Auth (:5432)
  */
 export interface AuthEnv {
     secret: string;
     baseURL: string;
     databaseUrl: string;
-    supabaseUrl: string;
-    supabaseAnonKey: string;
 }
 /**
  * Read and validate all nk-auth env vars at once. Throws a single error listing

package/dist/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,QAAO,OAgB1B,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,YAAY,QAAO,OAAgD,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,QAAO,OAc1B,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,YAAY,QAAO,OAAgD,CAAC"}

package/dist/keys.js

@@ -4,23 +4,18 @@
  * Following the "each package owns its own env validation" pattern. Env vars are
  * external input, so we parse them with Zod (per docs/code-style.md) rather than
  * reading `process.env` ad hoc. `authEnv()` returns a validated, config-shaped
- * object you can spread straight into `createAuth` / `createServerSupabase`.
+ * object you can spread straight into your `betterAuth()` call.
  *
  * Required:
- *   BETTER_AUTH_SECRET             — session/CSRF signing key (`openssl rand -hex 32`)
- *   BETTER_AUTH_URL                — canonical site origin, e.g. "https://example.com"
- *   DATABASE_URL                   — DIRECT Postgres connection for Better Auth
- *                                    (session-mode pooler or :5432, NOT PostgREST)
- *   NEXT_PUBLIC_SUPABASE_URL       — Supabase project URL (for the data client)
- *   NEXT_PUBLIC_SUPABASE_ANON_KEY  — Supabase anon key (RLS still enforced)
+ *   BETTER_AUTH_SECRET  — session/CSRF signing key (`openssl rand -hex 32`)
+ *   BETTER_AUTH_URL     — canonical site origin, e.g. "https://example.com"
+ *   DATABASE_URL        — direct Postgres connection for Better Auth (:5432)
  */
 import { z } from "zod";
 const schema = z.object({
     BETTER_AUTH_SECRET: z.string().min(1),
     BETTER_AUTH_URL: z.string().url(),
     DATABASE_URL: z.string().min(1),
-    NEXT_PUBLIC_SUPABASE_URL: z.string().url(),
-    NEXT_PUBLIC_SUPABASE_ANON_KEY: z.string().min(1),
 });
 /**
  * Read and validate all nk-auth env vars at once. Throws a single error listing
@@ -40,8 +35,6 @@ export const authEnv = () => {
         secret: env.BETTER_AUTH_SECRET,
         baseURL: env.BETTER_AUTH_URL,
         databaseUrl: env.DATABASE_URL,
-        supabaseUrl: env.NEXT_PUBLIC_SUPABASE_URL,
-        supabaseAnonKey: env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
     };
 };
 /** Whether nk-auth is fully configured (lets callers degrade in local/dev). */

package/dist/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC;AAUH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAY,EAAE;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,kBAAkB;QAC9B,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,wBAAwB;QACzC,eAAe,EAAE,GAAG,CAAC,6BAA6B;KAClD,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAQH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAY,EAAE;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,kBAAkB;QAC9B,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;KAC7B,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC"}

package/dist/options.d.ts

@@ -7,11 +7,16 @@ export { uuidGenerateId } from "./id.js";
  * and spreads these presets in. That keeps full plugin type inference at the
  * call site (where `declaration` is off) and respects the prime directive — the
  * site stays plain Better Auth, we just ship the shared config. JWT + org
- * presets live in `./jwt` and `./organization`. See docs/better-auth-migration.md.
+ * presets live in `./jwt` and `./organization`. See the package README.
  */
 /**
- * `emailAndPassword.password` config. Verifies with bcrypt so passwords
- * migrated from Supabase (bcrypt) keep working — Better Auth defaults to scrypt.
+ * `emailAndPassword.password` config that hashes/verifies with bcrypt.
+ *
+ * @deprecated LEGACY SUPPORT ONLY. Do not wire this into a new site. It exists
+ * solely so sites with pre-existing **bcrypt** password hashes keep verifying.
+ * Better Auth's default is scrypt — new sites should omit this and use that
+ * default. Sites still on bcrypt should migrate hashes to scrypt and drop this;
+ * see the nk-auth README (§"Migrating bcrypt passwords to scrypt") for the path.
  */
 export declare const bcryptPassword: {
     hash: (password: string) => Promise<string>;
@@ -30,7 +35,21 @@ export interface PasskeyConfig {
 }
 /** Build `passkey` plugin options. Use as `passkey(makePasskeyOptions(cfg))`. */
 export declare const makePasskeyOptions: (cfg: PasskeyConfig) => PasskeyOptions;
-/** Send one transactional email (wire to `@ingram-tech/email`'s `sendEmail`). */
+/**
+ * Derive passkey options from the site's single base URL: `rpID` = the URL's
+ * hostname (the WebAuthn effective domain — host only, no scheme or port) and
+ * `origin` = the URL itself. This is the common case (one sign-in origin), and
+ * it keeps the relying-party id and the registered origin in lockstep so they
+ * can't drift. Pass the same value the instance signs sessions for, e.g.:
+ *
+ *   passkey(passkeyOptionsForBaseUrl(env.baseURL, "Example"))
+ *
+ * Reach for `makePasskeyOptions` directly when a site spans multiple origins or
+ * must register against a parent registrable domain (e.g. rpID "example.com"
+ * for an "app.example.com" origin).
+ */
+export declare const passkeyOptionsForBaseUrl: (baseURL: string, rpName: string) => PasskeyOptions;
+/** Send one transactional email (wire to `@ingram-tech/nk-email`'s `sendEmail`). */
 export type SendEmail = (message: {
     to: string;
     subject: string;

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc;qBACT,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;kCAItC;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KACjB,KAAG,OAAO,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,KAAG,cAItD,CAAC;AAEH,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,SAAS;wCAI5C;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;4CAMd;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;CAGhB,CAAC"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;qBACT,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;kCAItC;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KACjB,KAAG,OAAO,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,KAAG,cAItD,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,GACpC,SAAS,MAAM,EACf,QAAQ,MAAM,KACZ,cAKA,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,SAAS;wCAI5C;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;4CAMd;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;CAGhB,CAAC"}

package/dist/options.js

@@ -10,11 +10,16 @@ export { uuidGenerateId } from "./id.js";
  * and spreads these presets in. That keeps full plugin type inference at the
  * call site (where `declaration` is off) and respects the prime directive — the
  * site stays plain Better Auth, we just ship the shared config. JWT + org
- * presets live in `./jwt` and `./organization`. See docs/better-auth-migration.md.
+ * presets live in `./jwt` and `./organization`. See the package README.
  */
 /**
- * `emailAndPassword.password` config. Verifies with bcrypt so passwords
- * migrated from Supabase (bcrypt) keep working — Better Auth defaults to scrypt.
+ * `emailAndPassword.password` config that hashes/verifies with bcrypt.
+ *
+ * @deprecated LEGACY SUPPORT ONLY. Do not wire this into a new site. It exists
+ * solely so sites with pre-existing **bcrypt** password hashes keep verifying.
+ * Better Auth's default is scrypt — new sites should omit this and use that
+ * default. Sites still on bcrypt should migrate hashes to scrypt and drop this;
+ * see the nk-auth README (§"Migrating bcrypt passwords to scrypt") for the path.
  */
 export const bcryptPassword = {
     hash: (password) => bcrypt.hash(password, 10),
@@ -26,6 +31,24 @@ export const makePasskeyOptions = (cfg) => ({
     rpName: cfg.rpName,
     origin: cfg.origin,
 });
+/**
+ * Derive passkey options from the site's single base URL: `rpID` = the URL's
+ * hostname (the WebAuthn effective domain — host only, no scheme or port) and
+ * `origin` = the URL itself. This is the common case (one sign-in origin), and
+ * it keeps the relying-party id and the registered origin in lockstep so they
+ * can't drift. Pass the same value the instance signs sessions for, e.g.:
+ *
+ *   passkey(passkeyOptionsForBaseUrl(env.baseURL, "Example"))
+ *
+ * Reach for `makePasskeyOptions` directly when a site spans multiple origins or
+ * must register against a parent registrable domain (e.g. rpID "example.com"
+ * for an "app.example.com" origin).
+ */
+export const passkeyOptionsForBaseUrl = (baseURL, rpName) => makePasskeyOptions({
+    rpId: new URL(baseURL).hostname,
+    rpName,
+    origin: baseURL,
+});
 /**
  * Email callbacks for `emailAndPassword.sendResetPassword` and
  * `emailVerification.sendVerificationEmail`, routed through your sender.

package/dist/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iFAAiF;AACjF,kFAAkF;AAClF,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,IAAI,EAAE,CAAC,QAAgB,EAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,MAAM,EAAE,CAAC,EACR,IAAI,EACJ,QAAQ,GAIR,EAAoB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;CACtD,CAAC;AAWF,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAkB,EAAE,CAAC,CAAC;IAC1E,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,MAAM,EAAE,GAAG,CAAC,MAAM;CAClB,CAAC,CAAC;AASH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAe,EAAE,EAAE,CAAC,CAAC;IACrD,iBAAiB,EAAE,KAAK,EAAE,EACzB,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,qBAAqB,EAAE,KAAK,EAAE,EAC7B,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iFAAiF;AACjF,kFAAkF;AAClF,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,IAAI,EAAE,CAAC,QAAgB,EAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,MAAM,EAAE,CAAC,EACR,IAAI,EACJ,QAAQ,GAIR,EAAoB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;CACtD,CAAC;AAWF,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAkB,EAAE,CAAC,CAAC;IAC1E,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,MAAM,EAAE,GAAG,CAAC,MAAM;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACvC,OAAe,EACf,MAAc,EACG,EAAE,CACnB,kBAAkB,CAAC;IAClB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ;IAC/B,MAAM;IACN,MAAM,EAAE,OAAO;CACf,CAAC,CAAC;AASJ;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAe,EAAE,EAAE,CAAC,CAAC;IACrD,iBAAiB,EAAE,KAAK,EAAE,EACzB,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,qBAAqB,EAAE,KAAK,EAAE,EAC7B,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;CACD,CAAC,CAAC"}

package/migrations/0001_better_auth.sql

@@ -1,4 +1,4 @@
--- @ingram-tech/nk-auth — Better Auth schema for Supabase, hardened for RLS.
+-- @ingram-tech/nk-auth — Better Auth schema, hardened for RLS.
 --
 -- This mirrors Better Auth's core tables (user / session / account /
 -- verification), the `jwt` plugin's `jwks` table, and the `passkey` plugin's
@@ -7,14 +7,14 @@
 --     npx @better-auth/cli generate
 -- and re-run after upgrading better-auth.
 --
--- TWO hardening steps the generator does NOT produce, both required (see
--- docs/better-auth-migration.md):
---   1. New users default to a UUID id, because Supabase's auth.uid() casts the
---      JWT `sub` to `uuid`. A non-UUID id silently breaks RLS for new signups.
---   2. Deny-all RLS on every Better Auth table. They live in `public` and are
---      exposed by PostgREST; Better Auth itself reaches them through its own
---      privileged DATABASE_URL connection, which bypasses RLS, so denying anon /
---      authenticated access here costs nothing and closes the leak.
+-- TWO hardening steps the generator does NOT produce, both required:
+--   1. New users default to a UUID id, because `auth.uid()`-style RLS policies
+--      cast the JWT `sub` to `uuid`. A non-UUID id silently breaks RLS for new
+--      signups.
+--   2. Deny-all RLS on every Better Auth table — defense in depth. Better Auth
+--      itself reaches them through its own privileged DATABASE_URL connection,
+--      which bypasses RLS, so denying the app's RLS role any access here costs
+--      nothing and keeps the auth tables off-limits to user-facing queries.
 
 create extension if not exists "pgcrypto" with schema "extensions";
 
@@ -64,7 +64,7 @@ create table if not exists "public"."verification" (
 	"updatedAt" timestamptz not null default now()
 );
 
--- `jwt` plugin: holds the asymmetric keypair used to sign the RLS bridge token.
+-- `jwt` plugin: holds the asymmetric keypair used to sign session JWTs.
 create table if not exists "public"."jwks" (
 	"id" text primary key,
 	"publicKey" text not null,

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@ingram-tech/nk-auth",
-	"version": "0.7.6",
-	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, Supabase RLS bridge, active-org hooks, pg pool) for Next.js sites.",
+	"version": "0.9.0",
+	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, active-org hooks, pg pool) for Next.js sites.",
 	"license": "MIT",
 	"type": "module",
 	"repository": {
@@ -61,14 +61,13 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@ingram-tech/nk-db": "^0.9.0",
+		"@ingram-tech/nk-db": "^1.0.0",
 		"bcrypt": "^6.0.0",
 		"jose": "^6.0.0",
 		"zod": "^4.0.0"
 	},
 	"peerDependencies": {
 		"@better-auth/passkey": "^1.6.0",
-		"@supabase/supabase-js": ">=2.0.0",
 		"better-auth": "^1.6.0",
 		"next": "^15.0.0 || ^16.0.0",
 		"pg": "^8.13.0",
@@ -78,9 +77,6 @@
 		"@better-auth/passkey": {
 			"optional": true
 		},
-		"@supabase/supabase-js": {
-			"optional": true
-		},
 		"next": {
 			"optional": true
 		},
@@ -93,8 +89,7 @@
 	},
 	"devDependencies": {
 		"@better-auth/passkey": "^1.6.0",
-		"@ingram-tech/nk-dev": "workspace:*",
-		"@supabase/supabase-js": "^2.45.0",
+		"@ingram-tech/nk-dev": "0.2.4",
 		"@types/bcrypt": "^6.0.0",
 		"@types/node": "^25.0.0",
 		"@types/pg": "^8.11.0",

package/dist/supabase.d.ts

@@ -1,26 +0,0 @@
-import { type SupabaseClient } from "@supabase/supabase-js";
-/**
- * The RLS-aware Supabase data client — the single chokepoint that keeps Row
- * Level Security working after the move off Supabase Auth.
- *
- * Instead of `supabase.auth`, it pulls the Better Auth session JWT (via the
- * injected `getToken`) and hands it to supabase-js's v2 `accessToken` callback.
- * PostgREST then sets `request.jwt.claims`, so `auth.uid()` (and every existing
- * policy) keeps returning the right user. With no session, `getToken` yields
- * `null` and the request runs as `anon` — RLS is still enforced, never bypassed.
- *
- * Sites should import THIS rather than constructing supabase-js directly, so the
- * token bridge can't be forgotten. (Enforce with a Biome/GritQL rule banning raw
- * `createClient` for data — see docs/better-auth-migration.md.)
- *
- * Wire `getToken` to the site's own Better Auth instance, e.g.:
- *   getToken: async () => (await auth.api.getToken({ headers }))?.token ?? null
- */
-export interface ServerSupabaseConfig {
-    /** Returns the current request's Better Auth JWT, or null when signed out. */
-    getToken: () => Promise<string | null>;
-    supabaseUrl: string;
-    supabaseAnonKey: string;
-}
-export declare const createServerSupabase: (config: ServerSupabaseConfig) => SupabaseClient;
-//# sourceMappingURL=supabase.d.ts.map

package/dist/supabase.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACpC,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,oBAAoB,GAAI,QAAQ,oBAAoB,KAAG,cAMjE,CAAC"}

package/dist/supabase.js

@@ -1,8 +0,0 @@
-import { createClient } from "@supabase/supabase-js";
-export const createServerSupabase = (config) => createClient(config.supabaseUrl, config.supabaseAnonKey, {
-    accessToken: async () => {
-        const token = await config.getToken();
-        return token ?? "";
-    },
-});
-//# sourceMappingURL=supabase.js.map

package/dist/supabase.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AA2B1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAA4B,EAAkB,EAAE,CACpF,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE;IACxD,WAAW,EAAE,KAAK,IAAI,EAAE;QACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,IAAI,EAAE,CAAC;IACpB,CAAC;CACD,CAAC,CAAC"}