@ingram-tech/nk-auth 0.8.0 → 0.9.1

package/README.md

@@ -14,14 +14,15 @@ exactly one Better Auth copy in the app.
 | `backendJwtOptions` / `verifyBackendJwt` (`./jwt`) | a JWT for the site's own backend API (custom `audience`) |
 | `nkOrganizationDefaults`, `lastActiveOrganizationHooks`, `lastActiveOrganizationUserField` (`./organization`) | org-plugin defaults + active-org restore/persist |
 | `createAuthPool` (`./pool`) | `pg` Pool with optional SSL CA verification |
-| `bcryptPassword`, `makeEmailSenders`, `makePasskeyOptions`, `uuidGenerateId` (`./`) | password verification, email hooks, passkeys, UUID ids |
+| `makeEmailSenders`, `makePasskeyOptions`, `passkeyOptionsForBaseUrl`, `uuidGenerateId` (`./`) | email hooks, passkeys (`passkeyOptionsForBaseUrl` derives `rpID`/`origin` from a single base URL), UUID ids |
+| `bcryptPassword` (`./`) | **legacy only** — bcrypt verifier for sites with pre-existing bcrypt hashes. New sites omit it (Better Auth defaults to scrypt). See [Migrating bcrypt passwords to scrypt](#migrating-bcrypt-passwords-to-scrypt) |
 | `createAuthHelpers`, `safeNext` (`./server`) | validated App Router session helpers (`getSession` / `getUser` / `requireSession` / `requireUser` / `redirectIfAuthenticated`) with automatic `next` + stale-cookie signalling; `safeNext` validates a `?next=` param |
 | `createAuthMiddleware` (`./middleware`) | loop-safe edge middleware: gates unauthenticated users off protected paths, preserves `next`, and clears a stale session cookie so a bad session self-heals |
 
 > **Data access + RLS** is owned by [`@ingram-tech/nk-db`](../nk-db): query over a
 > direct `pg` connection and enforce per-request Row Level Security with
 > `withRls` / `withRlsTransaction` (claims taken from the Better Auth session — no
-> JWT minting, no PostgREST). nk-auth no longer ships a Supabase data client.
+> JWT minting, no REST proxy).
 >
 > **Backend-JWT + org sites** (a backend API plus the org plugin): compose `createAuthPool`,
 > `backendJwtOptions({ audience })`, `nkOrganizationDefaults`, and
@@ -74,9 +75,8 @@ import { fromAddress, sendEmail } from "@ingram-tech/nk-email";
 import {
 	authBasePath,
 	authEnv,
-	bcryptPassword,
 	makeEmailSenders,
-	makePasskeyOptions,
+	passkeyOptionsForBaseUrl,
 	uuidGenerateId,
 } from "@ingram-tech/nk-auth";
 import { betterAuth } from "better-auth";
@@ -100,7 +100,8 @@ export const auth = betterAuth({
 	// mints a fresh one directly for text-id sites. All from `@ingram-tech/nk-auth`.
 	emailAndPassword: {
 		enabled: true,
-		password: bcryptPassword, // bcrypt verifier (Better Auth defaults to scrypt)
+		// Better Auth hashes with scrypt by default. Only sites carrying
+		// pre-existing bcrypt hashes set `password: bcryptPassword` (legacy).
 		sendResetPassword: email.sendResetPassword,
 	},
 	emailVerification: { sendVerificationEmail: email.sendVerificationEmail },
@@ -111,7 +112,10 @@ export const auth = betterAuth({
 		},
 	},
 	plugins: [
-		passkey(makePasskeyOptions({ rpId: "example.com", rpName: "Example", origin: env.baseURL })),
+		// Single sign-in origin: derive rpID (host) + origin from the base URL.
+		// For multi-origin / parent-domain sites use makePasskeyOptions({ rpId,
+		// rpName, origin }) and pass the registrable domain explicitly.
+		passkey(passkeyOptionsForBaseUrl(env.baseURL, "Example")),
 	],
 });
 ```
@@ -130,7 +134,7 @@ Data access lives in [`@ingram-tech/nk-db`](../nk-db), not here. Query over the
 direct `pg` connection and wrap reads/writes in `withRls` / `withRlsTransaction`,
 which set `request.jwt.claims` + `SET LOCAL ROLE` per transaction from the Better
 Auth session — so `auth.uid()` policies fire unchanged, with no JWT minting and
-no PostgREST. See its README for the pattern.
+no REST proxy. See its README for the pattern.
 
 ## 4. Client
 
@@ -239,3 +243,49 @@ the cookie-present case the guard reads it from the `x-nk-auth-path` header
 middleware injects — so the self-heal (next + clearing) needs the middleware.
 Sites that skip middleware still get validated gating from the server helpers,
 just without automatic `next`/clearing.
+
+## Migrating bcrypt passwords to scrypt
+
+`bcryptPassword` is **legacy support only** (see its `@deprecated` note). It
+exists so sites whose `account.password` hashes are bcrypt keep verifying. Better
+Auth's default hasher is **scrypt** (`<salt-hex>:<key-hex>`), and bcrypt hashes
+are trivially distinguishable (they start with `$2a$` / `$2b$` / `$2y$`), so a
+clean migration is possible without a schema change.
+
+**What Better Auth gives you natively (v1.6):**
+
+- A custom `emailAndPassword.password.verify` / `.hash` — but `verify` only
+  receives `{ hash, password }`; it gets **no** `userId`/adapter, so it can't
+  persist an upgraded hash by itself.
+- The full **password-reset flow** — `requestPasswordReset` → email →
+  `resetPassword`, which re-hashes with the configured (scrypt) hasher. We
+  already wire `sendResetPassword` via `makeEmailSenders`.
+- Admin `setUserPassword` (admin plugin) for out-of-band overrides.
+
+**What it does NOT have (we'd build it):**
+
+- **Rehash-on-login.** Better Auth never re-hashes a password on successful
+  sign-in. There is no `needsRehash`.
+- **A "must reset password" gate.** No native flag blocks sign-in until a user
+  resets; that's an extra `user` field + a `before` sign-in hook if you want it.
+
+**The plan.** Replace `bcryptPassword` with a **dual-format verifier** (override
+only `verify`, leaving `hash` as the scrypt default): branch on
+`hash.startsWith("$2")` → bcrypt compare, else fall through to Better Auth's
+scrypt verify. Old hashes keep working; every new signup, password change, and
+reset is written as scrypt. Then upgrade existing hashes by one of:
+
+1. **Lazy (preferred):** wrap the sign-in route (an nk-auth plugin endpoint or a
+   thin site route) so that, after a successful bcrypt verify, it re-hashes the
+   submitted plaintext with scrypt and persists it via
+   `internalAdapter.updatePassword(userId, newHash)`. This reconstructs the
+   rehash-on-login that core lacks, using only supported adapter calls — the
+   plaintext is only available here, at the sign-in request.
+2. **Eager:** run a `requestPasswordReset` campaign for all bcrypt users; their
+   next reset writes scrypt. Pair with the dual-format verifier as the bridge
+   (there's no native "must reset" gate, so un-migrated users still log in via
+   bcrypt until they reset).
+
+Either way the dual-format verifier is the one piece nk-auth should standardize;
+the forced-reset gate is only worth building if a site needs a hard cutover.
+**Status: proposed** — not yet shipped; `bcryptPassword` remains the stopgap.

package/dist/client.d.ts

@@ -13,7 +13,7 @@
  *     plugins: [jwtClient(), passkeyClient()],
  *   });
  *
- * This exposes the call surface that replaces `supabase.auth.*`:
+ * This exposes the client auth call surface:
  *   signUp.email / signIn.email / signIn.social / signOut / useSession,
  *   plus passkey.* (register / authenticate).
  */

package/dist/client.js

@@ -13,7 +13,7 @@
  *     plugins: [jwtClient(), passkeyClient()],
  *   });
  *
- * This exposes the call surface that replaces `supabase.auth.*`:
+ * This exposes the client auth call surface:
  *   signUp.email / signIn.email / signIn.social / signOut / useSession,
  *   plus passkey.* (register / authenticate).
  */

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { type BackendJwtConfig, backendJwtOptions, verifyBackendJwt } from "./jwt.js";
 export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js";
 export { type AuthEnv, authEnv, isConfigured } from "./keys.js";
-export { bcryptPassword, makeEmailSenders, makePasskeyOptions, type PasskeyConfig, type SendEmail, } from "./options.js";
+export { bcryptPassword, makeEmailSenders, makePasskeyOptions, type PasskeyConfig, passkeyOptionsForBaseUrl, type SendEmail, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,wBAAwB,EACxB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -5,7 +5,7 @@
 export { backendJwtOptions, verifyBackendJwt } from "./jwt.js";
 export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js";
 export { authEnv, isConfigured } from "./keys.js";
-export { bcryptPassword, makeEmailSenders, makePasskeyOptions, } from "./options.js";
+export { bcryptPassword, makeEmailSenders, makePasskeyOptions, passkeyOptionsForBaseUrl, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAAyB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAAyB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAElB,wBAAwB,GAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/jwt.d.ts

@@ -7,7 +7,7 @@ import { type JWTPayload } from "jose";
  * exposed at `/api/auth/jwks` so the backend can verify it (`verifyBackendJwt`).
  */
 export interface BackendJwtConfig {
-    /** Expected audience of the site's backend, e.g. "ingram-wiki-backend". */
+    /** Expected audience of the site's backend, e.g. "my-app-backend". */
     audience: string;
     /** Token lifetime, e.g. "15m". */
     expirationTime?: string;
@@ -23,6 +23,14 @@ export declare const backendJwtOptions: (config: BackendJwtConfig) => JwtOptions
  * Verify a Better-Auth-minted backend JWT (EdDSA) against the issuer's JWKS.
  * For use by the backend that consumes `backendJwtOptions` tokens. Throws on an
  * invalid/expired token or audience/issuer mismatch; returns the claims.
+ *
+ * Hardened against Better Auth signing-key rotation: jose's `createRemoteJWKSet`
+ * refuses to refetch the JWKS for `cooldownDuration` (30s default) after any
+ * fetch, so a token signed with a freshly rotated key whose `kid` isn't yet in
+ * the cached set would fail for the *whole* cooldown window — a ~30s burst of
+ * auth failures on every request that verifies a token. On a no-matching-key
+ * miss we force a single `.reload()` (which bypasses the cooldown) and retry, so
+ * a rotation costs one extra fetch instead of a brief outage.
  */
 export declare const verifyBackendJwt: (params: {
     token: string;

package/dist/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAerB,CAAC"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAGN,KAAK,UAAU,EAEf,MAAM,MAAM,CAAC;AAEd;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAChC,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAyBrB,CAAC"}

package/dist/jwt.js

@@ -1,4 +1,4 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, errors as joseErrors, jwtVerify, } from "jose";
 /** `jwt` plugin options for a backend-API token (custom audience). */
 export const backendJwtOptions = (config) => ({
     disableSettingJwtHeader: config.disableSettingJwtHeader,
@@ -12,6 +12,14 @@ const jwksCache = new Map();
  * Verify a Better-Auth-minted backend JWT (EdDSA) against the issuer's JWKS.
  * For use by the backend that consumes `backendJwtOptions` tokens. Throws on an
  * invalid/expired token or audience/issuer mismatch; returns the claims.
+ *
+ * Hardened against Better Auth signing-key rotation: jose's `createRemoteJWKSet`
+ * refuses to refetch the JWKS for `cooldownDuration` (30s default) after any
+ * fetch, so a token signed with a freshly rotated key whose `kid` isn't yet in
+ * the cached set would fail for the *whole* cooldown window — a ~30s burst of
+ * auth failures on every request that verifies a token. On a no-matching-key
+ * miss we force a single `.reload()` (which bypasses the cooldown) and retry, so
+ * a rotation costs one extra fetch instead of a brief outage.
  */
 export const verifyBackendJwt = async (params) => {
     const url = typeof params.jwksUrl === "string" ? new URL(params.jwksUrl) : params.jwksUrl;
@@ -21,11 +29,23 @@ export const verifyBackendJwt = async (params) => {
         jwks = createRemoteJWKSet(url);
         jwksCache.set(cacheKey, jwks);
     }
-    const { payload } = await jwtVerify(params.token, jwks, {
+    const options = {
         audience: params.audience,
         issuer: params.issuer,
         algorithms: ["EdDSA"],
-    });
-    return payload;
+    };
+    try {
+        const { payload } = await jwtVerify(params.token, jwks, options);
+        return payload;
+    }
+    catch (err) {
+        if (!(err instanceof joseErrors.JWKSNoMatchingKey))
+            throw err;
+        // `kid` absent from the cached JWKS — almost always a just-rotated signing
+        // key. Force a refresh past the cooldown and retry exactly once.
+        await jwks.reload();
+        const { payload } = await jwtVerify(params.token, jwks, options);
+        return payload;
+    }
 };
 //# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAmB,SAAS,EAAE,MAAM,MAAM,CAAC;AAqBtE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EACN,kBAAkB,EAClB,MAAM,IAAI,UAAU,EAEpB,SAAS,GACT,MAAM,MAAM,CAAC;AAqBd,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC;IACF,IAAI,CAAC;QACJ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,iBAAiB,CAAC;YAAE,MAAM,GAAG,CAAC;QAC9D,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC,CAAC"}

package/dist/options.d.ts

@@ -7,11 +7,16 @@ export { uuidGenerateId } from "./id.js";
  * and spreads these presets in. That keeps full plugin type inference at the
  * call site (where `declaration` is off) and respects the prime directive — the
  * site stays plain Better Auth, we just ship the shared config. JWT + org
- * presets live in `./jwt` and `./organization`. See docs/better-auth-migration.md.
+ * presets live in `./jwt` and `./organization`. See the package README.
  */
 /**
- * `emailAndPassword.password` config. Verifies with bcrypt so passwords
- * migrated from Supabase (bcrypt) keep working — Better Auth defaults to scrypt.
+ * `emailAndPassword.password` config that hashes/verifies with bcrypt.
+ *
+ * @deprecated LEGACY SUPPORT ONLY. Do not wire this into a new site. It exists
+ * solely so sites with pre-existing **bcrypt** password hashes keep verifying.
+ * Better Auth's default is scrypt — new sites should omit this and use that
+ * default. Sites still on bcrypt should migrate hashes to scrypt and drop this;
+ * see the nk-auth README (§"Migrating bcrypt passwords to scrypt") for the path.
  */
 export declare const bcryptPassword: {
     hash: (password: string) => Promise<string>;
@@ -30,6 +35,20 @@ export interface PasskeyConfig {
 }
 /** Build `passkey` plugin options. Use as `passkey(makePasskeyOptions(cfg))`. */
 export declare const makePasskeyOptions: (cfg: PasskeyConfig) => PasskeyOptions;
+/**
+ * Derive passkey options from the site's single base URL: `rpID` = the URL's
+ * hostname (the WebAuthn effective domain — host only, no scheme or port) and
+ * `origin` = the URL itself. This is the common case (one sign-in origin), and
+ * it keeps the relying-party id and the registered origin in lockstep so they
+ * can't drift. Pass the same value the instance signs sessions for, e.g.:
+ *
+ *   passkey(passkeyOptionsForBaseUrl(env.baseURL, "Example"))
+ *
+ * Reach for `makePasskeyOptions` directly when a site spans multiple origins or
+ * must register against a parent registrable domain (e.g. rpID "example.com"
+ * for an "app.example.com" origin).
+ */
+export declare const passkeyOptionsForBaseUrl: (baseURL: string, rpName: string) => PasskeyOptions;
 /** Send one transactional email (wire to `@ingram-tech/nk-email`'s `sendEmail`). */
 export type SendEmail = (message: {
     to: string;

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc;qBACT,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;kCAItC;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KACjB,KAAG,OAAO,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,KAAG,cAItD,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,SAAS;wCAI5C;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;4CAMd;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;CAGhB,CAAC"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;qBACT,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;kCAItC;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KACjB,KAAG,OAAO,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,KAAG,cAItD,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,GACpC,SAAS,MAAM,EACf,QAAQ,MAAM,KACZ,cAKA,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,SAAS;wCAI5C;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;4CAMd;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;CAGhB,CAAC"}

package/dist/options.js

@@ -10,11 +10,16 @@ export { uuidGenerateId } from "./id.js";
  * and spreads these presets in. That keeps full plugin type inference at the
  * call site (where `declaration` is off) and respects the prime directive — the
  * site stays plain Better Auth, we just ship the shared config. JWT + org
- * presets live in `./jwt` and `./organization`. See docs/better-auth-migration.md.
+ * presets live in `./jwt` and `./organization`. See the package README.
  */
 /**
- * `emailAndPassword.password` config. Verifies with bcrypt so passwords
- * migrated from Supabase (bcrypt) keep working — Better Auth defaults to scrypt.
+ * `emailAndPassword.password` config that hashes/verifies with bcrypt.
+ *
+ * @deprecated LEGACY SUPPORT ONLY. Do not wire this into a new site. It exists
+ * solely so sites with pre-existing **bcrypt** password hashes keep verifying.
+ * Better Auth's default is scrypt — new sites should omit this and use that
+ * default. Sites still on bcrypt should migrate hashes to scrypt and drop this;
+ * see the nk-auth README (§"Migrating bcrypt passwords to scrypt") for the path.
  */
 export const bcryptPassword = {
     hash: (password) => bcrypt.hash(password, 10),
@@ -26,6 +31,24 @@ export const makePasskeyOptions = (cfg) => ({
     rpName: cfg.rpName,
     origin: cfg.origin,
 });
+/**
+ * Derive passkey options from the site's single base URL: `rpID` = the URL's
+ * hostname (the WebAuthn effective domain — host only, no scheme or port) and
+ * `origin` = the URL itself. This is the common case (one sign-in origin), and
+ * it keeps the relying-party id and the registered origin in lockstep so they
+ * can't drift. Pass the same value the instance signs sessions for, e.g.:
+ *
+ *   passkey(passkeyOptionsForBaseUrl(env.baseURL, "Example"))
+ *
+ * Reach for `makePasskeyOptions` directly when a site spans multiple origins or
+ * must register against a parent registrable domain (e.g. rpID "example.com"
+ * for an "app.example.com" origin).
+ */
+export const passkeyOptionsForBaseUrl = (baseURL, rpName) => makePasskeyOptions({
+    rpId: new URL(baseURL).hostname,
+    rpName,
+    origin: baseURL,
+});
 /**
  * Email callbacks for `emailAndPassword.sendResetPassword` and
  * `emailVerification.sendVerificationEmail`, routed through your sender.

package/dist/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iFAAiF;AACjF,kFAAkF;AAClF,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,IAAI,EAAE,CAAC,QAAgB,EAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,MAAM,EAAE,CAAC,EACR,IAAI,EACJ,QAAQ,GAIR,EAAoB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;CACtD,CAAC;AAWF,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAkB,EAAE,CAAC,CAAC;IAC1E,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,MAAM,EAAE,GAAG,CAAC,MAAM;CAClB,CAAC,CAAC;AASH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAe,EAAE,EAAE,CAAC,CAAC;IACrD,iBAAiB,EAAE,KAAK,EAAE,EACzB,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,qBAAqB,EAAE,KAAK,EAAE,EAC7B,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iFAAiF;AACjF,kFAAkF;AAClF,iEAAiE;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,IAAI,EAAE,CAAC,QAAgB,EAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,MAAM,EAAE,CAAC,EACR,IAAI,EACJ,QAAQ,GAIR,EAAoB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;CACtD,CAAC;AAWF,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAkB,EAAE,CAAC,CAAC;IAC1E,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,MAAM,EAAE,GAAG,CAAC,MAAM;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACvC,OAAe,EACf,MAAc,EACG,EAAE,CACnB,kBAAkB,CAAC;IAClB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ;IAC/B,MAAM;IACN,MAAM,EAAE,OAAO;CACf,CAAC,CAAC;AASJ;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAe,EAAE,EAAE,CAAC,CAAC;IACrD,iBAAiB,EAAE,KAAK,EAAE,EACzB,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,qBAAqB,EAAE,KAAK,EAAE,EAC7B,IAAI,EACJ,GAAG,GAIH,EAAiB,EAAE;QACnB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;CACD,CAAC,CAAC"}

package/migrations/0001_better_auth.sql

@@ -1,4 +1,4 @@
--- @ingram-tech/nk-auth — Better Auth schema for Supabase, hardened for RLS.
+-- @ingram-tech/nk-auth — Better Auth schema, hardened for RLS.
 --
 -- This mirrors Better Auth's core tables (user / session / account /
 -- verification), the `jwt` plugin's `jwks` table, and the `passkey` plugin's
@@ -7,14 +7,14 @@
 --     npx @better-auth/cli generate
 -- and re-run after upgrading better-auth.
 --
--- TWO hardening steps the generator does NOT produce, both required (see
--- docs/better-auth-migration.md):
---   1. New users default to a UUID id, because Supabase's auth.uid() casts the
---      JWT `sub` to `uuid`. A non-UUID id silently breaks RLS for new signups.
---   2. Deny-all RLS on every Better Auth table. They live in `public` and are
---      exposed by PostgREST; Better Auth itself reaches them through its own
---      privileged DATABASE_URL connection, which bypasses RLS, so denying anon /
---      authenticated access here costs nothing and closes the leak.
+-- TWO hardening steps the generator does NOT produce, both required:
+--   1. New users default to a UUID id, because `auth.uid()`-style RLS policies
+--      cast the JWT `sub` to `uuid`. A non-UUID id silently breaks RLS for new
+--      signups.
+--   2. Deny-all RLS on every Better Auth table — defense in depth. Better Auth
+--      itself reaches them through its own privileged DATABASE_URL connection,
+--      which bypasses RLS, so denying the app's RLS role any access here costs
+--      nothing and keeps the auth tables off-limits to user-facing queries.
 
 create extension if not exists "pgcrypto" with schema "extensions";
 
@@ -64,7 +64,7 @@ create table if not exists "public"."verification" (
 	"updatedAt" timestamptz not null default now()
 );
 
--- `jwt` plugin: holds the asymmetric keypair used to sign the RLS bridge token.
+-- `jwt` plugin: holds the asymmetric keypair used to sign session JWTs.
 create table if not exists "public"."jwks" (
 	"id" text primary key,
 	"publicKey" text not null,

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@ingram-tech/nk-auth",
-	"version": "0.8.0",
-	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, Supabase RLS bridge, active-org hooks, pg pool) for Next.js sites.",
+	"version": "0.9.1",
+	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, active-org hooks, pg pool) for Next.js sites.",
 	"license": "MIT",
 	"type": "module",
 	"repository": {
@@ -61,14 +61,13 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@ingram-tech/nk-db": "^0.9.0",
+		"@ingram-tech/nk-db": "^1.1.0",
 		"bcrypt": "^6.0.0",
-		"jose": "^6.0.0",
-		"zod": "^4.0.0"
+		"jose": "^6.2.3",
+		"zod": "^4.4.3"
 	},
 	"peerDependencies": {
 		"@better-auth/passkey": "^1.6.0",
-		"@supabase/supabase-js": ">=2.0.0",
 		"better-auth": "^1.6.0",
 		"next": "^15.0.0 || ^16.0.0",
 		"pg": "^8.13.0",
@@ -78,9 +77,6 @@
 		"@better-auth/passkey": {
 			"optional": true
 		},
-		"@supabase/supabase-js": {
-			"optional": true
-		},
 		"next": {
 			"optional": true
 		},
@@ -92,18 +88,17 @@
 		}
 	},
 	"devDependencies": {
-		"@better-auth/passkey": "^1.6.0",
-		"@ingram-tech/nk-dev": "0.2.3",
-		"@supabase/supabase-js": "^2.45.0",
+		"@better-auth/passkey": "^1.6.22",
+		"@ingram-tech/nk-dev": "0.2.4",
 		"@types/bcrypt": "^6.0.0",
-		"@types/node": "^25.0.0",
-		"@types/pg": "^8.11.0",
-		"@types/react": "^19.0.0",
-		"better-auth": "^1.6.0",
+		"@types/node": "^26.0.1",
+		"@types/pg": "^8.20.0",
+		"@types/react": "^19.2.17",
+		"better-auth": "^1.6.22",
 		"next": "^16.2.9",
-		"pg": "^8.13.0",
-		"react": "^19.0.0",
+		"pg": "^8.22.0",
+		"react": "^19.2.7",
 		"typescript": "^6.0.3",
-		"vitest": "^4.1.6"
+		"vitest": "^4.1.9"
 	}
 }