@ingram-tech/nk-auth 0.9.0 → 0.10.0

package/README.md

@@ -176,6 +176,8 @@ export const {
 	requireSession,
 	requireUser,
 	redirectIfAuthenticated,
+	getLinkedProviders, // providerIds linked to the current user
+	hasCredentialAccount, // does the current user have an email/password login?
 } = createAuthHelpers(auth);
 ```
 
@@ -244,6 +246,84 @@ middleware injects — so the self-heal (next + clearing) needs the middleware.
 Sites that skip middleware still get validated gating from the server helpers,
 just without automatic `next`/clearing.
 
+## 6. Passwords: change, set, and reset
+
+nk-auth owns the reset **sender** (`makeEmailSenders.sendResetPassword`, §2) and
+now closes the loop so a site never touches Better Auth's `account` table or
+endpoint names directly. Three pieces:
+
+**Detect what login the user has.** A social-only account (Google, …) has no
+password credential until it sets one. `hasCredentialAccount()` drives the
+"Change password" vs "Set password" choice on a security page; reach for
+`getLinkedProviders()` when you need the full list.
+
+```tsx
+// app/settings/security/page.tsx (server component)
+import { hasCredentialAccount } from "@/lib/auth/session";
+export default async function Security() {
+	return (await hasCredentialAccount()) ? <ChangePassword /> : <SetPassword />;
+}
+```
+
+**Set a password without a current one.** A social-only user has no current
+password to verify, so the re-auth is an emailed reset link — clicking it proves
+account ownership. Trigger it with the standard client call; there is no separate
+"set password" endpoint:
+
+```ts
+await authClient.requestPasswordReset({
+	email,
+	redirectTo: "/reset-password", // your token-consumer page (below)
+});
+```
+
+Better Auth's reset endpoint **creates** the credential when the user has none,
+so the same flow both resets a forgotten password and sets a first one. That
+guarantee is pinned by `reset-password.test.ts` against a real instance, so a
+Better Auth upgrade can't silently break the set-password path.
+
+**Consume the token.** The email link lands on your page with `?token=` (or
+`?error=INVALID_TOKEN`). `useResetPassword` is the headless state machine —
+invalid-token, submitting, success, and policy validation (length + match) —
+against the shared `passwordSchema` bounds. You bring the shell:
+
+```tsx
+"use client";
+import { useResetPassword } from "@ingram-tech/nk-auth/client";
+import { authClient } from "@/lib/auth/client";
+
+export function ResetPasswordForm({ token }: { token: string | null }) {
+	const { status, error, submit } = useResetPassword(authClient, { token });
+	if (status === "invalid") return <p>This link is invalid or has expired.</p>;
+	if (status === "success") return <p>Password set. You can now sign in.</p>;
+	// <form onSubmit={() => submit(newPassword, confirm)}>; render `error.code`
+	// (stable, for i18n) or `error.message` (English fallback).
+}
+```
+
+Policy constants live at `@ingram-tech/nk-auth/password` (pure, importable from
+both ends): `DEFAULT_MIN_PASSWORD_LENGTH` / `DEFAULT_MAX_PASSWORD_LENGTH`,
+`passwordSchema()`, and `validateNewPassword()`. Pass your resolved bounds to
+`useResetPassword({ token, minLength, maxLength })` if you override Better Auth's
+defaults, so the form and the server never drift.
+
+**`.well-known/change-password`.** Add the [W3C well-known
+redirect](https://w3c.github.io/webappsec-change-password-url/) so password
+managers deep-link straight to your security page. It's a per-app route target,
+so nk-auth documents the convention rather than shipping it — in `next.config`:
+
+```ts
+async redirects() {
+	return [
+		{
+			source: "/.well-known/change-password",
+			destination: "/settings/security", // your Change/Set password page
+			permanent: false,
+		},
+	];
+}
+```
+
 ## Migrating bcrypt passwords to scrypt
 
 `bcryptPassword` is **legacy support only** (see its `@deprecated` note). It

package/dist/client.d.ts

@@ -20,5 +20,7 @@
 export { passkeyClient } from "@better-auth/passkey/client";
 export { jwtClient } from "better-auth/client/plugins";
 export { createAuthClient } from "better-auth/react";
+export { CREDENTIAL_PROVIDER_ID, DEFAULT_MAX_PASSWORD_LENGTH, DEFAULT_MIN_PASSWORD_LENGTH, type PasswordPolicy, passwordSchema, type ResetPasswordError, type ResetPasswordErrorCode, validateNewPassword, } from "./password.js";
 export { authBasePath } from "./paths.js";
+export { type ResetPasswordClient, type ResetPasswordStatus, type UseResetPassword, type UseResetPasswordOptions, useResetPassword, } from "./reset-password.js";
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EACN,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,mBAAmB,GACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,gBAAgB,GAChB,MAAM,qBAAqB,CAAC"}

package/dist/client.js

@@ -20,6 +20,11 @@
 export { passkeyClient } from "@better-auth/passkey/client";
 export { jwtClient } from "better-auth/client/plugins";
 export { createAuthClient } from "better-auth/react";
+// Password-policy primitives (pure), so a reset form validates against the same
+// bounds the server enforces without a second import.
+export { CREDENTIAL_PROVIDER_ID, DEFAULT_MAX_PASSWORD_LENGTH, DEFAULT_MIN_PASSWORD_LENGTH, passwordSchema, validateNewPassword, } from "./password.js";
 // Re-exported here too so the client can set `basePath` without a server import.
 export { authBasePath } from "./paths.js";
+// Headless reset-/set-password controller (React hook); the site brings the shell.
+export { useResetPassword, } from "./reset-password.js";
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,iFAAiF;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,gFAAgF;AAChF,sDAAsD;AACtD,OAAO,EACN,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAE3B,cAAc,EAGd,mBAAmB,GACnB,MAAM,eAAe,CAAC;AACvB,iFAAiF;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,mFAAmF;AACnF,OAAO,EAKN,gBAAgB,GAChB,MAAM,qBAAqB,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js"
 export { type AuthEnv, authEnv, isConfigured } from "./keys.js";
 export { bcryptPassword, makeEmailSenders, makePasskeyOptions, type PasskeyConfig, passkeyOptionsForBaseUrl, type SendEmail, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
+export { CREDENTIAL_PROVIDER_ID, DEFAULT_MAX_PASSWORD_LENGTH, DEFAULT_MIN_PASSWORD_LENGTH, type PasswordPolicy, passwordSchema, type ResetPasswordError, type ResetPasswordErrorCode, validateNewPassword, } from "./password.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,wBAAwB,EACxB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,wBAAwB,EACxB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,mBAAmB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -7,6 +7,7 @@ export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js"
 export { authEnv, isConfigured } from "./keys.js";
 export { bcryptPassword, makeEmailSenders, makePasskeyOptions, passkeyOptionsForBaseUrl, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
+export { CREDENTIAL_PROVIDER_ID, DEFAULT_MAX_PASSWORD_LENGTH, DEFAULT_MIN_PASSWORD_LENGTH, passwordSchema, validateNewPassword, } from "./password.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAAyB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAElB,wBAAwB,GAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAAyB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAElB,wBAAwB,GAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAE3B,cAAc,EAGd,mBAAmB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/jwt.d.ts

@@ -7,7 +7,7 @@ import { type JWTPayload } from "jose";
  * exposed at `/api/auth/jwks` so the backend can verify it (`verifyBackendJwt`).
  */
 export interface BackendJwtConfig {
-    /** Expected audience of the site's backend, e.g. "ingram-wiki-backend". */
+    /** Expected audience of the site's backend, e.g. "my-app-backend". */
     audience: string;
     /** Token lifetime, e.g. "15m". */
     expirationTime?: string;
@@ -23,6 +23,14 @@ export declare const backendJwtOptions: (config: BackendJwtConfig) => JwtOptions
  * Verify a Better-Auth-minted backend JWT (EdDSA) against the issuer's JWKS.
  * For use by the backend that consumes `backendJwtOptions` tokens. Throws on an
  * invalid/expired token or audience/issuer mismatch; returns the claims.
+ *
+ * Hardened against Better Auth signing-key rotation: jose's `createRemoteJWKSet`
+ * refuses to refetch the JWKS for `cooldownDuration` (30s default) after any
+ * fetch, so a token signed with a freshly rotated key whose `kid` isn't yet in
+ * the cached set would fail for the *whole* cooldown window — a ~30s burst of
+ * auth failures on every request that verifies a token. On a no-matching-key
+ * miss we force a single `.reload()` (which bypasses the cooldown) and retry, so
+ * a rotation costs one extra fetch instead of a brief outage.
  */
 export declare const verifyBackendJwt: (params: {
     token: string;

package/dist/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAerB,CAAC"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAGN,KAAK,UAAU,EAEf,MAAM,MAAM,CAAC;AAEd;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAChC,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAyBrB,CAAC"}

package/dist/jwt.js

@@ -1,4 +1,4 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, errors as joseErrors, jwtVerify, } from "jose";
 /** `jwt` plugin options for a backend-API token (custom audience). */
 export const backendJwtOptions = (config) => ({
     disableSettingJwtHeader: config.disableSettingJwtHeader,
@@ -12,6 +12,14 @@ const jwksCache = new Map();
  * Verify a Better-Auth-minted backend JWT (EdDSA) against the issuer's JWKS.
  * For use by the backend that consumes `backendJwtOptions` tokens. Throws on an
  * invalid/expired token or audience/issuer mismatch; returns the claims.
+ *
+ * Hardened against Better Auth signing-key rotation: jose's `createRemoteJWKSet`
+ * refuses to refetch the JWKS for `cooldownDuration` (30s default) after any
+ * fetch, so a token signed with a freshly rotated key whose `kid` isn't yet in
+ * the cached set would fail for the *whole* cooldown window — a ~30s burst of
+ * auth failures on every request that verifies a token. On a no-matching-key
+ * miss we force a single `.reload()` (which bypasses the cooldown) and retry, so
+ * a rotation costs one extra fetch instead of a brief outage.
  */
 export const verifyBackendJwt = async (params) => {
     const url = typeof params.jwksUrl === "string" ? new URL(params.jwksUrl) : params.jwksUrl;
@@ -21,11 +29,23 @@ export const verifyBackendJwt = async (params) => {
         jwks = createRemoteJWKSet(url);
         jwksCache.set(cacheKey, jwks);
     }
-    const { payload } = await jwtVerify(params.token, jwks, {
+    const options = {
         audience: params.audience,
         issuer: params.issuer,
         algorithms: ["EdDSA"],
-    });
-    return payload;
+    };
+    try {
+        const { payload } = await jwtVerify(params.token, jwks, options);
+        return payload;
+    }
+    catch (err) {
+        if (!(err instanceof joseErrors.JWKSNoMatchingKey))
+            throw err;
+        // `kid` absent from the cached JWKS — almost always a just-rotated signing
+        // key. Force a refresh past the cooldown and retry exactly once.
+        await jwks.reload();
+        const { payload } = await jwtVerify(params.token, jwks, options);
+        return payload;
+    }
 };
 //# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAmB,SAAS,EAAE,MAAM,MAAM,CAAC;AAqBtE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EACN,kBAAkB,EAClB,MAAM,IAAI,UAAU,EAEpB,SAAS,GACT,MAAM,MAAM,CAAC;AAqBd,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC;IACF,IAAI,CAAC;QACJ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,iBAAiB,CAAC;YAAE,MAAM,GAAG,CAAC;QAC9D,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC,CAAC"}

package/dist/password.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Password-policy primitives, shared by both ends of a site so the client form
+ * and the server validate against the *same* numbers. Pure (no `next`, `react`,
+ * or server imports) so it resolves identically from "@ingram-tech/nk-auth" and
+ * "@ingram-tech/nk-auth/client". Import from the "./password" subpath.
+ *
+ * The values mirror Better Auth's `emailAndPassword` defaults; if a site
+ * overrides `minPasswordLength` / `maxPasswordLength` in its `betterAuth()`
+ * config, pass the same numbers to `passwordSchema()` so the two stay in step.
+ */
+import { z } from "zod";
+/**
+ * The Better Auth `account.providerId` value for an email/password credential
+ * (as opposed to a social provider like "google"). This is Better Auth's own
+ * table shape, not ours — centralised here so no consuming site hard-codes the
+ * string. See {@link import("./server.js").createAuthHelpers}'s
+ * `hasCredentialAccount`.
+ */
+export declare const CREDENTIAL_PROVIDER_ID = "credential";
+/** Better Auth's default `emailAndPassword.minPasswordLength`. */
+export declare const DEFAULT_MIN_PASSWORD_LENGTH = 8;
+/** Better Auth's default `emailAndPassword.maxPasswordLength`. */
+export declare const DEFAULT_MAX_PASSWORD_LENGTH = 128;
+export interface PasswordPolicy {
+    /** Minimum length. Default {@link DEFAULT_MIN_PASSWORD_LENGTH}. */
+    minLength?: number;
+    /** Maximum length. Default {@link DEFAULT_MAX_PASSWORD_LENGTH}. */
+    maxLength?: number;
+}
+/**
+ * A Zod schema for a new password, honouring the resolved policy. Use it on both
+ * the client (form validation) and the server (before calling Better Auth) so
+ * neither side drifts from the other or from the instance's configured bounds.
+ */
+export declare function passwordSchema(policy?: PasswordPolicy): z.ZodString;
+/**
+ * The failure reasons of a "choose a new password + confirm it" form, as a
+ * stable `code` (switch on it for i18n) plus an English `message` fallback.
+ * `reset_failed` is the server rejecting the reset token (invalid / expired).
+ */
+export type ResetPasswordErrorCode = "password_too_short" | "password_too_long" | "passwords_do_not_match" | "reset_failed";
+export interface ResetPasswordError {
+    code: ResetPasswordErrorCode;
+    message: string;
+    /** Present on `password_too_short`. */
+    minLength?: number;
+    /** Present on `password_too_long`. */
+    maxLength?: number;
+}
+/**
+ * Validate a new-password pair (the field and its confirmation) against the
+ * policy. Returns the first {@link ResetPasswordError}, or null when valid. Pure
+ * so it is unit-testable and reusable outside React; {@link
+ * import("./client.js").useResetPassword} calls it before hitting the server.
+ */
+export declare function validateNewPassword(newPassword: string, confirmPassword: string, policy?: PasswordPolicy): ResetPasswordError | null;
+//# sourceMappingURL=password.d.ts.map

package/dist/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,MAAM,WAAW,cAAc;IAC9B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,GAAE,cAAmB,GAAG,CAAC,CAAC,SAAS,CAOvE;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAC/B,oBAAoB,GACpB,mBAAmB,GACnB,wBAAwB,GACxB,cAAc,CAAC;AAElB,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,cAAmB,GACzB,kBAAkB,GAAG,IAAI,CAwB3B"}

package/dist/password.js

@@ -0,0 +1,68 @@
+/**
+ * Password-policy primitives, shared by both ends of a site so the client form
+ * and the server validate against the *same* numbers. Pure (no `next`, `react`,
+ * or server imports) so it resolves identically from "@ingram-tech/nk-auth" and
+ * "@ingram-tech/nk-auth/client". Import from the "./password" subpath.
+ *
+ * The values mirror Better Auth's `emailAndPassword` defaults; if a site
+ * overrides `minPasswordLength` / `maxPasswordLength` in its `betterAuth()`
+ * config, pass the same numbers to `passwordSchema()` so the two stay in step.
+ */
+import { z } from "zod";
+/**
+ * The Better Auth `account.providerId` value for an email/password credential
+ * (as opposed to a social provider like "google"). This is Better Auth's own
+ * table shape, not ours — centralised here so no consuming site hard-codes the
+ * string. See {@link import("./server.js").createAuthHelpers}'s
+ * `hasCredentialAccount`.
+ */
+export const CREDENTIAL_PROVIDER_ID = "credential";
+/** Better Auth's default `emailAndPassword.minPasswordLength`. */
+export const DEFAULT_MIN_PASSWORD_LENGTH = 8;
+/** Better Auth's default `emailAndPassword.maxPasswordLength`. */
+export const DEFAULT_MAX_PASSWORD_LENGTH = 128;
+/**
+ * A Zod schema for a new password, honouring the resolved policy. Use it on both
+ * the client (form validation) and the server (before calling Better Auth) so
+ * neither side drifts from the other or from the instance's configured bounds.
+ */
+export function passwordSchema(policy = {}) {
+    const min = policy.minLength ?? DEFAULT_MIN_PASSWORD_LENGTH;
+    const max = policy.maxLength ?? DEFAULT_MAX_PASSWORD_LENGTH;
+    return z
+        .string()
+        .min(min, `Password must be at least ${min} characters.`)
+        .max(max, `Password must be at most ${max} characters.`);
+}
+/**
+ * Validate a new-password pair (the field and its confirmation) against the
+ * policy. Returns the first {@link ResetPasswordError}, or null when valid. Pure
+ * so it is unit-testable and reusable outside React; {@link
+ * import("./client.js").useResetPassword} calls it before hitting the server.
+ */
+export function validateNewPassword(newPassword, confirmPassword, policy = {}) {
+    const min = policy.minLength ?? DEFAULT_MIN_PASSWORD_LENGTH;
+    const max = policy.maxLength ?? DEFAULT_MAX_PASSWORD_LENGTH;
+    if (newPassword.length < min) {
+        return {
+            code: "password_too_short",
+            message: `Password must be at least ${min} characters.`,
+            minLength: min,
+        };
+    }
+    if (newPassword.length > max) {
+        return {
+            code: "password_too_long",
+            message: `Password must be at most ${max} characters.`,
+            maxLength: max,
+        };
+    }
+    if (newPassword !== confirmPassword) {
+        return {
+            code: "passwords_do_not_match",
+            message: "Passwords do not match.",
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=password.js.map

package/dist/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,kEAAkE;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAS/C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAyB,EAAE;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,2BAA2B,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,2BAA2B,CAAC;IAC5D,OAAO,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,EAAE,6BAA6B,GAAG,cAAc,CAAC;SACxD,GAAG,CAAC,GAAG,EAAE,4BAA4B,GAAG,cAAc,CAAC,CAAC;AAC3D,CAAC;AAsBD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAClC,WAAmB,EACnB,eAAuB,EACvB,SAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,2BAA2B,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,2BAA2B,CAAC;IAC5D,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC9B,OAAO;YACN,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,6BAA6B,GAAG,cAAc;YACvD,SAAS,EAAE,GAAG;SACd,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC9B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,4BAA4B,GAAG,cAAc;YACtD,SAAS,EAAE,GAAG;SACd,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACrC,OAAO;YACN,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,yBAAyB;SAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/reset-password.d.ts

@@ -0,0 +1,47 @@
+import { type PasswordPolicy, type ResetPasswordError } from "./password.js";
+export type ResetPasswordStatus = 
+/** No usable token in the URL — show an "invalid or expired link" message. */
+"invalid"
+/** Token present; awaiting the user's new password. */
+ | "idle"
+/** The reset request is in flight. */
+ | "submitting"
+/** The password was set; the user can now sign in with it. */
+ | "success"
+/** Validation failed, or the server rejected the reset — see `error`. */
+ | "error";
+/** The slice of a Better Auth client this hook calls. */
+export interface ResetPasswordClient {
+    resetPassword: (input: {
+        newPassword: string;
+        token: string;
+    }) => Promise<{
+        error?: {
+            message?: string;
+        } | null;
+    }>;
+}
+export interface UseResetPasswordOptions extends PasswordPolicy {
+    /**
+     * The reset token from the URL (`?token=`), or null when it is missing — e.g.
+     * the link carried `?error=INVALID_TOKEN` instead. Null puts the controller in
+     * the `invalid` state before any submit.
+     */
+    token: string | null;
+}
+export interface UseResetPassword {
+    status: ResetPasswordStatus;
+    /** The current failure, or null. `code` is stable for i18n; `message` is an English fallback. */
+    error: ResetPasswordError | null;
+    /** Validate the pair against the policy, then call the reset endpoint. */
+    submit: (newPassword: string, confirmPassword: string) => Promise<void>;
+}
+/**
+ * Drive a reset-password form. Returns the current `status`, the last `error`
+ * (with an i18n-friendly `code`), and a `submit(newPassword, confirmPassword)`
+ * that runs {@link validateNewPassword} against the policy before hitting the
+ * server. Pass the resolved `minLength` / `maxLength` when the site overrides
+ * Better Auth's defaults so client and server agree.
+ */
+export declare function useResetPassword(client: ResetPasswordClient, options: UseResetPasswordOptions): UseResetPassword;
+//# sourceMappingURL=reset-password.d.ts.map

package/dist/reset-password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../src/reset-password.ts"],"names":[],"mappings":"AAoBA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,mBAAmB;AAC9B,8EAA8E;AAC5E,SAAS;AACX,uDAAuD;GACrD,MAAM;AACR,sCAAsC;GACpC,YAAY;AACd,8DAA8D;GAC5D,SAAS;AACX,yEAAyE;GACvE,OAAO,CAAC;AAEX,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,uBAAwB,SAAQ,cAAc;IAC9D;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,iGAAiG;IACjG,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjC,0EAA0E;IAC1E,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,uBAAuB,GAC9B,gBAAgB,CAoDlB"}

package/dist/reset-password.js

@@ -0,0 +1,75 @@
+/**
+ * Headless controller for a "set / reset your password" page — the token
+ * consumer at the end of Better Auth's forget-password round trip. nk-auth owns
+ * the *sender* (`makeEmailSenders.sendResetPassword`) and the endpoint contract;
+ * this closes the loop so a site never touches the `resetPassword` endpoint name
+ * or hand-rolls the invalid-token / success / validation state machine. The site
+ * brings its own shell (inputs, buttons, i18n) and wires it to what this returns.
+ *
+ * The same page serves both entry points, because both land on the identical URL
+ * with a `?token=`: the classic "I forgot my password" flow, and "set a password
+ * for my social-only account" (Better Auth's reset endpoint creates the
+ * credential when the user has none — see the package README).
+ *
+ *   "use client";
+ *   const { status, error, submit } = useResetPassword(authClient, { token });
+ *   if (status === "invalid") return <InvalidLink />;
+ *   if (status === "success") return <Done />;
+ *   // <form onSubmit={() => submit(pw, confirm)}> … {error && t(error.code)} …
+ */
+import { useCallback, useState } from "react";
+import { validateNewPassword, } from "./password.js";
+const RESET_FAILED_FALLBACK = "Could not reset your password.";
+/**
+ * Drive a reset-password form. Returns the current `status`, the last `error`
+ * (with an i18n-friendly `code`), and a `submit(newPassword, confirmPassword)`
+ * that runs {@link validateNewPassword} against the policy before hitting the
+ * server. Pass the resolved `minLength` / `maxLength` when the site overrides
+ * Better Auth's defaults so client and server agree.
+ */
+export function useResetPassword(client, options) {
+    const { token, minLength, maxLength } = options;
+    const [status, setStatus] = useState(token ? "idle" : "invalid");
+    const [error, setError] = useState(null);
+    const submit = useCallback(async (newPassword, confirmPassword) => {
+        if (!token) {
+            setStatus("invalid");
+            return;
+        }
+        const validation = validateNewPassword(newPassword, confirmPassword, {
+            minLength,
+            maxLength,
+        });
+        if (validation) {
+            setError(validation);
+            setStatus("error");
+            return;
+        }
+        setError(null);
+        setStatus("submitting");
+        try {
+            const { error: resetError } = await client.resetPassword({
+                newPassword,
+                token,
+            });
+            if (resetError) {
+                setError({
+                    code: "reset_failed",
+                    message: resetError.message ?? RESET_FAILED_FALLBACK,
+                });
+                setStatus("error");
+                return;
+            }
+            setStatus("success");
+        }
+        catch (err) {
+            setError({
+                code: "reset_failed",
+                message: err instanceof Error ? err.message : RESET_FAILED_FALLBACK,
+            });
+            setStatus("error");
+        }
+    }, [token, minLength, maxLength, client]);
+    return { status, error, submit };
+}
+//# sourceMappingURL=reset-password.js.map

package/dist/reset-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-password.js","sourceRoot":"","sources":["../src/reset-password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,EAGN,mBAAmB,GACnB,MAAM,eAAe,CAAC;AAuCvB,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAA2B,EAC3B,OAAgC;IAEhC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAChD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CACnC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAC1B,CAAC;IACF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,WAAW,CACzB,KAAK,EAAE,WAAmB,EAAE,eAAuB,EAAiB,EAAE;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,EAAE,eAAe,EAAE;YACpE,SAAS;YACT,SAAS;SACT,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,UAAU,CAAC,CAAC;YACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO;QACR,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,CAAC;YACJ,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;gBACxD,WAAW;gBACX,KAAK;aACL,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBAChB,QAAQ,CAAC;oBACR,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,qBAAqB;iBACpD,CAAC,CAAC;gBACH,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO;YACR,CAAC;YACD,SAAS,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,CAAC;gBACR,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;aACnE,CAAC,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;IACF,CAAC,EACD,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CACrC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/server.d.ts

@@ -18,6 +18,17 @@ interface AuthLike<S extends SessionLike> {
         getSession: (input: {
             headers: Headers;
         }) => Promise<S | null>;
+        /**
+         * Better Auth's `/list-accounts`: the auth methods linked to the current
+         * session's user, each `{ providerId }` ("credential" for email/password,
+         * or a social provider like "google"). Present on every real `betterAuth()`
+         * instance; powers `getLinkedProviders` / `hasCredentialAccount` below.
+         */
+        listUserAccounts: (input: {
+            headers: Headers;
+        }) => Promise<Array<{
+            providerId: string;
+        }>>;
     };
 }
 export interface AuthHelpersOptions {
@@ -36,5 +47,7 @@ export declare function createAuthHelpers<S extends SessionLike>(auth: AuthLike<
     requireSession: () => Promise<S>;
     requireUser: () => Promise<S["user"]>;
     redirectIfAuthenticated: (to: string) => Promise<void>;
+    getLinkedProviders: () => Promise<string[]>;
+    hasCredentialAccount: () => Promise<boolean>;
 };
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA4BA;;;;GAIG;AACH,OAAO,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE,oEAAoE;AACpE,UAAU,WAAW;IACpB,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;;;GAIG;AACH,UAAU,QAAQ,CAAC,CAAC,SAAS,WAAW;IACvC,GAAG,EAAE;QACJ,UAAU,EAAE,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;KAC/D,CAAC;CACF;AAED,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW,EACtD,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EACjB,OAAO,GAAE,kBAAuB;sBAMH,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;mBAKpB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;0BAkClB,OAAO,CAAC,CAAC,CAAC;uBAXb,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;kCAuBL,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;EAWjE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA6BA;;;;GAIG;AACH,OAAO,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE,oEAAoE;AACpE,UAAU,WAAW;IACpB,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;;;GAIG;AACH,UAAU,QAAQ,CAAC,CAAC,SAAS,WAAW;IACvC,GAAG,EAAE;QACJ,UAAU,EAAE,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D;;;;;WAKG;QACH,gBAAgB,EAAE,CAAC,KAAK,EAAE;YACzB,OAAO,EAAE,OAAO,CAAC;SACjB,KAAK,OAAO,CAAC,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;KAC7C,CAAC;CACF;AAED,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW,EACtD,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EACjB,OAAO,GAAE,kBAAuB;sBAMH,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;mBAKpB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;0BAkClB,OAAO,CAAC,CAAC,CAAC;uBAXb,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;kCAuBL,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;8BAU5B,OAAO,CAAC,MAAM,EAAE,CAAC;gCAcf,OAAO,CAAC,OAAO,CAAC;EAcvD"}

package/dist/server.js

@@ -25,6 +25,7 @@
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { NK_AUTH_PATH_HEADER, signInUrl } from "./gating-internals.js";
+import { CREDENTIAL_PROVIDER_ID } from "./password.js";
 /**
  * Validate a `next` redirect param: returns it only if it's an internal,
  * non-protocol-relative path, else null. Use on the login page before honoring
@@ -87,12 +88,37 @@ export function createAuthHelpers(auth, options = {}) {
         if (await getSession())
             redirect(to);
     }
+    /**
+     * The `providerId`s linked to the current session's user — "credential" for
+     * email/password, plus any social providers ("google", …). Empty when signed
+     * out. Reads Better Auth's own `/list-accounts`, so a site never queries the
+     * `account` table or hard-codes provider strings itself.
+     */
+    async function getLinkedProviders() {
+        const accounts = await auth.api.listUserAccounts({
+            headers: await headers(),
+        });
+        return accounts.map((account) => account.providerId);
+    }
+    /**
+     * Whether the current user has an email/password credential. Drives the
+     * "Change password" vs "Set password" decision on a security page: a user who
+     * signed up purely through a social provider has none until they set one
+     * (typically via the reset-password / forgot-password flow — see the
+     * `useResetPassword` client hook). Returns false when signed out.
+     */
+    async function hasCredentialAccount() {
+        const providers = await getLinkedProviders();
+        return providers.includes(CREDENTIAL_PROVIDER_ID);
+    }
     return {
         getSession,
         getUser,
         requireSession,
         requireUser,
         redirectIfAuthenticated,
+        getLinkedProviders,
+        hasCredentialAccount,
     };
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvE;;;;GAIG;AACH,OAAO,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AA6BlE,MAAM,UAAU,iBAAiB,CAChC,IAAiB,EACjB,UAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,IAAI,aAAa,CAAC;IAElE,4DAA4D;IAC5D,KAAK,UAAU,UAAU;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,uCAAuC;IACvC,KAAK,UAAU,OAAO;QACrB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,YAAY;QAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,WAAW;QACzB,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,oEAAoE;QACpE,IAAI,CAAC,IAAI;YAAE,QAAQ,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,cAAc;QAC5B,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,uBAAuB,CAAC,EAAU;QAChD,IAAI,MAAM,UAAU,EAAE;YAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;QACN,UAAU;QACV,OAAO;QACP,cAAc;QACd,WAAW;QACX,uBAAuB;KACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;GAIG;AACH,OAAO,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAsClE,MAAM,UAAU,iBAAiB,CAChC,IAAiB,EACjB,UAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,IAAI,aAAa,CAAC;IAElE,4DAA4D;IAC5D,KAAK,UAAU,UAAU;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,uCAAuC;IACvC,KAAK,UAAU,OAAO;QACrB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,YAAY;QAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,WAAW;QACzB,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,oEAAoE;QACpE,IAAI,CAAC,IAAI;YAAE,QAAQ,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,cAAc;QAC5B,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,uBAAuB,CAAC,EAAU;QAChD,IAAI,MAAM,UAAU,EAAE;YAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,kBAAkB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAChD,OAAO,EAAE,MAAM,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,oBAAoB;QAClC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACN,UAAU;QACV,OAAO;QACP,cAAc;QACd,WAAW;QACX,uBAAuB;QACvB,kBAAkB;QAClB,oBAAoB;KACpB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-auth",
-	"version": "0.9.0",
+	"version": "0.10.0",
 	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, active-org hooks, pg pool) for Next.js sites.",
 	"license": "MIT",
 	"type": "module",
@@ -41,6 +41,10 @@
 			"types": "./dist/paths.d.ts",
 			"import": "./dist/paths.js"
 		},
+		"./password": {
+			"types": "./dist/password.d.ts",
+			"import": "./dist/password.js"
+		},
 		"./server": {
 			"types": "./dist/server.d.ts",
 			"import": "./dist/server.js"
@@ -61,10 +65,10 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@ingram-tech/nk-db": "^1.0.0",
+		"@ingram-tech/nk-db": "^1.1.0",
 		"bcrypt": "^6.0.0",
-		"jose": "^6.0.0",
-		"zod": "^4.0.0"
+		"jose": "^6.2.3",
+		"zod": "^4.4.3"
 	},
 	"peerDependencies": {
 		"@better-auth/passkey": "^1.6.0",
@@ -88,17 +92,17 @@
 		}
 	},
 	"devDependencies": {
-		"@better-auth/passkey": "^1.6.0",
+		"@better-auth/passkey": "^1.6.22",
 		"@ingram-tech/nk-dev": "0.2.4",
 		"@types/bcrypt": "^6.0.0",
-		"@types/node": "^25.0.0",
-		"@types/pg": "^8.11.0",
-		"@types/react": "^19.0.0",
-		"better-auth": "^1.6.0",
+		"@types/node": "^26.0.1",
+		"@types/pg": "^8.20.0",
+		"@types/react": "^19.2.17",
+		"better-auth": "^1.6.22",
 		"next": "^16.2.9",
-		"pg": "^8.13.0",
-		"react": "^19.0.0",
+		"pg": "^8.22.0",
+		"react": "^19.2.7",
 		"typescript": "^6.0.3",
-		"vitest": "^4.1.6"
+		"vitest": "^4.1.9"
 	}
 }