@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/admin/schema.d.mts

@@ -0,0 +1,40 @@
+//#region src/plugins/admin/schema.d.ts
+declare const schema: {
+  user: {
+    fields: {
+      role: {
+        type: "string";
+        required: false;
+        input: false;
+      };
+      banned: {
+        type: "boolean";
+        defaultValue: false;
+        required: false;
+        input: false;
+      };
+      banReason: {
+        type: "string";
+        required: false;
+        input: false;
+      };
+      banExpires: {
+        type: "date";
+        required: false;
+        input: false;
+      };
+    };
+  };
+  session: {
+    fields: {
+      impersonatedBy: {
+        type: "string";
+        required: false;
+        input: false;
+      };
+    };
+  };
+};
+type AdminSchema = typeof schema;
+//#endregion
+export { AdminSchema };

package/dist/plugins/admin/schema.mjs

@@ -0,0 +1,33 @@
+//#region src/plugins/admin/schema.ts
+const schema = {
+	user: { fields: {
+		role: {
+			type: "string",
+			required: false,
+			input: false
+		},
+		banned: {
+			type: "boolean",
+			defaultValue: false,
+			required: false,
+			input: false
+		},
+		banReason: {
+			type: "string",
+			required: false,
+			input: false
+		},
+		banExpires: {
+			type: "date",
+			required: false,
+			input: false
+		}
+	} },
+	session: { fields: { impersonatedBy: {
+		type: "string",
+		required: false,
+		input: false
+	} } }
+};
+//#endregion
+export { schema };

package/dist/plugins/admin/types.d.mts

@@ -0,0 +1,88 @@
+import { Session, User } from "../../types/models.mjs";
+import { InferOptionSchema } from "../../types/plugins.mjs";
+import { AccessControl, Role } from "../access/types.mjs";
+import { AdminSchema } from "./schema.mjs";
+
+//#region src/plugins/admin/types.d.ts
+interface UserWithRole extends User {
+  role?: string | undefined;
+  banned: boolean | null;
+  banReason?: (string | null) | undefined;
+  banExpires?: (Date | null) | undefined;
+}
+interface SessionWithImpersonatedBy extends Session {
+  impersonatedBy?: string | undefined;
+}
+interface AdminOptions {
+  /**
+   * The default role for a user
+   *
+   * @default "user"
+   */
+  defaultRole?: string | undefined;
+  /**
+   * Roles that are considered admin roles.
+   *
+   * Any user role that isn't in this list, even if they have the permission,
+   * will not be considered an admin.
+   *
+   * @default ["admin"]
+   */
+  adminRoles?: (string | string[]) | undefined;
+  /**
+   * A default ban reason
+   *
+   * By default, no reason is provided
+   */
+  defaultBanReason?: string | undefined;
+  /**
+   * Number of seconds until the ban expires
+   *
+   * By default, the ban never expires
+   */
+  defaultBanExpiresIn?: number | undefined;
+  /**
+   * Duration of the impersonation session in seconds
+   *
+   * By default, the impersonation session lasts 1 hour
+   */
+  impersonationSessionDuration?: number | undefined;
+  /**
+   * Custom schema for the admin plugin
+   */
+  schema?: InferOptionSchema<AdminSchema> | undefined;
+  /**
+   * Configure the roles and permissions for the admin
+   * plugin.
+   */
+  ac?: AccessControl | undefined;
+  /**
+   * Custom permissions for roles.
+   */
+  roles?: { [key in string]?: Role } | undefined;
+  /**
+   * List of user ids that should have admin access
+   *
+   * If this is set, the `adminRole` option is ignored
+   */
+  adminUserIds?: string[] | undefined;
+  /**
+   * Message to show when a user is banned
+   *
+   * By default, the message is "You have been banned from this application"
+   */
+  bannedUserMessage?: string | undefined;
+  /**
+   * Whether to allow impersonating other admins.
+   *
+   * @deprecated Use the `impersonate-admins` permission instead.
+   *
+   * @default false
+   */
+  allowImpersonatingAdmins?: boolean | undefined;
+}
+type InferAdminRolesFromOption<O extends AdminOptions | undefined> = O extends {
+  roles: Record<string, unknown>;
+} ? keyof O["roles"] : "user" | "admin";
+//#endregion
+export { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole };

package/dist/plugins/anonymous/client.d.mts

@@ -0,0 +1,32 @@
+import { schema } from "./schema.mjs";
+import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./types.mjs";
+import { anonymous } from "./index.mjs";
+import { ANONYMOUS_ERROR_CODES } from "./error-codes.mjs";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/anonymous/client.d.ts
+declare const anonymousClient: () => {
+  id: "anonymous";
+  version: string;
+  $InferServerPlugin: ReturnType<typeof anonymous>;
+  pathMethods: {
+    "/sign-in/anonymous": "POST";
+    "/delete-anonymous-user": "POST";
+  };
+  atomListeners: {
+    matcher: (path: string) => path is "/sign-in/anonymous";
+    signal: "$sessionSignal";
+  }[];
+  $ERROR_CODES: {
+    FAILED_TO_CREATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_CREATE_USER">;
+    INVALID_EMAIL_FORMAT: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_EMAIL_FORMAT">;
+    COULD_NOT_CREATE_SESSION: _$_better_auth_core_utils_error_codes0.RawError<"COULD_NOT_CREATE_SESSION">;
+    ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: _$_better_auth_core_utils_error_codes0.RawError<"ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY">;
+    FAILED_TO_DELETE_ANONYMOUS_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER">;
+    FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS">;
+    USER_IS_NOT_ANONYMOUS: _$_better_auth_core_utils_error_codes0.RawError<"USER_IS_NOT_ANONYMOUS">;
+    DELETE_ANONYMOUS_USER_DISABLED: _$_better_auth_core_utils_error_codes0.RawError<"DELETE_ANONYMOUS_USER_DISABLED">;
+  };
+};
+//#endregion
+export { anonymousClient };

package/dist/plugins/anonymous/client.mjs

@@ -0,0 +1,21 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { ANONYMOUS_ERROR_CODES } from "./error-codes.mjs";
+//#region src/plugins/anonymous/client.ts
+const anonymousClient = () => {
+	return {
+		id: "anonymous",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		pathMethods: {
+			"/sign-in/anonymous": "POST",
+			"/delete-anonymous-user": "POST"
+		},
+		atomListeners: [{
+			matcher: (path) => path === "/sign-in/anonymous",
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: ANONYMOUS_ERROR_CODES
+	};
+};
+//#endregion
+export { anonymousClient };

package/dist/plugins/anonymous/error-codes.d.mts

@@ -0,0 +1,15 @@
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/anonymous/error-codes.d.ts
+declare const ANONYMOUS_ERROR_CODES: {
+  FAILED_TO_CREATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_CREATE_USER">;
+  INVALID_EMAIL_FORMAT: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_EMAIL_FORMAT">;
+  COULD_NOT_CREATE_SESSION: _$_better_auth_core_utils_error_codes0.RawError<"COULD_NOT_CREATE_SESSION">;
+  ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: _$_better_auth_core_utils_error_codes0.RawError<"ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY">;
+  FAILED_TO_DELETE_ANONYMOUS_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER">;
+  FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS">;
+  USER_IS_NOT_ANONYMOUS: _$_better_auth_core_utils_error_codes0.RawError<"USER_IS_NOT_ANONYMOUS">;
+  DELETE_ANONYMOUS_USER_DISABLED: _$_better_auth_core_utils_error_codes0.RawError<"DELETE_ANONYMOUS_USER_DISABLED">;
+};
+//#endregion
+export { ANONYMOUS_ERROR_CODES };

package/dist/plugins/anonymous/error-codes.mjs

@@ -0,0 +1,14 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+//#region src/plugins/anonymous/error-codes.ts
+const ANONYMOUS_ERROR_CODES = defineErrorCodes({
+	INVALID_EMAIL_FORMAT: "Email was not generated in a valid format",
+	FAILED_TO_CREATE_USER: "Failed to create user",
+	COULD_NOT_CREATE_SESSION: "Could not create session",
+	ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: "Anonymous users cannot sign in again anonymously",
+	FAILED_TO_DELETE_ANONYMOUS_USER: "Failed to delete anonymous user",
+	FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: "Failed to delete anonymous user sessions",
+	USER_IS_NOT_ANONYMOUS: "User is not anonymous",
+	DELETE_ANONYMOUS_USER_DISABLED: "Deleting anonymous users is disabled"
+});
+//#endregion
+export { ANONYMOUS_ERROR_CODES };

package/dist/plugins/anonymous/index.d.mts

@@ -0,0 +1,175 @@
+import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./types.mjs";
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+import * as _$better_call0 from "better-call";
+
+//#region src/plugins/anonymous/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    anonymous: {
+      creator: typeof anonymous;
+    };
+  }
+}
+declare const anonymous: (options?: AnonymousOptions | undefined) => {
+  id: "anonymous";
+  version: string;
+  endpoints: {
+    signInAnonymous: _$better_call0.StrictEndpoint<"/sign-in/anonymous", {
+      method: "POST";
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      user: {
+                        $ref: string;
+                      };
+                      session: {
+                        $ref: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      token: string;
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    }>;
+    deleteAnonymousUser: _$better_call0.StrictEndpoint<"/delete-anonymous-user", {
+      method: "POST";
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>>[];
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      success: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+            "400": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      message: {
+                        type: string;
+                      };
+                    };
+                  };
+                  required: string[];
+                };
+              };
+            };
+            "500": {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      message: {
+                        type: string;
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      success: boolean;
+    }>;
+  };
+  hooks: {
+    before: {
+      matcher(ctx: _$_better_auth_core0.HookEndpointContext): boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+    after: {
+      matcher(ctx: _$_better_auth_core0.HookEndpointContext): boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+  options: AnonymousOptions | undefined;
+  schema: {
+    user: {
+      fields: {
+        isAnonymous: {
+          type: "boolean";
+          required: false;
+          input: false;
+          defaultValue: false;
+        };
+      };
+    };
+  };
+  $ERROR_CODES: {
+    FAILED_TO_CREATE_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_CREATE_USER">;
+    INVALID_EMAIL_FORMAT: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_EMAIL_FORMAT">;
+    COULD_NOT_CREATE_SESSION: _$_better_auth_core_utils_error_codes0.RawError<"COULD_NOT_CREATE_SESSION">;
+    ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: _$_better_auth_core_utils_error_codes0.RawError<"ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY">;
+    FAILED_TO_DELETE_ANONYMOUS_USER: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER">;
+    FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: _$_better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS">;
+    USER_IS_NOT_ANONYMOUS: _$_better_auth_core_utils_error_codes0.RawError<"USER_IS_NOT_ANONYMOUS">;
+    DELETE_ANONYMOUS_USER_DISABLED: _$_better_auth_core_utils_error_codes0.RawError<"DELETE_ANONYMOUS_USER_DISABLED">;
+  };
+};
+//#endregion
+export { AnonymousOptions, AnonymousSession, UserWithAnonymous, anonymous };

package/dist/plugins/anonymous/index.mjs

@@ -0,0 +1,219 @@
+import { mergeSchema, parseUserOutput } from "../../db/schema.mjs";
+import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
+import { deleteSessionCookie, setSessionCookie } from "../../cookies/index.mjs";
+import { addOAuthServerContext, getOAuthState } from "../../api/state/oauth.mjs";
+import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
+import { APIError } from "../../api/index.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { ANONYMOUS_ERROR_CODES } from "./error-codes.mjs";
+import { schema } from "./schema.mjs";
+import { generateId } from "@better-auth/core/utils/id";
+import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
+import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
+//#region src/plugins/anonymous/index.ts
+/**
+* Resolves the anonymous session being upgraded during an account-link callback.
+*
+* The anonymous session is normally read from the request cookie. When the
+* OAuth callback arrives without that cookie (for example Expo's in-app browser,
+* which only carries the OAuth state, not the session cookie), the anonymous
+* user id captured at sign-in is recovered from the server-only OAuth state
+* instead. Returns `null` when there is no anonymous session to link.
+*/
+async function resolveAnonymousSession(ctx) {
+	const cookieSession = await getSessionFromCtx(ctx, { disableRefresh: true });
+	if (cookieSession?.user.isAnonymous) return {
+		session: cookieSession.session,
+		user: {
+			...cookieSession.user,
+			isAnonymous: true
+		}
+	};
+	const anonymousUserId = (await getOAuthState())?.serverContext?.anonymousUserId;
+	if (typeof anonymousUserId !== "string") return null;
+	const user = await ctx.context.internalAdapter.findUserById(anonymousUserId);
+	if (!user?.isAnonymous) return null;
+	const [anonymousSession] = await ctx.context.internalAdapter.listSessions(user.id, { onlyActiveSessions: true });
+	if (!anonymousSession) return null;
+	return {
+		session: anonymousSession,
+		user: {
+			...user,
+			isAnonymous: true
+		}
+	};
+}
+async function getAnonUserEmail(options) {
+	const customEmail = await options?.generateRandomEmail?.();
+	if (customEmail) {
+		if (!z.email().safeParse(customEmail).success) throw APIError.from("BAD_REQUEST", ANONYMOUS_ERROR_CODES.INVALID_EMAIL_FORMAT);
+		return customEmail;
+	}
+	const id = generateId();
+	if (options?.emailDomainName) return `temp-${id}@${options.emailDomainName}`;
+	return createPlaceholderEmail({
+		identifier: id,
+		namespace: "anonymous"
+	});
+}
+const anonymous = (options) => {
+	return {
+		id: "anonymous",
+		version: PACKAGE_VERSION,
+		endpoints: {
+			signInAnonymous: createAuthEndpoint("/sign-in/anonymous", {
+				method: "POST",
+				metadata: { openapi: {
+					description: "Sign in anonymously",
+					responses: { 200: {
+						description: "Sign in anonymously",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								user: { $ref: "#/components/schemas/User" },
+								session: { $ref: "#/components/schemas/Session" }
+							}
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if ((await getSessionFromCtx(ctx, { disableRefresh: true }))?.user.isAnonymous) throw APIError.from("BAD_REQUEST", ANONYMOUS_ERROR_CODES.ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY);
+				const email = await getAnonUserEmail(options);
+				const name = await options?.generateName?.(ctx) || "Anonymous";
+				const newUser = await ctx.context.internalAdapter.createUser({
+					email,
+					emailVerified: false,
+					isAnonymous: true,
+					name,
+					createdAt: /* @__PURE__ */ new Date(),
+					updatedAt: /* @__PURE__ */ new Date()
+				}, { method: "anonymous" });
+				if (!newUser) throw APIError.from("INTERNAL_SERVER_ERROR", ANONYMOUS_ERROR_CODES.FAILED_TO_CREATE_USER);
+				const session = await ctx.context.internalAdapter.createSession(newUser.id);
+				if (!session) throw APIError.from("BAD_REQUEST", ANONYMOUS_ERROR_CODES.COULD_NOT_CREATE_SESSION);
+				await setSessionCookie(ctx, {
+					session,
+					user: newUser
+				});
+				return ctx.json({
+					token: session.token,
+					user: parseUserOutput(ctx.context.options, newUser)
+				});
+			}),
+			deleteAnonymousUser: createAuthEndpoint("/delete-anonymous-user", {
+				method: "POST",
+				use: [sensitiveSessionMiddleware],
+				metadata: { openapi: {
+					description: "Delete an anonymous user",
+					responses: {
+						200: {
+							description: "Anonymous user deleted",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: { success: { type: "boolean" } }
+							} } }
+						},
+						"400": {
+							description: "Anonymous user deletion is disabled",
+							content: { "application/json": {
+								schema: {
+									type: "object",
+									properties: { message: { type: "string" } }
+								},
+								required: ["message"]
+							} }
+						},
+						"500": {
+							description: "Internal server error",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: { message: { type: "string" } },
+								required: ["message"]
+							} } }
+						}
+					}
+				} }
+			}, async (ctx) => {
+				const session = ctx.context.session;
+				if (options?.disableDeleteAnonymousUser) throw APIError.from("BAD_REQUEST", ANONYMOUS_ERROR_CODES.DELETE_ANONYMOUS_USER_DISABLED);
+				if (!session.user.isAnonymous) throw APIError.from("FORBIDDEN", ANONYMOUS_ERROR_CODES.USER_IS_NOT_ANONYMOUS);
+				try {
+					await ctx.context.internalAdapter.deleteUserSessions(session.user.id);
+				} catch (error) {
+					ctx.context.logger.error("Failed to delete anonymous user sessions", error);
+					throw APIError.from("INTERNAL_SERVER_ERROR", ANONYMOUS_ERROR_CODES.FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS);
+				}
+				try {
+					await ctx.context.internalAdapter.deleteUser(session.user.id);
+				} catch (error) {
+					ctx.context.logger.error("Failed to delete anonymous user", error);
+					throw APIError.from("INTERNAL_SERVER_ERROR", ANONYMOUS_ERROR_CODES.FAILED_TO_DELETE_ANONYMOUS_USER);
+				}
+				deleteSessionCookie(ctx);
+				return ctx.json({ success: true });
+			})
+		},
+		hooks: {
+			before: [{
+				matcher(ctx) {
+					return ctx.path === "/sign-in/social";
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const session = await getSessionFromCtx(ctx, { disableRefresh: true });
+					if (!session?.user.isAnonymous) return;
+					await addOAuthServerContext({ anonymousUserId: session.user.id });
+				})
+			}],
+			after: [{
+				matcher(ctx) {
+					return ctx.path?.startsWith("/sign-in") || ctx.path?.startsWith("/sign-up") || ctx.path?.startsWith("/callback") || ctx.path?.startsWith("/magic-link/verify") || ctx.path?.startsWith("/email-otp/verify-email") || ctx.path?.startsWith("/one-tap/callback") || ctx.path?.startsWith("/passkey/verify-authentication") || ctx.path?.startsWith("/phone-number/verify") || ctx.path?.startsWith("/verify-email") || false;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const setCookie = ctx.context.responseHeaders?.get("set-cookie");
+					/**
+					* We can consider the user is about to sign in or sign up
+					* if the response contains a session token.
+					*/
+					const sessionTokenName = ctx.context.authCookies.sessionToken.name;
+					if (!parseSetCookieHeader(setCookie || "").get(sessionTokenName)?.value.split(".")[0]) return;
+					/**
+					* Make sure the user had an anonymous session. Falls back to the
+					* server-only OAuth state when the callback arrives without the
+					* anonymous session cookie (for example Expo).
+					*/
+					const session = await resolveAnonymousSession(ctx);
+					if (!session) return;
+					if (ctx.path === "/sign-in/anonymous" && !ctx.context.newSession) throw APIError.from("BAD_REQUEST", ANONYMOUS_ERROR_CODES.ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY);
+					const newSession = ctx.context.newSession;
+					if (!newSession) return;
+					if (options?.onLinkAccount) await options.onLinkAccount({
+						anonymousUser: {
+							session: session.session,
+							user: session.user
+						},
+						newUser: newSession,
+						ctx
+					});
+					const newSessionUser = newSession.user;
+					const isSameUser = newSessionUser?.id === session.user.id;
+					const newSessionIsAnonymous = Boolean(newSessionUser?.isAnonymous);
+					if (options?.disableDeleteAnonymousUser || isSameUser || newSessionIsAnonymous) return;
+					try {
+						await ctx.context.internalAdapter.deleteUser(session.user.id);
+					} catch (error) {
+						ctx.context.logger.error("Failed to clean up anonymous user during post-link cleanup", {
+							anonymousUserId: session.user.id,
+							error
+						});
+					}
+				})
+			}]
+		},
+		options,
+		schema: mergeSchema(schema, options?.schema),
+		$ERROR_CODES: ANONYMOUS_ERROR_CODES
+	};
+};
+//#endregion
+export { anonymous };

package/dist/plugins/anonymous/schema.d.mts

@@ -0,0 +1,15 @@
+//#region src/plugins/anonymous/schema.d.ts
+declare const schema: {
+  user: {
+    fields: {
+      isAnonymous: {
+        type: "boolean";
+        required: false;
+        input: false;
+        defaultValue: false;
+      };
+    };
+  };
+};
+//#endregion
+export { schema };

package/dist/plugins/anonymous/schema.mjs

@@ -0,0 +1,9 @@
+//#region src/plugins/anonymous/schema.ts
+const schema = { user: { fields: { isAnonymous: {
+	type: "boolean",
+	required: false,
+	input: false,
+	defaultValue: false
+} } } };
+//#endregion
+export { schema };