@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/generic-oauth/providers/slack.mjs

@@ -0,0 +1,63 @@
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/generic-oauth/providers/slack.ts
+/**
+* Slack OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, slack } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         slack({
+*           clientId: process.env.SLACK_CLIENT_ID,
+*           clientSecret: process.env.SLACK_CLIENT_SECRET,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function slack(options) {
+	const defaultScopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch("https://slack.com/api/openid.connect.userInfo", { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+		if (error || !profile) return null;
+		return {
+			sub: profile.sub,
+			name: profile.name,
+			email: profile.email,
+			image: profile.picture ?? profile["https://slack.com/user_image_512"],
+			emailVerified: profile.email_verified ?? false
+		};
+	};
+	return {
+		providerId: "slack",
+		accountSubject: ({ profile }) => profile.sub ?? "",
+		authorizationUrl: "https://slack.com/openid/connect/authorize",
+		tokenUrl: "https://slack.com/api/openid.connect.token",
+		userInfoUrl: "https://slack.com/api/openid.connect.userInfo",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		tokenEndpointAuth: options.tokenEndpointAuth,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+//#endregion
+export { slack };

package/dist/plugins/generic-oauth/providers/yandex.d.mts

@@ -0,0 +1,29 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/yandex.d.ts
+interface YandexOptions extends BaseOAuthProviderOptions {}
+/**
+ * Yandex OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, yandex } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         yandex({
+ *           clientId: process.env.YANDEX_CLIENT_ID,
+ *           clientSecret: process.env.YANDEX_CLIENT_SECRET,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function yandex(options: YandexOptions): GenericOAuthConfig;
+//#endregion
+export { YandexOptions, yandex };

package/dist/plugins/generic-oauth/providers/yandex.mjs

@@ -0,0 +1,67 @@
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/generic-oauth/providers/yandex.ts
+/**
+* Yandex OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, yandex } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         yandex({
+*           clientId: process.env.YANDEX_CLIENT_ID,
+*           clientSecret: process.env.YANDEX_CLIENT_SECRET,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function yandex(options) {
+	const defaultScopes = [
+		"login:info",
+		"login:email",
+		"login:avatar"
+	];
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch("https://login.yandex.ru/info?format=json", {
+			method: "GET",
+			headers: { Authorization: `OAuth ${tokens.accessToken}` }
+		});
+		if (error || !profile) return null;
+		const email = profile.default_email ?? profile.emails?.[0];
+		if (!email) return null;
+		return {
+			id: profile.id,
+			name: profile.display_name ?? profile.real_name ?? profile.first_name ?? profile.login,
+			email,
+			emailVerified: false,
+			image: !profile.is_avatar_empty && profile.default_avatar_id ? `https://avatars.yandex.net/get-yapic/${profile.default_avatar_id}/islands-200` : void 0
+		};
+	};
+	return {
+		providerId: "yandex",
+		accountSubject: ({ profile }) => profile.id ?? "",
+		authorizationUrl: "https://oauth.yandex.com/authorize",
+		tokenUrl: "https://oauth.yandex.com/token",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		tokenEndpointAuth: options.tokenEndpointAuth,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+//#endregion
+export { yandex };

package/dist/plugins/generic-oauth/types.d.mts

@@ -0,0 +1,268 @@
+import { Awaitable } from "@better-auth/core";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, OAuthMappedUser, OAuthRefreshContext, TokenEndpointAuth } from "@better-auth/core/oauth2";
+
+//#region src/plugins/generic-oauth/types.d.ts
+/** Raw profile returned by a Generic OAuth provider. */
+type GenericOAuthUserInfo = Omit<OAuth2UserInfo, "id"> & {
+  id?: string | number | null | undefined;
+  sub?: string | number | null | undefined;
+  [key: string]: unknown;
+};
+interface GenericOAuthOptions<ID extends string = string> {
+  /**
+   * Array of OAuth provider configurations.
+   */
+  config: GenericOAuthConfig<ID>[];
+}
+/**
+ * Configuration interface for generic OAuth providers.
+ */
+interface GenericOAuthConfig<ID extends string = string> {
+  /** Unique identifier for the OAuth provider */
+  providerId: ID;
+  /**
+   * Human-readable display name for this provider.
+   * Defaults to `providerId` if not set.
+   */
+  name?: string | undefined;
+  /**
+   * Stable subject assigned by the provider.
+   *
+   * OpenID Connect discovery providers use the verified profile's `sub` field
+   * by default. Plain OAuth providers use `id`. Configure this resolver when
+   * the provider uses a different immutable identifier. Better Auth never
+   * switches between fields at runtime because that could change an account's
+   * identity. The resolver never receives the mapped local user, so profile
+   * mapping cannot redefine provider identity.
+   */
+  accountSubject?: ((context: OAuthAccountKeyContext<GenericOAuthUserInfo>) => Awaitable<string | number>) | undefined;
+  /**
+   * URL to fetch OAuth 2.0 configuration.
+   * If provided, the authorization and token endpoints will be fetched from this URL.
+   */
+  discoveryUrl?: string | undefined;
+  /**
+   * Require discovery to provide the issuer and JWKS metadata needed to verify
+   * ID tokens before this provider is registered.
+   *
+   * Enable this when provider identity is derived from ID-token claims. This
+   * prevents an unavailable or incomplete discovery document from silently
+   * downgrading the provider to unverified token decoding.
+   *
+   * @default false
+   */
+  requireIdTokenVerification?: boolean | undefined;
+  /**
+   * URL for the authorization endpoint.
+   * Optional if using discoveryUrl.
+   */
+  authorizationUrl?: string | undefined;
+  /**
+   * URL for the token endpoint.
+   * Optional if using discoveryUrl.
+   */
+  tokenUrl?: string | undefined;
+  /**
+   * URL for the user info endpoint.
+   * Optional if using discoveryUrl.
+   */
+  userInfoUrl?: string | undefined;
+  /**
+   * URL for the OIDC RP-Initiated Logout endpoint.
+   * Optional if using discoveryUrl and the discovery document includes
+   * `end_session_endpoint`.
+   */
+  endSessionEndpoint?: string | undefined;
+  /**
+   * URL the provider should redirect back to after logout.
+   * This must also be registered with the provider as a post-logout redirect URI.
+   */
+  postLogoutRedirectURI?: string | undefined;
+  /**
+   * Disable automatic provider logout on `authClient.signOut()`.
+   * When set, sign out only clears the Better Auth session.
+   */
+  disableProviderLogout?: boolean | undefined;
+  /** OAuth client ID */
+  clientId: string;
+  /** OAuth client secret */
+  clientSecret?: string | undefined;
+  /**
+   * Token endpoint client authentication method.
+   *
+   * Use `private_key_jwt` for IdPs that authenticate clients with RFC 7523
+   * client assertions instead of a client secret. Secret-based methods require
+   * clientSecret.
+   */
+  tokenEndpointAuth?: TokenEndpointAuth | undefined;
+  /**
+   * Array of OAuth scopes to request.
+   * @default []
+   */
+  scopes?: string[] | undefined;
+  /**
+   * Custom redirect URI.
+   * If not provided, a default URI will be constructed.
+   */
+  redirectURI?: string | undefined;
+  /**
+   * OAuth response type.
+   * @default "code"
+   */
+  responseType?: string | undefined;
+  /**
+   * The response mode to use for the authorization code request.
+    */
+  responseMode?: ("query" | "form_post") | undefined;
+  /**
+   * Prompt parameter for the authorization request.
+   * Controls the authentication experience for the user.
+   */
+  prompt?: ("none" | "login" | "create" | "consent" | "select_account" | "select_account consent" | "login consent") | undefined;
+  /**
+   * Whether to use PKCE (Proof Key for Code Exchange).
+   * Required by OAuth 2.1 for all authorization code flows.
+   * Disable only for providers that explicitly reject PKCE.
+   * @default true
+   */
+  pkce?: boolean | undefined;
+  /**
+   * Access type for the authorization request.
+   * Use "offline" to request a refresh token.
+   */
+  accessType?: string | undefined;
+  /**
+   * Fallback access-token lifetime, in seconds, used only when the provider's
+   * token response omits `expires_in`. Set this so `getAccessToken` can track
+   * expiry and refresh the token; leave unset if the provider returns
+   * `expires_in`.
+   */
+  accessTokenExpiresIn?: number | undefined;
+  /**
+   * Custom function to exchange authorization code for tokens.
+   * If provided, this function will be used instead of the default token exchange logic.
+   * This is useful for providers with non-standard token endpoints.
+   * @param data - Authorization code exchange parameters
+   * @returns A promise that resolves to OAuth2Tokens
+   */
+  getToken?: ((data: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens>) | undefined;
+  /**
+   * Custom function to fetch user info.
+   * If provided, this function will be used instead of the default user info fetching logic.
+   * @param tokens - The OAuth tokens received after successful authentication
+   * @returns A promise that resolves to a raw provider profile or null
+   */
+  getUserInfo?: ((tokens: OAuth2Tokens) => Promise<GenericOAuthUserInfo | null>) | undefined;
+  /**
+   * Custom function to map the provider's user profile to your app's user fields.
+   * The profile contains standard OAuth2 fields plus any provider-specific extras.
+   */
+  mapProfileToUser?: ((profile: GenericOAuthUserInfo) => OAuthMappedUser | Promise<OAuthMappedUser>) | undefined;
+  /**
+   * Additional search-params to add to the authorizationUrl.
+   * Warning: Search-params added here overwrite any default params.
+   */
+  authorizationUrlParams?: Record<string, string> | undefined;
+  /**
+   * Additional search-params to add to the tokenUrl.
+   * Parameters already set by Better Auth are preserved. Configure token
+   * endpoint client authentication with clientId, clientSecret, and
+   * tokenEndpointAuth.
+   */
+  tokenUrlParams?: Record<string, string> | undefined;
+  /**
+   * Additional body params merged into the token endpoint request when
+   * refreshing an access token. Useful for multi-tenant OIDC providers that
+   * need to change `scope`, `audience`, `resource`, or a tenant identifier on
+   * the refresh call — e.g. Zitadel's `urn:zitadel:iam:org:id:{orgId}` scope
+   * on workspace switch or Auth0 `audience` rotation — without forcing a new
+   * authorization redirect.
+   *
+   * The function form is invoked at refresh time and receives request
+   * metadata for the triggering request, so dynamic
+   * per-request values like an active organization id read from cookies or
+   * headers can be injected directly. Headers and cookies are
+   * attacker-controlled: callers MUST validate any value derived from them
+   * against the authenticated user's entitlements before forwarding it as a
+   * `scope`, `audience`, or tenant claim. Resolved values are merged into the
+   * form body; `grant_type` and `refresh_token` are protected from override,
+   * and `client_id` is set by the configured token-endpoint authentication
+   * after the merge so it cannot be overridden here.
+   */
+  refreshTokenParams?: Record<string, string> | ((ctx?: OAuthRefreshContext) => Awaitable<Record<string, string> | undefined>) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * Authentication method for token requests.
+   * "basic" requires clientSecret.
+   * @default "post"
+   */
+  authentication?: ("basic" | "post") | undefined;
+  /**
+   * Custom headers to include in the discovery request.
+   * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
+   */
+  discoveryHeaders?: Record<string, string> | undefined;
+  /**
+   * Custom headers to include in the authorization request.
+   * Useful for providers like Qonto that require specific headers (e.g., X-Qonto-Staging-Token for local development).
+   */
+  authorizationHeaders?: Record<string, string> | undefined;
+  /**
+   * Override user info with the provider info.
+   *
+   * This will update the user info with the provider info,
+   * when the user signs in with the provider.
+   * @default false
+   */
+  overrideUserInfo?: boolean | undefined;
+  /**
+   * Require this provider's email to be verified before a session is created.
+   *
+   * When the provider reports the email as unverified, the user and account are
+   * still created or linked, but no session is issued: the callback redirects
+   * with `?error=email_not_verified`. The gate checks the local user's
+   * verification state, so a user already verified through another method keeps
+   * access. Only enable it for providers that report a trustworthy
+   * `email_verified` signal.
+   *
+   * @default false
+   */
+  requireEmailVerification?: boolean | undefined;
+  /**
+   * Accept callbacks from providers that initiate the OAuth flow without
+   * sending a `state` parameter (e.g. Clever). When enabled, stateless
+   * callbacks restart the OAuth flow server-side with a fresh `state` and
+   * PKCE verifier. See the generic-oauth docs for details.
+   *
+   * @default false
+   */
+  allowIdpInitiated?: boolean | undefined;
+  /**
+   * Disable OIDC `nonce` binding for this provider's `id_token`.
+   *
+   * Providers configured with `discoveryUrl` that publish a JWKS bind the
+   * `id_token` to the authorization request by default: Better Auth sends a
+   * server-generated `nonce` and rejects a callback whose `id_token` does not
+   * echo it (OIDC Core 1.0 §3.1.3.7). Set this to `true` only for OIDC
+   * providers that do not return the `nonce` claim in the authorization-code
+   * flow; doing so removes `id_token` replay protection for this provider.
+   *
+   * @default false
+   */
+  disableIdTokenNonceBinding?: boolean | undefined;
+}
+//#endregion
+export { GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo };

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -0,0 +1,63 @@
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/haveibeenpwned/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "have-i-been-pwned": {
+      creator: typeof haveIBeenPwned;
+    };
+  }
+}
+/**
+ * Checks whether a password appears in the Have I Been Pwned password corpus.
+ * Only the first five characters of its SHA-1 hash are sent to the service.
+ *
+ * @returns Whether the password has been compromised.
+ * @throws {APIError} When the password could not be checked.
+ */
+declare function isPasswordCompromised(password: string): Promise<boolean>;
+interface HaveIBeenPwnedOptions {
+  /**
+   * Custom error message shown when a compromised password is detected.
+   */
+  customPasswordCompromisedMessage?: string | undefined;
+  /**
+   * Paths to check for password
+   *
+   * @default ["/sign-up/email", "/change-password", "/reset-password", "/email-otp/reset-password", "/phone-number/reset-password", "/admin/create-user", "/admin/set-user-password"]
+   */
+  paths?: string[];
+  /**
+   * Enable or disable password checks against the HIBP database.
+   *
+   * @default true
+   */
+  enabled?: boolean | undefined;
+}
+declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
+  id: "have-i-been-pwned";
+  version: string;
+  init(ctx: _$_better_auth_core0.AuthContext): {
+    context: {
+      password: {
+        hash(password: string): Promise<string>;
+        verify: (data: {
+          password: string;
+          hash: string;
+        }) => Promise<boolean>;
+        config: {
+          minPasswordLength: number;
+          maxPasswordLength: number;
+        };
+        checkPassword: (userId: string, ctx: _$_better_auth_core0.GenericEndpointContext<_$_better_auth_core0.BetterAuthOptions>) => Promise<boolean>;
+      };
+    };
+  };
+  options: HaveIBeenPwnedOptions | undefined;
+  $ERROR_CODES: {
+    PASSWORD_COMPROMISED: _$_better_auth_core_utils_error_codes0.RawError<"PASSWORD_COMPROMISED">;
+  };
+};
+//#endregion
+export { HaveIBeenPwnedOptions, haveIBeenPwned, isPasswordCompromised };

package/dist/plugins/haveibeenpwned/index.mjs

@@ -0,0 +1,81 @@
+import { isAPIError } from "../../utils/is-api-error.mjs";
+import { APIError } from "../../api/index.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+import { createHash } from "@better-auth/utils/hash";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/haveibeenpwned/index.ts
+const ERROR_CODES = defineErrorCodes({ PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password." });
+function getPasswordCompromiseCount(response, hashSuffix) {
+	const matchingEntryPrefix = `${hashSuffix.toUpperCase()}:`;
+	for (const line of response.split(/\r?\n/)) {
+		if (line.slice(0, matchingEntryPrefix.length).toUpperCase() !== matchingEntryPrefix) continue;
+		const compromiseCountText = line.slice(matchingEntryPrefix.length);
+		const compromiseCount = Number(compromiseCountText);
+		if (!(Number.isSafeInteger(compromiseCount) && compromiseCount >= 0 && String(compromiseCount) === compromiseCountText)) throw new Error("Invalid password compromise count");
+		return compromiseCount;
+	}
+	return 0;
+}
+/**
+* Checks whether a password appears in the Have I Been Pwned password corpus.
+* Only the first five characters of its SHA-1 hash are sent to the service.
+*
+* @returns Whether the password has been compromised.
+* @throws {APIError} When the password could not be checked.
+*/
+async function isPasswordCompromised(password) {
+	try {
+		const sha1Hash = (await createHash("SHA-1", "hex").digest(password)).toUpperCase();
+		const prefix = sha1Hash.substring(0, 5);
+		const suffix = sha1Hash.substring(5);
+		const { data, error } = await betterFetch(`https://api.pwnedpasswords.com/range/${prefix}`, { headers: {
+			"Add-Padding": "true",
+			"User-Agent": "BetterAuth Password Checker"
+		} });
+		if (error) throw new APIError("INTERNAL_SERVER_ERROR", { message: `Failed to check password. Status: ${error.status}` });
+		return getPasswordCompromiseCount(data, suffix) > 0;
+	} catch (error) {
+		if (isAPIError(error)) throw error;
+		throw new APIError("INTERNAL_SERVER_ERROR", { message: "Failed to check password. Please try again later." });
+	}
+}
+async function rejectCompromisedPassword(password, customMessage) {
+	if (await isPasswordCompromised(password)) throw APIError.from("BAD_REQUEST", {
+		message: customMessage || ERROR_CODES.PASSWORD_COMPROMISED.message,
+		code: ERROR_CODES.PASSWORD_COMPROMISED.code
+	});
+}
+const haveIBeenPwned = (options) => {
+	const paths = options?.paths || [
+		"/sign-up/email",
+		"/change-password",
+		"/reset-password",
+		"/email-otp/reset-password",
+		"/phone-number/reset-password",
+		"/admin/create-user",
+		"/admin/set-user-password"
+	];
+	return {
+		id: "have-i-been-pwned",
+		version: PACKAGE_VERSION,
+		init(ctx) {
+			const originalHash = ctx.password.hash;
+			return { context: { password: {
+				...ctx.password,
+				async hash(password) {
+					if (options?.enabled === false) return originalHash(password);
+					const c = getCurrentAuthEndpointContext();
+					if (!c.path || !paths.includes(c.path)) return originalHash(password);
+					await rejectCompromisedPassword(password, options?.customPasswordCompromisedMessage);
+					return originalHash(password);
+				}
+			} } };
+		},
+		options,
+		$ERROR_CODES: ERROR_CODES
+	};
+};
+//#endregion
+export { haveIBeenPwned, isPasswordCompromised };

package/dist/plugins/index.d.mts

@@ -0,0 +1,69 @@
+import { InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginIDs } from "../types/plugins.mjs";
+import { HIDE_METADATA } from "../utils/hide-metadata.mjs";
+import { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset } from "./access/types.mjs";
+import { AuthorizeResponse, createAccessControl, role } from "./access/access.mjs";
+import { OrganizationOptions } from "./organization/types.mjs";
+import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "./organization/schema.mjs";
+import { getOrgAdapter } from "./organization/adapter.mjs";
+import { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole } from "./admin/types.mjs";
+import { admin } from "./admin/admin.mjs";
+import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./anonymous/types.mjs";
+import { anonymous } from "./anonymous/index.mjs";
+import { BearerOptions, bearer } from "./bearer/index.mjs";
+import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./captcha/types.mjs";
+import { captcha } from "./captcha/index.mjs";
+import { CustomSessionPluginOptions, customSession } from "./custom-session/index.mjs";
+import { TimeString, ms, sec } from "../utils/time.mjs";
+import { DeviceCode } from "./device-authorization/schema.mjs";
+import { DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, redeemDeviceCode } from "./device-authorization/routes.mjs";
+import { DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, deviceAuthorization, deviceAuthorizationOptionsSchema } from "./device-authorization/index.mjs";
+import { EmailOTPOptions } from "./email-otp/types.mjs";
+import { emailOTP } from "./email-otp/index.mjs";
+import { GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo } from "./generic-oauth/types.mjs";
+import { Auth0Options, auth0 } from "./generic-oauth/providers/auth0.mjs";
+import { GumroadOptions, gumroad } from "./generic-oauth/providers/gumroad.mjs";
+import { HubSpotOptions, hubspot } from "./generic-oauth/providers/hubspot.mjs";
+import { KeycloakOptions, keycloak } from "./generic-oauth/providers/keycloak.mjs";
+import { LineOptions, line } from "./generic-oauth/providers/line.mjs";
+import { MicrosoftEntraIdOptions, microsoftEntraId } from "./generic-oauth/providers/microsoft-entra-id.mjs";
+import { OktaOptions, okta } from "./generic-oauth/providers/okta.mjs";
+import { PatreonOptions, patreon } from "./generic-oauth/providers/patreon.mjs";
+import { SlackOptions, slack } from "./generic-oauth/providers/slack.mjs";
+import { YandexOptions, yandex } from "./generic-oauth/providers/yandex.mjs";
+import { BaseOAuthProviderOptions, genericOAuth } from "./generic-oauth/index.mjs";
+import { HaveIBeenPwnedOptions, haveIBeenPwned, isPasswordCompromised } from "./haveibeenpwned/index.mjs";
+import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./jwt/types.mjs";
+import { getJwtToken, resolveSigningKey, signJWT } from "./jwt/sign.mjs";
+import { createJwk, generateExportedKeyPair, toExpJWT } from "./jwt/utils.mjs";
+import { verifyJWT } from "./jwt/verify.mjs";
+import { jwt } from "./jwt/index.mjs";
+import { LastLoginMethodOptions, lastLoginMethod } from "./last-login-method/index.mjs";
+import { MagicLinkOptions, magicLink } from "./magic-link/index.mjs";
+import { MULTI_SESSION_ERROR_CODES } from "./multi-session/error-codes.mjs";
+import { MultiSessionConfig, multiSession } from "./multi-session/index.mjs";
+import { OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_MESSAGE_TYPE, POPUP_MARKER_COOKIE } from "./oauth-popup/constants.mjs";
+import { OAUTH_POPUP_ERROR_CODES } from "./oauth-popup/error-codes.mjs";
+import { OAuthPopupData, OAuthPopupMessage } from "./oauth-popup/types.mjs";
+import { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_SCRIPT_CSP_HASH, oauthPopup } from "./oauth-popup/index.mjs";
+import { OAuthProxyOptions, oAuthProxy } from "./oauth-proxy/index.mjs";
+import { OneTapOptions, oneTap } from "./one-tap/index.mjs";
+import { OneTimeTokenOptions, oneTimeToken } from "./one-time-token/index.mjs";
+import { FieldSchema, OpenAPIModelSchema, OpenAPIParameter, OpenAPISchema, Path, generator } from "./open-api/generator.mjs";
+import { OpenAPIOptions, openAPI } from "./open-api/index.mjs";
+import { PhoneNumberOptions, UserWithPhoneNumber } from "./phone-number/types.mjs";
+import { phoneNumber } from "./phone-number/index.mjs";
+import { SIWEPluginOptions, siwe } from "./siwe/index.mjs";
+import { LoginResult, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions } from "./test-utils/types.mjs";
+import { testUtils } from "./test-utils/index.mjs";
+import { BackupCodeOptions, backupCode2fa, encodeBackupCodes, generateBackupCodes, getBackupCodes, verifyBackupCode } from "./two-factor/backup-codes/index.mjs";
+import { OTPOptions, otp2fa } from "./two-factor/otp/index.mjs";
+import { TOTPOptions, totp2fa } from "./two-factor/totp/index.mjs";
+import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "./two-factor/types.mjs";
+import { TWO_FACTOR_ERROR_CODES } from "./two-factor/error-code.mjs";
+import { twoFactorClient } from "./two-factor/client.mjs";
+import { twoFactor } from "./two-factor/index.mjs";
+import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
+import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
+import { hasPermission } from "./organization/has-permission.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };