@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/two-factor/totp/index.mjs

@@ -0,0 +1,230 @@
+import { symmetricDecrypt } from "../../../crypto/index.mjs";
+import { setSessionCookie } from "../../../cookies/index.mjs";
+import { sessionMiddleware } from "../../../api/routes/session.mjs";
+import { shouldRequirePassword } from "../../../utils/password.mjs";
+import { PACKAGE_VERSION } from "../../../version.mjs";
+import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+import { createOTP } from "@better-auth/utils/otp";
+//#region src/plugins/two-factor/totp/index.ts
+const generateTOTPBodySchema = z.object({ secret: z.string().meta({ description: "The secret to generate the TOTP code" }) });
+const verifyTOTPBodySchema = z.object({
+	code: z.string().meta({ description: "The otp code to verify. Eg: \"012345\"" }),
+	/**
+	* if true, the device will be trusted
+	* for 30 days. It'll be refreshed on
+	* every sign in request within this time.
+	*/
+	trustDevice: z.boolean().meta({ description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true" }).optional()
+});
+const totp2fa = (options) => {
+	const opts = {
+		...options,
+		digits: options?.digits || 6,
+		period: options?.period || 30
+	};
+	const passwordSchema = z.string().meta({ description: "User password" });
+	const getTOTPURIBodySchema = options?.allowPasswordless ? z.object({ password: passwordSchema.optional() }) : z.object({ password: passwordSchema });
+	const twoFactorTable = "twoFactor";
+	return {
+		id: "totp",
+		version: PACKAGE_VERSION,
+		endpoints: {
+			/**
+			* ### Endpoint
+			*
+			* POST `/totp/generate`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.generateTOTP`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#totp)
+			*/
+			generateTOTP: createAuthEndpoint.serverOnly({
+				method: "POST",
+				body: generateTOTPBodySchema,
+				metadata: { openapi: {
+					summary: "Generate TOTP code",
+					description: "Use this endpoint to generate a TOTP code",
+					responses: { 200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { code: { type: "string" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (options?.disable) {
+					ctx.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp");
+					throw APIError.from("BAD_REQUEST", {
+						message: "totp isn't configured",
+						code: "TOTP_NOT_CONFIGURED"
+					});
+				}
+				return { code: await createOTP(ctx.body.secret, {
+					period: opts.period,
+					digits: opts.digits
+				}).totp() };
+			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/two-factor/get-totp-uri`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.getTOTPURI`
+			*
+			* **client:**
+			* `authClient.twoFactor.getTotpUri`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#getting-totp-uri)
+			*/
+			getTOTPURI: createAuthEndpoint("/two-factor/get-totp-uri", {
+				method: "POST",
+				use: [sessionMiddleware],
+				body: getTOTPURIBodySchema,
+				metadata: { openapi: {
+					summary: "Get TOTP URI",
+					description: "Use this endpoint to get the TOTP URI",
+					responses: { 200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { totpURI: { type: "string" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (options?.disable) {
+					ctx.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp");
+					throw APIError.from("BAD_REQUEST", {
+						message: "totp isn't configured",
+						code: "TOTP_NOT_CONFIGURED"
+					});
+				}
+				const user = ctx.context.session.user;
+				const twoFactor = await ctx.context.adapter.findOne({
+					model: twoFactorTable,
+					where: [{
+						field: "userId",
+						value: user.id
+					}]
+				});
+				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				const secret = await symmetricDecrypt({
+					key: ctx.context.secretConfig,
+					data: twoFactor.secret
+				});
+				if (await shouldRequirePassword(ctx, user.id, options?.allowPasswordless)) {
+					if (!ctx.body.password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
+					await ctx.context.password.checkPassword(user.id, ctx);
+				}
+				return { totpURI: createOTP(secret, {
+					digits: opts.digits,
+					period: opts.period
+				}).url(options?.issuer || ctx.context.appName, user.email) };
+			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/two-factor/verify-totp`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.verifyTOTP`
+			*
+			* **client:**
+			* `authClient.twoFactor.verifyTotp`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#verifying-totp)
+			*/
+			verifyTOTP: createAuthEndpoint("/two-factor/verify-totp", {
+				method: "POST",
+				body: verifyTOTPBodySchema,
+				metadata: { openapi: {
+					summary: "Verify two factor TOTP",
+					description: "Verify two factor TOTP",
+					responses: { 200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (options?.disable) {
+					ctx.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp");
+					throw APIError.from("BAD_REQUEST", {
+						message: "totp isn't configured",
+						code: "TOTP_NOT_CONFIGURED"
+					});
+				}
+				const { session, valid, invalid, beginAttempt } = await verifyTwoFactor(ctx);
+				const user = session.user;
+				const isSignIn = !session.session;
+				const twoFactor = await ctx.context.adapter.findOne({
+					model: twoFactorTable,
+					where: [{
+						field: "userId",
+						value: user.id
+					}]
+				});
+				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				if (isSignIn && twoFactor.verified === false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				if (isSignIn) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
+				const attempt = isSignIn ? await beginAttempt(5) : null;
+				let status;
+				try {
+					status = await createOTP(await symmetricDecrypt({
+						key: ctx.context.secretConfig,
+						data: twoFactor.secret
+					}), {
+						period: opts.period,
+						digits: opts.digits
+					}).verify(ctx.body.code);
+				} catch (error) {
+					await attempt?.restore();
+					throw error;
+				}
+				if (!status) {
+					await attempt?.recordFailure();
+					if (isSignIn) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
+					return invalid("INVALID_CODE");
+				}
+				if (isSignIn) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
+				if (twoFactor.verified !== true) {
+					if (!user.twoFactorEnabled) {
+						const activeSession = session.session;
+						const updatedUser = await ctx.context.internalAdapter.updateUser(user.id, { twoFactorEnabled: true });
+						await setSessionCookie(ctx, {
+							session: await ctx.context.internalAdapter.createSession(user.id, false, activeSession),
+							user: updatedUser
+						});
+						await ctx.context.internalAdapter.deleteSession(activeSession.token);
+					}
+					await ctx.context.adapter.update({
+						model: twoFactorTable,
+						update: { verified: true },
+						where: [{
+							field: "id",
+							value: twoFactor.id
+						}]
+					});
+				}
+				return valid(ctx);
+			})
+		}
+	};
+};
+//#endregion
+export { totp2fa };

package/dist/plugins/two-factor/types.d.mts

@@ -0,0 +1,111 @@
+import { User } from "../../types/models.mjs";
+import { InferOptionSchema } from "../../types/plugins.mjs";
+import { BackupCodeOptions } from "./backup-codes/index.mjs";
+import { OTPOptions } from "./otp/index.mjs";
+import { schema } from "./schema.mjs";
+import { TOTPOptions } from "./totp/index.mjs";
+import { BetterAuthPlugin, LiteralString } from "@better-auth/core";
+
+//#region src/plugins/two-factor/types.d.ts
+interface TwoFactorOptions {
+  /**
+   * Application Name
+   */
+  issuer?: string | undefined;
+  /**
+   * The name of the table that stores the two factor
+   * authentication data.
+   *
+   * @default "twoFactor"
+   */
+  twoFactorTable?: string | undefined;
+  /**
+   * TOTP OPtions
+   */
+  totpOptions?: Omit<TOTPOptions, "issuer"> | undefined;
+  /**
+   * OTP Options
+   */
+  otpOptions?: OTPOptions | undefined;
+  /**
+   * Backup code options
+   */
+  backupCodeOptions?: BackupCodeOptions | undefined;
+  /**
+   * Skip verification on enabling two factor authentication.
+   * @default false
+   */
+  skipVerificationOnEnable?: boolean | undefined;
+  /**
+   * Allow enabling and managing 2FA without a password when the user does not
+   * have a credential account (e.g. passkey-only users).
+   * When enabled, password is still required if a credential account exists.
+   * @default false
+   */
+  allowPasswordless?: boolean | undefined;
+  /**
+   * Custom schema for the two factor plugin
+   */
+  schema?: InferOptionSchema<typeof schema> | undefined;
+  /**
+   * Maximum age (in seconds) for the two-factor verification cookie.
+   * This controls how long users have to complete the 2FA flow
+   * after signing in.
+   *
+   * @default 600 (10 minutes)
+   */
+  twoFactorCookieMaxAge?: number | undefined;
+  /**
+   * Maximum age (in seconds) for the trusted device cookie.
+   * When a user opts to trust a device, this controls how long
+   * the device stays trusted before requiring 2FA again.
+   *
+   * @default 2592000 (30 days)
+   */
+  trustDeviceMaxAge?: number | undefined;
+  /**
+   * Account-level lockout for failed second-factor verifications during
+   * sign-in. Caps consecutive failed attempts per account, across challenges
+   * and factors, and resets on a successful verification.
+   */
+  accountLockout?: {
+    /**
+     * Whether account-level lockout is enforced.
+     * @default true
+     */
+    enabled?: boolean | undefined;
+    /**
+     * Consecutive failed verifications, across challenges and factors,
+     * before the account is locked.
+     * @default 10
+     */
+    maxFailedAttempts?: number | undefined;
+    /**
+     * How long the account stays locked, in seconds.
+     * @default 900 (15 minutes)
+     */
+    durationSeconds?: number | undefined;
+  } | undefined;
+}
+interface UserWithTwoFactor extends User {
+  /**
+   * If the user has enabled two factor authentication.
+   */
+  twoFactorEnabled: boolean;
+}
+interface TwoFactorProvider {
+  id: LiteralString;
+  version?: string | undefined;
+  endpoints?: BetterAuthPlugin["endpoints"] | undefined;
+}
+interface TwoFactorTable {
+  id: string;
+  userId: string;
+  secret: string;
+  backupCodes: string;
+  verified: boolean;
+  failedVerificationCount?: number;
+  lockedUntil?: Date | null;
+}
+//#endregion
+export { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor };

package/dist/plugins/two-factor/utils.mjs

@@ -0,0 +1,9 @@
+import { base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
+//#region src/plugins/two-factor/utils.ts
+const defaultKeyHasher = async (token) => {
+	const hash = await createHash("SHA-256").digest(new TextEncoder().encode(token));
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+};
+//#endregion
+export { defaultKeyHasher };

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -0,0 +1,205 @@
+import { parseUserOutput } from "../../db/schema.mjs";
+import { generateRandomString } from "../../crypto/random.mjs";
+import { expireCookie, setSessionCookie } from "../../cookies/index.mjs";
+import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
+import { TRUST_DEVICE_COOKIE_NAME, TWO_FACTOR_COOKIE_NAME } from "./constant.mjs";
+import { APIError } from "@better-auth/core/error";
+import { createHMAC } from "@better-auth/utils/hmac";
+//#region src/plugins/two-factor/verify-two-factor.ts
+async function verifyTwoFactor(ctx) {
+	const invalid = (errorKey) => {
+		throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES[errorKey]);
+	};
+	const session = await getSessionFromCtx(ctx);
+	if (!session) {
+		const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME);
+		const signedTwoFactorCookie = await ctx.getSignedCookie(twoFactorCookie.name, ctx.context.secret);
+		if (!signedTwoFactorCookie) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE);
+		const verificationToken = await ctx.context.internalAdapter.findVerificationValue(signedTwoFactorCookie);
+		if (!verificationToken) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE);
+		const user = await ctx.context.internalAdapter.findUserById(verificationToken.value);
+		if (!user) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE);
+		const dontRememberMe = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
+		return {
+			valid: async (ctx) => {
+				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(signedTwoFactorCookie);
+				if (!consumed || consumed.value !== user.id) {
+					expireCookie(ctx, twoFactorCookie);
+					throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE);
+				}
+				const session = await ctx.context.internalAdapter.createSession(consumed.value, !!dontRememberMe);
+				if (!session) throw APIError.from("INTERNAL_SERVER_ERROR", {
+					message: "failed to create session",
+					code: "FAILED_TO_CREATE_SESSION"
+				});
+				await setSessionCookie(ctx, {
+					session,
+					user
+				});
+				expireCookie(ctx, twoFactorCookie);
+				if (ctx.body.trustDevice) {
+					const maxAge = ctx.context.getPlugin("two-factor").options?.trustDeviceMaxAge ?? 2592e3;
+					const trustDeviceCookie = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge });
+					/**
+					* Create a random identifier for the trust device record.
+					* Store it in the verification table with an expiration
+					* so the server can validate and revoke it.
+					*/
+					const trustIdentifier = `trust-device-${generateRandomString(32)}`;
+					const token = await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${user.id}!${trustIdentifier}`);
+					await ctx.context.internalAdapter.createVerificationValue({
+						value: user.id,
+						identifier: trustIdentifier,
+						expiresAt: new Date(Date.now() + maxAge * 1e3)
+					});
+					await ctx.setSignedCookie(trustDeviceCookie.name, `${token}!${trustIdentifier}`, ctx.context.secret, trustDeviceCookie.attributes);
+					expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
+				}
+				return ctx.json({
+					token: session.token,
+					user: parseUserOutput(ctx.context.options, user)
+				});
+			},
+			invalid,
+			session: {
+				session: null,
+				user
+			},
+			key: signedTwoFactorCookie,
+			beginAttempt: async (allowedAttempts) => {
+				const identifier = `2fa-attempts-${signedTwoFactorCookie}`;
+				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(identifier).catch(() => null);
+				if (!consumed) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE);
+				const parsed = Number(consumed.value);
+				const attempts = Number.isInteger(parsed) && parsed >= 0 ? parsed : allowedAttempts;
+				if (attempts >= allowedAttempts) {
+					try {
+						await ctx.context.internalAdapter.consumeVerificationValue(signedTwoFactorCookie);
+					} catch {
+						expireCookie(ctx, twoFactorCookie);
+						throw APIError.from("INTERNAL_SERVER_ERROR", {
+							message: "Failed to invalidate two-factor challenge",
+							code: "FAILED_TO_INVALIDATE_TWO_FACTOR_CHALLENGE"
+						});
+					}
+					expireCookie(ctx, twoFactorCookie);
+					throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
+				}
+				const rearm = (count) => ctx.context.internalAdapter.createVerificationValue({
+					value: `${count}`,
+					identifier,
+					expiresAt: verificationToken.expiresAt
+				}).catch(() => {});
+				return {
+					recordFailure: () => rearm(attempts + 1),
+					restore: () => rearm(attempts)
+				};
+			}
+		};
+	}
+	return {
+		valid: async (ctx) => {
+			return ctx.json({
+				token: session.session.token,
+				user: parseUserOutput(ctx.context.options, session.user)
+			});
+		},
+		invalid,
+		session,
+		key: `${session.user.id}!${session.session.id}`,
+		beginAttempt: async (_allowedAttempts) => ({
+			recordFailure: async () => {},
+			restore: async () => {}
+		})
+	};
+}
+function resolveAccountLockoutConfig(ctx) {
+	const lockout = (ctx.context.getPlugin("two-factor")?.options)?.accountLockout;
+	return {
+		enabled: lockout?.enabled ?? true,
+		maxFailedAttempts: lockout?.maxFailedAttempts ?? 10,
+		durationMs: (lockout?.durationSeconds ?? 900) * 1e3
+	};
+}
+/**
+* Reject the verification when the account is locked, and lazily clear an
+* expired lock. The lock caps consecutive failed verifications per account,
+* across challenges and factors (NIST SP 800-63B §5.2.2).
+*/
+async function assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled || !twoFactor.lockedUntil) return;
+	if (new Date(twoFactor.lockedUntil).getTime() > Date.now()) throw APIError.from("TOO_MANY_REQUESTS", TWO_FACTOR_ERROR_CODES.ACCOUNT_TEMPORARILY_LOCKED);
+	await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}, {
+			field: "lockedUntil",
+			operator: "lte",
+			value: /* @__PURE__ */ new Date()
+		}],
+		increment: {},
+		set: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
+/**
+* Count one failed verification toward the account-level budget, and lock the
+* account once the budget is spent. The increment is atomic, so concurrent
+* failures cannot lose updates. It is unguarded so it still applies to a row
+* whose counter is null or absent (a row created before the migration, or a
+* document-store record predating the column), where a guarded comparison
+* would never match.
+*/
+async function recordTwoFactorFailure(ctx, twoFactorTable, twoFactor) {
+	const { enabled, maxFailedAttempts, durationMs } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	if (((await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		increment: { failedVerificationCount: 1 }
+	}))?.failedVerificationCount ?? 0) >= maxFailedAttempts) await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}, {
+			field: "failedVerificationCount",
+			operator: "gte",
+			value: maxFailedAttempts
+		}],
+		increment: {},
+		set: { lockedUntil: new Date(Date.now() + durationMs) }
+	});
+}
+/**
+* Clear the account-level failure budget after a successful verification, so the
+* count tracks only consecutive failures. The write is unconditional: a snapshot
+* read at the start of the request can miss a concurrent failure, so skipping it
+* could leave the counter non-zero after a success.
+*/
+async function resetTwoFactorFailures(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	await ctx.context.adapter.update({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		update: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
+//#endregion
+export { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor };

package/dist/plugins/username/client.d.mts

@@ -0,0 +1,38 @@
+import { USERNAME_ERROR_CODES } from "./error-codes.mjs";
+import { UsernamePlugin, UsernamePluginWithoutDisplayUsername } from "./index.mjs";
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/username/client.d.ts
+type UsernameClientOptions = {
+  /**
+   * Whether the server has the `displayUsername` field enabled.
+   *
+   * This must mirror the `displayUsername` option passed to the server
+   * `username` plugin so the client infers the correct user/session types.
+   *
+   * @default true
+   */
+  displayUsername?: boolean | undefined;
+};
+declare const usernameClient: <O extends UsernameClientOptions = UsernameClientOptions>(options?: O) => {
+  id: "username";
+  version: string;
+  $InferServerPlugin: O["displayUsername"] extends false ? UsernamePluginWithoutDisplayUsername : UsernamePlugin;
+  atomListeners: {
+    matcher: (path: string) => path is "/sign-in/username";
+    signal: "$sessionSignal";
+  }[];
+  $ERROR_CODES: {
+    EMAIL_NOT_VERIFIED: _$_better_auth_core_utils_error_codes0.RawError<"EMAIL_NOT_VERIFIED">;
+    UNEXPECTED_ERROR: _$_better_auth_core_utils_error_codes0.RawError<"UNEXPECTED_ERROR">;
+    INVALID_USERNAME_OR_PASSWORD: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_USERNAME_OR_PASSWORD">;
+    USERNAME_IS_ALREADY_TAKEN: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_IS_ALREADY_TAKEN">;
+    USERNAME_TOO_SHORT: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_TOO_SHORT">;
+    USERNAME_TOO_LONG: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_TOO_LONG">;
+    INVALID_USERNAME: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_USERNAME">;
+    INVALID_DISPLAY_USERNAME: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_DISPLAY_USERNAME">;
+    USERNAME_IS_IMMUTABLE: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_IS_IMMUTABLE">;
+  };
+};
+//#endregion
+export { UsernameClientOptions, usernameClient };

package/dist/plugins/username/client.mjs

@@ -0,0 +1,17 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { USERNAME_ERROR_CODES } from "./error-codes.mjs";
+//#region src/plugins/username/client.ts
+const usernameClient = (options) => {
+	return {
+		id: "username",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {},
+		atomListeners: [{
+			matcher: (path) => path === "/sign-in/username",
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: USERNAME_ERROR_CODES
+	};
+};
+//#endregion
+export { usernameClient };

package/dist/plugins/username/error-codes.d.mts

@@ -0,0 +1,16 @@
+import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/username/error-codes.d.ts
+declare const USERNAME_ERROR_CODES: {
+  EMAIL_NOT_VERIFIED: _$_better_auth_core_utils_error_codes0.RawError<"EMAIL_NOT_VERIFIED">;
+  UNEXPECTED_ERROR: _$_better_auth_core_utils_error_codes0.RawError<"UNEXPECTED_ERROR">;
+  INVALID_USERNAME_OR_PASSWORD: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_USERNAME_OR_PASSWORD">;
+  USERNAME_IS_ALREADY_TAKEN: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_IS_ALREADY_TAKEN">;
+  USERNAME_TOO_SHORT: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_TOO_SHORT">;
+  USERNAME_TOO_LONG: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_TOO_LONG">;
+  INVALID_USERNAME: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_USERNAME">;
+  INVALID_DISPLAY_USERNAME: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_DISPLAY_USERNAME">;
+  USERNAME_IS_IMMUTABLE: _$_better_auth_core_utils_error_codes0.RawError<"USERNAME_IS_IMMUTABLE">;
+};
+//#endregion
+export { USERNAME_ERROR_CODES };

package/dist/plugins/username/error-codes.mjs

@@ -0,0 +1,15 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+//#region src/plugins/username/error-codes.ts
+const USERNAME_ERROR_CODES = defineErrorCodes({
+	INVALID_USERNAME_OR_PASSWORD: "Invalid username or password",
+	EMAIL_NOT_VERIFIED: "Email not verified",
+	UNEXPECTED_ERROR: "Unexpected error",
+	USERNAME_IS_ALREADY_TAKEN: "Username is already taken. Please try another.",
+	USERNAME_TOO_SHORT: "Username is too short",
+	USERNAME_TOO_LONG: "Username is too long",
+	INVALID_USERNAME: "Username is invalid",
+	INVALID_DISPLAY_USERNAME: "Display username is invalid",
+	USERNAME_IS_IMMUTABLE: "Username cannot be updated"
+});
+//#endregion
+export { USERNAME_ERROR_CODES };