@pinklemon8/better-auth-siws 0.1.0

package/dist/index.js

@@ -0,0 +1,189 @@
+import {
+  deserializeOutput,
+  serializeOutput
+} from "./chunk-AUDIM6MZ.js";
+import {
+  generateNonce,
+  verifySIWS
+} from "./chunk-Q7TSFSYW.js";
+
+// src/index.ts
+import { createAuthEndpoint, APIError } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { z } from "zod";
+var siws = (options) => ({
+  id: "siws",
+  endpoints: {
+    getSiwsNonce: createAuthEndpoint(
+      "/siws/nonce",
+      {
+        method: "POST",
+        body: z.object({
+          walletAddress: z.string().min(32).max(44)
+        })
+      },
+      async (ctx) => {
+        const { walletAddress } = ctx.body;
+        const nonce = generateNonce();
+        const expiryMs = options?.nonceExpiryMs ?? 5 * 60 * 1e3;
+        await ctx.context.internalAdapter.createVerificationValue({
+          identifier: `siws:${walletAddress}`,
+          value: nonce,
+          expiresAt: new Date(Date.now() + expiryMs)
+        });
+        const host = ctx.headers?.get("host") || "localhost:3000";
+        const protocol = host.includes("localhost") ? "http" : "https";
+        const domain = host;
+        const uri = `${protocol}://${host}`;
+        return ctx.json({
+          nonce,
+          domain,
+          uri,
+          statement: options?.statement ?? "Sign in with your Solana wallet. This will not trigger a blockchain transaction or cost any gas fee.",
+          chainId: options?.chainId ?? "mainnet",
+          issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    ),
+    verifySiwsSignature: createAuthEndpoint(
+      "/siws/verify",
+      {
+        method: "POST",
+        body: z.object({
+          output: z.object({
+            account: z.object({
+              address: z.string(),
+              publicKey: z.array(z.number())
+            }),
+            signature: z.array(z.number()),
+            signedMessage: z.array(z.number())
+          }),
+          input: z.object({
+            domain: z.string(),
+            address: z.string().optional(),
+            statement: z.string().optional(),
+            uri: z.string().optional(),
+            version: z.string().optional(),
+            chainId: z.string().optional(),
+            nonce: z.string().optional(),
+            issuedAt: z.string().optional(),
+            expirationTime: z.string().optional(),
+            notBefore: z.string().optional(),
+            requestId: z.string().optional(),
+            resources: z.array(z.string()).optional()
+          })
+        }),
+        requireRequest: true
+      },
+      async (ctx) => {
+        const { output, input } = ctx.body;
+        const walletAddress = output.account.address;
+        const verification = await ctx.context.internalAdapter.findVerificationValue(
+          `siws:${walletAddress}`
+        );
+        if (!verification || /* @__PURE__ */ new Date() > verification.expiresAt) {
+          throw new APIError("UNAUTHORIZED", {
+            message: "Invalid or expired nonce"
+          });
+        }
+        const solanaOutput = deserializeOutput(output);
+        const isValid = verifySIWS(input, solanaOutput);
+        if (!isValid) {
+          throw new APIError("UNAUTHORIZED", {
+            message: "Invalid signature"
+          });
+        }
+        await ctx.context.internalAdapter.deleteVerificationValue(
+          verification.id
+        );
+        const linkedAccount = await ctx.context.adapter.findOne({
+          model: "account",
+          where: [
+            { field: "providerId", operator: "eq", value: "solana" },
+            { field: "accountId", operator: "eq", value: walletAddress }
+          ]
+        });
+        if (!linkedAccount) {
+          if (options?.anonymous) {
+            const user2 = await ctx.context.internalAdapter.createUser({
+              name: walletAddress,
+              email: `${walletAddress}@solana.wallet`,
+              image: ""
+            });
+            await ctx.context.internalAdapter.createAccount({
+              userId: user2.id,
+              providerId: "solana",
+              accountId: walletAddress,
+              createdAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date()
+            });
+            const session2 = await ctx.context.internalAdapter.createSession(
+              user2.id,
+              ctx
+            );
+            if (!session2) {
+              throw new APIError("INTERNAL_SERVER_ERROR", {
+                message: "Failed to create session"
+              });
+            }
+            await setSessionCookie(ctx, { session: session2, user: user2 });
+            return ctx.json({
+              success: true,
+              user: {
+                id: user2.id,
+                name: user2.name,
+                email: user2.email
+              }
+            });
+          }
+          throw new APIError("UNAUTHORIZED", {
+            message: "No account linked to this wallet. Please sign in with email first and link your wallet.",
+            code: "WALLET_NOT_LINKED"
+          });
+        }
+        const user = await ctx.context.adapter.findOne({
+          model: "user",
+          where: [
+            { field: "id", operator: "eq", value: linkedAccount.userId }
+          ]
+        });
+        if (!user) {
+          throw new APIError("UNAUTHORIZED", {
+            message: "User not found"
+          });
+        }
+        if (user.banned) {
+          throw new APIError("FORBIDDEN", {
+            message: "Your account has been banned"
+          });
+        }
+        const session = await ctx.context.internalAdapter.createSession(
+          user.id,
+          ctx
+        );
+        if (!session) {
+          throw new APIError("INTERNAL_SERVER_ERROR", {
+            message: "Failed to create session"
+          });
+        }
+        await setSessionCookie(ctx, { session, user });
+        return ctx.json({
+          success: true,
+          user: {
+            id: user.id,
+            name: user.name,
+            email: user.email
+          }
+        });
+      }
+    )
+  }
+});
+export {
+  deserializeOutput,
+  generateNonce,
+  serializeOutput,
+  siws,
+  verifySIWS
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { createAuthEndpoint, APIError } from \"better-auth/api\";\nimport { setSessionCookie } from \"better-auth/cookies\";\nimport { z } from \"zod\";\nimport { generateNonce, verifySIWS } from \"./crypto\";\nimport { deserializeOutput } from \"./types\";\nimport type { SiwsPluginOptions } from \"./types\";\n\nexport type { SiwsPluginOptions };\nexport { generateNonce, verifySIWS } from \"./crypto\";\nexport { serializeOutput, deserializeOutput } from \"./types\";\nexport type {\n  SiwsNonceResponse,\n  SiwsVerifyRequest,\n  SiwsVerifyResponse,\n  SiwsLinkedWallet,\n  SerializedSolanaOutput,\n} from \"./types\";\n\nexport const siws = (options?: SiwsPluginOptions) => ({\n  id: \"siws\" as const,\n  endpoints: {\n    getSiwsNonce: createAuthEndpoint(\n      \"/siws/nonce\",\n      {\n        method: \"POST\",\n        body: z.object({\n          walletAddress: z.string().min(32).max(44),\n        }),\n      },\n      async (ctx) => {\n        const { walletAddress } = ctx.body;\n        const nonce = generateNonce();\n        const expiryMs = options?.nonceExpiryMs ?? 5 * 60 * 1000;\n\n        await ctx.context.internalAdapter.createVerificationValue({\n          identifier: `siws:${walletAddress}`,\n          value: nonce,\n          expiresAt: new Date(Date.now() + expiryMs),\n        });\n\n        const host = ctx.headers?.get(\"host\") || \"localhost:3000\";\n        const protocol = host.includes(\"localhost\") ? \"http\" : \"https\";\n        const domain = host;\n        const uri = `${protocol}://${host}`;\n\n        return ctx.json({\n          nonce,\n          domain,\n          uri,\n          statement:\n            options?.statement ??\n            \"Sign in with your Solana wallet. This will not trigger a blockchain transaction or cost any gas fee.\",\n          chainId: options?.chainId ?? \"mainnet\",\n          issuedAt: new Date().toISOString(),\n        });\n      }\n    ),\n\n    verifySiwsSignature: createAuthEndpoint(\n      \"/siws/verify\",\n      {\n        method: \"POST\",\n        body: z.object({\n          output: z.object({\n            account: z.object({\n              address: z.string(),\n              publicKey: z.array(z.number()),\n            }),\n            signature: z.array(z.number()),\n            signedMessage: z.array(z.number()),\n          }),\n          input: z.object({\n            domain: z.string(),\n            address: z.string().optional(),\n            statement: z.string().optional(),\n            uri: z.string().optional(),\n            version: z.string().optional(),\n            chainId: z.string().optional(),\n            nonce: z.string().optional(),\n            issuedAt: z.string().optional(),\n            expirationTime: z.string().optional(),\n            notBefore: z.string().optional(),\n            requestId: z.string().optional(),\n            resources: z.array(z.string()).optional(),\n          }),\n        }),\n        requireRequest: true,\n      },\n      async (ctx: any) => {\n        const { output, input } = ctx.body;\n        const walletAddress = output.account.address;\n\n        const verification =\n          await ctx.context.internalAdapter.findVerificationValue(\n            `siws:${walletAddress}`\n          );\n\n        if (!verification || new Date() > verification.expiresAt) {\n          throw new APIError(\"UNAUTHORIZED\", {\n            message: \"Invalid or expired nonce\",\n          });\n        }\n\n        const solanaOutput = deserializeOutput(output);\n        const isValid = verifySIWS(input, solanaOutput);\n\n        if (!isValid) {\n          throw new APIError(\"UNAUTHORIZED\", {\n            message: \"Invalid signature\",\n          });\n        }\n\n        await ctx.context.internalAdapter.deleteVerificationValue(\n          verification.id\n        );\n\n        const linkedAccount = (await ctx.context.adapter.findOne({\n          model: \"account\",\n          where: [\n            { field: \"providerId\", operator: \"eq\", value: \"solana\" },\n            { field: \"accountId\", operator: \"eq\", value: walletAddress },\n          ],\n        })) as { userId: string } | null;\n\n        if (!linkedAccount) {\n          if (options?.anonymous) {\n            const user = await ctx.context.internalAdapter.createUser({\n              name: walletAddress,\n              email: `${walletAddress}@solana.wallet`,\n              image: \"\",\n            });\n\n            await ctx.context.internalAdapter.createAccount({\n              userId: user.id,\n              providerId: \"solana\",\n              accountId: walletAddress,\n              createdAt: new Date(),\n              updatedAt: new Date(),\n            });\n\n            const session = await ctx.context.internalAdapter.createSession(\n              user.id,\n              ctx\n            );\n\n            if (!session) {\n              throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n                message: \"Failed to create session\",\n              });\n            }\n\n            await setSessionCookie(ctx, { session, user });\n\n            return ctx.json({\n              success: true,\n              user: {\n                id: user.id,\n                name: user.name,\n                email: user.email,\n              },\n            });\n          }\n\n          throw new APIError(\"UNAUTHORIZED\", {\n            message:\n              \"No account linked to this wallet. Please sign in with email first and link your wallet.\",\n            code: \"WALLET_NOT_LINKED\",\n          });\n        }\n\n        const user = (await ctx.context.adapter.findOne({\n          model: \"user\",\n          where: [\n            { field: \"id\", operator: \"eq\", value: linkedAccount.userId },\n          ],\n        })) as {\n          id: string;\n          name: string;\n          email: string;\n          emailVerified: boolean;\n          image?: string | null;\n          banned?: boolean;\n          createdAt: Date;\n          updatedAt: Date;\n        } | null;\n\n        if (!user) {\n          throw new APIError(\"UNAUTHORIZED\", {\n            message: \"User not found\",\n          });\n        }\n\n        if (user.banned) {\n          throw new APIError(\"FORBIDDEN\", {\n            message: \"Your account has been banned\",\n          });\n        }\n\n        const session = await ctx.context.internalAdapter.createSession(\n          user.id,\n          ctx\n        );\n\n        if (!session) {\n          throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n            message: \"Failed to create session\",\n          });\n        }\n\n        await setSessionCookie(ctx, { session, user });\n\n        return ctx.json({\n          success: true,\n          user: {\n            id: user.id,\n            name: user.name,\n            email: user.email,\n          },\n        });\n      }\n    ),\n  },\n});\n"],"mappings":";;;;;;;;;;AAAA,SAAS,oBAAoB,gBAAgB;AAC7C,SAAS,wBAAwB;AACjC,SAAS,SAAS;AAgBX,IAAM,OAAO,CAAC,aAAiC;AAAA,EACpD,IAAI;AAAA,EACJ,WAAW;AAAA,IACT,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,MAAM,EAAE,OAAO;AAAA,UACb,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE;AAAA,QAC1C,CAAC;AAAA,MACH;AAAA,MACA,OAAO,QAAQ;AACb,cAAM,EAAE,cAAc,IAAI,IAAI;AAC9B,cAAM,QAAQ,cAAc;AAC5B,cAAM,WAAW,SAAS,iBAAiB,IAAI,KAAK;AAEpD,cAAM,IAAI,QAAQ,gBAAgB,wBAAwB;AAAA,UACxD,YAAY,QAAQ,aAAa;AAAA,UACjC,OAAO;AAAA,UACP,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ;AAAA,QAC3C,CAAC;AAED,cAAM,OAAO,IAAI,SAAS,IAAI,MAAM,KAAK;AACzC,cAAM,WAAW,KAAK,SAAS,WAAW,IAAI,SAAS;AACvD,cAAM,SAAS;AACf,cAAM,MAAM,GAAG,QAAQ,MAAM,IAAI;AAEjC,eAAO,IAAI,KAAK;AAAA,UACd;AAAA,UACA;AAAA,UACA;AAAA,UACA,WACE,SAAS,aACT;AAAA,UACF,SAAS,SAAS,WAAW;AAAA,UAC7B,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,QACnC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IAEA,qBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,MAAM,EAAE,OAAO;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,SAAS,EAAE,OAAO;AAAA,cAChB,SAAS,EAAE,OAAO;AAAA,cAClB,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,YAC/B,CAAC;AAAA,YACD,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,YAC7B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,UACnC,CAAC;AAAA,UACD,OAAO,EAAE,OAAO;AAAA,YACd,QAAQ,EAAE,OAAO;AAAA,YACjB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,YAC/B,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,YACzB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,YAC3B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,YAC9B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,YACpC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,YAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,YAC/B,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,UAC1C,CAAC;AAAA,QACH,CAAC;AAAA,QACD,gBAAgB;AAAA,MAClB;AAAA,MACA,OAAO,QAAa;AAClB,cAAM,EAAE,QAAQ,MAAM,IAAI,IAAI;AAC9B,cAAM,gBAAgB,OAAO,QAAQ;AAErC,cAAM,eACJ,MAAM,IAAI,QAAQ,gBAAgB;AAAA,UAChC,QAAQ,aAAa;AAAA,QACvB;AAEF,YAAI,CAAC,gBAAgB,oBAAI,KAAK,IAAI,aAAa,WAAW;AACxD,gBAAM,IAAI,SAAS,gBAAgB;AAAA,YACjC,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,eAAe,kBAAkB,MAAM;AAC7C,cAAM,UAAU,WAAW,OAAO,YAAY;AAE9C,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,SAAS,gBAAgB;AAAA,YACjC,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,IAAI,QAAQ,gBAAgB;AAAA,UAChC,aAAa;AAAA,QACf;AAEA,cAAM,gBAAiB,MAAM,IAAI,QAAQ,QAAQ,QAAQ;AAAA,UACvD,OAAO;AAAA,UACP,OAAO;AAAA,YACL,EAAE,OAAO,cAAc,UAAU,MAAM,OAAO,SAAS;AAAA,YACvD,EAAE,OAAO,aAAa,UAAU,MAAM,OAAO,cAAc;AAAA,UAC7D;AAAA,QACF,CAAC;AAED,YAAI,CAAC,eAAe;AAClB,cAAI,SAAS,WAAW;AACtB,kBAAMA,QAAO,MAAM,IAAI,QAAQ,gBAAgB,WAAW;AAAA,cACxD,MAAM;AAAA,cACN,OAAO,GAAG,aAAa;AAAA,cACvB,OAAO;AAAA,YACT,CAAC;AAED,kBAAM,IAAI,QAAQ,gBAAgB,cAAc;AAAA,cAC9C,QAAQA,MAAK;AAAA,cACb,YAAY;AAAA,cACZ,WAAW;AAAA,cACX,WAAW,oBAAI,KAAK;AAAA,cACpB,WAAW,oBAAI,KAAK;AAAA,YACtB,CAAC;AAED,kBAAMC,WAAU,MAAM,IAAI,QAAQ,gBAAgB;AAAA,cAChDD,MAAK;AAAA,cACL;AAAA,YACF;AAEA,gBAAI,CAACC,UAAS;AACZ,oBAAM,IAAI,SAAS,yBAAyB;AAAA,gBAC1C,SAAS;AAAA,cACX,CAAC;AAAA,YACH;AAEA,kBAAM,iBAAiB,KAAK,EAAE,SAAAA,UAAS,MAAAD,MAAK,CAAC;AAE7C,mBAAO,IAAI,KAAK;AAAA,cACd,SAAS;AAAA,cACT,MAAM;AAAA,gBACJ,IAAIA,MAAK;AAAA,gBACT,MAAMA,MAAK;AAAA,gBACX,OAAOA,MAAK;AAAA,cACd;AAAA,YACF,CAAC;AAAA,UACH;AAEA,gBAAM,IAAI,SAAS,gBAAgB;AAAA,YACjC,SACE;AAAA,YACF,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAEA,cAAM,OAAQ,MAAM,IAAI,QAAQ,QAAQ,QAAQ;AAAA,UAC9C,OAAO;AAAA,UACP,OAAO;AAAA,YACL,EAAE,OAAO,MAAM,UAAU,MAAM,OAAO,cAAc,OAAO;AAAA,UAC7D;AAAA,QACF,CAAC;AAWD,YAAI,CAAC,MAAM;AACT,gBAAM,IAAI,SAAS,gBAAgB;AAAA,YACjC,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,YAAI,KAAK,QAAQ;AACf,gBAAM,IAAI,SAAS,aAAa;AAAA,YAC9B,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB;AAAA,UAChD,KAAK;AAAA,UACL;AAAA,QACF;AAEA,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,SAAS,yBAAyB;AAAA,YAC1C,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,iBAAiB,KAAK,EAAE,SAAS,KAAK,CAAC;AAE7C,eAAO,IAAI,KAAK;AAAA,UACd,SAAS;AAAA,UACT,MAAM;AAAA,YACJ,IAAI,KAAK;AAAA,YACT,MAAM,KAAK;AAAA,YACX,OAAO,KAAK;AAAA,UACd;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;","names":["user","session"]}

package/dist/link.cjs

@@ -0,0 +1,208 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/link.ts
+var link_exports = {};
+__export(link_exports, {
+  createSignInInput: () => createSignInInput,
+  generateNonce: () => generateNonce,
+  siwsLink: () => siwsLink,
+  verifySIWS: () => verifySIWS
+});
+module.exports = __toCommonJS(link_exports);
+var import_api = require("better-auth/api");
+var import_api2 = require("better-auth/api");
+var import_zod = require("zod");
+
+// src/crypto.ts
+var import_wallet_standard_util = require("@solana/wallet-standard-util");
+function generateNonce() {
+  const array = new Uint8Array(16);
+  crypto.getRandomValues(array);
+  return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function createSignInInput(domain, nonce, options) {
+  return {
+    domain,
+    statement: options?.statement ?? "Sign in with your Solana wallet. This will not trigger a blockchain transaction or cost any gas fee.",
+    version: "1",
+    nonce,
+    chainId: options?.chainId ?? "mainnet",
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifySIWS(input, output) {
+  try {
+    const reconstructed = {
+      account: {
+        ...output.account,
+        publicKey: output.account.publicKey instanceof Uint8Array ? output.account.publicKey : new Uint8Array(output.account.publicKey),
+        chains: output.account.chains ?? [],
+        features: output.account.features ?? []
+      },
+      signature: output.signature instanceof Uint8Array ? output.signature : new Uint8Array(output.signature),
+      signedMessage: output.signedMessage instanceof Uint8Array ? output.signedMessage : new Uint8Array(output.signedMessage)
+    };
+    return (0, import_wallet_standard_util.verifySignIn)(input, reconstructed);
+  } catch (error) {
+    console.error("SIWS verification error:", error);
+    return false;
+  }
+}
+
+// src/link.ts
+var siwsLink = (_options) => ({
+  id: "siws-link",
+  endpoints: {
+    linkSolanaWallet: (0, import_api.createAuthEndpoint)(
+      "/siws/link",
+      {
+        method: "POST",
+        body: import_zod.z.object({
+          input: import_zod.z.object({
+            domain: import_zod.z.string(),
+            statement: import_zod.z.string().optional(),
+            version: import_zod.z.string().optional(),
+            nonce: import_zod.z.string().optional(),
+            chainId: import_zod.z.string().optional(),
+            issuedAt: import_zod.z.string().optional()
+          }),
+          output: import_zod.z.object({
+            account: import_zod.z.object({
+              address: import_zod.z.string(),
+              publicKey: import_zod.z.array(import_zod.z.number())
+            }),
+            signature: import_zod.z.array(import_zod.z.number()),
+            signedMessage: import_zod.z.array(import_zod.z.number())
+          })
+        }),
+        requireRequest: true
+      },
+      async (ctx) => {
+        const session = await (0, import_api2.getSessionFromCtx)(ctx);
+        if (!session?.user) {
+          throw new import_api.APIError("UNAUTHORIZED", { message: "Not authenticated" });
+        }
+        const { input, output } = ctx.body;
+        const walletAddress = output.account.address;
+        const isValid = verifySIWS(input, output);
+        if (!isValid) {
+          throw new import_api.APIError("BAD_REQUEST", {
+            message: "Invalid signature"
+          });
+        }
+        const existing = await ctx.context.adapter.findOne({
+          model: "account",
+          where: [
+            { field: "providerId", operator: "eq", value: "solana" },
+            { field: "accountId", operator: "eq", value: walletAddress }
+          ]
+        });
+        if (existing) {
+          if (existing.userId === session.user.id) {
+            throw new import_api.APIError("BAD_REQUEST", {
+              message: "This wallet is already linked to your account"
+            });
+          }
+          throw new import_api.APIError("BAD_REQUEST", {
+            message: "This wallet is already linked to another account"
+          });
+        }
+        await ctx.context.internalAdapter.createAccount({
+          userId: session.user.id,
+          providerId: "solana",
+          accountId: walletAddress,
+          createdAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        });
+        return ctx.json({ success: true, walletAddress });
+      }
+    ),
+    unlinkSolanaWallet: (0, import_api.createAuthEndpoint)(
+      "/siws/unlink",
+      {
+        method: "POST",
+        body: import_zod.z.object({
+          walletAddress: import_zod.z.string().min(32).max(44)
+        }),
+        requireRequest: true
+      },
+      async (ctx) => {
+        const session = await (0, import_api2.getSessionFromCtx)(ctx);
+        if (!session?.user) {
+          throw new import_api.APIError("UNAUTHORIZED", { message: "Not authenticated" });
+        }
+        const { walletAddress } = ctx.body;
+        const account = await ctx.context.adapter.findOne({
+          model: "account",
+          where: [
+            { field: "providerId", operator: "eq", value: "solana" },
+            { field: "accountId", operator: "eq", value: walletAddress },
+            { field: "userId", operator: "eq", value: session.user.id }
+          ]
+        });
+        if (!account) {
+          throw new import_api.APIError("NOT_FOUND", {
+            message: "Wallet not found on your account"
+          });
+        }
+        await ctx.context.adapter.delete({
+          model: "account",
+          where: [
+            { field: "id", operator: "eq", value: account.id }
+          ]
+        });
+        return ctx.json({ success: true });
+      }
+    ),
+    getLinkedSolanaWallets: (0, import_api.createAuthEndpoint)(
+      "/siws/wallets",
+      {
+        method: "GET",
+        requireRequest: true
+      },
+      async (ctx) => {
+        const session = await (0, import_api2.getSessionFromCtx)(ctx);
+        if (!session?.user) {
+          throw new import_api.APIError("UNAUTHORIZED", { message: "Not authenticated" });
+        }
+        const accounts = await ctx.context.adapter.findMany({
+          model: "account",
+          where: [
+            { field: "providerId", operator: "eq", value: "solana" },
+            { field: "userId", operator: "eq", value: session.user.id }
+          ]
+        });
+        const wallets = accounts.map((a) => ({
+          walletAddress: a.accountId,
+          createdAt: a.createdAt
+        }));
+        return ctx.json({ wallets });
+      }
+    )
+  }
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createSignInInput,
+  generateNonce,
+  siwsLink,
+  verifySIWS
+});
+//# sourceMappingURL=link.cjs.map

package/dist/link.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/link.ts","../src/crypto.ts"],"sourcesContent":["import { createAuthEndpoint, APIError } from \"better-auth/api\";\nimport { getSessionFromCtx } from \"better-auth/api\";\nimport { z } from \"zod\";\nimport { verifySIWS } from \"./crypto\";\nimport type { SiwsPluginOptions } from \"./types\";\n\nexport { verifySIWS } from \"./crypto\";\nexport { generateNonce, createSignInInput } from \"./crypto\";\nexport type { SiwsLinkedWallet, SiwsLinkRequest } from \"./types\";\n\nexport const siwsLink = (_options?: Pick<SiwsPluginOptions, \"chainId\">) => ({\n  id: \"siws-link\" as const,\n  endpoints: {\n    linkSolanaWallet: createAuthEndpoint(\n      \"/siws/link\",\n      {\n        method: \"POST\",\n        body: z.object({\n          input: z.object({\n            domain: z.string(),\n            statement: z.string().optional(),\n            version: z.string().optional(),\n            nonce: z.string().optional(),\n            chainId: z.string().optional(),\n            issuedAt: z.string().optional(),\n          }),\n          output: z.object({\n            account: z.object({\n              address: z.string(),\n              publicKey: z.array(z.number()),\n            }),\n            signature: z.array(z.number()),\n            signedMessage: z.array(z.number()),\n          }),\n        }),\n        requireRequest: true,\n      },\n      async (ctx: any) => {\n        const session = await getSessionFromCtx(ctx);\n        if (!session?.user) {\n          throw new APIError(\"UNAUTHORIZED\", { message: \"Not authenticated\" });\n        }\n\n        const { input, output } = ctx.body;\n        const walletAddress = output.account.address;\n\n        const isValid = verifySIWS(input, output);\n        if (!isValid) {\n          throw new APIError(\"BAD_REQUEST\", {\n            message: \"Invalid signature\",\n          });\n        }\n\n        const existing = await ctx.context.adapter.findOne({\n          model: \"account\",\n          where: [\n            { field: \"providerId\", operator: \"eq\", value: \"solana\" },\n            { field: \"accountId\", operator: \"eq\", value: walletAddress },\n          ],\n        });\n\n        if (existing) {\n          if ((existing as any).userId === session.user.id) {\n            throw new APIError(\"BAD_REQUEST\", {\n              message: \"This wallet is already linked to your account\",\n            });\n          }\n          throw new APIError(\"BAD_REQUEST\", {\n            message: \"This wallet is already linked to another account\",\n          });\n        }\n\n        await ctx.context.internalAdapter.createAccount({\n          userId: session.user.id,\n          providerId: \"solana\",\n          accountId: walletAddress,\n          createdAt: new Date(),\n          updatedAt: new Date(),\n        });\n\n        return ctx.json({ success: true, walletAddress });\n      }\n    ),\n\n    unlinkSolanaWallet: createAuthEndpoint(\n      \"/siws/unlink\",\n      {\n        method: \"POST\",\n        body: z.object({\n          walletAddress: z.string().min(32).max(44),\n        }),\n        requireRequest: true,\n      },\n      async (ctx: any) => {\n        const session = await getSessionFromCtx(ctx);\n        if (!session?.user) {\n          throw new APIError(\"UNAUTHORIZED\", { message: \"Not authenticated\" });\n        }\n\n        const { walletAddress } = ctx.body;\n\n        const account = await ctx.context.adapter.findOne({\n          model: \"account\",\n          where: [\n            { field: \"providerId\", operator: \"eq\", value: \"solana\" },\n            { field: \"accountId\", operator: \"eq\", value: walletAddress },\n            { field: \"userId\", operator: \"eq\", value: session.user.id },\n          ],\n        });\n\n        if (!account) {\n          throw new APIError(\"NOT_FOUND\", {\n            message: \"Wallet not found on your account\",\n          });\n        }\n\n        await ctx.context.adapter.delete({\n          model: \"account\",\n          where: [\n            { field: \"id\", operator: \"eq\", value: (account as any).id },\n          ],\n        });\n\n        return ctx.json({ success: true });\n      }\n    ),\n\n    getLinkedSolanaWallets: createAuthEndpoint(\n      \"/siws/wallets\",\n      {\n        method: \"GET\",\n        requireRequest: true,\n      },\n      async (ctx: any) => {\n        const session = await getSessionFromCtx(ctx);\n        if (!session?.user) {\n          throw new APIError(\"UNAUTHORIZED\", { message: \"Not authenticated\" });\n        }\n\n        const accounts = await ctx.context.adapter.findMany({\n          model: \"account\",\n          where: [\n            { field: \"providerId\", operator: \"eq\", value: \"solana\" },\n            { field: \"userId\", operator: \"eq\", value: session.user.id },\n          ],\n        });\n\n        const wallets = (accounts as any[]).map((a) => ({\n          walletAddress: a.accountId,\n          createdAt: a.createdAt,\n        }));\n\n        return ctx.json({ wallets });\n      }\n    ),\n  },\n});\n","import type { SolanaSignInInput, SolanaSignInOutput } from \"@solana/wallet-standard-features\";\nimport { verifySignIn } from \"@solana/wallet-standard-util\";\n\nexport function generateNonce(): string {\n  const array = new Uint8Array(16);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function createSignInInput(\n  domain: string,\n  nonce: string,\n  options?: { statement?: string; chainId?: string }\n): SolanaSignInInput {\n  return {\n    domain,\n    statement:\n      options?.statement ??\n      \"Sign in with your Solana wallet. This will not trigger a blockchain transaction or cost any gas fee.\",\n    version: \"1\",\n    nonce,\n    chainId: options?.chainId ?? \"mainnet\",\n    issuedAt: new Date().toISOString(),\n  };\n}\n\nexport function verifySIWS(\n  input: SolanaSignInInput,\n  output: SolanaSignInOutput | { account: { publicKey: number[] | Uint8Array; address: string }; signature: number[] | Uint8Array; signedMessage: number[] | Uint8Array }\n): boolean {\n  try {\n    const reconstructed: SolanaSignInOutput = {\n      account: {\n        ...output.account,\n        publicKey:\n          output.account.publicKey instanceof Uint8Array\n            ? output.account.publicKey\n            : new Uint8Array(output.account.publicKey),\n        chains: (output.account as any).chains ?? [],\n        features: (output.account as any).features ?? [],\n      },\n      signature:\n        output.signature instanceof Uint8Array\n          ? output.signature\n          : new Uint8Array(output.signature),\n      signedMessage:\n        output.signedMessage instanceof Uint8Array\n          ? output.signedMessage\n          : new Uint8Array(output.signedMessage),\n    };\n    return verifySignIn(input, reconstructed);\n  } catch (error) {\n    console.error(\"SIWS verification error:\", error);\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAA6C;AAC7C,IAAAA,cAAkC;AAClC,iBAAkB;;;ACDlB,kCAA6B;AAEtB,SAAS,gBAAwB;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAChF;AAEO,SAAS,kBACd,QACA,OACA,SACmB;AACnB,SAAO;AAAA,IACL;AAAA,IACA,WACE,SAAS,aACT;AAAA,IACF,SAAS;AAAA,IACT;AAAA,IACA,SAAS,SAAS,WAAW;AAAA,IAC7B,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC;AACF;AAEO,SAAS,WACd,OACA,QACS;AACT,MAAI;AACF,UAAM,gBAAoC;AAAA,MACxC,SAAS;AAAA,QACP,GAAG,OAAO;AAAA,QACV,WACE,OAAO,QAAQ,qBAAqB,aAChC,OAAO,QAAQ,YACf,IAAI,WAAW,OAAO,QAAQ,SAAS;AAAA,QAC7C,QAAS,OAAO,QAAgB,UAAU,CAAC;AAAA,QAC3C,UAAW,OAAO,QAAgB,YAAY,CAAC;AAAA,MACjD;AAAA,MACA,WACE,OAAO,qBAAqB,aACxB,OAAO,YACP,IAAI,WAAW,OAAO,SAAS;AAAA,MACrC,eACE,OAAO,yBAAyB,aAC5B,OAAO,gBACP,IAAI,WAAW,OAAO,aAAa;AAAA,IAC3C;AACA,eAAO,0CAAa,OAAO,aAAa;AAAA,EAC1C,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAC/C,WAAO;AAAA,EACT;AACF;;;AD7CO,IAAM,WAAW,CAAC,cAAmD;AAAA,EAC1E,IAAI;AAAA,EACJ,WAAW;AAAA,IACT,sBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,MAAM,aAAE,OAAO;AAAA,UACb,OAAO,aAAE,OAAO;AAAA,YACd,QAAQ,aAAE,OAAO;AAAA,YACjB,WAAW,aAAE,OAAO,EAAE,SAAS;AAAA,YAC/B,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,YAC3B,SAAS,aAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,UAAU,aAAE,OAAO,EAAE,SAAS;AAAA,UAChC,CAAC;AAAA,UACD,QAAQ,aAAE,OAAO;AAAA,YACf,SAAS,aAAE,OAAO;AAAA,cAChB,SAAS,aAAE,OAAO;AAAA,cAClB,WAAW,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,YAC/B,CAAC;AAAA,YACD,WAAW,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,YAC7B,eAAe,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,UACnC,CAAC;AAAA,QACH,CAAC;AAAA,QACD,gBAAgB;AAAA,MAClB;AAAA,MACA,OAAO,QAAa;AAClB,cAAM,UAAU,UAAM,+BAAkB,GAAG;AAC3C,YAAI,CAAC,SAAS,MAAM;AAClB,gBAAM,IAAI,oBAAS,gBAAgB,EAAE,SAAS,oBAAoB,CAAC;AAAA,QACrE;AAEA,cAAM,EAAE,OAAO,OAAO,IAAI,IAAI;AAC9B,cAAM,gBAAgB,OAAO,QAAQ;AAErC,cAAM,UAAU,WAAW,OAAO,MAAM;AACxC,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,oBAAS,eAAe;AAAA,YAChC,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,QAAQ;AAAA,UACjD,OAAO;AAAA,UACP,OAAO;AAAA,YACL,EAAE,OAAO,cAAc,UAAU,MAAM,OAAO,SAAS;AAAA,YACvD,EAAE,OAAO,aAAa,UAAU,MAAM,OAAO,cAAc;AAAA,UAC7D;AAAA,QACF,CAAC;AAED,YAAI,UAAU;AACZ,cAAK,SAAiB,WAAW,QAAQ,KAAK,IAAI;AAChD,kBAAM,IAAI,oBAAS,eAAe;AAAA,cAChC,SAAS;AAAA,YACX,CAAC;AAAA,UACH;AACA,gBAAM,IAAI,oBAAS,eAAe;AAAA,YAChC,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,IAAI,QAAQ,gBAAgB,cAAc;AAAA,UAC9C,QAAQ,QAAQ,KAAK;AAAA,UACrB,YAAY;AAAA,UACZ,WAAW;AAAA,UACX,WAAW,oBAAI,KAAK;AAAA,UACpB,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAED,eAAO,IAAI,KAAK,EAAE,SAAS,MAAM,cAAc,CAAC;AAAA,MAClD;AAAA,IACF;AAAA,IAEA,wBAAoB;AAAA,MAClB;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,MAAM,aAAE,OAAO;AAAA,UACb,eAAe,aAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE;AAAA,QAC1C,CAAC;AAAA,QACD,gBAAgB;AAAA,MAClB;AAAA,MACA,OAAO,QAAa;AAClB,cAAM,UAAU,UAAM,+BAAkB,GAAG;AAC3C,YAAI,CAAC,SAAS,MAAM;AAClB,gBAAM,IAAI,oBAAS,gBAAgB,EAAE,SAAS,oBAAoB,CAAC;AAAA,QACrE;AAEA,cAAM,EAAE,cAAc,IAAI,IAAI;AAE9B,cAAM,UAAU,MAAM,IAAI,QAAQ,QAAQ,QAAQ;AAAA,UAChD,OAAO;AAAA,UACP,OAAO;AAAA,YACL,EAAE,OAAO,cAAc,UAAU,MAAM,OAAO,SAAS;AAAA,YACvD,EAAE,OAAO,aAAa,UAAU,MAAM,OAAO,cAAc;AAAA,YAC3D,EAAE,OAAO,UAAU,UAAU,MAAM,OAAO,QAAQ,KAAK,GAAG;AAAA,UAC5D;AAAA,QACF,CAAC;AAED,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI,oBAAS,aAAa;AAAA,YAC9B,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,IAAI,QAAQ,QAAQ,OAAO;AAAA,UAC/B,OAAO;AAAA,UACP,OAAO;AAAA,YACL,EAAE,OAAO,MAAM,UAAU,MAAM,OAAQ,QAAgB,GAAG;AAAA,UAC5D;AAAA,QACF,CAAC;AAED,eAAO,IAAI,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,MACnC;AAAA,IACF;AAAA,IAEA,4BAAwB;AAAA,MACtB;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,gBAAgB;AAAA,MAClB;AAAA,MACA,OAAO,QAAa;AAClB,cAAM,UAAU,UAAM,+BAAkB,GAAG;AAC3C,YAAI,CAAC,SAAS,MAAM;AAClB,gBAAM,IAAI,oBAAS,gBAAgB,EAAE,SAAS,oBAAoB,CAAC;AAAA,QACrE;AAEA,cAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,SAAS;AAAA,UAClD,OAAO;AAAA,UACP,OAAO;AAAA,YACL,EAAE,OAAO,cAAc,UAAU,MAAM,OAAO,SAAS;AAAA,YACvD,EAAE,OAAO,UAAU,UAAU,MAAM,OAAO,QAAQ,KAAK,GAAG;AAAA,UAC5D;AAAA,QACF,CAAC;AAED,cAAM,UAAW,SAAmB,IAAI,CAAC,OAAO;AAAA,UAC9C,eAAe,EAAE;AAAA,UACjB,WAAW,EAAE;AAAA,QACf,EAAE;AAEF,eAAO,IAAI,KAAK,EAAE,QAAQ,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AACF;","names":["import_api"]}

package/dist/link.d.cts

@@ -0,0 +1,46 @@
+import * as better_call from 'better-call';
+import { z } from 'zod';
+import { b as SiwsPluginOptions } from './crypto-BQgenqov.cjs';
+export { h as SiwsLinkRequest, c as SiwsLinkedWallet, i as createSignInInput, g as generateNonce, v as verifySIWS } from './crypto-BQgenqov.cjs';
+import '@solana/wallet-standard-features';
+
+declare const siwsLink: (_options?: Pick<SiwsPluginOptions, "chainId">) => {
+    id: "siws-link";
+    endpoints: {
+        linkSolanaWallet: better_call.StrictEndpoint<"/siws/link", {
+            method: "POST";
+            body: z.ZodObject<{
+                input: z.ZodObject<{
+                    domain: z.ZodString;
+                    statement: z.ZodOptional<z.ZodString>;
+                    version: z.ZodOptional<z.ZodString>;
+                    nonce: z.ZodOptional<z.ZodString>;
+                    chainId: z.ZodOptional<z.ZodString>;
+                    issuedAt: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+                output: z.ZodObject<{
+                    account: z.ZodObject<{
+                        address: z.ZodString;
+                        publicKey: z.ZodArray<z.ZodNumber>;
+                    }, z.core.$strip>;
+                    signature: z.ZodArray<z.ZodNumber>;
+                    signedMessage: z.ZodArray<z.ZodNumber>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            requireRequest: true;
+        }, any>;
+        unlinkSolanaWallet: better_call.StrictEndpoint<"/siws/unlink", {
+            method: "POST";
+            body: z.ZodObject<{
+                walletAddress: z.ZodString;
+            }, z.core.$strip>;
+            requireRequest: true;
+        }, any>;
+        getLinkedSolanaWallets: better_call.StrictEndpoint<"/siws/wallets", {
+            method: "GET";
+            requireRequest: true;
+        }, any>;
+    };
+};
+
+export { siwsLink };

package/dist/link.d.ts

@@ -0,0 +1,46 @@
+import * as better_call from 'better-call';
+import { z } from 'zod';
+import { b as SiwsPluginOptions } from './crypto-BQgenqov.js';
+export { h as SiwsLinkRequest, c as SiwsLinkedWallet, i as createSignInInput, g as generateNonce, v as verifySIWS } from './crypto-BQgenqov.js';
+import '@solana/wallet-standard-features';
+
+declare const siwsLink: (_options?: Pick<SiwsPluginOptions, "chainId">) => {
+    id: "siws-link";
+    endpoints: {
+        linkSolanaWallet: better_call.StrictEndpoint<"/siws/link", {
+            method: "POST";
+            body: z.ZodObject<{
+                input: z.ZodObject<{
+                    domain: z.ZodString;
+                    statement: z.ZodOptional<z.ZodString>;
+                    version: z.ZodOptional<z.ZodString>;
+                    nonce: z.ZodOptional<z.ZodString>;
+                    chainId: z.ZodOptional<z.ZodString>;
+                    issuedAt: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+                output: z.ZodObject<{
+                    account: z.ZodObject<{
+                        address: z.ZodString;
+                        publicKey: z.ZodArray<z.ZodNumber>;
+                    }, z.core.$strip>;
+                    signature: z.ZodArray<z.ZodNumber>;
+                    signedMessage: z.ZodArray<z.ZodNumber>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            requireRequest: true;
+        }, any>;
+        unlinkSolanaWallet: better_call.StrictEndpoint<"/siws/unlink", {
+            method: "POST";
+            body: z.ZodObject<{
+                walletAddress: z.ZodString;
+            }, z.core.$strip>;
+            requireRequest: true;
+        }, any>;
+        getLinkedSolanaWallets: better_call.StrictEndpoint<"/siws/wallets", {
+            method: "GET";
+            requireRequest: true;
+        }, any>;
+    };
+};
+
+export { siwsLink };