@protobase/server 0.25.12 → 0.26.1

package/dist/admin-options.d.ts

@@ -4,6 +4,7 @@ import { MapOptions } from "./maps/map-settings.js";
 import { PluginOption } from "./plugins/plugin-settings.js";
 import { SourceOption } from "./sources/source-settings.js";
 import { CorsOrigins } from "./api-cors.js";
+import { ApiKeysOptions } from "./api-keys/api-key-settings.js";
 import { AssistantOptions } from "./assistant/assistant-settings.js";
 import { LocaleOption } from "./locale/locale-option.js";
 import { RuntimeOptions } from "./runtime/runtime-settings.js";
@@ -12,6 +13,12 @@ import { ResolveOptions, RoleLimit } from "@protobase/schema";
 export type AdminOptions = {
   /** Default `/api/v1`. */
   basePath?: string;
+  /**
+   * The app's publishable and secret keys, with which supabase-js calls the Realtime-compatible `/realtime/v1` (see
+   * `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and `PROTOBASE_SECRET_KEY`. Without either, or with
+   * `false`, the app serves no `/realtime/v1`.
+   */
+  apiKeys?: ApiKeysOptions | false;
   /** Applied to every request's transaction with SET LOCAL. Default 15000. */
   statementTimeoutMs?: number;
   /** Reads that filter, sort or count values by a column no index serves. Default mode `reject`. */

package/dist/better-auth/app-tokens.js

@@ -1,8 +1,8 @@
 import { checkedUrl } from "../checked-url.js";
 import { forbidden } from "../problem.js";
-import "./auth-base-path.js";
-import { noGlobalRole } from "./organizations/role-definitions.js";
 import { jwtAuthenticator } from "../auth/jwt.js";
+import { noGlobalRole } from "./organizations/role-definitions.js";
+import "./auth-base-path.js";
 import { createRemoteJWKSet, decodeJwt, errors } from "jose";
 //#region src/better-auth/app-tokens.ts
 const claimedIssuer = (request) => {

package/dist/better-auth/authenticator.js

@@ -1,5 +1,5 @@
-import { noGlobalRole } from "./organizations/role-definitions.js";
 import { jwtAuthenticator } from "../auth/jwt.js";
+import { noGlobalRole } from "./organizations/role-definitions.js";
 import { withTrustedApps } from "./app-tokens.js";
 import { cachedKeys } from "./jwks-cache.js";
 //#region src/better-auth/authenticator.ts

package/dist/better-auth/create-auth.d.ts

@@ -12,6 +12,7 @@ import { PasswordHash } from "./password-hashes.js";
 import { UserTableOptions } from "./user-table.js";
 import "../index.js";
 import { BetterAuthOptions } from "better-auth";
+import { JwtOptions } from "better-auth/plugins";
 //#region src/better-auth/create-auth.d.ts
 export type CreateAuthOptions = {
   /** A `pg` Pool, or `{ dialect, type: 'postgres', schemaName? }` for a Kysely dialect: the admin store, apart from the application's tables (its own schema or database). */
@@ -160,6 +161,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         readonly input: false;
         readonly fieldName: "last_organization_id";
       } | undefined;
+      emailConfirmedAt: {
+        readonly type: "date";
+        readonly required: false;
+        readonly input: false;
+        readonly fieldName: "email_confirmed_at";
+      };
     };
     modelName: string;
     fields: {
@@ -1136,6 +1143,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           };
         };
       };
+      jwks: {
+        keyPairConfigs: {
+          readonly alg: "ES256";
+        }[];
+      };
       jwt: {
         expirationTime: string;
         issuer: string;
@@ -1318,7 +1330,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           $Infer: {
             body: {
               payload: import("jose").JWTPayload;
-              overrideOptions?: import("better-auth/plugins").JwtOptions | undefined;
+              overrideOptions?: JwtOptions | undefined;
             };
           };
         };
@@ -1335,7 +1347,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           $Infer: {
             body: {
               token: string;
-              issuer?: string;
+              issuer? /** Sign-in attempts allowed per minute and client, default 5; also the sign-up requests allowed. */ : string;
             };
             response: {
               payload: {
@@ -4411,6 +4423,88 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-gotrue-sessions";
+    endpoints: {
+      goTrueSession: import("better-auth").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          sessionToken: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        access_token: string;
+        token_type: string;
+        expires_in: number;
+        expires_at: number;
+        refresh_token: string;
+        user: {
+          app_metadata: {
+            provider?: undefined;
+            providers?: undefined;
+          } | {
+            provider: string;
+            providers: string[];
+          };
+          user_metadata: Record<string, unknown>;
+          identities: {
+            identity_id: string;
+            id: string;
+            user_id: string;
+            provider: string;
+            created_at: string;
+            updated_at: string;
+          }[];
+          created_at: string;
+          updated_at: string;
+          is_anonymous: boolean;
+          email_confirmed_at?: string | undefined;
+          confirmed_at?: string | undefined;
+          id: string;
+          aud: string;
+          role: string;
+          email: string;
+        };
+      }>;
+      goTrueRefresh: import("better-auth").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          refreshToken: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        access_token: string;
+        token_type: string;
+        expires_in: number;
+        expires_at: number;
+        refresh_token: string;
+        user: {
+          app_metadata: {
+            provider?: undefined;
+            providers?: undefined;
+          } | {
+            provider: string;
+            providers: string[];
+          };
+          user_metadata: Record<string, unknown>;
+          identities: {
+            identity_id: string;
+            id: string;
+            user_id: string;
+            provider: string;
+            created_at: string;
+            updated_at: string;
+          }[];
+          created_at: string;
+          updated_at: string;
+          is_anonymous: boolean;
+          email_confirmed_at?: string | undefined;
+          confirmed_at?: string | undefined;
+          id: string;
+          aud: string;
+          role: string;
+          email: string;
+        };
+      }>;
+    };
   } | {
     id: "protobase-staff-sign-in";
     schema: {
@@ -5759,6 +5853,27 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           } & Record<string, unknown>;
         }>;
       };
+      update: {
+        before: (user: Partial<{
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          email: string;
+          emailVerified: boolean;
+          name: string;
+          image?: string | null | undefined;
+        }> & Record<string, unknown>) => Promise<{
+          data: Partial<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          }> & Record<string, unknown>;
+        }>;
+      };
     };
   };
   rateLimit: {
@@ -5851,6 +5966,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   passwordReset: boolean;
   /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
   signUp: boolean;
+  /** The role of accounts made by open sign-up, while it is offered. */
+  signUpRole: string | undefined;
+  /** The app keeps each user's metadata, in the column `users.metadata` names. */
+  userMetadata: boolean;
   socialProviders: string[];
   /** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
   appName: string;

package/dist/better-auth/create-auth.js

@@ -1,11 +1,15 @@
 import { multiHostBaseURL, readOrigins, resolveOrigins } from "./origins.js";
 import { defaultAppName, readAppName } from "../app-name.js";
+import { goTrueIssuer, goTrueKeyPair } from "../gotrue/keys.js";
+import { roleDefinitions } from "./organizations/role-definitions.js";
+import { narrowClaims } from "./roles/active-role.js";
+import { signInPolicyPlugin } from "./policy-plugin.js";
+import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
 import { authBasePath } from "./auth-base-path.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
-import { roleDefinitions } from "./organizations/role-definitions.js";
 import { lastOrganizationField, organizationClaims, sessionOrganizationHooks } from "./organizations/session-organization.js";
 import { organizationPlugin } from "./organizations/organization-plugin.js";
 import { protobaseOrganizationPlugin } from "./organizations/protobase-plugin.js";
@@ -14,13 +18,12 @@ import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey
 import { coreNames, pluginNames } from "./snake-case-names.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
-import { narrowClaims } from "./roles/active-role.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { platformSignInFor, platformSignInProvider, readPlatformSignIn, resolvePlatformSignIn } from "./platform-sign-in.js";
-import { signInPolicyPlugin } from "./policy-plugin.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin, samlPlugin } from "./saml-sign-in.js";
 import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
+import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
@@ -65,7 +68,38 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 	const samlIds = saml.map((provider) => provider.id);
 	const users = userTable(options.users);
 	const passwordHashes = options.passwordHashes ?? [];
+	const policy = {
+		mail: Boolean(mailer),
+		socialProviders: [...Object.keys(options.socialProviders ?? {}), ...samlIds],
+		...operator && { operator: operator.name },
+		...signIn && { platformSignIn: {
+			provider: signIn.provider,
+			name: signIn.name
+		} }
+	};
+	const jwtOptions = {
+		schema: pluginNames.jwt,
+		jwks: { keyPairConfigs: [goTrueKeyPair] },
+		jwt: {
+			expirationTime: tokenLifetime,
+			issuer: options.baseURL,
+			audience: options.baseURL,
+			definePayload: async ({ user, session }) => {
+				const { activeRole, activeOrganizationId } = session;
+				const claims = {
+					role: user.role,
+					...organizations && await organizationClaims((await context()).adapter, user, activeOrganizationId)
+				};
+				return {
+					email: user.email,
+					...narrowClaims(claims, [activeRole, user.lastRole], Boolean(organizations))
+				};
+			}
+		},
+		disableSettingJwtHeader: true
+	};
 	const userFields = {
+		...userFieldsNamed(emailConfirmedField, users),
 		...organizations && userFieldsNamed(lastOrganizationField, users),
 		...metadataField(users)
 	};
@@ -105,26 +139,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				defaultRole: defaultRole ?? "unassigned",
 				roles: Object.fromEntries(roles.map((role) => [role, role === "admin" ? adminAc : userAc]))
 			}),
-			jwt({
-				schema: pluginNames.jwt,
-				jwt: {
-					expirationTime: tokenLifetime,
-					issuer: options.baseURL,
-					audience: options.baseURL,
-					definePayload: async ({ user, session }) => {
-						const { activeRole, activeOrganizationId } = session;
-						const claims = {
-							role: user.role,
-							...organizations && await organizationClaims((await context()).adapter, user, activeOrganizationId)
-						};
-						return {
-							email: user.email,
-							...narrowClaims(claims, [activeRole, user.lastRole], Boolean(organizations))
-						};
-					}
-				},
-				disableSettingJwtHeader: true
-			}),
+			jwt(jwtOptions),
 			twoFactorAfterPasswordOrCode({
 				schema: pluginNames.twoFactor,
 				allowPasswordless: true,
@@ -142,14 +157,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			...saml.length > 0 ? [samlPlugin(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
-			signInPolicyPlugin({
-				mail: Boolean(mailer),
-				socialProviders: [...Object.keys(options.socialProviders ?? {}), ...samlIds],
-				...operator && { operator: operator.name },
-				...signIn && { platformSignIn: {
-					provider: signIn.provider,
-					name: signIn.name
-				} }
+			signInPolicyPlugin(policy),
+			goTrueSessionsPlugin({
+				issuer: goTrueIssuer(options.baseURL),
+				jwt: jwtOptions,
+				policy
 			}),
 			staffSignInPlugin({
 				...operator && { operator },
@@ -182,27 +194,30 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...saml.length > 0 ? samlDisabledPaths : []
 		],
 		databaseHooks: {
-			user: { create: {
-				before: async (user, context) => {
-					const given = String(user.role ?? "").split(",").map((name) => name.trim()).filter(Boolean);
-					const unknown = given.find((name) => !roles.includes(name));
-					if (given.length === 0 || unknown !== void 0) throw new APIError("BAD_REQUEST", { message: `Choose a role for the new user: ${roles.join(", ")}` });
-					const samlProvider = context?.path === "/sso/saml2/sp/acs/:providerId" ? saml.find((provider) => provider.id === context.params?.providerId) : void 0;
-					if (samlProvider && !emailInDomains(user.email, samlProvider.domains)) throw new APIError("FORBIDDEN", {
-						code: "EMAIL_DOMAIN_NOT_ALLOWED",
-						message: "This address is not one the identity provider may sign up."
-					});
-					const withId = options.generateUserId ? {
-						...user,
-						id: await newUserId(options.generateUserId)
-					} : user;
-					return { data: context?.path === "/admin/create-user" || samlProvider ? {
-						...withId,
-						emailVerified: true
-					} : withId };
+			user: {
+				create: {
+					before: async (user, context) => {
+						const given = String(user.role ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+						const unknown = given.find((name) => !roles.includes(name));
+						if (given.length === 0 || unknown !== void 0) throw new APIError("BAD_REQUEST", { message: `Choose a role for the new user: ${roles.join(", ")}` });
+						const samlProvider = context?.path === "/sso/saml2/sp/acs/:providerId" ? saml.find((provider) => provider.id === context.params?.providerId) : void 0;
+						if (samlProvider && !emailInDomains(user.email, samlProvider.domains)) throw new APIError("FORBIDDEN", {
+							code: "EMAIL_DOMAIN_NOT_ALLOWED",
+							message: "This address is not one the identity provider may sign up."
+						});
+						const withId = options.generateUserId ? {
+							...user,
+							id: await newUserId(options.generateUserId)
+						} : user;
+						return { data: confirmedOnCreate(context?.path === "/admin/create-user" || samlProvider ? {
+							...withId,
+							emailVerified: true
+						} : withId, /* @__PURE__ */ new Date()) };
+					},
+					...options.onUserCreated && { after: options.onUserCreated }
 				},
-				...options.onUserCreated && { after: options.onUserCreated }
-			} },
+				update: { before: async (user) => ({ data: confirmedOnUpdate(user, /* @__PURE__ */ new Date()) }) }
+			},
 			...organizations && { session: sessionOrganizationHooks(context) }
 		},
 		rateLimit: {
@@ -308,6 +323,10 @@ const createAuth = (options) => {
 		passwordReset: Boolean(mailer),
 		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */
 		signUp: Boolean(signUpRole && mailer),
+		/** The role of accounts made by open sign-up, while it is offered. */
+		signUpRole: mailer ? signUpRole : void 0,
+		/** The app keeps each user's metadata, in the column `users.metadata` names. */
+		userMetadata: Boolean(options.users?.metadata),
 		socialProviders,
 		/** The app's name it signs in and mails as: `appName`, else `PROTOBASE_APP_NAME`, else `Protobase`. */
 		appName: appName ?? "Protobase",

package/dist/better-auth/email-confirmed.js

@@ -0,0 +1,31 @@
+//#region src/better-auth/email-confirmed.ts
+/** The user field that holds the time, in the `email_confirmed_at` column unless the app names it otherwise. */
+const emailConfirmedField = { emailConfirmedAt: {
+	type: "date",
+	required: false,
+	input: false,
+	fieldName: "email_confirmed_at"
+} };
+/** A new user, confirmed now when created verified. A time the data gives itself, such as an import's, is kept. */
+const confirmedOnCreate = (user, now) => user.emailConfirmedAt === void 0 && user.emailVerified === true ? {
+	...user,
+	emailConfirmedAt: now
+} : user;
+/**
+* An update, with the confirmation time it implies: now, when it verifies the address, which Better Auth does only for
+* one not verified yet; empty, when it changes the address without verifying it. A time the update gives is kept.
+*/
+const confirmedOnUpdate = (data, now) => {
+	if (data.emailConfirmedAt !== void 0) return data;
+	if (data.emailVerified === true) return {
+		...data,
+		emailConfirmedAt: now
+	};
+	if (data.email !== void 0) return {
+		...data,
+		emailConfirmedAt: null
+	};
+	return data;
+};
+//#endregion
+export { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField };

package/dist/better-auth/organizations/accept-invitation.js

@@ -1,6 +1,6 @@
-import { invalidInvitation, invitationIdOf, verifyInvitationToken } from "../invitations/invitation-token.js";
 import { parseAppRoles } from "./app-roles.js";
 import { findMember, membersOf } from "./store.js";
+import { invalidInvitation, invitationIdOf, verifyInvitationToken } from "../invitations/invitation-token.js";
 import { APIError } from "better-auth/api";
 //#region src/better-auth/organizations/accept-invitation.ts
 /** The pending invitation an emailed link's token names, or a 400 `INVITATION_INVALID`. */

package/dist/better-auth/organizations/app-roles.js

@@ -1,5 +1,5 @@
-import { parseRoles } from "../parse-roles.js";
 import { membershipRoles, noGlobalRole } from "./role-definitions.js";
+import { parseRoles } from "../parse-roles.js";
 //#region src/better-auth/organizations/app-roles.ts
 /** A user's global roles, from the admin plugin's `role` column; the placeholder `user` is none. */
 const globalRoles = (role) => parseRoles(role).filter((name) => name !== noGlobalRole);

package/dist/better-auth/organizations/options.js

@@ -1,5 +1,5 @@
-import { defaultInvitationUrl } from "../invitations/invitation-link-hook.js";
 import { membershipRoles } from "./role-definitions.js";
+import { defaultInvitationUrl } from "../invitations/invitation-link-hook.js";
 //#region src/better-auth/organizations/options.ts
 const resolveOrganizations = (options, definitions, baseURL) => {
 	const holdable = membershipRoles(definitions);

package/dist/better-auth/organizations/organization-plugin.js

@@ -1,7 +1,7 @@
-import { invitationLink, invitationToken } from "../invitations/invitation-token.js";
 import "./role-definitions.js";
 import { checkAppRoleChange, effectiveRoles, globalRoles, parseAppRoles } from "./app-roles.js";
 import { findMember } from "./store.js";
+import { invitationLink, invitationToken } from "../invitations/invitation-token.js";
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
 import { APIError } from "better-auth/api";
 import { organization } from "better-auth/plugins/organization";

package/dist/better-auth/organizations/session-organization.js

@@ -1,6 +1,6 @@
 import { globalRoles } from "./app-roles.js";
-import { initialOrganization } from "./active-organization.js";
 import { findMember, findOrganization, membershipsOf, organizationRoleOf, summaries } from "./store.js";
+import { initialOrganization } from "./active-organization.js";
 //#region src/better-auth/organizations/session-organization.ts
 /** The user field that keeps the organization someone last worked in, for their next sign-in. */
 const lastOrganizationField = { lastOrganizationId: {

package/dist/better-auth/passkey-plugin.js

@@ -1,10 +1,10 @@
 import { pluginNames } from "./snake-case-names.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
+import { generateRandomString } from "better-auth/crypto";
 import { PASSKEY_ERROR_CODES, passkey } from "@better-auth/passkey";
 import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
 import { setSessionCookie } from "better-auth/cookies";
-import { generateRandomString } from "better-auth/crypto";
 //#region src/better-auth/passkey-plugin.ts
 const challengeCookie = "better-auth-passkey";
 const challengeSeconds = 300;

package/dist/better-auth/policy-plugin.js

@@ -1,8 +1,8 @@
-import { isStaffSession } from "./staff-checks.js";
 import { effectiveSignInPolicy, missingRequiredMethods, parseSignInPolicy, signInPolicyProblem } from "./sign-in-policy.js";
 import { readSignInPolicy, saveSignInPolicy, signInPolicySchema } from "./policy-store.js";
 import { isPoliced, lastPasskeyRequired, policyRefusal, setupRequired } from "./sign-in-enforcement.js";
 import { adminOnly } from "./admin-only.js";
+import { isStaffSession } from "./staff-checks.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/policy-plugin.ts
@@ -31,14 +31,25 @@ const accountMethods = async (context, user, socialProviders) => {
 	};
 };
 const refuse = (status, refusal) => new APIError(status, refusal);
+const currentPolicy = async (context, mail) => effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail });
+const providersUnder = (policy, { socialProviders, platformSignIn }) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];
+/**
+* Why `user` gets no API token yet, or `undefined` when they may have one: the policy requires a method, such as
+* two-factor authentication, that their account has not set up. `read` is the effective policy, when read already.
+*/
+const tokenRefusal = async (context, user, options, read) => {
+	const policy = read ?? await currentPolicy(context, options.mail);
+	if (policy.twoFactor !== "required" && policy.passkey !== "required") return void 0;
+	const account = await accountMethods(context, user, providersUnder(policy, options));
+	return missingRequiredMethods(policy, account).length > 0 ? setupRequired : void 0;
+};
 /**
 * Protobase's sign-in policy as a Better Auth plugin: its table, the endpoints that read and change it, and a hook that
 * applies it to Better Auth's own endpoints. A method the policy turns off answers `403 SIGN_IN_METHOD_FORBIDDEN`;
 * someone without what it requires gets a session, so they can set it up, but no API token (`403 SIGN_IN_SETUP_REQUIRED`).
 */
-const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn }) => {
-	const currentPolicy = async (context) => effectiveSignInPolicy((await readSignInPolicy(context.adapter)).policy, { mail });
-	const providersUnder = (policy) => [...socialProviders, ...platformSignIn && policy.platformSignIn === "allowed" ? [platformSignIn.provider] : []];
+const signInPolicyPlugin = (options) => {
+	const { mail, operator, platformSignIn } = options;
 	const policyAdmin = adminOnly("Only an admin can change how people sign in.");
 	const policyAnswer = async (context) => {
 		const stored = await readSignInPolicy(context.adapter);
@@ -74,7 +85,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn })
 					message: "Choose one of the offered rules for every sign-in method."
 				});
 				const user = ctx.context.session.user;
-				const admin = await accountMethods(ctx.context, user, providersUnder(effectiveSignInPolicy(policy, { mail })));
+				const admin = await accountMethods(ctx.context, user, providersUnder(effectiveSignInPolicy(policy, { mail }), options));
 				const problem = signInPolicyProblem(policy, {
 					mail,
 					admin
@@ -94,8 +105,8 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn })
 				method: "GET",
 				use: [sessionMiddleware]
 			}, async (ctx) => {
-				const policy = await currentPolicy(ctx.context);
-				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, providersUnder(policy));
+				const policy = await currentPolicy(ctx.context, mail);
+				const { socialSignIn: _, ...account } = await accountMethods(ctx.context, ctx.context.session.user, providersUnder(policy, options));
 				return ctx.json({
 					policy,
 					mail,
@@ -112,7 +123,7 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn })
 					code: "SIGN_IN_CODES_ONLY",
 					message: "Only sign-in codes can be emailed."
 				});
-				const policy = await currentPolicy(ctx.context);
+				const policy = await currentPolicy(ctx.context, mail);
 				const refusal = policyRefusal(policy, {
 					path,
 					body: ctx.body,
@@ -124,9 +135,13 @@ const signInPolicyPlugin = ({ mail, socialProviders, operator, platformSignIn })
 				if (!(path === "/token" && (policy.twoFactor === "required" || policy.passkey === "required") || path === "/passkey/delete-passkey" && policy.passkey === "required")) return;
 				const session = await getSessionFromCtx(ctx);
 				if (!session || isStaffSession(session.session)) return;
-				const account = await accountMethods(ctx.context, session.user, providersUnder(policy));
-				if (path === "/token" && missingRequiredMethods(policy, account).length > 0) throw refuse("FORBIDDEN", setupRequired);
-				if (path === "/passkey/delete-passkey" && account.passkeys <= 1) throw refuse("FORBIDDEN", lastPasskeyRequired);
+				const user = session.user;
+				if (path === "/token") {
+					const refusal = await tokenRefusal(ctx.context, user, options, policy);
+					if (refusal) throw refuse("FORBIDDEN", refusal);
+					return;
+				}
+				if ((await accountMethods(ctx.context, user, providersUnder(policy, options))).passkeys <= 1) throw refuse("FORBIDDEN", lastPasskeyRequired);
 			})
 		}] }
 	};
@@ -144,4 +159,4 @@ const vouchForCreatedAccount = async (context, email) => {
 	await context.internalAdapter.updateUser(found.user.id, { emailVerified: true });
 };
 //#endregion
-export { signInPolicyPlugin };
+export { signInPolicyPlugin, tokenRefusal };

package/dist/better-auth/roles/active-role.js

@@ -1,5 +1,5 @@
-import { parseRoles } from "../parse-roles.js";
 import { noGlobalRole } from "../organizations/role-definitions.js";
+import { parseRoles } from "../parse-roles.js";
 import { globalRoles } from "../organizations/app-roles.js";
 //#region src/better-auth/roles/active-role.ts
 /**

package/dist/better-auth/sign-up/sign-up-account.js

@@ -0,0 +1,26 @@
+import { APIError } from "better-auth/api";
+//#region src/better-auth/sign-up/sign-up-account.ts
+/** Makes the account of someone who proved their address with a sign-up code: verified, with the sign-up role. */
+const createSignedUpAccount = async (context, { email, name, role, passwordHash, metadata }) => {
+	const { internalAdapter } = context;
+	if (await internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", {
+		code: "ACCOUNT_EXISTS",
+		message: "This address has an account already: sign in instead."
+	});
+	const user = await internalAdapter.createUser({
+		email,
+		name,
+		emailVerified: true,
+		role,
+		...metadata && { metadata }
+	}, { method: "sign-up" });
+	if (passwordHash !== void 0) await internalAdapter.linkAccount({
+		userId: user.id,
+		providerId: "credential",
+		accountId: user.id,
+		password: passwordHash
+	});
+	return user;
+};
+//#endregion
+export { createSignedUpAccount };

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -1,7 +1,8 @@
-import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
 import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
+import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
 import { checkNewAccountPassword } from "../new-account-password.js";
+import { createSignedUpAccount } from "./sign-up-account.js";
 import { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime } from "./sign-up-code.js";
 import { consumeSignUpTicket, issueSignUpTicket } from "./sign-up-ticket.js";
 import * as z$1 from "zod";
@@ -79,21 +80,12 @@ const signUpPlugin = ({ role, mail }) => ({
 			if (await adapter.count({ model: "user" }) === 0) throw noAdminYet();
 			checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(adapter)).policy, { mail: true }), password);
 			const email = await consumeSignUpTicket(ctx.context, ticket);
-			if (await internalAdapter.findUserByEmail(email)) throw new APIError("BAD_REQUEST", {
-				code: "ACCOUNT_EXISTS",
-				message: "This address has an account already: sign in instead."
-			});
-			const user = await internalAdapter.createUser({
+			const passwordHash = password === void 0 ? void 0 : await ctx.context.password.hash(password);
+			const user = await createSignedUpAccount(ctx.context, {
 				email,
 				name,
-				emailVerified: true,
-				role
-			}, { method: "sign-up" });
-			if (password !== void 0) await internalAdapter.linkAccount({
-				userId: user.id,
-				providerId: "credential",
-				accountId: user.id,
-				password: await ctx.context.password.hash(password)
+				role,
+				...passwordHash !== void 0 && { passwordHash }
 			});
 			const session = await internalAdapter.createSession(user.id, false);
 			await setSessionCookie(ctx, {