@supertokens-plugins/rownd-nodejs 0.2.1 → 0.3.0-beta.0

package/dist/index.mjs

@@ -665,6 +665,39 @@ var PLUGIN_ID = "supertokens-plugin-rownd";
 var PLUGIN_SDK_VERSION = ["23.0.0", "23.0.1", ">=23.0.1"];
 var HANDLE_BASE_PATH = "/plugin/rownd";
 var PUBLIC_TENANT_ID = "public";
+var GUEST_AUTH_METHOD_ID = "guest";
+var ANONYMOUS_AUTH_METHOD_ID = "anonymous";
+var ROWND_JWT_CLAIMS = {
+  AppUserId: "https://auth.rownd.io/app_user_id",
+  IsVerifiedUser: "https://auth.rownd.io/is_verified_user",
+  IsAnonymous: "https://auth.rownd.io/is_anonymous",
+  IssuedOffline: "https://auth.rownd.io/issued_offline",
+  JwtType: "https://auth.rownd.io/jwt_type",
+  PlatformJwt: "https://auth.rownd.io/platform_jwt",
+  AuthLevel: "https://auth.rownd.io/auth_level"
+};
+var DEFAULT_ROWND_SCHEMA = {
+  zip_code: {
+    display_name: "Zip code",
+    type: "string",
+    user_visible: true
+  },
+  last_name: {
+    display_name: "Last name",
+    type: "string",
+    user_visible: true
+  },
+  nick_name: {
+    display_name: "Nick name",
+    type: "string",
+    user_visible: true
+  },
+  first_name: {
+    display_name: "First name",
+    type: "string",
+    user_visible: true
+  }
+};
 
 // src/logger.ts
 var { logDebugMessage, enableDebugLogs } = buildLogger(
@@ -672,9 +705,6 @@ var { logDebugMessage, enableDebugLogs } = buildLogger(
   PLUGIN_SDK_VERSION
 );
 
-// src/plugin.ts
-import Session from "supertokens-node/recipe/session";
-
 // src/telemetry/axiomTelemetryClient.ts
 var DEFAULT_AXIOM_URL = "https://api.axiom.co/v1/datasets";
 var AxiomTelemetryClient = class {
@@ -789,6 +819,17 @@ function safeRecordEvent(client, event, outcome) {
   }
 }
 
+// src/pluginImplementation.ts
+import { randomUUID } from "crypto";
+import SuperTokens from "supertokens-node";
+import AccountLinking from "supertokens-node/recipe/accountlinking";
+import EmailVerification from "supertokens-node/recipe/emailverification";
+import Passwordless from "supertokens-node/recipe/passwordless";
+import Session from "supertokens-node/recipe/session";
+import { BooleanClaim } from "supertokens-node/recipe/session/claims";
+import ThirdParty from "supertokens-node/recipe/thirdparty";
+import UserMetadata2 from "supertokens-node/recipe/usermetadata";
+
 // src/errors.ts
 var ROWND_PLUGIN_ERROR_MESSAGES = {
   MISSING_AUTHORIZATION_HEADER: "Missing authorization header",
@@ -802,7 +843,26 @@ var RowndPluginError = class extends Error {
 };
 
 // src/pluginImplementation.ts
+function rewriteLinkPath(inputUrl, targetPath, searchParams) {
+  try {
+    const url = new URL(inputUrl);
+    url.pathname = `/${targetPath.replace(/^\//, "")}`;
+    for (const [key, value] of Object.entries(searchParams ?? {})) {
+      url.searchParams.set(key, value);
+    }
+    return url.toString();
+  } catch {
+    const [path = inputUrl, query = ""] = inputUrl.replace(/auth\/verify[^?]*/, targetPath).split("?");
+    const params = new URLSearchParams(query);
+    for (const [key, value] of Object.entries(searchParams ?? {})) {
+      params.set(key, value);
+    }
+    const queryString = params.toString();
+    return queryString ? `${path}?${queryString}` : path;
+  }
+}
 var rowndClient;
+var pluginConfig;
 function setRowndClient(client) {
   rowndClient = client;
 }
@@ -812,6 +872,9 @@ function getRowndClient() {
   }
   return rowndClient;
 }
+function setPluginConfig(config2) {
+  pluginConfig = config2;
+}
 async function parseRequest(req) {
   const authHeader = req.getHeaderValue("authorization");
   if (!authHeader) {
@@ -825,6 +888,403 @@ async function parseRequest(req) {
     token
   };
 }
+function handleGetAppConfig(deps) {
+  return async (req) => {
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    const appConfig = buildAppConfig(
+      deps.pluginConfig,
+      deps.stConfig,
+      appVariantId
+    );
+    if (!appConfig) {
+      return {
+        status: "ERROR",
+        message: `Unknown Rownd app variant: ${appVariantId}`
+      };
+    }
+    return {
+      status: "OK",
+      ...appConfig
+    };
+  };
+}
+function handleGuestLogin(deps) {
+  return async (req, res, _session, userContext) => {
+    const startedAt = Date.now();
+    const guestId = `guest_${randomUUID()}`;
+    try {
+      const body = parseGuestBody(await getJsonBody(req));
+      const appVariantId = getRequestedAppVariantIdFromRequest(req);
+      assertRowndAppVariantIsConfigured(appVariantId);
+      const thirdPartyId = body.authLevel === ANONYMOUS_AUTH_METHOD_ID ? ANONYMOUS_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
+      const thirdPartyUserId = thirdPartyId === ANONYMOUS_AUTH_METHOD_ID ? `anon_${randomUUID()}` : guestId;
+      const response = await ThirdParty.manuallyCreateOrUpdateUser(
+        PUBLIC_TENANT_ID,
+        thirdPartyId,
+        thirdPartyUserId,
+        `${thirdPartyUserId}@anonymous.local`,
+        false,
+        void 0,
+        userContext
+      );
+      if (response.status !== "OK") {
+        throw new Error(
+          `Guest user creation failed with status: ${response.status}`
+        );
+      }
+      await Session.createNewSession(
+        req,
+        res,
+        PUBLIC_TENANT_ID,
+        response.recipeUserId,
+        {
+          ...buildRowndAudience({}, appVariantId),
+          auth_level: GUEST_AUTH_METHOD_ID,
+          is_anonymous: true,
+          app_user_id: response.user.id
+        },
+        {},
+        userContext
+      );
+      logDebugMessage(`Guest session created for user: ${response.user.id}`);
+      deps.telemetryClient.recordSuccess({
+        outcome: "success",
+        durationMs: Date.now() - startedAt,
+        tenantId: PUBLIC_TENANT_ID,
+        superTokensUserId: response.user.id
+      });
+      return {
+        status: "OK",
+        createdNewRecipeUser: response.createdNewRecipeUser
+      };
+    } catch (error) {
+      logDebugMessage(`Guest login failed. Error: ${getErrorMessage(error)}`);
+      deps.telemetryClient.recordError({
+        error,
+        startedAt,
+        tenantId: PUBLIC_TENANT_ID
+      });
+      return {
+        status: "ERROR",
+        message: "Guest login failed"
+      };
+    }
+  };
+}
+function handleMigrate(deps) {
+  return async (req, res, _session, userContext) => {
+    const startedAt = Date.now();
+    let tenantId = PUBLIC_TENANT_ID;
+    let rowndUserId;
+    let superTokensUserId;
+    let user;
+    let recipeUserId;
+    try {
+      if (!deps.stConfig.supertokens) {
+        throw new Error("Supertokens config not found");
+      }
+      const parsed = await parseRequest(req);
+      const appVariantId = getRequestedAppVariantIdFromRequest(req);
+      assertRowndAppVariantIsConfigured(appVariantId);
+      rowndUserId = await validateRowndToken(parsed.token);
+      user = await SuperTokens.getUser(rowndUserId, userContext);
+      if (!user) {
+        const rowndUser = await fetchRowndUserInfo(rowndUserId);
+        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        try {
+          const importedUser = await importUser(
+            stUserImport,
+            deps.stConfig.supertokens
+          );
+          superTokensUserId = importedUser.id;
+          if (importedUser.loginMethods[0]?.recipeUserId) {
+            recipeUserId = SuperTokens.convertToRecipeUserId(
+              importedUser.loginMethods[0].recipeUserId
+            );
+          }
+        } catch (err) {
+          user = await SuperTokens.getUser(rowndUserId, userContext);
+          if (!user) {
+            throw err;
+          }
+          superTokensUserId = user.id;
+          recipeUserId = user.loginMethods[0]?.recipeUserId;
+          logDebugMessage(
+            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          );
+        }
+        logDebugMessage(
+          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+        );
+      } else {
+        superTokensUserId = user.id;
+        recipeUserId = user.loginMethods[0]?.recipeUserId;
+        logDebugMessage(
+          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+        );
+      }
+      if (superTokensUserId) {
+        await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
+      }
+      if (!recipeUserId) {
+        throw new Error("User not found or has no login methods");
+      }
+      await Session.createNewSession(
+        req,
+        res,
+        PUBLIC_TENANT_ID,
+        recipeUserId,
+        {
+          ...buildRowndAudience({}, appVariantId)
+        },
+        {},
+        userContext
+      );
+      logDebugMessage(
+        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+      );
+      deps.telemetryClient.recordSuccess({
+        outcome: "success",
+        durationMs: Date.now() - startedAt,
+        tenantId,
+        rowndUserId,
+        superTokensUserId
+      });
+      return { status: "OK" };
+    } catch (error) {
+      logDebugMessage(`Migration failed. Error: ${getErrorMessage(error)}`);
+      deps.telemetryClient.recordError({
+        error,
+        startedAt,
+        tenantId,
+        rowndUserId,
+        superTokensUserId
+      });
+      return {
+        status: "ERROR",
+        message: error instanceof RowndPluginError ? error.message : "Migration failed"
+      };
+    }
+  };
+}
+function handleGetUser() {
+  return async (_req, _res, maybeSession) => {
+    const session = requireSession(maybeSession);
+    return {
+      status: "OK",
+      ...await getUserById(session.getUserId())
+    };
+  };
+}
+function handleUpdateUser() {
+  return async (req, _res, maybeSession, userContext) => {
+    const session = requireSession(maybeSession);
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    assertRowndAppVariantIsConfigured(appVariantId);
+    const payload = parseUpdateUserBody(await getJsonBody(req));
+    const inputData = payload.data ?? {};
+    const requestUserContext = {
+      ...userContext,
+      ...payload.context
+    };
+    const { email, ...dataWithoutEmail } = inputData;
+    const hasEmailUpdate = hasOwn(inputData, "email") && typeof email === "string";
+    const permissionError = validateWritableFields(
+      Object.keys(dataWithoutEmail)
+    );
+    if (permissionError) {
+      return permissionError;
+    }
+    if (Object.keys(dataWithoutEmail).length > 0) {
+      await updateUserData(session.getUserId(), dataWithoutEmail);
+    }
+    if (hasEmailUpdate) {
+      return {
+        status: "OK",
+        ...await startPendingEmailVerification({
+          userId: session.getUserId(),
+          recipeUserId: session.getRecipeUserId(),
+          tenantId: session.getTenantId(),
+          email,
+          pendingVerificationId: randomUUID(),
+          userContext: appVariantId ? { ...requestUserContext, rowndAppVariantId: appVariantId } : requestUserContext
+        })
+      };
+    }
+    return {
+      status: "OK",
+      ...await getUserById(session.getUserId())
+    };
+  };
+}
+function handleDeleteUser() {
+  return async (_req, _res, maybeSession) => {
+    const session = requireSession(maybeSession);
+    await SuperTokens.deleteUser(session.getUserId(), true);
+    return { status: "OK" };
+  };
+}
+function handleSignOut() {
+  return async (_req, _res, maybeSession, userContext) => {
+    const session = requireSession(maybeSession);
+    await Session.revokeAllSessionsForUser(
+      session.getUserId(),
+      true,
+      session.getTenantId(),
+      userContext
+    );
+    return { status: "OK" };
+  };
+}
+function handleGetUserMeta() {
+  return async (_req, _res, maybeSession) => {
+    const session = requireSession(maybeSession);
+    const metadata = await getUserMetadata(session.getUserId());
+    return {
+      status: "OK",
+      id: session.getUserId(),
+      meta: Object.fromEntries(
+        Object.entries(metadata).filter(
+          ([key]) => !isInternalMetadataField(key)
+        )
+      )
+    };
+  };
+}
+function handleUpdateUserMeta() {
+  return async (req, _res, maybeSession) => {
+    const session = requireSession(maybeSession);
+    const payload = parseUpdateMetaBody(await getJsonBody(req));
+    const internalField = Object.keys(payload.meta ?? {}).find(
+      isInternalMetadataField
+    );
+    if (internalField) {
+      return {
+        status: "ERROR",
+        code: 403,
+        message: `field is not writable: ${internalField}`
+      };
+    }
+    return {
+      status: "OK",
+      ...await updateUserMetadata(session.getUserId(), payload.meta ?? {})
+    };
+  };
+}
+function handleGetUserField() {
+  return async (req, _res, maybeSession) => {
+    const session = requireSession(maybeSession);
+    const field = req.getKeyValueFromQuery("field");
+    if (!field) {
+      return missingFieldResponse();
+    }
+    const user = await getUserById(session.getUserId());
+    return {
+      status: "OK",
+      value: user.data[field]
+    };
+  };
+}
+function handleUpdateUserField() {
+  return async (req, _res, maybeSession, userContext) => {
+    const session = requireSession(maybeSession);
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    assertRowndAppVariantIsConfigured(appVariantId);
+    const field = req.getKeyValueFromQuery("field");
+    if (!field) {
+      return missingFieldResponse();
+    }
+    const payload = parseUpdateFieldBody(await getJsonBody(req));
+    if (field === "email" && typeof payload.value === "string") {
+      return {
+        status: "OK",
+        ...await startPendingEmailVerification({
+          userId: session.getUserId(),
+          recipeUserId: session.getRecipeUserId(),
+          tenantId: session.getTenantId(),
+          email: payload.value,
+          pendingVerificationId: randomUUID(),
+          userContext: appVariantId ? { ...userContext, rowndAppVariantId: appVariantId } : userContext
+        })
+      };
+    }
+    const permissionError = validateWritableFields([field]);
+    if (permissionError) {
+      return permissionError;
+    }
+    return {
+      status: "OK",
+      ...await updateUserData(session.getUserId(), {
+        [field]: payload.value
+      })
+    };
+  };
+}
+function requireSession(session) {
+  if (!session) {
+    throw new Error("Session not found");
+  }
+  return session;
+}
+async function getJsonBody(req) {
+  return req.getJSONBody();
+}
+function parseGuestBody(value) {
+  if (!isJsonRecord(value)) {
+    return {};
+  }
+  return {
+    authLevel: typeof value.auth_level === "string" ? value.auth_level : void 0
+  };
+}
+function parseUpdateUserBody(value) {
+  if (!isJsonRecord(value) || !isJsonRecord(value.data)) {
+    return {};
+  }
+  return {
+    data: value.data,
+    ...isJsonRecord(value.context) ? { context: value.context } : {}
+  };
+}
+function parseUpdateMetaBody(value) {
+  if (!isJsonRecord(value) || !isJsonRecord(value.meta)) {
+    return {};
+  }
+  return { meta: value.meta };
+}
+function parseUpdateFieldBody(value) {
+  if (!isJsonRecord(value) || !hasOwn(value, "value")) {
+    return {};
+  }
+  return { value: value.value };
+}
+function validateWritableFields(fields) {
+  const readOnlyField = fields.find((field) => !canUpdateUserDataField(field));
+  if (!readOnlyField) {
+    return void 0;
+  }
+  return {
+    status: "ERROR",
+    code: 403,
+    message: `field is not writable: ${readOnlyField}`
+  };
+}
+function missingFieldResponse() {
+  return {
+    status: "ERROR",
+    code: 400,
+    message: "field is required"
+  };
+}
+function isJsonRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : "Unknown error";
+}
 function mapRowndUserToSuperTokens(rowndUser) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
@@ -863,34 +1323,26 @@ function mapRowndUserToSuperTokens(rowndUser) {
       isVerified: !!rowndUserVerifiedData.phone_number
     });
   }
-  if (rowndUserData.email && loginMethods.length === 0) {
+  if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
     loginMethods.push({
       recipeId: "passwordless",
       email: rowndUserData.email,
       isVerified: !!rowndUserVerifiedData.email
     });
   }
+  let authLevel = rowndUser.auth_level;
   if (loginMethods.length === 0) {
-    throw new Error("No valid login methods found in Rownd user data");
+    const thirdPartyId = authLevel === GUEST_AUTH_METHOD_ID ? GUEST_AUTH_METHOD_ID : ANONYMOUS_AUTH_METHOD_ID;
+    if (!authLevel) authLevel = thirdPartyId;
+    loginMethods.push({
+      recipeId: "thirdparty",
+      thirdPartyId,
+      thirdPartyUserId: rowndUserData.user_id,
+      email: `${rowndUserData.user_id}@anonymous.local`,
+      isVerified: false
+    });
   }
-  const rowndUserMeta = rowndUser.meta || {};
-  const rowndUserAttributes = rowndUser.attributes || {};
-  const userMetadata = {
-    data: {
-      ...rowndUserData
-    },
-    meta: {
-      ...rowndUserMeta
-    },
-    verified_data: {
-      ...rowndUserVerifiedData
-    },
-    attributes: {
-      ...rowndUserAttributes
-    },
-    rownd_migrated: true,
-    rownd_user_id: rowndUserData.user_id
-  };
+  const userMetadata = buildRowndUserMetadata(rowndUser);
   return {
     externalUserId: rowndUserData.user_id,
     loginMethods,
@@ -936,17 +1388,961 @@ async function fetchRowndUserInfo(userId) {
   }
   return rowndUser;
 }
+var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
+  "user_id",
+  "email",
+  "phone_number",
+  "google_id",
+  "apple_id"
+]);
+var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
+  "original_rownd_user",
+  "rownd_pending_verification"
+]);
+function isIdentityField(field) {
+  return IDENTITY_USER_DATA_FIELDS.has(field);
+}
+function isInternalMetadataField(field) {
+  return INTERNAL_METADATA_FIELDS.has(field);
+}
+function getStringList(value) {
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string");
+  }
+  return typeof value === "string" ? [value] : [];
+}
+function getRequestedAppVariantIdFromRequest(req) {
+  return req.getKeyValueFromQuery("app_variant_id");
+}
+function getRequestedDisplayContextFromRequest(req) {
+  const displayContext = req.getKeyValueFromQuery("rownd_display_context");
+  return displayContext === "browser" || displayContext === "mobile_app" || displayContext === "customer_web_view" ? displayContext : void 0;
+}
+function getRequestedRedirectToPathFromRequest(req) {
+  const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
+  return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
+}
+function assertRowndAppVariantIsConfigured(appVariantId) {
+  if (!appVariantId) {
+    return;
+  }
+  if (pluginConfig?.subBrands && !pluginConfig.subBrands[appVariantId]) {
+    throw new Error(`Unknown Rownd app variant: ${appVariantId}`);
+  }
+}
+async function recordRowndAppVariantForUser(userId, appVariantId) {
+  if (!appVariantId) {
+    return;
+  }
+  assertRowndAppVariantIsConfigured(appVariantId);
+  const metadata = await getUserMetadata(userId);
+  const originalRowndUser = isJsonRecord(metadata.original_rownd_user) ? metadata.original_rownd_user : {};
+  const attributes = isJsonRecord(originalRowndUser.attributes) ? originalRowndUser.attributes : {};
+  const appVariants = getStringList(attributes["rownd:app_variants"]);
+  if (appVariants.includes(appVariantId)) {
+    return;
+  }
+  await UserMetadata2.updateUserMetadata(userId, {
+    ...metadata,
+    original_rownd_user: {
+      ...originalRowndUser,
+      data: isJsonRecord(originalRowndUser.data) ? originalRowndUser.data : { user_id: userId },
+      verified_data: isJsonRecord(originalRowndUser.verified_data) ? originalRowndUser.verified_data : {},
+      attributes: {
+        ...attributes,
+        "rownd:app_variants": [...appVariants, appVariantId]
+      }
+    }
+  });
+}
+function buildRowndUserMetadata(rowndUser) {
+  const metadata = {
+    ...rowndUser.meta || {},
+    original_rownd_user: rowndUser
+  };
+  for (const [key, value] of Object.entries(rowndUser.data || {})) {
+    if (!isIdentityField(key) && value !== void 0) {
+      metadata[key] = value;
+    }
+  }
+  return metadata;
+}
+var RowndIsAnonymousClaim = new BooleanClaim({
+  key: "is_anonymous",
+  fetchValue: async (userId) => {
+    const user = await SuperTokens.getUser(userId);
+    const effectiveAuthLevel = getEffectiveAuthLevel(user);
+    return effectiveAuthLevel === GUEST_AUTH_METHOD_ID;
+  }
+});
+async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId) {
+  const user = await SuperTokens.getUser(userId);
+  const metadata = user ? await getUserMetadata(user.id) : void 0;
+  const originalRowndUser = metadata?.original_rownd_user;
+  const verifiedData = originalRowndUser?.verified_data;
+  const authLevel = getEffectiveAuthLevel(
+    user,
+    originalRowndUser?.auth_level,
+    verifiedData
+  );
+  const appUserId = getRowndAppUserId(userId, user, currentPayload, metadata);
+  const isAnonymous = authLevel === GUEST_AUTH_METHOD_ID;
+  const anonymousId = getAnonymousId(userId, user, metadata);
+  const isVerifiedUser = authLevel !== "unverified";
+  const audience = buildRowndAudience(currentPayload, appVariantId);
+  const configuredClaims = buildConfiguredSessionClaims(metadata);
+  return {
+    ...audience,
+    ...configuredClaims,
+    app_user_id: appUserId,
+    auth_level: authLevel,
+    is_verified_user: isVerifiedUser,
+    [ROWND_JWT_CLAIMS.AppUserId]: appUserId,
+    [ROWND_JWT_CLAIMS.AuthLevel]: authLevel,
+    [ROWND_JWT_CLAIMS.IsVerifiedUser]: isVerifiedUser,
+    [ROWND_JWT_CLAIMS.IsAnonymous]: isAnonymous,
+    ...anonymousId ? { anonymous_id: anonymousId } : {}
+  };
+}
+function buildConfiguredSessionClaims(metadata) {
+  if (!metadata) {
+    return {};
+  }
+  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
+  const claims = {};
+  for (const [key, field] of Object.entries(schema)) {
+    if (field.include_in_session_claims !== true) {
+      continue;
+    }
+    const value = metadata.original_rownd_user?.data?.[key] ?? metadata[key];
+    if (value !== void 0) {
+      claims[field.session_claim_name || key] = value;
+    }
+  }
+  return claims;
+}
+function getRowndAppUserId(userId, user, currentPayload, metadata) {
+  const originalUserId = metadata?.original_rownd_user?.data?.user_id;
+  if (typeof originalUserId === "string") {
+    return originalUserId;
+  }
+  if (typeof currentPayload.app_user_id === "string") {
+    return currentPayload.app_user_id;
+  }
+  return user?.id || userId;
+}
+function buildRowndAudience(currentPayload, appVariantId) {
+  const audience = getStringList(currentPayload.aud);
+  const appId = pluginConfig?.appConfig?.id;
+  if (appId) {
+    audience.push(`app:${appId}`);
+  }
+  if (appVariantId) {
+    audience.push(`app_variant:${appVariantId}`);
+  }
+  return audience.length > 0 ? { aud: [...new Set(audience)] } : {};
+}
+function getAnonymousId(userId, user, metadata) {
+  const originalAnonymousId = metadata?.original_rownd_user?.data?.anonymous_id;
+  if (typeof originalAnonymousId === "string") {
+    return originalAnonymousId;
+  }
+  const anonymousMethod = user?.loginMethods.find((loginMethod) => {
+    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
+  });
+  const thirdPartyUserId = anonymousMethod ? getThirdPartyUserId(anonymousMethod) : void 0;
+  return thirdPartyUserId || (hasAnonymousLoginMethod(user) ? `anon_${userId}` : void 0);
+}
+async function shouldLinkRowndAccounts(input) {
+  const [newAccountInfo, , session] = input;
+  if (!session) {
+    return void 0;
+  }
+  const currentUser = await SuperTokens.getUser(session.getUserId());
+  if (hasOnlyGuestLoginMethods(currentUser)) {
+    return {
+      shouldAutomaticallyLink: true,
+      shouldRequireVerification: false
+    };
+  }
+  if (!currentUser || isGuestAccountInfo(newAccountInfo)) {
+    return void 0;
+  }
+  if (doesAccountInfoMatchAuthMethod(currentUser, newAccountInfo)) {
+    return {
+      shouldAutomaticallyLink: true,
+      shouldRequireVerification: true
+    };
+  }
+  return void 0;
+}
+async function getUserMetadata(userId) {
+  const metadata = await UserMetadata2.getUserMetadata(userId);
+  return metadata.metadata || {};
+}
+function getPendingVerifications(metadata) {
+  const pendingVerification = metadata.rownd_pending_verification;
+  if (Array.isArray(pendingVerification)) {
+    return pendingVerification.filter(isPendingVerification);
+  }
+  return [];
+}
+function isPendingVerification(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
+}
+async function getUserById(userId) {
+  const metadata = await getUserMetadata(userId);
+  const stUser = await SuperTokens.getUser(userId);
+  if (!stUser) {
+    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
+  }
+  const originalRowndUser = metadata.original_rownd_user;
+  const rowndUser = originalRowndUser?.data?.user_id || userId;
+  const state = originalRowndUser?.state || "enabled";
+  const dataFieldKeys = /* @__PURE__ */ new Set();
+  const data = {
+    user_id: userId
+  };
+  for (const [key, value] of Object.entries(originalRowndUser?.data || {})) {
+    if (!isIdentityField(key)) {
+      data[key] = value;
+      dataFieldKeys.add(key);
+    }
+  }
+  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
+  for (const key of Object.keys(schema)) {
+    dataFieldKeys.add(key);
+    if (!isInternalMetadataField(key) && !isIdentityField(key) && metadata[key] !== void 0) {
+      data[key] = metadata[key];
+    }
+  }
+  const verifiedData = {
+    ...originalRowndUser?.verified_data || {}
+  };
+  let lastUsedAt = stUser.timeJoined;
+  for (const method of stUser.loginMethods) {
+    if (typeof method.lastUsed === "number" && method.lastUsed > lastUsedAt) {
+      lastUsedAt = method.lastUsed;
+    }
+    if (method.recipeId === "passwordless") {
+      if (method.email) {
+        verifiedData.email = method.email;
+        if (data.email === void 0) data.email = method.email;
+      }
+      if (method.phoneNumber) {
+        verifiedData.phone_number = method.phoneNumber;
+        if (data.phone_number === void 0)
+          data.phone_number = method.phoneNumber;
+      }
+    } else if (method.recipeId === "thirdparty") {
+      const thirdPartyId = getThirdPartyId(method);
+      const thirdPartyUserId = getThirdPartyUserId(method);
+      if (method.verified && method.email) {
+        verifiedData.email = method.email;
+      }
+      if (method.email && data.email === void 0) {
+        data.email = method.email;
+      }
+      if (thirdPartyId === "google" && thirdPartyUserId) {
+        data.google_id = thirdPartyUserId;
+        verifiedData.google_id = thirdPartyUserId;
+      }
+      if (thirdPartyId === "apple" && thirdPartyUserId) {
+        data.apple_id = thirdPartyUserId;
+        verifiedData.apple_id = thirdPartyUserId;
+      }
+    } else if (method.recipeId === "emailpassword") {
+      if (method.email && data.email === void 0) {
+        data.email = method.email;
+      }
+    }
+  }
+  if (verifiedData.email === true && typeof data.email === "string") {
+    verifiedData.email = data.email;
+  }
+  if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
+    verifiedData.phone_number = data.phone_number;
+  }
+  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
+  if (anonymousId && data.anonymous_id === void 0) {
+    data.anonymous_id = anonymousId;
+  }
+  const authLevel = getEffectiveAuthLevel(
+    stUser,
+    originalRowndUser?.auth_level,
+    verifiedData
+  );
+  for (const [key, field] of Object.entries(schema)) {
+    if (data[key] === void 0 && field.type === "string") {
+      data[key] = "";
+    }
+  }
+  const mapMethod = (method) => {
+    if (method.recipeId === "thirdparty") {
+      if (getThirdPartyId(method) === "google") return "google";
+      if (getThirdPartyId(method) === "apple") return "apple";
+    } else if (method.recipeId === "passwordless") {
+      if (method.email) return "email";
+      if (method.phoneNumber) return "phone";
+    } else if (method.recipeId === "emailpassword") {
+      return "email";
+    }
+    return "email";
+  };
+  const sortedByJoined = [...stUser.loginMethods].sort(
+    (a, b) => a.timeJoined - b.timeJoined
+  );
+  const sortedByLastUsed = [
+    ...stUser.loginMethods
+  ].sort((a, b) => (b.lastUsed || b.timeJoined) - (a.lastUsed || a.timeJoined));
+  const firstMethod = sortedByJoined[0];
+  const lastMethod = sortedByLastUsed[0];
+  const metadataMeta = Object.fromEntries(
+    Object.entries(metadata).filter(
+      ([key]) => !isInternalMetadataField(key) && !dataFieldKeys.has(key)
+    )
+  );
+  const meta = {
+    ...metadataMeta,
+    created: new Date(stUser.timeJoined).toISOString(),
+    first_sign_in: new Date(stUser.timeJoined).toISOString(),
+    last_sign_in: new Date(lastUsedAt).toISOString(),
+    last_active: new Date(lastUsedAt).toISOString(),
+    first_sign_in_method: firstMethod ? mapMethod(firstMethod) : "email",
+    last_sign_in_method: lastMethod ? mapMethod(lastMethod) : "email"
+  };
+  return {
+    rownd_user: rowndUser,
+    data,
+    meta,
+    verified_data: verifiedData,
+    state,
+    auth_level: authLevel,
+    redacted: [],
+    groups: originalRowndUser?.groups || [],
+    attributes: originalRowndUser?.attributes || {}
+  };
+}
+async function updateUserData(userId, inputData) {
+  const metadata = await getUserMetadata(userId);
+  const updatedMetadata = {
+    ...metadata,
+    ...inputData
+  };
+  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
+  return getUserById(userId);
+}
+async function startPendingEmailVerification(input) {
+  const metadata = await getUserMetadata(input.userId);
+  const currentEmail = (await getUserById(input.userId)).data.email;
+  if (currentEmail === input.email) {
+    return getUserById(input.userId);
+  }
+  const pendingVerifications = getPendingVerifications(metadata);
+  const pendingEmailVerifications = pendingVerifications.filter(
+    (pendingVerification2) => pendingVerification2.field === "email"
+  );
+  for (const pendingVerification2 of pendingEmailVerifications) {
+    await EmailVerification.revokeEmailVerificationTokens(
+      input.tenantId,
+      input.recipeUserId,
+      pendingVerification2.value,
+      input.userContext
+    );
+  }
+  const pendingVerification = {
+    id: input.pendingVerificationId,
+    field: "email",
+    value: input.email,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await UserMetadata2.updateUserMetadata(input.userId, {
+    ...metadata,
+    rownd_pending_verification: [
+      ...pendingVerifications.filter(
+        (pendingVerification2) => pendingVerification2.field !== "email"
+      ),
+      pendingVerification
+    ]
+  });
+  const response = await EmailVerification.sendEmailVerificationEmail(
+    input.tenantId,
+    input.userId,
+    input.recipeUserId,
+    input.email,
+    {
+      ...input.userContext,
+      rowndPendingVerificationId: pendingVerification.id
+    }
+  );
+  if (response.status === "EMAIL_ALREADY_VERIFIED_ERROR") {
+    await completePendingEmailVerification({
+      recipeUserId: input.recipeUserId,
+      email: input.email,
+      userContext: input.userContext
+    });
+  }
+  return getUserById(input.userId);
+}
+async function completePendingEmailVerification(input) {
+  const user = await SuperTokens.getUser(
+    input.recipeUserId.getAsString(),
+    input.userContext
+  );
+  const userId = user?.id ?? input.recipeUserId.getAsString();
+  const metadata = await getUserMetadata(userId);
+  const pendingVerifications = getPendingVerifications(metadata);
+  const pendingVerification = pendingVerifications.find(
+    (pendingVerification2) => pendingVerification2.field === "email" && pendingVerification2.value === input.email
+  );
+  if (!pendingVerification) {
+    return;
+  }
+  let metadataUserId = userId;
+  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
+  if (passwordlessEmailMethod) {
+    const updateResult = await Passwordless.updateUser({
+      recipeUserId: passwordlessEmailMethod.recipeUserId,
+      email: input.email,
+      userContext: input.userContext
+    });
+    if (updateResult.status !== "OK") {
+      throw new Error(
+        `Failed to update verified email method: ${updateResult.status}`
+      );
+    }
+  } else if (hasOnlyGuestLoginMethods(user)) {
+    const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
+      PUBLIC_TENANT_ID,
+      {
+        recipeId: "passwordless",
+        email: input.email
+      },
+      true,
+      void 0,
+      input.userContext
+    );
+    if (!isPasswordlessSignUpAllowed) {
+      throw new Error("Passwordless sign up is not allowed for this email");
+    }
+    const passwordlessUser = await Passwordless.signInUp({
+      email: input.email,
+      tenantId: PUBLIC_TENANT_ID,
+      userContext: input.userContext
+    });
+    const primaryUserResult = await AccountLinking.createPrimaryUser(
+      passwordlessUser.recipeUserId,
+      input.userContext
+    );
+    const primaryUserId = primaryUserResult.status === "OK" ? primaryUserResult.user.id : primaryUserResult.status === "RECIPE_USER_ID_ALREADY_LINKED_WITH_PRIMARY_USER_ID_ERROR" ? primaryUserResult.primaryUserId : passwordlessUser.user.id;
+    if (userId !== primaryUserId) {
+      const linkResult = await AccountLinking.linkAccounts(
+        input.recipeUserId,
+        primaryUserId,
+        input.userContext
+      );
+      if (linkResult.status !== "OK") {
+        throw new Error(
+          `Failed to link verified email method: ${linkResult.status}`
+        );
+      }
+    }
+    metadataUserId = primaryUserId;
+  }
+  const updatedMetadata = {
+    ...metadata,
+    ...metadata.original_rownd_user ? {
+      original_rownd_user: {
+        ...metadata.original_rownd_user,
+        data: {
+          ...metadata.original_rownd_user.data,
+          email: input.email
+        },
+        verified_data: {
+          ...metadata.original_rownd_user.verified_data,
+          email: input.email
+        }
+      }
+    } : {},
+    rownd_pending_verification: pendingVerifications.filter(
+      (verification) => verification !== pendingVerification
+    )
+  };
+  await UserMetadata2.updateUserMetadata(metadataUserId, updatedMetadata);
+}
+async function updateUserMetadata(userId, inputMeta) {
+  const metadata = await getUserMetadata(userId);
+  const updatedMetadata = {
+    ...metadata,
+    ...inputMeta
+  };
+  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
+  return {
+    id: userId,
+    meta: Object.fromEntries(
+      Object.entries(updatedMetadata).filter(
+        ([key]) => !isInternalMetadataField(key)
+      )
+    )
+  };
+}
+function getThirdPartyId(method) {
+  return method.thirdPartyId || method.thirdParty?.id;
+}
+function getThirdPartyUserId(method) {
+  return method.thirdPartyUserId || method.thirdParty?.userId;
+}
+function getGuestAuthLevel(user) {
+  const guestMethod = user?.loginMethods.find(isGuestLoginMethod);
+  return guestMethod ? GUEST_AUTH_METHOD_ID : void 0;
+}
+function hasAnonymousLoginMethod(user) {
+  return !!user?.loginMethods.some((loginMethod) => {
+    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
+  });
+}
+function getPasswordlessEmailLoginMethod(user) {
+  return user?.loginMethods.find((method) => {
+    return method.recipeId === "passwordless" && !!method.email;
+  });
+}
+function hasOnlyGuestLoginMethods(user) {
+  return !!user?.loginMethods.length && user.loginMethods.every(isGuestLoginMethod);
+}
+function isGuestLoginMethod(method) {
+  const thirdPartyId = getThirdPartyId(method);
+  return method.recipeId === "thirdparty" && (thirdPartyId === GUEST_AUTH_METHOD_ID || thirdPartyId === ANONYMOUS_AUTH_METHOD_ID);
+}
+function isGuestAccountInfo(input) {
+  return input?.recipeId === "thirdparty" && (input.thirdParty?.id === GUEST_AUTH_METHOD_ID || input.thirdParty?.id === ANONYMOUS_AUTH_METHOD_ID);
+}
+function doesAccountInfoMatchAuthMethod(user, accountInfo) {
+  if (!user) {
+    return false;
+  }
+  const normalizedEmail = accountInfo.email?.toLowerCase();
+  if (normalizedEmail) {
+    return user.loginMethods.some((method) => {
+      if (isGuestLoginMethod(method) || !method.email) {
+        return false;
+      }
+      return method.email.toLowerCase() === normalizedEmail;
+    });
+  }
+  if (accountInfo.phoneNumber) {
+    return user.loginMethods.some((method) => {
+      return !isGuestLoginMethod(method) && method.phoneNumber === accountInfo.phoneNumber;
+    });
+  }
+  return false;
+}
+function hasVerifiedRealLoginMethod(user) {
+  return !!user?.loginMethods.some((method) => {
+    if (isGuestLoginMethod(method)) {
+      return false;
+    }
+    if (method.recipeId === "passwordless") {
+      return !!(method.email || method.phoneNumber);
+    }
+    if (method.recipeId === "thirdparty") {
+      return !!getThirdPartyUserId(method) && method.verified === true;
+    }
+    if (method.recipeId === "emailpassword") {
+      return !!method.email && method.verified === true;
+    }
+    return method.verified === true;
+  });
+}
+function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
+  if (hasVerifiedRealLoginMethod(user)) {
+    return "verified";
+  }
+  return getGuestAuthLevel(user) || originalAuthLevel || (verifiedData && Object.keys(verifiedData).length > 0 ? "verified" : "unverified");
+}
+function canUpdateUserDataField(field) {
+  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
+  const schemaField = schema[field];
+  if (!schemaField) {
+    return false;
+  }
+  const ownedBy = field === "google_id" || field === "apple_id" ? "app" : schemaField.owned_by || "user";
+  return ownedBy !== "app" && schemaField.read_only !== true;
+}
+var BUILTIN_SIGN_IN_METHOD_KEYS = [
+  "email",
+  "phone",
+  "google",
+  "apple",
+  "anonymous"
+];
+function normalizeSchemaField(key, field) {
+  let ownedBy = field.owned_by;
+  if (key === "google_id" || key === "apple_id") {
+    ownedBy = "app";
+  } else if (!ownedBy) {
+    ownedBy = "user";
+  }
+  return {
+    display_name: field.display_name,
+    type: field.type,
+    owned_by: ownedBy,
+    user_visible: field.user_visible,
+    read_only: field.read_only ?? ownedBy === "app",
+    show_empty: field.show_empty ?? false
+  };
+}
+var DEFAULT_PRIMARY_COLOR = "#5b5bd6";
+function buildSignInMethodsConfig(methodsArray) {
+  const methods = (methodsArray ?? []).reduce(
+    (acc, curr) => {
+      acc[curr.method] = curr;
+      return acc;
+    },
+    {}
+  );
+  const customProviders = Object.fromEntries(
+    Object.entries(methods).filter(([key]) => !BUILTIN_SIGN_IN_METHOD_KEYS.includes(key)).map(([key, val]) => {
+      return val ? [
+        key,
+        {
+          enabled: true,
+          display_name: getStringMethodProperty(val, "displayName") ?? key,
+          icon_light_url: getStringMethodProperty(val, "iconLightUrl"),
+          icon_dark_url: getStringMethodProperty(val, "iconDarkUrl")
+        }
+      ] : [key, void 0];
+    }).filter(([, v]) => v !== void 0)
+  );
+  const googleMethod = methods.google;
+  const appleMethod = methods.apple;
+  const anonymousMethod = methods.anonymous;
+  const anonymousType = getAnonymousType(anonymousMethod);
+  const googleOneTap = getOneTapConfig(googleMethod);
+  return {
+    email: { enabled: !!methods.email },
+    phone: { enabled: !!methods.phone },
+    google: {
+      enabled: !!googleMethod,
+      client_id: getStringMethodProperty(googleMethod, "clientId") ?? "",
+      ios_client_id: getStringMethodProperty(googleMethod, "iosClientId") ?? "",
+      scopes: getStringArrayMethodProperty(googleMethod, "scopes") ?? [],
+      ...getSignInFasterWithGoogle(googleMethod) ? { sign_in_faster_with_google: getSignInFasterWithGoogle(googleMethod) } : {},
+      one_tap: {
+        browser: {
+          auto_prompt: googleOneTap?.browser?.autoPrompt ?? false,
+          delay: googleOneTap?.browser?.delay ?? 7e3
+        },
+        mobile_app: {
+          auto_prompt: googleOneTap?.mobileApp?.autoPrompt ?? false,
+          delay: googleOneTap?.mobileApp?.delay ?? 7e3
+        }
+      }
+    },
+    apple: {
+      enabled: !!appleMethod,
+      client_id: getStringMethodProperty(appleMethod, "clientId") ?? ""
+    },
+    anonymous: {
+      enabled: !!anonymousMethod && anonymousType !== "instant",
+      ...anonymousMethod && anonymousType !== "instant" ? { type: anonymousType } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "displayName") !== void 0 ? {
+        display_name: getStringMethodProperty(
+          anonymousMethod,
+          "displayName"
+        )
+      } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconLightUrl") !== void 0 ? {
+        icon_light_url: getStringMethodProperty(
+          anonymousMethod,
+          "iconLightUrl"
+        )
+      } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconDarkUrl") !== void 0 ? {
+        icon_dark_url: getStringMethodProperty(
+          anonymousMethod,
+          "iconDarkUrl"
+        )
+      } : {}
+    },
+    ...customProviders
+  };
+}
+function isInstantAnonymousMethod(methods) {
+  return (methods ?? []).some(
+    (method) => method.method === "anonymous" && getAnonymousType(method) === "instant"
+  );
+}
+function getAnonymousType(method) {
+  const type = getStringMethodProperty(method, "type");
+  return type === "instant" ? "instant" : "guest";
+}
+function getSignInFasterWithGoogle(method) {
+  const value = getStringMethodProperty(method, "signInFasterWithGoogle");
+  return value === "enabled" || value === "disabled" ? value : void 0;
+}
+function getMethodProperty(method, property) {
+  if (!method) {
+    return void 0;
+  }
+  return method[property];
+}
+function getStringMethodProperty(method, property) {
+  const value = getMethodProperty(method, property);
+  return typeof value === "string" ? value : void 0;
+}
+function getStringArrayMethodProperty(method, property) {
+  const value = getMethodProperty(method, property);
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
+function getOneTapConfig(method) {
+  const oneTap = getMethodProperty(method, "oneTap");
+  if (!isRecord(oneTap)) {
+    return void 0;
+  }
+  return {
+    browser: parseOneTapPlatform(oneTap.browser),
+    mobileApp: parseOneTapPlatform(oneTap.mobileApp)
+  };
+}
+function parseOneTapPlatform(value) {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  return {
+    autoPrompt: typeof value.autoPrompt === "boolean" ? value.autoPrompt : void 0,
+    delay: typeof value.delay === "number" ? value.delay : void 0
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getSubBrandVariant(app) {
+  if (isRecord(app) && isRecord(app.variant) && typeof app.variant.id === "string") {
+    return app.variant;
+  }
+  return void 0;
+}
+function mergeConfigInput(base, override) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (value === void 0) {
+      continue;
+    }
+    const existing = result[key];
+    result[key] = isRecord(existing) && isRecord(value) ? mergeConfigInput(existing, value) : value;
+  }
+  return result;
+}
+function buildAppConfig(config2, stConfig, appVariantId) {
+  const userSchema = config2.schema ?? DEFAULT_ROWND_SCHEMA;
+  const baseApp = config2.appConfig ?? {};
+  const subBrand = appVariantId ? config2.subBrands?.[appVariantId] : void 0;
+  const app = appVariantId ? subBrand && mergeConfigInput(baseApp, subBrand) : baseApp;
+  if (!app) {
+    return void 0;
+  }
+  const branding = app.branding ?? {};
+  const auth = app.auth ?? {};
+  const signInMethods = buildSignInMethodsConfig(app.signInMethods);
+  const variant = getSubBrandVariant(app);
+  const finalSchema = { ...userSchema };
+  if (signInMethods.email.enabled && !finalSchema.email) {
+    finalSchema.email = {
+      display_name: "Email",
+      type: "string",
+      user_visible: true
+    };
+  }
+  if (signInMethods.phone.enabled && !finalSchema.phone_number) {
+    finalSchema.phone_number = {
+      display_name: "Phone number",
+      type: "string",
+      user_visible: true
+    };
+  }
+  if (signInMethods.google.enabled && !finalSchema.google_id) {
+    finalSchema.google_id = {
+      display_name: "Google ID",
+      type: "string",
+      user_visible: false
+    };
+  }
+  if (signInMethods.apple.enabled && !finalSchema.apple_id) {
+    finalSchema.apple_id = {
+      display_name: "Apple ID",
+      type: "string",
+      user_visible: false
+    };
+  }
+  return {
+    config_type: appVariantId ? "variant" : "app",
+    ...variant ? { variant } : {},
+    app: {
+      id: app.id ?? "",
+      name: app.name ?? stConfig.appInfo.appName,
+      icon: app.icon ?? "",
+      ...app.userVerificationFields ? { user_verification_fields: app.userVerificationFields } : {},
+      schema: Object.fromEntries(
+        Object.entries(finalSchema).map(([key, field]) => [
+          key,
+          normalizeSchemaField(key, field)
+        ])
+      ),
+      config: {
+        ...app.capabilities ? { capabilities: app.capabilities } : {},
+        ...app.web ? { web: app.web } : {},
+        ...app.bottomSheet ? { bottom_sheet: app.bottomSheet } : {},
+        ...app.profileStorageVersion ? { profile_storage_version: app.profileStorageVersion } : {},
+        customizations: {
+          primary_color: branding.primaryColor ?? DEFAULT_PRIMARY_COLOR,
+          ...branding.logo ? { logo: branding.logo } : {},
+          ...branding.logoDarkMode ? { logo_dark_mode: branding.logoDarkMode } : {},
+          ...branding.animations ? { animations: branding.animations } : {}
+        },
+        hub: {
+          ...app.allowedWebOrigins ? { allowed_web_origins: app.allowedWebOrigins } : {},
+          customizations: {
+            rounded_corners: branding.roundedCorners ?? true,
+            ...branding.containerBorderRadius !== void 0 ? { container_border_radius: branding.containerBorderRadius } : {},
+            ...branding.placement !== void 0 ? { placement: branding.placement } : {},
+            ...branding.hubPrimaryColor !== void 0 ? { primary_color: branding.hubPrimaryColor } : {},
+            ...branding.primaryColorDarkMode !== void 0 ? { primary_color_dark_mode: branding.primaryColorDarkMode } : {},
+            ...branding.backgroundColor !== void 0 ? { background_color: branding.backgroundColor } : {},
+            ...branding.fontFamily !== void 0 ? { font_family: branding.fontFamily } : {},
+            ...branding.hideVerificationIcons !== void 0 ? { hide_verification_icons: branding.hideVerificationIcons } : {},
+            visual_swoops: branding.visualSwoops ?? true,
+            blur_background: branding.blurBackground ?? true,
+            ...branding.blurBackgroundOpacity !== void 0 ? { blur_background_opacity: branding.blurBackgroundOpacity } : {},
+            ...branding.offsetX !== void 0 ? { offset_x: branding.offsetX } : {},
+            ...branding.offsetY !== void 0 ? { offset_y: branding.offsetY } : {},
+            ...branding.propertyOverrides ? { property_overrides: branding.propertyOverrides } : {},
+            dark_mode: branding.darkMode ?? "auto"
+          },
+          ...branding.customScripts ? { custom_scripts: branding.customScripts } : {},
+          ...branding.customStyles ? { custom_styles: branding.customStyles } : {},
+          auth: {
+            email: buildAuthEmailConfig(auth.email),
+            ...auth.mobile ? { mobile: buildAuthMobileConfig(auth.mobile) } : {},
+            sign_in_methods: signInMethods,
+            additional_fields: auth.additionalFields ?? [],
+            ...auth.rememberSignInMethod !== void 0 ? { remember_sign_in_method: auth.rememberSignInMethod } : {},
+            ...auth.useExplicitSignUpFlow !== void 0 ? { use_explicit_sign_up_flow: auth.useExplicitSignUpFlow } : {},
+            ...auth.allowUnverifiedUsers !== void 0 ? { allow_unverified_users: auth.allowUnverifiedUsers } : {},
+            ...auth.primarySignUpMethod ? { primary_sign_up_method: auth.primarySignUpMethod } : {},
+            ...auth.preferredMethod ? { preferred_method: auth.preferredMethod } : {},
+            ...auth.order ? { order: auth.order } : {},
+            ...isInstantAnonymousMethod(app.signInMethods) ? { instant_user: { enabled: true } } : {},
+            show_app_icon: branding.showAppIcon ?? false
+          },
+          legal: {
+            ...app.legal?.companyName ? { company_name: app.legal.companyName } : {},
+            ...app.legal?.privacyPolicyUrl ? { privacy_policy_url: app.legal.privacyPolicyUrl } : {},
+            ...app.legal?.termsConditionsUrl ? { terms_conditions_url: app.legal.termsConditionsUrl } : {},
+            ...app.legal?.supportEmail ? { support_email: app.legal.supportEmail } : {}
+          },
+          custom_content: {
+            ...app.customContent?.signInModal ? {
+              sign_in_modal: {
+                ...app.customContent.signInModal.title ? { title: app.customContent.signInModal.title } : {},
+                ...app.customContent.signInModal.subtitle ? { subtitle: app.customContent.signInModal.subtitle } : {},
+                ...app.customContent.signInModal.signInTitle ? {
+                  sign_in_title: app.customContent.signInModal.signInTitle
+                } : {},
+                ...app.customContent.signInModal.signUpTitle ? {
+                  sign_up_title: app.customContent.signInModal.signUpTitle
+                } : {},
+                ...app.customContent.signInModal.signInSubtitle ? {
+                  sign_in_subtitle: app.customContent.signInModal.signInSubtitle
+                } : {},
+                ...app.customContent.signInModal.signUpSubtitle ? {
+                  sign_up_subtitle: app.customContent.signInModal.signUpSubtitle
+                } : {},
+                ...app.customContent.signInModal.signInButton ? {
+                  sign_in_button: app.customContent.signInModal.signInButton
+                } : {},
+                ...app.customContent.signInModal.signUpButton ? {
+                  sign_up_button: app.customContent.signInModal.signUpButton
+                } : {}
+              }
+            } : {},
+            ...app.customContent?.profileModal ? { profile_modal: app.customContent.profileModal } : {},
+            ...app.customContent?.verificationModal ? {
+              verification_modal: {
+                ...app.customContent.verificationModal.title ? { title: app.customContent.verificationModal.title } : {},
+                ...app.customContent.verificationModal.subtitle ? { subtitle: app.customContent.verificationModal.subtitle } : {}
+              }
+            } : {},
+            ...app.customContent?.signInFailureModal ? {
+              sign_in_failure_modal: {
+                failure_message: app.customContent.signInFailureModal.failureMessage
+              }
+            } : {},
+            ...app.customContent?.noAccountMessage ? { no_account_message: app.customContent.noAccountMessage } : {},
+            ...app.customContent?.mobile ? { mobile: app.customContent.mobile } : {}
+          },
+          profile: {
+            ...app.profile?.accountInformation ? { account_information: app.profile.accountInformation } : {},
+            ...app.profile?.personalInformation ? { personal_information: app.profile.personalInformation } : {},
+            ...app.profile?.preferences ? { preferences: app.profile.preferences } : {},
+            ...app.profile?.signOutButton ? { sign_out_button: app.profile.signOutButton } : {},
+            ...app.profile?.deleteAccountButton ? { delete_account_button: app.profile.deleteAccountButton } : {},
+            ...app.profile?.addSignInMethodsButton ? { add_sign_in_methods_button: app.profile.addSignInMethodsButton } : {}
+          }
+        }
+      }
+    }
+  };
+}
+function buildAuthEmailConfig(authEmail) {
+  return {
+    from_address: authEmail?.fromAddress ?? "no-reply@rownd.io",
+    image: authEmail?.image ?? "",
+    ...authEmail?.subject ? { subject: authEmail.subject } : {},
+    ...authEmail?.callToActionText ? { call_to_action_text: authEmail.callToActionText } : {},
+    ...authEmail?.verifyTemplate ? { verify_template: authEmail.verifyTemplate } : {},
+    ...authEmail?.customContent ? { custom_content: authEmail.customContent } : {},
+    ...authEmail?.customClosingContent ? { custom_closing_content: authEmail.customClosingContent } : {}
+  };
+}
+function buildAuthMobileConfig(authMobile) {
+  return {
+    ...authMobile?.title ? { title: authMobile.title } : {},
+    ...authMobile?.image ? { image: authMobile.image } : {},
+    ...authMobile?.callToActionText ? { call_to_action_text: authMobile.callToActionText } : {},
+    ...authMobile?.hyperlinkText ? { hyperlink_text: authMobile.hyperlinkText } : {},
+    ...authMobile?.hyperlinkRedirectUrl ? { hyperlink_redirect_url: authMobile.hyperlinkRedirectUrl } : {},
+    ...authMobile?.customContent ? { custom_content: authMobile.customContent } : {}
+  };
+}
 
 // src/plugin.ts
 var init = createPluginInitFunction(
-  (config2) => {
+  (pluginConfig2) => {
     const rowndClient2 = createInstance({
-      app_key: config2.rowndAppKey,
-      app_secret: config2.rowndAppSecret
+      app_key: pluginConfig2.rowndAppKey,
+      app_secret: pluginConfig2.rowndAppSecret
     });
-    const telemetryClient = createClient(config2.telemetry);
+    const telemetryClient = createClient(pluginConfig2.telemetry);
+    let hubBootstrapParams;
+    const addHubBootstrapParams = (input, linkKey, targetPath) => {
+      const appVariantId = input?.userContext?.rowndAppVariantId;
+      const displayContext = input?.userContext?.rowndDisplayContext;
+      const redirectToPath = input?.userContext?.rowndRedirectToPath;
+      const bootstrapParams = {
+        appKey: pluginConfig2.rowndAppKey,
+        ...hubBootstrapParams ?? {},
+        ...typeof appVariantId === "string" ? { appVariantId } : {},
+        ...typeof displayContext === "string" ? { displayContext } : {},
+        ...typeof redirectToPath === "string" ? { redirectToPath } : {}
+      };
+      return {
+        ...input,
+        [linkKey]: input[linkKey] ? rewriteLinkPath(input[linkKey], targetPath, bootstrapParams) : input[linkKey]
+      };
+    };
     setRowndClient(rowndClient2);
-    if (config2.enableDebugLogs) {
+    setPluginConfig(pluginConfig2);
+    if (pluginConfig2.enableDebugLogs) {
       enableDebugLogs();
     }
     logDebugMessage("Rownd plugin init complete");
@@ -959,104 +2355,336 @@ var init = createPluginInitFunction(
             "RowndMigrationPlugin: Session recipe is not initialized. Session migration will fail."
           );
         }
+        if (!supertokens.isRecipeInitialized("thirdparty")) {
+          console.warn(
+            "RowndMigrationPlugin: ThirdParty recipe is not initialized. Guest login will fail."
+          );
+        }
+        if (!supertokens.isRecipeInitialized("emailverification")) {
+          console.warn(
+            "RowndMigrationPlugin: EmailVerification recipe is not initialized. Verified email profile updates will fail."
+          );
+        }
       },
-      routeHandlers(config3) {
-        const apiBasePath = config3.appInfo.apiBasePath.getAsStringDangerous();
+      routeHandlers(stConfig) {
+        const apiBasePath = stConfig.appInfo.apiBasePath.getAsStringDangerous();
+        hubBootstrapParams = {
+          apiDomain: stConfig.appInfo.apiDomain.getAsStringDangerous(),
+          apiBasePath
+        };
+        const routeHandlerDeps = {
+          pluginConfig: pluginConfig2,
+          stConfig,
+          telemetryClient
+        };
         return {
           status: "OK",
           routeHandlers: [
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/app-config`,
+              method: "get",
+              handler: withRequestHandler(
+                handleGetAppConfig(routeHandlerDeps)
+              )
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/guest`,
+              method: "post",
+              handler: withRequestHandler(handleGuestLogin(routeHandlerDeps))
+            },
             {
               path: `${apiBasePath}${HANDLE_BASE_PATH}/migrate`,
               method: "post",
-              handler: withRequestHandler(
-                async (req, res, _session, userContext) => {
-                  const startedAt = Date.now();
-                  let tenantId = PUBLIC_TENANT_ID;
-                  let rowndUserId;
-                  let superTokensUserId;
-                  let user;
-                  let recipeUserId;
-                  try {
-                    if (!config3.supertokens) {
-                      throw new Error("Supertokens config not found");
+              handler: withRequestHandler(handleMigrate(routeHandlerDeps))
+            },
+            {
+              path: `${apiBasePath}/plugin/migrate-session`,
+              method: "post",
+              handler: withRequestHandler(handleMigrate(routeHandlerDeps))
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/signout`,
+              method: "post",
+              verifySessionOptions: {
+                sessionRequired: true,
+                checkDatabase: true
+              },
+              handler: withRequestHandler(handleSignOut())
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
+              method: "get",
+              verifySessionOptions: { sessionRequired: true },
+              handler: withRequestHandler(handleGetUser())
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
+              method: "put",
+              verifySessionOptions: { sessionRequired: true },
+              handler: withRequestHandler(handleUpdateUser())
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/user`,
+              method: "delete",
+              verifySessionOptions: { sessionRequired: true },
+              handler: withRequestHandler(handleDeleteUser())
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/user/meta`,
+              method: "get",
+              verifySessionOptions: { sessionRequired: true },
+              handler: withRequestHandler(handleGetUserMeta())
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/user/meta`,
+              method: "put",
+              verifySessionOptions: { sessionRequired: true },
+              handler: withRequestHandler(handleUpdateUserMeta())
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
+              method: "get",
+              verifySessionOptions: { sessionRequired: true },
+              handler: withRequestHandler(handleGetUserField())
+            },
+            {
+              path: `${apiBasePath}${HANDLE_BASE_PATH}/user/field`,
+              method: "put",
+              verifySessionOptions: { sessionRequired: true },
+              handler: withRequestHandler(handleUpdateUserField())
+            }
+          ]
+        };
+      },
+      overrideMap: {
+        passwordless: {
+          config: (config2) => {
+            const originalEmailDeliveryOverride = config2.emailDelivery?.override;
+            const originalSmsDeliveryOverride = config2.smsDelivery?.override;
+            return {
+              ...config2,
+              emailDelivery: {
+                ...config2.emailDelivery,
+                override: (originalImplementation, builder) => {
+                  const implementation = originalEmailDeliveryOverride ? originalEmailDeliveryOverride(
+                    originalImplementation,
+                    builder
+                  ) : originalImplementation;
+                  return {
+                    ...implementation,
+                    sendEmail: async function(input) {
+                      return implementation.sendEmail({
+                        ...addHubBootstrapParams(
+                          input,
+                          "urlWithLinkCode",
+                          "account/login"
+                        )
+                      });
                     }
-                    const parsed = await parseRequest(req);
-                    rowndUserId = await validateRowndToken(parsed.token);
-                    user = await supertokens.getUser(rowndUserId, userContext);
-                    if (!user) {
-                      const rowndUser = await fetchRowndUserInfo(rowndUserId);
-                      const stUserImport = mapRowndUserToSuperTokens(rowndUser);
-                      const importedUser = await importUser(
-                        stUserImport,
-                        config3.supertokens
-                      );
-                      superTokensUserId = importedUser.id;
-                      if (importedUser.loginMethods[0]?.recipeUserId) {
-                        recipeUserId = supertokens.convertToRecipeUserId(
-                          importedUser.loginMethods[0].recipeUserId
-                        );
-                      }
-                      logDebugMessage(
-                        `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-                      );
-                    } else {
-                      superTokensUserId = user.id;
-                      recipeUserId = user.loginMethods[0]?.recipeUserId;
-                      logDebugMessage(
-                        `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-                      );
+                  };
+                }
+              },
+              smsDelivery: {
+                ...config2.smsDelivery,
+                override: (originalImplementation, builder) => {
+                  const implementation = originalSmsDeliveryOverride ? originalSmsDeliveryOverride(
+                    originalImplementation,
+                    builder
+                  ) : originalImplementation;
+                  return {
+                    ...implementation,
+                    sendSms: async function(input) {
+                      return implementation.sendSms({
+                        ...addHubBootstrapParams(
+                          input,
+                          "urlWithLinkCode",
+                          "account/login"
+                        )
+                      });
                     }
-                    if (!recipeUserId) {
-                      throw new Error("User not found or has no login methods");
+                  };
+                }
+              }
+            };
+          },
+          apis: (originalImplementation) => ({
+            ...originalImplementation,
+            createCodePOST: async (input) => {
+              if (originalImplementation.createCodePOST === void 0) {
+                throw new Error("Passwordless createCodePOST is unavailable");
+              }
+              const displayContext = getRequestedDisplayContextFromRequest(
+                input.options.req
+              );
+              const redirectToPath = getRequestedRedirectToPathFromRequest(
+                input.options.req
+              );
+              const appVariantId = getRequestedAppVariantIdFromRequest(
+                input.options.req
+              );
+              assertRowndAppVariantIsConfigured(appVariantId);
+              return originalImplementation.createCodePOST({
+                ...input,
+                userContext: displayContext || redirectToPath || appVariantId ? {
+                  ...input.userContext,
+                  ...appVariantId ? { rowndAppVariantId: appVariantId } : {},
+                  ...displayContext ? { rowndDisplayContext: displayContext } : {},
+                  ...redirectToPath ? { rowndRedirectToPath: redirectToPath } : {}
+                } : input.userContext
+              });
+            },
+            consumeCodePOST: async (input) => {
+              if (originalImplementation.consumeCodePOST === void 0) {
+                throw new Error(
+                  "Passwordless consumeCodePOST is unavailable"
+                );
+              }
+              const appVariantId = getRequestedAppVariantIdFromRequest(
+                input.options.req
+              );
+              assertRowndAppVariantIsConfigured(appVariantId);
+              const response = await originalImplementation.consumeCodePOST({
+                ...input,
+                userContext: appVariantId ? { ...input.userContext, rowndAppVariantId: appVariantId } : input.userContext
+              });
+              if (response.status === "OK") {
+                await recordRowndAppVariantForUser(
+                  response.user.id,
+                  appVariantId
+                );
+              }
+              return response;
+            }
+          })
+        },
+        thirdparty: {
+          apis: (originalImplementation) => ({
+            ...originalImplementation,
+            signInUpPOST: async (input) => {
+              if (originalImplementation.signInUpPOST === void 0) {
+                throw new Error("ThirdParty signInUpPOST is unavailable");
+              }
+              const appVariantId = getRequestedAppVariantIdFromRequest(
+                input.options.req
+              );
+              assertRowndAppVariantIsConfigured(appVariantId);
+              const response = await originalImplementation.signInUpPOST({
+                ...input,
+                userContext: appVariantId ? { ...input.userContext, rowndAppVariantId: appVariantId } : input.userContext
+              });
+              if (response.status === "OK") {
+                await recordRowndAppVariantForUser(
+                  response.user.id,
+                  appVariantId
+                );
+              }
+              return response;
+            }
+          })
+        },
+        accountlinking: {
+          recipeInitRequired: true,
+          config: (config2) => {
+            const originalShouldDoAutomaticAccountLinking = config2.shouldDoAutomaticAccountLinking;
+            return {
+              ...config2,
+              shouldDoAutomaticAccountLinking: async (...input) => {
+                const rowndLinkingDecision = await shouldLinkRowndAccounts(input);
+                if (rowndLinkingDecision) {
+                  return rowndLinkingDecision;
+                }
+                if (originalShouldDoAutomaticAccountLinking) {
+                  return originalShouldDoAutomaticAccountLinking(...input);
+                }
+                return {
+                  shouldAutomaticallyLink: false,
+                  shouldRequireVerification: false
+                };
+              }
+            };
+          }
+        },
+        session: {
+          recipeInitRequired: true,
+          functions: (originalImplementation) => ({
+            ...originalImplementation,
+            createNewSession: async (input) => {
+              input.accessTokenPayload = {
+                ...input.accessTokenPayload,
+                ...await buildRowndSessionClaims(
+                  input.userId,
+                  input.accessTokenPayload
+                ),
+                ...await RowndIsAnonymousClaim.build(
+                  input.userId,
+                  input.recipeUserId,
+                  input.tenantId,
+                  input.accessTokenPayload,
+                  input.userContext
+                )
+              };
+              return originalImplementation.createNewSession(input);
+            }
+          })
+        },
+        emailverification: {
+          recipeInitRequired: true,
+          config: (config2) => {
+            const originalEmailDeliveryOverride = config2.emailDelivery?.override;
+            return {
+              ...config2,
+              emailDelivery: {
+                ...config2.emailDelivery,
+                override: (originalImplementation, builder) => {
+                  const implementation = originalEmailDeliveryOverride ? originalEmailDeliveryOverride(
+                    originalImplementation,
+                    builder
+                  ) : originalImplementation;
+                  return {
+                    ...implementation,
+                    sendEmail: async (input) => {
+                      return implementation.sendEmail({
+                        ...addHubBootstrapParams(
+                          input,
+                          "emailVerifyLink",
+                          "account/verify-email"
+                        )
+                      });
                     }
-                    await Session.createNewSession(
-                      req,
-                      res,
-                      PUBLIC_TENANT_ID,
-                      recipeUserId,
-                      {},
-                      {},
-                      userContext
-                    );
-                    logDebugMessage(
-                      `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
-                    );
-                    telemetryClient.recordSuccess({
-                      outcome: "success",
-                      durationMs: Date.now() - startedAt,
-                      tenantId,
-                      rowndUserId,
-                      superTokensUserId
-                    });
-                    return { status: "OK" };
-                  } catch (error) {
-                    logDebugMessage(
-                      `Migration failed. Error: ${error instanceof Error ? error.message : "Unknown error"}`
-                    );
-                    telemetryClient.recordError({
-                      error,
-                      startedAt,
-                      tenantId,
-                      rowndUserId,
-                      superTokensUserId
-                    });
-                    return {
-                      status: "ERROR",
-                      message: error instanceof RowndPluginError ? error.message : "Migration failed"
-                    };
-                  }
+                  };
                 }
-              )
+              }
+            };
+          },
+          apis: (originalImplementation) => ({
+            ...originalImplementation,
+            verifyEmailPOST: async (input) => {
+              if (originalImplementation.verifyEmailPOST === void 0) {
+                throw new Error(
+                  "EmailVerification verifyEmailPOST is unavailable"
+                );
+              }
+              const response = await originalImplementation.verifyEmailPOST(input);
+              if (response.status === "OK") {
+                await completePendingEmailVerification({
+                  recipeUserId: response.user.recipeUserId,
+                  email: response.user.email,
+                  userContext: input.userContext
+                });
+              }
+              return response;
             }
-          ]
-        };
+          })
+        }
       }
     };
   },
   () => ({}),
   (config2) => {
     if (!config2?.rowndAppKey || !config2?.rowndAppSecret) {
-      throw new Error("Missing rowndAppKey or rowndAppSecret in plugin config");
+      throw new Error(
+        "Missing rowndAppKey or rowndAppSecret in plugin config"
+      );
     }
     if (config2.telemetry?.provider === "axiom") {
       if (!config2.telemetry.token || !config2.telemetry.dataset) {
@@ -1076,7 +2704,10 @@ var init = createPluginInitFunction(
       rowndAppKey: config2.rowndAppKey,
       rowndAppSecret: config2.rowndAppSecret,
       enableDebugLogs: config2.enableDebugLogs,
-      telemetry: config2.telemetry
+      telemetry: config2.telemetry,
+      schema: config2.schema,
+      appConfig: config2.appConfig,
+      subBrands: config2.subBrands
     };
   }
 );
@@ -1084,12 +2715,18 @@ var init = createPluginInitFunction(
 // src/index.ts
 var index_default = { init };
 export {
+  ANONYMOUS_AUTH_METHOD_ID,
+  DEFAULT_ROWND_SCHEMA,
+  GUEST_AUTH_METHOD_ID,
   HANDLE_BASE_PATH,
   PLUGIN_ID,
   PLUGIN_SDK_VERSION,
   PUBLIC_TENANT_ID,
+  ROWND_JWT_CLAIMS,
   ROWND_PLUGIN_ERROR_MESSAGES,
   RowndPluginError,
   index_default as default,
-  init
+  getRowndClient,
+  init,
+  setRowndClient
 };