@supertokens-plugins/rownd-nodejs 0.3.0-beta.0 → 0.3.0-beta.2

package/dist/index.mjs

@@ -662,6 +662,7 @@ import supertokens from "supertokens-node";
 
 // src/constants.ts
 var PLUGIN_ID = "supertokens-plugin-rownd";
+var PLUGIN_VERSION = "0.3.0";
 var PLUGIN_SDK_VERSION = ["23.0.0", "23.0.1", ">=23.0.1"];
 var HANDLE_BASE_PATH = "/plugin/rownd";
 var PUBLIC_TENANT_ID = "public";
@@ -698,11 +699,13 @@ var DEFAULT_ROWND_SCHEMA = {
     user_visible: true
   }
 };
+var HUB_LOGIN_PAGE_PATH = "/account/login";
+var HUB_VERIFY_EMAIL_PAGE_PATH = "/account/verify-email";
 
 // src/logger.ts
 var { logDebugMessage, enableDebugLogs } = buildLogger(
   PLUGIN_ID,
-  PLUGIN_SDK_VERSION
+  PLUGIN_VERSION
 );
 
 // src/telemetry/axiomTelemetryClient.ts
@@ -819,17 +822,6 @@ function safeRecordEvent(client, event, outcome) {
   }
 }
 
-// src/pluginImplementation.ts
-import { randomUUID } from "crypto";
-import SuperTokens from "supertokens-node";
-import AccountLinking from "supertokens-node/recipe/accountlinking";
-import EmailVerification from "supertokens-node/recipe/emailverification";
-import Passwordless from "supertokens-node/recipe/passwordless";
-import Session from "supertokens-node/recipe/session";
-import { BooleanClaim } from "supertokens-node/recipe/session/claims";
-import ThirdParty from "supertokens-node/recipe/thirdparty";
-import UserMetadata2 from "supertokens-node/recipe/usermetadata";
-
 // src/errors.ts
 var ROWND_PLUGIN_ERROR_MESSAGES = {
   MISSING_AUTHORIZATION_HEADER: "Missing authorization header",
@@ -842,7 +834,7 @@ var RowndPluginError = class extends Error {
   }
 };
 
-// src/pluginImplementation.ts
+// src/utils.ts
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -861,19 +853,25 @@ function rewriteLinkPath(inputUrl, targetPath, searchParams) {
     return queryString ? `${path}?${queryString}` : path;
   }
 }
-var rowndClient;
-var pluginConfig;
-function setRowndClient(client) {
-  rowndClient = client;
-}
-function getRowndClient() {
-  if (!rowndClient) {
-    throw new Error("Rownd client not initialized");
+function rewriteLinkToBaseUrl(inputUrl, targetPath, baseUrl, searchParams) {
+  const normalizedBaseUrl = baseUrl.endsWith("://") ? baseUrl : baseUrl.replace(/\/+$/, "") + "/";
+  const targetUrl = new URL(
+    `${normalizedBaseUrl}${targetPath.replace(/^\//, "")}`
+  );
+  try {
+    const sourceUrl = new URL(inputUrl);
+    targetUrl.search = sourceUrl.search;
+    targetUrl.hash = sourceUrl.hash;
+  } catch {
+    const [, query = ""] = inputUrl.split("?");
+    targetUrl.search = query ? `?${query.split("#")[0]}` : "";
+    const hash = inputUrl.split("#")[1];
+    targetUrl.hash = hash ? `#${hash}` : "";
   }
-  return rowndClient;
-}
-function setPluginConfig(config2) {
-  pluginConfig = config2;
+  for (const [key, value] of Object.entries(searchParams ?? {})) {
+    targetUrl.searchParams.set(key, value);
+  }
+  return targetUrl.toString();
 }
 async function parseRequest(req) {
   const authHeader = req.getHeaderValue("authorization");
@@ -888,386 +886,37 @@ async function parseRequest(req) {
     token
   };
 }
-function handleGetAppConfig(deps) {
-  return async (req) => {
-    const appVariantId = getRequestedAppVariantIdFromRequest(req);
-    const appConfig = buildAppConfig(
-      deps.pluginConfig,
-      deps.stConfig,
-      appVariantId
-    );
-    if (!appConfig) {
-      return {
-        status: "ERROR",
-        message: `Unknown Rownd app variant: ${appVariantId}`
-      };
-    }
-    return {
-      status: "OK",
-      ...appConfig
-    };
-  };
+async function getJsonBody(req) {
+  return req.getJSONBody();
 }
-function handleGuestLogin(deps) {
-  return async (req, res, _session, userContext) => {
-    const startedAt = Date.now();
-    const guestId = `guest_${randomUUID()}`;
-    try {
-      const body = parseGuestBody(await getJsonBody(req));
-      const appVariantId = getRequestedAppVariantIdFromRequest(req);
-      assertRowndAppVariantIsConfigured(appVariantId);
-      const thirdPartyId = body.authLevel === ANONYMOUS_AUTH_METHOD_ID ? ANONYMOUS_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
-      const thirdPartyUserId = thirdPartyId === ANONYMOUS_AUTH_METHOD_ID ? `anon_${randomUUID()}` : guestId;
-      const response = await ThirdParty.manuallyCreateOrUpdateUser(
-        PUBLIC_TENANT_ID,
-        thirdPartyId,
-        thirdPartyUserId,
-        `${thirdPartyUserId}@anonymous.local`,
-        false,
-        void 0,
-        userContext
-      );
-      if (response.status !== "OK") {
-        throw new Error(
-          `Guest user creation failed with status: ${response.status}`
-        );
-      }
-      await Session.createNewSession(
-        req,
-        res,
-        PUBLIC_TENANT_ID,
-        response.recipeUserId,
-        {
-          ...buildRowndAudience({}, appVariantId),
-          auth_level: GUEST_AUTH_METHOD_ID,
-          is_anonymous: true,
-          app_user_id: response.user.id
-        },
-        {},
-        userContext
-      );
-      logDebugMessage(`Guest session created for user: ${response.user.id}`);
-      deps.telemetryClient.recordSuccess({
-        outcome: "success",
-        durationMs: Date.now() - startedAt,
-        tenantId: PUBLIC_TENANT_ID,
-        superTokensUserId: response.user.id
-      });
-      return {
-        status: "OK",
-        createdNewRecipeUser: response.createdNewRecipeUser
-      };
-    } catch (error) {
-      logDebugMessage(`Guest login failed. Error: ${getErrorMessage(error)}`);
-      deps.telemetryClient.recordError({
-        error,
-        startedAt,
-        tenantId: PUBLIC_TENANT_ID
-      });
-      return {
-        status: "ERROR",
-        message: "Guest login failed"
-      };
-    }
+function parseGuestBody(value) {
+  if (!isJsonRecord(value)) {
+    return {};
+  }
+  return {
+    authLevel: typeof value.auth_level === "string" ? value.auth_level : void 0
   };
 }
-function handleMigrate(deps) {
-  return async (req, res, _session, userContext) => {
-    const startedAt = Date.now();
-    let tenantId = PUBLIC_TENANT_ID;
-    let rowndUserId;
-    let superTokensUserId;
-    let user;
-    let recipeUserId;
-    try {
-      if (!deps.stConfig.supertokens) {
-        throw new Error("Supertokens config not found");
-      }
-      const parsed = await parseRequest(req);
-      const appVariantId = getRequestedAppVariantIdFromRequest(req);
-      assertRowndAppVariantIsConfigured(appVariantId);
-      rowndUserId = await validateRowndToken(parsed.token);
-      user = await SuperTokens.getUser(rowndUserId, userContext);
-      if (!user) {
-        const rowndUser = await fetchRowndUserInfo(rowndUserId);
-        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
-        try {
-          const importedUser = await importUser(
-            stUserImport,
-            deps.stConfig.supertokens
-          );
-          superTokensUserId = importedUser.id;
-          if (importedUser.loginMethods[0]?.recipeUserId) {
-            recipeUserId = SuperTokens.convertToRecipeUserId(
-              importedUser.loginMethods[0].recipeUserId
-            );
-          }
-        } catch (err) {
-          user = await SuperTokens.getUser(rowndUserId, userContext);
-          if (!user) {
-            throw err;
-          }
-          superTokensUserId = user.id;
-          recipeUserId = user.loginMethods[0]?.recipeUserId;
-          logDebugMessage(
-            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-          );
-        }
-        logDebugMessage(
-          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-        );
-      } else {
-        superTokensUserId = user.id;
-        recipeUserId = user.loginMethods[0]?.recipeUserId;
-        logDebugMessage(
-          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-        );
-      }
-      if (superTokensUserId) {
-        await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
-      }
-      if (!recipeUserId) {
-        throw new Error("User not found or has no login methods");
-      }
-      await Session.createNewSession(
-        req,
-        res,
-        PUBLIC_TENANT_ID,
-        recipeUserId,
-        {
-          ...buildRowndAudience({}, appVariantId)
-        },
-        {},
-        userContext
-      );
-      logDebugMessage(
-        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
-      );
-      deps.telemetryClient.recordSuccess({
-        outcome: "success",
-        durationMs: Date.now() - startedAt,
-        tenantId,
-        rowndUserId,
-        superTokensUserId
-      });
-      return { status: "OK" };
-    } catch (error) {
-      logDebugMessage(`Migration failed. Error: ${getErrorMessage(error)}`);
-      deps.telemetryClient.recordError({
-        error,
-        startedAt,
-        tenantId,
-        rowndUserId,
-        superTokensUserId
-      });
-      return {
-        status: "ERROR",
-        message: error instanceof RowndPluginError ? error.message : "Migration failed"
-      };
-    }
+function parseUpdateUserBody(value) {
+  if (!isJsonRecord(value) || !isJsonRecord(value.data)) {
+    return {};
+  }
+  return {
+    data: value.data,
+    ...isJsonRecord(value.context) ? { context: value.context } : {}
   };
 }
-function handleGetUser() {
-  return async (_req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    return {
-      status: "OK",
-      ...await getUserById(session.getUserId())
-    };
-  };
+function parseUpdateMetaBody(value) {
+  if (!isJsonRecord(value) || !isJsonRecord(value.meta)) {
+    return {};
+  }
+  return { meta: value.meta };
 }
-function handleUpdateUser() {
-  return async (req, _res, maybeSession, userContext) => {
-    const session = requireSession(maybeSession);
-    const appVariantId = getRequestedAppVariantIdFromRequest(req);
-    assertRowndAppVariantIsConfigured(appVariantId);
-    const payload = parseUpdateUserBody(await getJsonBody(req));
-    const inputData = payload.data ?? {};
-    const requestUserContext = {
-      ...userContext,
-      ...payload.context
-    };
-    const { email, ...dataWithoutEmail } = inputData;
-    const hasEmailUpdate = hasOwn(inputData, "email") && typeof email === "string";
-    const permissionError = validateWritableFields(
-      Object.keys(dataWithoutEmail)
-    );
-    if (permissionError) {
-      return permissionError;
-    }
-    if (Object.keys(dataWithoutEmail).length > 0) {
-      await updateUserData(session.getUserId(), dataWithoutEmail);
-    }
-    if (hasEmailUpdate) {
-      return {
-        status: "OK",
-        ...await startPendingEmailVerification({
-          userId: session.getUserId(),
-          recipeUserId: session.getRecipeUserId(),
-          tenantId: session.getTenantId(),
-          email,
-          pendingVerificationId: randomUUID(),
-          userContext: appVariantId ? { ...requestUserContext, rowndAppVariantId: appVariantId } : requestUserContext
-        })
-      };
-    }
-    return {
-      status: "OK",
-      ...await getUserById(session.getUserId())
-    };
-  };
-}
-function handleDeleteUser() {
-  return async (_req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    await SuperTokens.deleteUser(session.getUserId(), true);
-    return { status: "OK" };
-  };
-}
-function handleSignOut() {
-  return async (_req, _res, maybeSession, userContext) => {
-    const session = requireSession(maybeSession);
-    await Session.revokeAllSessionsForUser(
-      session.getUserId(),
-      true,
-      session.getTenantId(),
-      userContext
-    );
-    return { status: "OK" };
-  };
-}
-function handleGetUserMeta() {
-  return async (_req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    const metadata = await getUserMetadata(session.getUserId());
-    return {
-      status: "OK",
-      id: session.getUserId(),
-      meta: Object.fromEntries(
-        Object.entries(metadata).filter(
-          ([key]) => !isInternalMetadataField(key)
-        )
-      )
-    };
-  };
-}
-function handleUpdateUserMeta() {
-  return async (req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    const payload = parseUpdateMetaBody(await getJsonBody(req));
-    const internalField = Object.keys(payload.meta ?? {}).find(
-      isInternalMetadataField
-    );
-    if (internalField) {
-      return {
-        status: "ERROR",
-        code: 403,
-        message: `field is not writable: ${internalField}`
-      };
-    }
-    return {
-      status: "OK",
-      ...await updateUserMetadata(session.getUserId(), payload.meta ?? {})
-    };
-  };
-}
-function handleGetUserField() {
-  return async (req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    const field = req.getKeyValueFromQuery("field");
-    if (!field) {
-      return missingFieldResponse();
-    }
-    const user = await getUserById(session.getUserId());
-    return {
-      status: "OK",
-      value: user.data[field]
-    };
-  };
-}
-function handleUpdateUserField() {
-  return async (req, _res, maybeSession, userContext) => {
-    const session = requireSession(maybeSession);
-    const appVariantId = getRequestedAppVariantIdFromRequest(req);
-    assertRowndAppVariantIsConfigured(appVariantId);
-    const field = req.getKeyValueFromQuery("field");
-    if (!field) {
-      return missingFieldResponse();
-    }
-    const payload = parseUpdateFieldBody(await getJsonBody(req));
-    if (field === "email" && typeof payload.value === "string") {
-      return {
-        status: "OK",
-        ...await startPendingEmailVerification({
-          userId: session.getUserId(),
-          recipeUserId: session.getRecipeUserId(),
-          tenantId: session.getTenantId(),
-          email: payload.value,
-          pendingVerificationId: randomUUID(),
-          userContext: appVariantId ? { ...userContext, rowndAppVariantId: appVariantId } : userContext
-        })
-      };
-    }
-    const permissionError = validateWritableFields([field]);
-    if (permissionError) {
-      return permissionError;
-    }
-    return {
-      status: "OK",
-      ...await updateUserData(session.getUserId(), {
-        [field]: payload.value
-      })
-    };
-  };
-}
-function requireSession(session) {
-  if (!session) {
-    throw new Error("Session not found");
-  }
-  return session;
-}
-async function getJsonBody(req) {
-  return req.getJSONBody();
-}
-function parseGuestBody(value) {
-  if (!isJsonRecord(value)) {
-    return {};
-  }
-  return {
-    authLevel: typeof value.auth_level === "string" ? value.auth_level : void 0
-  };
-}
-function parseUpdateUserBody(value) {
-  if (!isJsonRecord(value) || !isJsonRecord(value.data)) {
-    return {};
-  }
-  return {
-    data: value.data,
-    ...isJsonRecord(value.context) ? { context: value.context } : {}
-  };
-}
-function parseUpdateMetaBody(value) {
-  if (!isJsonRecord(value) || !isJsonRecord(value.meta)) {
-    return {};
-  }
-  return { meta: value.meta };
-}
-function parseUpdateFieldBody(value) {
-  if (!isJsonRecord(value) || !hasOwn(value, "value")) {
-    return {};
-  }
-  return { value: value.value };
-}
-function validateWritableFields(fields) {
-  const readOnlyField = fields.find((field) => !canUpdateUserDataField(field));
-  if (!readOnlyField) {
-    return void 0;
-  }
-  return {
-    status: "ERROR",
-    code: 403,
-    message: `field is not writable: ${readOnlyField}`
-  };
+function parseUpdateFieldBody(value) {
+  if (!isJsonRecord(value) || !hasOwn(value, "value")) {
+    return {};
+  }
+  return { value: value.value };
 }
 function missingFieldResponse() {
   return {
@@ -1279,138 +928,21 @@ function missingFieldResponse() {
 function isJsonRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function hasOwn(value, key) {
   return Object.prototype.hasOwnProperty.call(value, key);
 }
-function getErrorMessage(error) {
-  return error instanceof Error ? error.message : "Unknown error";
-}
-function mapRowndUserToSuperTokens(rowndUser) {
-  const loginMethods = [];
-  const rowndUserData = rowndUser.data || {};
-  const rowndUserVerifiedData = rowndUser.verified_data || {};
-  if (!rowndUserData.user_id) {
-    throw new Error("Rownd user has no user_id");
-  }
-  if (rowndUserData.google_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Google user is missing email");
-    }
-    loginMethods.push({
-      recipeId: "thirdparty",
-      thirdPartyId: "google",
-      thirdPartyUserId: rowndUserData.google_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.google_id
-    });
-  }
-  if (rowndUserData.apple_id) {
-    if (!rowndUserData.email) {
-      throw new Error("Rownd Apple user is missing email");
-    }
-    loginMethods.push({
-      recipeId: "thirdparty",
-      thirdPartyId: "apple",
-      thirdPartyUserId: rowndUserData.apple_id,
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.apple_id
-    });
-  }
-  if (rowndUserData.phone_number) {
-    loginMethods.push({
-      recipeId: "passwordless",
-      phoneNumber: rowndUserData.phone_number,
-      isVerified: !!rowndUserVerifiedData.phone_number
-    });
-  }
-  if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
-    loginMethods.push({
-      recipeId: "passwordless",
-      email: rowndUserData.email,
-      isVerified: !!rowndUserVerifiedData.email
-    });
-  }
-  let authLevel = rowndUser.auth_level;
-  if (loginMethods.length === 0) {
-    const thirdPartyId = authLevel === GUEST_AUTH_METHOD_ID ? GUEST_AUTH_METHOD_ID : ANONYMOUS_AUTH_METHOD_ID;
-    if (!authLevel) authLevel = thirdPartyId;
-    loginMethods.push({
-      recipeId: "thirdparty",
-      thirdPartyId,
-      thirdPartyUserId: rowndUserData.user_id,
-      email: `${rowndUserData.user_id}@anonymous.local`,
-      isVerified: false
-    });
-  }
-  const userMetadata = buildRowndUserMetadata(rowndUser);
-  return {
-    externalUserId: rowndUserData.user_id,
-    loginMethods,
-    userMetadata
-  };
-}
-async function importUser(stUser, config2) {
-  const headers = {
-    "Content-Type": "application/json"
-  };
-  if (config2.apiKey) {
-    headers["api-key"] = config2.apiKey;
-  }
-  const response = await fetch(`${config2.connectionURI}/bulk-import/import`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(stUser)
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(
-      `Bulk import failed with status ${response.status}: ${errorText}`
-    );
-  }
-  const importResponse = await response.json();
-  if (importResponse.status !== "OK" || !importResponse.user) {
-    throw new Error(
-      `Bulk import failed: ${importResponse.message || "Missing user in response"}`
-    );
-  }
-  return importResponse.user;
-}
-async function validateRowndToken(token) {
-  const client = getRowndClient();
-  const tokenInfo = await client.validateToken(token);
-  return tokenInfo.user_id;
-}
-async function fetchRowndUserInfo(userId) {
-  const client = getRowndClient();
-  const rowndUser = await client.fetchUserInfo({ user_id: userId });
-  if (!rowndUser) {
-    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
-  }
-  return rowndUser;
-}
-var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
-  "user_id",
-  "email",
-  "phone_number",
-  "google_id",
-  "apple_id"
-]);
-var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
-  "original_rownd_user",
-  "rownd_pending_verification"
-]);
-function isIdentityField(field) {
-  return IDENTITY_USER_DATA_FIELDS.has(field);
-}
-function isInternalMetadataField(field) {
-  return INTERNAL_METADATA_FIELDS.has(field);
-}
 function getStringList(value) {
   if (Array.isArray(value)) {
     return value.filter((entry) => typeof entry === "string");
   }
   return typeof value === "string" ? [value] : [];
 }
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : "Unknown error";
+}
 function getRequestedAppVariantIdFromRequest(req) {
   return req.getKeyValueFromQuery("app_variant_id");
 }
@@ -1418,519 +950,627 @@ function getRequestedDisplayContextFromRequest(req) {
   const displayContext = req.getKeyValueFromQuery("rownd_display_context");
   return displayContext === "browser" || displayContext === "mobile_app" || displayContext === "customer_web_view" ? displayContext : void 0;
 }
+function getRequestedClientDomainFromRequest(req) {
+  const clientDomain = req.getKeyValueFromQuery("rownd_client_domain");
+  return typeof clientDomain === "string" && clientDomain.length > 0 ? clientDomain : void 0;
+}
 function getRequestedRedirectToPathFromRequest(req) {
   const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
   return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
 }
-function assertRowndAppVariantIsConfigured(appVariantId) {
-  if (!appVariantId) {
-    return;
-  }
-  if (pluginConfig?.subBrands && !pluginConfig.subBrands[appVariantId]) {
-    throw new Error(`Unknown Rownd app variant: ${appVariantId}`);
-  }
+
+// src/config.ts
+var pluginConfig;
+function setPluginConfig(config2) {
+  pluginConfig = config2;
 }
-async function recordRowndAppVariantForUser(userId, appVariantId) {
+function getPluginConfig() {
+  return pluginConfig;
+}
+function assertRowndAppVariantIsConfigured(appVariantId) {
   if (!appVariantId) {
     return;
   }
-  assertRowndAppVariantIsConfigured(appVariantId);
-  const metadata = await getUserMetadata(userId);
-  const originalRowndUser = isJsonRecord(metadata.original_rownd_user) ? metadata.original_rownd_user : {};
-  const attributes = isJsonRecord(originalRowndUser.attributes) ? originalRowndUser.attributes : {};
-  const appVariants = getStringList(attributes["rownd:app_variants"]);
-  if (appVariants.includes(appVariantId)) {
-    return;
+  if (pluginConfig?.subBrands && !pluginConfig.subBrands[appVariantId]) {
+    throw new Error(`Unknown Rownd app variant: ${appVariantId}`);
   }
-  await UserMetadata2.updateUserMetadata(userId, {
-    ...metadata,
-    original_rownd_user: {
-      ...originalRowndUser,
-      data: isJsonRecord(originalRowndUser.data) ? originalRowndUser.data : { user_id: userId },
-      verified_data: isJsonRecord(originalRowndUser.verified_data) ? originalRowndUser.verified_data : {},
-      attributes: {
-        ...attributes,
-        "rownd:app_variants": [...appVariants, appVariantId]
-      }
-    }
-  });
 }
-function buildRowndUserMetadata(rowndUser) {
-  const metadata = {
-    ...rowndUser.meta || {},
-    original_rownd_user: rowndUser
-  };
-  for (const [key, value] of Object.entries(rowndUser.data || {})) {
-    if (!isIdentityField(key) && value !== void 0) {
-      metadata[key] = value;
-    }
+var BUILTIN_SIGN_IN_METHOD_KEYS = [
+  "email",
+  "phone",
+  "google",
+  "apple",
+  "anonymous"
+];
+function normalizeSchemaField(key, field) {
+  let ownedBy = field.owned_by;
+  if (key === "google_id" || key === "apple_id") {
+    ownedBy = "app";
+  } else if (!ownedBy) {
+    ownedBy = "user";
   }
-  return metadata;
+  return {
+    display_name: field.display_name,
+    type: field.type,
+    owned_by: ownedBy,
+    user_visible: field.user_visible,
+    read_only: field.read_only ?? ownedBy === "app",
+    show_empty: field.show_empty ?? false
+  };
 }
-var RowndIsAnonymousClaim = new BooleanClaim({
-  key: "is_anonymous",
-  fetchValue: async (userId) => {
-    const user = await SuperTokens.getUser(userId);
-    const effectiveAuthLevel = getEffectiveAuthLevel(user);
-    return effectiveAuthLevel === GUEST_AUTH_METHOD_ID;
-  }
-});
-async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId) {
-  const user = await SuperTokens.getUser(userId);
-  const metadata = user ? await getUserMetadata(user.id) : void 0;
-  const originalRowndUser = metadata?.original_rownd_user;
-  const verifiedData = originalRowndUser?.verified_data;
-  const authLevel = getEffectiveAuthLevel(
-    user,
-    originalRowndUser?.auth_level,
-    verifiedData
+var DEFAULT_PRIMARY_COLOR = "#5b5bd6";
+function buildSignInMethodsConfig(methodsArray) {
+  const methods = (methodsArray ?? []).reduce(
+    (acc, curr) => {
+      acc[curr.method] = curr;
+      return acc;
+    },
+    {}
   );
-  const appUserId = getRowndAppUserId(userId, user, currentPayload, metadata);
-  const isAnonymous = authLevel === GUEST_AUTH_METHOD_ID;
-  const anonymousId = getAnonymousId(userId, user, metadata);
-  const isVerifiedUser = authLevel !== "unverified";
-  const audience = buildRowndAudience(currentPayload, appVariantId);
-  const configuredClaims = buildConfiguredSessionClaims(metadata);
+  const customProviders = Object.fromEntries(
+    Object.entries(methods).filter(([key]) => !BUILTIN_SIGN_IN_METHOD_KEYS.includes(key)).map(([key, val]) => {
+      return val ? [
+        key,
+        {
+          enabled: true,
+          display_name: getStringMethodProperty(val, "displayName") ?? key,
+          icon_light_url: getStringMethodProperty(val, "iconLightUrl"),
+          icon_dark_url: getStringMethodProperty(val, "iconDarkUrl")
+        }
+      ] : [key, void 0];
+    }).filter(([, v]) => v !== void 0)
+  );
+  const googleMethod = methods.google;
+  const appleMethod = methods.apple;
+  const anonymousMethod = methods.anonymous;
+  const anonymousType = getAnonymousType(anonymousMethod);
+  const googleOneTap = getOneTapConfig(googleMethod);
   return {
-    ...audience,
-    ...configuredClaims,
-    app_user_id: appUserId,
-    auth_level: authLevel,
-    is_verified_user: isVerifiedUser,
-    [ROWND_JWT_CLAIMS.AppUserId]: appUserId,
-    [ROWND_JWT_CLAIMS.AuthLevel]: authLevel,
-    [ROWND_JWT_CLAIMS.IsVerifiedUser]: isVerifiedUser,
-    [ROWND_JWT_CLAIMS.IsAnonymous]: isAnonymous,
-    ...anonymousId ? { anonymous_id: anonymousId } : {}
+    email: { enabled: !!methods.email },
+    phone: { enabled: !!methods.phone },
+    google: {
+      enabled: !!googleMethod,
+      client_id: getStringMethodProperty(googleMethod, "clientId") ?? "",
+      ios_client_id: getStringMethodProperty(googleMethod, "iosClientId") ?? "",
+      scopes: getStringArrayMethodProperty(googleMethod, "scopes") ?? [],
+      ...getSignInFasterWithGoogle(googleMethod) ? { sign_in_faster_with_google: getSignInFasterWithGoogle(googleMethod) } : {},
+      one_tap: {
+        browser: {
+          auto_prompt: googleOneTap?.browser?.autoPrompt ?? false,
+          delay: googleOneTap?.browser?.delay ?? 7e3
+        },
+        mobile_app: {
+          auto_prompt: googleOneTap?.mobileApp?.autoPrompt ?? false,
+          delay: googleOneTap?.mobileApp?.delay ?? 7e3
+        }
+      }
+    },
+    apple: {
+      enabled: !!appleMethod,
+      client_id: getStringMethodProperty(appleMethod, "clientId") ?? ""
+    },
+    anonymous: {
+      enabled: !!anonymousMethod && anonymousType !== "instant",
+      ...anonymousMethod && anonymousType !== "instant" ? { type: anonymousType } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "displayName") !== void 0 ? {
+        display_name: getStringMethodProperty(
+          anonymousMethod,
+          "displayName"
+        )
+      } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconLightUrl") !== void 0 ? {
+        icon_light_url: getStringMethodProperty(
+          anonymousMethod,
+          "iconLightUrl"
+        )
+      } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconDarkUrl") !== void 0 ? {
+        icon_dark_url: getStringMethodProperty(
+          anonymousMethod,
+          "iconDarkUrl"
+        )
+      } : {}
+    },
+    ...customProviders
   };
 }
-function buildConfiguredSessionClaims(metadata) {
-  if (!metadata) {
-    return {};
-  }
-  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
-  const claims = {};
-  for (const [key, field] of Object.entries(schema)) {
-    if (field.include_in_session_claims !== true) {
-      continue;
-    }
-    const value = metadata.original_rownd_user?.data?.[key] ?? metadata[key];
-    if (value !== void 0) {
-      claims[field.session_claim_name || key] = value;
-    }
-  }
-  return claims;
+function isInstantAnonymousMethod(methods) {
+  return (methods ?? []).some(
+    (method) => method.method === "anonymous" && getAnonymousType(method) === "instant"
+  );
 }
-function getRowndAppUserId(userId, user, currentPayload, metadata) {
-  const originalUserId = metadata?.original_rownd_user?.data?.user_id;
-  if (typeof originalUserId === "string") {
-    return originalUserId;
-  }
-  if (typeof currentPayload.app_user_id === "string") {
-    return currentPayload.app_user_id;
-  }
-  return user?.id || userId;
+function getAnonymousType(method) {
+  const type = getStringMethodProperty(method, "type");
+  return type === "instant" ? "instant" : "guest";
 }
-function buildRowndAudience(currentPayload, appVariantId) {
-  const audience = getStringList(currentPayload.aud);
-  const appId = pluginConfig?.appConfig?.id;
-  if (appId) {
-    audience.push(`app:${appId}`);
-  }
-  if (appVariantId) {
-    audience.push(`app_variant:${appVariantId}`);
-  }
-  return audience.length > 0 ? { aud: [...new Set(audience)] } : {};
+function getSignInFasterWithGoogle(method) {
+  const value = getStringMethodProperty(method, "signInFasterWithGoogle");
+  return value === "enabled" || value === "disabled" ? value : void 0;
 }
-function getAnonymousId(userId, user, metadata) {
-  const originalAnonymousId = metadata?.original_rownd_user?.data?.anonymous_id;
-  if (typeof originalAnonymousId === "string") {
-    return originalAnonymousId;
+function getMethodProperty(method, property) {
+  if (!method) {
+    return void 0;
   }
-  const anonymousMethod = user?.loginMethods.find((loginMethod) => {
-    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
-  });
-  const thirdPartyUserId = anonymousMethod ? getThirdPartyUserId(anonymousMethod) : void 0;
-  return thirdPartyUserId || (hasAnonymousLoginMethod(user) ? `anon_${userId}` : void 0);
+  return method[property];
 }
-async function shouldLinkRowndAccounts(input) {
-  const [newAccountInfo, , session] = input;
-  if (!session) {
+function getStringMethodProperty(method, property) {
+  const value = getMethodProperty(method, property);
+  return typeof value === "string" ? value : void 0;
+}
+function getStringArrayMethodProperty(method, property) {
+  const value = getMethodProperty(method, property);
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
+function getOneTapConfig(method) {
+  const oneTap = getMethodProperty(method, "oneTap");
+  if (!isRecord(oneTap)) {
     return void 0;
   }
-  const currentUser = await SuperTokens.getUser(session.getUserId());
-  if (hasOnlyGuestLoginMethods(currentUser)) {
-    return {
-      shouldAutomaticallyLink: true,
-      shouldRequireVerification: false
-    };
-  }
-  if (!currentUser || isGuestAccountInfo(newAccountInfo)) {
+  return {
+    browser: parseOneTapPlatform(oneTap.browser),
+    mobileApp: parseOneTapPlatform(oneTap.mobileApp)
+  };
+}
+function parseOneTapPlatform(value) {
+  if (!isRecord(value)) {
     return void 0;
   }
-  if (doesAccountInfoMatchAuthMethod(currentUser, newAccountInfo)) {
-    return {
-      shouldAutomaticallyLink: true,
-      shouldRequireVerification: true
-    };
-  }
-  return void 0;
+  return {
+    autoPrompt: typeof value.autoPrompt === "boolean" ? value.autoPrompt : void 0,
+    delay: typeof value.delay === "number" ? value.delay : void 0
+  };
 }
-async function getUserMetadata(userId) {
-  const metadata = await UserMetadata2.getUserMetadata(userId);
-  return metadata.metadata || {};
-}
-function getPendingVerifications(metadata) {
-  const pendingVerification = metadata.rownd_pending_verification;
-  if (Array.isArray(pendingVerification)) {
-    return pendingVerification.filter(isPendingVerification);
+function getSubBrandVariant(app) {
+  if (isRecord(app) && isRecord(app.variant) && typeof app.variant.id === "string") {
+    return app.variant;
   }
-  return [];
-}
-function isPendingVerification(value) {
-  return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
+  return void 0;
 }
-async function getUserById(userId) {
-  const metadata = await getUserMetadata(userId);
-  const stUser = await SuperTokens.getUser(userId);
-  if (!stUser) {
-    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
-  }
-  const originalRowndUser = metadata.original_rownd_user;
-  const rowndUser = originalRowndUser?.data?.user_id || userId;
-  const state = originalRowndUser?.state || "enabled";
-  const dataFieldKeys = /* @__PURE__ */ new Set();
-  const data = {
-    user_id: userId
-  };
-  for (const [key, value] of Object.entries(originalRowndUser?.data || {})) {
-    if (!isIdentityField(key)) {
-      data[key] = value;
-      dataFieldKeys.add(key);
-    }
-  }
-  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
-  for (const key of Object.keys(schema)) {
-    dataFieldKeys.add(key);
-    if (!isInternalMetadataField(key) && !isIdentityField(key) && metadata[key] !== void 0) {
-      data[key] = metadata[key];
+function mergeConfigInput(base, override) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (value === void 0) {
+      continue;
     }
+    const existing = result[key];
+    result[key] = isRecord(existing) && isRecord(value) ? mergeConfigInput(existing, value) : value;
   }
-  const verifiedData = {
-    ...originalRowndUser?.verified_data || {}
-  };
-  let lastUsedAt = stUser.timeJoined;
-  for (const method of stUser.loginMethods) {
-    if (typeof method.lastUsed === "number" && method.lastUsed > lastUsedAt) {
-      lastUsedAt = method.lastUsed;
-    }
-    if (method.recipeId === "passwordless") {
-      if (method.email) {
-        verifiedData.email = method.email;
-        if (data.email === void 0) data.email = method.email;
-      }
-      if (method.phoneNumber) {
-        verifiedData.phone_number = method.phoneNumber;
-        if (data.phone_number === void 0)
-          data.phone_number = method.phoneNumber;
-      }
-    } else if (method.recipeId === "thirdparty") {
-      const thirdPartyId = getThirdPartyId(method);
-      const thirdPartyUserId = getThirdPartyUserId(method);
-      if (method.verified && method.email) {
-        verifiedData.email = method.email;
-      }
-      if (method.email && data.email === void 0) {
-        data.email = method.email;
-      }
-      if (thirdPartyId === "google" && thirdPartyUserId) {
-        data.google_id = thirdPartyUserId;
-        verifiedData.google_id = thirdPartyUserId;
-      }
-      if (thirdPartyId === "apple" && thirdPartyUserId) {
-        data.apple_id = thirdPartyUserId;
-        verifiedData.apple_id = thirdPartyUserId;
-      }
-    } else if (method.recipeId === "emailpassword") {
-      if (method.email && data.email === void 0) {
-        data.email = method.email;
-      }
-    }
+  return result;
+}
+function buildRowndAppConfig(config2, stConfig, appVariantId) {
+  const userSchema = config2.schema ?? DEFAULT_ROWND_SCHEMA;
+  const baseApp = config2.appConfig ?? {};
+  const subBrand = appVariantId ? config2.subBrands?.[appVariantId] : void 0;
+  const app = appVariantId ? subBrand && mergeConfigInput(baseApp, subBrand) : baseApp;
+  if (!app) {
+    return void 0;
   }
-  if (verifiedData.email === true && typeof data.email === "string") {
-    verifiedData.email = data.email;
+  const branding = app.branding ?? {};
+  const auth = app.auth ?? {};
+  const signInMethods = buildSignInMethodsConfig(app.signInMethods);
+  const variant = getSubBrandVariant(app);
+  const finalSchema = { ...userSchema };
+  if (signInMethods.email.enabled && !finalSchema.email) {
+    finalSchema.email = {
+      display_name: "Email",
+      type: "string",
+      user_visible: true
+    };
   }
-  if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
-    verifiedData.phone_number = data.phone_number;
+  if (signInMethods.phone.enabled && !finalSchema.phone_number) {
+    finalSchema.phone_number = {
+      display_name: "Phone number",
+      type: "string",
+      user_visible: true
+    };
   }
-  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
-  if (anonymousId && data.anonymous_id === void 0) {
-    data.anonymous_id = anonymousId;
+  if (signInMethods.google.enabled && !finalSchema.google_id) {
+    finalSchema.google_id = {
+      display_name: "Google ID",
+      type: "string",
+      user_visible: false
+    };
   }
-  const authLevel = getEffectiveAuthLevel(
-    stUser,
-    originalRowndUser?.auth_level,
-    verifiedData
-  );
-  for (const [key, field] of Object.entries(schema)) {
-    if (data[key] === void 0 && field.type === "string") {
-      data[key] = "";
-    }
+  if (signInMethods.apple.enabled && !finalSchema.apple_id) {
+    finalSchema.apple_id = {
+      display_name: "Apple ID",
+      type: "string",
+      user_visible: false
+    };
   }
-  const mapMethod = (method) => {
-    if (method.recipeId === "thirdparty") {
-      if (getThirdPartyId(method) === "google") return "google";
-      if (getThirdPartyId(method) === "apple") return "apple";
-    } else if (method.recipeId === "passwordless") {
-      if (method.email) return "email";
-      if (method.phoneNumber) return "phone";
-    } else if (method.recipeId === "emailpassword") {
-      return "email";
-    }
-    return "email";
-  };
-  const sortedByJoined = [...stUser.loginMethods].sort(
-    (a, b) => a.timeJoined - b.timeJoined
-  );
-  const sortedByLastUsed = [
-    ...stUser.loginMethods
-  ].sort((a, b) => (b.lastUsed || b.timeJoined) - (a.lastUsed || a.timeJoined));
-  const firstMethod = sortedByJoined[0];
-  const lastMethod = sortedByLastUsed[0];
-  const metadataMeta = Object.fromEntries(
-    Object.entries(metadata).filter(
-      ([key]) => !isInternalMetadataField(key) && !dataFieldKeys.has(key)
-    )
-  );
-  const meta = {
-    ...metadataMeta,
-    created: new Date(stUser.timeJoined).toISOString(),
-    first_sign_in: new Date(stUser.timeJoined).toISOString(),
-    last_sign_in: new Date(lastUsedAt).toISOString(),
-    last_active: new Date(lastUsedAt).toISOString(),
-    first_sign_in_method: firstMethod ? mapMethod(firstMethod) : "email",
-    last_sign_in_method: lastMethod ? mapMethod(lastMethod) : "email"
-  };
   return {
-    rownd_user: rowndUser,
-    data,
-    meta,
-    verified_data: verifiedData,
-    state,
-    auth_level: authLevel,
-    redacted: [],
-    groups: originalRowndUser?.groups || [],
-    attributes: originalRowndUser?.attributes || {}
-  };
-}
-async function updateUserData(userId, inputData) {
-  const metadata = await getUserMetadata(userId);
-  const updatedMetadata = {
-    ...metadata,
-    ...inputData
-  };
-  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
-  return getUserById(userId);
-}
-async function startPendingEmailVerification(input) {
-  const metadata = await getUserMetadata(input.userId);
-  const currentEmail = (await getUserById(input.userId)).data.email;
-  if (currentEmail === input.email) {
-    return getUserById(input.userId);
-  }
-  const pendingVerifications = getPendingVerifications(metadata);
-  const pendingEmailVerifications = pendingVerifications.filter(
-    (pendingVerification2) => pendingVerification2.field === "email"
-  );
-  for (const pendingVerification2 of pendingEmailVerifications) {
-    await EmailVerification.revokeEmailVerificationTokens(
-      input.tenantId,
-      input.recipeUserId,
-      pendingVerification2.value,
-      input.userContext
-    );
-  }
-  const pendingVerification = {
-    id: input.pendingVerificationId,
-    field: "email",
-    value: input.email,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await UserMetadata2.updateUserMetadata(input.userId, {
-    ...metadata,
-    rownd_pending_verification: [
-      ...pendingVerifications.filter(
-        (pendingVerification2) => pendingVerification2.field !== "email"
+    config_type: appVariantId ? "variant" : "app",
+    ...variant ? { variant } : {},
+    app: {
+      id: app.id ?? "",
+      name: app.name ?? stConfig.appInfo.appName,
+      icon: app.icon ?? "",
+      ...app.userVerificationFields ? { user_verification_fields: app.userVerificationFields } : {},
+      schema: Object.fromEntries(
+        Object.entries(finalSchema).map(([key, field]) => [
+          key,
+          normalizeSchemaField(key, field)
+        ])
       ),
-      pendingVerification
-    ]
-  });
-  const response = await EmailVerification.sendEmailVerificationEmail(
-    input.tenantId,
-    input.userId,
-    input.recipeUserId,
-    input.email,
-    {
-      ...input.userContext,
-      rowndPendingVerificationId: pendingVerification.id
-    }
-  );
-  if (response.status === "EMAIL_ALREADY_VERIFIED_ERROR") {
-    await completePendingEmailVerification({
-      recipeUserId: input.recipeUserId,
-      email: input.email,
-      userContext: input.userContext
-    });
-  }
-  return getUserById(input.userId);
-}
-async function completePendingEmailVerification(input) {
-  const user = await SuperTokens.getUser(
-    input.recipeUserId.getAsString(),
-    input.userContext
-  );
-  const userId = user?.id ?? input.recipeUserId.getAsString();
-  const metadata = await getUserMetadata(userId);
-  const pendingVerifications = getPendingVerifications(metadata);
-  const pendingVerification = pendingVerifications.find(
-    (pendingVerification2) => pendingVerification2.field === "email" && pendingVerification2.value === input.email
-  );
-  if (!pendingVerification) {
-    return;
-  }
-  let metadataUserId = userId;
-  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
-  if (passwordlessEmailMethod) {
-    const updateResult = await Passwordless.updateUser({
-      recipeUserId: passwordlessEmailMethod.recipeUserId,
-      email: input.email,
-      userContext: input.userContext
-    });
-    if (updateResult.status !== "OK") {
-      throw new Error(
-        `Failed to update verified email method: ${updateResult.status}`
-      );
-    }
-  } else if (hasOnlyGuestLoginMethods(user)) {
-    const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
-      PUBLIC_TENANT_ID,
-      {
-        recipeId: "passwordless",
-        email: input.email
-      },
-      true,
-      void 0,
-      input.userContext
-    );
-    if (!isPasswordlessSignUpAllowed) {
-      throw new Error("Passwordless sign up is not allowed for this email");
-    }
-    const passwordlessUser = await Passwordless.signInUp({
-      email: input.email,
-      tenantId: PUBLIC_TENANT_ID,
-      userContext: input.userContext
-    });
-    const primaryUserResult = await AccountLinking.createPrimaryUser(
-      passwordlessUser.recipeUserId,
-      input.userContext
-    );
-    const primaryUserId = primaryUserResult.status === "OK" ? primaryUserResult.user.id : primaryUserResult.status === "RECIPE_USER_ID_ALREADY_LINKED_WITH_PRIMARY_USER_ID_ERROR" ? primaryUserResult.primaryUserId : passwordlessUser.user.id;
-    if (userId !== primaryUserId) {
-      const linkResult = await AccountLinking.linkAccounts(
-        input.recipeUserId,
-        primaryUserId,
-        input.userContext
-      );
-      if (linkResult.status !== "OK") {
-        throw new Error(
-          `Failed to link verified email method: ${linkResult.status}`
-        );
-      }
-    }
-    metadataUserId = primaryUserId;
-  }
-  const updatedMetadata = {
-    ...metadata,
-    ...metadata.original_rownd_user ? {
-      original_rownd_user: {
-        ...metadata.original_rownd_user,
-        data: {
-          ...metadata.original_rownd_user.data,
-          email: input.email
+      config: {
+        ...app.capabilities ? { capabilities: app.capabilities } : {},
+        ...app.web ? { web: app.web } : {},
+        ...app.bottomSheet ? { bottom_sheet: app.bottomSheet } : {},
+        ...app.profileStorageVersion ? { profile_storage_version: app.profileStorageVersion } : {},
+        customizations: {
+          primary_color: branding.primaryColor ?? DEFAULT_PRIMARY_COLOR,
+          ...branding.logo ? { logo: branding.logo } : {},
+          ...branding.logoDarkMode ? { logo_dark_mode: branding.logoDarkMode } : {},
+          ...branding.animations ? { animations: branding.animations } : {}
         },
-        verified_data: {
-          ...metadata.original_rownd_user.verified_data,
-          email: input.email
+        hub: {
+          ...app.allowedWebOrigins ? { allowed_web_origins: app.allowedWebOrigins } : {},
+          customizations: {
+            rounded_corners: branding.roundedCorners ?? true,
+            ...branding.containerBorderRadius !== void 0 ? { container_border_radius: branding.containerBorderRadius } : {},
+            ...branding.placement !== void 0 ? { placement: branding.placement } : {},
+            ...branding.hubPrimaryColor !== void 0 ? { primary_color: branding.hubPrimaryColor } : {},
+            ...branding.primaryColorDarkMode !== void 0 ? { primary_color_dark_mode: branding.primaryColorDarkMode } : {},
+            ...branding.backgroundColor !== void 0 ? { background_color: branding.backgroundColor } : {},
+            ...branding.fontFamily !== void 0 ? { font_family: branding.fontFamily } : {},
+            ...branding.hideVerificationIcons !== void 0 ? { hide_verification_icons: branding.hideVerificationIcons } : {},
+            visual_swoops: branding.visualSwoops ?? true,
+            blur_background: branding.blurBackground ?? true,
+            ...branding.blurBackgroundOpacity !== void 0 ? { blur_background_opacity: branding.blurBackgroundOpacity } : {},
+            ...branding.offsetX !== void 0 ? { offset_x: branding.offsetX } : {},
+            ...branding.offsetY !== void 0 ? { offset_y: branding.offsetY } : {},
+            ...branding.propertyOverrides ? { property_overrides: branding.propertyOverrides } : {},
+            dark_mode: branding.darkMode ?? "auto"
+          },
+          ...branding.customScripts ? { custom_scripts: branding.customScripts } : {},
+          ...branding.customStyles ? { custom_styles: branding.customStyles } : {},
+          auth: {
+            email: buildAuthEmailConfig(auth.email),
+            ...auth.mobile ? { mobile: buildAuthMobileConfig(auth.mobile) } : {},
+            sign_in_methods: signInMethods,
+            additional_fields: auth.additionalFields ?? [],
+            ...auth.rememberSignInMethod !== void 0 ? { remember_sign_in_method: auth.rememberSignInMethod } : {},
+            ...auth.useExplicitSignUpFlow !== void 0 ? { use_explicit_sign_up_flow: auth.useExplicitSignUpFlow } : {},
+            ...auth.allowUnverifiedUsers !== void 0 ? { allow_unverified_users: auth.allowUnverifiedUsers } : {},
+            ...auth.primarySignUpMethod ? { primary_sign_up_method: auth.primarySignUpMethod } : {},
+            ...auth.preferredMethod ? { preferred_method: auth.preferredMethod } : {},
+            ...auth.order ? { order: auth.order } : {},
+            ...isInstantAnonymousMethod(app.signInMethods) ? { instant_user: { enabled: true } } : {},
+            show_app_icon: branding.showAppIcon ?? false
+          },
+          legal: {
+            ...app.legal?.companyName ? { company_name: app.legal.companyName } : {},
+            ...app.legal?.privacyPolicyUrl ? { privacy_policy_url: app.legal.privacyPolicyUrl } : {},
+            ...app.legal?.termsConditionsUrl ? { terms_conditions_url: app.legal.termsConditionsUrl } : {},
+            ...app.legal?.supportEmail ? { support_email: app.legal.supportEmail } : {}
+          },
+          custom_content: {
+            ...app.customContent?.signInModal ? {
+              sign_in_modal: {
+                ...app.customContent.signInModal.title ? { title: app.customContent.signInModal.title } : {},
+                ...app.customContent.signInModal.subtitle ? { subtitle: app.customContent.signInModal.subtitle } : {},
+                ...app.customContent.signInModal.signInTitle ? {
+                  sign_in_title: app.customContent.signInModal.signInTitle
+                } : {},
+                ...app.customContent.signInModal.signUpTitle ? {
+                  sign_up_title: app.customContent.signInModal.signUpTitle
+                } : {},
+                ...app.customContent.signInModal.signInSubtitle ? {
+                  sign_in_subtitle: app.customContent.signInModal.signInSubtitle
+                } : {},
+                ...app.customContent.signInModal.signUpSubtitle ? {
+                  sign_up_subtitle: app.customContent.signInModal.signUpSubtitle
+                } : {},
+                ...app.customContent.signInModal.signInButton ? {
+                  sign_in_button: app.customContent.signInModal.signInButton
+                } : {},
+                ...app.customContent.signInModal.signUpButton ? {
+                  sign_up_button: app.customContent.signInModal.signUpButton
+                } : {}
+              }
+            } : {},
+            ...app.customContent?.profileModal ? { profile_modal: app.customContent.profileModal } : {},
+            ...app.customContent?.verificationModal ? {
+              verification_modal: {
+                ...app.customContent.verificationModal.title ? { title: app.customContent.verificationModal.title } : {},
+                ...app.customContent.verificationModal.subtitle ? { subtitle: app.customContent.verificationModal.subtitle } : {}
+              }
+            } : {},
+            ...app.customContent?.signInFailureModal ? {
+              sign_in_failure_modal: {
+                failure_message: app.customContent.signInFailureModal.failureMessage
+              }
+            } : {},
+            ...app.customContent?.noAccountMessage ? { no_account_message: app.customContent.noAccountMessage } : {},
+            ...app.customContent?.mobile ? { mobile: app.customContent.mobile } : {}
+          },
+          profile: {
+            ...app.profile?.accountInformation ? { account_information: app.profile.accountInformation } : {},
+            ...app.profile?.personalInformation ? { personal_information: app.profile.personalInformation } : {},
+            ...app.profile?.preferences ? { preferences: app.profile.preferences } : {},
+            ...app.profile?.signOutButton ? { sign_out_button: app.profile.signOutButton } : {},
+            ...app.profile?.deleteAccountButton ? { delete_account_button: app.profile.deleteAccountButton } : {},
+            ...app.profile?.addSignInMethodsButton ? { add_sign_in_methods_button: app.profile.addSignInMethodsButton } : {}
+          }
         }
       }
-    } : {},
-    rownd_pending_verification: pendingVerifications.filter(
-      (verification) => verification !== pendingVerification
-    )
+    }
   };
-  await UserMetadata2.updateUserMetadata(metadataUserId, updatedMetadata);
 }
-async function updateUserMetadata(userId, inputMeta) {
-  const metadata = await getUserMetadata(userId);
-  const updatedMetadata = {
-    ...metadata,
-    ...inputMeta
-  };
-  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
+function buildAuthEmailConfig(authEmail) {
   return {
-    id: userId,
-    meta: Object.fromEntries(
-      Object.entries(updatedMetadata).filter(
-        ([key]) => !isInternalMetadataField(key)
-      )
-    )
+    from_address: authEmail?.fromAddress ?? "no-reply@rownd.io",
+    image: authEmail?.image ?? "",
+    ...authEmail?.subject ? { subject: authEmail.subject } : {},
+    ...authEmail?.callToActionText ? { call_to_action_text: authEmail.callToActionText } : {},
+    ...authEmail?.verifyTemplate ? { verify_template: authEmail.verifyTemplate } : {},
+    ...authEmail?.customContent ? { custom_content: authEmail.customContent } : {},
+    ...authEmail?.customClosingContent ? { custom_closing_content: authEmail.customClosingContent } : {}
   };
 }
-function getThirdPartyId(method) {
-  return method.thirdPartyId || method.thirdParty?.id;
-}
-function getThirdPartyUserId(method) {
-  return method.thirdPartyUserId || method.thirdParty?.userId;
-}
-function getGuestAuthLevel(user) {
-  const guestMethod = user?.loginMethods.find(isGuestLoginMethod);
-  return guestMethod ? GUEST_AUTH_METHOD_ID : void 0;
-}
-function hasAnonymousLoginMethod(user) {
-  return !!user?.loginMethods.some((loginMethod) => {
-    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
-  });
-}
-function getPasswordlessEmailLoginMethod(user) {
-  return user?.loginMethods.find((method) => {
-    return method.recipeId === "passwordless" && !!method.email;
-  });
-}
-function hasOnlyGuestLoginMethods(user) {
-  return !!user?.loginMethods.length && user.loginMethods.every(isGuestLoginMethod);
+function buildAuthMobileConfig(authMobile) {
+  return {
+    ...authMobile?.title ? { title: authMobile.title } : {},
+    ...authMobile?.image ? { image: authMobile.image } : {},
+    ...authMobile?.callToActionText ? { call_to_action_text: authMobile.callToActionText } : {},
+    ...authMobile?.hyperlinkText ? { hyperlink_text: authMobile.hyperlinkText } : {},
+    ...authMobile?.hyperlinkRedirectUrl ? { hyperlink_redirect_url: authMobile.hyperlinkRedirectUrl } : {},
+    ...authMobile?.customContent ? { custom_content: authMobile.customContent } : {}
+  };
 }
-function isGuestLoginMethod(method) {
-  const thirdPartyId = getThirdPartyId(method);
-  return method.recipeId === "thirdparty" && (thirdPartyId === GUEST_AUTH_METHOD_ID || thirdPartyId === ANONYMOUS_AUTH_METHOD_ID);
+
+// src/rownd-compatibility.ts
+import SuperTokens from "supertokens-node";
+var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
+  "user_id",
+  "email",
+  "phone_number",
+  "google_id",
+  "apple_id"
+]);
+var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
+  "original_rownd_user",
+  "rownd_pending_verification"
+]);
+function isIdentityField(field) {
+  return IDENTITY_USER_DATA_FIELDS.has(field);
 }
-function isGuestAccountInfo(input) {
-  return input?.recipeId === "thirdparty" && (input.thirdParty?.id === GUEST_AUTH_METHOD_ID || input.thirdParty?.id === ANONYMOUS_AUTH_METHOD_ID);
+function isInternalMetadataField(field) {
+  return INTERNAL_METADATA_FIELDS.has(field);
 }
-function doesAccountInfoMatchAuthMethod(user, accountInfo) {
-  if (!user) {
-    return false;
+function mapRowndUserToSuperTokens(rowndUser) {
+  const loginMethods = [];
+  const rowndUserData = rowndUser.data || {};
+  const rowndUserVerifiedData = rowndUser.verified_data || {};
+  if (!rowndUserData.user_id) {
+    throw new Error("Rownd user has no user_id");
   }
-  const normalizedEmail = accountInfo.email?.toLowerCase();
-  if (normalizedEmail) {
-    return user.loginMethods.some((method) => {
-      if (isGuestLoginMethod(method) || !method.email) {
-        return false;
-      }
-      return method.email.toLowerCase() === normalizedEmail;
+  if (rowndUserData.google_id) {
+    if (!rowndUserData.email) {
+      throw new Error("Rownd Google user is missing email");
+    }
+    loginMethods.push({
+      recipeId: "thirdparty",
+      thirdPartyId: "google",
+      thirdPartyUserId: rowndUserData.google_id,
+      email: rowndUserData.email,
+      isVerified: !!rowndUserVerifiedData.google_id
     });
   }
-  if (accountInfo.phoneNumber) {
-    return user.loginMethods.some((method) => {
+  if (rowndUserData.apple_id) {
+    if (!rowndUserData.email) {
+      throw new Error("Rownd Apple user is missing email");
+    }
+    loginMethods.push({
+      recipeId: "thirdparty",
+      thirdPartyId: "apple",
+      thirdPartyUserId: rowndUserData.apple_id,
+      email: rowndUserData.email,
+      isVerified: !!rowndUserVerifiedData.apple_id
+    });
+  }
+  if (rowndUserData.phone_number) {
+    loginMethods.push({
+      recipeId: "passwordless",
+      phoneNumber: rowndUserData.phone_number,
+      isVerified: !!rowndUserVerifiedData.phone_number
+    });
+  }
+  if (rowndUserData.email && !rowndUserData.google_id && !rowndUserData.apple_id) {
+    loginMethods.push({
+      recipeId: "passwordless",
+      email: rowndUserData.email,
+      isVerified: !!rowndUserVerifiedData.email
+    });
+  }
+  let authLevel = rowndUser.auth_level;
+  if (loginMethods.length === 0) {
+    const thirdPartyId = authLevel === GUEST_AUTH_METHOD_ID ? GUEST_AUTH_METHOD_ID : ANONYMOUS_AUTH_METHOD_ID;
+    if (!authLevel) authLevel = thirdPartyId;
+    loginMethods.push({
+      recipeId: "thirdparty",
+      thirdPartyId,
+      thirdPartyUserId: rowndUserData.user_id,
+      email: `${rowndUserData.user_id}@anonymous.local`,
+      isVerified: false
+    });
+  }
+  const userMetadata = buildRowndUserMetadata(rowndUser);
+  return {
+    externalUserId: rowndUserData.user_id,
+    loginMethods,
+    userMetadata
+  };
+}
+function buildRowndUserMetadata(rowndUser) {
+  const metadata = {
+    ...rowndUser.meta || {},
+    original_rownd_user: rowndUser
+  };
+  for (const [key, value] of Object.entries(rowndUser.data || {})) {
+    if (!isIdentityField(key) && value !== void 0) {
+      metadata[key] = value;
+    }
+  }
+  return metadata;
+}
+function buildRowndAudience(currentPayload, appVariantId) {
+  const audience = getStringList(currentPayload.aud);
+  const appId = getPluginConfig()?.appConfig?.id;
+  if (appId) {
+    audience.push(`app:${appId}`);
+  }
+  if (appVariantId) {
+    audience.push(`app_variant:${appVariantId}`);
+  }
+  return audience.length > 0 ? { aud: [...new Set(audience)] } : {};
+}
+function buildConfiguredSessionClaims(metadata) {
+  if (!metadata) {
+    return {};
+  }
+  const schema = getPluginConfig()?.schema || DEFAULT_ROWND_SCHEMA;
+  const claims = {};
+  for (const [key, field] of Object.entries(schema)) {
+    if (field.include_in_session_claims !== true) {
+      continue;
+    }
+    const value = metadata.original_rownd_user?.data?.[key] ?? metadata[key];
+    if (value !== void 0) {
+      claims[field.session_claim_name || key] = value;
+    }
+  }
+  return claims;
+}
+function getRowndAppUserId(userId, user, currentPayload, metadata) {
+  const originalUserId = metadata?.original_rownd_user?.data?.user_id;
+  if (typeof originalUserId === "string") {
+    return originalUserId;
+  }
+  if (typeof currentPayload.app_user_id === "string") {
+    return currentPayload.app_user_id;
+  }
+  return user?.id || userId;
+}
+function getAnonymousId(userId, user, metadata) {
+  const originalAnonymousId = metadata?.original_rownd_user?.data?.anonymous_id;
+  if (typeof originalAnonymousId === "string") {
+    return originalAnonymousId;
+  }
+  const anonymousMethod = user?.loginMethods.find((loginMethod) => {
+    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
+  });
+  const thirdPartyUserId = anonymousMethod ? getThirdPartyUserId(anonymousMethod) : void 0;
+  return thirdPartyUserId || (hasAnonymousLoginMethod(user) ? `anon_${userId}` : void 0);
+}
+function buildRowndSessionClaimPayload(input) {
+  const currentPayload = input.currentPayload ?? {};
+  const originalRowndUser = input.metadata?.original_rownd_user;
+  const verifiedData = originalRowndUser?.verified_data;
+  const authLevel = getEffectiveAuthLevel(
+    input.user,
+    originalRowndUser?.auth_level,
+    verifiedData
+  );
+  const appUserId = getRowndAppUserId(
+    input.userId,
+    input.user,
+    currentPayload,
+    input.metadata
+  );
+  const isAnonymous = authLevel === GUEST_AUTH_METHOD_ID;
+  const anonymousId = getAnonymousId(input.userId, input.user, input.metadata);
+  const isVerifiedUser = authLevel !== "unverified";
+  const audience = buildRowndAudience(currentPayload, input.appVariantId);
+  const configuredClaims = buildConfiguredSessionClaims(input.metadata);
+  return {
+    ...audience,
+    ...configuredClaims,
+    app_user_id: appUserId,
+    auth_level: authLevel,
+    is_verified_user: isVerifiedUser,
+    [ROWND_JWT_CLAIMS.AppUserId]: appUserId,
+    [ROWND_JWT_CLAIMS.AuthLevel]: authLevel,
+    [ROWND_JWT_CLAIMS.IsVerifiedUser]: isVerifiedUser,
+    [ROWND_JWT_CLAIMS.IsAnonymous]: isAnonymous,
+    ...anonymousId ? { anonymous_id: anonymousId } : {}
+  };
+}
+async function shouldLinkRowndAccounts(input) {
+  const [newAccountInfo, , session] = input;
+  if (!session) {
+    return void 0;
+  }
+  const currentUser = await SuperTokens.getUser(session.getUserId());
+  if (hasOnlyGuestLoginMethods(currentUser)) {
+    return {
+      shouldAutomaticallyLink: true,
+      shouldRequireVerification: false
+    };
+  }
+  if (!currentUser || isGuestAccountInfo(newAccountInfo)) {
+    return void 0;
+  }
+  if (doesAccountInfoMatchAuthMethod(currentUser, newAccountInfo)) {
+    return {
+      shouldAutomaticallyLink: true,
+      shouldRequireVerification: true
+    };
+  }
+  return void 0;
+}
+function mapMethod(method) {
+  if (method.recipeId === "thirdparty") {
+    if (getThirdPartyId(method) === "google") return "google";
+    if (getThirdPartyId(method) === "apple") return "apple";
+  } else if (method.recipeId === "passwordless") {
+    if (method.email) return "email";
+    if (method.phoneNumber) return "phone";
+  } else if (method.recipeId === "emailpassword") {
+    return "email";
+  }
+  return "email";
+}
+function getThirdPartyId(method) {
+  return method.thirdParty?.id;
+}
+function getThirdPartyUserId(method) {
+  return method.thirdParty?.userId;
+}
+function getGuestAuthLevel(user) {
+  const guestMethod = user?.loginMethods.find(isGuestLoginMethod);
+  return guestMethod ? GUEST_AUTH_METHOD_ID : void 0;
+}
+function hasAnonymousLoginMethod(user) {
+  return !!user?.loginMethods.some((loginMethod) => {
+    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
+  });
+}
+function hasOnlyGuestLoginMethods(user) {
+  return !!user?.loginMethods.length && user.loginMethods.every(isGuestLoginMethod);
+}
+function isGuestLoginMethod(method) {
+  const thirdPartyId = getThirdPartyId(method);
+  return method.recipeId === "thirdparty" && (thirdPartyId === GUEST_AUTH_METHOD_ID || thirdPartyId === ANONYMOUS_AUTH_METHOD_ID);
+}
+function isGuestAccountInfo(input) {
+  return input?.recipeId === "thirdparty" && (input.thirdParty?.id === GUEST_AUTH_METHOD_ID || input.thirdParty?.id === ANONYMOUS_AUTH_METHOD_ID);
+}
+function doesAccountInfoMatchAuthMethod(user, accountInfo) {
+  if (!user) {
+    return false;
+  }
+  const normalizedEmail = accountInfo.email?.toLowerCase();
+  if (normalizedEmail) {
+    return user.loginMethods.some((method) => {
+      if (isGuestLoginMethod(method) || !method.email) {
+        return false;
+      }
+      return method.email.toLowerCase() === normalizedEmail;
+    });
+  }
+  if (accountInfo.phoneNumber) {
+    return user.loginMethods.some((method) => {
       return !isGuestLoginMethod(method) && method.phoneNumber === accountInfo.phoneNumber;
     });
   }
@@ -1960,7 +1600,7 @@ function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
   return getGuestAuthLevel(user) || originalAuthLevel || (verifiedData && Object.keys(verifiedData).length > 0 ? "verified" : "unverified");
 }
 function canUpdateUserDataField(field) {
-  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
+  const schema = getPluginConfig()?.schema || DEFAULT_ROWND_SCHEMA;
   const schemaField = schema[field];
   if (!schemaField) {
     return false;
@@ -1968,350 +1608,806 @@ function canUpdateUserDataField(field) {
   const ownedBy = field === "google_id" || field === "apple_id" ? "app" : schemaField.owned_by || "user";
   return ownedBy !== "app" && schemaField.read_only !== true;
 }
-var BUILTIN_SIGN_IN_METHOD_KEYS = [
-  "email",
-  "phone",
-  "google",
-  "apple",
-  "anonymous"
-];
-function normalizeSchemaField(key, field) {
-  let ownedBy = field.owned_by;
-  if (key === "google_id" || key === "apple_id") {
-    ownedBy = "app";
-  } else if (!ownedBy) {
-    ownedBy = "user";
+
+// src/rownd-repository.ts
+var rowndClient;
+function setRowndClient(client) {
+  rowndClient = client;
+}
+function getRowndClient() {
+  if (!rowndClient) {
+    throw new Error("Rownd client not initialized");
   }
-  return {
-    display_name: field.display_name,
-    type: field.type,
-    owned_by: ownedBy,
-    user_visible: field.user_visible,
-    read_only: field.read_only ?? ownedBy === "app",
-    show_empty: field.show_empty ?? false
-  };
+  return rowndClient;
 }
-var DEFAULT_PRIMARY_COLOR = "#5b5bd6";
-function buildSignInMethodsConfig(methodsArray) {
-  const methods = (methodsArray ?? []).reduce(
-    (acc, curr) => {
-      acc[curr.method] = curr;
-      return acc;
-    },
-    {}
-  );
-  const customProviders = Object.fromEntries(
-    Object.entries(methods).filter(([key]) => !BUILTIN_SIGN_IN_METHOD_KEYS.includes(key)).map(([key, val]) => {
-      return val ? [
-        key,
-        {
-          enabled: true,
-          display_name: getStringMethodProperty(val, "displayName") ?? key,
-          icon_light_url: getStringMethodProperty(val, "iconLightUrl"),
-          icon_dark_url: getStringMethodProperty(val, "iconDarkUrl")
-        }
-      ] : [key, void 0];
-    }).filter(([, v]) => v !== void 0)
-  );
-  const googleMethod = methods.google;
-  const appleMethod = methods.apple;
-  const anonymousMethod = methods.anonymous;
-  const anonymousType = getAnonymousType(anonymousMethod);
-  const googleOneTap = getOneTapConfig(googleMethod);
-  return {
-    email: { enabled: !!methods.email },
-    phone: { enabled: !!methods.phone },
-    google: {
-      enabled: !!googleMethod,
-      client_id: getStringMethodProperty(googleMethod, "clientId") ?? "",
-      ios_client_id: getStringMethodProperty(googleMethod, "iosClientId") ?? "",
-      scopes: getStringArrayMethodProperty(googleMethod, "scopes") ?? [],
-      ...getSignInFasterWithGoogle(googleMethod) ? { sign_in_faster_with_google: getSignInFasterWithGoogle(googleMethod) } : {},
-      one_tap: {
-        browser: {
-          auto_prompt: googleOneTap?.browser?.autoPrompt ?? false,
-          delay: googleOneTap?.browser?.delay ?? 7e3
-        },
-        mobile_app: {
-          auto_prompt: googleOneTap?.mobileApp?.autoPrompt ?? false,
-          delay: googleOneTap?.mobileApp?.delay ?? 7e3
-        }
-      }
-    },
-    apple: {
-      enabled: !!appleMethod,
-      client_id: getStringMethodProperty(appleMethod, "clientId") ?? ""
-    },
-    anonymous: {
-      enabled: !!anonymousMethod && anonymousType !== "instant",
-      ...anonymousMethod && anonymousType !== "instant" ? { type: anonymousType } : {},
-      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "displayName") !== void 0 ? {
-        display_name: getStringMethodProperty(
-          anonymousMethod,
-          "displayName"
-        )
-      } : {},
-      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconLightUrl") !== void 0 ? {
-        icon_light_url: getStringMethodProperty(
-          anonymousMethod,
-          "iconLightUrl"
-        )
-      } : {},
-      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconDarkUrl") !== void 0 ? {
-        icon_dark_url: getStringMethodProperty(
-          anonymousMethod,
-          "iconDarkUrl"
-        )
-      } : {}
-    },
-    ...customProviders
-  };
-}
-function isInstantAnonymousMethod(methods) {
-  return (methods ?? []).some(
-    (method) => method.method === "anonymous" && getAnonymousType(method) === "instant"
-  );
+async function validateRowndToken(token) {
+  const client = getRowndClient();
+  const tokenInfo = await client.validateToken(token);
+  return tokenInfo.user_id;
 }
-function getAnonymousType(method) {
-  const type = getStringMethodProperty(method, "type");
-  return type === "instant" ? "instant" : "guest";
+async function fetchRowndUserInfo(userId) {
+  const client = getRowndClient();
+  const rowndUser = await client.fetchUserInfo({ user_id: userId });
+  if (!rowndUser) {
+    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
+  }
+  return rowndUser;
 }
-function getSignInFasterWithGoogle(method) {
-  const value = getStringMethodProperty(method, "signInFasterWithGoogle");
-  return value === "enabled" || value === "disabled" ? value : void 0;
+
+// src/supertokens-repository.ts
+import SuperTokens2 from "supertokens-node";
+import AccountLinking from "supertokens-node/recipe/accountlinking";
+import EmailVerification from "supertokens-node/recipe/emailverification";
+import Passwordless from "supertokens-node/recipe/passwordless";
+import Session from "supertokens-node/recipe/session";
+import { BooleanClaim } from "supertokens-node/recipe/session/claims";
+import UserMetadata2 from "supertokens-node/recipe/usermetadata";
+async function importUser(stUser, config2) {
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (config2.apiKey) {
+    headers["api-key"] = config2.apiKey;
+  }
+  const response = await fetch(`${config2.connectionURI}/bulk-import/import`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(stUser)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(
+      `Bulk import failed with status ${response.status}: ${errorText}`
+    );
+  }
+  const importResponse = await response.json();
+  if (importResponse.status !== "OK" || !importResponse.user) {
+    throw new Error(
+      `Bulk import failed: ${importResponse.message || "Missing user in response"}`
+    );
+  }
+  return importResponse.user;
 }
-function getMethodProperty(method, property) {
-  if (!method) {
-    return void 0;
+async function recordRowndAppVariantForUser(userId, appVariantId) {
+  if (!appVariantId) {
+    return;
   }
-  return method[property];
+  assertRowndAppVariantIsConfigured(appVariantId);
+  const metadata = await getUserMetadata(userId);
+  const originalRowndUser = isJsonRecord(metadata.original_rownd_user) ? metadata.original_rownd_user : {};
+  const attributes = isJsonRecord(originalRowndUser.attributes) ? originalRowndUser.attributes : {};
+  const appVariants = getStringList(attributes["rownd:app_variants"]);
+  if (appVariants.includes(appVariantId)) {
+    return;
+  }
+  await UserMetadata2.updateUserMetadata(userId, {
+    ...metadata,
+    original_rownd_user: {
+      ...originalRowndUser,
+      data: isJsonRecord(originalRowndUser.data) ? originalRowndUser.data : { user_id: userId },
+      verified_data: isJsonRecord(originalRowndUser.verified_data) ? originalRowndUser.verified_data : {},
+      attributes: {
+        ...attributes,
+        "rownd:app_variants": [...appVariants, appVariantId]
+      }
+    }
+  });
 }
-function getStringMethodProperty(method, property) {
-  const value = getMethodProperty(method, property);
-  return typeof value === "string" ? value : void 0;
+var RowndIsAnonymousClaim = new BooleanClaim({
+  key: "is_anonymous",
+  fetchValue: async (userId) => {
+    const user = await SuperTokens2.getUser(userId);
+    const effectiveAuthLevel = getEffectiveAuthLevel(user);
+    return effectiveAuthLevel === GUEST_AUTH_METHOD_ID;
+  }
+});
+async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId) {
+  const user = await SuperTokens2.getUser(userId);
+  const metadata = user ? await getUserMetadata(user.id) : void 0;
+  return buildRowndSessionClaimPayload({
+    userId,
+    user,
+    metadata,
+    currentPayload,
+    appVariantId
+  });
 }
-function getStringArrayMethodProperty(method, property) {
-  const value = getMethodProperty(method, property);
-  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+async function getUserMetadata(userId) {
+  const metadata = await UserMetadata2.getUserMetadata(userId);
+  return metadata.metadata || {};
 }
-function getOneTapConfig(method) {
-  const oneTap = getMethodProperty(method, "oneTap");
-  if (!isRecord(oneTap)) {
-    return void 0;
+function getPendingVerifications(metadata) {
+  const pendingVerification = metadata.rownd_pending_verification;
+  if (Array.isArray(pendingVerification)) {
+    return pendingVerification.filter(isPendingVerification);
   }
-  return {
-    browser: parseOneTapPlatform(oneTap.browser),
-    mobileApp: parseOneTapPlatform(oneTap.mobileApp)
-  };
+  return [];
 }
-function parseOneTapPlatform(value) {
-  if (!isRecord(value)) {
-    return void 0;
+function isPendingVerification(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
+}
+async function getUserById(userId) {
+  const metadata = await getUserMetadata(userId);
+  const stUser = await SuperTokens2.getUser(userId);
+  if (!stUser) {
+    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
   }
-  return {
-    autoPrompt: typeof value.autoPrompt === "boolean" ? value.autoPrompt : void 0,
-    delay: typeof value.delay === "number" ? value.delay : void 0
+  const originalRowndUser = metadata.original_rownd_user;
+  const rowndUser = originalRowndUser?.data?.user_id || userId;
+  const state = originalRowndUser?.state || "enabled";
+  const dataFieldKeys = /* @__PURE__ */ new Set();
+  const data = {
+    user_id: userId
   };
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getSubBrandVariant(app) {
-  if (isRecord(app) && isRecord(app.variant) && typeof app.variant.id === "string") {
-    return app.variant;
+  for (const [key, value] of Object.entries(originalRowndUser?.data || {})) {
+    if (!isIdentityField(key)) {
+      data[key] = value;
+      dataFieldKeys.add(key);
+    }
   }
-  return void 0;
-}
-function mergeConfigInput(base, override) {
-  const result = { ...base };
-  for (const [key, value] of Object.entries(override)) {
-    if (value === void 0) {
-      continue;
+  const schema = getPluginConfig()?.schema || DEFAULT_ROWND_SCHEMA;
+  for (const key of Object.keys(schema)) {
+    dataFieldKeys.add(key);
+    if (!isInternalMetadataField(key) && !isIdentityField(key) && metadata[key] !== void 0) {
+      data[key] = metadata[key];
     }
-    const existing = result[key];
-    result[key] = isRecord(existing) && isRecord(value) ? mergeConfigInput(existing, value) : value;
   }
-  return result;
-}
-function buildAppConfig(config2, stConfig, appVariantId) {
-  const userSchema = config2.schema ?? DEFAULT_ROWND_SCHEMA;
-  const baseApp = config2.appConfig ?? {};
-  const subBrand = appVariantId ? config2.subBrands?.[appVariantId] : void 0;
-  const app = appVariantId ? subBrand && mergeConfigInput(baseApp, subBrand) : baseApp;
-  if (!app) {
-    return void 0;
+  const verifiedData = {
+    ...originalRowndUser?.verified_data || {}
+  };
+  for (const method of stUser.loginMethods) {
+    if (method.recipeId === "passwordless") {
+      if (method.email) {
+        verifiedData.email = method.email;
+        if (data.email === void 0) data.email = method.email;
+      }
+      if (method.phoneNumber) {
+        verifiedData.phone_number = method.phoneNumber;
+        if (data.phone_number === void 0)
+          data.phone_number = method.phoneNumber;
+      }
+    } else if (method.recipeId === "thirdparty") {
+      const thirdPartyId = getThirdPartyId(method);
+      const thirdPartyUserId = getThirdPartyUserId(method);
+      if (method.verified && method.email) {
+        verifiedData.email = method.email;
+      }
+      if (method.email && data.email === void 0) {
+        data.email = method.email;
+      }
+      if (thirdPartyId === "google" && thirdPartyUserId) {
+        data.google_id = thirdPartyUserId;
+        verifiedData.google_id = thirdPartyUserId;
+      }
+      if (thirdPartyId === "apple" && thirdPartyUserId) {
+        data.apple_id = thirdPartyUserId;
+        verifiedData.apple_id = thirdPartyUserId;
+      }
+    } else if (method.recipeId === "emailpassword") {
+      if (method.email && data.email === void 0) {
+        data.email = method.email;
+      }
+    }
   }
-  const branding = app.branding ?? {};
-  const auth = app.auth ?? {};
-  const signInMethods = buildSignInMethodsConfig(app.signInMethods);
-  const variant = getSubBrandVariant(app);
-  const finalSchema = { ...userSchema };
-  if (signInMethods.email.enabled && !finalSchema.email) {
-    finalSchema.email = {
-      display_name: "Email",
-      type: "string",
-      user_visible: true
-    };
+  if (verifiedData.email === true && typeof data.email === "string") {
+    verifiedData.email = data.email;
   }
-  if (signInMethods.phone.enabled && !finalSchema.phone_number) {
-    finalSchema.phone_number = {
-      display_name: "Phone number",
-      type: "string",
-      user_visible: true
-    };
+  if (verifiedData.phone_number === true && typeof data.phone_number === "string") {
+    verifiedData.phone_number = data.phone_number;
   }
-  if (signInMethods.google.enabled && !finalSchema.google_id) {
-    finalSchema.google_id = {
-      display_name: "Google ID",
-      type: "string",
-      user_visible: false
-    };
+  const anonymousId = getAnonymousId(stUser.id, stUser, metadata);
+  if (anonymousId && data.anonymous_id === void 0) {
+    data.anonymous_id = anonymousId;
   }
-  if (signInMethods.apple.enabled && !finalSchema.apple_id) {
-    finalSchema.apple_id = {
-      display_name: "Apple ID",
-      type: "string",
-      user_visible: false
-    };
+  const authLevel = getEffectiveAuthLevel(
+    stUser,
+    originalRowndUser?.auth_level,
+    verifiedData
+  );
+  for (const [key, field] of Object.entries(schema)) {
+    if (data[key] === void 0 && field.type === "string") {
+      data[key] = "";
+    }
   }
+  const sortedByJoined = [...stUser.loginMethods].sort(
+    (a, b) => a.timeJoined - b.timeJoined
+  );
+  const latestSessionInfo = await getLatestSessionInfo(stUser.id);
+  const firstMethod = sortedByJoined[0];
+  const latestSessionRecipeUserId = latestSessionInfo?.recipeUserId.getAsString();
+  const lastMethod = latestSessionRecipeUserId ? stUser.loginMethods.find(
+    (method) => method.recipeUserId.getAsString() === latestSessionRecipeUserId
+  ) : [...stUser.loginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
+  const lastSignInAt = latestSessionInfo?.timeCreated ?? stUser.timeJoined;
+  const metadataMeta = Object.fromEntries(
+    Object.entries(metadata).filter(
+      ([key]) => !isInternalMetadataField(key) && !dataFieldKeys.has(key)
+    )
+  );
+  const meta = {
+    ...metadataMeta,
+    created: new Date(stUser.timeJoined).toISOString(),
+    first_sign_in: new Date(stUser.timeJoined).toISOString(),
+    last_sign_in: new Date(lastSignInAt).toISOString(),
+    last_active: new Date(lastSignInAt).toISOString(),
+    first_sign_in_method: firstMethod ? mapMethod(firstMethod) : "email",
+    last_sign_in_method: lastMethod ? mapMethod(lastMethod) : "email"
+  };
   return {
-    config_type: appVariantId ? "variant" : "app",
-    ...variant ? { variant } : {},
-    app: {
-      id: app.id ?? "",
-      name: app.name ?? stConfig.appInfo.appName,
-      icon: app.icon ?? "",
-      ...app.userVerificationFields ? { user_verification_fields: app.userVerificationFields } : {},
-      schema: Object.fromEntries(
-        Object.entries(finalSchema).map(([key, field]) => [
-          key,
-          normalizeSchemaField(key, field)
-        ])
+    rownd_user: rowndUser,
+    data,
+    meta,
+    verified_data: verifiedData,
+    state,
+    auth_level: authLevel,
+    redacted: [],
+    groups: originalRowndUser?.groups || [],
+    attributes: originalRowndUser?.attributes || {}
+  };
+}
+async function getLatestSessionInfo(userId) {
+  const sessionHandles = await Session.getAllSessionHandlesForUser(
+    userId,
+    true,
+    PUBLIC_TENANT_ID
+  );
+  const sessionInfos = await Promise.all(
+    sessionHandles.map(
+      (sessionHandle) => Session.getSessionInformation(sessionHandle)
+    )
+  );
+  let latestSessionInfo;
+  for (const sessionInfo of sessionInfos) {
+    if (sessionInfo && (!latestSessionInfo || sessionInfo.timeCreated > latestSessionInfo.timeCreated)) {
+      latestSessionInfo = sessionInfo;
+    }
+  }
+  return latestSessionInfo;
+}
+async function updateUserData(userId, inputData) {
+  const metadata = await getUserMetadata(userId);
+  const updatedMetadata = {
+    ...metadata,
+    ...inputData
+  };
+  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
+  return getUserById(userId);
+}
+async function startPendingEmailVerification(input) {
+  const metadata = await getUserMetadata(input.userId);
+  const currentEmail = (await getUserById(input.userId)).data.email;
+  const pendingVerifications = getPendingVerifications(metadata);
+  const pendingEmailVerifications = pendingVerifications.filter(
+    (pendingVerification2) => pendingVerification2.field === "email"
+  );
+  if (currentEmail === input.email) {
+    for (const pendingVerification2 of pendingEmailVerifications) {
+      await EmailVerification.revokeEmailVerificationTokens(
+        input.tenantId,
+        input.recipeUserId,
+        pendingVerification2.value,
+        input.userContext
+      );
+    }
+    if (pendingEmailVerifications.length > 0) {
+      await UserMetadata2.updateUserMetadata(input.userId, {
+        ...metadata,
+        rownd_pending_verification: pendingVerifications.filter(
+          (pendingVerification2) => pendingVerification2.field !== "email"
+        )
+      });
+    }
+    return getUserById(input.userId);
+  }
+  for (const pendingVerification2 of pendingEmailVerifications) {
+    await EmailVerification.revokeEmailVerificationTokens(
+      input.tenantId,
+      input.recipeUserId,
+      pendingVerification2.value,
+      input.userContext
+    );
+  }
+  const pendingVerification = {
+    id: input.pendingVerificationId,
+    field: "email",
+    value: input.email,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await UserMetadata2.updateUserMetadata(input.userId, {
+    ...metadata,
+    rownd_pending_verification: [
+      ...pendingVerifications.filter(
+        (pendingVerification2) => pendingVerification2.field !== "email"
       ),
-      config: {
-        ...app.capabilities ? { capabilities: app.capabilities } : {},
-        ...app.web ? { web: app.web } : {},
-        ...app.bottomSheet ? { bottom_sheet: app.bottomSheet } : {},
-        ...app.profileStorageVersion ? { profile_storage_version: app.profileStorageVersion } : {},
-        customizations: {
-          primary_color: branding.primaryColor ?? DEFAULT_PRIMARY_COLOR,
-          ...branding.logo ? { logo: branding.logo } : {},
-          ...branding.logoDarkMode ? { logo_dark_mode: branding.logoDarkMode } : {},
-          ...branding.animations ? { animations: branding.animations } : {}
+      pendingVerification
+    ]
+  });
+  const response = await EmailVerification.sendEmailVerificationEmail(
+    input.tenantId,
+    input.userId,
+    input.recipeUserId,
+    input.email,
+    {
+      ...input.userContext,
+      rowndPendingVerificationId: pendingVerification.id
+    }
+  );
+  if (response.status === "EMAIL_ALREADY_VERIFIED_ERROR") {
+    await completePendingEmailVerification({
+      recipeUserId: input.recipeUserId,
+      email: input.email,
+      userContext: input.userContext
+    });
+  }
+  return getUserById(input.userId);
+}
+async function completePendingEmailVerification(input) {
+  const user = await SuperTokens2.getUser(
+    input.recipeUserId.getAsString(),
+    input.userContext
+  );
+  const userId = user?.id ?? input.recipeUserId.getAsString();
+  const metadata = await getUserMetadata(userId);
+  const pendingVerifications = getPendingVerifications(metadata);
+  const pendingVerification = pendingVerifications.find(
+    (pendingVerification2) => isMatchingPendingEmailVerification(
+      pendingVerification2,
+      input.email
+    )
+  );
+  if (!pendingVerification) {
+    return;
+  }
+  let metadataUserId = userId;
+  const passwordlessEmailMethod = getPasswordlessEmailLoginMethod(user);
+  if (passwordlessEmailMethod) {
+    const updateResult = await Passwordless.updateUser({
+      recipeUserId: passwordlessEmailMethod.recipeUserId,
+      email: input.email,
+      userContext: input.userContext
+    });
+    if (updateResult.status !== "OK") {
+      throw new Error(
+        `Failed to update verified email method: ${updateResult.status}`
+      );
+    }
+  } else if (hasOnlyGuestLoginMethods(user)) {
+    const isPasswordlessSignUpAllowed = await AccountLinking.isSignUpAllowed(
+      PUBLIC_TENANT_ID,
+      {
+        recipeId: "passwordless",
+        email: input.email
+      },
+      true,
+      void 0,
+      input.userContext
+    );
+    if (!isPasswordlessSignUpAllowed) {
+      throw new Error("Passwordless sign up is not allowed for this email");
+    }
+    const passwordlessUser = await Passwordless.signInUp({
+      email: input.email,
+      tenantId: PUBLIC_TENANT_ID,
+      userContext: input.userContext
+    });
+    const primaryUserResult = await AccountLinking.createPrimaryUser(
+      passwordlessUser.recipeUserId,
+      input.userContext
+    );
+    const primaryUserId = primaryUserResult.status === "OK" ? primaryUserResult.user.id : primaryUserResult.status === "RECIPE_USER_ID_ALREADY_LINKED_WITH_PRIMARY_USER_ID_ERROR" ? primaryUserResult.primaryUserId : passwordlessUser.user.id;
+    if (userId !== primaryUserId) {
+      const linkResult = await AccountLinking.linkAccounts(
+        input.recipeUserId,
+        primaryUserId,
+        input.userContext
+      );
+      if (linkResult.status !== "OK") {
+        throw new Error(
+          `Failed to link verified email method: ${linkResult.status}`
+        );
+      }
+    }
+    metadataUserId = primaryUserId;
+  }
+  const targetMetadata = metadataUserId === userId ? metadata : await getUserMetadata(metadataUserId);
+  const originalRowndUser = targetMetadata.original_rownd_user ?? metadata.original_rownd_user;
+  const targetPendingVerifications = getPendingVerifications(targetMetadata);
+  const updatedMetadata = {
+    ...targetMetadata,
+    ...originalRowndUser ? {
+      original_rownd_user: {
+        ...originalRowndUser,
+        data: {
+          ...originalRowndUser.data,
+          email: input.email
         },
-        hub: {
-          ...app.allowedWebOrigins ? { allowed_web_origins: app.allowedWebOrigins } : {},
-          customizations: {
-            rounded_corners: branding.roundedCorners ?? true,
-            ...branding.containerBorderRadius !== void 0 ? { container_border_radius: branding.containerBorderRadius } : {},
-            ...branding.placement !== void 0 ? { placement: branding.placement } : {},
-            ...branding.hubPrimaryColor !== void 0 ? { primary_color: branding.hubPrimaryColor } : {},
-            ...branding.primaryColorDarkMode !== void 0 ? { primary_color_dark_mode: branding.primaryColorDarkMode } : {},
-            ...branding.backgroundColor !== void 0 ? { background_color: branding.backgroundColor } : {},
-            ...branding.fontFamily !== void 0 ? { font_family: branding.fontFamily } : {},
-            ...branding.hideVerificationIcons !== void 0 ? { hide_verification_icons: branding.hideVerificationIcons } : {},
-            visual_swoops: branding.visualSwoops ?? true,
-            blur_background: branding.blurBackground ?? true,
-            ...branding.blurBackgroundOpacity !== void 0 ? { blur_background_opacity: branding.blurBackgroundOpacity } : {},
-            ...branding.offsetX !== void 0 ? { offset_x: branding.offsetX } : {},
-            ...branding.offsetY !== void 0 ? { offset_y: branding.offsetY } : {},
-            ...branding.propertyOverrides ? { property_overrides: branding.propertyOverrides } : {},
-            dark_mode: branding.darkMode ?? "auto"
-          },
-          ...branding.customScripts ? { custom_scripts: branding.customScripts } : {},
-          ...branding.customStyles ? { custom_styles: branding.customStyles } : {},
-          auth: {
-            email: buildAuthEmailConfig(auth.email),
-            ...auth.mobile ? { mobile: buildAuthMobileConfig(auth.mobile) } : {},
-            sign_in_methods: signInMethods,
-            additional_fields: auth.additionalFields ?? [],
-            ...auth.rememberSignInMethod !== void 0 ? { remember_sign_in_method: auth.rememberSignInMethod } : {},
-            ...auth.useExplicitSignUpFlow !== void 0 ? { use_explicit_sign_up_flow: auth.useExplicitSignUpFlow } : {},
-            ...auth.allowUnverifiedUsers !== void 0 ? { allow_unverified_users: auth.allowUnverifiedUsers } : {},
-            ...auth.primarySignUpMethod ? { primary_sign_up_method: auth.primarySignUpMethod } : {},
-            ...auth.preferredMethod ? { preferred_method: auth.preferredMethod } : {},
-            ...auth.order ? { order: auth.order } : {},
-            ...isInstantAnonymousMethod(app.signInMethods) ? { instant_user: { enabled: true } } : {},
-            show_app_icon: branding.showAppIcon ?? false
-          },
-          legal: {
-            ...app.legal?.companyName ? { company_name: app.legal.companyName } : {},
-            ...app.legal?.privacyPolicyUrl ? { privacy_policy_url: app.legal.privacyPolicyUrl } : {},
-            ...app.legal?.termsConditionsUrl ? { terms_conditions_url: app.legal.termsConditionsUrl } : {},
-            ...app.legal?.supportEmail ? { support_email: app.legal.supportEmail } : {}
-          },
-          custom_content: {
-            ...app.customContent?.signInModal ? {
-              sign_in_modal: {
-                ...app.customContent.signInModal.title ? { title: app.customContent.signInModal.title } : {},
-                ...app.customContent.signInModal.subtitle ? { subtitle: app.customContent.signInModal.subtitle } : {},
-                ...app.customContent.signInModal.signInTitle ? {
-                  sign_in_title: app.customContent.signInModal.signInTitle
-                } : {},
-                ...app.customContent.signInModal.signUpTitle ? {
-                  sign_up_title: app.customContent.signInModal.signUpTitle
-                } : {},
-                ...app.customContent.signInModal.signInSubtitle ? {
-                  sign_in_subtitle: app.customContent.signInModal.signInSubtitle
-                } : {},
-                ...app.customContent.signInModal.signUpSubtitle ? {
-                  sign_up_subtitle: app.customContent.signInModal.signUpSubtitle
-                } : {},
-                ...app.customContent.signInModal.signInButton ? {
-                  sign_in_button: app.customContent.signInModal.signInButton
-                } : {},
-                ...app.customContent.signInModal.signUpButton ? {
-                  sign_up_button: app.customContent.signInModal.signUpButton
-                } : {}
-              }
-            } : {},
-            ...app.customContent?.profileModal ? { profile_modal: app.customContent.profileModal } : {},
-            ...app.customContent?.verificationModal ? {
-              verification_modal: {
-                ...app.customContent.verificationModal.title ? { title: app.customContent.verificationModal.title } : {},
-                ...app.customContent.verificationModal.subtitle ? { subtitle: app.customContent.verificationModal.subtitle } : {}
-              }
-            } : {},
-            ...app.customContent?.signInFailureModal ? {
-              sign_in_failure_modal: {
-                failure_message: app.customContent.signInFailureModal.failureMessage
-              }
-            } : {},
-            ...app.customContent?.noAccountMessage ? { no_account_message: app.customContent.noAccountMessage } : {},
-            ...app.customContent?.mobile ? { mobile: app.customContent.mobile } : {}
-          },
-          profile: {
-            ...app.profile?.accountInformation ? { account_information: app.profile.accountInformation } : {},
-            ...app.profile?.personalInformation ? { personal_information: app.profile.personalInformation } : {},
-            ...app.profile?.preferences ? { preferences: app.profile.preferences } : {},
-            ...app.profile?.signOutButton ? { sign_out_button: app.profile.signOutButton } : {},
-            ...app.profile?.deleteAccountButton ? { delete_account_button: app.profile.deleteAccountButton } : {},
-            ...app.profile?.addSignInMethodsButton ? { add_sign_in_methods_button: app.profile.addSignInMethodsButton } : {}
+        verified_data: {
+          ...originalRowndUser.verified_data,
+          email: input.email
+        }
+      }
+    } : {},
+    rownd_pending_verification: targetPendingVerifications.filter(
+      (verification) => !isMatchingPendingEmailVerification(
+        verification,
+        input.email
+      )
+    )
+  };
+  await UserMetadata2.updateUserMetadata(metadataUserId, updatedMetadata);
+}
+function isMatchingPendingEmailVerification(verification, email) {
+  return verification.field === "email" && verification.value === email;
+}
+async function updateUserMetadata(userId, inputMeta) {
+  const metadata = await getUserMetadata(userId);
+  const updatedMetadata = {
+    ...metadata,
+    ...inputMeta
+  };
+  await UserMetadata2.updateUserMetadata(userId, updatedMetadata);
+  return {
+    id: userId,
+    meta: Object.fromEntries(
+      Object.entries(updatedMetadata).filter(
+        ([key]) => !isInternalMetadataField(key)
+      )
+    )
+  };
+}
+function getPasswordlessEmailLoginMethod(user) {
+  return user?.loginMethods.find((method) => {
+    return method.recipeId === "passwordless" && !!method.email;
+  });
+}
+
+// src/pluginImplementation.ts
+import { randomUUID } from "crypto";
+import SuperTokens3 from "supertokens-node";
+import Session2 from "supertokens-node/recipe/session";
+import ThirdParty from "supertokens-node/recipe/thirdparty";
+function handleGetAppConfig(deps) {
+  return async (req) => {
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    const appConfig = buildRowndAppConfig(
+      deps.pluginConfig,
+      deps.stConfig,
+      appVariantId
+    );
+    if (!appConfig) {
+      return {
+        status: "ERROR",
+        message: `Unknown Rownd app variant: ${appVariantId}`
+      };
+    }
+    return {
+      status: "OK",
+      ...appConfig
+    };
+  };
+}
+function handleGuestLogin(deps) {
+  return async (req, res, _session, userContext) => {
+    const startedAt = Date.now();
+    const guestId = `guest_${randomUUID()}`;
+    try {
+      const body = parseGuestBody(await getJsonBody(req));
+      const appVariantId = getRequestedAppVariantIdFromRequest(req);
+      assertRowndAppVariantIsConfigured(appVariantId);
+      const thirdPartyId = body.authLevel === ANONYMOUS_AUTH_METHOD_ID ? ANONYMOUS_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
+      const thirdPartyUserId = thirdPartyId === ANONYMOUS_AUTH_METHOD_ID ? `anon_${randomUUID()}` : guestId;
+      const response = await ThirdParty.manuallyCreateOrUpdateUser(
+        PUBLIC_TENANT_ID,
+        thirdPartyId,
+        thirdPartyUserId,
+        `${thirdPartyUserId}@anonymous.local`,
+        false,
+        void 0,
+        userContext
+      );
+      if (response.status !== "OK") {
+        throw new Error(
+          `Guest user creation failed with status: ${response.status}`
+        );
+      }
+      await Session2.createNewSession(
+        req,
+        res,
+        PUBLIC_TENANT_ID,
+        response.recipeUserId,
+        {
+          ...buildRowndAudience({}, appVariantId),
+          auth_level: GUEST_AUTH_METHOD_ID,
+          is_anonymous: true,
+          app_user_id: response.user.id
+        },
+        {},
+        userContext
+      );
+      logDebugMessage(`Guest session created for user: ${response.user.id}`);
+      deps.telemetryClient.recordSuccess({
+        outcome: "success",
+        durationMs: Date.now() - startedAt,
+        tenantId: PUBLIC_TENANT_ID,
+        superTokensUserId: response.user.id
+      });
+      return {
+        status: "OK",
+        createdNewRecipeUser: response.createdNewRecipeUser
+      };
+    } catch (error) {
+      logDebugMessage(`Guest login failed. Error: ${getErrorMessage(error)}`);
+      deps.telemetryClient.recordError({
+        error,
+        startedAt,
+        tenantId: PUBLIC_TENANT_ID
+      });
+      return {
+        status: "ERROR",
+        message: "Guest login failed"
+      };
+    }
+  };
+}
+function handleMigrate(deps) {
+  return async (req, res, _session, userContext) => {
+    const startedAt = Date.now();
+    let tenantId = PUBLIC_TENANT_ID;
+    let rowndUserId;
+    let superTokensUserId;
+    let user;
+    let recipeUserId;
+    try {
+      if (!deps.stConfig.supertokens) {
+        throw new Error("Supertokens config not found");
+      }
+      const parsed = await parseRequest(req);
+      const appVariantId = getRequestedAppVariantIdFromRequest(req);
+      assertRowndAppVariantIsConfigured(appVariantId);
+      rowndUserId = await validateRowndToken(parsed.token);
+      user = await SuperTokens3.getUser(rowndUserId, userContext);
+      if (!user) {
+        const rowndUser = await fetchRowndUserInfo(rowndUserId);
+        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        try {
+          const importedUser = await importUser(
+            stUserImport,
+            deps.stConfig.supertokens
+          );
+          superTokensUserId = importedUser.id;
+          if (importedUser.loginMethods[0]?.recipeUserId) {
+            recipeUserId = SuperTokens3.convertToRecipeUserId(
+              importedUser.loginMethods[0].recipeUserId
+            );
+          }
+        } catch (err) {
+          user = await SuperTokens3.getUser(rowndUserId, userContext);
+          if (!user) {
+            throw err;
           }
+          superTokensUserId = user.id;
+          recipeUserId = user.loginMethods[0]?.recipeUserId;
+          logDebugMessage(
+            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          );
         }
+        logDebugMessage(
+          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+        );
+      } else {
+        superTokensUserId = user.id;
+        recipeUserId = user.loginMethods[0]?.recipeUserId;
+        logDebugMessage(
+          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+        );
+      }
+      if (superTokensUserId) {
+        await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
+      }
+      if (!recipeUserId) {
+        throw new Error("User not found or has no login methods");
       }
+      await Session2.createNewSession(
+        req,
+        res,
+        PUBLIC_TENANT_ID,
+        recipeUserId,
+        {
+          ...buildRowndAudience({}, appVariantId)
+        },
+        {},
+        userContext
+      );
+      logDebugMessage(
+        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+      );
+      deps.telemetryClient.recordSuccess({
+        outcome: "success",
+        durationMs: Date.now() - startedAt,
+        tenantId,
+        rowndUserId,
+        superTokensUserId
+      });
+      return { status: "OK" };
+    } catch (error) {
+      logDebugMessage(`Migration failed. Error: ${getErrorMessage(error)}`);
+      deps.telemetryClient.recordError({
+        error,
+        startedAt,
+        tenantId,
+        rowndUserId,
+        superTokensUserId
+      });
+      return {
+        status: "ERROR",
+        message: error instanceof RowndPluginError ? error.message : "Migration failed"
+      };
     }
   };
 }
-function buildAuthEmailConfig(authEmail) {
-  return {
-    from_address: authEmail?.fromAddress ?? "no-reply@rownd.io",
-    image: authEmail?.image ?? "",
-    ...authEmail?.subject ? { subject: authEmail.subject } : {},
-    ...authEmail?.callToActionText ? { call_to_action_text: authEmail.callToActionText } : {},
-    ...authEmail?.verifyTemplate ? { verify_template: authEmail.verifyTemplate } : {},
-    ...authEmail?.customContent ? { custom_content: authEmail.customContent } : {},
-    ...authEmail?.customClosingContent ? { custom_closing_content: authEmail.customClosingContent } : {}
+function handleGetUser() {
+  return async (_req, _res, session) => {
+    const user = await getUserById(session.getUserId());
+    return {
+      status: "OK",
+      ...user
+    };
   };
 }
-function buildAuthMobileConfig(authMobile) {
+function handleUpdateUser() {
+  return async (req, _res, session, userContext) => {
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    assertRowndAppVariantIsConfigured(appVariantId);
+    const payload = parseUpdateUserBody(await getJsonBody(req));
+    const inputData = payload.data ?? {};
+    const requestUserContext = {
+      ...userContext,
+      ...payload.context
+    };
+    const { email, ...dataWithoutEmail } = inputData;
+    const hasEmailUpdate = hasOwn(inputData, "email") && typeof email === "string";
+    const permissionError = validateWritableFields(
+      Object.keys(dataWithoutEmail)
+    );
+    if (permissionError) {
+      return permissionError;
+    }
+    if (Object.keys(dataWithoutEmail).length > 0) {
+      await updateUserData(session.getUserId(), dataWithoutEmail);
+    }
+    if (hasEmailUpdate) {
+      const pendingVerificationResult = await startPendingEmailVerification({
+        userId: session.getUserId(),
+        recipeUserId: session.getRecipeUserId(),
+        tenantId: session.getTenantId(),
+        email,
+        pendingVerificationId: randomUUID(),
+        userContext: appVariantId ? { ...requestUserContext, rowndAppVariantId: appVariantId } : requestUserContext
+      });
+      return {
+        status: "OK",
+        ...pendingVerificationResult
+      };
+    }
+    const user = await getUserById(session.getUserId());
+    return {
+      status: "OK",
+      ...user
+    };
+  };
+}
+function handleDeleteUser() {
+  return async (_req, _res, session) => {
+    await SuperTokens3.deleteUser(session.getUserId(), true);
+    return { status: "OK" };
+  };
+}
+function handleSignOut() {
+  return async (_req, _res, session, userContext) => {
+    await Session2.revokeAllSessionsForUser(
+      session.getUserId(),
+      true,
+      session.getTenantId(),
+      userContext
+    );
+    return { status: "OK" };
+  };
+}
+function handleGetUserMeta() {
+  return async (_req, _res, session) => {
+    const metadata = await getUserMetadata(session.getUserId());
+    return {
+      status: "OK",
+      id: session.getUserId(),
+      meta: Object.fromEntries(
+        Object.entries(metadata).filter(
+          ([key]) => !isInternalMetadataField(key)
+        )
+      )
+    };
+  };
+}
+function handleUpdateUserMeta() {
+  return async (req, _res, session) => {
+    const payload = parseUpdateMetaBody(await getJsonBody(req));
+    const internalField = Object.keys(payload.meta ?? {}).find(
+      isInternalMetadataField
+    );
+    if (internalField) {
+      return {
+        status: "ERROR",
+        code: 403,
+        message: `field is not writable: ${internalField}`
+      };
+    }
+    const updateMetadataResult = await updateUserMetadata(
+      session.getUserId(),
+      payload.meta ?? {}
+    );
+    return {
+      status: "OK",
+      ...updateMetadataResult
+    };
+  };
+}
+function handleGetUserField() {
+  return async (req, _res, session) => {
+    const field = req.getKeyValueFromQuery("field");
+    if (!field) {
+      return missingFieldResponse();
+    }
+    const user = await getUserById(session.getUserId());
+    return {
+      status: "OK",
+      value: user.data[field]
+    };
+  };
+}
+function handleUpdateUserField() {
+  return async (req, _res, session, userContext) => {
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    assertRowndAppVariantIsConfigured(appVariantId);
+    const field = req.getKeyValueFromQuery("field");
+    if (!field) {
+      return missingFieldResponse();
+    }
+    const payload = parseUpdateFieldBody(await getJsonBody(req));
+    if (field === "email" && typeof payload.value === "string") {
+      const pendingVerificationResult = await startPendingEmailVerification({
+        userId: session.getUserId(),
+        recipeUserId: session.getRecipeUserId(),
+        tenantId: session.getTenantId(),
+        email: payload.value,
+        pendingVerificationId: randomUUID(),
+        userContext: appVariantId ? { ...userContext, rowndAppVariantId: appVariantId } : userContext
+      });
+      return {
+        status: "OK",
+        ...pendingVerificationResult
+      };
+    }
+    const permissionError = validateWritableFields([field]);
+    if (permissionError) {
+      return permissionError;
+    }
+    const updateUserDataResult = await updateUserData(session.getUserId(), {
+      [field]: payload.value
+    });
+    return {
+      status: "OK",
+      ...updateUserDataResult
+    };
+  };
+}
+function validateWritableFields(fields) {
+  const readOnlyField = fields.find((field) => !canUpdateUserDataField(field));
+  if (!readOnlyField) {
+    return void 0;
+  }
   return {
-    ...authMobile?.title ? { title: authMobile.title } : {},
-    ...authMobile?.image ? { image: authMobile.image } : {},
-    ...authMobile?.callToActionText ? { call_to_action_text: authMobile.callToActionText } : {},
-    ...authMobile?.hyperlinkText ? { hyperlink_text: authMobile.hyperlinkText } : {},
-    ...authMobile?.hyperlinkRedirectUrl ? { hyperlink_redirect_url: authMobile.hyperlinkRedirectUrl } : {},
-    ...authMobile?.customContent ? { custom_content: authMobile.customContent } : {}
+    status: "ERROR",
+    code: 403,
+    message: `field is not writable: ${readOnlyField}`
   };
 }
 
@@ -2328,6 +2424,9 @@ var init = createPluginInitFunction(
       const appVariantId = input?.userContext?.rowndAppVariantId;
       const displayContext = input?.userContext?.rowndDisplayContext;
       const redirectToPath = input?.userContext?.rowndRedirectToPath;
+      const clientDomain = input?.userContext?.rowndClientDomain;
+      const clientDomainKey = clientDomain ?? (displayContext === "mobile_app" ? "mobile" : "browser");
+      const clientBaseUrl = pluginConfig2.clientDomains?.[clientDomainKey];
       const bootstrapParams = {
         appKey: pluginConfig2.rowndAppKey,
         ...hubBootstrapParams ?? {},
@@ -2335,9 +2434,15 @@ var init = createPluginInitFunction(
         ...typeof displayContext === "string" ? { displayContext } : {},
         ...typeof redirectToPath === "string" ? { redirectToPath } : {}
       };
+      const rewrittenLink = input[linkKey] ? clientBaseUrl ? rewriteLinkToBaseUrl(
+        input[linkKey],
+        targetPath,
+        clientBaseUrl,
+        bootstrapParams
+      ) : rewriteLinkPath(input[linkKey], targetPath, bootstrapParams) : input[linkKey];
       return {
         ...input,
-        [linkKey]: input[linkKey] ? rewriteLinkPath(input[linkKey], targetPath, bootstrapParams) : input[linkKey]
+        [linkKey]: rewrittenLink
       };
     };
     setRowndClient(rowndClient2);
@@ -2473,13 +2578,13 @@ var init = createPluginInitFunction(
                   return {
                     ...implementation,
                     sendEmail: async function(input) {
-                      return implementation.sendEmail({
-                        ...addHubBootstrapParams(
+                      return implementation.sendEmail(
+                        addHubBootstrapParams(
                           input,
                           "urlWithLinkCode",
-                          "account/login"
+                          HUB_LOGIN_PAGE_PATH
                         )
-                      });
+                      );
                     }
                   };
                 }
@@ -2494,13 +2599,13 @@ var init = createPluginInitFunction(
                   return {
                     ...implementation,
                     sendSms: async function(input) {
-                      return implementation.sendSms({
-                        ...addHubBootstrapParams(
+                      return implementation.sendSms(
+                        addHubBootstrapParams(
                           input,
                           "urlWithLinkCode",
-                          "account/login"
+                          HUB_LOGIN_PAGE_PATH
                         )
-                      });
+                      );
                     }
                   };
                 }
@@ -2516,22 +2621,29 @@ var init = createPluginInitFunction(
               const displayContext = getRequestedDisplayContextFromRequest(
                 input.options.req
               );
+              if (displayContext) {
+                input.userContext.rowndDisplayContext = displayContext;
+              }
               const redirectToPath = getRequestedRedirectToPathFromRequest(
                 input.options.req
               );
+              if (redirectToPath) {
+                input.userContext.rowndRedirectToPath = redirectToPath;
+              }
+              const clientDomain = getRequestedClientDomainFromRequest(
+                input.options.req
+              );
+              if (clientDomain) {
+                input.userContext.rowndClientDomain = clientDomain;
+              }
               const appVariantId = getRequestedAppVariantIdFromRequest(
                 input.options.req
               );
+              if (appVariantId) {
+                input.userContext.rowndAppVariantId = appVariantId;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
-              return originalImplementation.createCodePOST({
-                ...input,
-                userContext: displayContext || redirectToPath || appVariantId ? {
-                  ...input.userContext,
-                  ...appVariantId ? { rowndAppVariantId: appVariantId } : {},
-                  ...displayContext ? { rowndDisplayContext: displayContext } : {},
-                  ...redirectToPath ? { rowndRedirectToPath: redirectToPath } : {}
-                } : input.userContext
-              });
+              return originalImplementation.createCodePOST(input);
             },
             consumeCodePOST: async (input) => {
               if (originalImplementation.consumeCodePOST === void 0) {
@@ -2542,11 +2654,11 @@ var init = createPluginInitFunction(
               const appVariantId = getRequestedAppVariantIdFromRequest(
                 input.options.req
               );
+              if (appVariantId) {
+                input.userContext.rowndAppVariantId = appVariantId;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
-              const response = await originalImplementation.consumeCodePOST({
-                ...input,
-                userContext: appVariantId ? { ...input.userContext, rowndAppVariantId: appVariantId } : input.userContext
-              });
+              const response = await originalImplementation.consumeCodePOST(input);
               if (response.status === "OK") {
                 await recordRowndAppVariantForUser(
                   response.user.id,
@@ -2567,11 +2679,11 @@ var init = createPluginInitFunction(
               const appVariantId = getRequestedAppVariantIdFromRequest(
                 input.options.req
               );
+              if (appVariantId) {
+                input.userContext.rowndAppVariantId = appVariantId;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
-              const response = await originalImplementation.signInUpPOST({
-                ...input,
-                userContext: appVariantId ? { ...input.userContext, rowndAppVariantId: appVariantId } : input.userContext
-              });
+              const response = await originalImplementation.signInUpPOST(input);
               if (response.status === "OK") {
                 await recordRowndAppVariantForUser(
                   response.user.id,
@@ -2609,19 +2721,23 @@ var init = createPluginInitFunction(
           functions: (originalImplementation) => ({
             ...originalImplementation,
             createNewSession: async (input) => {
-              input.accessTokenPayload = {
-                ...input.accessTokenPayload,
-                ...await buildRowndSessionClaims(
+              const [rowndSessionClaims, rowndIsAnonymousClaim] = await Promise.all([
+                buildRowndSessionClaims(
                   input.userId,
                   input.accessTokenPayload
                 ),
-                ...await RowndIsAnonymousClaim.build(
+                RowndIsAnonymousClaim.build(
                   input.userId,
                   input.recipeUserId,
                   input.tenantId,
                   input.accessTokenPayload,
                   input.userContext
                 )
+              ]);
+              input.accessTokenPayload = {
+                ...input.accessTokenPayload,
+                ...rowndSessionClaims,
+                ...rowndIsAnonymousClaim
               };
               return originalImplementation.createNewSession(input);
             }
@@ -2647,7 +2763,7 @@ var init = createPluginInitFunction(
                         ...addHubBootstrapParams(
                           input,
                           "emailVerifyLink",
-                          "account/verify-email"
+                          HUB_VERIFY_EMAIL_PAGE_PATH
                         )
                       });
                     }
@@ -2700,10 +2816,14 @@ var init = createPluginInitFunction(
         );
       }
     }
+    for (const [key, value] of Object.entries(config2.clientDomains ?? {})) {
+      validateClientDomainUrl(key, value);
+    }
     return {
       rowndAppKey: config2.rowndAppKey,
       rowndAppSecret: config2.rowndAppSecret,
       enableDebugLogs: config2.enableDebugLogs,
+      clientDomains: config2.clientDomains,
       telemetry: config2.telemetry,
       schema: config2.schema,
       appConfig: config2.appConfig,
@@ -2711,6 +2831,16 @@ var init = createPluginInitFunction(
     };
   }
 );
+function validateClientDomainUrl(key, value) {
+  try {
+    if (typeof value !== "string" || !/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(value)) {
+      throw new Error();
+    }
+    new URL(value);
+  } catch {
+    throw new Error(`Invalid clientDomains.${key} in plugin config`);
+  }
+}
 
 // src/index.ts
 var index_default = { init };
@@ -2719,8 +2849,11 @@ export {
   DEFAULT_ROWND_SCHEMA,
   GUEST_AUTH_METHOD_ID,
   HANDLE_BASE_PATH,
+  HUB_LOGIN_PAGE_PATH,
+  HUB_VERIFY_EMAIL_PAGE_PATH,
   PLUGIN_ID,
   PLUGIN_SDK_VERSION,
+  PLUGIN_VERSION,
   PUBLIC_TENANT_ID,
   ROWND_JWT_CLAIMS,
   ROWND_PLUGIN_ERROR_MESSAGES,