@supertokens-plugins/rownd-nodejs 0.3.0-beta.1 → 0.3.0-beta.2

package/dist/index.js

@@ -271,16 +271,17 @@ __export(index_exports, {
   DEFAULT_ROWND_SCHEMA: () => DEFAULT_ROWND_SCHEMA,
   GUEST_AUTH_METHOD_ID: () => GUEST_AUTH_METHOD_ID,
   HANDLE_BASE_PATH: () => HANDLE_BASE_PATH,
+  HUB_LOGIN_PAGE_PATH: () => HUB_LOGIN_PAGE_PATH,
+  HUB_VERIFY_EMAIL_PAGE_PATH: () => HUB_VERIFY_EMAIL_PAGE_PATH,
   PLUGIN_ID: () => PLUGIN_ID,
   PLUGIN_SDK_VERSION: () => PLUGIN_SDK_VERSION,
+  PLUGIN_VERSION: () => PLUGIN_VERSION,
   PUBLIC_TENANT_ID: () => PUBLIC_TENANT_ID,
   ROWND_JWT_CLAIMS: () => ROWND_JWT_CLAIMS,
   ROWND_PLUGIN_ERROR_MESSAGES: () => ROWND_PLUGIN_ERROR_MESSAGES,
   RowndPluginError: () => RowndPluginError,
   default: () => index_default,
   getRowndClient: () => getRowndClient,
-  getRowndEmailVerificationContent: () => getRowndEmailVerificationContent,
-  getRowndPasswordlessEmailContent: () => getRowndPasswordlessEmailContent,
   init: () => init,
   setRowndClient: () => setRowndClient
 });
@@ -680,10 +681,11 @@ var buildLogger = (pluginId, version, { fileLocation = true } = {}) => {
 
 // src/plugin.ts
 var import_node = require("@rownd/node");
-var import_supertokens_node2 = __toESM(require("supertokens-node"));
+var import_supertokens_node4 = __toESM(require("supertokens-node"));
 
 // src/constants.ts
 var PLUGIN_ID = "supertokens-plugin-rownd";
+var PLUGIN_VERSION = "0.3.0";
 var PLUGIN_SDK_VERSION = ["23.0.0", "23.0.1", ">=23.0.1"];
 var HANDLE_BASE_PATH = "/plugin/rownd";
 var PUBLIC_TENANT_ID = "public";
@@ -720,11 +722,13 @@ var DEFAULT_ROWND_SCHEMA = {
     user_visible: true
   }
 };
+var HUB_LOGIN_PAGE_PATH = "/account/login";
+var HUB_VERIFY_EMAIL_PAGE_PATH = "/account/verify-email";
 
 // src/logger.ts
 var { logDebugMessage, enableDebugLogs } = buildLogger(
   PLUGIN_ID,
-  PLUGIN_SDK_VERSION
+  PLUGIN_VERSION
 );
 
 // src/telemetry/axiomTelemetryClient.ts
@@ -841,17 +845,6 @@ function safeRecordEvent(client, event, outcome) {
   }
 }
 
-// src/pluginImplementation.ts
-var import_crypto = require("crypto");
-var import_supertokens_node = __toESM(require("supertokens-node"));
-var import_accountlinking = __toESM(require("supertokens-node/recipe/accountlinking"));
-var import_emailverification = __toESM(require("supertokens-node/recipe/emailverification"));
-var import_passwordless = __toESM(require("supertokens-node/recipe/passwordless"));
-var import_session = __toESM(require("supertokens-node/recipe/session"));
-var import_claims = require("supertokens-node/recipe/session/claims");
-var import_thirdparty = __toESM(require("supertokens-node/recipe/thirdparty"));
-var import_usermetadata2 = __toESM(require("supertokens-node/recipe/usermetadata"));
-
 // src/errors.ts
 var ROWND_PLUGIN_ERROR_MESSAGES = {
   MISSING_AUTHORIZATION_HEADER: "Missing authorization header",
@@ -864,7 +857,7 @@ var RowndPluginError = class extends Error {
   }
 };
 
-// src/pluginImplementation.ts
+// src/utils.ts
 function rewriteLinkPath(inputUrl, targetPath, searchParams) {
   try {
     const url = new URL(inputUrl);
@@ -883,7 +876,7 @@ function rewriteLinkPath(inputUrl, targetPath, searchParams) {
     return queryString ? `${path}?${queryString}` : path;
   }
 }
-function rewriteLinkToMobileDeepLink(inputUrl, targetPath, baseUrl, searchParams) {
+function rewriteLinkToBaseUrl(inputUrl, targetPath, baseUrl, searchParams) {
   const normalizedBaseUrl = baseUrl.endsWith("://") ? baseUrl : baseUrl.replace(/\/+$/, "") + "/";
   const targetUrl = new URL(
     `${normalizedBaseUrl}${targetPath.replace(/^\//, "")}`
@@ -903,23 +896,6 @@ function rewriteLinkToMobileDeepLink(inputUrl, targetPath, baseUrl, searchParams
   }
   return targetUrl.toString();
 }
-var rowndClient;
-var pluginConfig;
-function setRowndClient(client) {
-  rowndClient = client;
-}
-function getRowndClient() {
-  if (!rowndClient) {
-    throw new Error("Rownd client not initialized");
-  }
-  return rowndClient;
-}
-function setPluginConfig(config2) {
-  pluginConfig = config2;
-}
-function getPluginConfig() {
-  return pluginConfig;
-}
 async function parseRequest(req) {
   const authHeader = req.getHeaderValue("authorization");
   if (!authHeader) {
@@ -933,404 +909,459 @@ async function parseRequest(req) {
     token
   };
 }
-function handleGetAppConfig(deps) {
-  return async (req) => {
-    const appVariantId = getRequestedAppVariantIdFromRequest(req);
-    const appConfig = buildAppConfig(
-      deps.pluginConfig,
-      deps.stConfig,
-      appVariantId
-    );
-    if (!appConfig) {
-      return {
-        status: "ERROR",
-        message: `Unknown Rownd app variant: ${appVariantId}`
-      };
-    }
-    return {
-      status: "OK",
-      ...appConfig
-    };
-  };
+async function getJsonBody(req) {
+  return req.getJSONBody();
 }
-function handleGuestLogin(deps) {
-  return async (req, res, _session, userContext) => {
-    const startedAt = Date.now();
-    const guestId = `guest_${(0, import_crypto.randomUUID)()}`;
-    try {
-      const body = parseGuestBody(await getJsonBody(req));
-      const appVariantId = getRequestedAppVariantIdFromRequest(req);
-      assertRowndAppVariantIsConfigured(appVariantId);
-      const thirdPartyId = body.authLevel === ANONYMOUS_AUTH_METHOD_ID ? ANONYMOUS_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
-      const thirdPartyUserId = thirdPartyId === ANONYMOUS_AUTH_METHOD_ID ? `anon_${(0, import_crypto.randomUUID)()}` : guestId;
-      const response = await import_thirdparty.default.manuallyCreateOrUpdateUser(
-        PUBLIC_TENANT_ID,
-        thirdPartyId,
-        thirdPartyUserId,
-        `${thirdPartyUserId}@anonymous.local`,
-        false,
-        void 0,
-        userContext
-      );
-      if (response.status !== "OK") {
-        throw new Error(
-          `Guest user creation failed with status: ${response.status}`
-        );
-      }
-      await import_session.default.createNewSession(
-        req,
-        res,
-        PUBLIC_TENANT_ID,
-        response.recipeUserId,
-        {
-          ...buildRowndAudience({}, appVariantId),
-          auth_level: GUEST_AUTH_METHOD_ID,
-          is_anonymous: true,
-          app_user_id: response.user.id
-        },
-        {},
-        userContext
-      );
-      logDebugMessage(`Guest session created for user: ${response.user.id}`);
-      deps.telemetryClient.recordSuccess({
-        outcome: "success",
-        durationMs: Date.now() - startedAt,
-        tenantId: PUBLIC_TENANT_ID,
-        superTokensUserId: response.user.id
-      });
-      return {
-        status: "OK",
-        createdNewRecipeUser: response.createdNewRecipeUser
-      };
-    } catch (error) {
-      logDebugMessage(`Guest login failed. Error: ${getErrorMessage(error)}`);
-      deps.telemetryClient.recordError({
-        error,
-        startedAt,
-        tenantId: PUBLIC_TENANT_ID
-      });
-      return {
-        status: "ERROR",
-        message: "Guest login failed"
-      };
-    }
+function parseGuestBody(value) {
+  if (!isJsonRecord(value)) {
+    return {};
+  }
+  return {
+    authLevel: typeof value.auth_level === "string" ? value.auth_level : void 0
   };
 }
-function handleMigrate(deps) {
-  return async (req, res, _session, userContext) => {
-    const startedAt = Date.now();
-    let tenantId = PUBLIC_TENANT_ID;
-    let rowndUserId;
-    let superTokensUserId;
-    let user;
-    let recipeUserId;
-    try {
-      if (!deps.stConfig.supertokens) {
-        throw new Error("Supertokens config not found");
-      }
-      const parsed = await parseRequest(req);
-      const appVariantId = getRequestedAppVariantIdFromRequest(req);
-      assertRowndAppVariantIsConfigured(appVariantId);
-      rowndUserId = await validateRowndToken(parsed.token);
-      user = await import_supertokens_node.default.getUser(rowndUserId, userContext);
-      if (!user) {
-        const rowndUser = await fetchRowndUserInfo(rowndUserId);
-        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
-        try {
-          const importedUser = await importUser(
-            stUserImport,
-            deps.stConfig.supertokens
-          );
-          superTokensUserId = importedUser.id;
-          if (importedUser.loginMethods[0]?.recipeUserId) {
-            recipeUserId = import_supertokens_node.default.convertToRecipeUserId(
-              importedUser.loginMethods[0].recipeUserId
-            );
-          }
-        } catch (err) {
-          user = await import_supertokens_node.default.getUser(rowndUserId, userContext);
-          if (!user) {
-            throw err;
-          }
-          superTokensUserId = user.id;
-          recipeUserId = user.loginMethods[0]?.recipeUserId;
-          logDebugMessage(
-            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-          );
-        }
-        logDebugMessage(
-          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-        );
-      } else {
-        superTokensUserId = user.id;
-        recipeUserId = user.loginMethods[0]?.recipeUserId;
-        logDebugMessage(
-          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
-        );
-      }
-      if (superTokensUserId) {
-        await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
-      }
-      if (!recipeUserId) {
-        throw new Error("User not found or has no login methods");
-      }
-      await import_session.default.createNewSession(
-        req,
-        res,
-        PUBLIC_TENANT_ID,
-        recipeUserId,
-        {
-          ...buildRowndAudience({}, appVariantId)
-        },
-        {},
-        userContext
-      );
-      logDebugMessage(
-        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
-      );
-      deps.telemetryClient.recordSuccess({
-        outcome: "success",
-        durationMs: Date.now() - startedAt,
-        tenantId,
-        rowndUserId,
-        superTokensUserId
-      });
-      return { status: "OK" };
-    } catch (error) {
-      logDebugMessage(`Migration failed. Error: ${getErrorMessage(error)}`);
-      deps.telemetryClient.recordError({
-        error,
-        startedAt,
-        tenantId,
-        rowndUserId,
-        superTokensUserId
-      });
-      return {
-        status: "ERROR",
-        message: error instanceof RowndPluginError ? error.message : "Migration failed"
-      };
-    }
+function parseUpdateUserBody(value) {
+  if (!isJsonRecord(value) || !isJsonRecord(value.data)) {
+    return {};
+  }
+  return {
+    data: value.data,
+    ...isJsonRecord(value.context) ? { context: value.context } : {}
   };
 }
-function handleGetUser() {
-  return async (_req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    return {
-      status: "OK",
-      ...await getUserById(session.getUserId())
-    };
+function parseUpdateMetaBody(value) {
+  if (!isJsonRecord(value) || !isJsonRecord(value.meta)) {
+    return {};
+  }
+  return { meta: value.meta };
+}
+function parseUpdateFieldBody(value) {
+  if (!isJsonRecord(value) || !hasOwn(value, "value")) {
+    return {};
+  }
+  return { value: value.value };
+}
+function missingFieldResponse() {
+  return {
+    status: "ERROR",
+    code: 400,
+    message: "field is required"
   };
 }
-function handleUpdateUser() {
-  return async (req, _res, maybeSession, userContext) => {
-    const session = requireSession(maybeSession);
-    const appVariantId = getRequestedAppVariantIdFromRequest(req);
-    assertRowndAppVariantIsConfigured(appVariantId);
-    const payload = parseUpdateUserBody(await getJsonBody(req));
-    const inputData = payload.data ?? {};
-    const requestUserContext = {
-      ...userContext,
-      ...payload.context
-    };
-    const { email, ...dataWithoutEmail } = inputData;
-    const hasEmailUpdate = hasOwn(inputData, "email") && typeof email === "string";
-    const permissionError = validateWritableFields(
-      Object.keys(dataWithoutEmail)
-    );
-    if (permissionError) {
-      return permissionError;
-    }
-    if (Object.keys(dataWithoutEmail).length > 0) {
-      await updateUserData(session.getUserId(), dataWithoutEmail);
-    }
-    if (hasEmailUpdate) {
-      return {
-        status: "OK",
-        ...await startPendingEmailVerification({
-          userId: session.getUserId(),
-          recipeUserId: session.getRecipeUserId(),
-          tenantId: session.getTenantId(),
-          email,
-          pendingVerificationId: (0, import_crypto.randomUUID)(),
-          userContext: appVariantId ? { ...requestUserContext, rowndAppVariantId: appVariantId } : requestUserContext
-        })
-      };
-    }
-    return {
-      status: "OK",
-      ...await getUserById(session.getUserId())
-    };
-  };
+function isJsonRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function handleDeleteUser() {
-  return async (_req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    await import_supertokens_node.default.deleteUser(session.getUserId(), true);
-    return { status: "OK" };
-  };
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function handleSignOut() {
-  return async (_req, _res, maybeSession, userContext) => {
-    const session = requireSession(maybeSession);
-    await import_session.default.revokeAllSessionsForUser(
-      session.getUserId(),
-      true,
-      session.getTenantId(),
-      userContext
-    );
-    return { status: "OK" };
-  };
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
 }
-function handleGetUserMeta() {
-  return async (_req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    const metadata = await getUserMetadata(session.getUserId());
-    return {
-      status: "OK",
-      id: session.getUserId(),
-      meta: Object.fromEntries(
-        Object.entries(metadata).filter(
-          ([key]) => !isInternalMetadataField(key)
-        )
-      )
-    };
-  };
+function getStringList(value) {
+  if (Array.isArray(value)) {
+    return value.filter((entry) => typeof entry === "string");
+  }
+  return typeof value === "string" ? [value] : [];
 }
-function handleUpdateUserMeta() {
-  return async (req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    const payload = parseUpdateMetaBody(await getJsonBody(req));
-    const internalField = Object.keys(payload.meta ?? {}).find(
-      isInternalMetadataField
-    );
-    if (internalField) {
-      return {
-        status: "ERROR",
-        code: 403,
-        message: `field is not writable: ${internalField}`
-      };
-    }
-    return {
-      status: "OK",
-      ...await updateUserMetadata(session.getUserId(), payload.meta ?? {})
-    };
-  };
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : "Unknown error";
 }
-function handleGetUserField() {
-  return async (req, _res, maybeSession) => {
-    const session = requireSession(maybeSession);
-    const field = req.getKeyValueFromQuery("field");
-    if (!field) {
-      return missingFieldResponse();
-    }
-    const user = await getUserById(session.getUserId());
-    return {
-      status: "OK",
-      value: user.data[field]
-    };
-  };
+function getRequestedAppVariantIdFromRequest(req) {
+  return req.getKeyValueFromQuery("app_variant_id");
 }
-function handleUpdateUserField() {
-  return async (req, _res, maybeSession, userContext) => {
-    const session = requireSession(maybeSession);
-    const appVariantId = getRequestedAppVariantIdFromRequest(req);
-    assertRowndAppVariantIsConfigured(appVariantId);
-    const field = req.getKeyValueFromQuery("field");
-    if (!field) {
-      return missingFieldResponse();
-    }
-    const payload = parseUpdateFieldBody(await getJsonBody(req));
-    if (field === "email" && typeof payload.value === "string") {
-      return {
-        status: "OK",
-        ...await startPendingEmailVerification({
-          userId: session.getUserId(),
-          recipeUserId: session.getRecipeUserId(),
-          tenantId: session.getTenantId(),
-          email: payload.value,
-          pendingVerificationId: (0, import_crypto.randomUUID)(),
-          userContext: appVariantId ? { ...userContext, rowndAppVariantId: appVariantId } : userContext
-        })
-      };
-    }
-    const permissionError = validateWritableFields([field]);
-    if (permissionError) {
-      return permissionError;
-    }
-    return {
-      status: "OK",
-      ...await updateUserData(session.getUserId(), {
-        [field]: payload.value
-      })
-    };
-  };
+function getRequestedDisplayContextFromRequest(req) {
+  const displayContext = req.getKeyValueFromQuery("rownd_display_context");
+  return displayContext === "browser" || displayContext === "mobile_app" || displayContext === "customer_web_view" ? displayContext : void 0;
 }
-function requireSession(session) {
-  if (!session) {
-    throw new Error("Session not found");
-  }
-  return session;
+function getRequestedClientDomainFromRequest(req) {
+  const clientDomain = req.getKeyValueFromQuery("rownd_client_domain");
+  return typeof clientDomain === "string" && clientDomain.length > 0 ? clientDomain : void 0;
 }
-async function getJsonBody(req) {
-  return req.getJSONBody();
+function getRequestedRedirectToPathFromRequest(req) {
+  const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
+  return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
 }
-function parseGuestBody(value) {
-  if (!isJsonRecord(value)) {
-    return {};
-  }
-  return {
-    authLevel: typeof value.auth_level === "string" ? value.auth_level : void 0
-  };
+
+// src/config.ts
+var pluginConfig;
+function setPluginConfig(config2) {
+  pluginConfig = config2;
 }
-function parseUpdateUserBody(value) {
-  if (!isJsonRecord(value) || !isJsonRecord(value.data)) {
-    return {};
-  }
-  return {
-    data: value.data,
-    ...isJsonRecord(value.context) ? { context: value.context } : {}
-  };
+function getPluginConfig() {
+  return pluginConfig;
 }
-function parseUpdateMetaBody(value) {
-  if (!isJsonRecord(value) || !isJsonRecord(value.meta)) {
-    return {};
+function assertRowndAppVariantIsConfigured(appVariantId) {
+  if (!appVariantId) {
+    return;
   }
-  return { meta: value.meta };
-}
-function parseUpdateFieldBody(value) {
-  if (!isJsonRecord(value) || !hasOwn(value, "value")) {
-    return {};
+  if (pluginConfig?.subBrands && !pluginConfig.subBrands[appVariantId]) {
+    throw new Error(`Unknown Rownd app variant: ${appVariantId}`);
   }
-  return { value: value.value };
 }
-function validateWritableFields(fields) {
-  const readOnlyField = fields.find((field) => !canUpdateUserDataField(field));
-  if (!readOnlyField) {
-    return void 0;
+var BUILTIN_SIGN_IN_METHOD_KEYS = [
+  "email",
+  "phone",
+  "google",
+  "apple",
+  "anonymous"
+];
+function normalizeSchemaField(key, field) {
+  let ownedBy = field.owned_by;
+  if (key === "google_id" || key === "apple_id") {
+    ownedBy = "app";
+  } else if (!ownedBy) {
+    ownedBy = "user";
   }
   return {
-    status: "ERROR",
-    code: 403,
-    message: `field is not writable: ${readOnlyField}`
+    display_name: field.display_name,
+    type: field.type,
+    owned_by: ownedBy,
+    user_visible: field.user_visible,
+    read_only: field.read_only ?? ownedBy === "app",
+    show_empty: field.show_empty ?? false
   };
 }
-function missingFieldResponse() {
+var DEFAULT_PRIMARY_COLOR = "#5b5bd6";
+function buildSignInMethodsConfig(methodsArray) {
+  const methods = (methodsArray ?? []).reduce(
+    (acc, curr) => {
+      acc[curr.method] = curr;
+      return acc;
+    },
+    {}
+  );
+  const customProviders = Object.fromEntries(
+    Object.entries(methods).filter(([key]) => !BUILTIN_SIGN_IN_METHOD_KEYS.includes(key)).map(([key, val]) => {
+      return val ? [
+        key,
+        {
+          enabled: true,
+          display_name: getStringMethodProperty(val, "displayName") ?? key,
+          icon_light_url: getStringMethodProperty(val, "iconLightUrl"),
+          icon_dark_url: getStringMethodProperty(val, "iconDarkUrl")
+        }
+      ] : [key, void 0];
+    }).filter(([, v]) => v !== void 0)
+  );
+  const googleMethod = methods.google;
+  const appleMethod = methods.apple;
+  const anonymousMethod = methods.anonymous;
+  const anonymousType = getAnonymousType(anonymousMethod);
+  const googleOneTap = getOneTapConfig(googleMethod);
   return {
-    status: "ERROR",
-    code: 400,
-    message: "field is required"
+    email: { enabled: !!methods.email },
+    phone: { enabled: !!methods.phone },
+    google: {
+      enabled: !!googleMethod,
+      client_id: getStringMethodProperty(googleMethod, "clientId") ?? "",
+      ios_client_id: getStringMethodProperty(googleMethod, "iosClientId") ?? "",
+      scopes: getStringArrayMethodProperty(googleMethod, "scopes") ?? [],
+      ...getSignInFasterWithGoogle(googleMethod) ? { sign_in_faster_with_google: getSignInFasterWithGoogle(googleMethod) } : {},
+      one_tap: {
+        browser: {
+          auto_prompt: googleOneTap?.browser?.autoPrompt ?? false,
+          delay: googleOneTap?.browser?.delay ?? 7e3
+        },
+        mobile_app: {
+          auto_prompt: googleOneTap?.mobileApp?.autoPrompt ?? false,
+          delay: googleOneTap?.mobileApp?.delay ?? 7e3
+        }
+      }
+    },
+    apple: {
+      enabled: !!appleMethod,
+      client_id: getStringMethodProperty(appleMethod, "clientId") ?? ""
+    },
+    anonymous: {
+      enabled: !!anonymousMethod && anonymousType !== "instant",
+      ...anonymousMethod && anonymousType !== "instant" ? { type: anonymousType } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "displayName") !== void 0 ? {
+        display_name: getStringMethodProperty(
+          anonymousMethod,
+          "displayName"
+        )
+      } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconLightUrl") !== void 0 ? {
+        icon_light_url: getStringMethodProperty(
+          anonymousMethod,
+          "iconLightUrl"
+        )
+      } : {},
+      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconDarkUrl") !== void 0 ? {
+        icon_dark_url: getStringMethodProperty(
+          anonymousMethod,
+          "iconDarkUrl"
+        )
+      } : {}
+    },
+    ...customProviders
   };
 }
-function isJsonRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasOwn(value, key) {
-  return Object.prototype.hasOwnProperty.call(value, key);
+function isInstantAnonymousMethod(methods) {
+  return (methods ?? []).some(
+    (method) => method.method === "anonymous" && getAnonymousType(method) === "instant"
+  );
 }
-function getErrorMessage(error) {
-  return error instanceof Error ? error.message : "Unknown error";
+function getAnonymousType(method) {
+  const type = getStringMethodProperty(method, "type");
+  return type === "instant" ? "instant" : "guest";
 }
-function mapRowndUserToSuperTokens(rowndUser) {
+function getSignInFasterWithGoogle(method) {
+  const value = getStringMethodProperty(method, "signInFasterWithGoogle");
+  return value === "enabled" || value === "disabled" ? value : void 0;
+}
+function getMethodProperty(method, property) {
+  if (!method) {
+    return void 0;
+  }
+  return method[property];
+}
+function getStringMethodProperty(method, property) {
+  const value = getMethodProperty(method, property);
+  return typeof value === "string" ? value : void 0;
+}
+function getStringArrayMethodProperty(method, property) {
+  const value = getMethodProperty(method, property);
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
+function getOneTapConfig(method) {
+  const oneTap = getMethodProperty(method, "oneTap");
+  if (!isRecord(oneTap)) {
+    return void 0;
+  }
+  return {
+    browser: parseOneTapPlatform(oneTap.browser),
+    mobileApp: parseOneTapPlatform(oneTap.mobileApp)
+  };
+}
+function parseOneTapPlatform(value) {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  return {
+    autoPrompt: typeof value.autoPrompt === "boolean" ? value.autoPrompt : void 0,
+    delay: typeof value.delay === "number" ? value.delay : void 0
+  };
+}
+function getSubBrandVariant(app) {
+  if (isRecord(app) && isRecord(app.variant) && typeof app.variant.id === "string") {
+    return app.variant;
+  }
+  return void 0;
+}
+function mergeConfigInput(base, override) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (value === void 0) {
+      continue;
+    }
+    const existing = result[key];
+    result[key] = isRecord(existing) && isRecord(value) ? mergeConfigInput(existing, value) : value;
+  }
+  return result;
+}
+function buildRowndAppConfig(config2, stConfig, appVariantId) {
+  const userSchema = config2.schema ?? DEFAULT_ROWND_SCHEMA;
+  const baseApp = config2.appConfig ?? {};
+  const subBrand = appVariantId ? config2.subBrands?.[appVariantId] : void 0;
+  const app = appVariantId ? subBrand && mergeConfigInput(baseApp, subBrand) : baseApp;
+  if (!app) {
+    return void 0;
+  }
+  const branding = app.branding ?? {};
+  const auth = app.auth ?? {};
+  const signInMethods = buildSignInMethodsConfig(app.signInMethods);
+  const variant = getSubBrandVariant(app);
+  const finalSchema = { ...userSchema };
+  if (signInMethods.email.enabled && !finalSchema.email) {
+    finalSchema.email = {
+      display_name: "Email",
+      type: "string",
+      user_visible: true
+    };
+  }
+  if (signInMethods.phone.enabled && !finalSchema.phone_number) {
+    finalSchema.phone_number = {
+      display_name: "Phone number",
+      type: "string",
+      user_visible: true
+    };
+  }
+  if (signInMethods.google.enabled && !finalSchema.google_id) {
+    finalSchema.google_id = {
+      display_name: "Google ID",
+      type: "string",
+      user_visible: false
+    };
+  }
+  if (signInMethods.apple.enabled && !finalSchema.apple_id) {
+    finalSchema.apple_id = {
+      display_name: "Apple ID",
+      type: "string",
+      user_visible: false
+    };
+  }
+  return {
+    config_type: appVariantId ? "variant" : "app",
+    ...variant ? { variant } : {},
+    app: {
+      id: app.id ?? "",
+      name: app.name ?? stConfig.appInfo.appName,
+      icon: app.icon ?? "",
+      ...app.userVerificationFields ? { user_verification_fields: app.userVerificationFields } : {},
+      schema: Object.fromEntries(
+        Object.entries(finalSchema).map(([key, field]) => [
+          key,
+          normalizeSchemaField(key, field)
+        ])
+      ),
+      config: {
+        ...app.capabilities ? { capabilities: app.capabilities } : {},
+        ...app.web ? { web: app.web } : {},
+        ...app.bottomSheet ? { bottom_sheet: app.bottomSheet } : {},
+        ...app.profileStorageVersion ? { profile_storage_version: app.profileStorageVersion } : {},
+        customizations: {
+          primary_color: branding.primaryColor ?? DEFAULT_PRIMARY_COLOR,
+          ...branding.logo ? { logo: branding.logo } : {},
+          ...branding.logoDarkMode ? { logo_dark_mode: branding.logoDarkMode } : {},
+          ...branding.animations ? { animations: branding.animations } : {}
+        },
+        hub: {
+          ...app.allowedWebOrigins ? { allowed_web_origins: app.allowedWebOrigins } : {},
+          customizations: {
+            rounded_corners: branding.roundedCorners ?? true,
+            ...branding.containerBorderRadius !== void 0 ? { container_border_radius: branding.containerBorderRadius } : {},
+            ...branding.placement !== void 0 ? { placement: branding.placement } : {},
+            ...branding.hubPrimaryColor !== void 0 ? { primary_color: branding.hubPrimaryColor } : {},
+            ...branding.primaryColorDarkMode !== void 0 ? { primary_color_dark_mode: branding.primaryColorDarkMode } : {},
+            ...branding.backgroundColor !== void 0 ? { background_color: branding.backgroundColor } : {},
+            ...branding.fontFamily !== void 0 ? { font_family: branding.fontFamily } : {},
+            ...branding.hideVerificationIcons !== void 0 ? { hide_verification_icons: branding.hideVerificationIcons } : {},
+            visual_swoops: branding.visualSwoops ?? true,
+            blur_background: branding.blurBackground ?? true,
+            ...branding.blurBackgroundOpacity !== void 0 ? { blur_background_opacity: branding.blurBackgroundOpacity } : {},
+            ...branding.offsetX !== void 0 ? { offset_x: branding.offsetX } : {},
+            ...branding.offsetY !== void 0 ? { offset_y: branding.offsetY } : {},
+            ...branding.propertyOverrides ? { property_overrides: branding.propertyOverrides } : {},
+            dark_mode: branding.darkMode ?? "auto"
+          },
+          ...branding.customScripts ? { custom_scripts: branding.customScripts } : {},
+          ...branding.customStyles ? { custom_styles: branding.customStyles } : {},
+          auth: {
+            email: buildAuthEmailConfig(auth.email),
+            ...auth.mobile ? { mobile: buildAuthMobileConfig(auth.mobile) } : {},
+            sign_in_methods: signInMethods,
+            additional_fields: auth.additionalFields ?? [],
+            ...auth.rememberSignInMethod !== void 0 ? { remember_sign_in_method: auth.rememberSignInMethod } : {},
+            ...auth.useExplicitSignUpFlow !== void 0 ? { use_explicit_sign_up_flow: auth.useExplicitSignUpFlow } : {},
+            ...auth.allowUnverifiedUsers !== void 0 ? { allow_unverified_users: auth.allowUnverifiedUsers } : {},
+            ...auth.primarySignUpMethod ? { primary_sign_up_method: auth.primarySignUpMethod } : {},
+            ...auth.preferredMethod ? { preferred_method: auth.preferredMethod } : {},
+            ...auth.order ? { order: auth.order } : {},
+            ...isInstantAnonymousMethod(app.signInMethods) ? { instant_user: { enabled: true } } : {},
+            show_app_icon: branding.showAppIcon ?? false
+          },
+          legal: {
+            ...app.legal?.companyName ? { company_name: app.legal.companyName } : {},
+            ...app.legal?.privacyPolicyUrl ? { privacy_policy_url: app.legal.privacyPolicyUrl } : {},
+            ...app.legal?.termsConditionsUrl ? { terms_conditions_url: app.legal.termsConditionsUrl } : {},
+            ...app.legal?.supportEmail ? { support_email: app.legal.supportEmail } : {}
+          },
+          custom_content: {
+            ...app.customContent?.signInModal ? {
+              sign_in_modal: {
+                ...app.customContent.signInModal.title ? { title: app.customContent.signInModal.title } : {},
+                ...app.customContent.signInModal.subtitle ? { subtitle: app.customContent.signInModal.subtitle } : {},
+                ...app.customContent.signInModal.signInTitle ? {
+                  sign_in_title: app.customContent.signInModal.signInTitle
+                } : {},
+                ...app.customContent.signInModal.signUpTitle ? {
+                  sign_up_title: app.customContent.signInModal.signUpTitle
+                } : {},
+                ...app.customContent.signInModal.signInSubtitle ? {
+                  sign_in_subtitle: app.customContent.signInModal.signInSubtitle
+                } : {},
+                ...app.customContent.signInModal.signUpSubtitle ? {
+                  sign_up_subtitle: app.customContent.signInModal.signUpSubtitle
+                } : {},
+                ...app.customContent.signInModal.signInButton ? {
+                  sign_in_button: app.customContent.signInModal.signInButton
+                } : {},
+                ...app.customContent.signInModal.signUpButton ? {
+                  sign_up_button: app.customContent.signInModal.signUpButton
+                } : {}
+              }
+            } : {},
+            ...app.customContent?.profileModal ? { profile_modal: app.customContent.profileModal } : {},
+            ...app.customContent?.verificationModal ? {
+              verification_modal: {
+                ...app.customContent.verificationModal.title ? { title: app.customContent.verificationModal.title } : {},
+                ...app.customContent.verificationModal.subtitle ? { subtitle: app.customContent.verificationModal.subtitle } : {}
+              }
+            } : {},
+            ...app.customContent?.signInFailureModal ? {
+              sign_in_failure_modal: {
+                failure_message: app.customContent.signInFailureModal.failureMessage
+              }
+            } : {},
+            ...app.customContent?.noAccountMessage ? { no_account_message: app.customContent.noAccountMessage } : {},
+            ...app.customContent?.mobile ? { mobile: app.customContent.mobile } : {}
+          },
+          profile: {
+            ...app.profile?.accountInformation ? { account_information: app.profile.accountInformation } : {},
+            ...app.profile?.personalInformation ? { personal_information: app.profile.personalInformation } : {},
+            ...app.profile?.preferences ? { preferences: app.profile.preferences } : {},
+            ...app.profile?.signOutButton ? { sign_out_button: app.profile.signOutButton } : {},
+            ...app.profile?.deleteAccountButton ? { delete_account_button: app.profile.deleteAccountButton } : {},
+            ...app.profile?.addSignInMethodsButton ? { add_sign_in_methods_button: app.profile.addSignInMethodsButton } : {}
+          }
+        }
+      }
+    }
+  };
+}
+function buildAuthEmailConfig(authEmail) {
+  return {
+    from_address: authEmail?.fromAddress ?? "no-reply@rownd.io",
+    image: authEmail?.image ?? "",
+    ...authEmail?.subject ? { subject: authEmail.subject } : {},
+    ...authEmail?.callToActionText ? { call_to_action_text: authEmail.callToActionText } : {},
+    ...authEmail?.verifyTemplate ? { verify_template: authEmail.verifyTemplate } : {},
+    ...authEmail?.customContent ? { custom_content: authEmail.customContent } : {},
+    ...authEmail?.customClosingContent ? { custom_closing_content: authEmail.customClosingContent } : {}
+  };
+}
+function buildAuthMobileConfig(authMobile) {
+  return {
+    ...authMobile?.title ? { title: authMobile.title } : {},
+    ...authMobile?.image ? { image: authMobile.image } : {},
+    ...authMobile?.callToActionText ? { call_to_action_text: authMobile.callToActionText } : {},
+    ...authMobile?.hyperlinkText ? { hyperlink_text: authMobile.hyperlinkText } : {},
+    ...authMobile?.hyperlinkRedirectUrl ? { hyperlink_redirect_url: authMobile.hyperlinkRedirectUrl } : {},
+    ...authMobile?.customContent ? { custom_content: authMobile.customContent } : {}
+  };
+}
+
+// src/rownd-compatibility.ts
+var import_supertokens_node = __toESM(require("supertokens-node"));
+var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
+  "user_id",
+  "email",
+  "phone_number",
+  "google_id",
+  "apple_id"
+]);
+var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
+  "original_rownd_user",
+  "rownd_pending_verification"
+]);
+function isIdentityField(field) {
+  return IDENTITY_USER_DATA_FIELDS.has(field);
+}
+function isInternalMetadataField(field) {
+  return INTERNAL_METADATA_FIELDS.has(field);
+}
+function mapRowndUserToSuperTokens(rowndUser) {
   const loginMethods = [];
   const rowndUserData = rowndUser.data || {};
   const rowndUserVerifiedData = rowndUser.verified_data || {};
@@ -1394,112 +1425,6 @@ function mapRowndUserToSuperTokens(rowndUser) {
     userMetadata
   };
 }
-async function importUser(stUser, config2) {
-  const headers = {
-    "Content-Type": "application/json"
-  };
-  if (config2.apiKey) {
-    headers["api-key"] = config2.apiKey;
-  }
-  const response = await fetch(`${config2.connectionURI}/bulk-import/import`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(stUser)
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(
-      `Bulk import failed with status ${response.status}: ${errorText}`
-    );
-  }
-  const importResponse = await response.json();
-  if (importResponse.status !== "OK" || !importResponse.user) {
-    throw new Error(
-      `Bulk import failed: ${importResponse.message || "Missing user in response"}`
-    );
-  }
-  return importResponse.user;
-}
-async function validateRowndToken(token) {
-  const client = getRowndClient();
-  const tokenInfo = await client.validateToken(token);
-  return tokenInfo.user_id;
-}
-async function fetchRowndUserInfo(userId) {
-  const client = getRowndClient();
-  const rowndUser = await client.fetchUserInfo({ user_id: userId });
-  if (!rowndUser) {
-    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
-  }
-  return rowndUser;
-}
-var IDENTITY_USER_DATA_FIELDS = /* @__PURE__ */ new Set([
-  "user_id",
-  "email",
-  "phone_number",
-  "google_id",
-  "apple_id"
-]);
-var INTERNAL_METADATA_FIELDS = /* @__PURE__ */ new Set([
-  "original_rownd_user",
-  "rownd_pending_verification"
-]);
-function isIdentityField(field) {
-  return IDENTITY_USER_DATA_FIELDS.has(field);
-}
-function isInternalMetadataField(field) {
-  return INTERNAL_METADATA_FIELDS.has(field);
-}
-function getStringList(value) {
-  if (Array.isArray(value)) {
-    return value.filter((entry) => typeof entry === "string");
-  }
-  return typeof value === "string" ? [value] : [];
-}
-function getRequestedAppVariantIdFromRequest(req) {
-  return req.getKeyValueFromQuery("app_variant_id");
-}
-function getRequestedDisplayContextFromRequest(req) {
-  const displayContext = req.getKeyValueFromQuery("rownd_display_context");
-  return displayContext === "browser" || displayContext === "mobile_app" || displayContext === "customer_web_view" ? displayContext : void 0;
-}
-function getRequestedRedirectToPathFromRequest(req) {
-  const redirectToPath = req.getKeyValueFromQuery("rownd_redirect_to_path");
-  return typeof redirectToPath === "string" && redirectToPath.length > 0 ? redirectToPath : void 0;
-}
-function assertRowndAppVariantIsConfigured(appVariantId) {
-  if (!appVariantId) {
-    return;
-  }
-  if (pluginConfig?.subBrands && !pluginConfig.subBrands[appVariantId]) {
-    throw new Error(`Unknown Rownd app variant: ${appVariantId}`);
-  }
-}
-async function recordRowndAppVariantForUser(userId, appVariantId) {
-  if (!appVariantId) {
-    return;
-  }
-  assertRowndAppVariantIsConfigured(appVariantId);
-  const metadata = await getUserMetadata(userId);
-  const originalRowndUser = isJsonRecord(metadata.original_rownd_user) ? metadata.original_rownd_user : {};
-  const attributes = isJsonRecord(originalRowndUser.attributes) ? originalRowndUser.attributes : {};
-  const appVariants = getStringList(attributes["rownd:app_variants"]);
-  if (appVariants.includes(appVariantId)) {
-    return;
-  }
-  await import_usermetadata2.default.updateUserMetadata(userId, {
-    ...metadata,
-    original_rownd_user: {
-      ...originalRowndUser,
-      data: isJsonRecord(originalRowndUser.data) ? originalRowndUser.data : { user_id: userId },
-      verified_data: isJsonRecord(originalRowndUser.verified_data) ? originalRowndUser.verified_data : {},
-      attributes: {
-        ...attributes,
-        "rownd:app_variants": [...appVariants, appVariantId]
-      }
-    }
-  });
-}
 function buildRowndUserMetadata(rowndUser) {
   const metadata = {
     ...rowndUser.meta || {},
@@ -1512,48 +1437,22 @@ function buildRowndUserMetadata(rowndUser) {
   }
   return metadata;
 }
-var RowndIsAnonymousClaim = new import_claims.BooleanClaim({
-  key: "is_anonymous",
-  fetchValue: async (userId) => {
-    const user = await import_supertokens_node.default.getUser(userId);
-    const effectiveAuthLevel = getEffectiveAuthLevel(user);
-    return effectiveAuthLevel === GUEST_AUTH_METHOD_ID;
+function buildRowndAudience(currentPayload, appVariantId) {
+  const audience = getStringList(currentPayload.aud);
+  const appId = getPluginConfig()?.appConfig?.id;
+  if (appId) {
+    audience.push(`app:${appId}`);
   }
-});
-async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId) {
-  const user = await import_supertokens_node.default.getUser(userId);
-  const metadata = user ? await getUserMetadata(user.id) : void 0;
-  const originalRowndUser = metadata?.original_rownd_user;
-  const verifiedData = originalRowndUser?.verified_data;
-  const authLevel = getEffectiveAuthLevel(
-    user,
-    originalRowndUser?.auth_level,
-    verifiedData
-  );
-  const appUserId = getRowndAppUserId(userId, user, currentPayload, metadata);
-  const isAnonymous = authLevel === GUEST_AUTH_METHOD_ID;
-  const anonymousId = getAnonymousId(userId, user, metadata);
-  const isVerifiedUser = authLevel !== "unverified";
-  const audience = buildRowndAudience(currentPayload, appVariantId);
-  const configuredClaims = buildConfiguredSessionClaims(metadata);
-  return {
-    ...audience,
-    ...configuredClaims,
-    app_user_id: appUserId,
-    auth_level: authLevel,
-    is_verified_user: isVerifiedUser,
-    [ROWND_JWT_CLAIMS.AppUserId]: appUserId,
-    [ROWND_JWT_CLAIMS.AuthLevel]: authLevel,
-    [ROWND_JWT_CLAIMS.IsVerifiedUser]: isVerifiedUser,
-    [ROWND_JWT_CLAIMS.IsAnonymous]: isAnonymous,
-    ...anonymousId ? { anonymous_id: anonymousId } : {}
-  };
+  if (appVariantId) {
+    audience.push(`app_variant:${appVariantId}`);
+  }
+  return audience.length > 0 ? { aud: [...new Set(audience)] } : {};
 }
 function buildConfiguredSessionClaims(metadata) {
   if (!metadata) {
     return {};
   }
-  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
+  const schema = getPluginConfig()?.schema || DEFAULT_ROWND_SCHEMA;
   const claims = {};
   for (const [key, field] of Object.entries(schema)) {
     if (field.include_in_session_claims !== true) {
@@ -1576,17 +1475,6 @@ function getRowndAppUserId(userId, user, currentPayload, metadata) {
   }
   return user?.id || userId;
 }
-function buildRowndAudience(currentPayload, appVariantId) {
-  const audience = getStringList(currentPayload.aud);
-  const appId = pluginConfig?.appConfig?.id;
-  if (appId) {
-    audience.push(`app:${appId}`);
-  }
-  if (appVariantId) {
-    audience.push(`app_variant:${appVariantId}`);
-  }
-  return audience.length > 0 ? { aud: [...new Set(audience)] } : {};
-}
 function getAnonymousId(userId, user, metadata) {
   const originalAnonymousId = metadata?.original_rownd_user?.data?.anonymous_id;
   if (typeof originalAnonymousId === "string") {
@@ -1598,6 +1486,39 @@ function getAnonymousId(userId, user, metadata) {
   const thirdPartyUserId = anonymousMethod ? getThirdPartyUserId(anonymousMethod) : void 0;
   return thirdPartyUserId || (hasAnonymousLoginMethod(user) ? `anon_${userId}` : void 0);
 }
+function buildRowndSessionClaimPayload(input) {
+  const currentPayload = input.currentPayload ?? {};
+  const originalRowndUser = input.metadata?.original_rownd_user;
+  const verifiedData = originalRowndUser?.verified_data;
+  const authLevel = getEffectiveAuthLevel(
+    input.user,
+    originalRowndUser?.auth_level,
+    verifiedData
+  );
+  const appUserId = getRowndAppUserId(
+    input.userId,
+    input.user,
+    currentPayload,
+    input.metadata
+  );
+  const isAnonymous = authLevel === GUEST_AUTH_METHOD_ID;
+  const anonymousId = getAnonymousId(input.userId, input.user, input.metadata);
+  const isVerifiedUser = authLevel !== "unverified";
+  const audience = buildRowndAudience(currentPayload, input.appVariantId);
+  const configuredClaims = buildConfiguredSessionClaims(input.metadata);
+  return {
+    ...audience,
+    ...configuredClaims,
+    app_user_id: appUserId,
+    auth_level: authLevel,
+    is_verified_user: isVerifiedUser,
+    [ROWND_JWT_CLAIMS.AppUserId]: appUserId,
+    [ROWND_JWT_CLAIMS.AuthLevel]: authLevel,
+    [ROWND_JWT_CLAIMS.IsVerifiedUser]: isVerifiedUser,
+    [ROWND_JWT_CLAIMS.IsAnonymous]: isAnonymous,
+    ...anonymousId ? { anonymous_id: anonymousId } : {}
+  };
+}
 async function shouldLinkRowndAccounts(input) {
   const [newAccountInfo, , session] = input;
   if (!session) {
@@ -1621,59 +1542,248 @@ async function shouldLinkRowndAccounts(input) {
   }
   return void 0;
 }
-async function getUserMetadata(userId) {
-  const metadata = await import_usermetadata2.default.getUserMetadata(userId);
-  return metadata.metadata || {};
-}
-function getPendingVerifications(metadata) {
-  const pendingVerification = metadata.rownd_pending_verification;
-  if (Array.isArray(pendingVerification)) {
-    return pendingVerification.filter(isPendingVerification);
+function mapMethod(method) {
+  if (method.recipeId === "thirdparty") {
+    if (getThirdPartyId(method) === "google") return "google";
+    if (getThirdPartyId(method) === "apple") return "apple";
+  } else if (method.recipeId === "passwordless") {
+    if (method.email) return "email";
+    if (method.phoneNumber) return "phone";
+  } else if (method.recipeId === "emailpassword") {
+    return "email";
   }
-  return [];
+  return "email";
 }
-function isPendingVerification(value) {
-  return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
+function getThirdPartyId(method) {
+  return method.thirdParty?.id;
 }
-async function getUserById(userId) {
-  const metadata = await getUserMetadata(userId);
-  const stUser = await import_supertokens_node.default.getUser(userId);
-  if (!stUser) {
-    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
+function getThirdPartyUserId(method) {
+  return method.thirdParty?.userId;
+}
+function getGuestAuthLevel(user) {
+  const guestMethod = user?.loginMethods.find(isGuestLoginMethod);
+  return guestMethod ? GUEST_AUTH_METHOD_ID : void 0;
+}
+function hasAnonymousLoginMethod(user) {
+  return !!user?.loginMethods.some((loginMethod) => {
+    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
+  });
+}
+function hasOnlyGuestLoginMethods(user) {
+  return !!user?.loginMethods.length && user.loginMethods.every(isGuestLoginMethod);
+}
+function isGuestLoginMethod(method) {
+  const thirdPartyId = getThirdPartyId(method);
+  return method.recipeId === "thirdparty" && (thirdPartyId === GUEST_AUTH_METHOD_ID || thirdPartyId === ANONYMOUS_AUTH_METHOD_ID);
+}
+function isGuestAccountInfo(input) {
+  return input?.recipeId === "thirdparty" && (input.thirdParty?.id === GUEST_AUTH_METHOD_ID || input.thirdParty?.id === ANONYMOUS_AUTH_METHOD_ID);
+}
+function doesAccountInfoMatchAuthMethod(user, accountInfo) {
+  if (!user) {
+    return false;
   }
-  const originalRowndUser = metadata.original_rownd_user;
-  const rowndUser = originalRowndUser?.data?.user_id || userId;
-  const state = originalRowndUser?.state || "enabled";
-  const dataFieldKeys = /* @__PURE__ */ new Set();
-  const data = {
-    user_id: userId
-  };
-  for (const [key, value] of Object.entries(originalRowndUser?.data || {})) {
-    if (!isIdentityField(key)) {
-      data[key] = value;
-      dataFieldKeys.add(key);
-    }
+  const normalizedEmail = accountInfo.email?.toLowerCase();
+  if (normalizedEmail) {
+    return user.loginMethods.some((method) => {
+      if (isGuestLoginMethod(method) || !method.email) {
+        return false;
+      }
+      return method.email.toLowerCase() === normalizedEmail;
+    });
   }
-  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
-  for (const key of Object.keys(schema)) {
-    dataFieldKeys.add(key);
-    if (!isInternalMetadataField(key) && !isIdentityField(key) && metadata[key] !== void 0) {
-      data[key] = metadata[key];
-    }
+  if (accountInfo.phoneNumber) {
+    return user.loginMethods.some((method) => {
+      return !isGuestLoginMethod(method) && method.phoneNumber === accountInfo.phoneNumber;
+    });
   }
-  const verifiedData = {
-    ...originalRowndUser?.verified_data || {}
-  };
-  let lastUsedAt = stUser.timeJoined;
-  for (const method of stUser.loginMethods) {
-    if (typeof method.lastUsed === "number" && method.lastUsed > lastUsedAt) {
-      lastUsedAt = method.lastUsed;
+  return false;
+}
+function hasVerifiedRealLoginMethod(user) {
+  return !!user?.loginMethods.some((method) => {
+    if (isGuestLoginMethod(method)) {
+      return false;
     }
     if (method.recipeId === "passwordless") {
-      if (method.email) {
-        verifiedData.email = method.email;
-        if (data.email === void 0) data.email = method.email;
-      }
+      return !!(method.email || method.phoneNumber);
+    }
+    if (method.recipeId === "thirdparty") {
+      return !!getThirdPartyUserId(method) && method.verified === true;
+    }
+    if (method.recipeId === "emailpassword") {
+      return !!method.email && method.verified === true;
+    }
+    return method.verified === true;
+  });
+}
+function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
+  if (hasVerifiedRealLoginMethod(user)) {
+    return "verified";
+  }
+  return getGuestAuthLevel(user) || originalAuthLevel || (verifiedData && Object.keys(verifiedData).length > 0 ? "verified" : "unverified");
+}
+function canUpdateUserDataField(field) {
+  const schema = getPluginConfig()?.schema || DEFAULT_ROWND_SCHEMA;
+  const schemaField = schema[field];
+  if (!schemaField) {
+    return false;
+  }
+  const ownedBy = field === "google_id" || field === "apple_id" ? "app" : schemaField.owned_by || "user";
+  return ownedBy !== "app" && schemaField.read_only !== true;
+}
+
+// src/rownd-repository.ts
+var rowndClient;
+function setRowndClient(client) {
+  rowndClient = client;
+}
+function getRowndClient() {
+  if (!rowndClient) {
+    throw new Error("Rownd client not initialized");
+  }
+  return rowndClient;
+}
+async function validateRowndToken(token) {
+  const client = getRowndClient();
+  const tokenInfo = await client.validateToken(token);
+  return tokenInfo.user_id;
+}
+async function fetchRowndUserInfo(userId) {
+  const client = getRowndClient();
+  const rowndUser = await client.fetchUserInfo({ user_id: userId });
+  if (!rowndUser) {
+    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
+  }
+  return rowndUser;
+}
+
+// src/supertokens-repository.ts
+var import_supertokens_node2 = __toESM(require("supertokens-node"));
+var import_accountlinking = __toESM(require("supertokens-node/recipe/accountlinking"));
+var import_emailverification = __toESM(require("supertokens-node/recipe/emailverification"));
+var import_passwordless = __toESM(require("supertokens-node/recipe/passwordless"));
+var import_session = __toESM(require("supertokens-node/recipe/session"));
+var import_claims = require("supertokens-node/recipe/session/claims");
+var import_usermetadata2 = __toESM(require("supertokens-node/recipe/usermetadata"));
+async function importUser(stUser, config2) {
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (config2.apiKey) {
+    headers["api-key"] = config2.apiKey;
+  }
+  const response = await fetch(`${config2.connectionURI}/bulk-import/import`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(stUser)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(
+      `Bulk import failed with status ${response.status}: ${errorText}`
+    );
+  }
+  const importResponse = await response.json();
+  if (importResponse.status !== "OK" || !importResponse.user) {
+    throw new Error(
+      `Bulk import failed: ${importResponse.message || "Missing user in response"}`
+    );
+  }
+  return importResponse.user;
+}
+async function recordRowndAppVariantForUser(userId, appVariantId) {
+  if (!appVariantId) {
+    return;
+  }
+  assertRowndAppVariantIsConfigured(appVariantId);
+  const metadata = await getUserMetadata(userId);
+  const originalRowndUser = isJsonRecord(metadata.original_rownd_user) ? metadata.original_rownd_user : {};
+  const attributes = isJsonRecord(originalRowndUser.attributes) ? originalRowndUser.attributes : {};
+  const appVariants = getStringList(attributes["rownd:app_variants"]);
+  if (appVariants.includes(appVariantId)) {
+    return;
+  }
+  await import_usermetadata2.default.updateUserMetadata(userId, {
+    ...metadata,
+    original_rownd_user: {
+      ...originalRowndUser,
+      data: isJsonRecord(originalRowndUser.data) ? originalRowndUser.data : { user_id: userId },
+      verified_data: isJsonRecord(originalRowndUser.verified_data) ? originalRowndUser.verified_data : {},
+      attributes: {
+        ...attributes,
+        "rownd:app_variants": [...appVariants, appVariantId]
+      }
+    }
+  });
+}
+var RowndIsAnonymousClaim = new import_claims.BooleanClaim({
+  key: "is_anonymous",
+  fetchValue: async (userId) => {
+    const user = await import_supertokens_node2.default.getUser(userId);
+    const effectiveAuthLevel = getEffectiveAuthLevel(user);
+    return effectiveAuthLevel === GUEST_AUTH_METHOD_ID;
+  }
+});
+async function buildRowndSessionClaims(userId, currentPayload = {}, appVariantId) {
+  const user = await import_supertokens_node2.default.getUser(userId);
+  const metadata = user ? await getUserMetadata(user.id) : void 0;
+  return buildRowndSessionClaimPayload({
+    userId,
+    user,
+    metadata,
+    currentPayload,
+    appVariantId
+  });
+}
+async function getUserMetadata(userId) {
+  const metadata = await import_usermetadata2.default.getUserMetadata(userId);
+  return metadata.metadata || {};
+}
+function getPendingVerifications(metadata) {
+  const pendingVerification = metadata.rownd_pending_verification;
+  if (Array.isArray(pendingVerification)) {
+    return pendingVerification.filter(isPendingVerification);
+  }
+  return [];
+}
+function isPendingVerification(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.field === "string" && typeof value.value === "string" && typeof value.created_at === "string";
+}
+async function getUserById(userId) {
+  const metadata = await getUserMetadata(userId);
+  const stUser = await import_supertokens_node2.default.getUser(userId);
+  if (!stUser) {
+    throw new RowndPluginError("ROWND_USER_NOT_FOUND");
+  }
+  const originalRowndUser = metadata.original_rownd_user;
+  const rowndUser = originalRowndUser?.data?.user_id || userId;
+  const state = originalRowndUser?.state || "enabled";
+  const dataFieldKeys = /* @__PURE__ */ new Set();
+  const data = {
+    user_id: userId
+  };
+  for (const [key, value] of Object.entries(originalRowndUser?.data || {})) {
+    if (!isIdentityField(key)) {
+      data[key] = value;
+      dataFieldKeys.add(key);
+    }
+  }
+  const schema = getPluginConfig()?.schema || DEFAULT_ROWND_SCHEMA;
+  for (const key of Object.keys(schema)) {
+    dataFieldKeys.add(key);
+    if (!isInternalMetadataField(key) && !isIdentityField(key) && metadata[key] !== void 0) {
+      data[key] = metadata[key];
+    }
+  }
+  const verifiedData = {
+    ...originalRowndUser?.verified_data || {}
+  };
+  for (const method of stUser.loginMethods) {
+    if (method.recipeId === "passwordless") {
+      if (method.email) {
+        verifiedData.email = method.email;
+        if (data.email === void 0) data.email = method.email;
+      }
       if (method.phoneNumber) {
         verifiedData.phone_number = method.phoneNumber;
         if (data.phone_number === void 0)
@@ -1722,26 +1832,16 @@ async function getUserById(userId) {
       data[key] = "";
     }
   }
-  const mapMethod = (method) => {
-    if (method.recipeId === "thirdparty") {
-      if (getThirdPartyId(method) === "google") return "google";
-      if (getThirdPartyId(method) === "apple") return "apple";
-    } else if (method.recipeId === "passwordless") {
-      if (method.email) return "email";
-      if (method.phoneNumber) return "phone";
-    } else if (method.recipeId === "emailpassword") {
-      return "email";
-    }
-    return "email";
-  };
   const sortedByJoined = [...stUser.loginMethods].sort(
     (a, b) => a.timeJoined - b.timeJoined
   );
-  const sortedByLastUsed = [
-    ...stUser.loginMethods
-  ].sort((a, b) => (b.lastUsed || b.timeJoined) - (a.lastUsed || a.timeJoined));
+  const latestSessionInfo = await getLatestSessionInfo(stUser.id);
   const firstMethod = sortedByJoined[0];
-  const lastMethod = sortedByLastUsed[0];
+  const latestSessionRecipeUserId = latestSessionInfo?.recipeUserId.getAsString();
+  const lastMethod = latestSessionRecipeUserId ? stUser.loginMethods.find(
+    (method) => method.recipeUserId.getAsString() === latestSessionRecipeUserId
+  ) : [...stUser.loginMethods].sort((a, b) => b.timeJoined - a.timeJoined)[0];
+  const lastSignInAt = latestSessionInfo?.timeCreated ?? stUser.timeJoined;
   const metadataMeta = Object.fromEntries(
     Object.entries(metadata).filter(
       ([key]) => !isInternalMetadataField(key) && !dataFieldKeys.has(key)
@@ -1751,8 +1851,8 @@ async function getUserById(userId) {
     ...metadataMeta,
     created: new Date(stUser.timeJoined).toISOString(),
     first_sign_in: new Date(stUser.timeJoined).toISOString(),
-    last_sign_in: new Date(lastUsedAt).toISOString(),
-    last_active: new Date(lastUsedAt).toISOString(),
+    last_sign_in: new Date(lastSignInAt).toISOString(),
+    last_active: new Date(lastSignInAt).toISOString(),
     first_sign_in_method: firstMethod ? mapMethod(firstMethod) : "email",
     last_sign_in_method: lastMethod ? mapMethod(lastMethod) : "email"
   };
@@ -1768,6 +1868,25 @@ async function getUserById(userId) {
     attributes: originalRowndUser?.attributes || {}
   };
 }
+async function getLatestSessionInfo(userId) {
+  const sessionHandles = await import_session.default.getAllSessionHandlesForUser(
+    userId,
+    true,
+    PUBLIC_TENANT_ID
+  );
+  const sessionInfos = await Promise.all(
+    sessionHandles.map(
+      (sessionHandle) => import_session.default.getSessionInformation(sessionHandle)
+    )
+  );
+  let latestSessionInfo;
+  for (const sessionInfo of sessionInfos) {
+    if (sessionInfo && (!latestSessionInfo || sessionInfo.timeCreated > latestSessionInfo.timeCreated)) {
+      latestSessionInfo = sessionInfo;
+    }
+  }
+  return latestSessionInfo;
+}
 async function updateUserData(userId, inputData) {
   const metadata = await getUserMetadata(userId);
   const updatedMetadata = {
@@ -1780,13 +1899,29 @@ async function updateUserData(userId, inputData) {
 async function startPendingEmailVerification(input) {
   const metadata = await getUserMetadata(input.userId);
   const currentEmail = (await getUserById(input.userId)).data.email;
-  if (currentEmail === input.email) {
-    return getUserById(input.userId);
-  }
   const pendingVerifications = getPendingVerifications(metadata);
   const pendingEmailVerifications = pendingVerifications.filter(
     (pendingVerification2) => pendingVerification2.field === "email"
   );
+  if (currentEmail === input.email) {
+    for (const pendingVerification2 of pendingEmailVerifications) {
+      await import_emailverification.default.revokeEmailVerificationTokens(
+        input.tenantId,
+        input.recipeUserId,
+        pendingVerification2.value,
+        input.userContext
+      );
+    }
+    if (pendingEmailVerifications.length > 0) {
+      await import_usermetadata2.default.updateUserMetadata(input.userId, {
+        ...metadata,
+        rownd_pending_verification: pendingVerifications.filter(
+          (pendingVerification2) => pendingVerification2.field !== "email"
+        )
+      });
+    }
+    return getUserById(input.userId);
+  }
   for (const pendingVerification2 of pendingEmailVerifications) {
     await import_emailverification.default.revokeEmailVerificationTokens(
       input.tenantId,
@@ -1830,7 +1965,7 @@ async function startPendingEmailVerification(input) {
   return getUserById(input.userId);
 }
 async function completePendingEmailVerification(input) {
-  const user = await import_supertokens_node.default.getUser(
+  const user = await import_supertokens_node2.default.getUser(
     input.recipeUserId.getAsString(),
     input.userContext
   );
@@ -1838,7 +1973,10 @@ async function completePendingEmailVerification(input) {
   const metadata = await getUserMetadata(userId);
   const pendingVerifications = getPendingVerifications(metadata);
   const pendingVerification = pendingVerifications.find(
-    (pendingVerification2) => pendingVerification2.field === "email" && pendingVerification2.value === input.email
+    (pendingVerification2) => isMatchingPendingEmailVerification(
+      pendingVerification2,
+      input.email
+    )
   );
   if (!pendingVerification) {
     return;
@@ -1894,27 +2032,36 @@ async function completePendingEmailVerification(input) {
     }
     metadataUserId = primaryUserId;
   }
+  const targetMetadata = metadataUserId === userId ? metadata : await getUserMetadata(metadataUserId);
+  const originalRowndUser = targetMetadata.original_rownd_user ?? metadata.original_rownd_user;
+  const targetPendingVerifications = getPendingVerifications(targetMetadata);
   const updatedMetadata = {
-    ...metadata,
-    ...metadata.original_rownd_user ? {
+    ...targetMetadata,
+    ...originalRowndUser ? {
       original_rownd_user: {
-        ...metadata.original_rownd_user,
+        ...originalRowndUser,
         data: {
-          ...metadata.original_rownd_user.data,
+          ...originalRowndUser.data,
           email: input.email
         },
         verified_data: {
-          ...metadata.original_rownd_user.verified_data,
+          ...originalRowndUser.verified_data,
           email: input.email
         }
       }
     } : {},
-    rownd_pending_verification: pendingVerifications.filter(
-      (verification) => verification !== pendingVerification
+    rownd_pending_verification: targetPendingVerifications.filter(
+      (verification) => !isMatchingPendingEmailVerification(
+        verification,
+        input.email
+      )
     )
   };
   await import_usermetadata2.default.updateUserMetadata(metadataUserId, updatedMetadata);
 }
+function isMatchingPendingEmailVerification(verification, email) {
+  return verification.field === "email" && verification.value === email;
+}
 async function updateUserMetadata(userId, inputMeta) {
   const metadata = await getUserMetadata(userId);
   const updatedMetadata = {
@@ -1931,432 +2078,359 @@ async function updateUserMetadata(userId, inputMeta) {
     )
   };
 }
-function getThirdPartyId(method) {
-  return method.thirdPartyId || method.thirdParty?.id;
-}
-function getThirdPartyUserId(method) {
-  return method.thirdPartyUserId || method.thirdParty?.userId;
-}
-function getGuestAuthLevel(user) {
-  const guestMethod = user?.loginMethods.find(isGuestLoginMethod);
-  return guestMethod ? GUEST_AUTH_METHOD_ID : void 0;
-}
-function hasAnonymousLoginMethod(user) {
-  return !!user?.loginMethods.some((loginMethod) => {
-    return loginMethod.recipeId === "thirdparty" && getThirdPartyId(loginMethod) === ANONYMOUS_AUTH_METHOD_ID;
-  });
-}
 function getPasswordlessEmailLoginMethod(user) {
   return user?.loginMethods.find((method) => {
     return method.recipeId === "passwordless" && !!method.email;
   });
 }
-function hasOnlyGuestLoginMethods(user) {
-  return !!user?.loginMethods.length && user.loginMethods.every(isGuestLoginMethod);
-}
-function isGuestLoginMethod(method) {
-  const thirdPartyId = getThirdPartyId(method);
-  return method.recipeId === "thirdparty" && (thirdPartyId === GUEST_AUTH_METHOD_ID || thirdPartyId === ANONYMOUS_AUTH_METHOD_ID);
-}
-function isGuestAccountInfo(input) {
-  return input?.recipeId === "thirdparty" && (input.thirdParty?.id === GUEST_AUTH_METHOD_ID || input.thirdParty?.id === ANONYMOUS_AUTH_METHOD_ID);
+
+// src/pluginImplementation.ts
+var import_crypto = require("crypto");
+var import_supertokens_node3 = __toESM(require("supertokens-node"));
+var import_session2 = __toESM(require("supertokens-node/recipe/session"));
+var import_thirdparty = __toESM(require("supertokens-node/recipe/thirdparty"));
+function handleGetAppConfig(deps) {
+  return async (req) => {
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    const appConfig = buildRowndAppConfig(
+      deps.pluginConfig,
+      deps.stConfig,
+      appVariantId
+    );
+    if (!appConfig) {
+      return {
+        status: "ERROR",
+        message: `Unknown Rownd app variant: ${appVariantId}`
+      };
+    }
+    return {
+      status: "OK",
+      ...appConfig
+    };
+  };
 }
-function doesAccountInfoMatchAuthMethod(user, accountInfo) {
-  if (!user) {
-    return false;
-  }
-  const normalizedEmail = accountInfo.email?.toLowerCase();
-  if (normalizedEmail) {
-    return user.loginMethods.some((method) => {
-      if (isGuestLoginMethod(method) || !method.email) {
-        return false;
-      }
-      return method.email.toLowerCase() === normalizedEmail;
-    });
-  }
-  if (accountInfo.phoneNumber) {
-    return user.loginMethods.some((method) => {
-      return !isGuestLoginMethod(method) && method.phoneNumber === accountInfo.phoneNumber;
-    });
-  }
-  return false;
-}
-function hasVerifiedRealLoginMethod(user) {
-  return !!user?.loginMethods.some((method) => {
-    if (isGuestLoginMethod(method)) {
-      return false;
-    }
-    if (method.recipeId === "passwordless") {
-      return !!(method.email || method.phoneNumber);
-    }
-    if (method.recipeId === "thirdparty") {
-      return !!getThirdPartyUserId(method) && method.verified === true;
-    }
-    if (method.recipeId === "emailpassword") {
-      return !!method.email && method.verified === true;
-    }
-    return method.verified === true;
-  });
-}
-function getEffectiveAuthLevel(user, originalAuthLevel, verifiedData) {
-  if (hasVerifiedRealLoginMethod(user)) {
-    return "verified";
-  }
-  return getGuestAuthLevel(user) || originalAuthLevel || (verifiedData && Object.keys(verifiedData).length > 0 ? "verified" : "unverified");
-}
-function canUpdateUserDataField(field) {
-  const schema = pluginConfig?.schema || DEFAULT_ROWND_SCHEMA;
-  const schemaField = schema[field];
-  if (!schemaField) {
-    return false;
-  }
-  const ownedBy = field === "google_id" || field === "apple_id" ? "app" : schemaField.owned_by || "user";
-  return ownedBy !== "app" && schemaField.read_only !== true;
-}
-var BUILTIN_SIGN_IN_METHOD_KEYS = [
-  "email",
-  "phone",
-  "google",
-  "apple",
-  "anonymous"
-];
-function normalizeSchemaField(key, field) {
-  let ownedBy = field.owned_by;
-  if (key === "google_id" || key === "apple_id") {
-    ownedBy = "app";
-  } else if (!ownedBy) {
-    ownedBy = "user";
-  }
-  return {
-    display_name: field.display_name,
-    type: field.type,
-    owned_by: ownedBy,
-    user_visible: field.user_visible,
-    read_only: field.read_only ?? ownedBy === "app",
-    show_empty: field.show_empty ?? false
-  };
-}
-var DEFAULT_PRIMARY_COLOR = "#5b5bd6";
-function buildSignInMethodsConfig(methodsArray) {
-  const methods = (methodsArray ?? []).reduce(
-    (acc, curr) => {
-      acc[curr.method] = curr;
-      return acc;
-    },
-    {}
-  );
-  const customProviders = Object.fromEntries(
-    Object.entries(methods).filter(([key]) => !BUILTIN_SIGN_IN_METHOD_KEYS.includes(key)).map(([key, val]) => {
-      return val ? [
-        key,
+function handleGuestLogin(deps) {
+  return async (req, res, _session, userContext) => {
+    const startedAt = Date.now();
+    const guestId = `guest_${(0, import_crypto.randomUUID)()}`;
+    try {
+      const body = parseGuestBody(await getJsonBody(req));
+      const appVariantId = getRequestedAppVariantIdFromRequest(req);
+      assertRowndAppVariantIsConfigured(appVariantId);
+      const thirdPartyId = body.authLevel === ANONYMOUS_AUTH_METHOD_ID ? ANONYMOUS_AUTH_METHOD_ID : GUEST_AUTH_METHOD_ID;
+      const thirdPartyUserId = thirdPartyId === ANONYMOUS_AUTH_METHOD_ID ? `anon_${(0, import_crypto.randomUUID)()}` : guestId;
+      const response = await import_thirdparty.default.manuallyCreateOrUpdateUser(
+        PUBLIC_TENANT_ID,
+        thirdPartyId,
+        thirdPartyUserId,
+        `${thirdPartyUserId}@anonymous.local`,
+        false,
+        void 0,
+        userContext
+      );
+      if (response.status !== "OK") {
+        throw new Error(
+          `Guest user creation failed with status: ${response.status}`
+        );
+      }
+      await import_session2.default.createNewSession(
+        req,
+        res,
+        PUBLIC_TENANT_ID,
+        response.recipeUserId,
         {
-          enabled: true,
-          display_name: getStringMethodProperty(val, "displayName") ?? key,
-          icon_light_url: getStringMethodProperty(val, "iconLightUrl"),
-          icon_dark_url: getStringMethodProperty(val, "iconDarkUrl")
-        }
-      ] : [key, void 0];
-    }).filter(([, v]) => v !== void 0)
-  );
-  const googleMethod = methods.google;
-  const appleMethod = methods.apple;
-  const anonymousMethod = methods.anonymous;
-  const anonymousType = getAnonymousType(anonymousMethod);
-  const googleOneTap = getOneTapConfig(googleMethod);
-  return {
-    email: { enabled: !!methods.email },
-    phone: { enabled: !!methods.phone },
-    google: {
-      enabled: !!googleMethod,
-      client_id: getStringMethodProperty(googleMethod, "clientId") ?? "",
-      ios_client_id: getStringMethodProperty(googleMethod, "iosClientId") ?? "",
-      scopes: getStringArrayMethodProperty(googleMethod, "scopes") ?? [],
-      ...getSignInFasterWithGoogle(googleMethod) ? { sign_in_faster_with_google: getSignInFasterWithGoogle(googleMethod) } : {},
-      one_tap: {
-        browser: {
-          auto_prompt: googleOneTap?.browser?.autoPrompt ?? false,
-          delay: googleOneTap?.browser?.delay ?? 7e3
+          ...buildRowndAudience({}, appVariantId),
+          auth_level: GUEST_AUTH_METHOD_ID,
+          is_anonymous: true,
+          app_user_id: response.user.id
         },
-        mobile_app: {
-          auto_prompt: googleOneTap?.mobileApp?.autoPrompt ?? false,
-          delay: googleOneTap?.mobileApp?.delay ?? 7e3
-        }
-      }
-    },
-    apple: {
-      enabled: !!appleMethod,
-      client_id: getStringMethodProperty(appleMethod, "clientId") ?? ""
-    },
-    anonymous: {
-      enabled: !!anonymousMethod && anonymousType !== "instant",
-      ...anonymousMethod && anonymousType !== "instant" ? { type: anonymousType } : {},
-      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "displayName") !== void 0 ? {
-        display_name: getStringMethodProperty(
-          anonymousMethod,
-          "displayName"
-        )
-      } : {},
-      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconLightUrl") !== void 0 ? {
-        icon_light_url: getStringMethodProperty(
-          anonymousMethod,
-          "iconLightUrl"
-        )
-      } : {},
-      ...anonymousType !== "instant" && getStringMethodProperty(anonymousMethod, "iconDarkUrl") !== void 0 ? {
-        icon_dark_url: getStringMethodProperty(
-          anonymousMethod,
-          "iconDarkUrl"
-        )
-      } : {}
-    },
-    ...customProviders
-  };
-}
-function isInstantAnonymousMethod(methods) {
-  return (methods ?? []).some(
-    (method) => method.method === "anonymous" && getAnonymousType(method) === "instant"
-  );
-}
-function getAnonymousType(method) {
-  const type = getStringMethodProperty(method, "type");
-  return type === "instant" ? "instant" : "guest";
-}
-function getSignInFasterWithGoogle(method) {
-  const value = getStringMethodProperty(method, "signInFasterWithGoogle");
-  return value === "enabled" || value === "disabled" ? value : void 0;
-}
-function getMethodProperty(method, property) {
-  if (!method) {
-    return void 0;
-  }
-  return method[property];
-}
-function getStringMethodProperty(method, property) {
-  const value = getMethodProperty(method, property);
-  return typeof value === "string" ? value : void 0;
-}
-function getStringArrayMethodProperty(method, property) {
-  const value = getMethodProperty(method, property);
-  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
-}
-function getOneTapConfig(method) {
-  const oneTap = getMethodProperty(method, "oneTap");
-  if (!isRecord(oneTap)) {
-    return void 0;
-  }
-  return {
-    browser: parseOneTapPlatform(oneTap.browser),
-    mobileApp: parseOneTapPlatform(oneTap.mobileApp)
-  };
-}
-function parseOneTapPlatform(value) {
-  if (!isRecord(value)) {
-    return void 0;
-  }
-  return {
-    autoPrompt: typeof value.autoPrompt === "boolean" ? value.autoPrompt : void 0,
-    delay: typeof value.delay === "number" ? value.delay : void 0
-  };
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getSubBrandVariant(app) {
-  if (isRecord(app) && isRecord(app.variant) && typeof app.variant.id === "string") {
-    return app.variant;
-  }
-  return void 0;
-}
-function mergeConfigInput(base, override) {
-  const result = { ...base };
-  for (const [key, value] of Object.entries(override)) {
-    if (value === void 0) {
-      continue;
+        {},
+        userContext
+      );
+      logDebugMessage(`Guest session created for user: ${response.user.id}`);
+      deps.telemetryClient.recordSuccess({
+        outcome: "success",
+        durationMs: Date.now() - startedAt,
+        tenantId: PUBLIC_TENANT_ID,
+        superTokensUserId: response.user.id
+      });
+      return {
+        status: "OK",
+        createdNewRecipeUser: response.createdNewRecipeUser
+      };
+    } catch (error) {
+      logDebugMessage(`Guest login failed. Error: ${getErrorMessage(error)}`);
+      deps.telemetryClient.recordError({
+        error,
+        startedAt,
+        tenantId: PUBLIC_TENANT_ID
+      });
+      return {
+        status: "ERROR",
+        message: "Guest login failed"
+      };
     }
-    const existing = result[key];
-    result[key] = isRecord(existing) && isRecord(value) ? mergeConfigInput(existing, value) : value;
-  }
-  return result;
+  };
 }
-function buildAppConfig(config2, stConfig, appVariantId) {
-  const userSchema = config2.schema ?? DEFAULT_ROWND_SCHEMA;
-  const baseApp = config2.appConfig ?? {};
-  const subBrand = appVariantId ? config2.subBrands?.[appVariantId] : void 0;
-  const app = appVariantId ? subBrand && mergeConfigInput(baseApp, subBrand) : baseApp;
-  if (!app) {
-    return void 0;
-  }
-  const branding = app.branding ?? {};
-  const auth = app.auth ?? {};
-  const signInMethods = buildSignInMethodsConfig(app.signInMethods);
-  const variant = getSubBrandVariant(app);
-  const finalSchema = { ...userSchema };
-  if (signInMethods.email.enabled && !finalSchema.email) {
-    finalSchema.email = {
-      display_name: "Email",
-      type: "string",
-      user_visible: true
-    };
-  }
-  if (signInMethods.phone.enabled && !finalSchema.phone_number) {
-    finalSchema.phone_number = {
-      display_name: "Phone number",
-      type: "string",
-      user_visible: true
-    };
-  }
-  if (signInMethods.google.enabled && !finalSchema.google_id) {
-    finalSchema.google_id = {
-      display_name: "Google ID",
-      type: "string",
-      user_visible: false
-    };
-  }
-  if (signInMethods.apple.enabled && !finalSchema.apple_id) {
-    finalSchema.apple_id = {
-      display_name: "Apple ID",
-      type: "string",
-      user_visible: false
-    };
-  }
-  return {
-    config_type: appVariantId ? "variant" : "app",
-    ...variant ? { variant } : {},
-    app: {
-      id: app.id ?? "",
-      name: app.name ?? stConfig.appInfo.appName,
-      icon: app.icon ?? "",
-      ...app.userVerificationFields ? { user_verification_fields: app.userVerificationFields } : {},
-      schema: Object.fromEntries(
-        Object.entries(finalSchema).map(([key, field]) => [
-          key,
-          normalizeSchemaField(key, field)
-        ])
-      ),
-      config: {
-        ...app.capabilities ? { capabilities: app.capabilities } : {},
-        ...app.web ? { web: app.web } : {},
-        ...app.bottomSheet ? { bottom_sheet: app.bottomSheet } : {},
-        ...app.profileStorageVersion ? { profile_storage_version: app.profileStorageVersion } : {},
-        customizations: {
-          primary_color: branding.primaryColor ?? DEFAULT_PRIMARY_COLOR,
-          ...branding.logo ? { logo: branding.logo } : {},
-          ...branding.logoDarkMode ? { logo_dark_mode: branding.logoDarkMode } : {},
-          ...branding.animations ? { animations: branding.animations } : {}
-        },
-        hub: {
-          ...app.allowedWebOrigins ? { allowed_web_origins: app.allowedWebOrigins } : {},
-          customizations: {
-            rounded_corners: branding.roundedCorners ?? true,
-            ...branding.containerBorderRadius !== void 0 ? { container_border_radius: branding.containerBorderRadius } : {},
-            ...branding.placement !== void 0 ? { placement: branding.placement } : {},
-            ...branding.hubPrimaryColor !== void 0 ? { primary_color: branding.hubPrimaryColor } : {},
-            ...branding.primaryColorDarkMode !== void 0 ? { primary_color_dark_mode: branding.primaryColorDarkMode } : {},
-            ...branding.backgroundColor !== void 0 ? { background_color: branding.backgroundColor } : {},
-            ...branding.fontFamily !== void 0 ? { font_family: branding.fontFamily } : {},
-            ...branding.hideVerificationIcons !== void 0 ? { hide_verification_icons: branding.hideVerificationIcons } : {},
-            visual_swoops: branding.visualSwoops ?? true,
-            blur_background: branding.blurBackground ?? true,
-            ...branding.blurBackgroundOpacity !== void 0 ? { blur_background_opacity: branding.blurBackgroundOpacity } : {},
-            ...branding.offsetX !== void 0 ? { offset_x: branding.offsetX } : {},
-            ...branding.offsetY !== void 0 ? { offset_y: branding.offsetY } : {},
-            ...branding.propertyOverrides ? { property_overrides: branding.propertyOverrides } : {},
-            dark_mode: branding.darkMode ?? "auto"
-          },
-          ...branding.customScripts ? { custom_scripts: branding.customScripts } : {},
-          ...branding.customStyles ? { custom_styles: branding.customStyles } : {},
-          auth: {
-            email: buildAuthEmailConfig(auth.email),
-            ...auth.mobile ? { mobile: buildAuthMobileConfig(auth.mobile) } : {},
-            sign_in_methods: signInMethods,
-            additional_fields: auth.additionalFields ?? [],
-            ...auth.rememberSignInMethod !== void 0 ? { remember_sign_in_method: auth.rememberSignInMethod } : {},
-            ...auth.useExplicitSignUpFlow !== void 0 ? { use_explicit_sign_up_flow: auth.useExplicitSignUpFlow } : {},
-            ...auth.allowUnverifiedUsers !== void 0 ? { allow_unverified_users: auth.allowUnverifiedUsers } : {},
-            ...auth.primarySignUpMethod ? { primary_sign_up_method: auth.primarySignUpMethod } : {},
-            ...auth.preferredMethod ? { preferred_method: auth.preferredMethod } : {},
-            ...auth.order ? { order: auth.order } : {},
-            ...isInstantAnonymousMethod(app.signInMethods) ? { instant_user: { enabled: true } } : {},
-            show_app_icon: branding.showAppIcon ?? false
-          },
-          legal: {
-            ...app.legal?.companyName ? { company_name: app.legal.companyName } : {},
-            ...app.legal?.privacyPolicyUrl ? { privacy_policy_url: app.legal.privacyPolicyUrl } : {},
-            ...app.legal?.termsConditionsUrl ? { terms_conditions_url: app.legal.termsConditionsUrl } : {},
-            ...app.legal?.supportEmail ? { support_email: app.legal.supportEmail } : {}
-          },
-          custom_content: {
-            ...app.customContent?.signInModal ? {
-              sign_in_modal: {
-                ...app.customContent.signInModal.title ? { title: app.customContent.signInModal.title } : {},
-                ...app.customContent.signInModal.subtitle ? { subtitle: app.customContent.signInModal.subtitle } : {},
-                ...app.customContent.signInModal.signInTitle ? {
-                  sign_in_title: app.customContent.signInModal.signInTitle
-                } : {},
-                ...app.customContent.signInModal.signUpTitle ? {
-                  sign_up_title: app.customContent.signInModal.signUpTitle
-                } : {},
-                ...app.customContent.signInModal.signInSubtitle ? {
-                  sign_in_subtitle: app.customContent.signInModal.signInSubtitle
-                } : {},
-                ...app.customContent.signInModal.signUpSubtitle ? {
-                  sign_up_subtitle: app.customContent.signInModal.signUpSubtitle
-                } : {},
-                ...app.customContent.signInModal.signInButton ? {
-                  sign_in_button: app.customContent.signInModal.signInButton
-                } : {},
-                ...app.customContent.signInModal.signUpButton ? {
-                  sign_up_button: app.customContent.signInModal.signUpButton
-                } : {}
-              }
-            } : {},
-            ...app.customContent?.profileModal ? { profile_modal: app.customContent.profileModal } : {},
-            ...app.customContent?.verificationModal ? {
-              verification_modal: {
-                ...app.customContent.verificationModal.title ? { title: app.customContent.verificationModal.title } : {},
-                ...app.customContent.verificationModal.subtitle ? { subtitle: app.customContent.verificationModal.subtitle } : {}
-              }
-            } : {},
-            ...app.customContent?.signInFailureModal ? {
-              sign_in_failure_modal: {
-                failure_message: app.customContent.signInFailureModal.failureMessage
-              }
-            } : {},
-            ...app.customContent?.noAccountMessage ? { no_account_message: app.customContent.noAccountMessage } : {},
-            ...app.customContent?.mobile ? { mobile: app.customContent.mobile } : {}
-          },
-          profile: {
-            ...app.profile?.accountInformation ? { account_information: app.profile.accountInformation } : {},
-            ...app.profile?.personalInformation ? { personal_information: app.profile.personalInformation } : {},
-            ...app.profile?.preferences ? { preferences: app.profile.preferences } : {},
-            ...app.profile?.signOutButton ? { sign_out_button: app.profile.signOutButton } : {},
-            ...app.profile?.deleteAccountButton ? { delete_account_button: app.profile.deleteAccountButton } : {},
-            ...app.profile?.addSignInMethodsButton ? { add_sign_in_methods_button: app.profile.addSignInMethodsButton } : {}
+function handleMigrate(deps) {
+  return async (req, res, _session, userContext) => {
+    const startedAt = Date.now();
+    let tenantId = PUBLIC_TENANT_ID;
+    let rowndUserId;
+    let superTokensUserId;
+    let user;
+    let recipeUserId;
+    try {
+      if (!deps.stConfig.supertokens) {
+        throw new Error("Supertokens config not found");
+      }
+      const parsed = await parseRequest(req);
+      const appVariantId = getRequestedAppVariantIdFromRequest(req);
+      assertRowndAppVariantIsConfigured(appVariantId);
+      rowndUserId = await validateRowndToken(parsed.token);
+      user = await import_supertokens_node3.default.getUser(rowndUserId, userContext);
+      if (!user) {
+        const rowndUser = await fetchRowndUserInfo(rowndUserId);
+        const stUserImport = mapRowndUserToSuperTokens(rowndUser);
+        try {
+          const importedUser = await importUser(
+            stUserImport,
+            deps.stConfig.supertokens
+          );
+          superTokensUserId = importedUser.id;
+          if (importedUser.loginMethods[0]?.recipeUserId) {
+            recipeUserId = import_supertokens_node3.default.convertToRecipeUserId(
+              importedUser.loginMethods[0].recipeUserId
+            );
+          }
+        } catch (err) {
+          user = await import_supertokens_node3.default.getUser(rowndUserId, userContext);
+          if (!user) {
+            throw err;
           }
+          superTokensUserId = user.id;
+          recipeUserId = user.loginMethods[0]?.recipeUserId;
+          logDebugMessage(
+            `User already migrated (race condition). tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+          );
         }
+        logDebugMessage(
+          `User migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+        );
+      } else {
+        superTokensUserId = user.id;
+        recipeUserId = user.loginMethods[0]?.recipeUserId;
+        logDebugMessage(
+          `User already migrated. tenantId: ${PUBLIC_TENANT_ID}, rowndUserId: ${rowndUserId}`
+        );
+      }
+      if (superTokensUserId) {
+        await recordRowndAppVariantForUser(superTokensUserId, appVariantId);
+      }
+      if (!recipeUserId) {
+        throw new Error("User not found or has no login methods");
       }
+      await import_session2.default.createNewSession(
+        req,
+        res,
+        PUBLIC_TENANT_ID,
+        recipeUserId,
+        {
+          ...buildRowndAudience({}, appVariantId)
+        },
+        {},
+        userContext
+      );
+      logDebugMessage(
+        `Session migrated successfully. tenantId: ${PUBLIC_TENANT_ID}, userId: ${superTokensUserId}`
+      );
+      deps.telemetryClient.recordSuccess({
+        outcome: "success",
+        durationMs: Date.now() - startedAt,
+        tenantId,
+        rowndUserId,
+        superTokensUserId
+      });
+      return { status: "OK" };
+    } catch (error) {
+      logDebugMessage(`Migration failed. Error: ${getErrorMessage(error)}`);
+      deps.telemetryClient.recordError({
+        error,
+        startedAt,
+        tenantId,
+        rowndUserId,
+        superTokensUserId
+      });
+      return {
+        status: "ERROR",
+        message: error instanceof RowndPluginError ? error.message : "Migration failed"
+      };
     }
   };
 }
-function buildAuthEmailConfig(authEmail) {
-  return {
-    from_address: authEmail?.fromAddress ?? "no-reply@rownd.io",
-    image: authEmail?.image ?? "",
-    ...authEmail?.subject ? { subject: authEmail.subject } : {},
-    ...authEmail?.callToActionText ? { call_to_action_text: authEmail.callToActionText } : {},
-    ...authEmail?.verifyTemplate ? { verify_template: authEmail.verifyTemplate } : {},
-    ...authEmail?.customContent ? { custom_content: authEmail.customContent } : {},
-    ...authEmail?.customClosingContent ? { custom_closing_content: authEmail.customClosingContent } : {}
+function handleGetUser() {
+  return async (_req, _res, session) => {
+    const user = await getUserById(session.getUserId());
+    return {
+      status: "OK",
+      ...user
+    };
   };
 }
-function buildAuthMobileConfig(authMobile) {
+function handleUpdateUser() {
+  return async (req, _res, session, userContext) => {
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    assertRowndAppVariantIsConfigured(appVariantId);
+    const payload = parseUpdateUserBody(await getJsonBody(req));
+    const inputData = payload.data ?? {};
+    const requestUserContext = {
+      ...userContext,
+      ...payload.context
+    };
+    const { email, ...dataWithoutEmail } = inputData;
+    const hasEmailUpdate = hasOwn(inputData, "email") && typeof email === "string";
+    const permissionError = validateWritableFields(
+      Object.keys(dataWithoutEmail)
+    );
+    if (permissionError) {
+      return permissionError;
+    }
+    if (Object.keys(dataWithoutEmail).length > 0) {
+      await updateUserData(session.getUserId(), dataWithoutEmail);
+    }
+    if (hasEmailUpdate) {
+      const pendingVerificationResult = await startPendingEmailVerification({
+        userId: session.getUserId(),
+        recipeUserId: session.getRecipeUserId(),
+        tenantId: session.getTenantId(),
+        email,
+        pendingVerificationId: (0, import_crypto.randomUUID)(),
+        userContext: appVariantId ? { ...requestUserContext, rowndAppVariantId: appVariantId } : requestUserContext
+      });
+      return {
+        status: "OK",
+        ...pendingVerificationResult
+      };
+    }
+    const user = await getUserById(session.getUserId());
+    return {
+      status: "OK",
+      ...user
+    };
+  };
+}
+function handleDeleteUser() {
+  return async (_req, _res, session) => {
+    await import_supertokens_node3.default.deleteUser(session.getUserId(), true);
+    return { status: "OK" };
+  };
+}
+function handleSignOut() {
+  return async (_req, _res, session, userContext) => {
+    await import_session2.default.revokeAllSessionsForUser(
+      session.getUserId(),
+      true,
+      session.getTenantId(),
+      userContext
+    );
+    return { status: "OK" };
+  };
+}
+function handleGetUserMeta() {
+  return async (_req, _res, session) => {
+    const metadata = await getUserMetadata(session.getUserId());
+    return {
+      status: "OK",
+      id: session.getUserId(),
+      meta: Object.fromEntries(
+        Object.entries(metadata).filter(
+          ([key]) => !isInternalMetadataField(key)
+        )
+      )
+    };
+  };
+}
+function handleUpdateUserMeta() {
+  return async (req, _res, session) => {
+    const payload = parseUpdateMetaBody(await getJsonBody(req));
+    const internalField = Object.keys(payload.meta ?? {}).find(
+      isInternalMetadataField
+    );
+    if (internalField) {
+      return {
+        status: "ERROR",
+        code: 403,
+        message: `field is not writable: ${internalField}`
+      };
+    }
+    const updateMetadataResult = await updateUserMetadata(
+      session.getUserId(),
+      payload.meta ?? {}
+    );
+    return {
+      status: "OK",
+      ...updateMetadataResult
+    };
+  };
+}
+function handleGetUserField() {
+  return async (req, _res, session) => {
+    const field = req.getKeyValueFromQuery("field");
+    if (!field) {
+      return missingFieldResponse();
+    }
+    const user = await getUserById(session.getUserId());
+    return {
+      status: "OK",
+      value: user.data[field]
+    };
+  };
+}
+function handleUpdateUserField() {
+  return async (req, _res, session, userContext) => {
+    const appVariantId = getRequestedAppVariantIdFromRequest(req);
+    assertRowndAppVariantIsConfigured(appVariantId);
+    const field = req.getKeyValueFromQuery("field");
+    if (!field) {
+      return missingFieldResponse();
+    }
+    const payload = parseUpdateFieldBody(await getJsonBody(req));
+    if (field === "email" && typeof payload.value === "string") {
+      const pendingVerificationResult = await startPendingEmailVerification({
+        userId: session.getUserId(),
+        recipeUserId: session.getRecipeUserId(),
+        tenantId: session.getTenantId(),
+        email: payload.value,
+        pendingVerificationId: (0, import_crypto.randomUUID)(),
+        userContext: appVariantId ? { ...userContext, rowndAppVariantId: appVariantId } : userContext
+      });
+      return {
+        status: "OK",
+        ...pendingVerificationResult
+      };
+    }
+    const permissionError = validateWritableFields([field]);
+    if (permissionError) {
+      return permissionError;
+    }
+    const updateUserDataResult = await updateUserData(session.getUserId(), {
+      [field]: payload.value
+    });
+    return {
+      status: "OK",
+      ...updateUserDataResult
+    };
+  };
+}
+function validateWritableFields(fields) {
+  const readOnlyField = fields.find((field) => !canUpdateUserDataField(field));
+  if (!readOnlyField) {
+    return void 0;
+  }
   return {
-    ...authMobile?.title ? { title: authMobile.title } : {},
-    ...authMobile?.image ? { image: authMobile.image } : {},
-    ...authMobile?.callToActionText ? { call_to_action_text: authMobile.callToActionText } : {},
-    ...authMobile?.hyperlinkText ? { hyperlink_text: authMobile.hyperlinkText } : {},
-    ...authMobile?.hyperlinkRedirectUrl ? { hyperlink_redirect_url: authMobile.hyperlinkRedirectUrl } : {},
-    ...authMobile?.customContent ? { custom_content: authMobile.customContent } : {}
+    status: "ERROR",
+    code: 403,
+    message: `field is not writable: ${readOnlyField}`
   };
 }
 
@@ -2373,6 +2447,9 @@ var init = createPluginInitFunction(
       const appVariantId = input?.userContext?.rowndAppVariantId;
       const displayContext = input?.userContext?.rowndDisplayContext;
       const redirectToPath = input?.userContext?.rowndRedirectToPath;
+      const clientDomain = input?.userContext?.rowndClientDomain;
+      const clientDomainKey = clientDomain ?? (displayContext === "mobile_app" ? "mobile" : "browser");
+      const clientBaseUrl = pluginConfig2.clientDomains?.[clientDomainKey];
       const bootstrapParams = {
         appKey: pluginConfig2.rowndAppKey,
         ...hubBootstrapParams ?? {},
@@ -2380,10 +2457,10 @@ var init = createPluginInitFunction(
         ...typeof displayContext === "string" ? { displayContext } : {},
         ...typeof redirectToPath === "string" ? { redirectToPath } : {}
       };
-      const rewrittenLink = input[linkKey] ? displayContext === "mobile_app" && pluginConfig2.mobileDeepLinkBaseUrl ? rewriteLinkToMobileDeepLink(
+      const rewrittenLink = input[linkKey] ? clientBaseUrl ? rewriteLinkToBaseUrl(
         input[linkKey],
         targetPath,
-        pluginConfig2.mobileDeepLinkBaseUrl,
+        clientBaseUrl,
         bootstrapParams
       ) : rewriteLinkPath(input[linkKey], targetPath, bootstrapParams) : input[linkKey];
       return {
@@ -2401,17 +2478,17 @@ var init = createPluginInitFunction(
       id: PLUGIN_ID,
       compatibleSDKVersions: PLUGIN_SDK_VERSION,
       init: async () => {
-        if (!import_supertokens_node2.default.isRecipeInitialized("session")) {
+        if (!import_supertokens_node4.default.isRecipeInitialized("session")) {
           console.warn(
             "RowndMigrationPlugin: Session recipe is not initialized. Session migration will fail."
           );
         }
-        if (!import_supertokens_node2.default.isRecipeInitialized("thirdparty")) {
+        if (!import_supertokens_node4.default.isRecipeInitialized("thirdparty")) {
           console.warn(
             "RowndMigrationPlugin: ThirdParty recipe is not initialized. Guest login will fail."
           );
         }
-        if (!import_supertokens_node2.default.isRecipeInitialized("emailverification")) {
+        if (!import_supertokens_node4.default.isRecipeInitialized("emailverification")) {
           console.warn(
             "RowndMigrationPlugin: EmailVerification recipe is not initialized. Verified email profile updates will fail."
           );
@@ -2524,13 +2601,13 @@ var init = createPluginInitFunction(
                   return {
                     ...implementation,
                     sendEmail: async function(input) {
-                      return implementation.sendEmail({
-                        ...addHubBootstrapParams(
+                      return implementation.sendEmail(
+                        addHubBootstrapParams(
                           input,
                           "urlWithLinkCode",
-                          "account/login"
+                          HUB_LOGIN_PAGE_PATH
                         )
-                      });
+                      );
                     }
                   };
                 }
@@ -2545,13 +2622,13 @@ var init = createPluginInitFunction(
                   return {
                     ...implementation,
                     sendSms: async function(input) {
-                      return implementation.sendSms({
-                        ...addHubBootstrapParams(
+                      return implementation.sendSms(
+                        addHubBootstrapParams(
                           input,
                           "urlWithLinkCode",
-                          "account/login"
+                          HUB_LOGIN_PAGE_PATH
                         )
-                      });
+                      );
                     }
                   };
                 }
@@ -2567,22 +2644,29 @@ var init = createPluginInitFunction(
               const displayContext = getRequestedDisplayContextFromRequest(
                 input.options.req
               );
+              if (displayContext) {
+                input.userContext.rowndDisplayContext = displayContext;
+              }
               const redirectToPath = getRequestedRedirectToPathFromRequest(
                 input.options.req
               );
+              if (redirectToPath) {
+                input.userContext.rowndRedirectToPath = redirectToPath;
+              }
+              const clientDomain = getRequestedClientDomainFromRequest(
+                input.options.req
+              );
+              if (clientDomain) {
+                input.userContext.rowndClientDomain = clientDomain;
+              }
               const appVariantId = getRequestedAppVariantIdFromRequest(
                 input.options.req
               );
+              if (appVariantId) {
+                input.userContext.rowndAppVariantId = appVariantId;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
-              return originalImplementation.createCodePOST({
-                ...input,
-                userContext: displayContext || redirectToPath || appVariantId ? {
-                  ...input.userContext,
-                  ...appVariantId ? { rowndAppVariantId: appVariantId } : {},
-                  ...displayContext ? { rowndDisplayContext: displayContext } : {},
-                  ...redirectToPath ? { rowndRedirectToPath: redirectToPath } : {}
-                } : input.userContext
-              });
+              return originalImplementation.createCodePOST(input);
             },
             consumeCodePOST: async (input) => {
               if (originalImplementation.consumeCodePOST === void 0) {
@@ -2593,11 +2677,11 @@ var init = createPluginInitFunction(
               const appVariantId = getRequestedAppVariantIdFromRequest(
                 input.options.req
               );
+              if (appVariantId) {
+                input.userContext.rowndAppVariantId = appVariantId;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
-              const response = await originalImplementation.consumeCodePOST({
-                ...input,
-                userContext: appVariantId ? { ...input.userContext, rowndAppVariantId: appVariantId } : input.userContext
-              });
+              const response = await originalImplementation.consumeCodePOST(input);
               if (response.status === "OK") {
                 await recordRowndAppVariantForUser(
                   response.user.id,
@@ -2618,11 +2702,11 @@ var init = createPluginInitFunction(
               const appVariantId = getRequestedAppVariantIdFromRequest(
                 input.options.req
               );
+              if (appVariantId) {
+                input.userContext.rowndAppVariantId = appVariantId;
+              }
               assertRowndAppVariantIsConfigured(appVariantId);
-              const response = await originalImplementation.signInUpPOST({
-                ...input,
-                userContext: appVariantId ? { ...input.userContext, rowndAppVariantId: appVariantId } : input.userContext
-              });
+              const response = await originalImplementation.signInUpPOST(input);
               if (response.status === "OK") {
                 await recordRowndAppVariantForUser(
                   response.user.id,
@@ -2660,19 +2744,23 @@ var init = createPluginInitFunction(
           functions: (originalImplementation) => ({
             ...originalImplementation,
             createNewSession: async (input) => {
-              input.accessTokenPayload = {
-                ...input.accessTokenPayload,
-                ...await buildRowndSessionClaims(
+              const [rowndSessionClaims, rowndIsAnonymousClaim] = await Promise.all([
+                buildRowndSessionClaims(
                   input.userId,
                   input.accessTokenPayload
                 ),
-                ...await RowndIsAnonymousClaim.build(
+                RowndIsAnonymousClaim.build(
                   input.userId,
                   input.recipeUserId,
                   input.tenantId,
                   input.accessTokenPayload,
                   input.userContext
                 )
+              ]);
+              input.accessTokenPayload = {
+                ...input.accessTokenPayload,
+                ...rowndSessionClaims,
+                ...rowndIsAnonymousClaim
               };
               return originalImplementation.createNewSession(input);
             }
@@ -2698,7 +2786,7 @@ var init = createPluginInitFunction(
                         ...addHubBootstrapParams(
                           input,
                           "emailVerifyLink",
-                          "account/verify-email"
+                          HUB_VERIFY_EMAIL_PAGE_PATH
                         )
                       });
                     }
@@ -2751,21 +2839,14 @@ var init = createPluginInitFunction(
         );
       }
     }
-    if (config2.mobileDeepLinkBaseUrl !== void 0) {
-      try {
-        if (!/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(config2.mobileDeepLinkBaseUrl)) {
-          throw new Error();
-        }
-        new URL(config2.mobileDeepLinkBaseUrl);
-      } catch {
-        throw new Error("Invalid mobileDeepLinkBaseUrl in plugin config");
-      }
+    for (const [key, value] of Object.entries(config2.clientDomains ?? {})) {
+      validateClientDomainUrl(key, value);
     }
     return {
       rowndAppKey: config2.rowndAppKey,
       rowndAppSecret: config2.rowndAppSecret,
       enableDebugLogs: config2.enableDebugLogs,
-      mobileDeepLinkBaseUrl: config2.mobileDeepLinkBaseUrl,
+      clientDomains: config2.clientDomains,
       telemetry: config2.telemetry,
       schema: config2.schema,
       appConfig: config2.appConfig,
@@ -2773,110 +2854,15 @@ var init = createPluginInitFunction(
     };
   }
 );
-
-// src/emailContent.ts
-function getActiveAppConfig(userContext) {
-  const config2 = getPluginConfig();
-  const baseApp = config2?.appConfig;
-  const appVariantId = userContext?.rowndAppVariantId;
-  if (typeof appVariantId === "string" && config2?.subBrands?.[appVariantId]) {
-    return deepMerge(baseApp ?? {}, config2.subBrands[appVariantId]);
-  }
-  return baseApp;
-}
-function deepMerge(base, overlay) {
-  const result = { ...base };
-  for (const [key, value] of Object.entries(overlay)) {
-    if (value === void 0) {
-      continue;
-    }
-    const existingValue = result[key];
-    if (isRecord2(existingValue) && isRecord2(value)) {
-      result[key] = deepMerge(existingValue, value);
-    } else {
-      result[key] = value;
+function validateClientDomainUrl(key, value) {
+  try {
+    if (typeof value !== "string" || !/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(value)) {
+      throw new Error();
     }
+    new URL(value);
+  } catch {
+    throw new Error(`Invalid clientDomains.${key} in plugin config`);
   }
-  return result;
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getEmailConfig(userContext) {
-  return getActiveAppConfig(userContext)?.auth?.email;
-}
-function getEmailLink(input) {
-  if (hasOwn2(input, "urlWithLinkCode")) {
-    return input.urlWithLinkCode;
-  }
-  return hasOwn2(input, "emailVerifyLink") ? input.emailVerifyLink : void 0;
-}
-function getEmailAddress(input) {
-  if (hasOwn2(input, "email")) {
-    return input.email;
-  }
-  return input.user.email;
-}
-function hasOwn2(value, key) {
-  return Object.prototype.hasOwnProperty.call(value, key);
-}
-function buildRowndEmailContent(input, originalContent, emailConfig) {
-  if (!emailConfig) {
-    return originalContent;
-  }
-  const appConfig = getActiveAppConfig(input.userContext) ?? {};
-  const link = getEmailLink(input);
-  const callToActionText = emailConfig.callToActionText ?? "Verify your email";
-  if (!link) {
-    return {
-      ...originalContent,
-      subject: emailConfig.subject ?? originalContent.subject
-    };
-  }
-  return {
-    ...originalContent,
-    toEmail: getEmailAddress(input),
-    subject: emailConfig.subject ?? originalContent.subject,
-    isHtml: true,
-    body: renderEmailHtml({
-      appConfig,
-      emailConfig,
-      link,
-      callToActionText,
-      originalBody: originalContent.body
-    })
-  };
-}
-function renderEmailHtml(input) {
-  const primaryColor = input.appConfig.branding?.primaryColor ?? DEFAULT_PRIMARY_COLOR;
-  const image = input.emailConfig.image || input.appConfig.branding?.logo || input.appConfig.icon;
-  const appName = input.appConfig.name ?? "Application";
-  const content = input.emailConfig.customContent ?? input.originalBody;
-  return `<!doctype html>
-<html>
-  <body style="font-family: Arial, sans-serif; color: #1f2937; margin: 0; padding: 32px; background: #f9fafb;">
-    <table role="presentation" width="100%" cellspacing="0" cellpadding="0" style="max-width: 560px; margin: 0 auto; background: #ffffff; border-radius: 16px; padding: 32px;">
-      <tr>
-        <td style="text-align: center;">
-          ${image ? `<img src="${escapeHtml(image)}" alt="${escapeHtml(appName)}" style="max-width: 96px; max-height: 96px; margin-bottom: 24px;" />` : ""}
-          <div style="font-size: 18px; font-weight: 600; margin-bottom: 16px;">${escapeHtml(appName)}</div>
-          <div style="font-size: 15px; line-height: 1.6; margin-bottom: 24px;">${content}</div>
-          <a href="${escapeHtml(input.link)}" style="display: inline-block; background: ${escapeHtml(primaryColor)}; color: #ffffff; text-decoration: none; padding: 12px 20px; border-radius: 10px; font-weight: 600;">${escapeHtml(input.callToActionText)}</a>
-          ${input.emailConfig.customClosingContent ? `<div style="font-size: 14px; line-height: 1.6; margin-top: 24px;">${input.emailConfig.customClosingContent}</div>` : ""}
-        </td>
-      </tr>
-    </table>
-  </body>
-</html>`;
-}
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-async function getRowndPasswordlessEmailContent(input, originalContent) {
-  return buildRowndEmailContent(input, originalContent, getEmailConfig(input.userContext));
-}
-async function getRowndEmailVerificationContent(input, originalContent) {
-  return buildRowndEmailContent(input, originalContent, getEmailConfig(input.userContext));
 }
 
 // src/index.ts
@@ -2887,15 +2873,16 @@ var index_default = { init };
   DEFAULT_ROWND_SCHEMA,
   GUEST_AUTH_METHOD_ID,
   HANDLE_BASE_PATH,
+  HUB_LOGIN_PAGE_PATH,
+  HUB_VERIFY_EMAIL_PAGE_PATH,
   PLUGIN_ID,
   PLUGIN_SDK_VERSION,
+  PLUGIN_VERSION,
   PUBLIC_TENANT_ID,
   ROWND_JWT_CLAIMS,
   ROWND_PLUGIN_ERROR_MESSAGES,
   RowndPluginError,
   getRowndClient,
-  getRowndEmailVerificationContent,
-  getRowndPasswordlessEmailContent,
   init,
   setRowndClient
 });