@synqauth/nextjs 0.0.0 → 0.3.0

package/README.md

@@ -4,7 +4,7 @@ Synq for Next.js: a backend-for-frontend session, so the browser never holds a S
 
 Synq is customer identity for businesses: an OpenID Connect issuer for each of your brands, with Solana wallet, social, email and passkey sign-in. The documentation is at [docs.synq.build](https://docs.synq.build).
 
-This package is at 0.x and hasn't been published yet: its API can change in any release until Synq's first customer depends on it.
+This package is at 0.x, so a minor release can change its API: see its CHANGELOG.md.
 
 ## Quick start
 
@@ -52,12 +52,31 @@ export const proxy = synqProxy(synqConfig, { protect: ['/dashboard'] })
 export const config = { matcher: ['/((?!_next/|.*\\..*).*)'] }
 ```
 
-To add a way to sign in to someone's account (Google, a wallet, anything the brand offers), POST `{ method, returnTo }` as JSON to `/api/auth/link` from your own pages and send the browser to the `redirect` it answers, or call `useAuth().link('google')` from `@synqauth/react`: Synq asks them to sign in again, then adds it.
+To add a way to sign in to someone's account (Google, a wallet, a passkey, anything the brand offers), POST `{ method, returnTo }` as JSON to `/api/auth/link` from your own pages and send the browser to the `redirect` it answers, or call `useAuth().link('google')` from `@synqauth/react`: Synq asks them to sign in again, then adds it.
+
+To sign people in on your own page instead of the brand's (AERO-1411), turn on own-UI sign-in for the app in the dashboard and use `<SignInForm>` or `useSignIn()` from `@synqauth/react`. They post each step to `/api/auth/sign-in/flow`, which takes it to Synq as your app. Pass `clientAddress` to `defineSynqConfig` when your host doesn't set `x-real-ip`, so Synq can limit tries per address. Read a header your own proxy sets, never one the browser could send:
+
+```ts
+export const synqConfig = defineSynqConfig({
+  // Behind Cloudflare
+  clientAddress: (request) => request.headers.get('cf-connecting-ip') ?? undefined,
+})
+```
 
 In a server component, `await synq.me()` is the signed-in person or null, and `await synq.getAccessToken()` is a token for your API (`resource`). Link `synq.signInPath({ returnTo: '/dashboard' })` to sign in, and sign out with a form that POSTs to `synq.signOutPath`.
 
 ## When a sign-in doesn't finish
 
+Synq's own dashboard can resume an unverified email address with
+`/auth/sign-in?intent=verify-email&returnTo=/onboard`. The intent defaults to
+`prompt=select_account`, so an existing GitHub-only account can prove its email
+without signing in again or creating another account. An explicit `prompt` and
+`max_age` are preserved: verification never replaces a request for fresh
+authentication. A maximum-age request takes the normal sign-in flow; an
+incompatible explicit prompt is refused rather than replaced. This verification
+flow applies only where the issuer requires unproved email addresses to be
+verified; tenants keep their existing behavior.
+
 When Synq refuses a sign-in (the person cancelled, their account can't use the app, a token gate they went back from) or the callback fails, the route mount sends the browser back to `returnTo` with `synq_error=<code>`. The proxy never sends such a page to sign in again: with the same session at the brand, that would land on the same refusal, round and round. Without a session, it shows why instead, with "Try again" and "Use another account" (`prompt=select_account`). Give it a page of your own with `signInError`, which it never protects:
 
 ```ts
@@ -104,6 +123,28 @@ export const synqConfig = defineSynqConfig({
 
 To rotate `SYNQ_SESSION_SECRET`, move the old secret to `SYNQ_SESSION_SECRET_PREVIOUS` (comma-separated), which opens cookies but never seals them.
 
+## Several sites from one deployment
+
+One app can sign people in on many hosts, each with its own app, at its own brand or a shared one: a site per chapter, say. Pass `hosts`, every host you serve (`*.` and a domain for any one label under it), and `resolve`, which answers each request's site from its host. It may be async and read the client secret from your own store:
+
+```ts
+export const synqConfig = defineSynqConfig({
+  hosts: ['*.acmeguild.com'],
+  async resolve({ host }) {
+    const chapter = await chapterByHost(host)
+    if (!chapter) return null
+    return {
+      issuer: chapter.issuer,
+      clientId: chapter.clientId,
+      clientSecret: await chapter.clientSecret(),
+      storePrefix: `chapter-${chapter.slug}:`,
+    }
+  },
+})
+```
+
+The handlers, the proxy, `me()`, `getSession()` and `getAccessToken()` then pick the request's site per request. The host comes from `X-Forwarded-Host`, else `Host`, and the site's app URL is `https://<host>`. A host off `hosts`, or one `resolve` answers `null` for, is refused with `unknown_host`: never given another site's configuration. Each site's core is kept, and its cookies are sealed for it alone, so sites never share a session. The guide is at [docs.synq.build/guides/several-sites](https://docs.synq.build/guides/several-sites).
+
 ## License
 
 MIT

package/dist/{config-BNh2Aznt.d.ts → config-a7tT3KtP.d.ts}

@@ -1,3 +1,4 @@
+import { LinkedAccount } from "@synqauth/js";
 //#region src/plugins.d.ts
 /** A signed-in person, from the ID token Synq issued at sign-in. */
 interface SynqUser {
@@ -7,11 +8,40 @@ interface SynqUser {
   readonly email_verified?: boolean;
   readonly name?: string;
   readonly preferred_username?: string;
+  /** The picture they chose: none, and your app shows its own default, from `avatar_seed`. */
   readonly picture?: string;
+  /** Where `picture` came from (AERO-2700): `none`, `upload`, `url` or `linked:<provider>`. */
+  readonly picture_source?: string;
+  /**
+   * What to draw their default avatar from (AERO-2704): theirs in every app
+   * of the brand. Absent from a token issued before seeds: use `sub`.
+   */
+  readonly avatar_seed?: string;
+  /** The brand's own default avatar for them, where it uploaded a set. */
+  readonly default_picture?: string;
   /** When they signed in, in seconds since the epoch. */
   readonly auth_time?: number;
   /** How they signed in: `pwd`, `otp`, `wallet`, `hwk`, `fed`... */
   readonly amr?: readonly string[];
+  /**
+   * Their accounts at upstream providers (GitHub, Google…), with what each
+   * says of the account, when the app asks for the `linked_accounts` scope
+   * (AERO-2332).
+   */
+  readonly linked_accounts?: readonly LinkedAccount[];
+  /**
+   * How the sign-in this session came from went, when the app turned its
+   * sign-in claims on (`sign_in_claims`, AERO-2691): the way in (`google`,
+   * `wallet`, `email`, `password`, `passkey`…).
+   */
+  readonly sign_in_method?: string;
+  /** For a wallet sign-in, the address that signed and the wallet app's name, when it said. */
+  readonly sign_in_wallet?: {
+    readonly address: string;
+    readonly app: string | null;
+  };
+  /** Whether that sign-in made the account: true in its first ID token only. */
+  readonly new_user?: boolean;
   readonly [claim: string]: unknown;
 }
 /** What a plugin's route is handed. */
@@ -173,7 +203,75 @@ interface SynqAuthOptions {
   plugins?: readonly SynqPlugin[];
   /** The `fetch` to call Synq with. */
   fetch?: typeof fetch;
+  /**
+   * Where the person signing in on the app's own screens is
+   * (`<basePath>/sign-in/flow`, AERO-1411), as this server saw them: Synq
+   * counts its per-address limits for the app with it (`Synq-End-User-IP`).
+   * `x-real-ip` by default, which Vercel sets; give one that reads your
+   * proxy's header otherwise. Return undefined, and per-address protection
+   * is off for the app.
+   */
+  clientAddress?: (request: Request) => string | undefined;
+  /**
+   * For an app that serves several sites from one deployment (AERO-2655):
+   * a brand per site, an app per host, or both. Called per request with the
+   * host the browser asked for, once it is on `hosts`, it answers that
+   * site's issuer, app and secret, which it may read from the app's own
+   * store (it may be async). Null for a host the app doesn't serve, which is
+   * refused as one off `hosts` is. Each site's core is made once and kept,
+   * keyed by everything that tells sites apart, so two never share a
+   * session. With `resolve`, the site's options come from it alone: never
+   * from `issuer`, `clientId`, `clientSecret`, `appUrl` or
+   * `postLogoutRedirectUri` here, nor from `SYNQ_*`.
+   */
+  resolve?: SynqResolve;
+  /**
+   * With `resolve`: every host the app serves, as the browser names it
+   * (`club.example.com`, `localhost:3000`), or `*.example.com` for any one
+   * label under a domain. A request whose host (`X-Forwarded-Host`, else
+   * `Host`) isn't one is refused with `unknown_host`: never answered with
+   * another site's configuration.
+   */
+  hosts?: readonly string[];
 }
+/** What `resolve` is asked about: the request's host, already on `hosts`. */
+interface SynqSiteRequest {
+  /** The host the browser asked for, lowercase, with its port when it named one. */
+  readonly host: string;
+  /**
+   * `https://<host>`, or `http://` for a host on this machine when the
+   * request came over http: the site's `appUrl` unless `resolve` says.
+   */
+  readonly origin: string;
+  /** The request's headers, cookies included: for a choice the app keeps in one. */
+  readonly headers: Headers;
+}
+/** One site's Synq, as `resolve` answers it. */
+interface SynqSite {
+  /** The brand's issuer URL: `https://<issuer-slug>.auth.<Synq's domain>`. */
+  readonly issuer: string;
+  /** The site's app: a web app of the brand. */
+  readonly clientId: string;
+  /** The app's client secret. Never logged, never in a cookie, never in an error. */
+  readonly clientSecret: string;
+  /**
+   * Where the site is served: the request's own `origin` by default, and
+   * nothing else, since the session's cookies are on that host alone.
+   */
+  readonly appUrl?: string;
+  /**
+   * The site's sessions' prefix in `store`, so one store keeps every
+   * site's apart, and a site's can be found or cleared on their own:
+   * `club-dragons:`, say. Sessions never open on another site either way.
+   */
+  readonly storePrefix?: string;
+  /** Whether the site's sessions hold a token for the brand's account API: the top-level `account` by default. */
+  readonly account?: boolean;
+  /** Where the browser lands after signing out: the site's root by default. */
+  readonly postLogoutRedirectUri?: string;
+}
+/** Picks a request's site: null (or undefined) for a host the app doesn't serve. */
+type SynqResolve = (request: SynqSiteRequest) => SynqSite | null | undefined | Promise<SynqSite | null | undefined>;
 interface SynqConfig {
   readonly issuer: string;
   readonly clientId: string;
@@ -194,11 +292,19 @@ interface SynqConfig {
   readonly refreshLeewaySeconds: number;
   readonly plugins: readonly SynqPlugin[];
   readonly fetch: typeof fetch | undefined;
+  /** Where a person signing in on the app's own screens is: `x-real-ip` by default. */
+  readonly clientAddress: (request: Request) => string | undefined;
   /** Over https: `Secure` cookies with the `__Host-` prefix. */
   readonly secure: boolean;
+  /**
+   * The site the session's cookies are sealed for (`resolve`): its issuer,
+   * app and origin, so a cookie never opens on another site. Empty for an
+   * app with one configuration.
+   */
+  readonly site: string;
 }
 type Env = Record<string, string | undefined>;
 /** The configuration from `options` and the environment; throws `invalid_options` for anything missing or unsafe. */
 declare function resolveConfig(options?: SynqAuthOptions, env?: Env): SynqConfig;
 //#endregion
-export { KeyValueSessionStoreOptions as a, keyValueSessionStore as c, SynqPluginContext as d, SynqPluginRoute as f, KeyValue as i, memorySessionStore as l, defineSynqPlugin as m, SynqConfig as n, SessionValues as o, SynqUser as p, resolveConfig as r, SynqSessionStore as s, SynqAuthOptions as t, SynqPlugin as u };
+export { defineSynqPlugin as _, SynqSiteRequest as a, KeyValueSessionStoreOptions as c, keyValueSessionStore as d, memorySessionStore as f, SynqUser as g, SynqPluginRoute as h, SynqSite as i, SessionValues as l, SynqPluginContext as m, SynqConfig as n, resolveConfig as o, SynqPlugin as p, SynqResolve as r, KeyValue as s, SynqAuthOptions as t, SynqSessionStore as u };

package/dist/define.d.ts

@@ -1,6 +1,6 @@
-import { t as SynqAuthOptions } from "./config-BNh2Aznt.js";
+import { a as SynqSiteRequest, i as SynqSite, r as SynqResolve, t as SynqAuthOptions } from "./config-a7tT3KtP.js";
 //#region src/define.d.ts
 /** Declares the app's Synq configuration: `SYNQ_*` environment variables fill in whatever it leaves out. */
 export declare function defineSynqConfig<const T extends SynqAuthOptions>(options: T): T;
 //#endregion
-export type { SynqAuthOptions };
+export type { SynqAuthOptions, SynqResolve, SynqSite, SynqSiteRequest };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
-import { a as KeyValueSessionStoreOptions, c as keyValueSessionStore, d as SynqPluginContext, f as SynqPluginRoute, i as KeyValue, l as memorySessionStore, m as defineSynqPlugin, n as SynqConfig, o as SessionValues, p as SynqUser, r as resolveConfig, s as SynqSessionStore, t as SynqAuthOptions, u as SynqPlugin } from "./config-BNh2Aznt.js";
+import { _ as defineSynqPlugin, a as SynqSiteRequest, c as KeyValueSessionStoreOptions, d as keyValueSessionStore, f as memorySessionStore, g as SynqUser, h as SynqPluginRoute, i as SynqSite, l as SessionValues, m as SynqPluginContext, n as SynqConfig, o as resolveConfig, p as SynqPlugin, r as SynqResolve, s as KeyValue, t as SynqAuthOptions, u as SynqSessionStore } from "./config-a7tT3KtP.js";
 import { defineSynqConfig } from "./define.js";
 import { cookies } from "next/headers.js";
+import "@synqauth/js";
 //#region src/cookies.d.ts
 /** The cookies a request carries and the changes a response makes: what a route handler, Next's `cookies()` or a test gives. */
 interface CookieJar {
@@ -19,12 +20,54 @@ interface CookieOptions {
   secure: boolean;
 }
 //#endregion
+//#region src/sign-in-context.d.ts
+/** The way this browser last signed in to the app: never who, never an address. */
+interface LastUsedMethod {
+  /** The method's id: `google`, `wallet`, `email`… */
+  readonly method: string;
+  /** For a wallet, the wallet app's name as it announced itself (`Phantom`). */
+  readonly walletApp?: string;
+}
+/** A sign-in that just finished, told to the page once (`useSignInEvent()`). */
+interface SignInEvent {
+  /**
+   * This sign-in's own id, random: two sign-ins the same way can share
+   * `at` (a provider's own sign-in time), never this.
+   */
+  readonly id: string;
+  /** Whether it made the account: their first sign-in. */
+  readonly isNewUser: boolean;
+  /** The way in: `google`, `wallet`, `email`, `password`, `passkey`… */
+  readonly method: string;
+  /** For a wallet sign-in, the address that signed and its wallet app, when it said. */
+  readonly wallet: {
+    readonly address: string;
+    readonly app: string | null;
+  } | null;
+  /** When they signed in, in seconds since the epoch (the ID token's `auth_time`). */
+  readonly at: number;
+}
+//#endregion
 //#region src/core.d.ts
 /** Who is signed in, as the browser may see it: never a token. */
 interface SynqSessionInfo {
   readonly user: SynqUser | null;
   /** When the main access token expires, in seconds since the epoch. */
   readonly expiresAt: number | null;
+  /**
+   * The way this browser last signed in to the app, for a "Last used" mark
+   * (AERO-2691): kept on the app's own host from the app's sign-in claims,
+   * signed in or out, and never where the brand turned "Last used" off.
+   * Null without the claims, or before any sign-in here.
+   */
+  readonly lastUsed: LastUsedMethod | null;
+  /**
+   * The sign-in that just finished, until the page says it heard of it
+   * (`DELETE <base>/session/event`, `useSignInEvent().consume()`) or five
+   * minutes pass: whether it made the account, how, and with which wallet.
+   * Needs the app's sign-in claims on.
+   */
+  readonly event: SignInEvent | null;
 }
 interface SynqCore {
   /** Answers a request under the route mount. */
@@ -81,7 +124,11 @@ export interface SynqAuth {
   };
   /** The signed-in person, or null: read from the session's ID token, once per request, with no request to Synq. */
   me(): Promise<SynqUser | null>;
-  /** Who is signed in and until when, as the browser may see it. */
+  /**
+   * Who is signed in and until when, as the browser may see it, with the way
+   * this browser last signed in (`lastUsed`) and the sign-in that just
+   * finished (`event`), once the app's sign-in claims are on (AERO-2691).
+   */
   getSession(): Promise<SynqSessionInfo>;
   /**
    * A current access token for the app's API (or `resource`), refreshed
@@ -97,7 +144,7 @@ export interface SynqAuth {
     returnTo?: string;
     method?: string;
     loginHint?: string;
-    prompt?: 'login' | 'none' | 'consent' | 'select_account';
+    prompt?: 'login' | 'none' | 'consent' | 'select_account' | 'create';
     maxAge?: number;
   }): string;
   /** Where a form POSTs to sign out. */
@@ -115,11 +162,14 @@ export interface SynqAuth {
 /**
  * Synq for this app, configured from SYNQ_ISSUER, SYNQ_CLIENT_ID,
  * SYNQ_CLIENT_SECRET, SYNQ_APP_URL and SYNQ_SESSION_SECRET unless `options`
- * (`defineSynqConfig`, shared with the proxy) says.
+ * (`defineSynqConfig`, shared with the proxy) says. With `resolve` and
+ * `hosts`, each request's site is its own (AERO-2655): its handlers answer a
+ * host off `hosts` with 421 `unknown_host`, and `me()`, `getSession()` and
+ * `getAccessToken()` throw that error.
  */
 export declare function synqAuth(options?: SynqAuthOptions): SynqAuth;
 type NextCookieStore = Awaited<ReturnType<typeof cookies>>;
 /** Next's cookie store as the cookie jar `createSynqCore` reads and writes. */
 export declare function jarOf(store: NextCookieStore): CookieJar;
 //#endregion
-export { type KeyValue, type KeyValueSessionStoreOptions, type SessionValues, type SynqAuthOptions, type SynqPlugin, type SynqPluginContext, type SynqPluginRoute, type SynqSessionInfo, type SynqSessionStore, type SynqSignInError, type SynqUser, defineSynqConfig, defineSynqPlugin, keyValueSessionStore, memorySessionStore, resolveConfig };
+export { type KeyValue, type KeyValueSessionStoreOptions, type LastUsedMethod, type SessionValues, type SignInEvent, type SynqAuthOptions, type SynqPlugin, type SynqPluginContext, type SynqPluginRoute, type SynqResolve, type SynqSessionInfo, type SynqSessionStore, type SynqSignInError, type SynqSite, type SynqSiteRequest, type SynqUser, defineSynqConfig, defineSynqPlugin, keyValueSessionStore, memorySessionStore, resolveConfig };

package/dist/index.js

@@ -1,25 +1,40 @@
-import { c as memorySessionStore, d as normalizePath, f as resolveConfig, l as defineSynqPlugin, n as signInErrorMessage, o as createSynqCore, r as signInErrorOf, s as keyValueSessionStore, t as SIGN_IN_ERROR_PARAM } from "./sign-in-error-DSCgrk0b.js";
+import { a as signInErrorMessage, d as memorySessionStore, f as defineSynqPlugin, h as resolveConfig, i as SIGN_IN_ERROR_PARAM, l as createSynqCore, m as normalizePath, n as unknownHostError, o as signInErrorOf, r as unknownHostResponse, t as siteCores, u as keyValueSessionStore } from "./sites-JUnMBDbp.js";
 import { defineSynqConfig } from "./define.js";
-import { cookies } from "next/headers.js";
+import { cookies, headers } from "next/headers.js";
 import { cache } from "react";
 //#region src/index.ts
 /**
 * Synq for this app, configured from SYNQ_ISSUER, SYNQ_CLIENT_ID,
 * SYNQ_CLIENT_SECRET, SYNQ_APP_URL and SYNQ_SESSION_SECRET unless `options`
-* (`defineSynqConfig`, shared with the proxy) says.
+* (`defineSynqConfig`, shared with the proxy) says. With `resolve` and
+* `hosts`, each request's site is its own (AERO-2655): its handlers answer a
+* host off `hosts` with 421 `unknown_host`, and `me()`, `getSession()` and
+* `getAccessToken()` throw that error.
 */
 function synqAuth(options = {}) {
 	let core;
+	const sites = options.resolve ? siteCores(options) : void 0;
 	const get = () => core ??= createSynqCore(resolveConfig(options));
-	const handler = (request) => get().handle(request);
+	/** The core for the page's request: the one, or its site's, read from Next's headers. */
+	const forPage = async () => {
+		if (!sites) return get();
+		const found = await sites.coreFor(await headers());
+		if (!found) throw unknownHostError();
+		return found;
+	};
+	const handler = async (request) => {
+		if (!sites) return get().handle(request);
+		const found = await sites.coreFor(request.headers, request.url);
+		return found ? found.handle(request) : unknownHostResponse();
+	};
 	const basePath = () => normalizePath(options.basePath ?? "/api/auth");
 	const me = cache(async () => {
 		const jar = await nextJar();
-		return get().user(jar);
+		return (await forPage()).user(jar);
 	});
 	const getSession = cache(async () => {
 		const jar = await nextJar();
-		return get().session(jar);
+		return (await forPage()).session(jar);
 	});
 	return {
 		handlers: {
@@ -32,7 +47,7 @@ function synqAuth(options = {}) {
 		getSession,
 		async getAccessToken(opts) {
 			const jar = await nextJar();
-			return get().getAccessToken(jar, opts);
+			return (await forPage()).getAccessToken(jar, opts);
 		},
 		signInPath(opts = {}) {
 			const params = new URLSearchParams();

package/dist/proxy.d.ts

@@ -1,4 +1,4 @@
-import { t as SynqAuthOptions } from "./config-BNh2Aznt.js";
+import { t as SynqAuthOptions } from "./config-a7tT3KtP.js";
 //#region src/proxy.d.ts
 /** What `synqProxy()` takes: which paths need a session. */
 export interface SynqProxyOptions {
@@ -18,6 +18,34 @@ export interface SynqProxyOptions {
    * of its own. Either way, it never sends that request to sign in again.
    */
   readonly signInError?: string;
+  /**
+   * Paths whose visitors without a session are sent to sign up rather than
+   * to sign in (`prompt=create`): where a "Get started" or pricing link
+   * lands. Path prefixes, or a test. Synq's page opens on its sign-up screen
+   * where the brand lets someone new sign up, with "Sign in" a link away,
+   * and someone already signed in at Synq is simply signed in.
+   */
+  readonly signUp?: readonly string[] | ((pathname: string) => boolean);
+  /**
+   * What the visitor picked on a pricing page, read from the URL of the page
+   * they are sent to sign in (or up) from: a plan's code and its billing
+   * interval, and the onboarding visit's id. Synq's own sign-up page says
+   * the plan back, and its funnel ties the account made to the visit
+   * (AERO-2160); a tenant's page ignores them. Return undefined when the
+   * page names neither.
+   */
+  readonly choice?: (url: URL) => SignUpChoice | undefined;
+}
+/** What a visitor picked: a plan's code and its interval, and the onboarding visit. */
+export interface SignUpChoice {
+  readonly plan?: string;
+  /** Monthly or yearly; only with a plan. */
+  readonly interval?: 'month' | 'year';
+  /**
+   * The onboarding visit's id (22 base62 characters), which Synq's funnel
+   * ties the account a sign-up makes to.
+   */
+  readonly onboarding?: string;
 }
 /**
  * Next's proxy for Synq: refreshes a session that is due, and sends a

package/dist/proxy.js

@@ -1,4 +1,4 @@
-import { a as withoutSignInError, f as resolveConfig, i as signInErrorPage, o as createSynqCore, r as signInErrorOf, t as SIGN_IN_ERROR_PARAM, u as requestJar } from "./sign-in-error-DSCgrk0b.js";
+import { c as withoutSignInError, h as resolveConfig, i as SIGN_IN_ERROR_PARAM, l as createSynqCore, m as normalizePath, o as signInErrorOf, p as requestJar, r as unknownHostResponse, s as signInErrorPage, t as siteCores } from "./sites-JUnMBDbp.js";
 import { NextResponse } from "next/server.js";
 //#region src/proxy.ts
 /**
@@ -7,14 +7,22 @@ import { NextResponse } from "next/server.js";
 * just failed, to the page that says why.
 */
 function synqProxy(config, options) {
-	const { protect, signInError } = options;
+	const { protect, signInError, signUp, choice } = options;
 	if (signInError !== void 0 && !/^\/(?![/\\])/.test(signInError)) throw new TypeError("synqProxy: signInError is a path on the app, such as /sign-in-error");
 	const protectsPath = typeof protect === "function" ? protect : (path) => protect.some((prefix) => under(path, prefix));
+	const signsUp = signUp === void 0 ? () => false : typeof signUp === "function" ? signUp : (path) => signUp.some((prefix) => under(path, prefix));
 	const protects = (path) => !(signInError !== void 0 && under(path, signInError)) && protectsPath(path);
-	let core;
+	let single;
+	const sites = config.resolve ? siteCores(config) : void 0;
 	return async function proxy(request) {
-		core ??= createSynqCore(resolveConfig(config));
 		const url = new URL(request.url);
+		let core;
+		if (sites) {
+			if (under(url.pathname, normalizePath(config.basePath ?? "/api/auth"))) return void 0;
+			const found = await sites.coreFor(request.headers, request.url);
+			if (!found) return protects(url.pathname) ? unknownHostResponse() : void 0;
+			core = found;
+		} else core = single ??= createSynqCore(resolveConfig(config));
 		if (under(url.pathname, core.config.basePath)) return void 0;
 		const jar = requestJar(request);
 		const signedIn = await core.refreshIfDue(jar);
@@ -29,6 +37,13 @@ function synqProxy(config, options) {
 			}
 			const signIn = new URL(`${core.config.basePath}/sign-in`, core.config.appUrl);
 			signIn.searchParams.set("returnTo", returnTo);
+			if (signsUp(url.pathname)) signIn.searchParams.set("prompt", "create");
+			const picked = choice?.(url);
+			if (picked?.plan) {
+				signIn.searchParams.set("plan", picked.plan);
+				if (picked.interval) signIn.searchParams.set("interval", picked.interval);
+			}
+			if (picked?.onboarding) signIn.searchParams.set("onboarding", picked.onboarding);
 			const response = new Response(null, {
 				status: 307,
 				headers: { location: signIn.href }