better-auth-cognito-native 0.1.0

package/dist/index.mjs

@@ -0,0 +1,679 @@
+import { t as COGNITO_ERROR_CODES } from "./error-codes-O-Ljx2JX.mjs";
+import { getPasskeyConfig } from "./config.mjs";
+import { AliasExistsException, CodeMismatchException, CognitoIdentityProviderClient, CompleteWebAuthnRegistrationCommand, ConfirmForgotPasswordCommand, ConfirmSignUpCommand, ExpiredCodeException, ForgotPasswordCommand, GetUserCommand, GlobalSignOutCommand, InitiateAuthCommand, InvalidParameterException, InvalidPasswordException, LimitExceededException, NotAuthorizedException, ResendConfirmationCodeCommand, RespondToAuthChallengeCommand, SignUpCommand, StartWebAuthnRegistrationCommand, UpdateUserAttributesCommand, UserLambdaValidationException, UserNotConfirmedException, UserNotFoundException, UsernameExistsException, WebAuthnChallengeNotFoundException, WebAuthnConfigurationMissingException, WebAuthnNotEnabledException, WebAuthnOriginNotAllowedException, WebAuthnRelyingPartyMismatchException } from "@aws-sdk/client-cognito-identity-provider";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
+import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
+import { symmetricDecodeJWT, symmetricEncodeJWT } from "better-auth/crypto";
+import * as z from "zod";
+//#region src/routes.ts
+const cognitoSignInBodySchema = z.object({
+	email: z.email(),
+	password: z.string().min(1),
+	rememberMe: z.boolean().optional()
+});
+const cognitoSignUpBodySchema = z.object({
+	email: z.email(),
+	password: z.string().min(1)
+});
+const cognitoConfirmSignUpBodySchema = z.object({
+	email: z.email(),
+	code: z.string().trim().min(1)
+});
+const cognitoResendConfirmationCodeBodySchema = z.object({ email: z.email() });
+const cognitoForgotPasswordBodySchema = z.object({ email: z.email() });
+const cognitoConfirmForgotPasswordBodySchema = z.object({
+	email: z.email(),
+	code: z.string().trim().min(1),
+	newPassword: z.string().min(1)
+});
+const cognitoNewPasswordBodySchema = z.object({
+	email: z.email(),
+	newPassword: z.string().min(1),
+	challengeSession: z.string().min(1),
+	rememberMe: z.boolean().optional()
+});
+const cognitoSignOutBodySchema = z.object({ redirectTo: z.string().optional() });
+const cognitoStartPasskeySignInBodySchema = z.object({ email: z.email() });
+const cognitoCompletePasskeySignInBodySchema = z.object({
+	email: z.email(),
+	credential: z.record(z.string(), z.unknown()),
+	session: z.string().min(1),
+	rememberMe: z.boolean().optional()
+});
+const cognitoCompletePasskeyRegistrationBodySchema = z.object({ credential: z.record(z.string(), z.unknown()) });
+const cognitoUpdateUserAttributesBodySchema = z.object({ attributes: z.array(z.object({
+	Name: z.string().min(1),
+	Value: z.string()
+})).min(1) });
+const COGNITO_COOKIE = "cognito_tokens";
+const COGNITO_COOKIE_DEFAULT_MAX_AGE = 3600;
+const COGNITO_COOKIE_SUBJECT = "better-auth-cognito";
+function isStatefulAuth(ctx) {
+	return !!ctx.context.options.database || !!ctx.context.options.secondaryStorage;
+}
+async function writeCognitoTokenCookie(ctx, payload) {
+	const cookie = ctx.context.createAuthCookie(COGNITO_COOKIE, { maxAge: COGNITO_COOKIE_DEFAULT_MAX_AGE });
+	const maxAge = typeof cookie.attributes.maxAge === "number" ? cookie.attributes.maxAge : COGNITO_COOKIE_DEFAULT_MAX_AGE;
+	const encoded = await symmetricEncodeJWT(payload, ctx.context.secretConfig, COGNITO_COOKIE_SUBJECT, maxAge);
+	ctx.setCookie(cookie.name, encoded, cookie.attributes);
+}
+async function readCognitoTokenCookie(ctx, userId) {
+	const cookie = ctx.context.createAuthCookie(COGNITO_COOKIE);
+	const raw = ctx.getCookie(cookie.name);
+	if (!raw) return null;
+	try {
+		const data = await symmetricDecodeJWT(raw, ctx.context.secretConfig, COGNITO_COOKIE_SUBJECT);
+		if (data?.userId === userId) return data;
+	} catch {}
+	return null;
+}
+function clearCognitoTokenCookie(ctx) {
+	const cognitoCookie = ctx.context.createAuthCookie(COGNITO_COOKIE);
+	ctx.setCookie(cognitoCookie.name, "", {
+		...cognitoCookie.attributes,
+		maxAge: 0
+	});
+}
+async function getCognitoTokens(ctx, userId) {
+	if (!isStatefulAuth(ctx)) {
+		const fromCookie = await readCognitoTokenCookie(ctx, userId);
+		if (fromCookie) return {
+			accessToken: fromCookie.accessToken,
+			idToken: fromCookie.idToken
+		};
+	}
+	const account = (await ctx.context.internalAdapter.findAccounts(userId).catch(() => [])).find((a) => a.providerId === "cognito");
+	if (account) return {
+		accessToken: account.accessToken ?? null,
+		idToken: account.idToken ?? null
+	};
+	if (isStatefulAuth(ctx)) {
+		const fromCookie = await readCognitoTokenCookie(ctx, userId);
+		if (fromCookie) return {
+			accessToken: fromCookie.accessToken,
+			idToken: fromCookie.idToken
+		};
+	}
+	return {
+		accessToken: null,
+		idToken: null
+	};
+}
+async function getCognitoAccessToken(ctx, userId) {
+	const { accessToken } = await getCognitoTokens(ctx, userId);
+	return accessToken;
+}
+async function upsertCognitoAccount(ctx, userId, accountId, tokenData) {
+	const accountFields = {
+		providerId: "cognito",
+		accountId,
+		userId,
+		accessToken: tokenData.accessToken,
+		refreshToken: tokenData.refreshToken ?? null,
+		idToken: tokenData.idToken,
+		accessTokenExpiresAt: tokenData.accessTokenExpiresAt,
+		scope: "openid profile email"
+	};
+	if (!isStatefulAuth(ctx)) {
+		await writeCognitoTokenCookie(ctx, {
+			userId,
+			accessToken: tokenData.accessToken ?? null,
+			idToken: tokenData.idToken
+		});
+		return;
+	}
+	const existing = await ctx.context.internalAdapter.findAccounts(userId).then((accounts) => accounts.find((a) => a.providerId === "cognito")).catch(() => null);
+	if (existing) await ctx.context.internalAdapter.updateAccount(existing.id, accountFields);
+	else await ctx.context.internalAdapter.createAccount(accountFields);
+}
+function cognitoGetTokensEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/tokens", { method: "GET" }, async (ctx) => {
+		const activeSession = await getSessionFromCtx(ctx);
+		if (!activeSession) throw new APIError("UNAUTHORIZED");
+		const { accessToken, idToken } = await getCognitoTokens(ctx, activeSession.user.id);
+		return ctx.json({
+			accessToken,
+			idToken
+		});
+	});
+}
+function cognitoSignUpEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/sign-up", {
+		method: "POST",
+		body: cognitoSignUpBodySchema
+	}, async (ctx) => {
+		const { email, password } = ctx.body;
+		try {
+			const result = await pCtx.client.send(new SignUpCommand({
+				ClientId: pCtx.clientId,
+				Username: email,
+				Password: password,
+				UserAttributes: [{
+					Name: "email",
+					Value: email
+				}]
+			}));
+			return ctx.json({
+				userConfirmed: result.UserConfirmed,
+				userSub: result.UserSub,
+				codeDeliveryDetails: result.CodeDeliveryDetails ?? null
+			});
+		} catch (err) {
+			if (err instanceof UsernameExistsException) throw new APIError("CONFLICT", { message: COGNITO_ERROR_CODES.ACCOUNT_ALREADY_EXISTS });
+			if (err instanceof LimitExceededException) return ctx.json({
+				userConfirmed: false,
+				userSub: email,
+				codeDeliveryDetails: null
+			});
+			if (err instanceof InvalidPasswordException || err instanceof InvalidParameterException || err instanceof UserLambdaValidationException) throw new APIError("BAD_REQUEST", { message: err.message ?? COGNITO_ERROR_CODES.SIGN_UP_FAILED });
+			ctx.context.logger.error("cognito/sign-up: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.SIGN_UP_FAILED });
+		}
+	});
+}
+function cognitoConfirmSignUpEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/confirm-sign-up", {
+		method: "POST",
+		body: cognitoConfirmSignUpBodySchema
+	}, async (ctx) => {
+		const { email, code } = ctx.body;
+		try {
+			await pCtx.client.send(new ConfirmSignUpCommand({
+				ClientId: pCtx.clientId,
+				Username: email,
+				ConfirmationCode: code
+			}));
+			return ctx.json({ confirmed: true });
+		} catch (err) {
+			if (err instanceof CodeMismatchException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.CONFIRMATION_CODE_MISMATCH });
+			if (err instanceof ExpiredCodeException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.CONFIRMATION_CODE_EXPIRED });
+			if (err instanceof UserNotFoundException) throw new APIError("NOT_FOUND", { message: COGNITO_ERROR_CODES.USER_NOT_FOUND });
+			if (err instanceof AliasExistsException || err instanceof InvalidParameterException || err instanceof NotAuthorizedException) throw new APIError("BAD_REQUEST", { message: err.message ?? COGNITO_ERROR_CODES.CONFIRMATION_FAILED });
+			ctx.context.logger.error("cognito/confirm-sign-up: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.CONFIRMATION_FAILED });
+		}
+	});
+}
+function cognitoResendConfirmationCodeEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/resend-confirmation", {
+		method: "POST",
+		body: cognitoResendConfirmationCodeBodySchema
+	}, async (ctx) => {
+		const { email } = ctx.body;
+		try {
+			const result = await pCtx.client.send(new ResendConfirmationCodeCommand({
+				ClientId: pCtx.clientId,
+				Username: email
+			}));
+			return ctx.json({ codeDeliveryDetails: result.CodeDeliveryDetails ?? null });
+		} catch (err) {
+			if (err instanceof UserNotFoundException) throw new APIError("NOT_FOUND", { message: COGNITO_ERROR_CODES.USER_NOT_FOUND });
+			if (err instanceof InvalidParameterException || err instanceof LimitExceededException || err instanceof NotAuthorizedException) throw new APIError("BAD_REQUEST", { message: err.message ?? COGNITO_ERROR_CODES.RESEND_CONFIRMATION_FAILED });
+			ctx.context.logger.error("cognito/resend-confirmation: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.RESEND_CONFIRMATION_FAILED });
+		}
+	});
+}
+function cognitoForgotPasswordEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/forgot-password", {
+		method: "POST",
+		body: cognitoForgotPasswordBodySchema
+	}, async (ctx) => {
+		const { email } = ctx.body;
+		try {
+			const result = await pCtx.client.send(new ForgotPasswordCommand({
+				ClientId: pCtx.clientId,
+				Username: email
+			}));
+			return ctx.json({ codeDeliveryDetails: result.CodeDeliveryDetails ?? null });
+		} catch (err) {
+			if (err instanceof UserNotFoundException) throw new APIError("NOT_FOUND", { message: COGNITO_ERROR_CODES.USER_NOT_FOUND });
+			if (err instanceof InvalidParameterException || err instanceof LimitExceededException || err instanceof NotAuthorizedException || err instanceof UserLambdaValidationException) throw new APIError("BAD_REQUEST", { message: err.message ?? COGNITO_ERROR_CODES.FORGOT_PASSWORD_FAILED });
+			ctx.context.logger.error("cognito/forgot-password: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.FORGOT_PASSWORD_FAILED });
+		}
+	});
+}
+function cognitoConfirmForgotPasswordEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/confirm-forgot-password", {
+		method: "POST",
+		body: cognitoConfirmForgotPasswordBodySchema
+	}, async (ctx) => {
+		const { email, code, newPassword } = ctx.body;
+		try {
+			await pCtx.client.send(new ConfirmForgotPasswordCommand({
+				ClientId: pCtx.clientId,
+				Username: email,
+				ConfirmationCode: code,
+				Password: newPassword
+			}));
+			return ctx.json({ reset: true });
+		} catch (err) {
+			if (err instanceof CodeMismatchException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.CONFIRMATION_CODE_MISMATCH });
+			if (err instanceof ExpiredCodeException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.CONFIRMATION_CODE_EXPIRED });
+			if (err instanceof UserNotFoundException) throw new APIError("NOT_FOUND", { message: COGNITO_ERROR_CODES.USER_NOT_FOUND });
+			if (err instanceof InvalidPasswordException || err instanceof InvalidParameterException || err instanceof LimitExceededException || err instanceof NotAuthorizedException || err instanceof UserLambdaValidationException) throw new APIError("BAD_REQUEST", { message: err.message ?? COGNITO_ERROR_CODES.FORGOT_PASSWORD_CONFIRM_FAILED });
+			ctx.context.logger.error("cognito/confirm-forgot-password: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.FORGOT_PASSWORD_CONFIRM_FAILED });
+		}
+	});
+}
+function cognitoSignInEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/sign-in", {
+		method: "POST",
+		body: cognitoSignInBodySchema
+	}, async (ctx) => {
+		const { email, password, rememberMe } = ctx.body;
+		let authResult;
+		try {
+			authResult = await pCtx.client.send(new InitiateAuthCommand({
+				AuthFlow: "USER_PASSWORD_AUTH",
+				ClientId: pCtx.clientId,
+				AuthParameters: {
+					USERNAME: email,
+					PASSWORD: password
+				}
+			}));
+		} catch (err) {
+			if (err instanceof NotAuthorizedException || err instanceof UserNotFoundException) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.INVALID_CREDENTIALS });
+			if (err instanceof UserNotConfirmedException) throw new APIError("FORBIDDEN", { message: COGNITO_ERROR_CODES.USER_NOT_CONFIRMED });
+			ctx.context.logger.error("cognito/sign-in: unexpected Cognito auth error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.AUTH_SERVICE_ERROR });
+		}
+		if (authResult.ChallengeName === "NEW_PASSWORD_REQUIRED") return ctx.json({
+			type: "NEW_PASSWORD_REQUIRED",
+			challengeSession: authResult.Session
+		});
+		const tokens = authResult.AuthenticationResult;
+		if (!tokens?.IdToken) {
+			ctx.context.logger.error("cognito/sign-in: no IdToken in Cognito response");
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.NO_TOKEN_FROM_COGNITO });
+		}
+		let claims;
+		try {
+			claims = await pCtx.verifyToken(tokens.IdToken);
+		} catch (err) {
+			ctx.context.logger.error("cognito/sign-in: token verification failed", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.TOKEN_VERIFICATION_FAILED });
+		}
+		const existing = await ctx.context.internalAdapter.findUserByEmail(email, { includeAccounts: false }).catch(() => null);
+		const user = existing ? await ctx.context.internalAdapter.updateUser(existing.user.id, {
+			name: claims.name,
+			emailVerified: true
+		}) : await ctx.context.internalAdapter.createUser({
+			email,
+			name: claims.name,
+			emailVerified: true,
+			id: claims.sub
+		});
+		await setSessionCookie(ctx, {
+			session: await ctx.context.internalAdapter.createSession(user.id, rememberMe === false),
+			user
+		}, rememberMe === false);
+		await upsertCognitoAccount(ctx, user.id, claims.sub, {
+			accessToken: tokens.AccessToken,
+			refreshToken: tokens.RefreshToken,
+			idToken: tokens.IdToken,
+			accessTokenExpiresAt: new Date(Date.now() + 3600 * 1e3)
+		});
+		return ctx.json({ ok: true });
+	});
+}
+function cognitoNewPasswordEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/new-password", {
+		method: "POST",
+		body: cognitoNewPasswordBodySchema
+	}, async (ctx) => {
+		const { email, newPassword, challengeSession, rememberMe } = ctx.body;
+		let tokens;
+		try {
+			tokens = (await pCtx.client.send(new RespondToAuthChallengeCommand({
+				ClientId: pCtx.clientId,
+				ChallengeName: "NEW_PASSWORD_REQUIRED",
+				Session: challengeSession,
+				ChallengeResponses: {
+					USERNAME: email,
+					NEW_PASSWORD: newPassword
+				}
+			}))).AuthenticationResult;
+		} catch (err) {
+			throw new APIError("BAD_REQUEST", { message: err instanceof Error ? err.message : "Failed to set new password" });
+		}
+		if (!tokens?.IdToken) {
+			ctx.context.logger.error("cognito/new-password: no IdToken in Cognito response");
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.NO_TOKEN_FROM_COGNITO });
+		}
+		let claims;
+		try {
+			claims = await pCtx.verifyToken(tokens.IdToken);
+		} catch (err) {
+			ctx.context.logger.error("cognito/new-password: token verification failed", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.TOKEN_VERIFICATION_FAILED });
+		}
+		const existing = await ctx.context.internalAdapter.findUserByEmail(email, { includeAccounts: false }).catch(() => null);
+		const user = existing ? await ctx.context.internalAdapter.updateUser(existing.user.id, {
+			name: claims.name,
+			emailVerified: true
+		}) : await ctx.context.internalAdapter.createUser({
+			email,
+			name: claims.name,
+			emailVerified: true,
+			id: claims.sub
+		});
+		await setSessionCookie(ctx, {
+			session: await ctx.context.internalAdapter.createSession(user.id, rememberMe === false),
+			user
+		}, rememberMe === false);
+		await upsertCognitoAccount(ctx, user.id, claims.sub, {
+			accessToken: tokens.AccessToken,
+			refreshToken: tokens.RefreshToken,
+			idToken: tokens.IdToken,
+			accessTokenExpiresAt: new Date(Date.now() + 3600 * 1e3)
+		});
+		return ctx.json({ ok: true });
+	});
+}
+function cognitoStartPasskeySignInEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/passkey/sign-in/start", {
+		method: "POST",
+		body: cognitoStartPasskeySignInBodySchema
+	}, async (ctx) => {
+		const { email } = ctx.body;
+		let result;
+		try {
+			result = await pCtx.client.send(new InitiateAuthCommand({
+				AuthFlow: "USER_AUTH",
+				ClientId: pCtx.clientId,
+				AuthParameters: {
+					USERNAME: email,
+					PREFERRED_CHALLENGE: "WEB_AUTHN"
+				}
+			}));
+		} catch (err) {
+			if (err instanceof UserNotFoundException || err instanceof NotAuthorizedException) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.USER_NOT_FOUND });
+			if (err instanceof WebAuthnNotEnabledException || err instanceof WebAuthnConfigurationMissingException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.PASSKEYS_NOT_ENABLED });
+			ctx.context.logger.error("cognito/passkey/sign-in/start: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.AUTH_SERVICE_ERROR });
+		}
+		if (result.ChallengeName === "SELECT_CHALLENGE") {
+			if (!(result.AvailableChallenges ?? []).includes("WEB_AUTHN")) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.NO_PASSKEYS_REGISTERED });
+			try {
+				result = await pCtx.client.send(new RespondToAuthChallengeCommand({
+					ClientId: pCtx.clientId,
+					ChallengeName: "SELECT_CHALLENGE",
+					Session: result.Session,
+					ChallengeResponses: {
+						USERNAME: email,
+						ANSWER: "WEB_AUTHN"
+					}
+				}));
+			} catch (err) {
+				ctx.context.logger.error("cognito/passkey/sign-in/start: SELECT_CHALLENGE respond failed", err);
+				throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.AUTH_SERVICE_ERROR });
+			}
+		}
+		if (result.ChallengeName !== "WEB_AUTHN") throw new APIError("BAD_REQUEST", { message: `Passkey sign-in is not available (challenge: ${result.ChallengeName ?? "none"})` });
+		const rawOptions = result.ChallengeParameters?.CREDENTIAL_REQUEST_OPTIONS ?? result.ChallengeParameters?.PASSKEY_REQUEST_OPTIONS ?? Object.values(result.ChallengeParameters ?? {}).find((v) => typeof v === "string" && v.trimStart().startsWith("{"));
+		if (!rawOptions) {
+			ctx.context.logger.error(`cognito/passkey/sign-in/start: no credential request options. Keys: ${Object.keys(result.ChallengeParameters ?? {}).join(", ")}`);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: `${COGNITO_ERROR_CODES.PASSKEY_NO_OPTIONS_RETURNED}. Keys: ${Object.keys(result.ChallengeParameters ?? {}).join(", ")}` });
+		}
+		return ctx.json({
+			session: result.Session,
+			requestOptions: JSON.parse(rawOptions)
+		});
+	});
+}
+function cognitoCompletePasskeySignInEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/passkey/sign-in/complete", {
+		method: "POST",
+		body: cognitoCompletePasskeySignInBodySchema
+	}, async (ctx) => {
+		const { email, credential, session, rememberMe } = ctx.body;
+		let result;
+		try {
+			result = await pCtx.client.send(new RespondToAuthChallengeCommand({
+				ClientId: pCtx.clientId,
+				ChallengeName: "WEB_AUTHN",
+				Session: session,
+				ChallengeResponses: {
+					USERNAME: email,
+					CREDENTIAL: JSON.stringify(credential)
+				}
+			}));
+		} catch (err) {
+			if (err instanceof NotAuthorizedException || err instanceof WebAuthnChallengeNotFoundException || err instanceof WebAuthnRelyingPartyMismatchException) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.PASSKEY_VERIFICATION_FAILED });
+			ctx.context.logger.error("cognito/passkey/sign-in/complete: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.AUTH_SERVICE_ERROR });
+		}
+		const tokens = result.AuthenticationResult;
+		if (!tokens?.IdToken) {
+			ctx.context.logger.error("cognito/passkey/sign-in/complete: no IdToken in Cognito response");
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.NO_TOKEN_FROM_COGNITO });
+		}
+		let claims;
+		try {
+			claims = await pCtx.verifyToken(tokens.IdToken);
+		} catch (err) {
+			ctx.context.logger.error("cognito/passkey/sign-in/complete: token verification failed", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.TOKEN_VERIFICATION_FAILED });
+		}
+		const existing = await ctx.context.internalAdapter.findUserByEmail(email, { includeAccounts: false }).catch(() => null);
+		const user = existing ? await ctx.context.internalAdapter.updateUser(existing.user.id, {
+			name: claims.name,
+			emailVerified: true
+		}) : await ctx.context.internalAdapter.createUser({
+			email,
+			name: claims.name,
+			emailVerified: true,
+			id: claims.sub
+		});
+		const sessionRecord = await ctx.context.internalAdapter.createSession(user.id, rememberMe === false);
+		await setSessionCookie(ctx, {
+			session: sessionRecord,
+			user
+		}, rememberMe === false);
+		await upsertCognitoAccount(ctx, user.id, claims.sub, {
+			accessToken: tokens.AccessToken,
+			refreshToken: tokens.RefreshToken,
+			idToken: tokens.IdToken,
+			accessTokenExpiresAt: new Date(Date.now() + 3600 * 1e3)
+		});
+		return ctx.json({
+			redirect: false,
+			token: sessionRecord.token,
+			user
+		});
+	});
+}
+function cognitoStartPasskeyRegistrationEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/passkey/register/start", {
+		method: "POST",
+		body: z.object({})
+	}, async (ctx) => {
+		if (!await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret)) throw new APIError("UNAUTHORIZED");
+		const activeSession = await getSessionFromCtx(ctx);
+		if (!activeSession) throw new APIError("UNAUTHORIZED");
+		const accessToken = await getCognitoAccessToken(ctx, activeSession.user.id);
+		if (!accessToken) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.NO_COGNITO_ACCESS_TOKEN });
+		let result;
+		try {
+			result = await pCtx.client.send(new StartWebAuthnRegistrationCommand({ AccessToken: accessToken }));
+		} catch (err) {
+			if (err instanceof WebAuthnNotEnabledException || err instanceof WebAuthnConfigurationMissingException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.PASSKEYS_NOT_ENABLED });
+			ctx.context.logger.error("cognito/passkey/register/start: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.PASSKEY_REGISTRATION_START_FAILED });
+		}
+		return ctx.json({ credentialCreationOptions: result.CredentialCreationOptions });
+	});
+}
+function cognitoCompletePasskeyRegistrationEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/passkey/register/complete", {
+		method: "POST",
+		body: cognitoCompletePasskeyRegistrationBodySchema
+	}, async (ctx) => {
+		const { credential } = ctx.body;
+		if (!await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret)) throw new APIError("UNAUTHORIZED");
+		const activeSession = await getSessionFromCtx(ctx);
+		if (!activeSession) throw new APIError("UNAUTHORIZED");
+		const accessToken = await getCognitoAccessToken(ctx, activeSession.user.id);
+		if (!accessToken) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.NO_COGNITO_ACCESS_TOKEN });
+		try {
+			await pCtx.client.send(new CompleteWebAuthnRegistrationCommand({
+				AccessToken: accessToken,
+				Credential: credential
+			}));
+		} catch (err) {
+			if (err instanceof WebAuthnOriginNotAllowedException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.PASSKEY_ORIGIN_NOT_ALLOWED });
+			if (err instanceof WebAuthnRelyingPartyMismatchException) throw new APIError("BAD_REQUEST", { message: COGNITO_ERROR_CODES.RELYING_PARTY_MISMATCH });
+			ctx.context.logger.error("cognito/passkey/register/complete: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.PASSKEY_REGISTRATION_FAILED });
+		}
+		return ctx.json({ ok: true });
+	});
+}
+function cognitoGetUserAttributesEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/user-attributes", { method: "GET" }, async (ctx) => {
+		const activeSession = await getSessionFromCtx(ctx);
+		if (!activeSession) throw new APIError("UNAUTHORIZED");
+		const accessToken = await getCognitoAccessToken(ctx, activeSession.user.id);
+		if (!accessToken) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.NO_COGNITO_ACCESS_TOKEN });
+		try {
+			const result = await pCtx.client.send(new GetUserCommand({ AccessToken: accessToken }));
+			return ctx.json({ attributes: result.UserAttributes ?? [] });
+		} catch (err) {
+			if (err instanceof NotAuthorizedException) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.NO_COGNITO_ACCESS_TOKEN });
+			ctx.context.logger.error("cognito/user-attributes GET: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.GET_USER_ATTRIBUTES_FAILED });
+		}
+	});
+}
+function cognitoUpdateUserAttributesEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/user-attributes", {
+		method: "POST",
+		body: cognitoUpdateUserAttributesBodySchema
+	}, async (ctx) => {
+		const activeSession = await getSessionFromCtx(ctx);
+		if (!activeSession) throw new APIError("UNAUTHORIZED");
+		const accessToken = await getCognitoAccessToken(ctx, activeSession.user.id);
+		if (!accessToken) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.NO_COGNITO_ACCESS_TOKEN });
+		try {
+			await pCtx.client.send(new UpdateUserAttributesCommand({
+				AccessToken: accessToken,
+				UserAttributes: ctx.body.attributes
+			}));
+			const nameAttr = ctx.body.attributes.find((a) => a.Name === "name");
+			if (nameAttr && isStatefulAuth(ctx)) await ctx.context.internalAdapter.updateUser(activeSession.user.id, { name: nameAttr.Value }).catch((err) => {
+				ctx.context.logger.error("cognito/user-attributes POST: failed to sync name to DB", err);
+			});
+			return ctx.json({ updated: true });
+		} catch (err) {
+			if (err instanceof NotAuthorizedException) throw new APIError("UNAUTHORIZED", { message: COGNITO_ERROR_CODES.NO_COGNITO_ACCESS_TOKEN });
+			if (err instanceof InvalidParameterException || err instanceof AliasExistsException) throw new APIError("BAD_REQUEST", { message: err.message ?? COGNITO_ERROR_CODES.UPDATE_USER_ATTRIBUTES_FAILED });
+			ctx.context.logger.error("cognito/user-attributes POST: unexpected Cognito error", err);
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: COGNITO_ERROR_CODES.UPDATE_USER_ATTRIBUTES_FAILED });
+		}
+	});
+}
+function cognitoSignOutEndpoint(pCtx) {
+	return createAuthEndpoint("/cognito/sign-out", {
+		method: "POST",
+		body: cognitoSignOutBodySchema.optional()
+	}, async (ctx) => {
+		const sessionCookieToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+		if (!sessionCookieToken) {
+			deleteSessionCookie(ctx);
+			return ctx.json({ success: true });
+		}
+		const activeSession = await getSessionFromCtx(ctx);
+		const accessToken = activeSession ? await getCognitoAccessToken(ctx, activeSession.user.id) : null;
+		if (accessToken) try {
+			await pCtx.client.send(new GlobalSignOutCommand({ AccessToken: accessToken }));
+		} catch (error) {
+			ctx.context.logger.error("Failed to sign out from Cognito", error);
+		}
+		try {
+			await ctx.context.internalAdapter.deleteSession(sessionCookieToken);
+		} catch (error) {
+			ctx.context.logger.error("Failed to delete session from database", error);
+		}
+		deleteSessionCookie(ctx);
+		clearCognitoTokenCookie(ctx);
+		return ctx.json({ success: true });
+	});
+}
+//#endregion
+//#region src/index.ts
+/**
+* Better Auth server plugin for AWS Cognito.
+*
+* Registers endpoints:
+*   GET /cognito/tokens
+*   POST /cognito/sign-up
+*   POST /cognito/confirm-sign-up
+*   POST /cognito/resend-confirmation
+*   POST /cognito/forgot-password
+*   POST /cognito/confirm-forgot-password
+*   POST /cognito/sign-in
+*   POST /cognito/new-password
+*   POST /cognito/sign-out
+*   POST /cognito/passkey/sign-in/start
+*   POST /cognito/passkey/sign-in/complete
+*   POST /cognito/passkey/register/start
+*   POST /cognito/passkey/register/complete
+*/
+const cognitoPlugin = (opts) => {
+	const client = new CognitoIdentityProviderClient({ region: opts.region });
+	const jwks = createRemoteJWKSet(new URL(`https://cognito-idp.${opts.region}.amazonaws.com/${opts.userPoolId}/.well-known/jwks.json`));
+	const issuer = `https://cognito-idp.${opts.region}.amazonaws.com/${opts.userPoolId}`;
+	const verifyToken = async (idToken) => {
+		const { payload } = await jwtVerify(idToken, jwks, {
+			issuer,
+			audience: opts.clientId
+		});
+		const profile = payload;
+		return {
+			...profile,
+			name: `${profile.given_name ?? ""} ${profile.family_name ?? ""}`.trim() || profile.name || profile.email || "",
+			"cognito:groups": payload["cognito:groups"] ?? [],
+			idToken
+		};
+	};
+	const pCtx = {
+		client,
+		clientId: opts.clientId,
+		verifyToken
+	};
+	return {
+		id: "cognito",
+		endpoints: {
+			cognitoGetTokens: cognitoGetTokensEndpoint(pCtx),
+			cognitoGetUserAttributes: cognitoGetUserAttributesEndpoint(pCtx),
+			cognitoUpdateUserAttributes: cognitoUpdateUserAttributesEndpoint(pCtx),
+			cognitoSignUp: cognitoSignUpEndpoint(pCtx),
+			cognitoConfirmSignUp: cognitoConfirmSignUpEndpoint(pCtx),
+			cognitoResendConfirmationCode: cognitoResendConfirmationCodeEndpoint(pCtx),
+			cognitoForgotPassword: cognitoForgotPasswordEndpoint(pCtx),
+			cognitoConfirmForgotPassword: cognitoConfirmForgotPasswordEndpoint(pCtx),
+			cognitoSignIn: cognitoSignInEndpoint(pCtx),
+			cognitoNewPassword: cognitoNewPasswordEndpoint(pCtx),
+			cognitoStartPasskeySignIn: cognitoStartPasskeySignInEndpoint(pCtx),
+			cognitoCompletePasskeySignIn: cognitoCompletePasskeySignInEndpoint(pCtx),
+			cognitoStartPasskeyRegistration: cognitoStartPasskeyRegistrationEndpoint(pCtx),
+			cognitoCompletePasskeyRegistration: cognitoCompletePasskeyRegistrationEndpoint(pCtx),
+			cognitoSignOut: cognitoSignOutEndpoint(pCtx)
+		},
+		$ERROR_CODES: COGNITO_ERROR_CODES,
+		options: opts
+	};
+};
+/** Globally sign out from Cognito (invalidates the refresh token). Best-effort. */
+async function cognitoGlobalSignOut(accessToken, opts) {
+	const client = new CognitoIdentityProviderClient({ region: opts.region });
+	try {
+		await client.send(new GlobalSignOutCommand({ AccessToken: accessToken }));
+	} catch {}
+}
+//#endregion
+export { COGNITO_ERROR_CODES, cognitoGlobalSignOut, cognitoPlugin, getPasskeyConfig };