better-auth-evp 0.1.0

package/.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  lint-and-build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v3
+        with:
+          version: 9
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check code formatting
+        run: pnpm format:check
+
+      - name: Run ESLint
+        run: pnpm lint:style
+
+      - name: Type check
+        run: pnpm lint:typecheck
+
+      - name: Build
+        run: pnpm build
+
+      - name: Check build output
+        run: |
+          if [ ! -d "dist" ]; then
+            echo "Build output directory not found"
+            exit 1
+          fi
+          if [ ! -f "dist/index.js" ]; then
+            echo "index.js not found in build output"
+            exit 1
+          fi
+          if [ ! -f "dist/index.d.ts" ]; then
+            echo "index.d.ts not found in build output"
+            exit 1
+          fi
+          echo "Build output verified successfully"

package/.github/workflows/publish.yml

@@ -0,0 +1,46 @@
+name: Semantic Release
+
+on:
+  push:
+    branches:
+      - main
+      - master
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "lts/*"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: latest
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npx semantic-release

package/.prettierignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+*.log
+.env
+coverage
+pnpm-lock.yaml

package/.prettierrc

@@ -0,0 +1,10 @@
+{
+  "semi": true,
+  "trailingComma": "all",
+  "singleQuote": false,
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "arrowParens": "always",
+  "endOfLine": "lf"
+}

package/.releaserc.json

@@ -0,0 +1,27 @@
+{
+  "branches": ["main", "master"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/changelog",
+    "@semantic-release/npm",
+    [
+      "@semantic-release/github",
+      {
+        "assets": [
+          {
+            "path": "dist/**/*",
+            "label": "Distribution files"
+          }
+        ]
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["package.json", "CHANGELOG.md"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ]
+  ]
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kamil Marczak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,140 @@
+# better-auth-evp
+
+[![npm version](https://badge.fury.io/js/better-auth-evp.svg)](https://www.npmjs.com/package/better-auth-evp)
+[![Better Auth](https://img.shields.io/badge/Better%20Auth-Plugin-blue)](https://www.better-auth.com)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![TypeScript](https://img.shields.io/badge/TypeScript-Ready-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
+
+[Email Verification Protocol (EVP)](https://developer.chrome.com/blog/email-verification-protocol-origin-trial) plugin for [Better Auth](https://www.better-auth.com), with automatic fallback to whatever other sign-in method you already have.
+
+## What is EVP?
+
+EVP is an experimental, **Chrome-only** browser capability (currently gated behind an [origin trial](https://developer.chrome.com/origintrials)) that lets a user prove they own an email address without typing an OTP or clicking a magic link. The browser talks to the user's mailbox provider directly and, if the user is signed in there, hands your form a signed token proving ownership - all triggered by the normal act of filling in and submitting an email field.
+
+Because this depends on: the user running an origin-trial build of Chrome, their mailbox provider having implemented the issuer side of the protocol, and the user being signed into that mailbox in the browser - **it will not work for most users today**. This plugin is pure progressive enhancement: wire it up, try it first, and fall back to your existing sign-in method (OTP, magic link, password, ...) whenever it doesn't pan out.
+
+## Installation
+
+```bash
+npm install better-auth-evp email-verification-api
+```
+
+### Peer Dependencies
+
+- `better-auth` ^1.5.0
+- `email-verification-api` ^0.1.0 (does the actual SD-JWT/DNS/issuer verification)
+- `zod` ^3.0.0 || ^4.0.0
+
+## Server Setup
+
+```ts
+import { betterAuth } from "better-auth";
+import { emailVerificationProtocol } from "better-auth-evp";
+
+export const auth = betterAuth({
+  // ...
+  plugins: [
+    emailVerificationProtocol({
+      // Must match the origin your Chrome origin-trial token, DNS
+      // `_email-verification` record, etc. were issued for.
+      origin: "https://example.com",
+      disableSignUp: false,
+      userFields: (verified) => ({
+        // any additional fields for a newly created user
+      }),
+    }),
+    // Keep your existing sign-in plugin(s) around for the fallback path,
+    // e.g. emailOTP(), magicLink(), ...
+  ],
+});
+```
+
+## Client Setup
+
+```ts
+import { createAuthClient } from "better-auth/react";
+import { emailVerificationProtocolClient } from "better-auth-evp/client";
+
+export const authClient = createAuthClient({
+  plugins: [emailVerificationProtocolClient()],
+});
+```
+
+## Origin Trial Token
+
+As a participating site you must register for the origin trial and serve the token on any page that renders the email form, either as a meta tag:
+
+```html
+<meta http-equiv="origin-trial" content="YOUR_TOKEN" />
+```
+
+or as an HTTP response header:
+
+```
+Origin-Trial: YOUR_TOKEN
+```
+
+This plugin does not manage that token for you - it's static per-origin configuration, not something to fetch from an API.
+
+## Form Markup
+
+```html
+<input name="email" type="email" autocomplete="email" />
+<input type="hidden" name="token" nonce="{nonce}" autocomplete="email-verification-token" />
+```
+
+`{nonce}` comes from `authClient.evp.getNonce()` and must be re-fetched for every attempt.
+
+## Usage Example (progressive enhancement)
+
+```ts
+import { emailVerificationProtocolClient } from "better-auth-evp/client";
+
+async function handleEmailSubmit(email: string, form: HTMLFormElement) {
+  const tokenInput = form.elements.namedItem("token") as HTMLInputElement;
+
+  if (tokenInput.value) {
+    const { nonce } = await authClient.evp.getNonce();
+    const result = await authClient.evp.verify({
+      email,
+      token: tokenInput.value,
+      nonce,
+    });
+
+    if (result.data?.verified) {
+      // User is signed in already - redirect and stop here.
+      return;
+    }
+  }
+
+  // EVP unsupported/unavailable/failed - fall back to your normal flow.
+  await authClient.emailOtp.sendVerificationOtp({ email, type: "sign-in" });
+}
+```
+
+## API
+
+### Server (`auth.api`)
+
+- `evpNonce()` - `GET /evp/nonce` - issues a single-use nonce, valid for `nonceExpiresIn` seconds (default 120).
+- `evpVerify({ email, token, nonce })` - `POST /evp/verify` - verifies the token and, on success, creates a session (and a user, unless `disableSignUp` is set). Returns `{ verified: false, reason }` instead of throwing on any expected failure (invalid/expired nonce, verification failure, email mismatch, sign-up disabled).
+
+### Client (`authClient.evp`)
+
+- `getNonce()`
+- `verify({ email, token, nonce })`
+
+### Options
+
+| Option           | Type                                             | Default    | Description                                             |
+| ---------------- | ------------------------------------------------ | ---------- | --------------------------------------------------------- |
+| `origin`          | `string`                                         | (required) | This relying party's absolute origin, used as `audience`. |
+| `nonceExpiresIn`  | `number`                                         | `120`      | Seconds a nonce stays valid.                               |
+| `disableSignUp`   | `boolean`                                        | `false`    | Reject verified emails with no existing account.           |
+| `userFields`      | `(verified) => T`                                | -          | Extra fields for a newly created user.                     |
+| `onVerified`      | `(verified & { userId }) => void \| Promise<void>` | -        | Side-effect hook after a session is created.                |
+| `verify`          | custom verification function                    | `verifyEmailToken` from `email-verification-api` | Override for testing. |
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,59 @@
+import type { emailVerificationProtocol } from "./index";
+import type { EvpNonceResponse, EvpVerifyResponse } from "./types";
+/**
+ * `autocomplete` value for the visible email `<input>`. Required by the
+ * protocol so the browser can offer verified addresses.
+ */
+export declare const EVP_EMAIL_AUTOCOMPLETE = "email";
+/**
+ * `autocomplete` value for the hidden token `<input>` the browser fills in
+ * with the signed Email Verification Token.
+ */
+export declare const EVP_TOKEN_AUTOCOMPLETE = "email-verification-token";
+export declare function emailVerificationProtocolClient(): {
+    id: "email-verification-protocol";
+    $InferServerPlugin: ReturnType<typeof emailVerificationProtocol>;
+    getActions: ($fetch: import("better-auth/client").BetterFetch) => {
+        evp: {
+            /**
+             * Fetches a fresh, single-use nonce. Call this once per sign-in
+             * attempt and bind the result to the hidden token input's `nonce`
+             * attribute before the user submits the form.
+             */
+            getNonce: () => Promise<{
+                data: EvpNonceResponse;
+                error: null;
+            } | {
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            }>;
+            /**
+             * Verifies the token the browser filled into the hidden input and,
+             * on success, signs the user in. Always check `data.verified`
+             * (or the presence of `error`) and fall back to a normal sign-in
+             * method when it's falsy - this is expected for the vast majority
+             * of browsers/users today.
+             */
+            verify: (data: {
+                email: string;
+                token: string;
+                nonce: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: EvpVerifyResponse;
+                error: null;
+            }>;
+        };
+    };
+};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE,wBAAgB,+BAA+B;;wBAGjB,UAAU,CAAC,OAAO,yBAAyB,CAAC;;;YAGlE;;;;eAIG;;;;;;;;;;;;YAIH;;;;;;eAMG;2BACkB;gBACnB,KAAK,EAAE,MAAM,CAAC;gBACd,KAAK,EAAE,MAAM,CAAC;gBACd,KAAK,EAAE,MAAM,CAAC;aACf;;;;;;;;;;;;;EASR"}

package/dist/client.js

@@ -0,0 +1,41 @@
+/**
+ * `autocomplete` value for the visible email `<input>`. Required by the
+ * protocol so the browser can offer verified addresses.
+ */
+export const EVP_EMAIL_AUTOCOMPLETE = "email";
+/**
+ * `autocomplete` value for the hidden token `<input>` the browser fills in
+ * with the signed Email Verification Token.
+ */
+export const EVP_TOKEN_AUTOCOMPLETE = "email-verification-token";
+export function emailVerificationProtocolClient() {
+    return {
+        id: "email-verification-protocol",
+        $InferServerPlugin: {},
+        getActions: ($fetch) => ({
+            evp: {
+                /**
+                 * Fetches a fresh, single-use nonce. Call this once per sign-in
+                 * attempt and bind the result to the hidden token input's `nonce`
+                 * attribute before the user submits the form.
+                 */
+                getNonce: async () => {
+                    return $fetch("/evp/nonce", { method: "GET" });
+                },
+                /**
+                 * Verifies the token the browser filled into the hidden input and,
+                 * on success, signs the user in. Always check `data.verified`
+                 * (or the presence of `error`) and fall back to a normal sign-in
+                 * method when it's falsy - this is expected for the vast majority
+                 * of browsers/users today.
+                 */
+                verify: async (data) => {
+                    return $fetch("/evp/verify", {
+                        method: "POST",
+                        body: data,
+                    });
+                },
+            },
+        }),
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,94 @@
+import * as z from "zod";
+import type { EvpPluginOptions } from "./types";
+export * from "./types";
+/**
+ * [Email Verification Protocol](https://developer.chrome.com/blog/email-verification-protocol-origin-trial)
+ * plugin for Better Auth.
+ *
+ * EVP lets a browser that supports the (Chrome-only, origin-trial-gated)
+ * protocol prove a user owns the email address they typed into a form,
+ * without sending an OTP or magic link. It is entirely progressive
+ * enhancement: unsupported browsers, mailbox providers that haven't
+ * implemented the issuer side, or a user simply not signed into their
+ * mailbox all result in an empty/unverifiable token. Callers MUST treat
+ * `verified: false` (or the nonce/verify endpoints being unreachable) as a
+ * normal, expected outcome and fall back to whatever sign-in method the
+ * app already uses (email OTP, magic link, password, ...) - this plugin
+ * does not implement a fallback itself, it only adds the EVP fast path.
+ *
+ * @see https://github.com/philnash/email-verification-api
+ */
+export declare function emailVerificationProtocol<T extends Record<string, any> = {}>(options: EvpPluginOptions<T>): {
+    id: "email-verification-protocol";
+    endpoints: {
+        /**
+         * ### Endpoint
+         *
+         * GET `/evp/nonce`
+         *
+         * ### API Methods
+         *
+         * **server:** `auth.api.evpNonce`
+         *
+         * **client:** `authClient.evp.getNonce`
+         *
+         * Issues a single-use nonce to bind into the hidden
+         * `email-verification-token` input's `nonce` attribute. Call this
+         * once per sign-in attempt, right before rendering the form.
+         */
+        evpNonce: import("better-auth").StrictEndpoint<"/evp/nonce", {
+            method: "GET";
+        }, {
+            nonce: string;
+            expiresIn: number;
+        }>;
+        /**
+         * ### Endpoint
+         *
+         * POST `/evp/verify`
+         *
+         * ### API Methods
+         *
+         * **server:** `auth.api.evpVerify`
+         *
+         * **client:** `authClient.evp.verify`
+         *
+         * Verifies the browser-issued Email Verification Token. On success,
+         * signs the user in (creating an account first if none exists and
+         * sign-up isn't disabled) exactly like any other passwordless method
+         * and returns `{ verified: true }`. On any failure it returns
+         * `{ verified: false, reason }` instead of throwing, since a failure
+         * here is an expected, common outcome that the caller should recover
+         * from by falling back to a different sign-in method.
+         */
+        evpVerify: import("better-auth").StrictEndpoint<"/evp/verify", {
+            method: "POST";
+            body: z.ZodObject<{
+                email: z.ZodString;
+                token: z.ZodString;
+                nonce: z.ZodString;
+            }, z.core.$strip>;
+        }, {
+            verified: boolean;
+            reason: string;
+        } | {
+            verified: boolean;
+            token: string;
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            };
+        }>;
+    };
+    rateLimit: {
+        pathMatcher(path: string): boolean;
+        window: number;
+        max: number;
+    }[];
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,KAAK,EACV,gBAAgB,EAGjB,MAAM,SAAS,CAAC;AAEjB,cAAc,SAAS,CAAC;AAUxB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,EAC1E,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;;;QAcxB;;;;;;;;;;;;;;WAcG;;;;;;;QAcH;;;;;;;;;;;;;;;;;;WAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;0BA2FiB,MAAM;;;;EAQ/B"}

package/dist/index.js

@@ -0,0 +1,156 @@
+import { APIError, createAuthEndpoint } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+import { generateRandomString } from "better-auth/crypto";
+import { verifyEmailToken } from "email-verification-api";
+import * as z from "zod";
+export * from "./types";
+const NONCE_IDENTIFIER_PREFIX = "evp-nonce:";
+const evpVerifyBodySchema = z.object({
+    email: z.string(),
+    token: z.string(),
+    nonce: z.string(),
+});
+/**
+ * [Email Verification Protocol](https://developer.chrome.com/blog/email-verification-protocol-origin-trial)
+ * plugin for Better Auth.
+ *
+ * EVP lets a browser that supports the (Chrome-only, origin-trial-gated)
+ * protocol prove a user owns the email address they typed into a form,
+ * without sending an OTP or magic link. It is entirely progressive
+ * enhancement: unsupported browsers, mailbox providers that haven't
+ * implemented the issuer side, or a user simply not signed into their
+ * mailbox all result in an empty/unverifiable token. Callers MUST treat
+ * `verified: false` (or the nonce/verify endpoints being unreachable) as a
+ * normal, expected outcome and fall back to whatever sign-in method the
+ * app already uses (email OTP, magic link, password, ...) - this plugin
+ * does not implement a fallback itself, it only adds the EVP fast path.
+ *
+ * @see https://github.com/philnash/email-verification-api
+ */
+export function emailVerificationProtocol(options) {
+    if (!options.origin) {
+        throw new Error("emailVerificationProtocol plugin requires an `origin` option (this relying party's absolute origin)");
+    }
+    const nonceExpiresIn = options.nonceExpiresIn ?? 120;
+    const verify = options.verify ?? verifyEmailToken;
+    return {
+        id: "email-verification-protocol",
+        endpoints: {
+            /**
+             * ### Endpoint
+             *
+             * GET `/evp/nonce`
+             *
+             * ### API Methods
+             *
+             * **server:** `auth.api.evpNonce`
+             *
+             * **client:** `authClient.evp.getNonce`
+             *
+             * Issues a single-use nonce to bind into the hidden
+             * `email-verification-token` input's `nonce` attribute. Call this
+             * once per sign-in attempt, right before rendering the form.
+             */
+            evpNonce: createAuthEndpoint("/evp/nonce", { method: "GET" }, async (ctx) => {
+                const nonce = generateRandomString(24, "a-z", "A-Z", "0-9");
+                await ctx.context.internalAdapter.createVerificationValue({
+                    identifier: `${NONCE_IDENTIFIER_PREFIX}${nonce}`,
+                    value: "pending",
+                    expiresAt: new Date(Date.now() + nonceExpiresIn * 1000),
+                });
+                return ctx.json({ nonce, expiresIn: nonceExpiresIn });
+            }),
+            /**
+             * ### Endpoint
+             *
+             * POST `/evp/verify`
+             *
+             * ### API Methods
+             *
+             * **server:** `auth.api.evpVerify`
+             *
+             * **client:** `authClient.evp.verify`
+             *
+             * Verifies the browser-issued Email Verification Token. On success,
+             * signs the user in (creating an account first if none exists and
+             * sign-up isn't disabled) exactly like any other passwordless method
+             * and returns `{ verified: true }`. On any failure it returns
+             * `{ verified: false, reason }` instead of throwing, since a failure
+             * here is an expected, common outcome that the caller should recover
+             * from by falling back to a different sign-in method.
+             */
+            evpVerify: createAuthEndpoint("/evp/verify", { method: "POST", body: evpVerifyBodySchema }, async (ctx) => {
+                const email = ctx.body.email.trim().toLowerCase();
+                const { token, nonce } = ctx.body;
+                if (!z.email().safeParse(email).success) {
+                    throw new APIError("BAD_REQUEST", { message: "Invalid email" });
+                }
+                const nonceRecord = await ctx.context.internalAdapter.consumeVerificationValue(`${NONCE_IDENTIFIER_PREFIX}${nonce}`);
+                if (!nonceRecord) {
+                    return ctx.json({ verified: false, reason: "nonce_invalid" });
+                }
+                let result;
+                try {
+                    result = await verify({
+                        token,
+                        nonce,
+                        email,
+                        audience: options.origin,
+                    });
+                }
+                catch (error) {
+                    ctx.context.logger.error("[email-verification-protocol] verification threw", error);
+                    return ctx.json({ verified: false, reason: "verification_error" });
+                }
+                if (!result.ok) {
+                    return ctx.json({
+                        verified: false,
+                        reason: result.error.code,
+                    });
+                }
+                const verified = result.value;
+                if (verified.email.trim().toLowerCase() !== email) {
+                    return ctx.json({ verified: false, reason: "email_mismatch" });
+                }
+                const existing = await ctx.context.internalAdapter.findUserByEmail(email);
+                let user;
+                if (!existing) {
+                    if (options.disableSignUp) {
+                        return ctx.json({ verified: false, reason: "sign_up_disabled" });
+                    }
+                    const additionalFields = options.userFields
+                        ? options.userFields(verified)
+                        : {};
+                    user = await ctx.context.internalAdapter.createUser({ ...additionalFields, email, emailVerified: true, name: "" }, { method: "email-verification-protocol" });
+                }
+                else {
+                    user = existing.user;
+                    if (!user.emailVerified) {
+                        user = await ctx.context.internalAdapter.updateUser(user.id, {
+                            emailVerified: true,
+                        });
+                    }
+                }
+                const session = await ctx.context.internalAdapter.createSession(user.id);
+                await setSessionCookie(ctx, { session, user });
+                if (options.onVerified) {
+                    await options.onVerified({ ...verified, userId: user.id });
+                }
+                return ctx.json({
+                    verified: true,
+                    token: session.token,
+                    user,
+                });
+            }),
+        },
+        rateLimit: [
+            {
+                pathMatcher(path) {
+                    return path.startsWith("/evp/");
+                },
+                window: 60,
+                max: 20,
+            },
+        ],
+    };
+}

package/dist/types.d.ts

@@ -0,0 +1,90 @@
+export interface EvpVerifiedEmail {
+    /** The mailbox address the issuer vouched for. */
+    email: string;
+    /** The issuer that signed the Email Verification Token. */
+    issuer: string;
+    /** The relying-party origin the token was bound to. */
+    audience: string;
+    /** Timestamps reported by the verification library, if any. */
+    issuedAt?: unknown;
+    /** Any additional claims the issuer included in the token. */
+    claims?: Record<string, unknown>;
+}
+export interface EvpVerificationError {
+    /** Which stage of verification failed (DNS lookup, signature check, ...). */
+    stage?: string;
+    /** Machine-readable error code. */
+    code: string;
+    /** Human-readable message, safe to log. */
+    message: string;
+    cause?: unknown;
+}
+export type EvpVerificationResult = {
+    ok: true;
+    value: EvpVerifiedEmail;
+} | {
+    ok: false;
+    error: EvpVerificationError;
+};
+export interface EvpVerifyParams {
+    /** The SD-JWT+KB presentation the browser put in the hidden form field. */
+    token: string;
+    /** The nonce this relying party issued for the current attempt. */
+    nonce: string;
+    /** The email address the user typed into the form. */
+    email: string;
+    /** This relying party's absolute HTTP(S) origin. */
+    audience: string;
+}
+export interface EvpPluginOptions<T extends Record<string, any> = {}> {
+    /**
+     * This relying party's absolute origin, e.g. `https://example.com`. Sent
+     * to the verifier as the `audience` and must match the origin the Chrome
+     * origin-trial token (and the DNS/issuer records) were issued for.
+     */
+    origin: string;
+    /**
+     * How long an issued nonce stays valid for, in seconds.
+     * @default 120
+     */
+    nonceExpiresIn?: number;
+    /**
+     * When true, a verified email that has no existing account is rejected
+     * instead of provisioning a new user.
+     * @default false
+     */
+    disableSignUp?: boolean;
+    /**
+     * Additional fields to set on a newly created user.
+     */
+    userFields?: (verified: EvpVerifiedEmail) => T;
+    /**
+     * Called after a session has been created for a successfully verified
+     * email. Useful for analytics/logging.
+     */
+    onVerified?: (verified: EvpVerifiedEmail & {
+        userId: string;
+    }) => void | Promise<void>;
+    /**
+     * Overrides the verification call - mainly useful for tests. Defaults to
+     * `verifyEmailToken` from the `email-verification-api` package.
+     */
+    verify?: (params: EvpVerifyParams) => Promise<EvpVerificationResult>;
+}
+export interface EvpNonceResponse {
+    nonce: string;
+    expiresIn: number;
+}
+export interface EvpVerifyResponse {
+    verified: boolean;
+    /**
+     * Present when `verified` is false. Callers should treat any failure as
+     * a signal to fall back to a normal sign-in method (OTP, magic link,
+     * password, ...) - this is an experimental, Chrome-only capability and
+     * is expected to fail for most users.
+     */
+    reason?: string;
+    token?: string;
+    user?: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE;IAClE;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;OAEG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,CAAC,CAAC;IAE/C;;;OAGG;IACH,UAAU,CAAC,EAAE,CACX,QAAQ,EAAE,gBAAgB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KAC5C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B;;;OAGG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/eslint.config.mjs

@@ -0,0 +1,42 @@
+import js from "@eslint/js";
+import tseslint from "@typescript-eslint/eslint-plugin";
+import tsparser from "@typescript-eslint/parser";
+import prettier from "eslint-plugin-prettier";
+import prettierConfig from "eslint-config-prettier";
+
+export default [
+  {
+    ignores: ["dist/**", "node_modules/**", "*.js"],
+  },
+  js.configs.recommended,
+  {
+    files: ["src/**/*.ts"],
+    languageOptions: {
+      parser: tsparser,
+      parserOptions: {
+        ecmaVersion: 2021,
+        sourceType: "module",
+        project: "./tsconfig.json",
+      },
+      globals: {
+        console: "readonly",
+        process: "readonly",
+        fetch: "readonly",
+        URLSearchParams: "readonly",
+        window: "readonly",
+      },
+    },
+    plugins: {
+      "@typescript-eslint": tseslint,
+      prettier: prettier,
+    },
+    rules: {
+      ...tseslint.configs.recommended.rules,
+      ...prettierConfig.rules,
+      "prettier/prettier": "error",
+      "@typescript-eslint/no-explicit-any": "off",
+      "@typescript-eslint/explicit-module-boundary-types": "off",
+      "@typescript-eslint/no-empty-object-type": "off",
+    },
+  },
+];

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "better-auth-evp",
+  "version": "0.1.0",
+  "description": "Email Verification Protocol (Chrome origin trial) plugin for Better Auth, with automatic fallback to any other sign-in method",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "pnpm build",
+    "lint": "pnpm lint:style && pnpm lint:typecheck",
+    "lint:style": "eslint src --ext .ts",
+    "lint:typecheck": "tsc --noEmit",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "format:check": "prettier --check \"src/**/*.ts\""
+  },
+  "peerDependencies": {
+    "better-auth": "^1.5.0",
+    "email-verification-api": "^0.1.0",
+    "zod": "^3.0.0 || ^4.0.0"
+  },
+  "dependencies": {
+    "email-verification-api": "^0.1.0"
+  },
+  "keywords": [
+    "better-auth",
+    "better-auth-plugin",
+    "email-verification-protocol",
+    "email-verification",
+    "chrome",
+    "origin-trial",
+    "authentication",
+    "passwordless"
+  ],
+  "author": "Kamil Marczak",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/qamarq/better-auth-evp"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^11.0.1",
+    "@semantic-release/npm": "^12.0.1",
+    "@types/node": "^25.3.5",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/parser": "^8.56.1",
+    "eslint": "^10.0.3",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.5",
+    "prettier": "^3.8.1",
+    "semantic-release": "^24.2.0",
+    "typescript": "^5.9.3",
+    "zod": "^4.3.6"
+  }
+}