better-auth-evp 0.1.0 → 1.0.1

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+## [1.0.1](https://github.com/qamarq/better-auth-evp/compare/v1.0.0...v1.0.1) (2026-08-31)
+
+
+### Bug Fixes
+
+* rely on better-auth client auto-inference instead of a custom getActions ([dc49d4e](https://github.com/qamarq/better-auth-evp/commit/dc49d4e125ace25e76d4b31cca167e5937d061b8))
+
+# 1.0.0 (2026-08-31)
+
+
+### Features
+
+* initial Email Verification Protocol plugin for Better Auth ([753fcb6](https://github.com/qamarq/better-auth-evp/commit/753fcb66bc34cc6acb9273bacbce69bb1fecdb5e))

package/dist/client.d.ts

@@ -1,59 +1,8 @@
 import type { emailVerificationProtocol } from "./index";
-import type { EvpNonceResponse, EvpVerifyResponse } from "./types";
-/**
- * `autocomplete` value for the visible email `<input>`. Required by the
- * protocol so the browser can offer verified addresses.
- */
 export declare const EVP_EMAIL_AUTOCOMPLETE = "email";
-/**
- * `autocomplete` value for the hidden token `<input>` the browser fills in
- * with the signed Email Verification Token.
- */
 export declare const EVP_TOKEN_AUTOCOMPLETE = "email-verification-token";
 export declare function emailVerificationProtocolClient(): {
     id: "email-verification-protocol";
     $InferServerPlugin: ReturnType<typeof emailVerificationProtocol>;
-    getActions: ($fetch: import("better-auth/client").BetterFetch) => {
-        evp: {
-            /**
-             * Fetches a fresh, single-use nonce. Call this once per sign-in
-             * attempt and bind the result to the hidden token input's `nonce`
-             * attribute before the user submits the form.
-             */
-            getNonce: () => Promise<{
-                data: EvpNonceResponse;
-                error: null;
-            } | {
-                data: null;
-                error: {
-                    message?: string | undefined;
-                    status: number;
-                    statusText: string;
-                };
-            }>;
-            /**
-             * Verifies the token the browser filled into the hidden input and,
-             * on success, signs the user in. Always check `data.verified`
-             * (or the presence of `error`) and fall back to a normal sign-in
-             * method when it's falsy - this is expected for the vast majority
-             * of browsers/users today.
-             */
-            verify: (data: {
-                email: string;
-                token: string;
-                nonce: string;
-            }) => Promise<{
-                data: null;
-                error: {
-                    message?: string | undefined;
-                    status: number;
-                    statusText: string;
-                };
-            } | {
-                data: EvpVerifyResponse;
-                error: null;
-            }>;
-        };
-    };
 };
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE,wBAAgB,+BAA+B;;wBAGjB,UAAU,CAAC,OAAO,yBAAyB,CAAC;;;YAGlE;;;;eAIG;;;;;;;;;;;;YAIH;;;;;;eAMG;2BACkB;gBACnB,KAAK,EAAE,MAAM,CAAC;gBACd,KAAK,EAAE,MAAM,CAAC;gBACd,KAAK,EAAE,MAAM,CAAC;aACf;;;;;;;;;;;;;EASR"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAEzD,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAC9C,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE,wBAAgB,+BAA+B;;wBAGjB,UAAU,CAAC,OAAO,yBAAyB,CAAC;EAEzE"}

package/dist/client.js

@@ -1,41 +1,8 @@
-/**
- * `autocomplete` value for the visible email `<input>`. Required by the
- * protocol so the browser can offer verified addresses.
- */
 export const EVP_EMAIL_AUTOCOMPLETE = "email";
-/**
- * `autocomplete` value for the hidden token `<input>` the browser fills in
- * with the signed Email Verification Token.
- */
 export const EVP_TOKEN_AUTOCOMPLETE = "email-verification-token";
 export function emailVerificationProtocolClient() {
     return {
         id: "email-verification-protocol",
         $InferServerPlugin: {},
-        getActions: ($fetch) => ({
-            evp: {
-                /**
-                 * Fetches a fresh, single-use nonce. Call this once per sign-in
-                 * attempt and bind the result to the hidden token input's `nonce`
-                 * attribute before the user submits the form.
-                 */
-                getNonce: async () => {
-                    return $fetch("/evp/nonce", { method: "GET" });
-                },
-                /**
-                 * Verifies the token the browser filled into the hidden input and,
-                 * on success, signs the user in. Always check `data.verified`
-                 * (or the presence of `error`) and fall back to a normal sign-in
-                 * method when it's falsy - this is expected for the vast majority
-                 * of browsers/users today.
-                 */
-                verify: async (data) => {
-                    return $fetch("/evp/verify", {
-                        method: "POST",
-                        body: data,
-                    });
-                },
-            },
-        }),
     };
 }

package/dist/index.d.ts

@@ -1,66 +1,15 @@
 import * as z from "zod";
 import type { EvpPluginOptions } from "./types";
 export * from "./types";
-/**
- * [Email Verification Protocol](https://developer.chrome.com/blog/email-verification-protocol-origin-trial)
- * plugin for Better Auth.
- *
- * EVP lets a browser that supports the (Chrome-only, origin-trial-gated)
- * protocol prove a user owns the email address they typed into a form,
- * without sending an OTP or magic link. It is entirely progressive
- * enhancement: unsupported browsers, mailbox providers that haven't
- * implemented the issuer side, or a user simply not signed into their
- * mailbox all result in an empty/unverifiable token. Callers MUST treat
- * `verified: false` (or the nonce/verify endpoints being unreachable) as a
- * normal, expected outcome and fall back to whatever sign-in method the
- * app already uses (email OTP, magic link, password, ...) - this plugin
- * does not implement a fallback itself, it only adds the EVP fast path.
- *
- * @see https://github.com/philnash/email-verification-api
- */
 export declare function emailVerificationProtocol<T extends Record<string, any> = {}>(options: EvpPluginOptions<T>): {
     id: "email-verification-protocol";
     endpoints: {
-        /**
-         * ### Endpoint
-         *
-         * GET `/evp/nonce`
-         *
-         * ### API Methods
-         *
-         * **server:** `auth.api.evpNonce`
-         *
-         * **client:** `authClient.evp.getNonce`
-         *
-         * Issues a single-use nonce to bind into the hidden
-         * `email-verification-token` input's `nonce` attribute. Call this
-         * once per sign-in attempt, right before rendering the form.
-         */
-        evpNonce: import("better-auth").StrictEndpoint<"/evp/nonce", {
+        evpGetNonce: import("better-auth").StrictEndpoint<"/evp/get-nonce", {
             method: "GET";
         }, {
             nonce: string;
             expiresIn: number;
         }>;
-        /**
-         * ### Endpoint
-         *
-         * POST `/evp/verify`
-         *
-         * ### API Methods
-         *
-         * **server:** `auth.api.evpVerify`
-         *
-         * **client:** `authClient.evp.verify`
-         *
-         * Verifies the browser-issued Email Verification Token. On success,
-         * signs the user in (creating an account first if none exists and
-         * sign-up isn't disabled) exactly like any other passwordless method
-         * and returns `{ verified: true }`. On any failure it returns
-         * `{ verified: false, reason }` instead of throwing, since a failure
-         * here is an expected, common outcome that the caller should recover
-         * from by falling back to a different sign-in method.
-         */
         evpVerify: import("better-auth").StrictEndpoint<"/evp/verify", {
             method: "POST";
             body: z.ZodObject<{

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,KAAK,EACV,gBAAgB,EAGjB,MAAM,SAAS,CAAC;AAEjB,cAAc,SAAS,CAAC;AAUxB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,EAC1E,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;;;QAcxB;;;;;;;;;;;;;;WAcG;;;;;;;QAcH;;;;;;;;;;;;;;;;;;WAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;0BA2FiB,MAAM;;;;EAQ/B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,KAAK,EACV,gBAAgB,EAGjB,MAAM,SAAS,CAAC;AAEjB,cAAc,SAAS,CAAC;AAUxB,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,EAC1E,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAqHJ,MAAM;;;;EAQ/B"}

package/dist/index.js

@@ -10,23 +10,6 @@ const evpVerifyBodySchema = z.object({
     token: z.string(),
     nonce: z.string(),
 });
-/**
- * [Email Verification Protocol](https://developer.chrome.com/blog/email-verification-protocol-origin-trial)
- * plugin for Better Auth.
- *
- * EVP lets a browser that supports the (Chrome-only, origin-trial-gated)
- * protocol prove a user owns the email address they typed into a form,
- * without sending an OTP or magic link. It is entirely progressive
- * enhancement: unsupported browsers, mailbox providers that haven't
- * implemented the issuer side, or a user simply not signed into their
- * mailbox all result in an empty/unverifiable token. Callers MUST treat
- * `verified: false` (or the nonce/verify endpoints being unreachable) as a
- * normal, expected outcome and fall back to whatever sign-in method the
- * app already uses (email OTP, magic link, password, ...) - this plugin
- * does not implement a fallback itself, it only adds the EVP fast path.
- *
- * @see https://github.com/philnash/email-verification-api
- */
 export function emailVerificationProtocol(options) {
     if (!options.origin) {
         throw new Error("emailVerificationProtocol plugin requires an `origin` option (this relying party's absolute origin)");
@@ -36,22 +19,7 @@ export function emailVerificationProtocol(options) {
     return {
         id: "email-verification-protocol",
         endpoints: {
-            /**
-             * ### Endpoint
-             *
-             * GET `/evp/nonce`
-             *
-             * ### API Methods
-             *
-             * **server:** `auth.api.evpNonce`
-             *
-             * **client:** `authClient.evp.getNonce`
-             *
-             * Issues a single-use nonce to bind into the hidden
-             * `email-verification-token` input's `nonce` attribute. Call this
-             * once per sign-in attempt, right before rendering the form.
-             */
-            evpNonce: createAuthEndpoint("/evp/nonce", { method: "GET" }, async (ctx) => {
+            evpGetNonce: createAuthEndpoint("/evp/get-nonce", { method: "GET" }, async (ctx) => {
                 const nonce = generateRandomString(24, "a-z", "A-Z", "0-9");
                 await ctx.context.internalAdapter.createVerificationValue({
                     identifier: `${NONCE_IDENTIFIER_PREFIX}${nonce}`,
@@ -60,25 +28,6 @@ export function emailVerificationProtocol(options) {
                 });
                 return ctx.json({ nonce, expiresIn: nonceExpiresIn });
             }),
-            /**
-             * ### Endpoint
-             *
-             * POST `/evp/verify`
-             *
-             * ### API Methods
-             *
-             * **server:** `auth.api.evpVerify`
-             *
-             * **client:** `authClient.evp.verify`
-             *
-             * Verifies the browser-issued Email Verification Token. On success,
-             * signs the user in (creating an account first if none exists and
-             * sign-up isn't disabled) exactly like any other passwordless method
-             * and returns `{ verified: true }`. On any failure it returns
-             * `{ verified: false, reason }` instead of throwing, since a failure
-             * here is an expected, common outcome that the caller should recover
-             * from by falling back to a different sign-in method.
-             */
             evpVerify: createAuthEndpoint("/evp/verify", { method: "POST", body: evpVerifyBodySchema }, async (ctx) => {
                 const email = ctx.body.email.trim().toLowerCase();
                 const { token, nonce } = ctx.body;

package/dist/types.d.ts

@@ -1,21 +1,13 @@
 export interface EvpVerifiedEmail {
-    /** The mailbox address the issuer vouched for. */
     email: string;
-    /** The issuer that signed the Email Verification Token. */
     issuer: string;
-    /** The relying-party origin the token was bound to. */
     audience: string;
-    /** Timestamps reported by the verification library, if any. */
     issuedAt?: unknown;
-    /** Any additional claims the issuer included in the token. */
     claims?: Record<string, unknown>;
 }
 export interface EvpVerificationError {
-    /** Which stage of verification failed (DNS lookup, signature check, ...). */
     stage?: string;
-    /** Machine-readable error code. */
     code: string;
-    /** Human-readable message, safe to log. */
     message: string;
     cause?: unknown;
 }
@@ -27,48 +19,19 @@ export type EvpVerificationResult = {
     error: EvpVerificationError;
 };
 export interface EvpVerifyParams {
-    /** The SD-JWT+KB presentation the browser put in the hidden form field. */
     token: string;
-    /** The nonce this relying party issued for the current attempt. */
     nonce: string;
-    /** The email address the user typed into the form. */
     email: string;
-    /** This relying party's absolute HTTP(S) origin. */
     audience: string;
 }
 export interface EvpPluginOptions<T extends Record<string, any> = {}> {
-    /**
-     * This relying party's absolute origin, e.g. `https://example.com`. Sent
-     * to the verifier as the `audience` and must match the origin the Chrome
-     * origin-trial token (and the DNS/issuer records) were issued for.
-     */
     origin: string;
-    /**
-     * How long an issued nonce stays valid for, in seconds.
-     * @default 120
-     */
     nonceExpiresIn?: number;
-    /**
-     * When true, a verified email that has no existing account is rejected
-     * instead of provisioning a new user.
-     * @default false
-     */
     disableSignUp?: boolean;
-    /**
-     * Additional fields to set on a newly created user.
-     */
     userFields?: (verified: EvpVerifiedEmail) => T;
-    /**
-     * Called after a session has been created for a successfully verified
-     * email. Useful for analytics/logging.
-     */
     onVerified?: (verified: EvpVerifiedEmail & {
         userId: string;
     }) => void | Promise<void>;
-    /**
-     * Overrides the verification call - mainly useful for tests. Defaults to
-     * `verifyEmailToken` from the `email-verification-api` package.
-     */
     verify?: (params: EvpVerifyParams) => Promise<EvpVerificationResult>;
 }
 export interface EvpNonceResponse {
@@ -77,12 +40,6 @@ export interface EvpNonceResponse {
 }
 export interface EvpVerifyResponse {
     verified: boolean;
-    /**
-     * Present when `verified` is false. Callers should treat any failure as
-     * a signal to fall back to a normal sign-in method (OTP, magic link,
-     * password, ...) - this is an experimental, Chrome-only capability and
-     * is expected to fail for most users.
-     */
     reason?: string;
     token?: string;
     user?: Record<string, unknown>;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE;IAClE;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;OAEG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,CAAC,CAAC;IAE/C;;;OAGG;IACH,UAAU,CAAC,EAAE,CACX,QAAQ,EAAE,gBAAgB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KAC5C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B;;;OAGG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,CACX,QAAQ,EAAE,gBAAgB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KAC5C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth-evp",
-  "version": "0.1.0",
+  "version": "1.0.1",
   "description": "Email Verification Protocol (Chrome origin trial) plugin for Better Auth, with automatic fallback to any other sign-in method",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",