pnpm add @railman/auth-elevate @railman/auth-login-factor
# optional TOTP storage:
# better-auth twoFactor plugin
# optional passkey step-up:
# @better-auth/passkey @railman/auth-zero-access-passkey

import { betterAuth } from "better-auth";
import { twoFactor } from "better-auth/plugins";
import { elevate, requireElevate } from "@railman/auth-elevate";
import { loginFactors } from "@railman/auth-login-factor";

export const auth = betterAuth({
  plugins: [
    loginFactors(),
    twoFactor(),
    elevate({
      deploymentMode: "single-instance",
      // omit passkeyCounterGuard → passkey step-up off
      passwordOnlyIfNoStronger: true,
      elevatedTtlSec: 300,
    }),
  ],
});

await requireElevate(session.session.elevateClaim, {
  userId: session.user.id,
  sessionToken: session.session.token ?? session.session.id,
  secret: process.env.BETTER_AUTH_SECRET!,
  ttlSec: 300,
});

import { passkey } from "@better-auth/passkey";
import { enhancePasskey } from "@railman/auth-zero-access-passkey";

const passkeyStack = enhancePasskey(passkey, {
  rpID: "example.com",
  origin: ["https://example.com"],
  assertCredentialAccess: "session",
});

elevate({
  deploymentMode: "single-instance",
  passkeyCounterGuard: passkeyStack.controller,
  passwordOnlyIfNoStronger: true,
  elevatedTtlSec: 300,
});

import { elevateClient } from "@railman/auth-elevate/client";

createAuthClient({ plugins: [elevateClient()] });