chore: import upstream snapshot with attribution

packages/auth/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@sim/auth",
+  "version": "0.1.0",
+  "private": true,
+  "sideEffects": false,
+  "type": "module",
+  "license": "Apache-2.0",
+  "engines": {
+    "bun": ">=1.2.13",
+    "node": ">=20.0.0"
+  },
+  "exports": {
+    "./verify": {
+      "types": "./src/verify.ts",
+      "default": "./src/verify.ts"
+    }
+  },
+  "scripts": {
+    "type-check": "tsc --noEmit",
+    "lint": "biome check --write --unsafe .",
+    "lint:check": "biome check .",
+    "format": "biome format --write .",
+    "format:check": "biome format ."
+  },
+  "dependencies": {
+    "@sim/db": "workspace:*",
+    "better-auth": "1.6.13"
+  },
+  "devDependencies": {
+    "@sim/tsconfig": "workspace:*",
+    "@types/node": "24.2.1",
+    "typescript": "^7.0.2"
+  }
+}

packages/auth/src/verify.ts

@@ -0,0 +1,36 @@
+import { db } from '@sim/db'
+import * as schema from '@sim/db/schema'
+import { betterAuth } from 'better-auth'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { oneTimeToken } from 'better-auth/plugins'
+
+export interface VerifyAuthOptions {
+  /** Better Auth shared secret. Must match the apps/sim Better Auth secret. */
+  secret: string
+  /** Public-facing Better Auth URL (usually same as NEXT_PUBLIC_APP_URL). */
+  baseURL: string
+}
+
+/**
+ * Minimal Better Auth instance used by services that only need to verify
+ * one-time tokens issued by the main app. Shares the Better Auth DB schema
+ * (`verification` table) and secret with the main app, so tokens issued by
+ * `apps/sim`'s full auth config are accepted here.
+ */
+export function createVerifyAuth(options: VerifyAuthOptions) {
+  return betterAuth({
+    baseURL: options.baseURL,
+    secret: options.secret,
+    database: drizzleAdapter(db, {
+      provider: 'pg',
+      schema,
+    }),
+    plugins: [
+      oneTimeToken({
+        expiresIn: 24 * 60,
+      }),
+    ],
+  })
+}
+
+export type VerifyAuth = ReturnType<typeof createVerifyAuth>

packages/auth/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "@sim/tsconfig/library.json",
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}