@eusend_dev/better-auth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Eusend
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,191 @@
+# @eusend_dev/better-auth
+
+[Better Auth](https://better-auth.com) plugin for [eusend](https://eusend.dev), the
+EU-native transactional email API.
+
+- **Auth email:** verification, password reset and the "your password was changed" notice
+  are set up by one plugin block, with clean default templates you can brand or replace. Senders for
+  email OTP, magic links and organization invitations are one line each.
+- **Contact sync (optional):** users are added to an eusend audience once they have verified
+  their email address, and never before.
+
+Every message is sent and stored on infrastructure in the EU.
+
+## Install
+
+```bash
+npm install @eusend_dev/better-auth
+```
+
+Add your domain under [Domains](https://eusend.dev/domains), create an API key under
+[API keys](https://eusend.dev/api-keys), and set it as `EUSEND_API_KEY`.
+
+## Quick start
+
+```ts
+// auth.ts
+import { betterAuth } from 'better-auth'
+import { eusend } from '@eusend_dev/better-auth'
+
+export const auth = betterAuth({
+  emailAndPassword: { enabled: true, requireEmailVerification: true },
+  emailVerification: { sendOnSignUp: true },
+  plugins: [
+    eusend({
+      email: {
+        from: 'Acme <auth@acme.com>',
+        appName: 'Acme',
+        brand: {
+          logoUrl: 'https://acme.com/logo.png',
+          primaryColor: '#4f46e5',
+          supportEmail: 'help@acme.com',
+        },
+      },
+    }),
+  ],
+})
+```
+
+That sets `sendVerificationEmail`, `sendResetPassword` and `onPasswordReset`.
+
+### Your config always wins
+
+Better Auth merges plugin options *underneath* your own. If you already have a
+`sendVerificationEmail`, it keeps working and the plugin only fills in what is missing.
+The plugin never turns on password sign-in either: `emailAndPassword.enabled` stays whatever
+you set it to.
+
+## Other plugins' emails
+
+The OTP, magic-link and invitation senders belong to other Better Auth plugins, so you build
+them once and pass them in:
+
+```ts
+import { eusend, eusendAuthEmails } from '@eusend_dev/better-auth'
+import { emailOTP, magicLink, organization } from 'better-auth/plugins'
+
+const emails = eusendAuthEmails({
+  from: 'Acme <auth@acme.com>',
+  appName: 'Acme',
+  appUrl: 'https://app.acme.com', // for the invitation link
+})
+
+betterAuth({
+  plugins: [
+    eusend({ email: { from: 'Acme <auth@acme.com>', appName: 'Acme' } }),
+    emailOTP({ sendVerificationOTP: emails.otp }),
+    magicLink({ sendMagicLink: emails.magicLink }),
+    organization({ sendInvitationEmail: emails.invitation }),
+  ],
+})
+```
+
+The six senders are `verification`, `resetPassword`, `passwordChanged`, `magicLink`, `otp` and
+`invitation`. The invitation link defaults to `${appUrl}/accept-invitation/${id}`; pass
+`invitationUrl: ({ id }) => ...` for a different route.
+
+## Sends don't block the response
+
+No sender waits for eusend to answer. That is what Better Auth recommends: an endpoint that
+waits for the send responds faster when an address has no account, and that difference tells
+an attacker which addresses are registered.
+
+On a long-running server nothing else is needed. On serverless, the function can be frozen as
+soon as the response goes out, so hand the send to the platform:
+
+```ts
+import { after } from 'next/server'
+
+eusend({ waitUntil: after, email: { ... } })
+```
+
+`waitUntil` from `@vercel/functions` and a Worker's `ctx.waitUntil` work the same way.
+
+## Contact sync
+
+```ts
+eusend({
+  email: { from: 'Acme <auth@acme.com>', appName: 'Acme' },
+  sync: {
+    audienceId: process.env.EUSEND_AUDIENCE_ID!,
+    properties: (user) => ({ user_id: user.id }),
+  },
+})
+```
+
+- **Verified addresses only.** A user who signs up with email and password is added once
+  they verify. A user whose provider already verified them (Google, GitHub) is added at
+  creation. A signup form accepts typos and other people's addresses, and mailing those is
+  how a sending domain gets its reputation damaged.
+- **Nothing is overwritten.** The sync merges into an existing contact. It never clears
+  properties or names you set elsewhere, and it never removes an opt-out: someone who
+  unsubscribed from your newsletter and later signs up stays unsubscribed.
+- **Every sign-up path.** It runs on Better Auth's database hooks, so email and password,
+  OAuth, magic link, OTP and admin-created users all go through it, alongside any database
+  hooks of your own.
+
+## Templates
+
+The built-in templates are plain HTML with a text alternative, no React, and no eusend
+branding — they read as coming from your app. Everything you pass in is HTML-escaped, and a
+link that isn't `http(s)` is refused rather than rendered.
+
+Replace any of them:
+
+```ts
+eusend({
+  email: {
+    from: 'auth@acme.com',
+    appName: 'Acme',
+    templates: {
+      verification: ({ user, url }, { appName }) => ({
+        subject: `Confirm your ${appName} account`,
+        html: renderMyEmail({ user, url }),
+        text: `Confirm: ${url}`,
+      }),
+    },
+  },
+})
+```
+
+## Errors
+
+A failed send never throws into Better Auth; a sign-up still succeeds if its email could not
+be sent. Failures are logged with `console.error`, or passed to your own handler:
+
+```ts
+eusend({
+  onError: ({ category, to, code, message }) => logger.warn({ category, to, code }, message),
+  email: { ... },
+})
+```
+
+`code` is the eusend [error code](https://eusend.dev/docs/reference/error-codes), such as
+`DOMAIN_NOT_VERIFIED` or `ALL_SUPPRESSED`.
+
+Every message is tagged `source: better-auth` and `category: verification` (or
+`reset-password`, `otp`, …), so you can filter auth mail in the eusend email log. Click
+tracking is off for auth mail: link scanners that follow tracked links can use up a
+single-use sign-in link before the user clicks it.
+
+## Options
+
+| Option | Where | |
+|---|---|---|
+| `apiKey` | top level | Defaults to `EUSEND_API_KEY`. |
+| `waitUntil` | top level | Keeps sends alive after the response on serverless. |
+| `onError` | top level | Receives `{ category, to, code, message }`. |
+| `baseUrl` | top level | API host override, for staging. |
+| `from` | `email` | Sender; its domain must be verified on eusend. |
+| `appName` | `email` | Used in subjects and copy. |
+| `brand` | `email` | `logoUrl`, `primaryColor` (hex), `supportEmail`. |
+| `replyTo` | `email` | Reply-to address. |
+| `templates` | `email` | Replace any of the six templates. |
+| `tags` | `email` | Extra tags on every send, up to 8. |
+| `appUrl` / `invitationUrl` | `email` | How invitation links are built. |
+| `audienceId` | `sync` | Audience verified users are added to. |
+| `properties` | `sync` | Custom contact properties from the user. |
+
+## License
+
+MIT

package/dist/index.d.mts

@@ -0,0 +1,287 @@
+import { Eusend } from "@eusend_dev/sdk";
+//#region src/templates.d.ts
+type Brand = {
+  /** Shown above every email. Use an absolute https URL; mail clients cannot load relative ones. */
+  logoUrl?: string;
+  /** Button and link colour, as a hex value. Defaults to a neutral near-black. */
+  primaryColor?: string;
+  /** Printed in the footer as the place to reply to. */
+  supportEmail?: string;
+};
+type RenderedEmail = {
+  subject: string;
+  html: string;
+  text: string;
+};
+type TemplateContext = {
+  appName: string;
+  brand: Brand;
+};
+type OtpType = 'sign-in' | 'email-verification' | 'forget-password' | 'change-email';
+type Templates = {
+  verification: (data: {
+    user: {
+      email: string;
+      name?: string | null;
+    };
+    url: string;
+  }, context: TemplateContext) => RenderedEmail;
+  resetPassword: (data: {
+    user: {
+      email: string;
+      name?: string | null;
+    };
+    url: string;
+  }, context: TemplateContext) => RenderedEmail;
+  passwordChanged: (data: {
+    user: {
+      email: string;
+      name?: string | null;
+    };
+  }, context: TemplateContext) => RenderedEmail;
+  magicLink: (data: {
+    email: string;
+    url: string;
+  }, context: TemplateContext) => RenderedEmail;
+  otp: (data: {
+    email: string;
+    otp: string;
+    type: OtpType;
+  }, context: TemplateContext) => RenderedEmail;
+  invitation: (data: {
+    email: string;
+    url: string;
+    role: string;
+    organizationName: string;
+    inviterName: string;
+    inviterEmail: string;
+  }, context: TemplateContext) => RenderedEmail;
+};
+declare function escapeHtml(value: string): string;
+/**
+ * Only http(s) URLs make it into an href. Better Auth builds these links itself, but the
+ * base URL comes from config and request headers, and a `javascript:` link in an auth email
+ * is the one mistake that must be impossible rather than unlikely.
+ */
+declare function safeUrl(value: string): string;
+type Block = {
+  kind: 'p';
+  text: string;
+} | {
+  kind: 'button';
+  label: string;
+  url: string;
+} | {
+  kind: 'code';
+  code: string;
+};
+declare function renderLayout({ appName, brand }: TemplateContext, { preheader, blocks, footnote }: {
+  preheader: string;
+  blocks: Block[];
+  footnote: string;
+}): {
+  html: string;
+  text: string;
+};
+declare const defaultTemplates: Templates;
+//#endregion
+//#region src/emails.d.ts
+type EmailCategory = keyof Templates;
+type EusendSendError = {
+  category: EmailCategory | 'contactSync';
+  to: string;
+  /** The eusend error code, e.g. `DOMAIN_NOT_VERIFIED`, or `NETWORK_ERROR` when the request never got an answer. */
+  code: string;
+  message: string;
+};
+type EusendClientOptions = {
+  /** Defaults to the `EUSEND_API_KEY` environment variable. */
+  apiKey?: string;
+  /** Override the API host. Only useful against a staging deployment. */
+  baseUrl?: string;
+  /**
+   * Keeps the send alive after the response has gone out, on platforms that freeze the
+   * function when it returns — `after` from `next/server`, `waitUntil` from
+   * `@vercel/functions`, or a Worker's `ctx.waitUntil`. Without it the send is started and
+   * not awaited, which is right for a long-running server.
+   */
+  waitUntil?: (promise: Promise<unknown>) => void;
+  /** Called when a send or a contact sync fails. Defaults to `console.error`. */
+  onError?: (error: EusendSendError) => void;
+};
+type EusendAuthEmailOptions = EusendClientOptions & {
+  /** Sender for every auth email, e.g. `Acme <auth@acme.com>`. Its domain must be verified on eusend. */
+  from: string;
+  /** Your product name, used in subjects and copy. */
+  appName: string;
+  replyTo?: string;
+  brand?: Brand;
+  /** Replace any of the built-in templates. Each receives the same data as the default. */
+  templates?: Partial<Templates>;
+  /** Added to every send alongside `source: better-auth` and `category`. Up to 8. */
+  tags?: Record<string, string>;
+  /**
+   * Builds the link in organization invitation emails. Defaults to
+   * `${appUrl}/accept-invitation/${id}`, the route Better Auth's docs use.
+   */
+  invitationUrl?: (invitation: {
+    id: string;
+    email: string;
+  }) => string;
+  /** Your app's public URL. Only needed for invitation emails, when `invitationUrl` is not set. */
+  appUrl?: string;
+};
+type AuthUser = {
+  email: string;
+  name?: string | null;
+};
+type InvitationData = {
+  id: string;
+  email: string;
+  role: string;
+  organization: {
+    name: string;
+  };
+  inviter: {
+    user: {
+      name: string;
+      email: string;
+    };
+  };
+};
+type EusendAuthEmails = {
+  /** For `emailVerification.sendVerificationEmail`. */
+  verification: (data: {
+    user: AuthUser;
+    url: string;
+  }) => Promise<void>;
+  /** For `emailAndPassword.sendResetPassword`. */
+  resetPassword: (data: {
+    user: AuthUser;
+    url: string;
+  }) => Promise<void>;
+  /** For `emailAndPassword.onPasswordReset` — the "was this you?" notice after a reset. */
+  passwordChanged: (data: {
+    user: AuthUser;
+  }) => Promise<void>;
+  /** For `magicLink({ sendMagicLink })`. */
+  magicLink: (data: {
+    email: string;
+    url: string;
+  }) => Promise<void>;
+  /** For `emailOTP({ sendVerificationOTP })`. */
+  otp: (data: {
+    email: string;
+    otp: string;
+    type: OtpType;
+  }) => Promise<void>;
+  /** For `organization({ sendInvitationEmail })`. */
+  invitation: (data: InvitationData) => Promise<void>;
+};
+/**
+ * The six senders Better Auth's email hooks need, each rendering a template and sending it
+ * through eusend. Pass them to the plugins the `eusend()` plugin cannot reach:
+ *
+ * ```ts
+ * const emails = eusendAuthEmails({ from: 'Acme <auth@acme.com>', appName: 'Acme' })
+ * emailOTP({ sendVerificationOTP: emails.otp })
+ * ```
+ *
+ * Every sender resolves straight away and never rejects — failures go to `onError`.
+ */
+declare function eusendAuthEmails(options: EusendAuthEmailOptions): EusendAuthEmails;
+//#endregion
+//#region src/sync.d.ts
+type SyncedUser = {
+  id: string;
+  email: string;
+  name?: string | null;
+  emailVerified?: boolean | null;
+};
+type ContactSyncOptions = EusendClientOptions & {
+  /** The eusend audience verified users are added to. */
+  audienceId: string;
+  /**
+   * Custom contact properties to set from the user, e.g. `(user) => ({ plan: user.plan })`.
+   * Merged into what the contact already has, never replacing it.
+   */
+  properties?: (user: SyncedUser) => Record<string, string>;
+};
+/** Users carry one `name`; contacts carry two. "Ada Lovelace King" gives a last name of "Lovelace King". */
+declare function splitName(name: string | null | undefined): {
+  firstName?: string;
+  lastName?: string;
+};
+/**
+ * Adds verified users to an audience.
+ *
+ * Unverified addresses are never synced. A signup form accepts typos and addresses that are
+ * not the signer's own, and broadcasting to those is the bounce and complaint rate that gets
+ * a sending domain blocked.
+ *
+ * The write goes through the batch endpoint, which merges instead of replacing: it cannot
+ * clear an existing contact's properties or names, and it can add an opt-out but never
+ * remove one. Someone who unsubscribed and then signs up stays unsubscribed.
+ */
+declare function createContactSync(options: ContactSyncOptions): (user: SyncedUser) => Promise<void>;
+//#endregion
+//#region src/index.d.ts
+type EusendPluginOptions = EusendClientOptions & {
+  /** Send Better Auth's verification, password-reset and password-changed emails. Omit to leave them to you. */
+  email?: Omit<EusendAuthEmailOptions, keyof EusendClientOptions>;
+  /** Add users to an eusend audience once their email is verified. Omit to turn syncing off. */
+  sync?: Omit<ContactSyncOptions, keyof EusendClientOptions>;
+};
+/**
+ * Better Auth plugin for [eusend](https://eusend.dev), EU-native transactional email.
+ *
+ * Everything it sets is a default. Better Auth merges plugin options underneath the app's
+ * own, so a `sendVerificationEmail` you already wrote keeps working and this plugin only
+ * fills the gaps. Adding it cannot switch on password sign-in.
+ */
+declare const eusend: (options?: EusendPluginOptions) => {
+  id: "eusend";
+  init(): {
+    options: {
+      databaseHooks?: {
+        user: {
+          create: {
+            after: (user: SyncedUser) => Promise<void>;
+          };
+          update: {
+            before: (data: Partial<SyncedUser>, context: object | null) => Promise<void>;
+            after: (user: SyncedUser, context: object | null) => Promise<void>;
+          };
+        };
+      } | undefined;
+      emailVerification?: {
+        sendVerificationEmail: (data: {
+          user: {
+            email: string;
+            name?: string | null;
+          };
+          url: string;
+        }) => Promise<void>;
+      } | undefined;
+      emailAndPassword?: {
+        enabled: false;
+        sendResetPassword: (data: {
+          user: {
+            email: string;
+            name?: string | null;
+          };
+          url: string;
+        }) => Promise<void>;
+        onPasswordReset: (data: {
+          user: {
+            email: string;
+            name?: string | null;
+          };
+        }) => Promise<void>;
+      } | undefined;
+    };
+  };
+};
+//#endregion
+export { type Brand, type ContactSyncOptions, type EmailCategory, type EusendAuthEmailOptions, type EusendAuthEmails, type EusendClientOptions, EusendPluginOptions, type EusendSendError, type InvitationData, type OtpType, type RenderedEmail, type SyncedUser, type TemplateContext, type Templates, createContactSync, defaultTemplates, escapeHtml, eusend, eusendAuthEmails, renderLayout, safeUrl, splitName };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/templates.ts","../src/emails.ts","../src/sync.ts","../src/index.ts"],"mappings":";;KAAY;;EAEV;;EAEA;;EAEA;;KAGU;EAAkB;EAAiB;EAAc;;KAEjD;EAAoB;EAAiB,OAAO;;KAE5C;KAEA;EACV,eACE;IAAQ;MAAQ;MAAe;;IAAwB;KACvD,SAAS,oBACN;EACL,gBACE;IAAQ;MAAQ;MAAe;;IAAwB;KACvD,SAAS,oBACN;EACL,kBACE;IAAQ;MAAQ;MAAe;;KAC/B,SAAS,oBACN;EACL,YAAY;IAAQ;IAAe;KAAe,SAAS,oBAAoB;EAC/E,MAAM;IAAQ;IAAe;IAAa,MAAM;KAAW,SAAS,oBAAoB;EACxF,aACE;IACE;IACA;IACA;IACA;IACA;IACA;KAEF,SAAS,oBACN;;iBAKS,WAAW;;;;;;iBAcX,QAAQ;KAkBnB;EAAU;EAAW;;EAAmB;EAAgB;EAAe;;EAAkB;EAAc;;iBAE5F,eACZ,SAAS,SAAS,mBAClB,WAAW,QAAQ;EAAc;EAAmB,QAAQ;EAAS;;EACpE;EAAc;;cAgEN,kBAAkB;;;KC5InB,sBAAsB;KAEtB;EACV,UAAU;EACV;;EAEA;EACA;;KAGU;;EAEV;;EAEA;;;;;;;EAOA,aAAa,SAAS;;EAEtB,WAAW,OAAO;;KAGR,yBAAyB;;EAEnC;;EAEA;EACA;EACA,QAAQ;;EAER,YAAY,QAAQ;;EAEpB,OAAO;;;;;EAKP,iBAAiB;IAAc;IAAY;;;EAE3C;;KAGG;EAAa;EAAe;;KAErB;EACV;EACA;EACA;EACA;IAAgB;;EAChB;IAAW;MAAQ;MAAc;;;;KAGvB;;EAEV,eAAe;IAAQ,MAAM;IAAU;QAAkB;;EAEzD,gBAAgB;IAAQ,MAAM;IAAU;QAAkB;;EAE1D,kBAAkB;IAAQ,MAAM;QAAe;;EAE/C,YAAY;IAAQ;IAAe;QAAkB;;EAErD,MAAM;IAAQ;IAAe;IAAa,MAAM;QAAc;;EAE9D,aAAa,MAAM,mBAAmB;;;;;;;;;;;;;iBA0CxB,iBAAiB,SAAS,yBAAyB;;;KCjHvD;EAAe;EAAY;EAAe;EAAsB;;KAEhE,qBAAqB;;EAE/B;;;;;EAKA,cAAc,MAAM,eAAe;;;iBAIrB,UAAU;EAAoC;EAAoB;;;;;;;;;;;;;iBAmBlE,kBAAkB,SAAS,sBAGjC,MAAM,eAAU;;;KCjBd,sBAAsB;;EAEhC,QAAQ,KAAK,8BAA8B;;EAE3C,OAAO,KAAK,0BAA0B;;;;;;;;;cAU3B,SAAU,UAAS;;;;;;;YAmCU,QAAA,MAAA,eAAU;;;YAKT,SAAA,MAAA,QAAQ,aAAW,2BAAwB;YAG5C,QAAA,MAAA,YAAU,2BAAwB"}

package/dist/index.mjs

@@ -0,0 +1,430 @@
+import { Eusend } from "@eusend_dev/sdk";
+//#region src/templates.ts
+const DEFAULT_COLOR = "#18181b";
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+/**
+* Only http(s) URLs make it into an href. Better Auth builds these links itself, but the
+* base URL comes from config and request headers, and a `javascript:` link in an auth email
+* is the one mistake that must be impossible rather than unlikely.
+*/
+function safeUrl(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol === "https:" || url.protocol === "http:") return url.toString();
+	} catch {}
+	throw new Error(`Refusing to put a non-http(s) URL in an email: ${value}`);
+}
+function color(brand) {
+	const value = brand.primaryColor?.trim();
+	return value && /^#[0-9a-f]{3,8}$/i.test(value) ? value : DEFAULT_COLOR;
+}
+function greeting(name) {
+	const first = name?.trim().split(/\s+/)[0];
+	return first ? `Hi ${first},` : "Hi,";
+}
+function renderLayout({ appName, brand }, { preheader, blocks, footnote }) {
+	const accent = color(brand);
+	const logo = brand.logoUrl ? `<img src="${escapeHtml(safeUrl(brand.logoUrl))}" alt="${escapeHtml(appName)}" height="32" style="display:block;height:32px;width:auto;border:0;margin:0 0 24px">` : `<div style="font-size:18px;font-weight:600;color:#18181b;margin:0 0 24px">${escapeHtml(appName)}</div>`;
+	const body = blocks.map((block) => {
+		if (block.kind === "p") return `<p style="margin:0 0 16px;font-size:15px;line-height:24px;color:#3f3f46">${escapeHtml(block.text)}</p>`;
+		if (block.kind === "code") return `<p style="margin:8px 0 24px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:28px;letter-spacing:6px;font-weight:600;color:#18181b">${escapeHtml(block.code)}</p>`;
+		const href = escapeHtml(safeUrl(block.url));
+		return `<table role="presentation" cellpadding="0" cellspacing="0" style="margin:8px 0 24px"><tr><td style="border-radius:6px;background:${accent}"><a href="${href}" style="display:inline-block;padding:12px 20px;font-size:15px;font-weight:600;color:#ffffff;text-decoration:none;border-radius:6px">${escapeHtml(block.label)}</a></td></tr></table>
+<p style="margin:0 0 16px;font-size:13px;line-height:20px;color:#71717a">Or paste this link into your browser:<br><a href="${href}" style="color:${accent};word-break:break-all">${href}</a></p>`;
+	}).join("\n");
+	const support = brand.supportEmail ? ` Questions? Write to <a href="mailto:${escapeHtml(brand.supportEmail)}" style="color:#71717a">${escapeHtml(brand.supportEmail)}</a>.` : "";
+	return {
+		html: `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="light"></head>
+<body style="margin:0;padding:0;background:#f4f4f5">
+<div style="display:none;max-height:0;overflow:hidden">${escapeHtml(preheader)}</div>
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f4f4f5">
+<tr><td align="center" style="padding:32px 16px">
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:520px;background:#ffffff;border-radius:8px;border:1px solid #e4e4e7">
+<tr><td style="padding:32px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif">
+${logo}
+${body}
+</td></tr>
+</table>
+<p style="max-width:520px;margin:16px auto 0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;font-size:12px;line-height:18px;color:#71717a">${escapeHtml(footnote)}${support}</p>
+</td></tr>
+</table>
+</body>
+</html>`,
+		text: [
+			...blocks.map((block) => {
+				if (block.kind === "p") return block.text;
+				if (block.kind === "code") return block.code;
+				return `${block.label}: ${safeUrl(block.url)}`;
+			}),
+			"",
+			"—",
+			footnote + (brand.supportEmail ? ` Questions? Write to ${brand.supportEmail}.` : "")
+		].join("\n\n")
+	};
+}
+const OTP_COPY = {
+	"sign-in": {
+		subject: "sign-in code",
+		lead: "Use this code to sign in to"
+	},
+	"email-verification": {
+		subject: "verification code",
+		lead: "Use this code to verify your email address for"
+	},
+	"forget-password": {
+		subject: "password reset code",
+		lead: "Use this code to reset your password for"
+	},
+	"change-email": {
+		subject: "code to confirm your new email",
+		lead: "Use this code to confirm your new email address for"
+	}
+};
+const defaultTemplates = {
+	verification: ({ user, url }, context) => ({
+		subject: `Verify your email for ${context.appName}`,
+		...renderLayout(context, {
+			preheader: `Confirm your email address to finish setting up ${context.appName}.`,
+			blocks: [
+				{
+					kind: "p",
+					text: greeting(user.name)
+				},
+				{
+					kind: "p",
+					text: `Confirm that ${user.email} is your email address to finish setting up your ${context.appName} account.`
+				},
+				{
+					kind: "button",
+					label: "Verify email",
+					url
+				}
+			],
+			footnote: `If you didn't create a ${context.appName} account, you can ignore this email.`
+		})
+	}),
+	resetPassword: ({ user, url }, context) => ({
+		subject: `Reset your ${context.appName} password`,
+		...renderLayout(context, {
+			preheader: `Someone asked to reset the password for ${user.email}.`,
+			blocks: [
+				{
+					kind: "p",
+					text: greeting(user.name)
+				},
+				{
+					kind: "p",
+					text: `Someone asked to reset the password for your ${context.appName} account. Choose a new one with the button below.`
+				},
+				{
+					kind: "button",
+					label: "Reset password",
+					url
+				}
+			],
+			footnote: "If you didn't ask for this, you can ignore this email — your password stays the same."
+		})
+	}),
+	passwordChanged: ({ user }, context) => ({
+		subject: `Your ${context.appName} password was changed`,
+		...renderLayout(context, {
+			preheader: `The password for ${user.email} was just changed.`,
+			blocks: [
+				{
+					kind: "p",
+					text: greeting(user.name)
+				},
+				{
+					kind: "p",
+					text: `The password for your ${context.appName} account (${user.email}) was just changed.`
+				},
+				{
+					kind: "p",
+					text: "If this was you, there's nothing else to do."
+				}
+			],
+			footnote: `If you didn't change it, reset your password straight away and contact ${context.appName} support.`
+		})
+	}),
+	magicLink: ({ url }, context) => ({
+		subject: `Sign in to ${context.appName}`,
+		...renderLayout(context, {
+			preheader: `Your sign-in link for ${context.appName}.`,
+			blocks: [{
+				kind: "p",
+				text: `Use the button below to sign in to ${context.appName}. The link works once and expires shortly.`
+			}, {
+				kind: "button",
+				label: `Sign in to ${context.appName}`,
+				url
+			}],
+			footnote: "If you didn't try to sign in, you can ignore this email."
+		})
+	}),
+	otp: ({ otp, type }, context) => {
+		const copy = OTP_COPY[type] ?? OTP_COPY["sign-in"];
+		return {
+			subject: `Your ${context.appName} ${copy.subject}: ${otp}`,
+			...renderLayout(context, {
+				preheader: `${copy.lead} ${context.appName}.`,
+				blocks: [
+					{
+						kind: "p",
+						text: `${copy.lead} ${context.appName}:`
+					},
+					{
+						kind: "code",
+						code: otp
+					},
+					{
+						kind: "p",
+						text: "The code expires shortly. Never share it with anyone."
+					}
+				],
+				footnote: "If you didn't ask for this code, you can ignore this email."
+			})
+		};
+	},
+	invitation: ({ url, organizationName, inviterName, inviterEmail, role }, context) => ({
+		subject: `${inviterName} invited you to ${organizationName} on ${context.appName}`,
+		...renderLayout(context, {
+			preheader: `Join ${organizationName} on ${context.appName}.`,
+			blocks: [{
+				kind: "p",
+				text: `${inviterName} (${inviterEmail}) invited you to join ${organizationName} on ${context.appName} as ${role}.`
+			}, {
+				kind: "button",
+				label: "Accept invitation",
+				url
+			}],
+			footnote: "If you weren't expecting this invitation, you can ignore this email."
+		})
+	})
+};
+//#endregion
+//#region src/emails.ts
+function reportError(options, error) {
+	if (options.onError) {
+		try {
+			options.onError(error);
+		} catch {}
+		return;
+	}
+	console.error(`[eusend] ${error.category} for ${error.to} failed: ${error.code} — ${error.message}`);
+}
+/**
+* Start `work` without making the caller wait for it. Better Auth asks for exactly this:
+* a reset endpoint that waits for the send answers faster for addresses with no account,
+* and that difference is how an attacker learns which addresses are registered.
+*/
+function detach(options, work) {
+	const running = work();
+	if (options.waitUntil) options.waitUntil(running);
+	return Promise.resolve();
+}
+function lazyClient(options) {
+	let client;
+	return () => client ??= new Eusend(options.apiKey, options.baseUrl ? { baseUrl: options.baseUrl } : void 0);
+}
+/**
+* The six senders Better Auth's email hooks need, each rendering a template and sending it
+* through eusend. Pass them to the plugins the `eusend()` plugin cannot reach:
+*
+* ```ts
+* const emails = eusendAuthEmails({ from: 'Acme <auth@acme.com>', appName: 'Acme' })
+* emailOTP({ sendVerificationOTP: emails.otp })
+* ```
+*
+* Every sender resolves straight away and never rejects — failures go to `onError`.
+*/
+function eusendAuthEmails(options) {
+	const templates = {
+		...defaultTemplates,
+		...options.templates
+	};
+	const context = {
+		appName: options.appName,
+		brand: options.brand ?? {}
+	};
+	const client = lazyClient(options);
+	const send = (category, to, render) => detach(options, async () => {
+		try {
+			const email = render();
+			const message = {
+				from: options.from,
+				to,
+				replyTo: options.replyTo,
+				subject: email.subject,
+				html: email.html,
+				text: email.text,
+				tags: {
+					...options.tags,
+					source: "better-auth",
+					category: toTagValue(category)
+				},
+				trackClicks: false
+			};
+			const { error } = await client().emails.send(message);
+			if (error) reportError(options, {
+				category,
+				to,
+				code: error.name,
+				message: error.message
+			});
+		} catch (error) {
+			reportError(options, {
+				category,
+				to,
+				code: "NETWORK_ERROR",
+				message: error instanceof Error ? error.message : String(error)
+			});
+		}
+	});
+	return {
+		verification: ({ user, url }) => send("verification", user.email, () => templates.verification({
+			user,
+			url
+		}, context)),
+		resetPassword: ({ user, url }) => send("resetPassword", user.email, () => templates.resetPassword({
+			user,
+			url
+		}, context)),
+		passwordChanged: ({ user }) => send("passwordChanged", user.email, () => templates.passwordChanged({ user }, context)),
+		magicLink: ({ email, url }) => send("magicLink", email, () => templates.magicLink({
+			email,
+			url
+		}, context)),
+		otp: ({ email, otp, type }) => send("otp", email, () => templates.otp({
+			email,
+			otp,
+			type
+		}, context)),
+		invitation: (data) => send("invitation", data.email, () => templates.invitation({
+			email: data.email,
+			url: invitationLink(options, data),
+			role: data.role,
+			organizationName: data.organization.name,
+			inviterName: data.inviter.user.name,
+			inviterEmail: data.inviter.user.email
+		}, context))
+	};
+}
+function invitationLink(options, data) {
+	if (options.invitationUrl) return options.invitationUrl({
+		id: data.id,
+		email: data.email
+	});
+	if (!options.appUrl) throw new Error("Set `appUrl` or `invitationUrl` to send organization invitation emails.");
+	return safeUrl(`${options.appUrl.replace(/\/+$/, "")}/accept-invitation/${encodeURIComponent(data.id)}`);
+}
+/** Tag values allow letters, digits, `_` and `-`, so `resetPassword` goes on the wire as `reset-password`. */
+function toTagValue(category) {
+	return category.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+}
+//#endregion
+//#region src/sync.ts
+/** Users carry one `name`; contacts carry two. "Ada Lovelace King" gives a last name of "Lovelace King". */
+function splitName(name) {
+	const trimmed = name?.trim() ?? "";
+	if (!trimmed) return {};
+	const gap = trimmed.indexOf(" ");
+	if (gap === -1) return { firstName: trimmed };
+	return {
+		firstName: trimmed.slice(0, gap),
+		lastName: trimmed.slice(gap + 1)
+	};
+}
+/**
+* Adds verified users to an audience.
+*
+* Unverified addresses are never synced. A signup form accepts typos and addresses that are
+* not the signer's own, and broadcasting to those is the bounce and complaint rate that gets
+* a sending domain blocked.
+*
+* The write goes through the batch endpoint, which merges instead of replacing: it cannot
+* clear an existing contact's properties or names, and it can add an opt-out but never
+* remove one. Someone who unsubscribed and then signs up stays unsubscribed.
+*/
+function createContactSync(options) {
+	const client = lazyClient(options);
+	return (user) => detach(options, async () => {
+		if (!user.emailVerified || !user.email) return;
+		try {
+			const { error } = await client().audiences.batchCreateContacts(options.audienceId, { contacts: [{
+				email: user.email,
+				...splitName(user.name),
+				properties: options.properties?.(user)
+			}] });
+			if (error) reportError(options, {
+				category: "contactSync",
+				to: user.email,
+				code: error.name,
+				message: error.message
+			});
+		} catch (error) {
+			reportError(options, {
+				category: "contactSync",
+				to: user.email,
+				code: "NETWORK_ERROR",
+				message: error instanceof Error ? error.message : String(error)
+			});
+		}
+	});
+}
+//#endregion
+//#region src/index.ts
+/**
+* Better Auth plugin for [eusend](https://eusend.dev), EU-native transactional email.
+*
+* Everything it sets is a default. Better Auth merges plugin options underneath the app's
+* own, so a `sendVerificationEmail` you already wrote keeps working and this plugin only
+* fills the gaps. Adding it cannot switch on password sign-in.
+*/
+const eusend = (options = {}) => {
+	const { email, sync: syncOptions, ...client } = options;
+	const emails = email ? eusendAuthEmails({
+		...client,
+		...email
+	}) : null;
+	const sync = syncOptions ? createContactSync({
+		...client,
+		...syncOptions
+	}) : null;
+	const verifying = /* @__PURE__ */ new WeakSet();
+	return {
+		id: "eusend",
+		init() {
+			return { options: {
+				...emails ? {
+					emailVerification: { sendVerificationEmail: emails.verification },
+					emailAndPassword: {
+						enabled: false,
+						sendResetPassword: emails.resetPassword,
+						onPasswordReset: emails.passwordChanged
+					}
+				} : {},
+				...sync ? { databaseHooks: { user: {
+					create: { after: async (user) => {
+						await sync(user);
+					} },
+					update: {
+						before: async (data, context) => {
+							if (data.emailVerified === true && context) verifying.add(context);
+						},
+						after: async (user, context) => {
+							if (context && verifying.delete(context)) await sync(user);
+						}
+					}
+				} } } : {}
+			} };
+		}
+	};
+};
+//#endregion
+export { createContactSync, defaultTemplates, escapeHtml, eusend, eusendAuthEmails, renderLayout, safeUrl, splitName };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/templates.ts","../src/emails.ts","../src/sync.ts","../src/index.ts"],"sourcesContent":["export type Brand = {\r\n  /** Shown above every email. Use an absolute https URL; mail clients cannot load relative ones. */\r\n  logoUrl?: string\r\n  /** Button and link colour, as a hex value. Defaults to a neutral near-black. */\r\n  primaryColor?: string\r\n  /** Printed in the footer as the place to reply to. */\r\n  supportEmail?: string\r\n}\r\n\r\nexport type RenderedEmail = { subject: string; html: string; text: string }\r\n\r\nexport type TemplateContext = { appName: string; brand: Brand }\r\n\r\nexport type OtpType = 'sign-in' | 'email-verification' | 'forget-password' | 'change-email'\r\n\r\nexport type Templates = {\r\n  verification: (\r\n    data: { user: { email: string; name?: string | null }; url: string },\r\n    context: TemplateContext,\r\n  ) => RenderedEmail\r\n  resetPassword: (\r\n    data: { user: { email: string; name?: string | null }; url: string },\r\n    context: TemplateContext,\r\n  ) => RenderedEmail\r\n  passwordChanged: (\r\n    data: { user: { email: string; name?: string | null } },\r\n    context: TemplateContext,\r\n  ) => RenderedEmail\r\n  magicLink: (data: { email: string; url: string }, context: TemplateContext) => RenderedEmail\r\n  otp: (data: { email: string; otp: string; type: OtpType }, context: TemplateContext) => RenderedEmail\r\n  invitation: (\r\n    data: {\r\n      email: string\r\n      url: string\r\n      role: string\r\n      organizationName: string\r\n      inviterName: string\r\n      inviterEmail: string\r\n    },\r\n    context: TemplateContext,\r\n  ) => RenderedEmail\r\n}\r\n\r\nconst DEFAULT_COLOR = '#18181b'\r\n\r\nexport function escapeHtml(value: string): string {\r\n  return value\r\n    .replace(/&/g, '&amp;')\r\n    .replace(/</g, '&lt;')\r\n    .replace(/>/g, '&gt;')\r\n    .replace(/\"/g, '&quot;')\r\n    .replace(/'/g, '&#39;')\r\n}\r\n\r\n/**\r\n * Only http(s) URLs make it into an href. Better Auth builds these links itself, but the\r\n * base URL comes from config and request headers, and a `javascript:` link in an auth email\r\n * is the one mistake that must be impossible rather than unlikely.\r\n */\r\nexport function safeUrl(value: string): string {\r\n  try {\r\n    const url = new URL(value)\r\n    if (url.protocol === 'https:' || url.protocol === 'http:') return url.toString()\r\n  } catch {}\r\n  throw new Error(`Refusing to put a non-http(s) URL in an email: ${value}`)\r\n}\r\n\r\nfunction color(brand: Brand): string {\r\n  const value = brand.primaryColor?.trim()\r\n  return value && /^#[0-9a-f]{3,8}$/i.test(value) ? value : DEFAULT_COLOR\r\n}\r\n\r\nfunction greeting(name: string | null | undefined): string {\r\n  const first = name?.trim().split(/\\s+/)[0]\r\n  return first ? `Hi ${first},` : 'Hi,'\r\n}\r\n\r\ntype Block = { kind: 'p'; text: string } | { kind: 'button'; label: string; url: string } | { kind: 'code'; code: string }\r\n\r\nexport function renderLayout(\r\n  { appName, brand }: TemplateContext,\r\n  { preheader, blocks, footnote }: { preheader: string; blocks: Block[]; footnote: string },\r\n): { html: string; text: string } {\r\n  const accent = color(brand)\r\n  const logo = brand.logoUrl\r\n    ? `<img src=\"${escapeHtml(safeUrl(brand.logoUrl))}\" alt=\"${escapeHtml(appName)}\" height=\"32\" style=\"display:block;height:32px;width:auto;border:0;margin:0 0 24px\">`\r\n    : `<div style=\"font-size:18px;font-weight:600;color:#18181b;margin:0 0 24px\">${escapeHtml(appName)}</div>`\r\n\r\n  const body = blocks\r\n    .map((block) => {\r\n      if (block.kind === 'p') {\r\n        return `<p style=\"margin:0 0 16px;font-size:15px;line-height:24px;color:#3f3f46\">${escapeHtml(block.text)}</p>`\r\n      }\r\n      if (block.kind === 'code') {\r\n        return `<p style=\"margin:8px 0 24px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:28px;letter-spacing:6px;font-weight:600;color:#18181b\">${escapeHtml(block.code)}</p>`\r\n      }\r\n      const href = escapeHtml(safeUrl(block.url))\r\n      return `<table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" style=\"margin:8px 0 24px\"><tr><td style=\"border-radius:6px;background:${accent}\"><a href=\"${href}\" style=\"display:inline-block;padding:12px 20px;font-size:15px;font-weight:600;color:#ffffff;text-decoration:none;border-radius:6px\">${escapeHtml(block.label)}</a></td></tr></table>\r\n<p style=\"margin:0 0 16px;font-size:13px;line-height:20px;color:#71717a\">Or paste this link into your browser:<br><a href=\"${href}\" style=\"color:${accent};word-break:break-all\">${href}</a></p>`\r\n    })\r\n    .join('\\n')\r\n\r\n  const support = brand.supportEmail\r\n    ? ` Questions? Write to <a href=\"mailto:${escapeHtml(brand.supportEmail)}\" style=\"color:#71717a\">${escapeHtml(brand.supportEmail)}</a>.`\r\n    : ''\r\n\r\n  const html = `<!doctype html>\r\n<html lang=\"en\">\r\n<head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><meta name=\"color-scheme\" content=\"light\"></head>\r\n<body style=\"margin:0;padding:0;background:#f4f4f5\">\r\n<div style=\"display:none;max-height:0;overflow:hidden\">${escapeHtml(preheader)}</div>\r\n<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" style=\"background:#f4f4f5\">\r\n<tr><td align=\"center\" style=\"padding:32px 16px\">\r\n<table role=\"presentation\" width=\"100%\" cellpadding=\"0\" cellspacing=\"0\" style=\"max-width:520px;background:#ffffff;border-radius:8px;border:1px solid #e4e4e7\">\r\n<tr><td style=\"padding:32px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif\">\r\n${logo}\r\n${body}\r\n</td></tr>\r\n</table>\r\n<p style=\"max-width:520px;margin:16px auto 0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;font-size:12px;line-height:18px;color:#71717a\">${escapeHtml(footnote)}${support}</p>\r\n</td></tr>\r\n</table>\r\n</body>\r\n</html>`\r\n\r\n  const text = [\r\n    ...blocks.map((block) => {\r\n      if (block.kind === 'p') return block.text\r\n      if (block.kind === 'code') return block.code\r\n      return `${block.label}: ${safeUrl(block.url)}`\r\n    }),\r\n    '',\r\n    '—',\r\n    footnote + (brand.supportEmail ? ` Questions? Write to ${brand.supportEmail}.` : ''),\r\n  ].join('\\n\\n')\r\n\r\n  return { html, text }\r\n}\r\n\r\nconst OTP_COPY: Record<OtpType, { subject: string; lead: string }> = {\r\n  'sign-in': { subject: 'sign-in code', lead: 'Use this code to sign in to' },\r\n  'email-verification': { subject: 'verification code', lead: 'Use this code to verify your email address for' },\r\n  'forget-password': { subject: 'password reset code', lead: 'Use this code to reset your password for' },\r\n  'change-email': { subject: 'code to confirm your new email', lead: 'Use this code to confirm your new email address for' },\r\n}\r\n\r\nexport const defaultTemplates: Templates = {\r\n  verification: ({ user, url }, context) => ({\r\n    subject: `Verify your email for ${context.appName}`,\r\n    ...renderLayout(context, {\r\n      preheader: `Confirm your email address to finish setting up ${context.appName}.`,\r\n      blocks: [\r\n        { kind: 'p', text: greeting(user.name) },\r\n        { kind: 'p', text: `Confirm that ${user.email} is your email address to finish setting up your ${context.appName} account.` },\r\n        { kind: 'button', label: 'Verify email', url },\r\n      ],\r\n      footnote: `If you didn't create a ${context.appName} account, you can ignore this email.`,\r\n    }),\r\n  }),\r\n\r\n  resetPassword: ({ user, url }, context) => ({\r\n    subject: `Reset your ${context.appName} password`,\r\n    ...renderLayout(context, {\r\n      preheader: `Someone asked to reset the password for ${user.email}.`,\r\n      blocks: [\r\n        { kind: 'p', text: greeting(user.name) },\r\n        { kind: 'p', text: `Someone asked to reset the password for your ${context.appName} account. Choose a new one with the button below.` },\r\n        { kind: 'button', label: 'Reset password', url },\r\n      ],\r\n      footnote: \"If you didn't ask for this, you can ignore this email — your password stays the same.\",\r\n    }),\r\n  }),\r\n\r\n  passwordChanged: ({ user }, context) => ({\r\n    subject: `Your ${context.appName} password was changed`,\r\n    ...renderLayout(context, {\r\n      preheader: `The password for ${user.email} was just changed.`,\r\n      blocks: [\r\n        { kind: 'p', text: greeting(user.name) },\r\n        { kind: 'p', text: `The password for your ${context.appName} account (${user.email}) was just changed.` },\r\n        { kind: 'p', text: \"If this was you, there's nothing else to do.\" },\r\n      ],\r\n      footnote: `If you didn't change it, reset your password straight away and contact ${context.appName} support.`,\r\n    }),\r\n  }),\r\n\r\n  magicLink: ({ url }, context) => ({\r\n    subject: `Sign in to ${context.appName}`,\r\n    ...renderLayout(context, {\r\n      preheader: `Your sign-in link for ${context.appName}.`,\r\n      blocks: [\r\n        { kind: 'p', text: `Use the button below to sign in to ${context.appName}. The link works once and expires shortly.` },\r\n        { kind: 'button', label: `Sign in to ${context.appName}`, url },\r\n      ],\r\n      footnote: \"If you didn't try to sign in, you can ignore this email.\",\r\n    }),\r\n  }),\r\n\r\n  otp: ({ otp, type }, context) => {\r\n    const copy = OTP_COPY[type] ?? OTP_COPY['sign-in']\r\n    return {\r\n      subject: `Your ${context.appName} ${copy.subject}: ${otp}`,\r\n      ...renderLayout(context, {\r\n        preheader: `${copy.lead} ${context.appName}.`,\r\n        blocks: [\r\n          { kind: 'p', text: `${copy.lead} ${context.appName}:` },\r\n          { kind: 'code', code: otp },\r\n          { kind: 'p', text: 'The code expires shortly. Never share it with anyone.' },\r\n        ],\r\n        footnote: \"If you didn't ask for this code, you can ignore this email.\",\r\n      }),\r\n    }\r\n  },\r\n\r\n  invitation: ({ url, organizationName, inviterName, inviterEmail, role }, context) => ({\r\n    subject: `${inviterName} invited you to ${organizationName} on ${context.appName}`,\r\n    ...renderLayout(context, {\r\n      preheader: `Join ${organizationName} on ${context.appName}.`,\r\n      blocks: [\r\n        { kind: 'p', text: `${inviterName} (${inviterEmail}) invited you to join ${organizationName} on ${context.appName} as ${role}.` },\r\n        { kind: 'button', label: 'Accept invitation', url },\r\n      ],\r\n      footnote: \"If you weren't expecting this invitation, you can ignore this email.\",\r\n    }),\r\n  }),\r\n}\r\n","import { Eusend } from '@eusend_dev/sdk'\r\nimport type { SendEmailOptions } from '@eusend_dev/sdk'\r\n\r\nimport { defaultTemplates, safeUrl } from './templates'\r\nimport type { Brand, OtpType, RenderedEmail, TemplateContext, Templates } from './templates'\r\n\r\nexport type EmailCategory = keyof Templates\r\n\r\nexport type EusendSendError = {\r\n  category: EmailCategory | 'contactSync'\r\n  to: string\r\n  /** The eusend error code, e.g. `DOMAIN_NOT_VERIFIED`, or `NETWORK_ERROR` when the request never got an answer. */\r\n  code: string\r\n  message: string\r\n}\r\n\r\nexport type EusendClientOptions = {\r\n  /** Defaults to the `EUSEND_API_KEY` environment variable. */\r\n  apiKey?: string\r\n  /** Override the API host. Only useful against a staging deployment. */\r\n  baseUrl?: string\r\n  /**\r\n   * Keeps the send alive after the response has gone out, on platforms that freeze the\r\n   * function when it returns — `after` from `next/server`, `waitUntil` from\r\n   * `@vercel/functions`, or a Worker's `ctx.waitUntil`. Without it the send is started and\r\n   * not awaited, which is right for a long-running server.\r\n   */\r\n  waitUntil?: (promise: Promise<unknown>) => void\r\n  /** Called when a send or a contact sync fails. Defaults to `console.error`. */\r\n  onError?: (error: EusendSendError) => void\r\n}\r\n\r\nexport type EusendAuthEmailOptions = EusendClientOptions & {\r\n  /** Sender for every auth email, e.g. `Acme <auth@acme.com>`. Its domain must be verified on eusend. */\r\n  from: string\r\n  /** Your product name, used in subjects and copy. */\r\n  appName: string\r\n  replyTo?: string\r\n  brand?: Brand\r\n  /** Replace any of the built-in templates. Each receives the same data as the default. */\r\n  templates?: Partial<Templates>\r\n  /** Added to every send alongside `source: better-auth` and `category`. Up to 8. */\r\n  tags?: Record<string, string>\r\n  /**\r\n   * Builds the link in organization invitation emails. Defaults to\r\n   * `${appUrl}/accept-invitation/${id}`, the route Better Auth's docs use.\r\n   */\r\n  invitationUrl?: (invitation: { id: string; email: string }) => string\r\n  /** Your app's public URL. Only needed for invitation emails, when `invitationUrl` is not set. */\r\n  appUrl?: string\r\n}\r\n\r\ntype AuthUser = { email: string; name?: string | null }\r\n\r\nexport type InvitationData = {\r\n  id: string\r\n  email: string\r\n  role: string\r\n  organization: { name: string }\r\n  inviter: { user: { name: string; email: string } }\r\n}\r\n\r\nexport type EusendAuthEmails = {\r\n  /** For `emailVerification.sendVerificationEmail`. */\r\n  verification: (data: { user: AuthUser; url: string }) => Promise<void>\r\n  /** For `emailAndPassword.sendResetPassword`. */\r\n  resetPassword: (data: { user: AuthUser; url: string }) => Promise<void>\r\n  /** For `emailAndPassword.onPasswordReset` — the \"was this you?\" notice after a reset. */\r\n  passwordChanged: (data: { user: AuthUser }) => Promise<void>\r\n  /** For `magicLink({ sendMagicLink })`. */\r\n  magicLink: (data: { email: string; url: string }) => Promise<void>\r\n  /** For `emailOTP({ sendVerificationOTP })`. */\r\n  otp: (data: { email: string; otp: string; type: OtpType }) => Promise<void>\r\n  /** For `organization({ sendInvitationEmail })`. */\r\n  invitation: (data: InvitationData) => Promise<void>\r\n}\r\n\r\nexport function reportError(options: EusendClientOptions, error: EusendSendError): void {\r\n  if (options.onError) {\r\n    try {\r\n      options.onError(error)\r\n    } catch {}\r\n    return\r\n  }\r\n  console.error(`[eusend] ${error.category} for ${error.to} failed: ${error.code} — ${error.message}`)\r\n}\r\n\r\n/**\r\n * Start `work` without making the caller wait for it. Better Auth asks for exactly this:\r\n * a reset endpoint that waits for the send answers faster for addresses with no account,\r\n * and that difference is how an attacker learns which addresses are registered.\r\n */\r\nexport function detach(options: EusendClientOptions, work: () => Promise<void>): Promise<void> {\r\n  const running = work()\r\n  if (options.waitUntil) options.waitUntil(running)\r\n  return Promise.resolve()\r\n}\r\n\r\nexport function lazyClient(options: EusendClientOptions): () => Eusend {\r\n  let client: Eusend | undefined\r\n  // Built on first use rather than at import, so a build step that loads auth.ts without\r\n  // production env vars does not crash on the missing key.\r\n  return () => (client ??= new Eusend(options.apiKey, options.baseUrl ? { baseUrl: options.baseUrl } : undefined))\r\n}\r\n\r\n/**\r\n * The six senders Better Auth's email hooks need, each rendering a template and sending it\r\n * through eusend. Pass them to the plugins the `eusend()` plugin cannot reach:\r\n *\r\n * ```ts\r\n * const emails = eusendAuthEmails({ from: 'Acme <auth@acme.com>', appName: 'Acme' })\r\n * emailOTP({ sendVerificationOTP: emails.otp })\r\n * ```\r\n *\r\n * Every sender resolves straight away and never rejects — failures go to `onError`.\r\n */\r\nexport function eusendAuthEmails(options: EusendAuthEmailOptions): EusendAuthEmails {\r\n  const templates: Templates = { ...defaultTemplates, ...options.templates }\r\n  const context: TemplateContext = { appName: options.appName, brand: options.brand ?? {} }\r\n  const client = lazyClient(options)\r\n\r\n  const send = (category: EmailCategory, to: string, render: () => RenderedEmail) =>\r\n    detach(options, async () => {\r\n      try {\r\n        const email = render()\r\n        const message: SendEmailOptions = {\r\n          from: options.from,\r\n          to,\r\n          replyTo: options.replyTo,\r\n          subject: email.subject,\r\n          html: email.html,\r\n          text: email.text,\r\n          tags: { ...options.tags, source: 'better-auth', category: toTagValue(category) },\r\n          // A tracked link is rewritten through a redirect, and some security scanners\r\n          // follow every link in a message — which would burn a single-use sign-in or\r\n          // reset link before the user ever clicks it.\r\n          trackClicks: false,\r\n        }\r\n        const { error } = await client().emails.send(message)\r\n        if (error) reportError(options, { category, to, code: error.name, message: error.message })\r\n      } catch (error) {\r\n        reportError(options, {\r\n          category,\r\n          to,\r\n          code: 'NETWORK_ERROR',\r\n          message: error instanceof Error ? error.message : String(error),\r\n        })\r\n      }\r\n    })\r\n\r\n  return {\r\n    verification: ({ user, url }) => send('verification', user.email, () => templates.verification({ user, url }, context)),\r\n    resetPassword: ({ user, url }) =>\r\n      send('resetPassword', user.email, () => templates.resetPassword({ user, url }, context)),\r\n    passwordChanged: ({ user }) =>\r\n      send('passwordChanged', user.email, () => templates.passwordChanged({ user }, context)),\r\n    magicLink: ({ email, url }) => send('magicLink', email, () => templates.magicLink({ email, url }, context)),\r\n    otp: ({ email, otp, type }) => send('otp', email, () => templates.otp({ email, otp, type }, context)),\r\n    invitation: (data) =>\r\n      send('invitation', data.email, () =>\r\n        templates.invitation(\r\n          {\r\n            email: data.email,\r\n            url: invitationLink(options, data),\r\n            role: data.role,\r\n            organizationName: data.organization.name,\r\n            inviterName: data.inviter.user.name,\r\n            inviterEmail: data.inviter.user.email,\r\n          },\r\n          context,\r\n        ),\r\n      ),\r\n  }\r\n}\r\n\r\nfunction invitationLink(options: EusendAuthEmailOptions, data: InvitationData): string {\r\n  if (options.invitationUrl) return options.invitationUrl({ id: data.id, email: data.email })\r\n  if (!options.appUrl) {\r\n    throw new Error('Set `appUrl` or `invitationUrl` to send organization invitation emails.')\r\n  }\r\n  return safeUrl(`${options.appUrl.replace(/\\/+$/, '')}/accept-invitation/${encodeURIComponent(data.id)}`)\r\n}\r\n\r\n/** Tag values allow letters, digits, `_` and `-`, so `resetPassword` goes on the wire as `reset-password`. */\r\nfunction toTagValue(category: EmailCategory): string {\r\n  return category.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`)\r\n}\r\n","import { detach, lazyClient, reportError } from './emails'\r\nimport type { EusendClientOptions } from './emails'\r\n\r\nexport type SyncedUser = { id: string; email: string; name?: string | null; emailVerified?: boolean | null }\r\n\r\nexport type ContactSyncOptions = EusendClientOptions & {\r\n  /** The eusend audience verified users are added to. */\r\n  audienceId: string\r\n  /**\r\n   * Custom contact properties to set from the user, e.g. `(user) => ({ plan: user.plan })`.\r\n   * Merged into what the contact already has, never replacing it.\r\n   */\r\n  properties?: (user: SyncedUser) => Record<string, string>\r\n}\r\n\r\n/** Users carry one `name`; contacts carry two. \"Ada Lovelace King\" gives a last name of \"Lovelace King\". */\r\nexport function splitName(name: string | null | undefined): { firstName?: string; lastName?: string } {\r\n  const trimmed = name?.trim() ?? ''\r\n  if (!trimmed) return {}\r\n  const gap = trimmed.indexOf(' ')\r\n  if (gap === -1) return { firstName: trimmed }\r\n  return { firstName: trimmed.slice(0, gap), lastName: trimmed.slice(gap + 1) }\r\n}\r\n\r\n/**\r\n * Adds verified users to an audience.\r\n *\r\n * Unverified addresses are never synced. A signup form accepts typos and addresses that are\r\n * not the signer's own, and broadcasting to those is the bounce and complaint rate that gets\r\n * a sending domain blocked.\r\n *\r\n * The write goes through the batch endpoint, which merges instead of replacing: it cannot\r\n * clear an existing contact's properties or names, and it can add an opt-out but never\r\n * remove one. Someone who unsubscribed and then signs up stays unsubscribed.\r\n */\r\nexport function createContactSync(options: ContactSyncOptions) {\r\n  const client = lazyClient(options)\r\n\r\n  return (user: SyncedUser) =>\r\n    detach(options, async () => {\r\n      if (!user.emailVerified || !user.email) return\r\n      try {\r\n        const { error } = await client().audiences.batchCreateContacts(options.audienceId, {\r\n          contacts: [{ email: user.email, ...splitName(user.name), properties: options.properties?.(user) }],\r\n        })\r\n        if (error) {\r\n          reportError(options, { category: 'contactSync', to: user.email, code: error.name, message: error.message })\r\n        }\r\n      } catch (error) {\r\n        reportError(options, {\r\n          category: 'contactSync',\r\n          to: user.email,\r\n          code: 'NETWORK_ERROR',\r\n          message: error instanceof Error ? error.message : String(error),\r\n        })\r\n      }\r\n    })\r\n}\r\n","import type { BetterAuthPlugin } from 'better-auth'\r\n\r\nimport { eusendAuthEmails } from './emails'\r\nimport type { EusendAuthEmailOptions, EusendClientOptions } from './emails'\r\nimport { createContactSync } from './sync'\r\nimport type { ContactSyncOptions, SyncedUser } from './sync'\r\n\r\nexport { eusendAuthEmails } from './emails'\r\nexport type {\r\n  EmailCategory,\r\n  EusendAuthEmailOptions,\r\n  EusendAuthEmails,\r\n  EusendClientOptions,\r\n  EusendSendError,\r\n  InvitationData,\r\n} from './emails'\r\nexport { createContactSync, splitName } from './sync'\r\nexport type { ContactSyncOptions, SyncedUser } from './sync'\r\nexport { defaultTemplates, escapeHtml, renderLayout, safeUrl } from './templates'\r\nexport type { Brand, OtpType, RenderedEmail, TemplateContext, Templates } from './templates'\r\n\r\nexport type EusendPluginOptions = EusendClientOptions & {\r\n  /** Send Better Auth's verification, password-reset and password-changed emails. Omit to leave them to you. */\r\n  email?: Omit<EusendAuthEmailOptions, keyof EusendClientOptions>\r\n  /** Add users to an eusend audience once their email is verified. Omit to turn syncing off. */\r\n  sync?: Omit<ContactSyncOptions, keyof EusendClientOptions>\r\n}\r\n\r\n/**\r\n * Better Auth plugin for [eusend](https://eusend.dev), EU-native transactional email.\r\n *\r\n * Everything it sets is a default. Better Auth merges plugin options underneath the app's\r\n * own, so a `sendVerificationEmail` you already wrote keeps working and this plugin only\r\n * fills the gaps. Adding it cannot switch on password sign-in.\r\n */\r\nexport const eusend = (options: EusendPluginOptions = {}) => {\r\n  const { email, sync: syncOptions, ...client } = options\r\n  const emails = email ? eusendAuthEmails({ ...client, ...email }) : null\r\n  const sync = syncOptions ? createContactSync({ ...client, ...syncOptions }) : null\r\n\r\n  // Better Auth hands the same context object to an update's `before` and `after` hooks,\r\n  // which is how the update that sets `emailVerified` is told apart from a later name change.\r\n  const verifying = new WeakSet<object>()\r\n\r\n  return {\r\n    id: 'eusend',\r\n    init() {\r\n      return {\r\n        options: {\r\n          ...(emails\r\n            ? {\r\n                emailVerification: { sendVerificationEmail: emails.verification },\r\n                emailAndPassword: {\r\n                  // Required by the type. `false` is Better Auth's own default, and the app's\r\n                  // `enabled: true` wins the merge, so this can never switch password sign-in on.\r\n                  enabled: false,\r\n                  sendResetPassword: emails.resetPassword,\r\n                  onPasswordReset: emails.passwordChanged,\r\n                },\r\n              }\r\n            : {}),\r\n          // Database hooks, not endpoint hooks: they fire for every way a user is created or\r\n          // verified — email and password, OAuth, magic link, OTP, admin — and they run\r\n          // alongside the app's own database hooks rather than replacing them.\r\n          ...(sync\r\n            ? {\r\n                databaseHooks: {\r\n                  user: {\r\n                    create: {\r\n                      // OAuth users arrive already verified; everyone else waits for the update below.\r\n                      after: async (user: SyncedUser) => {\r\n                        await sync(user)\r\n                      },\r\n                    },\r\n                    update: {\r\n                      before: async (data: Partial<SyncedUser>, context: object | null) => {\r\n                        if (data.emailVerified === true && context) verifying.add(context)\r\n                      },\r\n                      after: async (user: SyncedUser, context: object | null) => {\r\n                        // Without a request context the two hooks cannot be paired, so a bare update\r\n                        // is never treated as a verification. Mailing someone who never confirmed\r\n                        // their address is a worse mistake than missing a sync.\r\n                        if (context && verifying.delete(context)) await sync(user)\r\n                      },\r\n                    },\r\n                  },\r\n                },\r\n              }\r\n            : {}),\r\n        },\r\n      }\r\n    },\r\n  } satisfies BetterAuthPlugin\r\n}\r\n"],"mappings":";;AA2CA,MAAM,gBAAgB;AAEtB,SAAgB,WAAW,OAAuB;CAChD,OAAO,MACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ,CAAC,CACvB,QAAQ,MAAM,OAAO;AAC1B;;;;;;AAOA,SAAgB,QAAQ,OAAuB;CAC7C,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,KAAK;EACzB,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS,OAAO,IAAI,SAAS;CACjF,QAAQ,CAAC;CACT,MAAM,IAAI,MAAM,kDAAkD,OAAO;AAC3E;AAEA,SAAS,MAAM,OAAsB;CACnC,MAAM,QAAQ,MAAM,cAAc,KAAK;CACvC,OAAO,SAAS,oBAAoB,KAAK,KAAK,IAAI,QAAQ;AAC5D;AAEA,SAAS,SAAS,MAAyC;CACzD,MAAM,QAAQ,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;CACxC,OAAO,QAAQ,MAAM,MAAM,KAAK;AAClC;AAIA,SAAgB,aACd,EAAE,SAAS,SACX,EAAE,WAAW,QAAQ,YACW;CAChC,MAAM,SAAS,MAAM,KAAK;CAC1B,MAAM,OAAO,MAAM,UACf,aAAa,WAAW,QAAQ,MAAM,OAAO,CAAC,EAAE,SAAS,WAAW,OAAO,EAAE,wFAC7E,6EAA6E,WAAW,OAAO,EAAE;CAErG,MAAM,OAAO,OACV,KAAK,UAAU;EACd,IAAI,MAAM,SAAS,KACjB,OAAO,4EAA4E,WAAW,MAAM,IAAI,EAAE;EAE5G,IAAI,MAAM,SAAS,QACjB,OAAO,wJAAwJ,WAAW,MAAM,IAAI,EAAE;EAExL,MAAM,OAAO,WAAW,QAAQ,MAAM,GAAG,CAAC;EAC1C,OAAO,oIAAoI,OAAO,aAAa,KAAK,uIAAuI,WAAW,MAAM,KAAK,EAAE;6HAC5M,KAAK,iBAAiB,OAAO,yBAAyB,KAAK;CACpL,CAAC,CAAC,CACD,KAAK,IAAI;CAEZ,MAAM,UAAU,MAAM,eAClB,wCAAwC,WAAW,MAAM,YAAY,EAAE,0BAA0B,WAAW,MAAM,YAAY,EAAE,SAChI;CAgCJ,OAAO;EAAE,MAAA;;;;yDA1B8C,WAAW,SAAS,EAAE;;;;;EAK7E,KAAK;EACL,KAAK;;;wLAGiL,WAAW,QAAQ,IAAI,QAAQ;;;;;EAiBtM,MAXF;GACX,GAAG,OAAO,KAAK,UAAU;IACvB,IAAI,MAAM,SAAS,KAAK,OAAO,MAAM;IACrC,IAAI,MAAM,SAAS,QAAQ,OAAO,MAAM;IACxC,OAAO,GAAG,MAAM,MAAM,IAAI,QAAQ,MAAM,GAAG;GAC7C,CAAC;GACD;GACA;GACA,YAAY,MAAM,eAAe,wBAAwB,MAAM,aAAa,KAAK;EACnF,CAAC,CAAC,KAAK,MAEW;CAAE;AACtB;AAEA,MAAM,WAA+D;CACnE,WAAW;EAAE,SAAS;EAAgB,MAAM;CAA8B;CAC1E,sBAAsB;EAAE,SAAS;EAAqB,MAAM;CAAiD;CAC7G,mBAAmB;EAAE,SAAS;EAAuB,MAAM;CAA2C;CACtG,gBAAgB;EAAE,SAAS;EAAkC,MAAM;CAAsD;AAC3H;AAEA,MAAa,mBAA8B;CACzC,eAAe,EAAE,MAAM,OAAO,aAAa;EACzC,SAAS,yBAAyB,QAAQ;EAC1C,GAAG,aAAa,SAAS;GACvB,WAAW,mDAAmD,QAAQ,QAAQ;GAC9E,QAAQ;IACN;KAAE,MAAM;KAAK,MAAM,SAAS,KAAK,IAAI;IAAE;IACvC;KAAE,MAAM;KAAK,MAAM,gBAAgB,KAAK,MAAM,mDAAmD,QAAQ,QAAQ;IAAW;IAC5H;KAAE,MAAM;KAAU,OAAO;KAAgB;IAAI;GAC/C;GACA,UAAU,0BAA0B,QAAQ,QAAQ;EACtD,CAAC;CACH;CAEA,gBAAgB,EAAE,MAAM,OAAO,aAAa;EAC1C,SAAS,cAAc,QAAQ,QAAQ;EACvC,GAAG,aAAa,SAAS;GACvB,WAAW,2CAA2C,KAAK,MAAM;GACjE,QAAQ;IACN;KAAE,MAAM;KAAK,MAAM,SAAS,KAAK,IAAI;IAAE;IACvC;KAAE,MAAM;KAAK,MAAM,gDAAgD,QAAQ,QAAQ;IAAmD;IACtI;KAAE,MAAM;KAAU,OAAO;KAAkB;IAAI;GACjD;GACA,UAAU;EACZ,CAAC;CACH;CAEA,kBAAkB,EAAE,QAAQ,aAAa;EACvC,SAAS,QAAQ,QAAQ,QAAQ;EACjC,GAAG,aAAa,SAAS;GACvB,WAAW,oBAAoB,KAAK,MAAM;GAC1C,QAAQ;IACN;KAAE,MAAM;KAAK,MAAM,SAAS,KAAK,IAAI;IAAE;IACvC;KAAE,MAAM;KAAK,MAAM,yBAAyB,QAAQ,QAAQ,YAAY,KAAK,MAAM;IAAqB;IACxG;KAAE,MAAM;KAAK,MAAM;IAA+C;GACpE;GACA,UAAU,0EAA0E,QAAQ,QAAQ;EACtG,CAAC;CACH;CAEA,YAAY,EAAE,OAAO,aAAa;EAChC,SAAS,cAAc,QAAQ;EAC/B,GAAG,aAAa,SAAS;GACvB,WAAW,yBAAyB,QAAQ,QAAQ;GACpD,QAAQ,CACN;IAAE,MAAM;IAAK,MAAM,sCAAsC,QAAQ,QAAQ;GAA4C,GACrH;IAAE,MAAM;IAAU,OAAO,cAAc,QAAQ;IAAW;GAAI,CAChE;GACA,UAAU;EACZ,CAAC;CACH;CAEA,MAAM,EAAE,KAAK,QAAQ,YAAY;EAC/B,MAAM,OAAO,SAAS,SAAS,SAAS;EACxC,OAAO;GACL,SAAS,QAAQ,QAAQ,QAAQ,GAAG,KAAK,QAAQ,IAAI;GACrD,GAAG,aAAa,SAAS;IACvB,WAAW,GAAG,KAAK,KAAK,GAAG,QAAQ,QAAQ;IAC3C,QAAQ;KACN;MAAE,MAAM;MAAK,MAAM,GAAG,KAAK,KAAK,GAAG,QAAQ,QAAQ;KAAG;KACtD;MAAE,MAAM;MAAQ,MAAM;KAAI;KAC1B;MAAE,MAAM;MAAK,MAAM;KAAwD;IAC7E;IACA,UAAU;GACZ,CAAC;EACH;CACF;CAEA,aAAa,EAAE,KAAK,kBAAkB,aAAa,cAAc,QAAQ,aAAa;EACpF,SAAS,GAAG,YAAY,kBAAkB,iBAAiB,MAAM,QAAQ;EACzE,GAAG,aAAa,SAAS;GACvB,WAAW,QAAQ,iBAAiB,MAAM,QAAQ,QAAQ;GAC1D,QAAQ,CACN;IAAE,MAAM;IAAK,MAAM,GAAG,YAAY,IAAI,aAAa,wBAAwB,iBAAiB,MAAM,QAAQ,QAAQ,MAAM,KAAK;GAAG,GAChI;IAAE,MAAM;IAAU,OAAO;IAAqB;GAAI,CACpD;GACA,UAAU;EACZ,CAAC;CACH;AACF;;;ACpJA,SAAgB,YAAY,SAA8B,OAA8B;CACtF,IAAI,QAAQ,SAAS;EACnB,IAAI;GACF,QAAQ,QAAQ,KAAK;EACvB,QAAQ,CAAC;EACT;CACF;CACA,QAAQ,MAAM,YAAY,MAAM,SAAS,OAAO,MAAM,GAAG,WAAW,MAAM,KAAK,KAAK,MAAM,SAAS;AACrG;;;;;;AAOA,SAAgB,OAAO,SAA8B,MAA0C;CAC7F,MAAM,UAAU,KAAK;CACrB,IAAI,QAAQ,WAAW,QAAQ,UAAU,OAAO;CAChD,OAAO,QAAQ,QAAQ;AACzB;AAEA,SAAgB,WAAW,SAA4C;CACrE,IAAI;CAGJ,aAAc,WAAW,IAAI,OAAO,QAAQ,QAAQ,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,KAAA,CAAS;AAChH;;;;;;;;;;;;AAaA,SAAgB,iBAAiB,SAAmD;CAClF,MAAM,YAAuB;EAAE,GAAG;EAAkB,GAAG,QAAQ;CAAU;CACzE,MAAM,UAA2B;EAAE,SAAS,QAAQ;EAAS,OAAO,QAAQ,SAAS,CAAC;CAAE;CACxF,MAAM,SAAS,WAAW,OAAO;CAEjC,MAAM,QAAQ,UAAyB,IAAY,WACjD,OAAO,SAAS,YAAY;EAC1B,IAAI;GACF,MAAM,QAAQ,OAAO;GACrB,MAAM,UAA4B;IAChC,MAAM,QAAQ;IACd;IACA,SAAS,QAAQ;IACjB,SAAS,MAAM;IACf,MAAM,MAAM;IACZ,MAAM,MAAM;IACZ,MAAM;KAAE,GAAG,QAAQ;KAAM,QAAQ;KAAe,UAAU,WAAW,QAAQ;IAAE;IAI/E,aAAa;GACf;GACA,MAAM,EAAE,UAAU,MAAM,OAAO,CAAC,CAAC,OAAO,KAAK,OAAO;GACpD,IAAI,OAAO,YAAY,SAAS;IAAE;IAAU;IAAI,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,CAAC;EAC5F,SAAS,OAAO;GACd,YAAY,SAAS;IACnB;IACA;IACA,MAAM;IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAChE,CAAC;EACH;CACF,CAAC;CAEH,OAAO;EACL,eAAe,EAAE,MAAM,UAAU,KAAK,gBAAgB,KAAK,aAAa,UAAU,aAAa;GAAE;GAAM;EAAI,GAAG,OAAO,CAAC;EACtH,gBAAgB,EAAE,MAAM,UACtB,KAAK,iBAAiB,KAAK,aAAa,UAAU,cAAc;GAAE;GAAM;EAAI,GAAG,OAAO,CAAC;EACzF,kBAAkB,EAAE,WAClB,KAAK,mBAAmB,KAAK,aAAa,UAAU,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC;EACxF,YAAY,EAAE,OAAO,UAAU,KAAK,aAAa,aAAa,UAAU,UAAU;GAAE;GAAO;EAAI,GAAG,OAAO,CAAC;EAC1G,MAAM,EAAE,OAAO,KAAK,WAAW,KAAK,OAAO,aAAa,UAAU,IAAI;GAAE;GAAO;GAAK;EAAK,GAAG,OAAO,CAAC;EACpG,aAAa,SACX,KAAK,cAAc,KAAK,aACtB,UAAU,WACR;GACE,OAAO,KAAK;GACZ,KAAK,eAAe,SAAS,IAAI;GACjC,MAAM,KAAK;GACX,kBAAkB,KAAK,aAAa;GACpC,aAAa,KAAK,QAAQ,KAAK;GAC/B,cAAc,KAAK,QAAQ,KAAK;EAClC,GACA,OACF,CACF;CACJ;AACF;AAEA,SAAS,eAAe,SAAiC,MAA8B;CACrF,IAAI,QAAQ,eAAe,OAAO,QAAQ,cAAc;EAAE,IAAI,KAAK;EAAI,OAAO,KAAK;CAAM,CAAC;CAC1F,IAAI,CAAC,QAAQ,QACX,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,QAAQ,GAAG,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,qBAAqB,mBAAmB,KAAK,EAAE,GAAG;AACzG;;AAGA,SAAS,WAAW,UAAiC;CACnD,OAAO,SAAS,QAAQ,WAAW,WAAW,IAAI,OAAO,YAAY,GAAG;AAC1E;;;;AC1KA,SAAgB,UAAU,MAA4E;CACpG,MAAM,UAAU,MAAM,KAAK,KAAK;CAChC,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,MAAM,QAAQ,QAAQ,GAAG;CAC/B,IAAI,QAAQ,IAAI,OAAO,EAAE,WAAW,QAAQ;CAC5C,OAAO;EAAE,WAAW,QAAQ,MAAM,GAAG,GAAG;EAAG,UAAU,QAAQ,MAAM,MAAM,CAAC;CAAE;AAC9E;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,SAA6B;CAC7D,MAAM,SAAS,WAAW,OAAO;CAEjC,QAAQ,SACN,OAAO,SAAS,YAAY;EAC1B,IAAI,CAAC,KAAK,iBAAiB,CAAC,KAAK,OAAO;EACxC,IAAI;GACF,MAAM,EAAE,UAAU,MAAM,OAAO,CAAC,CAAC,UAAU,oBAAoB,QAAQ,YAAY,EACjF,UAAU,CAAC;IAAE,OAAO,KAAK;IAAO,GAAG,UAAU,KAAK,IAAI;IAAG,YAAY,QAAQ,aAAa,IAAI;GAAE,CAAC,EACnG,CAAC;GACD,IAAI,OACF,YAAY,SAAS;IAAE,UAAU;IAAe,IAAI,KAAK;IAAO,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,CAAC;EAE9G,SAAS,OAAO;GACd,YAAY,SAAS;IACnB,UAAU;IACV,IAAI,KAAK;IACT,MAAM;IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAChE,CAAC;EACH;CACF,CAAC;AACL;;;;;;;;;;ACtBA,MAAa,UAAU,UAA+B,CAAC,MAAM;CAC3D,MAAM,EAAE,OAAO,MAAM,aAAa,GAAG,WAAW;CAChD,MAAM,SAAS,QAAQ,iBAAiB;EAAE,GAAG;EAAQ,GAAG;CAAM,CAAC,IAAI;CACnE,MAAM,OAAO,cAAc,kBAAkB;EAAE,GAAG;EAAQ,GAAG;CAAY,CAAC,IAAI;CAI9E,MAAM,4BAAY,IAAI,QAAgB;CAEtC,OAAO;EACL,IAAI;EACJ,OAAO;GACL,OAAO,EACL,SAAS;IACP,GAAI,SACA;KACE,mBAAmB,EAAE,uBAAuB,OAAO,aAAa;KAChE,kBAAkB;MAGhB,SAAS;MACT,mBAAmB,OAAO;MAC1B,iBAAiB,OAAO;KAC1B;IACF,IACA,CAAC;IAIL,GAAI,OACA,EACE,eAAe,EACb,MAAM;KACJ,QAAQ,EAEN,OAAO,OAAO,SAAqB;MACjC,MAAM,KAAK,IAAI;KACjB,EACF;KACA,QAAQ;MACN,QAAQ,OAAO,MAA2B,YAA2B;OACnE,IAAI,KAAK,kBAAkB,QAAQ,SAAS,UAAU,IAAI,OAAO;MACnE;MACA,OAAO,OAAO,MAAkB,YAA2B;OAIzD,IAAI,WAAW,UAAU,OAAO,OAAO,GAAG,MAAM,KAAK,IAAI;MAC3D;KACF;IACF,EACF,EACF,IACA,CAAC;GACP,EACF;EACF;CACF;AACF"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@eusend_dev/better-auth",
+  "version": "0.1.0",
+  "description": "Better Auth plugin for eusend — verification, password-reset, OTP, magic-link and invitation email from the EU, plus contact sync for verified users.",
+  "author": "Eusend",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eusend-dev/eusend-better-auth.git"
+  },
+  "homepage": "https://eusend.dev/docs/integrations/better-auth",
+  "bugs": "https://github.com/eusend-dev/eusend-better-auth/issues",
+  "keywords": [
+    "better-auth",
+    "better-auth-plugin",
+    "auth",
+    "email",
+    "eusend",
+    "transactional-email",
+    "gdpr"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsdown src/index.ts --format esm --dts",
+    "dev": "tsdown src/index.ts --format esm --dts --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@eusend_dev/sdk": "^0.18.0"
+  },
+  "peerDependencies": {
+    "better-auth": ">=1.6.0"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.4.2",
+    "@types/node": "^26.5.0",
+    "better-auth": "^1.6.23",
+    "tsdown": "^0.22.14",
+    "typescript": "^5.9.3"
+  }
+}