@lalternative/auth 0.10.3 → 0.10.4

package/dist/server.js

@@ -99,27 +99,43 @@ function createPlatformAuth(config) {
         enabled: false
       }
     },
-    // Passed through as given. The platform defines none of its own today, so
-    // there is nothing to merge; should it ever add one, this becomes a merge
-    // rather than a hand-off, or an app silently switches a platform hook off.
-    ...databaseHooks ? { databaseHooks } : {},
+    // Naming happens here rather than on /sign-up/email so that every way in
+    // is covered: a magic link that signs up bypasses the endpoint entirely
+    // and calls createUser straight, with `name: name || ""`.
+    databaseHooks: {
+      ...databaseHooks,
+      user: {
+        ...databaseHooks?.user,
+        create: {
+          ...databaseHooks?.user?.create,
+          before: async (user, ctx) => {
+            const named = withSignUpName(user);
+            const appHook = databaseHooks?.user?.create?.before;
+            const applied = await appHook?.(named, ctx);
+            if (applied === false) return false;
+            if (applied && typeof applied === "object" && "data" in applied) {
+              return { data: withSignUpName(applied.data) };
+            }
+            return { data: named };
+          }
+        }
+      }
+    },
     hooks: {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       before: async (ctx) => {
+        if (!betaMode) return;
         if (ctx.path !== "/sign-up/email") return;
         const body = ctx.body;
-        if (betaMode) {
-          const email = body?.email;
-          const inviteToken = body?.inviteToken;
-          const invited = email && inviteToken && isInvited ? await isInvited(email, inviteToken) : false;
-          if (!invited) {
-            throw new APIError("FORBIDDEN", {
-              message: "Registration is invite-only during the private beta."
-            });
-          }
+        const email = body?.email;
+        const inviteToken = body?.inviteToken;
+        if (email && inviteToken && isInvited) {
+          const ok = await isInvited(email, inviteToken);
+          if (ok) return;
         }
-        if (!body) return;
-        return { context: { body: withSignUpName(body) } };
+        throw new APIError("FORBIDDEN", {
+          message: "Registration is invite-only during the private beta."
+        });
       }
     },
     plugins: [

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts","../src/google-defaults.ts","../src/signup-name.ts"],"sourcesContent":["import { betterAuth, APIError, type Auth, type BetterAuthOptions } from \"better-auth\"\nimport { emailOTP, admin, magicLink } from \"better-auth/plugins\"\nimport type { PlatformAuthConfig, PlatformAuthMailerType } from \"./types\"\nimport { withGoogleDefaults } from \"./google-defaults\"\nimport { withSignUpName } from \"./signup-name\"\n\nconst DEFAULT_EMAIL_SUBJECTS: Record<string, string> = {\n  \"email-verification\": \"Verify your account\",\n  \"forget-password\": \"Reset your password\",\n  \"sign-in\": \"Your sign-in code\",\n}\n\nfunction defaultRenderOtpEmail(otp: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your verification code</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Use the code below to continue. It expires in 5 minutes.</p>\n                <div style=\"background:#f5f5f5;border-radius:8px;padding:24px;text-align:center;letter-spacing:8px;font-size:32px;font-weight:700\">\n                  ${otp}\n                </div>\n                <p style=\"color:#999;font-size:12px;margin-top:24px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\nfunction defaultRenderMagicLinkEmail(url: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your sign-in link</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Click the button below to sign in. The link expires in 5 minutes and works once.</p>\n                <a href=\"${url}\" style=\"display:inline-block;background:#111;color:#fff;text-decoration:none;border-radius:8px;padding:14px 28px;font-weight:600\">Sign in</a>\n                <p style=\"color:#999;font-size:12px;margin-top:24px;word-break:break-all\">Or paste this address into your browser:<br>${url}</p>\n                <p style=\"color:#999;font-size:12px;margin-top:16px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\n/**\n * Creates a Better Auth instance with platform defaults.\n * Each app calls this with its own config (DB, secret, providers, plugins).\n */\nexport function createPlatformAuth(\n  config: PlatformAuthConfig,\n): Auth<BetterAuthOptions> {\n  const {\n    database,\n    baseURL,\n    secret,\n    appName,\n    mailer,\n    google,\n    github,\n    plugins = [],\n    databaseHooks,\n    betaMode = false,\n    isInvited,\n    emailSubjects,\n    renderOtpEmail,\n    magicLink: magicLinkConfig,\n  } = config\n\n  const subjects = { ...DEFAULT_EMAIL_SUBJECTS, ...emailSubjects }\n  const renderEmail = renderOtpEmail ?? defaultRenderOtpEmail\n\n  // The concrete instance type (with email-otp/admin plugins) is widened to\n  // the base Auth type so the published .d.ts stays portable (inferring the\n  // full plugin type triggers TS2742 — it can't be named without a zod ref).\n  // The admin() plugin's user.role field is re-exposed via module augmentation\n  // below, so consumers (e.g. transcript-web me.ts) still see session.user.role.\n  return betterAuth({\n    database,\n    baseURL,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      requireEmailVerification: true,\n    },\n    // Never auto-merge a social identity into an existing account by matching\n    // email. Better Auth links by default (email-verified providers are trusted),\n    // so signing in with Google/GitHub on an email already registered would fold\n    // that identity into the existing account. We keep each sign-in method its\n    // own account: a social login on a taken email is refused, not linked.\n    account: {\n      accountLinking: {\n        enabled: false,\n      },\n    },\n    // Passed through as given. The platform defines none of its own today, so\n    // there is nothing to merge; should it ever add one, this becomes a merge\n    // rather than a hand-off, or an app silently switches a platform hook off.\n    ...(databaseHooks ? { databaseHooks } : {}),\n    hooks: {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      before: async (ctx: any) => {\n        if (ctx.path !== \"/sign-up/email\") return\n        const body = ctx.body as\n          | { email?: string; name?: string; inviteToken?: string }\n          | undefined\n\n        if (betaMode) {\n          const email = body?.email\n          const inviteToken = body?.inviteToken\n          const invited =\n            email && inviteToken && isInvited\n              ? await isInvited(email, inviteToken)\n              : false\n          if (!invited) {\n            throw new APIError(\"FORBIDDEN\", {\n              message: \"Registration is invite-only during the private beta.\",\n            })\n          }\n        }\n\n        if (!body) return\n        // Better Auth merges what a before hook returns under `context` into\n        // the request context, so only the amended body is handed back.\n        return { context: { body: withSignUpName(body) } }\n      },\n    },\n    plugins: [\n      emailOTP({\n        async sendVerificationOTP({ email, otp, type }) {\n          const subject = subjects[type]\n            ? `${subjects[type]} - ${appName}`\n            : `Your ${appName} code`\n          const html = renderEmail(otp, type as PlatformAuthMailerType)\n\n          if (mailer) {\n            await mailer({\n              to: email,\n              subject,\n              html,\n              type: type as PlatformAuthMailerType,\n              otp,\n            })\n            return\n          }\n\n          console.warn(\n            `[EMAIL] No mailer configured — logging OTP to stdout for ${email} (${type}): ${otp}`,\n          )\n        },\n        otpLength: 6,\n        expiresIn: 300,\n        overrideDefaultEmailVerification: true,\n      }),\n      ...(magicLinkConfig\n        ? [\n            magicLink({\n              expiresIn: magicLinkConfig.expiresIn ?? 300,\n              // A magic link that signs up walks past both gates the platform\n              // puts on the front door: requireEmailVerification, and the\n              // invite-only hook, which only guards /sign-up/email.\n              disableSignUp: !magicLinkConfig.allowSignUp,\n              async sendMagicLink({ email, url }) {\n                const subject =\n                  magicLinkConfig.subject ?? `Your sign-in link - ${appName}`\n                const html = (\n                  magicLinkConfig.render ?? defaultRenderMagicLinkEmail\n                )(url, email)\n\n                if (mailer) {\n                  await mailer({\n                    to: email,\n                    subject,\n                    html,\n                    type: \"magic-link\",\n                    url,\n                  })\n                  return\n                }\n\n                console.warn(\n                  `[EMAIL] No mailer configured — logging magic link to stdout for ${email}: ${url}`,\n                )\n              },\n            }),\n          ]\n        : []),\n      admin(),\n      ...plugins, // app-specific plugins (e.g. tanstackStartCookies)\n    ],\n    socialProviders: {\n      // Spread as given rather than rebuilt field by field: anything Better\n      // Auth accepts belongs to the app, and a config silently dropped on the\n      // way through is how an app ends up writing a plugin to put it back.\n      //\n      // The two defaults below are the platform's, not Google's: without\n      // accessType 'offline' Google never mints a refresh token, and without\n      // 'consent' it stops minting one for an account that already consented.\n      // A NULL refreshToken means deleting an account can revoke the access\n      // token but cannot remove the app from myaccount.google.com/permissions,\n      // so the grant outlives the account it belonged to.\n      ...(google ? { google: withGoogleDefaults(google) } : {}),\n      ...(github ? { github } : {}),\n    },\n  }) as unknown as Auth<BetterAuthOptions>\n}\n\nexport type PlatformAuth = ReturnType<typeof createPlatformAuth>\n\n// Re-export the session contract from /server so consumers that import the\n// auth factory can type api.getSession() without a second import path.\nexport type {\n  PlatformUser,\n  PlatformSession,\n  PlatformSessionData,\n} from \"./types\"\n\n// Invitation claiming runs on the auth callback, where the session is\n// established — the one place every sign-up flow passes through.\nexport {\n  claimInvitation,\n  completesSignup,\n  holdInviteTokenCookie,\n  invitationOutcomeCookie,\n  inviteTokenFrom,\n  isInvitationFailure,\n  pinInviteToken,\n  releaseInviteTokenCookie,\n} from \"./invitation\"\nexport type { ClaimOutcome, ClaimInvitationOptions } from \"./invitation\"\n","import type { PlatformAuthConfig } from \"./types\"\n\n/**\n * Applies the platform's Google defaults without touching what the app set.\n *\n * Better Auth also accepts a function returning the options, which cannot be\n * amended without calling it — such a config is passed straight through and\n * owns its own defaults.\n */\nexport function withGoogleDefaults(\n  google: NonNullable<PlatformAuthConfig[\"google\"]>,\n): NonNullable<PlatformAuthConfig[\"google\"]> {\n  if (typeof google === \"function\") return google\n  return {\n    ...google,\n    accessType: google.accessType ?? \"offline\",\n    prompt: google.prompt ?? \"select_account consent\",\n  }\n}\n\n","/**\n * Fills in the display name of an account signed up without one.\n *\n * The sign-up form treats the name as optional and omits the key when it is\n * left blank, but Better Auth's user schema requires it and rejects the\n * request with `[body.name] Invalid input`. Naming the account is the server's\n * call, so the default is applied here rather than invented by the client.\n *\n * The local part of the address is the closest thing to a name the person has\n * actually given us. It is only a starting label: they can change it later,\n * and nothing keys off it.\n */\nexport function withSignUpName<T extends { email?: unknown; name?: unknown }>(\n  body: T,\n): T & { name: string } {\n  const name = typeof body.name === \"string\" ? body.name.trim() : \"\"\n  if (name) return { ...body, name }\n\n  const email = typeof body.email === \"string\" ? body.email.trim() : \"\"\n  const at = email.lastIndexOf(\"@\")\n  const localPart = at > 0 ? email.slice(0, at) : email\n\n  return { ...body, name: localPart }\n}\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,YAAY,gBAAmD;AACxE,SAAS,UAAU,OAAO,iBAAiB;;;ACQpC,SAAS,mBACd,QAC2C;AAC3C,MAAI,OAAO,WAAW,WAAY,QAAO;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,OAAO,cAAc;AAAA,IACjC,QAAQ,OAAO,UAAU;AAAA,EAC3B;AACF;;;ACNO,SAAS,eACd,MACsB;AACtB,QAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AAChE,MAAI,KAAM,QAAO,EAAE,GAAG,MAAM,KAAK;AAEjC,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACnE,QAAM,KAAK,MAAM,YAAY,GAAG;AAChC,QAAM,YAAY,KAAK,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AAEhD,SAAO,EAAE,GAAG,MAAM,MAAM,UAAU;AACpC;;;AFjBA,IAAM,yBAAiD;AAAA,EACrD,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,WAAW;AACb;AAEA,SAAS,sBAAsB,KAAqB;AAClD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,oBAKW,GAAG;AAAA;AAAA;AAAA;AAAA;AAKvB;AAEA,SAAS,4BAA4B,KAAqB;AACxD,SAAO;AAAA;AAAA;AAAA;AAAA,2BAIkB,GAAG;AAAA,wIAC0G,GAAG;AAAA;AAAA;AAAA;AAI3I;AAMO,SAAS,mBACd,QACyB;AACzB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,CAAC;AAAA,IACX;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,IAAI;AAEJ,QAAM,WAAW,EAAE,GAAG,wBAAwB,GAAG,cAAc;AAC/D,QAAM,cAAc,kBAAkB;AAOtC,SAAO,WAAW;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT,0BAA0B;AAAA,IAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS;AAAA,MACP,gBAAgB;AAAA,QACd,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;AAAA;AAAA,IAIA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,OAAO;AAAA;AAAA,MAEL,QAAQ,OAAO,QAAa;AAC1B,YAAI,IAAI,SAAS,iBAAkB;AACnC,cAAM,OAAO,IAAI;AAIjB,YAAI,UAAU;AACZ,gBAAM,QAAQ,MAAM;AACpB,gBAAM,cAAc,MAAM;AAC1B,gBAAM,UACJ,SAAS,eAAe,YACpB,MAAM,UAAU,OAAO,WAAW,IAClC;AACN,cAAI,CAAC,SAAS;AACZ,kBAAM,IAAI,SAAS,aAAa;AAAA,cAC9B,SAAS;AAAA,YACX,CAAC;AAAA,UACH;AAAA,QACF;AAEA,YAAI,CAAC,KAAM;AAGX,eAAO,EAAE,SAAS,EAAE,MAAM,eAAe,IAAI,EAAE,EAAE;AAAA,MACnD;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,QACP,MAAM,oBAAoB,EAAE,OAAO,KAAK,KAAK,GAAG;AAC9C,gBAAM,UAAU,SAAS,IAAI,IACzB,GAAG,SAAS,IAAI,CAAC,MAAM,OAAO,KAC9B,QAAQ,OAAO;AACnB,gBAAM,OAAO,YAAY,KAAK,IAA8B;AAE5D,cAAI,QAAQ;AACV,kBAAM,OAAO;AAAA,cACX,IAAI;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF,CAAC;AACD;AAAA,UACF;AAEA,kBAAQ;AAAA,YACN,iEAA4D,KAAK,KAAK,IAAI,MAAM,GAAG;AAAA,UACrF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,kCAAkC;AAAA,MACpC,CAAC;AAAA,MACD,GAAI,kBACA;AAAA,QACE,UAAU;AAAA,UACR,WAAW,gBAAgB,aAAa;AAAA;AAAA;AAAA;AAAA,UAIxC,eAAe,CAAC,gBAAgB;AAAA,UAChC,MAAM,cAAc,EAAE,OAAO,IAAI,GAAG;AAClC,kBAAM,UACJ,gBAAgB,WAAW,uBAAuB,OAAO;AAC3D,kBAAM,QACJ,gBAAgB,UAAU,6BAC1B,KAAK,KAAK;AAEZ,gBAAI,QAAQ;AACV,oBAAM,OAAO;AAAA,gBACX,IAAI;AAAA,gBACJ;AAAA,gBACA;AAAA,gBACA,MAAM;AAAA,gBACN;AAAA,cACF,CAAC;AACD;AAAA,YACF;AAEA,oBAAQ;AAAA,cACN,wEAAmE,KAAK,KAAK,GAAG;AAAA,YAClF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,IACA,CAAC;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWf,GAAI,SAAS,EAAE,QAAQ,mBAAmB,MAAM,EAAE,IAAI,CAAC;AAAA,MACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/server.ts","../src/google-defaults.ts","../src/signup-name.ts"],"sourcesContent":["import { betterAuth, APIError, type Auth, type BetterAuthOptions } from \"better-auth\"\nimport { emailOTP, admin, magicLink } from \"better-auth/plugins\"\nimport type { PlatformAuthConfig, PlatformAuthMailerType } from \"./types\"\nimport { withGoogleDefaults } from \"./google-defaults\"\nimport { withSignUpName } from \"./signup-name\"\n\nconst DEFAULT_EMAIL_SUBJECTS: Record<string, string> = {\n  \"email-verification\": \"Verify your account\",\n  \"forget-password\": \"Reset your password\",\n  \"sign-in\": \"Your sign-in code\",\n}\n\nfunction defaultRenderOtpEmail(otp: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your verification code</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Use the code below to continue. It expires in 5 minutes.</p>\n                <div style=\"background:#f5f5f5;border-radius:8px;padding:24px;text-align:center;letter-spacing:8px;font-size:32px;font-weight:700\">\n                  ${otp}\n                </div>\n                <p style=\"color:#999;font-size:12px;margin-top:24px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\nfunction defaultRenderMagicLinkEmail(url: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your sign-in link</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Click the button below to sign in. The link expires in 5 minutes and works once.</p>\n                <a href=\"${url}\" style=\"display:inline-block;background:#111;color:#fff;text-decoration:none;border-radius:8px;padding:14px 28px;font-weight:600\">Sign in</a>\n                <p style=\"color:#999;font-size:12px;margin-top:24px;word-break:break-all\">Or paste this address into your browser:<br>${url}</p>\n                <p style=\"color:#999;font-size:12px;margin-top:16px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\n/**\n * Creates a Better Auth instance with platform defaults.\n * Each app calls this with its own config (DB, secret, providers, plugins).\n */\nexport function createPlatformAuth(\n  config: PlatformAuthConfig,\n): Auth<BetterAuthOptions> {\n  const {\n    database,\n    baseURL,\n    secret,\n    appName,\n    mailer,\n    google,\n    github,\n    plugins = [],\n    databaseHooks,\n    betaMode = false,\n    isInvited,\n    emailSubjects,\n    renderOtpEmail,\n    magicLink: magicLinkConfig,\n  } = config\n\n  const subjects = { ...DEFAULT_EMAIL_SUBJECTS, ...emailSubjects }\n  const renderEmail = renderOtpEmail ?? defaultRenderOtpEmail\n\n  // The concrete instance type (with email-otp/admin plugins) is widened to\n  // the base Auth type so the published .d.ts stays portable (inferring the\n  // full plugin type triggers TS2742 — it can't be named without a zod ref).\n  // The admin() plugin's user.role field is re-exposed via module augmentation\n  // below, so consumers (e.g. transcript-web me.ts) still see session.user.role.\n  return betterAuth({\n    database,\n    baseURL,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      requireEmailVerification: true,\n    },\n    // Never auto-merge a social identity into an existing account by matching\n    // email. Better Auth links by default (email-verified providers are trusted),\n    // so signing in with Google/GitHub on an email already registered would fold\n    // that identity into the existing account. We keep each sign-in method its\n    // own account: a social login on a taken email is refused, not linked.\n    account: {\n      accountLinking: {\n        enabled: false,\n      },\n    },\n    // Naming happens here rather than on /sign-up/email so that every way in\n    // is covered: a magic link that signs up bypasses the endpoint entirely\n    // and calls createUser straight, with `name: name || \"\"`.\n    databaseHooks: {\n      ...databaseHooks,\n      user: {\n        ...databaseHooks?.user,\n        create: {\n          ...databaseHooks?.user?.create,\n          before: async (user: Record<string, unknown>, ctx: unknown) => {\n            const named = withSignUpName(user)\n            const appHook = databaseHooks?.user?.create?.before\n            // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            const applied = await appHook?.(named as any, ctx as any)\n            if (applied === false) return false\n            if (applied && typeof applied === \"object\" && \"data\" in applied) {\n              return { data: withSignUpName(applied.data) }\n            }\n            return { data: named }\n          },\n        },\n      },\n    },\n    hooks: {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      before: async (ctx: any) => {\n        if (!betaMode) return\n        if (ctx.path !== \"/sign-up/email\") return\n        const body = ctx.body as { email?: string; inviteToken?: string } | undefined\n        const email = body?.email\n        const inviteToken = body?.inviteToken\n        if (email && inviteToken && isInvited) {\n          const ok = await isInvited(email, inviteToken)\n          if (ok) return\n        }\n        throw new APIError(\"FORBIDDEN\", {\n          message: \"Registration is invite-only during the private beta.\",\n        })\n      },\n    },\n    plugins: [\n      emailOTP({\n        async sendVerificationOTP({ email, otp, type }) {\n          const subject = subjects[type]\n            ? `${subjects[type]} - ${appName}`\n            : `Your ${appName} code`\n          const html = renderEmail(otp, type as PlatformAuthMailerType)\n\n          if (mailer) {\n            await mailer({\n              to: email,\n              subject,\n              html,\n              type: type as PlatformAuthMailerType,\n              otp,\n            })\n            return\n          }\n\n          console.warn(\n            `[EMAIL] No mailer configured — logging OTP to stdout for ${email} (${type}): ${otp}`,\n          )\n        },\n        otpLength: 6,\n        expiresIn: 300,\n        overrideDefaultEmailVerification: true,\n      }),\n      ...(magicLinkConfig\n        ? [\n            magicLink({\n              expiresIn: magicLinkConfig.expiresIn ?? 300,\n              // A magic link that signs up walks past both gates the platform\n              // puts on the front door: requireEmailVerification, and the\n              // invite-only hook, which only guards /sign-up/email.\n              disableSignUp: !magicLinkConfig.allowSignUp,\n              async sendMagicLink({ email, url }) {\n                const subject =\n                  magicLinkConfig.subject ?? `Your sign-in link - ${appName}`\n                const html = (\n                  magicLinkConfig.render ?? defaultRenderMagicLinkEmail\n                )(url, email)\n\n                if (mailer) {\n                  await mailer({\n                    to: email,\n                    subject,\n                    html,\n                    type: \"magic-link\",\n                    url,\n                  })\n                  return\n                }\n\n                console.warn(\n                  `[EMAIL] No mailer configured — logging magic link to stdout for ${email}: ${url}`,\n                )\n              },\n            }),\n          ]\n        : []),\n      admin(),\n      ...plugins, // app-specific plugins (e.g. tanstackStartCookies)\n    ],\n    socialProviders: {\n      // Spread as given rather than rebuilt field by field: anything Better\n      // Auth accepts belongs to the app, and a config silently dropped on the\n      // way through is how an app ends up writing a plugin to put it back.\n      //\n      // The two defaults below are the platform's, not Google's: without\n      // accessType 'offline' Google never mints a refresh token, and without\n      // 'consent' it stops minting one for an account that already consented.\n      // A NULL refreshToken means deleting an account can revoke the access\n      // token but cannot remove the app from myaccount.google.com/permissions,\n      // so the grant outlives the account it belonged to.\n      ...(google ? { google: withGoogleDefaults(google) } : {}),\n      ...(github ? { github } : {}),\n    },\n  }) as unknown as Auth<BetterAuthOptions>\n}\n\nexport type PlatformAuth = ReturnType<typeof createPlatformAuth>\n\n// Re-export the session contract from /server so consumers that import the\n// auth factory can type api.getSession() without a second import path.\nexport type {\n  PlatformUser,\n  PlatformSession,\n  PlatformSessionData,\n} from \"./types\"\n\n// Invitation claiming runs on the auth callback, where the session is\n// established — the one place every sign-up flow passes through.\nexport {\n  claimInvitation,\n  completesSignup,\n  holdInviteTokenCookie,\n  invitationOutcomeCookie,\n  inviteTokenFrom,\n  isInvitationFailure,\n  pinInviteToken,\n  releaseInviteTokenCookie,\n} from \"./invitation\"\nexport type { ClaimOutcome, ClaimInvitationOptions } from \"./invitation\"\n","import type { PlatformAuthConfig } from \"./types\"\n\n/**\n * Applies the platform's Google defaults without touching what the app set.\n *\n * Better Auth also accepts a function returning the options, which cannot be\n * amended without calling it — such a config is passed straight through and\n * owns its own defaults.\n */\nexport function withGoogleDefaults(\n  google: NonNullable<PlatformAuthConfig[\"google\"]>,\n): NonNullable<PlatformAuthConfig[\"google\"]> {\n  if (typeof google === \"function\") return google\n  return {\n    ...google,\n    accessType: google.accessType ?? \"offline\",\n    prompt: google.prompt ?? \"select_account consent\",\n  }\n}\n\n","/**\n * Fills in the display name of an account signed up without one.\n *\n * The sign-up form treats the name as optional and omits the key when it is\n * left blank, but Better Auth's user schema requires it and rejects the\n * request with `[body.name] Invalid input`. Naming the account is the server's\n * call, so the default is applied here rather than invented by the client.\n *\n * The local part of the address is the closest thing to a name the person has\n * actually given us. It is only a starting label: they can change it later,\n * and nothing keys off it.\n */\nexport function withSignUpName<T extends { email?: unknown; name?: unknown }>(\n  body: T,\n): T & { name: string } {\n  const name = typeof body.name === \"string\" ? body.name.trim() : \"\"\n  if (name) return { ...body, name }\n\n  const email = typeof body.email === \"string\" ? body.email.trim() : \"\"\n  const at = email.lastIndexOf(\"@\")\n  const localPart = at > 0 ? email.slice(0, at) : email\n\n  return { ...body, name: localPart }\n}\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,YAAY,gBAAmD;AACxE,SAAS,UAAU,OAAO,iBAAiB;;;ACQpC,SAAS,mBACd,QAC2C;AAC3C,MAAI,OAAO,WAAW,WAAY,QAAO;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,OAAO,cAAc;AAAA,IACjC,QAAQ,OAAO,UAAU;AAAA,EAC3B;AACF;;;ACNO,SAAS,eACd,MACsB;AACtB,QAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AAChE,MAAI,KAAM,QAAO,EAAE,GAAG,MAAM,KAAK;AAEjC,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACnE,QAAM,KAAK,MAAM,YAAY,GAAG;AAChC,QAAM,YAAY,KAAK,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI;AAEhD,SAAO,EAAE,GAAG,MAAM,MAAM,UAAU;AACpC;;;AFjBA,IAAM,yBAAiD;AAAA,EACrD,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,WAAW;AACb;AAEA,SAAS,sBAAsB,KAAqB;AAClD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,oBAKW,GAAG;AAAA;AAAA;AAAA;AAAA;AAKvB;AAEA,SAAS,4BAA4B,KAAqB;AACxD,SAAO;AAAA;AAAA;AAAA;AAAA,2BAIkB,GAAG;AAAA,wIAC0G,GAAG;AAAA;AAAA;AAAA;AAI3I;AAMO,SAAS,mBACd,QACyB;AACzB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,CAAC;AAAA,IACX;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,IAAI;AAEJ,QAAM,WAAW,EAAE,GAAG,wBAAwB,GAAG,cAAc;AAC/D,QAAM,cAAc,kBAAkB;AAOtC,SAAO,WAAW;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT,0BAA0B;AAAA,IAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS;AAAA,MACP,gBAAgB;AAAA,QACd,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;AAAA;AAAA,IAIA,eAAe;AAAA,MACb,GAAG;AAAA,MACH,MAAM;AAAA,QACJ,GAAG,eAAe;AAAA,QAClB,QAAQ;AAAA,UACN,GAAG,eAAe,MAAM;AAAA,UACxB,QAAQ,OAAO,MAA+B,QAAiB;AAC7D,kBAAM,QAAQ,eAAe,IAAI;AACjC,kBAAM,UAAU,eAAe,MAAM,QAAQ;AAE7C,kBAAM,UAAU,MAAM,UAAU,OAAc,GAAU;AACxD,gBAAI,YAAY,MAAO,QAAO;AAC9B,gBAAI,WAAW,OAAO,YAAY,YAAY,UAAU,SAAS;AAC/D,qBAAO,EAAE,MAAM,eAAe,QAAQ,IAAI,EAAE;AAAA,YAC9C;AACA,mBAAO,EAAE,MAAM,MAAM;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,MAEL,QAAQ,OAAO,QAAa;AAC1B,YAAI,CAAC,SAAU;AACf,YAAI,IAAI,SAAS,iBAAkB;AACnC,cAAM,OAAO,IAAI;AACjB,cAAM,QAAQ,MAAM;AACpB,cAAM,cAAc,MAAM;AAC1B,YAAI,SAAS,eAAe,WAAW;AACrC,gBAAM,KAAK,MAAM,UAAU,OAAO,WAAW;AAC7C,cAAI,GAAI;AAAA,QACV;AACA,cAAM,IAAI,SAAS,aAAa;AAAA,UAC9B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,QACP,MAAM,oBAAoB,EAAE,OAAO,KAAK,KAAK,GAAG;AAC9C,gBAAM,UAAU,SAAS,IAAI,IACzB,GAAG,SAAS,IAAI,CAAC,MAAM,OAAO,KAC9B,QAAQ,OAAO;AACnB,gBAAM,OAAO,YAAY,KAAK,IAA8B;AAE5D,cAAI,QAAQ;AACV,kBAAM,OAAO;AAAA,cACX,IAAI;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF,CAAC;AACD;AAAA,UACF;AAEA,kBAAQ;AAAA,YACN,iEAA4D,KAAK,KAAK,IAAI,MAAM,GAAG;AAAA,UACrF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,kCAAkC;AAAA,MACpC,CAAC;AAAA,MACD,GAAI,kBACA;AAAA,QACE,UAAU;AAAA,UACR,WAAW,gBAAgB,aAAa;AAAA;AAAA;AAAA;AAAA,UAIxC,eAAe,CAAC,gBAAgB;AAAA,UAChC,MAAM,cAAc,EAAE,OAAO,IAAI,GAAG;AAClC,kBAAM,UACJ,gBAAgB,WAAW,uBAAuB,OAAO;AAC3D,kBAAM,QACJ,gBAAgB,UAAU,6BAC1B,KAAK,KAAK;AAEZ,gBAAI,QAAQ;AACV,oBAAM,OAAO;AAAA,gBACX,IAAI;AAAA,gBACJ;AAAA,gBACA;AAAA,gBACA,MAAM;AAAA,gBACN;AAAA,cACF,CAAC;AACD;AAAA,YACF;AAEA,oBAAQ;AAAA,cACN,wEAAmE,KAAK,KAAK,GAAG;AAAA,YAClF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,IACA,CAAC;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWf,GAAI,SAAS,EAAE,QAAQ,mBAAmB,MAAM,EAAE,IAAI,CAAC;AAAA,MACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lalternative/auth",
-  "version": "0.10.3",
+  "version": "0.10.4",
   "description": "Shared Better Auth wrapper for L'Alternative apps (server + React client + auth UI)",
   "type": "module",
   "main": "./dist/index.js",