@mastra/auth-better-auth 0.0.0-auth-and-authz-20260131004229 → 0.0.0-auth-and-authz-20260202232929

package/CHANGELOG.md

@@ -1,11 +1,11 @@
 # @mastra/auth-better-auth
 
-## 0.0.0-auth-and-authz-20260131004229
+## 0.0.0-auth-and-authz-20260202232929
 
 ### Patch Changes
 
 - Updated dependencies [[`5fe1fe0`](https://github.com/mastra-ai/mastra/commit/5fe1fe0109faf2c87db34b725d8a4571a594f80e), [`aa37c84`](https://github.com/mastra-ai/mastra/commit/aa37c84d29b7db68c72517337932ef486c316275), [`47eba72`](https://github.com/mastra-ai/mastra/commit/47eba72f0397d0d14fbe324b97940c3d55e5a525)]:
-  - @mastra/core@0.0.0-auth-and-authz-20260131004229
+  - @mastra/core@0.0.0-auth-and-authz-20260202232929
 
 ## 1.0.0
 

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["MastraAuthProvider"],"mappings":";;;;;AAmBA,SAAS,0BAA0B,IAAA,EAAoB;AACrD,EAAA,OAAO;AAAA,IACL,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,SAAA,EAAW,KAAK,KAAA,IAAS,MAAA;AAAA,IACzB,QAAA,EAAU;AAAA,MACR,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA;AAClB,GACF;AACF;AAsDO,IAAM,oBAAA,GAAN,cACGA,yBAAA,CAEV;AAAA,EACY,IAAA;AAAA,EACA,mBAAA;AAAA,EAEV,YAAY,OAAA,EAAsC;AAChD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,eAAe,CAAA;AAE9C,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,mBAAA,GAAsB,QAAQ,aAAA,IAAiB,IAAA;AAEpD,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAA2B;AACzB,IAAA,OAAO,IAAA,CAAK,mBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,eAAe,OAAA,EAA0C;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C,SAAS,OAAA,CAAQ;AAAA,OAClB,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA;AAC1B,MAAA,OAAO,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAQ,OAAA,EAAyC;AAIrD,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KAEF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAAsD;AAC3F,IAAA,IAAI;AAGF,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAG5B,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,eAAe,CAAA;AACjD,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAAA,MACzC,WAAW,KAAA,EAAO;AAEhB,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAGA,MAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAC5C,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,MACpC;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,IAAA,EAAM;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO;AAAA,QACL,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAM,MAAA,CAAO;AAAA,OACf;AAAA,IACF,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,IAAA,EAAwC;AAE1D,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,OAAA,EAAS,MAAM,CAAC,CAAC,MAAM,IAAA,EAAM,EAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,MAAA,CAAO,KAAA,EAAe,QAAA,EAAkB,OAAA,EAAsD;AAClG,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAS;AAAA,MACxB,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CACJ,KAAA,EACA,QAAA,EACA,MACA,OAAA,EACoC;AACpC,IAAA,MAAM,cAAc,IAAA,IAAQ,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,MAAA;AACnD,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,WAAA,EAAY;AAAA,MAC3C,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,0BAA0B,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,sBAAA,GAAiD;AAG/C,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,uEAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,YAAA,EAAc,OAAA,CAAQ,IAAA,CAAK,IAAI;AAAA,KACjC;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { IUserProvider, ICredentialsProvider, EEUser, CredentialsResult } from '@mastra/core/ee';\nimport type { MastraAuthProviderOptions } from '@mastra/core/server';\nimport { MastraAuthProvider } from '@mastra/core/server';\n\nimport type { Auth, Session, User } from 'better-auth';\nimport type { HonoRequest } from 'hono';\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n  session: Session;\n  user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    avatarUrl: user.image ?? undefined,\n    metadata: {\n      emailVerified: user.emailVerified,\n      createdAt: user.createdAt,\n      updatedAt: user.updatedAt,\n    },\n  };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n  /**\n   * The Better Auth instance to use for authentication.\n   * This should be the result of calling `betterAuth({ ... })`.\n   */\n  auth: Auth;\n\n  /**\n   * Whether to allow new user registration via sign-up.\n   * Set to false to disable public registration.\n   * @default true\n   */\n  signUpEnabled?: boolean;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n *   database: {\n *     provider: 'postgresql',\n *     url: process.env.DATABASE_URL!,\n *   },\n *   emailAndPassword: {\n *     enabled: true,\n *   },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n *   auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n *   server: {\n *     auth: mastraAuth,\n *   },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n  extends MastraAuthProvider<BetterAuthUser>\n  implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>\n{\n  protected auth: Auth;\n  protected signUpEnabledConfig: boolean;\n\n  constructor(options: MastraAuthBetterAuthOptions) {\n    super({ name: options?.name ?? 'better-auth' });\n\n    if (!options.auth) {\n      throw new Error(\n        'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... })',\n      );\n    }\n\n    this.auth = options.auth;\n    this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n    this.registerOptions(options);\n  }\n\n  /**\n   * Check if sign-up is enabled.\n   * Implements ICredentialsProvider.isSignUpEnabled.\n   */\n  isSignUpEnabled(): boolean {\n    return this.signUpEnabledConfig;\n  }\n\n  // ============================================\n  // IUserProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Get current user from request.\n   * Implements IUserProvider for EE user awareness in Studio.\n   *\n   * @param request - Incoming HTTP request\n   * @returns EE User object or null if not authenticated\n   */\n  async getCurrentUser(request: Request): Promise<EEUser | null> {\n    try {\n      const result = await this.auth.api.getSession({\n        headers: request.headers,\n      });\n\n      if (!result?.user) return null;\n      return mapBetterAuthUserToEEUser(result.user);\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Get user by ID.\n   * Implements IUserProvider for EE user awareness.\n   *\n   * Note: Better Auth doesn't expose a direct getUser API.\n   * For full functionality, you may need to implement this using\n   * direct database access in a subclass.\n   *\n   * @param userId - User identifier\n   * @returns EE User object or null if not found\n   */\n  async getUser(_userId: string): Promise<EEUser | null> {\n    // Better Auth doesn't have a direct getUser API\n    // Users can override this method with their own implementation\n    // that queries the database directly\n    console.warn(\n      '[MastraAuthBetterAuth] getUser() requires direct database access. ' +\n        'Override this method in a subclass for full user lookup support.',\n    );\n    return null;\n  }\n\n  /**\n   * Get URL to user's profile page.\n   * Optional IUserProvider method.\n   */\n  getUserProfileUrl(user: EEUser): string {\n    return `/profile/${user.id}`;\n  }\n\n  /**\n   * Authenticate a bearer token by verifying the session with Better Auth.\n   *\n   * This method extracts the session from the request headers using\n   * Better Auth's `api.getSession()` endpoint.\n   *\n   * @param token - The bearer token (session token) to authenticate\n   * @param request - The Hono request object containing headers\n   * @returns The authenticated user and session, or null if authentication fails\n   */\n  async authenticateToken(token: string, request: HonoRequest): Promise<BetterAuthUser | null> {\n    try {\n      // Better Auth expects the token to be passed via headers\n      // We need to construct headers with the Authorization bearer token\n      const headers = new Headers();\n\n      // Copy relevant headers from the request\n      const authHeader = request.header('Authorization');\n      if (authHeader) {\n        headers.set('Authorization', authHeader);\n      } else if (token) {\n        // If no auth header but token is provided, set it\n        headers.set('Authorization', `Bearer ${token}`);\n      }\n\n      // Copy cookie header if present (Better Auth can use cookies for sessions)\n      const cookieHeader = request.header('Cookie');\n      if (cookieHeader) {\n        headers.set('Cookie', cookieHeader);\n      }\n\n      // Use Better Auth's API to get the session\n      const result = await this.auth.api.getSession({\n        headers,\n      });\n\n      if (!result || !result.session || !result.user) {\n        return null;\n      }\n\n      return {\n        session: result.session,\n        user: result.user,\n      };\n    } catch {\n      // Session verification failed\n      return null;\n    }\n  }\n\n  /**\n   * Authorize a user for access.\n   *\n   * By default, any authenticated user with a valid session is authorized.\n   * You can override this behavior by providing a custom `authorizeUser` function\n   * in the constructor options.\n   *\n   * @param user - The authenticated user and session\n   * @returns True if the user is authorized, false otherwise\n   */\n  async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n    // By default, any authenticated user with a valid session is authorized\n    return !!user?.session?.id && !!user?.user?.id;\n  }\n\n  // ============================================\n  // ICredentialsProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Sign in with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param request - Incoming HTTP request\n   * @returns Result with user and session cookies\n   * @throws Error if credentials are invalid\n   */\n  async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signInEmail({\n      body: { email, password },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Invalid email or password');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Invalid email or password');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Sign up with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param name - Optional display name\n   * @param request - Incoming HTTP request\n   * @returns Result with new user and session cookies\n   * @throws Error if sign up fails\n   */\n  async signUp(\n    email: string,\n    password: string,\n    name: string | undefined,\n    request: Request,\n  ): Promise<CredentialsResult<EEUser>> {\n    const displayName = name ?? email.split('@')[0] ?? 'User';\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signUpEmail({\n      body: { email, password, name: displayName },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Failed to create account');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Failed to create account');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Get the underlying Better Auth instance.\n   * Useful for accessing Better Auth APIs directly.\n   */\n  getAuth(): Auth {\n    return this.auth;\n  }\n\n  /**\n   * Get headers to clear the session cookies on logout.\n   * Partial ISessionProvider implementation for logout support.\n   *\n   * Clears Better Auth's default session cookies.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    // Better Auth uses these cookie names by default\n    // Clear both the session token and its signature cookie\n    const cookies = [\n      'better-auth.session_token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n      'better-auth.session_token_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    ];\n    return {\n      'Set-Cookie': cookies.join(', '),\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["MastraAuthProvider"],"mappings":";;;;;AAmBA,SAAS,0BAA0B,IAAA,EAAoB;AACrD,EAAA,OAAO;AAAA,IACL,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,SAAA,EAAW,KAAK,KAAA,IAAS,MAAA;AAAA,IACzB,QAAA,EAAU;AAAA,MACR,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA;AAClB,GACF;AACF;AAsDO,IAAM,oBAAA,GAAN,cACGA,yBAAA,CAEV;AAAA,EACY,IAAA;AAAA,EACA,mBAAA;AAAA,EAEV,YAAY,OAAA,EAAsC;AAChD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,eAAe,CAAA;AAE9C,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,mBAAA,GAAsB,QAAQ,aAAA,IAAiB,IAAA;AAEpD,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAA2B;AACzB,IAAA,OAAO,IAAA,CAAK,mBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,eAAe,OAAA,EAA0C;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C,SAAS,OAAA,CAAQ;AAAA,OAClB,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA;AAC1B,MAAA,OAAO,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAQ,OAAA,EAAyC;AAIrD,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KAEF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAAsD;AAC3F,IAAA,IAAI;AAGF,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAG5B,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,eAAe,CAAA;AACjD,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAAA,MACzC,WAAW,KAAA,EAAO;AAEhB,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAGA,MAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAC5C,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,MACpC;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,IAAA,EAAM;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO;AAAA,QACL,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAM,MAAA,CAAO;AAAA,OACf;AAAA,IACF,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,IAAA,EAAwC;AAE1D,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,OAAA,EAAS,MAAM,CAAC,CAAC,MAAM,IAAA,EAAM,EAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,MAAA,CAAO,KAAA,EAAe,QAAA,EAAkB,OAAA,EAAsD;AAClG,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAS;AAAA,MACxB,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CACJ,KAAA,EACA,QAAA,EACA,MACA,OAAA,EACoC;AACpC,IAAA,MAAM,cAAc,IAAA,IAAQ,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,MAAA;AACnD,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,WAAA,EAAY;AAAA,MAC3C,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,0BAA0B,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,sBAAA,GAAiD;AAG/C,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,uEAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,YAAA,EAAc,OAAA,CAAQ,IAAA,CAAK,IAAI;AAAA,KACjC;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { IUserProvider, ICredentialsProvider, EEUser, CredentialsResult } from '@mastra/core/auth';\nimport type { MastraAuthProviderOptions } from '@mastra/core/server';\nimport { MastraAuthProvider } from '@mastra/core/server';\n\nimport type { Auth, Session, User } from 'better-auth';\nimport type { HonoRequest } from 'hono';\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n  session: Session;\n  user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    avatarUrl: user.image ?? undefined,\n    metadata: {\n      emailVerified: user.emailVerified,\n      createdAt: user.createdAt,\n      updatedAt: user.updatedAt,\n    },\n  };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n  /**\n   * The Better Auth instance to use for authentication.\n   * This should be the result of calling `betterAuth({ ... })`.\n   */\n  auth: Auth;\n\n  /**\n   * Whether to allow new user registration via sign-up.\n   * Set to false to disable public registration.\n   * @default true\n   */\n  signUpEnabled?: boolean;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n *   database: {\n *     provider: 'postgresql',\n *     url: process.env.DATABASE_URL!,\n *   },\n *   emailAndPassword: {\n *     enabled: true,\n *   },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n *   auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n *   server: {\n *     auth: mastraAuth,\n *   },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n  extends MastraAuthProvider<BetterAuthUser>\n  implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>\n{\n  protected auth: Auth;\n  protected signUpEnabledConfig: boolean;\n\n  constructor(options: MastraAuthBetterAuthOptions) {\n    super({ name: options?.name ?? 'better-auth' });\n\n    if (!options.auth) {\n      throw new Error(\n        'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... })',\n      );\n    }\n\n    this.auth = options.auth;\n    this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n    this.registerOptions(options);\n  }\n\n  /**\n   * Check if sign-up is enabled.\n   * Implements ICredentialsProvider.isSignUpEnabled.\n   */\n  isSignUpEnabled(): boolean {\n    return this.signUpEnabledConfig;\n  }\n\n  // ============================================\n  // IUserProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Get current user from request.\n   * Implements IUserProvider for EE user awareness in Studio.\n   *\n   * @param request - Incoming HTTP request\n   * @returns EE User object or null if not authenticated\n   */\n  async getCurrentUser(request: Request): Promise<EEUser | null> {\n    try {\n      const result = await this.auth.api.getSession({\n        headers: request.headers,\n      });\n\n      if (!result?.user) return null;\n      return mapBetterAuthUserToEEUser(result.user);\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Get user by ID.\n   * Implements IUserProvider for EE user awareness.\n   *\n   * Note: Better Auth doesn't expose a direct getUser API.\n   * For full functionality, you may need to implement this using\n   * direct database access in a subclass.\n   *\n   * @param userId - User identifier\n   * @returns EE User object or null if not found\n   */\n  async getUser(_userId: string): Promise<EEUser | null> {\n    // Better Auth doesn't have a direct getUser API\n    // Users can override this method with their own implementation\n    // that queries the database directly\n    console.warn(\n      '[MastraAuthBetterAuth] getUser() requires direct database access. ' +\n        'Override this method in a subclass for full user lookup support.',\n    );\n    return null;\n  }\n\n  /**\n   * Get URL to user's profile page.\n   * Optional IUserProvider method.\n   */\n  getUserProfileUrl(user: EEUser): string {\n    return `/profile/${user.id}`;\n  }\n\n  /**\n   * Authenticate a bearer token by verifying the session with Better Auth.\n   *\n   * This method extracts the session from the request headers using\n   * Better Auth's `api.getSession()` endpoint.\n   *\n   * @param token - The bearer token (session token) to authenticate\n   * @param request - The Hono request object containing headers\n   * @returns The authenticated user and session, or null if authentication fails\n   */\n  async authenticateToken(token: string, request: HonoRequest): Promise<BetterAuthUser | null> {\n    try {\n      // Better Auth expects the token to be passed via headers\n      // We need to construct headers with the Authorization bearer token\n      const headers = new Headers();\n\n      // Copy relevant headers from the request\n      const authHeader = request.header('Authorization');\n      if (authHeader) {\n        headers.set('Authorization', authHeader);\n      } else if (token) {\n        // If no auth header but token is provided, set it\n        headers.set('Authorization', `Bearer ${token}`);\n      }\n\n      // Copy cookie header if present (Better Auth can use cookies for sessions)\n      const cookieHeader = request.header('Cookie');\n      if (cookieHeader) {\n        headers.set('Cookie', cookieHeader);\n      }\n\n      // Use Better Auth's API to get the session\n      const result = await this.auth.api.getSession({\n        headers,\n      });\n\n      if (!result || !result.session || !result.user) {\n        return null;\n      }\n\n      return {\n        session: result.session,\n        user: result.user,\n      };\n    } catch {\n      // Session verification failed\n      return null;\n    }\n  }\n\n  /**\n   * Authorize a user for access.\n   *\n   * By default, any authenticated user with a valid session is authorized.\n   * You can override this behavior by providing a custom `authorizeUser` function\n   * in the constructor options.\n   *\n   * @param user - The authenticated user and session\n   * @returns True if the user is authorized, false otherwise\n   */\n  async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n    // By default, any authenticated user with a valid session is authorized\n    return !!user?.session?.id && !!user?.user?.id;\n  }\n\n  // ============================================\n  // ICredentialsProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Sign in with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param request - Incoming HTTP request\n   * @returns Result with user and session cookies\n   * @throws Error if credentials are invalid\n   */\n  async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signInEmail({\n      body: { email, password },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Invalid email or password');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Invalid email or password');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Sign up with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param name - Optional display name\n   * @param request - Incoming HTTP request\n   * @returns Result with new user and session cookies\n   * @throws Error if sign up fails\n   */\n  async signUp(\n    email: string,\n    password: string,\n    name: string | undefined,\n    request: Request,\n  ): Promise<CredentialsResult<EEUser>> {\n    const displayName = name ?? email.split('@')[0] ?? 'User';\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signUpEmail({\n      body: { email, password, name: displayName },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Failed to create account');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Failed to create account');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Get the underlying Better Auth instance.\n   * Useful for accessing Better Auth APIs directly.\n   */\n  getAuth(): Auth {\n    return this.auth;\n  }\n\n  /**\n   * Get headers to clear the session cookies on logout.\n   * Partial ISessionProvider implementation for logout support.\n   *\n   * Clears Better Auth's default session cookies.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    // Better Auth uses these cookie names by default\n    // Clear both the session token and its signature cookie\n    const cookies = [\n      'better-auth.session_token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n      'better-auth.session_token_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    ];\n    return {\n      'Set-Cookie': cookies.join(', '),\n    };\n  }\n}\n"]}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { IUserProvider, ICredentialsProvider, EEUser, CredentialsResult } from '@mastra/core/ee';
+import type { IUserProvider, ICredentialsProvider, EEUser, CredentialsResult } from '@mastra/core/auth';
 import type { MastraAuthProviderOptions } from '@mastra/core/server';
 import { MastraAuthProvider } from '@mastra/core/server';
 import type { Auth, Session, User } from 'better-auth';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACtG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAmBD,UAAU,2BAA4B,SAAQ,yBAAyB,CAAC,cAAc,CAAC;IACrF;;;OAGG;IACH,IAAI,EAAE,IAAI,CAAC;IAEX;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBAAa,oBACX,SAAQ,kBAAkB,CAAC,cAAc,CACzC,YAAW,aAAa,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC;IAE9D,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;IACrB,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC;gBAE3B,OAAO,EAAE,2BAA2B;IAehD;;;OAGG;IACH,eAAe,IAAI,OAAO;IAS1B;;;;;;OAMG;IACG,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAa9D;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWtD;;;OAGG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIvC;;;;;;;;;OASG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAwC5F;;;;;;;;;OASG;IACG,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAU3D;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAoCnG;;;;;;;;;;OAUG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAqCrC;;;OAGG;IACH,OAAO,IAAI,IAAI;IAIf;;;;;OAKG;IACH,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAWjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAmBD,UAAU,2BAA4B,SAAQ,yBAAyB,CAAC,cAAc,CAAC;IACrF;;;OAGG;IACH,IAAI,EAAE,IAAI,CAAC;IAEX;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBAAa,oBACX,SAAQ,kBAAkB,CAAC,cAAc,CACzC,YAAW,aAAa,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC;IAE9D,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;IACrB,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC;gBAE3B,OAAO,EAAE,2BAA2B;IAehD;;;OAGG;IACH,eAAe,IAAI,OAAO;IAS1B;;;;;;OAMG;IACG,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAa9D;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWtD;;;OAGG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIvC;;;;;;;;;OASG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAwC5F;;;;;;;;;OASG;IACG,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAU3D;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAoCnG;;;;;;;;;;OAUG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAqCrC;;;OAGG;IACH,OAAO,IAAI,IAAI;IAIf;;;;;OAKG;IACH,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAWjD"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAmBA,SAAS,0BAA0B,IAAA,EAAoB;AACrD,EAAA,OAAO;AAAA,IACL,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,SAAA,EAAW,KAAK,KAAA,IAAS,MAAA;AAAA,IACzB,QAAA,EAAU;AAAA,MACR,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA;AAClB,GACF;AACF;AAsDO,IAAM,oBAAA,GAAN,cACG,kBAAA,CAEV;AAAA,EACY,IAAA;AAAA,EACA,mBAAA;AAAA,EAEV,YAAY,OAAA,EAAsC;AAChD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,eAAe,CAAA;AAE9C,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,mBAAA,GAAsB,QAAQ,aAAA,IAAiB,IAAA;AAEpD,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAA2B;AACzB,IAAA,OAAO,IAAA,CAAK,mBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,eAAe,OAAA,EAA0C;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C,SAAS,OAAA,CAAQ;AAAA,OAClB,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA;AAC1B,MAAA,OAAO,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAQ,OAAA,EAAyC;AAIrD,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KAEF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAAsD;AAC3F,IAAA,IAAI;AAGF,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAG5B,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,eAAe,CAAA;AACjD,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAAA,MACzC,WAAW,KAAA,EAAO;AAEhB,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAGA,MAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAC5C,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,MACpC;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,IAAA,EAAM;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO;AAAA,QACL,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAM,MAAA,CAAO;AAAA,OACf;AAAA,IACF,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,IAAA,EAAwC;AAE1D,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,OAAA,EAAS,MAAM,CAAC,CAAC,MAAM,IAAA,EAAM,EAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,MAAA,CAAO,KAAA,EAAe,QAAA,EAAkB,OAAA,EAAsD;AAClG,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAS;AAAA,MACxB,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CACJ,KAAA,EACA,QAAA,EACA,MACA,OAAA,EACoC;AACpC,IAAA,MAAM,cAAc,IAAA,IAAQ,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,MAAA;AACnD,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,WAAA,EAAY;AAAA,MAC3C,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,0BAA0B,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,sBAAA,GAAiD;AAG/C,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,uEAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,YAAA,EAAc,OAAA,CAAQ,IAAA,CAAK,IAAI;AAAA,KACjC;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import type { IUserProvider, ICredentialsProvider, EEUser, CredentialsResult } from '@mastra/core/ee';\nimport type { MastraAuthProviderOptions } from '@mastra/core/server';\nimport { MastraAuthProvider } from '@mastra/core/server';\n\nimport type { Auth, Session, User } from 'better-auth';\nimport type { HonoRequest } from 'hono';\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n  session: Session;\n  user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    avatarUrl: user.image ?? undefined,\n    metadata: {\n      emailVerified: user.emailVerified,\n      createdAt: user.createdAt,\n      updatedAt: user.updatedAt,\n    },\n  };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n  /**\n   * The Better Auth instance to use for authentication.\n   * This should be the result of calling `betterAuth({ ... })`.\n   */\n  auth: Auth;\n\n  /**\n   * Whether to allow new user registration via sign-up.\n   * Set to false to disable public registration.\n   * @default true\n   */\n  signUpEnabled?: boolean;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n *   database: {\n *     provider: 'postgresql',\n *     url: process.env.DATABASE_URL!,\n *   },\n *   emailAndPassword: {\n *     enabled: true,\n *   },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n *   auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n *   server: {\n *     auth: mastraAuth,\n *   },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n  extends MastraAuthProvider<BetterAuthUser>\n  implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>\n{\n  protected auth: Auth;\n  protected signUpEnabledConfig: boolean;\n\n  constructor(options: MastraAuthBetterAuthOptions) {\n    super({ name: options?.name ?? 'better-auth' });\n\n    if (!options.auth) {\n      throw new Error(\n        'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... })',\n      );\n    }\n\n    this.auth = options.auth;\n    this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n    this.registerOptions(options);\n  }\n\n  /**\n   * Check if sign-up is enabled.\n   * Implements ICredentialsProvider.isSignUpEnabled.\n   */\n  isSignUpEnabled(): boolean {\n    return this.signUpEnabledConfig;\n  }\n\n  // ============================================\n  // IUserProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Get current user from request.\n   * Implements IUserProvider for EE user awareness in Studio.\n   *\n   * @param request - Incoming HTTP request\n   * @returns EE User object or null if not authenticated\n   */\n  async getCurrentUser(request: Request): Promise<EEUser | null> {\n    try {\n      const result = await this.auth.api.getSession({\n        headers: request.headers,\n      });\n\n      if (!result?.user) return null;\n      return mapBetterAuthUserToEEUser(result.user);\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Get user by ID.\n   * Implements IUserProvider for EE user awareness.\n   *\n   * Note: Better Auth doesn't expose a direct getUser API.\n   * For full functionality, you may need to implement this using\n   * direct database access in a subclass.\n   *\n   * @param userId - User identifier\n   * @returns EE User object or null if not found\n   */\n  async getUser(_userId: string): Promise<EEUser | null> {\n    // Better Auth doesn't have a direct getUser API\n    // Users can override this method with their own implementation\n    // that queries the database directly\n    console.warn(\n      '[MastraAuthBetterAuth] getUser() requires direct database access. ' +\n        'Override this method in a subclass for full user lookup support.',\n    );\n    return null;\n  }\n\n  /**\n   * Get URL to user's profile page.\n   * Optional IUserProvider method.\n   */\n  getUserProfileUrl(user: EEUser): string {\n    return `/profile/${user.id}`;\n  }\n\n  /**\n   * Authenticate a bearer token by verifying the session with Better Auth.\n   *\n   * This method extracts the session from the request headers using\n   * Better Auth's `api.getSession()` endpoint.\n   *\n   * @param token - The bearer token (session token) to authenticate\n   * @param request - The Hono request object containing headers\n   * @returns The authenticated user and session, or null if authentication fails\n   */\n  async authenticateToken(token: string, request: HonoRequest): Promise<BetterAuthUser | null> {\n    try {\n      // Better Auth expects the token to be passed via headers\n      // We need to construct headers with the Authorization bearer token\n      const headers = new Headers();\n\n      // Copy relevant headers from the request\n      const authHeader = request.header('Authorization');\n      if (authHeader) {\n        headers.set('Authorization', authHeader);\n      } else if (token) {\n        // If no auth header but token is provided, set it\n        headers.set('Authorization', `Bearer ${token}`);\n      }\n\n      // Copy cookie header if present (Better Auth can use cookies for sessions)\n      const cookieHeader = request.header('Cookie');\n      if (cookieHeader) {\n        headers.set('Cookie', cookieHeader);\n      }\n\n      // Use Better Auth's API to get the session\n      const result = await this.auth.api.getSession({\n        headers,\n      });\n\n      if (!result || !result.session || !result.user) {\n        return null;\n      }\n\n      return {\n        session: result.session,\n        user: result.user,\n      };\n    } catch {\n      // Session verification failed\n      return null;\n    }\n  }\n\n  /**\n   * Authorize a user for access.\n   *\n   * By default, any authenticated user with a valid session is authorized.\n   * You can override this behavior by providing a custom `authorizeUser` function\n   * in the constructor options.\n   *\n   * @param user - The authenticated user and session\n   * @returns True if the user is authorized, false otherwise\n   */\n  async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n    // By default, any authenticated user with a valid session is authorized\n    return !!user?.session?.id && !!user?.user?.id;\n  }\n\n  // ============================================\n  // ICredentialsProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Sign in with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param request - Incoming HTTP request\n   * @returns Result with user and session cookies\n   * @throws Error if credentials are invalid\n   */\n  async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signInEmail({\n      body: { email, password },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Invalid email or password');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Invalid email or password');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Sign up with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param name - Optional display name\n   * @param request - Incoming HTTP request\n   * @returns Result with new user and session cookies\n   * @throws Error if sign up fails\n   */\n  async signUp(\n    email: string,\n    password: string,\n    name: string | undefined,\n    request: Request,\n  ): Promise<CredentialsResult<EEUser>> {\n    const displayName = name ?? email.split('@')[0] ?? 'User';\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signUpEmail({\n      body: { email, password, name: displayName },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Failed to create account');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Failed to create account');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Get the underlying Better Auth instance.\n   * Useful for accessing Better Auth APIs directly.\n   */\n  getAuth(): Auth {\n    return this.auth;\n  }\n\n  /**\n   * Get headers to clear the session cookies on logout.\n   * Partial ISessionProvider implementation for logout support.\n   *\n   * Clears Better Auth's default session cookies.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    // Better Auth uses these cookie names by default\n    // Clear both the session token and its signature cookie\n    const cookies = [\n      'better-auth.session_token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n      'better-auth.session_token_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    ];\n    return {\n      'Set-Cookie': cookies.join(', '),\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAmBA,SAAS,0BAA0B,IAAA,EAAoB;AACrD,EAAA,OAAO;AAAA,IACL,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,SAAA,EAAW,KAAK,KAAA,IAAS,MAAA;AAAA,IACzB,QAAA,EAAU;AAAA,MACR,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA;AAClB,GACF;AACF;AAsDO,IAAM,oBAAA,GAAN,cACG,kBAAA,CAEV;AAAA,EACY,IAAA;AAAA,EACA,mBAAA;AAAA,EAEV,YAAY,OAAA,EAAsC;AAChD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,eAAe,CAAA;AAE9C,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,mBAAA,GAAsB,QAAQ,aAAA,IAAiB,IAAA;AAEpD,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAA2B;AACzB,IAAA,OAAO,IAAA,CAAK,mBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,eAAe,OAAA,EAA0C;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C,SAAS,OAAA,CAAQ;AAAA,OAClB,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA;AAC1B,MAAA,OAAO,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,QAAQ,OAAA,EAAyC;AAIrD,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN;AAAA,KAEF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAAsD;AAC3F,IAAA,IAAI;AAGF,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAG5B,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,eAAe,CAAA;AACjD,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAAA,MACzC,WAAW,KAAA,EAAO;AAEhB,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAGA,MAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAC5C,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,MACpC;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,IAAA,EAAM;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO;AAAA,QACL,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAM,MAAA,CAAO;AAAA,OACf;AAAA,IACF,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,IAAA,EAAwC;AAE1D,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,OAAA,EAAS,MAAM,CAAC,CAAC,MAAM,IAAA,EAAM,EAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,MAAA,CAAO,KAAA,EAAe,QAAA,EAAkB,OAAA,EAAsD;AAClG,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAS;AAAA,MACxB,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CACJ,KAAA,EACA,QAAA,EACA,MACA,OAAA,EACoC;AACpC,IAAA,MAAM,cAAc,IAAA,IAAQ,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,MAAA;AACnD,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,WAAA,EAAY;AAAA,MAC3C,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,0BAA0B,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,sBAAA,GAAiD;AAG/C,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,uEAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO;AAAA,MACL,YAAA,EAAc,OAAA,CAAQ,IAAA,CAAK,IAAI;AAAA,KACjC;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import type { IUserProvider, ICredentialsProvider, EEUser, CredentialsResult } from '@mastra/core/auth';\nimport type { MastraAuthProviderOptions } from '@mastra/core/server';\nimport { MastraAuthProvider } from '@mastra/core/server';\n\nimport type { Auth, Session, User } from 'better-auth';\nimport type { HonoRequest } from 'hono';\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n  session: Session;\n  user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    avatarUrl: user.image ?? undefined,\n    metadata: {\n      emailVerified: user.emailVerified,\n      createdAt: user.createdAt,\n      updatedAt: user.updatedAt,\n    },\n  };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n  /**\n   * The Better Auth instance to use for authentication.\n   * This should be the result of calling `betterAuth({ ... })`.\n   */\n  auth: Auth;\n\n  /**\n   * Whether to allow new user registration via sign-up.\n   * Set to false to disable public registration.\n   * @default true\n   */\n  signUpEnabled?: boolean;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n *   database: {\n *     provider: 'postgresql',\n *     url: process.env.DATABASE_URL!,\n *   },\n *   emailAndPassword: {\n *     enabled: true,\n *   },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n *   auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n *   server: {\n *     auth: mastraAuth,\n *   },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n  extends MastraAuthProvider<BetterAuthUser>\n  implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>\n{\n  protected auth: Auth;\n  protected signUpEnabledConfig: boolean;\n\n  constructor(options: MastraAuthBetterAuthOptions) {\n    super({ name: options?.name ?? 'better-auth' });\n\n    if (!options.auth) {\n      throw new Error(\n        'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... })',\n      );\n    }\n\n    this.auth = options.auth;\n    this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n    this.registerOptions(options);\n  }\n\n  /**\n   * Check if sign-up is enabled.\n   * Implements ICredentialsProvider.isSignUpEnabled.\n   */\n  isSignUpEnabled(): boolean {\n    return this.signUpEnabledConfig;\n  }\n\n  // ============================================\n  // IUserProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Get current user from request.\n   * Implements IUserProvider for EE user awareness in Studio.\n   *\n   * @param request - Incoming HTTP request\n   * @returns EE User object or null if not authenticated\n   */\n  async getCurrentUser(request: Request): Promise<EEUser | null> {\n    try {\n      const result = await this.auth.api.getSession({\n        headers: request.headers,\n      });\n\n      if (!result?.user) return null;\n      return mapBetterAuthUserToEEUser(result.user);\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Get user by ID.\n   * Implements IUserProvider for EE user awareness.\n   *\n   * Note: Better Auth doesn't expose a direct getUser API.\n   * For full functionality, you may need to implement this using\n   * direct database access in a subclass.\n   *\n   * @param userId - User identifier\n   * @returns EE User object or null if not found\n   */\n  async getUser(_userId: string): Promise<EEUser | null> {\n    // Better Auth doesn't have a direct getUser API\n    // Users can override this method with their own implementation\n    // that queries the database directly\n    console.warn(\n      '[MastraAuthBetterAuth] getUser() requires direct database access. ' +\n        'Override this method in a subclass for full user lookup support.',\n    );\n    return null;\n  }\n\n  /**\n   * Get URL to user's profile page.\n   * Optional IUserProvider method.\n   */\n  getUserProfileUrl(user: EEUser): string {\n    return `/profile/${user.id}`;\n  }\n\n  /**\n   * Authenticate a bearer token by verifying the session with Better Auth.\n   *\n   * This method extracts the session from the request headers using\n   * Better Auth's `api.getSession()` endpoint.\n   *\n   * @param token - The bearer token (session token) to authenticate\n   * @param request - The Hono request object containing headers\n   * @returns The authenticated user and session, or null if authentication fails\n   */\n  async authenticateToken(token: string, request: HonoRequest): Promise<BetterAuthUser | null> {\n    try {\n      // Better Auth expects the token to be passed via headers\n      // We need to construct headers with the Authorization bearer token\n      const headers = new Headers();\n\n      // Copy relevant headers from the request\n      const authHeader = request.header('Authorization');\n      if (authHeader) {\n        headers.set('Authorization', authHeader);\n      } else if (token) {\n        // If no auth header but token is provided, set it\n        headers.set('Authorization', `Bearer ${token}`);\n      }\n\n      // Copy cookie header if present (Better Auth can use cookies for sessions)\n      const cookieHeader = request.header('Cookie');\n      if (cookieHeader) {\n        headers.set('Cookie', cookieHeader);\n      }\n\n      // Use Better Auth's API to get the session\n      const result = await this.auth.api.getSession({\n        headers,\n      });\n\n      if (!result || !result.session || !result.user) {\n        return null;\n      }\n\n      return {\n        session: result.session,\n        user: result.user,\n      };\n    } catch {\n      // Session verification failed\n      return null;\n    }\n  }\n\n  /**\n   * Authorize a user for access.\n   *\n   * By default, any authenticated user with a valid session is authorized.\n   * You can override this behavior by providing a custom `authorizeUser` function\n   * in the constructor options.\n   *\n   * @param user - The authenticated user and session\n   * @returns True if the user is authorized, false otherwise\n   */\n  async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n    // By default, any authenticated user with a valid session is authorized\n    return !!user?.session?.id && !!user?.user?.id;\n  }\n\n  // ============================================\n  // ICredentialsProvider implementation (EE capability)\n  // License check happens in buildCapabilities()\n  // ============================================\n\n  /**\n   * Sign in with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param request - Incoming HTTP request\n   * @returns Result with user and session cookies\n   * @throws Error if credentials are invalid\n   */\n  async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signInEmail({\n      body: { email, password },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Invalid email or password');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Invalid email or password');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Sign up with email and password.\n   * Implements ICredentialsProvider for EE credentials auth.\n   *\n   * @param email - User email\n   * @param password - User password\n   * @param name - Optional display name\n   * @param request - Incoming HTTP request\n   * @returns Result with new user and session cookies\n   * @throws Error if sign up fails\n   */\n  async signUp(\n    email: string,\n    password: string,\n    name: string | undefined,\n    request: Request,\n  ): Promise<CredentialsResult<EEUser>> {\n    const displayName = name ?? email.split('@')[0] ?? 'User';\n    const headers = request?.headers ?? new Headers();\n\n    // Use asResponse: true to get the full response with Set-Cookie headers\n    const response = await this.auth.api.signUpEmail({\n      body: { email, password, name: displayName },\n      headers,\n      asResponse: true,\n    });\n\n    if (!response.ok) {\n      const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n      throw new Error(errorData.message || 'Failed to create account');\n    }\n\n    const result = (await response.json()) as { user?: User; token?: string | null };\n\n    if (!result?.user) {\n      throw new Error('Failed to create account');\n    }\n\n    // Extract Set-Cookie headers from Better Auth response\n    const cookies: string[] = [];\n    const setCookieHeader = response.headers.get('set-cookie');\n    if (setCookieHeader) {\n      // Split multiple cookies (they may be comma-separated or in multiple headers)\n      cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n    }\n\n    return {\n      user: mapBetterAuthUserToEEUser(result.user),\n      token: result.token ?? undefined,\n      cookies,\n    };\n  }\n\n  /**\n   * Get the underlying Better Auth instance.\n   * Useful for accessing Better Auth APIs directly.\n   */\n  getAuth(): Auth {\n    return this.auth;\n  }\n\n  /**\n   * Get headers to clear the session cookies on logout.\n   * Partial ISessionProvider implementation for logout support.\n   *\n   * Clears Better Auth's default session cookies.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    // Better Auth uses these cookie names by default\n    // Clear both the session token and its signature cookie\n    const cookies = [\n      'better-auth.session_token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n      'better-auth.session_token_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    ];\n    return {\n      'Set-Cookie': cookies.join(', '),\n    };\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/auth-better-auth",
-  "version": "0.0.0-auth-and-authz-20260131004229",
+  "version": "0.0.0-auth-and-authz-20260202232929",
   "description": "Mastra Better Auth integration - self-hosted authentication",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,7 @@
     "better-auth": "^1.4.5"
   },
   "peerDependencies": {
-    "@mastra/core": "0.0.0-auth-and-authz-20260131004229"
+    "@mastra/core": "0.0.0-auth-and-authz-20260202232929"
   },
   "devDependencies": {
     "@types/node": "22.19.7",
@@ -34,9 +34,9 @@
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "4.0.16",
-    "@internal/lint": "0.0.0-auth-and-authz-20260131004229",
-    "@mastra/core": "0.0.0-auth-and-authz-20260131004229",
-    "@internal/types-builder": "0.0.0-auth-and-authz-20260131004229"
+    "@internal/lint": "0.0.0-auth-and-authz-20260202232929",
+    "@internal/types-builder": "0.0.0-auth-and-authz-20260202232929",
+    "@mastra/core": "0.0.0-auth-and-authz-20260202232929"
   },
   "files": [
     "dist",