@mastra/auth-better-auth 1.1.2 → 1.1.3

package/dist/index.cjs

@@ -1,729 +1,758 @@
-'use strict';
-
-var kyselyLibsql = require('@libsql/kysely-libsql');
-var betterAuth = require('better-auth');
-var crypto$1 = require('better-auth/crypto');
-var migration = require('better-auth/db/migration');
-var plugins = require('better-auth/plugins');
-
-// ../../packages/_internal-core/dist/chunk-3M4SEWMI.js
-var RegisteredLogger = {
-  LLM: "LLM"};
-var LogLevel = {
-  DEBUG: "debug",
-  INFO: "info",
-  WARN: "warn",
-  ERROR: "error"};
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _libsql_kysely_libsql = require("@libsql/kysely-libsql");
+let better_auth = require("better-auth");
+let better_auth_crypto = require("better-auth/crypto");
+let better_auth_db_migration = require("better-auth/db/migration");
+let better_auth_plugins = require("better-auth/plugins");
+//#region ../../packages/_internal-core/dist/logger/index.js
+const RegisteredLogger = {
+	AGENT: "AGENT",
+	OBSERVABILITY: "OBSERVABILITY",
+	AUTH: "AUTH",
+	BROWSER: "BROWSER",
+	NETWORK: "NETWORK",
+	WORKFLOW: "WORKFLOW",
+	LLM: "LLM",
+	TTS: "TTS",
+	VOICE: "VOICE",
+	VECTOR: "VECTOR",
+	BUNDLER: "BUNDLER",
+	DEPLOYER: "DEPLOYER",
+	MEMORY: "MEMORY",
+	STORAGE: "STORAGE",
+	EMBEDDINGS: "EMBEDDINGS",
+	MCP_SERVER: "MCP_SERVER",
+	SERVER_CACHE: "SERVER_CACHE",
+	SERVER: "SERVER",
+	WORKSPACE: "WORKSPACE",
+	CHANNEL: "CHANNEL"
+};
+const LogLevel = {
+	DEBUG: "debug",
+	INFO: "info",
+	WARN: "warn",
+	ERROR: "error",
+	NONE: "silent"
+};
 var MastraLogger = class {
-  name;
-  level;
-  transports;
-  constructor(options = {}) {
-    this.name = options.name || "Mastra";
-    this.level = options.level || LogLevel.ERROR;
-    this.transports = new Map(Object.entries(options.transports || {}));
-  }
-  getTransports() {
-    return this.transports;
-  }
-  trackException(_error, _metadata) {
-  }
-  async listLogs(transportId, params) {
-    if (!transportId || !this.transports.has(transportId)) {
-      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };
-    }
-    return this.transports.get(transportId).listLogs?.(params) ?? {
-      logs: [],
-      total: 0,
-      page: params?.page ?? 1,
-      perPage: params?.perPage ?? 100,
-      hasMore: false
-    };
-  }
-  async listLogsByRunId({
-    transportId,
-    runId,
-    fromDate,
-    toDate,
-    logLevel,
-    filters,
-    page,
-    perPage
-  }) {
-    if (!transportId || !this.transports.has(transportId) || !runId) {
-      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };
-    }
-    return this.transports.get(transportId).listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {
-      logs: [],
-      total: 0,
-      page: page ?? 1,
-      perPage: perPage ?? 100,
-      hasMore: false
-    };
-  }
+	name;
+	level;
+	transports;
+	constructor(options = {}) {
+		this.name = options.name || "Mastra";
+		this.level = options.level || LogLevel.ERROR;
+		this.transports = new Map(Object.entries(options.transports || {}));
+	}
+	getTransports() {
+		return this.transports;
+	}
+	trackException(_error, _metadata) {}
+	async listLogs(transportId, params) {
+		if (!transportId || !this.transports.has(transportId)) return {
+			logs: [],
+			total: 0,
+			page: params?.page ?? 1,
+			perPage: params?.perPage ?? 100,
+			hasMore: false
+		};
+		return this.transports.get(transportId).listLogs?.(params) ?? {
+			logs: [],
+			total: 0,
+			page: params?.page ?? 1,
+			perPage: params?.perPage ?? 100,
+			hasMore: false
+		};
+	}
+	async listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {
+		if (!transportId || !this.transports.has(transportId) || !runId) return {
+			logs: [],
+			total: 0,
+			page: page ?? 1,
+			perPage: perPage ?? 100,
+			hasMore: false
+		};
+		return this.transports.get(transportId).listLogsByRunId?.({
+			runId,
+			fromDate,
+			toDate,
+			logLevel,
+			filters,
+			page,
+			perPage
+		}) ?? {
+			logs: [],
+			total: 0,
+			page: page ?? 1,
+			perPage: perPage ?? 100,
+			hasMore: false
+		};
+	}
 };
-var ConsoleLogger = class _ConsoleLogger extends MastraLogger {
-  component;
-  filter;
-  constructor(options = {}) {
-    super(options);
-    this.component = options.component;
-    this.filter = options.filter;
-  }
-  child(componentOrBindings) {
-    const component = typeof componentOrBindings === "string" ? componentOrBindings : componentOrBindings?.component ?? this.component;
-    return new _ConsoleLogger({
-      name: this.name,
-      level: this.level,
-      component,
-      filter: this.filter
-    });
-  }
-  shouldLog(level, message, args) {
-    if (!this.filter) return true;
-    try {
-      return this.filter({ component: this.component, level, message, args });
-    } catch (e) {
-      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);
-      return true;
-    }
-  }
-  prefix() {
-    return this.component ? `[${this.component}] ` : "";
-  }
-  debug(message, ...args) {
-    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {
-      console.info(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  info(message, ...args) {
-    if ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) {
-      console.info(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  warn(message, ...args) {
-    if ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) {
-      console.warn(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  error(message, ...args) {
-    if ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) {
-      console.error(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  async listLogs(_transportId, _params) {
-    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };
-  }
-  async listLogsByRunId(_args) {
-    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };
-  }
+var ConsoleLogger = class ConsoleLogger extends MastraLogger {
+	component;
+	filter;
+	constructor(options = {}) {
+		super(options);
+		this.component = options.component;
+		this.filter = options.filter;
+	}
+	child(componentOrBindings) {
+		const component = typeof componentOrBindings === "string" ? componentOrBindings : componentOrBindings?.component ?? this.component;
+		return new ConsoleLogger({
+			name: this.name,
+			level: this.level,
+			component,
+			filter: this.filter
+		});
+	}
+	shouldLog(level, message, args) {
+		if (!this.filter) return true;
+		try {
+			return this.filter({
+				component: this.component,
+				level,
+				message,
+				args
+			});
+		} catch (e) {
+			console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);
+			return true;
+		}
+	}
+	prefix() {
+		return this.component ? `[${this.component}] ` : "";
+	}
+	debug(message, ...args) {
+		if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...args);
+	}
+	info(message, ...args) {
+		if ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...args);
+	}
+	warn(message, ...args) {
+		if ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...args);
+	}
+	error(message, ...args) {
+		if ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...args);
+	}
+	async listLogs(_transportId, _params) {
+		return {
+			logs: [],
+			total: 0,
+			page: _params?.page ?? 1,
+			perPage: _params?.perPage ?? 100,
+			hasMore: false
+		};
+	}
+	async listLogsByRunId(_args) {
+		return {
+			logs: [],
+			total: 0,
+			page: _args.page ?? 1,
+			perPage: _args.perPage ?? 100,
+			hasMore: false
+		};
+	}
 };
-
-// ../../packages/_internal-core/dist/base/index.js
+//#endregion
+//#region ../../packages/_internal-core/dist/base/index.js
 var MastraBase = class {
-  component = RegisteredLogger.LLM;
-  logger;
-  name;
-  #rawConfig;
-  constructor({
-    component,
-    name,
-    rawConfig
-  }) {
-    this.component = component || RegisteredLogger.LLM;
-    this.name = name;
-    this.#rawConfig = rawConfig;
-    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });
-  }
-  /**
-   * Returns the raw storage configuration this primitive was created from,
-   * or undefined if it was created from code.
-   */
-  toRawConfig() {
-    return this.#rawConfig;
-  }
-  /**
-   * Sets the raw storage configuration for this primitive.
-   * @internal
-   */
-  __setRawConfig(rawConfig) {
-    this.#rawConfig = rawConfig;
-  }
-  /**
-   * Set the logger for the agent
-   * @param logger
-   */
-  __setLogger(logger) {
-    this.logger = "child" in logger && typeof logger.child === "function" ? logger.child({ component: this.component }) : logger;
-  }
+	component = RegisteredLogger.LLM;
+	logger;
+	name;
+	#rawConfig;
+	constructor({ component, name, rawConfig }) {
+		this.component = component || RegisteredLogger.LLM;
+		this.name = name;
+		this.#rawConfig = rawConfig;
+		this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });
+	}
+	/**
+	* Returns the raw storage configuration this primitive was created from,
+	* or undefined if it was created from code.
+	*/
+	toRawConfig() {
+		return this.#rawConfig;
+	}
+	/**
+	* Sets the raw storage configuration for this primitive.
+	* @internal
+	*/
+	__setRawConfig(rawConfig) {
+		this.#rawConfig = rawConfig;
+	}
+	/**
+	* Set the logger for the agent
+	* @param logger
+	*/
+	__setLogger(logger) {
+		this.logger = "child" in logger && typeof logger.child === "function" ? logger.child({ component: this.component }) : logger;
+	}
 };
-
-// ../../packages/_internals/auth/dist/chunk-NJOKT6V5.js
+//#endregion
+//#region ../../packages/_internals/auth/dist/provider/index.js
 var MastraAuthProvider = class extends MastraBase {
-  protected;
-  public;
-  constructor(options) {
-    super({ component: "AUTH", name: options?.name });
-    if (options?.authorizeUser) {
-      this.authorizeUser = options.authorizeUser.bind(this);
-    }
-    this.protected = options?.protected;
-    this.public = options?.public;
-    this.mapUserToResourceId = options?.mapUserToResourceId;
-  }
-  registerOptions(opts) {
-    if (opts?.authorizeUser) {
-      this.authorizeUser = opts.authorizeUser.bind(this);
-    }
-    if (opts?.mapUserToResourceId) {
-      this.mapUserToResourceId = opts.mapUserToResourceId;
-    }
-    if (opts?.protected) {
-      this.protected = opts.protected;
-    }
-    if (opts?.public) {
-      this.public = opts.public;
-    }
-  }
+	protected;
+	public;
+	constructor(options) {
+		super({
+			component: "AUTH",
+			name: options?.name
+		});
+		if (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);
+		this.protected = options?.protected;
+		this.public = options?.public;
+		this.mapUserToResourceId = options?.mapUserToResourceId;
+	}
+	registerOptions(opts) {
+		if (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);
+		if (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;
+		if (opts?.protected) this.protected = opts.protected;
+		if (opts?.public) this.public = opts.public;
+	}
 };
+//#endregion
+//#region src/index.ts
 function tryDecode(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
-  }
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
 }
-function getRequestHeader2(request, name) {
-  if (request instanceof Request) {
-    return request.headers.get(name);
-  }
-  return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
+function getRequestHeader(request, name) {
+	if (request instanceof Request) return request.headers.get(name);
+	return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
 }
+/**
+* Maps Better Auth User to EE User format.
+*/
 function mapBetterAuthUserToEEUser(user) {
-  return {
-    id: user.id,
-    email: user.email,
-    name: user.name,
-    avatarUrl: user.image ?? void 0,
-    metadata: {
-      emailVerified: user.emailVerified,
-      createdAt: user.createdAt,
-      updatedAt: user.updatedAt
-    }
-  };
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		avatarUrl: user.image ?? void 0,
+		metadata: {
+			emailVerified: user.emailVerified,
+			createdAt: user.createdAt,
+			updatedAt: user.updatedAt
+		}
+	};
 }
+/**
+* Mastra authentication provider for Better Auth.
+*
+* Better Auth is a self-hosted, open-source authentication framework
+* that gives you full control over your authentication system.
+*
+* @example
+* ```typescript
+* import { betterAuth } from 'better-auth';
+* import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';
+*
+* // Create your Better Auth instance
+* const auth = betterAuth({
+*   database: {
+*     provider: 'postgresql',
+*     url: process.env.DATABASE_URL!,
+*   },
+*   emailAndPassword: {
+*     enabled: true,
+*   },
+* });
+*
+* // Create the Mastra auth provider
+* const mastraAuth = new MastraAuthBetterAuth({
+*   auth,
+* });
+*
+* // Use with Mastra
+* const mastra = new Mastra({
+*   server: {
+*     auth: mastraAuth,
+*   },
+* });
+* ```
+*
+* @see https://better-auth.com for Better Auth documentation
+*/
 var MastraAuthBetterAuth = class extends MastraAuthProvider {
-  #auth;
-  #secret;
-  /** True when `init()` built the instance — then we also own its migrations. */
-  #ownsInstance = false;
-  /** Once-per-process migration latch; reset on failure so a later call retries. */
-  #migrated;
-  /** In-process `userId → orgId` cache so hosts can call `ensureOrganization` per request. */
-  #orgCache = /* @__PURE__ */ new Map();
-  /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */
-  #crossSite = false;
-  signUpEnabledConfig;
-  constructor(options) {
-    super({ name: options?.name ?? "better-auth" });
-    if (!options.auth && !options.secret) {
-      throw new Error(
-        "Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), or provide `secret` so the provider can build its own instance in init() on the host database."
-      );
-    }
-    this.#auth = options.auth;
-    this.#secret = options.secret;
-    this.signUpEnabledConfig = options.signUpEnabled ?? true;
-    this.registerOptions(options);
-  }
-  /**
-   * The active Better Auth instance. Throws before `init()` in deferred
-   * instance mode (constructed with `secret` instead of `auth`).
-   */
-  get auth() {
-    if (!this.#auth) {
-      throw new Error(
-        "MastraAuthBetterAuth is not initialized \u2014 init() must run first (or pass a configured `auth` instance)."
-      );
-    }
-    return this.#auth;
-  }
-  /**
-   * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller
-   * override via `advanced.cookies.session_token.name`, and the `__Secure-`
-   * prefix Better Auth applies when secure cookies are active.
-   */
-  get sessionCookieName() {
-    const options = this.#auth?.options;
-    const advanced = options?.advanced;
-    const prefix = advanced?.cookiePrefix ?? "better-auth";
-    const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith("https://") ?? false;
-    const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;
-    return `${secure ? "__Secure-" : ""}${baseName}`;
-  }
-  // ============================================
-  // IAuthInit implementation
-  // ============================================
-  /**
-   * One-time host initialization. In deferred instance mode (no `auth` in the
-   * options) this builds the provider-owned `betterAuth()` instance on the
-   * host's auth database; schema migrations then run lazily behind a
-   * once-per-process latch on first use.
-   *
-   * Bring-your-own `auth` instances skip construction entirely — the caller
-   * owns their database and migrations.
-   */
-  async init(ctx) {
-    this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;
-    if (this.#auth) return;
-    const authDb = ctx.database;
-    if (!authDb) {
-      throw new Error(
-        "MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. Use a storage backend that exposes an auth database, or pass your own configured `auth` instance."
-      );
-    }
-    const database = authDb.dialect === "postgres" ? authDb.pool : authDb.dialect === "libsql" ? {
-      dialect: new kyselyLibsql.LibsqlDialect({ client: authDb.client }),
-      type: "sqlite"
-    } : authDb.database;
-    const allowedOrigins = ctx.allowedOrigins ?? [];
-    const options = {
-      database,
-      secret: this.#secret,
-      // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,
-      // where hosts mount handleAuthRequest.
-      basePath: "/auth/api",
-      ...ctx.publicUrl ? { baseURL: ctx.publicUrl } : {},
-      // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the
-      // cookie — better-auth still rejects requests from origins outside its
-      // own allow-list, so the SPA origins must be trusted too.
-      ...allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {},
-      emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },
-      plugins: [plugins.organization()],
-      // Cross-origin SPA deploys need SameSite=None; Secure for the browser to
-      // send the session cookie.
-      ...this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: "none", secure: true } } } : {}
-    };
-    this.#auth = betterAuth.betterAuth(options);
-    this.#ownsInstance = true;
-  }
-  /**
-   * Ensure better-auth's tables exist in the host database. Only for instances
-   * this provider built — bring-your-own instances manage their own migrations.
-   */
-  async #ensureDbReady() {
-    if (!this.#ownsInstance) return;
-    this.#migrated ??= (async () => {
-      const { runMigrations } = await migration.getMigrations(this.auth.options);
-      await runMigrations();
-    })();
-    try {
-      await this.#migrated;
-    } catch (error) {
-      this.#migrated = void 0;
-      console.warn("[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.");
-      throw error;
-    }
-  }
-  // ============================================
-  // IAuthHttpHandler implementation
-  // ============================================
-  /**
-   * Proxy a raw HTTP request to Better Auth's own API surface
-   * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.
-   */
-  async handleAuthRequest(request) {
-    try {
-      await this.#ensureDbReady();
-    } catch {
-      return new Response(JSON.stringify({ error: "auth_unavailable" }), {
-        status: 503,
-        headers: { "content-type": "application/json" }
-      });
-    }
-    return this.auth.handler(request);
-  }
-  // ============================================
-  // IOrganizationsProvider implementation
-  // ============================================
-  /**
-   * Ensure the user belongs to an organization, mirroring the WorkOS
-   * personal-org bootstrap on better-auth's organization tables:
-   * ≥1 membership → first org id; 0 → create a personal org with an
-   * idempotent slug derived from the user id.
-   *
-   * Concurrent/retried first logins recover via the unique slug instead of
-   * creating duplicates. Slug alone is NOT proof of ownership though: the
-   * organization API is reachable by any authenticated user, so an attacker
-   * could squat `personal-<victimId>`. The slug-matched org is only adopted
-   * when nobody else is a member; otherwise a fresh org with an unguessable
-   * slug is created instead.
-   *
-   * Best-effort: any failure is swallowed and leaves the user no-org.
-   */
-  async ensureOrganization(userId) {
-    const cached = this.#orgCache.get(userId);
-    if (cached) return cached;
-    try {
-      await this.#ensureDbReady();
-      const ctx = await this.getAuthContext();
-      if (!ctx) return void 0;
-      const memberships = await ctx.adapter.findMany({
-        model: "member",
-        where: [{ field: "userId", value: userId }]
-      });
-      const firstExisting = memberships.find((m) => m.organizationId)?.organizationId;
-      if (firstExisting) {
-        this.#orgCache.set(userId, firstExisting);
-        return firstExisting;
-      }
-      const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);
-      const label = userRecord?.email ?? userRecord?.name ?? userId;
-      const orgName = `${label}'s org`;
-      const orgData = () => ({
-        name: orgName,
-        createdAt: /* @__PURE__ */ new Date(),
-        metadata: JSON.stringify({ mastraPersonalOrg: "true" })
-      });
-      const slug = `personal-${userId}`;
-      let organizationId;
-      try {
-        const created = await ctx.adapter.create({
-          model: "organization",
-          data: { ...orgData(), slug }
-        });
-        organizationId = created.id;
-      } catch (error) {
-        const existing = await ctx.adapter.findOne({
-          model: "organization",
-          where: [{ field: "slug", value: slug }]
-        });
-        if (!existing) throw error;
-        const existingMembers = await ctx.adapter.findMany({
-          model: "member",
-          where: [{ field: "organizationId", value: existing.id }]
-        });
-        const foreignMember = existingMembers.some((m) => m.userId !== userId);
-        if (foreignMember) {
-          const fallback = await ctx.adapter.create({
-            model: "organization",
-            data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` }
-          });
-          organizationId = fallback.id;
-        } else {
-          organizationId = existing.id;
-        }
-      }
-      try {
-        await ctx.adapter.create({
-          model: "member",
-          data: { organizationId, userId, role: "owner", createdAt: /* @__PURE__ */ new Date() }
-        });
-      } catch (error) {
-        const member = await ctx.adapter.findOne({
-          model: "member",
-          where: [
-            { field: "organizationId", value: organizationId },
-            { field: "userId", value: userId }
-          ]
-        });
-        if (!member) throw error;
-      }
-      this.#orgCache.set(userId, organizationId);
-      return organizationId;
-    } catch (error) {
-      console.warn(
-        `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. The user will see organization_required until this succeeds.`,
-        error
-      );
-      return void 0;
-    }
-  }
-  /**
-   * Whether the user holds an admin-equivalent role (`owner` or `admin`) in
-   * the organization. Provider errors resolve to `false`.
-   */
-  async isOrganizationAdmin(organizationId, userId) {
-    try {
-      await this.#ensureDbReady();
-      const ctx = await this.getAuthContext();
-      if (!ctx) return false;
-      const membership = await ctx.adapter.findOne({
-        model: "member",
-        where: [
-          { field: "organizationId", value: organizationId },
-          { field: "userId", value: userId }
-        ]
-      });
-      return membership?.role === "owner" || membership?.role === "admin";
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Check if sign-up is enabled.
-   * Implements ICredentialsProvider.isSignUpEnabled.
-   */
-  isSignUpEnabled() {
-    return this.signUpEnabledConfig;
-  }
-  // ============================================
-  // IUserProvider implementation (EE capability)
-  // License check happens in buildCapabilities()
-  // ============================================
-  /**
-   * Get current user from request.
-   * Implements IUserProvider for EE user awareness in Studio.
-   *
-   * Supports both cookie-based sessions and `Authorization: Bearer <token>`
-   * requests (e.g. API clients using the token returned by `signIn`).
-   *
-   * @param request - Incoming HTTP request
-   * @returns EE User object or null if not authenticated
-   */
-  async getCurrentUser(request) {
-    try {
-      await this.#ensureDbReady();
-      const headers = new Headers(request.headers);
-      const authHeader = headers.get("Authorization");
-      const bearerToken = authHeader && authHeader.slice(0, 7).toLowerCase() === "bearer " ? authHeader.slice(7).trim() : void 0;
-      await this.ensureSessionCookie(headers, bearerToken);
-      const result = await this.auth.api.getSession({
-        headers
-      });
-      if (!result?.user) return null;
-      return mapBetterAuthUserToEEUser(result.user);
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Get user by ID.
-   * Implements IUserProvider for EE user awareness.
-   *
-   * Uses Better Auth's internal adapter to look up the user record,
-   * so it works with whichever database Better Auth is configured with.
-   *
-   * @param userId - User identifier
-   * @returns EE User object or null if not found
-   */
-  async getUser(userId) {
-    try {
-      const ctx = await this.getAuthContext();
-      if (!ctx) return null;
-      const user = await ctx.internalAdapter.findUserById(userId);
-      if (!user) return null;
-      return mapBetterAuthUserToEEUser(user);
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Get multiple users by ID.
-   * Optional IUserProvider method used for batch author enrichment.
-   *
-   * @param userIds - User identifiers
-   * @returns EE User objects (null for missing users, order preserved)
-   */
-  async getUsers(userIds) {
-    return Promise.all(userIds.map((userId) => this.getUser(userId)));
-  }
-  /**
-   * Get URL to user's profile page.
-   * Optional IUserProvider method.
-   */
-  getUserProfileUrl(user) {
-    return `/profile/${user.id}`;
-  }
-  /**
-   * Get the resolved Better Auth context, or null when unavailable
-   * (e.g. a partial mock without `$context`).
-   */
-  async getAuthContext() {
-    try {
-      return await Promise.resolve(this.auth.$context) ?? null;
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Ensure the Cookie header on `headers` carries a Better Auth session cookie
-   * for the given token.
-   *
-   * Better Auth's `getSession` reads the session from a *signed* cookie
-   * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the
-   * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens
-   * are signed with the instance secret before being set as the session cookie.
-   */
-  async ensureSessionCookie(headers, token) {
-    if (!token) return;
-    const ctx = await this.getAuthContext();
-    const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;
-    const secret = ctx?.secret;
-    const cookieHeader = headers.get("Cookie");
-    const hasSessionCookie = !!cookieHeader?.split(";").some((pair) => {
-      const [key] = pair.trim().split("=");
-      return key?.trim() === cookieName;
-    });
-    if (hasSessionCookie) return;
-    let cookieValue = token.includes(".") ? token.includes("%") ? tryDecode(token) : token : token;
-    if (!token.includes(".") && secret) {
-      cookieValue = `${token}.${await crypto$1.makeSignature(token, secret)}`;
-    }
-    const existingCookies = cookieHeader ? `${cookieHeader}; ` : "";
-    headers.set("Cookie", `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);
-  }
-  /**
-   * Authenticate a bearer token by verifying the session with Better Auth.
-   *
-   * This method extracts the session from the request headers using
-   * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —
-   * as returned by `signIn`/`signUp` — are signed before being passed to
-   * Better Auth as a session cookie, matching the bearer plugin's semantics.
-   *
-   * @param token - The bearer token (session token) to authenticate
-   * @param request - The request containing headers
-   * @returns The authenticated user and session, or null if authentication fails
-   */
-  async authenticateToken(token, request) {
-    try {
-      await this.#ensureDbReady();
-      const headers = new Headers();
-      const cookieHeader = getRequestHeader2(request, "Cookie");
-      if (cookieHeader) {
-        headers.set("Cookie", cookieHeader);
-      }
-      await this.ensureSessionCookie(headers, token);
-      const result = await this.auth.api.getSession({
-        headers
-      });
-      if (!result || !result.session || !result.user) {
-        return null;
-      }
-      return {
-        session: result.session,
-        user: result.user
-      };
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Authorize a user for access.
-   *
-   * By default, any authenticated user with a valid session is authorized.
-   * You can override this behavior by providing a custom `authorizeUser` function
-   * in the constructor options.
-   *
-   * @param user - The authenticated user and session
-   * @returns True if the user is authorized, false otherwise
-   */
-  async authorizeUser(user) {
-    return !!user?.session?.id && !!user?.user?.id;
-  }
-  // ============================================
-  // ICredentialsProvider implementation (EE capability)
-  // License check happens in buildCapabilities()
-  // ============================================
-  /**
-   * Sign in with email and password.
-   * Implements ICredentialsProvider for EE credentials auth.
-   *
-   * @param email - User email
-   * @param password - User password
-   * @param request - Incoming HTTP request
-   * @returns Result with user and session cookies
-   * @throws Error if credentials are invalid
-   */
-  async signIn(email, password, request) {
-    const headers = request?.headers ?? new Headers();
-    const response = await this.auth.api.signInEmail({
-      body: { email, password },
-      headers,
-      asResponse: true
-    });
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      throw new Error(errorData.message || "Invalid email or password");
-    }
-    const result = await response.json();
-    if (!result?.user) {
-      throw new Error("Invalid email or password");
-    }
-    const cookies = [];
-    const setCookieHeader = response.headers.get("set-cookie");
-    if (setCookieHeader) {
-      cookies.push(...setCookieHeader.split(/,(?=\s*\w+=)/));
-    }
-    return {
-      user: mapBetterAuthUserToEEUser(result.user),
-      token: result.token ?? void 0,
-      cookies
-    };
-  }
-  /**
-   * Sign up with email and password.
-   * Implements ICredentialsProvider for EE credentials auth.
-   *
-   * @param email - User email
-   * @param password - User password
-   * @param name - Optional display name
-   * @param request - Incoming HTTP request
-   * @returns Result with new user and session cookies
-   * @throws Error if sign up fails
-   */
-  async signUp(email, password, name, request) {
-    const displayName = name ?? email.split("@")[0] ?? "User";
-    const headers = request?.headers ?? new Headers();
-    const response = await this.auth.api.signUpEmail({
-      body: { email, password, name: displayName },
-      headers,
-      asResponse: true
-    });
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      throw new Error(errorData.message || "Failed to create account");
-    }
-    const result = await response.json();
-    if (!result?.user) {
-      throw new Error("Failed to create account");
-    }
-    const cookies = [];
-    const setCookieHeader = response.headers.get("set-cookie");
-    if (setCookieHeader) {
-      cookies.push(...setCookieHeader.split(/,(?=\s*\w+=)/));
-    }
-    return {
-      user: mapBetterAuthUserToEEUser(result.user),
-      token: result.token ?? void 0,
-      cookies
-    };
-  }
-  /**
-   * Get the underlying Better Auth instance.
-   * Useful for accessing Better Auth APIs directly.
-   */
-  getAuth() {
-    return this.auth;
-  }
-  /**
-   * Get headers to clear the session cookies on logout.
-   * Partial ISessionProvider implementation for logout support.
-   *
-   * Clears Better Auth's default session cookies.
-   */
-  getClearSessionHeaders() {
-    const sameSite = this.#crossSite ? "None; Secure" : "Lax";
-    const cookies = [
-      `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,
-      `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`
-    ];
-    return {
-      "Set-Cookie": cookies.join(", ")
-    };
-  }
+	#auth;
+	#secret;
+	/** True when `init()` built the instance — then we also own its migrations. */
+	#ownsInstance = false;
+	/** Once-per-process migration latch; reset on failure so a later call retries. */
+	#migrated;
+	/** In-process `userId → orgId` cache so hosts can call `ensureOrganization` per request. */
+	#orgCache = /* @__PURE__ */ new Map();
+	/** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */
+	#crossSite = false;
+	signUpEnabledConfig;
+	constructor(options) {
+		super({ name: options?.name ?? "better-auth" });
+		if (!options.auth && !options.secret) throw new Error("Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), or provide `secret` so the provider can build its own instance in init() on the host database.");
+		this.#auth = options.auth;
+		this.#secret = options.secret;
+		this.signUpEnabledConfig = options.signUpEnabled ?? true;
+		this.registerOptions(options);
+	}
+	/**
+	* The active Better Auth instance. Throws before `init()` in deferred
+	* instance mode (constructed with `secret` instead of `auth`).
+	*/
+	get auth() {
+		if (!this.#auth) throw new Error("MastraAuthBetterAuth is not initialized — init() must run first (or pass a configured `auth` instance).");
+		return this.#auth;
+	}
+	/**
+	* Session cookie name, honoring Better Auth's `cookiePrefix`, a caller
+	* override via `advanced.cookies.session_token.name`, and the `__Secure-`
+	* prefix Better Auth applies when secure cookies are active.
+	*/
+	get sessionCookieName() {
+		const options = this.#auth?.options;
+		const advanced = options?.advanced;
+		const prefix = advanced?.cookiePrefix ?? "better-auth";
+		const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith("https://") ?? false;
+		const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;
+		return `${secure ? "__Secure-" : ""}${baseName}`;
+	}
+	/**
+	* One-time host initialization. In deferred instance mode (no `auth` in the
+	* options) this builds the provider-owned `betterAuth()` instance on the
+	* host's auth database; schema migrations then run lazily behind a
+	* once-per-process latch on first use.
+	*
+	* Bring-your-own `auth` instances skip construction entirely — the caller
+	* owns their database and migrations.
+	*/
+	async init(ctx) {
+		this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;
+		if (this.#auth) return;
+		const authDb = ctx.database;
+		if (!authDb) throw new Error("MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. Use a storage backend that exposes an auth database, or pass your own configured `auth` instance.");
+		const database = authDb.dialect === "postgres" ? authDb.pool : authDb.dialect === "libsql" ? {
+			dialect: new _libsql_kysely_libsql.LibsqlDialect({ client: authDb.client }),
+			type: "sqlite"
+		} : authDb.database;
+		const allowedOrigins = ctx.allowedOrigins ?? [];
+		const options = {
+			database,
+			secret: this.#secret,
+			basePath: "/auth/api",
+			...ctx.publicUrl ? { baseURL: ctx.publicUrl } : {},
+			...allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {},
+			emailAndPassword: {
+				enabled: true,
+				disableSignUp: !this.signUpEnabledConfig
+			},
+			plugins: [(0, better_auth_plugins.organization)()],
+			...this.#crossSite ? { advanced: { defaultCookieAttributes: {
+				sameSite: "none",
+				secure: true
+			} } } : {}
+		};
+		this.#auth = (0, better_auth.betterAuth)(options);
+		this.#ownsInstance = true;
+	}
+	/**
+	* Ensure better-auth's tables exist in the host database. Only for instances
+	* this provider built — bring-your-own instances manage their own migrations.
+	*/
+	async #ensureDbReady() {
+		if (!this.#ownsInstance) return;
+		this.#migrated ??= (async () => {
+			const { runMigrations } = await (0, better_auth_db_migration.getMigrations)(this.auth.options);
+			await runMigrations();
+		})();
+		try {
+			await this.#migrated;
+		} catch (error) {
+			this.#migrated = void 0;
+			console.warn("[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.");
+			throw error;
+		}
+	}
+	/**
+	* Proxy a raw HTTP request to Better Auth's own API surface
+	* (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.
+	*/
+	async handleAuthRequest(request) {
+		try {
+			await this.#ensureDbReady();
+		} catch {
+			return new Response(JSON.stringify({ error: "auth_unavailable" }), {
+				status: 503,
+				headers: { "content-type": "application/json" }
+			});
+		}
+		return this.auth.handler(request);
+	}
+	/**
+	* Ensure the user belongs to an organization, mirroring the WorkOS
+	* personal-org bootstrap on better-auth's organization tables:
+	* ≥1 membership → first org id; 0 → create a personal org with an
+	* idempotent slug derived from the user id.
+	*
+	* Concurrent/retried first logins recover via the unique slug instead of
+	* creating duplicates. Slug alone is NOT proof of ownership though: the
+	* organization API is reachable by any authenticated user, so an attacker
+	* could squat `personal-<victimId>`. The slug-matched org is only adopted
+	* when nobody else is a member; otherwise a fresh org with an unguessable
+	* slug is created instead.
+	*
+	* Best-effort: any failure is swallowed and leaves the user no-org.
+	*/
+	async ensureOrganization(userId) {
+		const cached = this.#orgCache.get(userId);
+		if (cached) return cached;
+		try {
+			await this.#ensureDbReady();
+			const ctx = await this.getAuthContext();
+			if (!ctx) return void 0;
+			const firstExisting = (await ctx.adapter.findMany({
+				model: "member",
+				where: [{
+					field: "userId",
+					value: userId
+				}]
+			})).find((m) => m.organizationId)?.organizationId;
+			if (firstExisting) {
+				this.#orgCache.set(userId, firstExisting);
+				return firstExisting;
+			}
+			const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);
+			const orgName = `${userRecord?.email ?? userRecord?.name ?? userId}'s org`;
+			const orgData = () => ({
+				name: orgName,
+				createdAt: /* @__PURE__ */ new Date(),
+				metadata: JSON.stringify({ mastraPersonalOrg: "true" })
+			});
+			const slug = `personal-${userId}`;
+			let organizationId;
+			try {
+				organizationId = (await ctx.adapter.create({
+					model: "organization",
+					data: {
+						...orgData(),
+						slug
+					}
+				})).id;
+			} catch (error) {
+				const existing = await ctx.adapter.findOne({
+					model: "organization",
+					where: [{
+						field: "slug",
+						value: slug
+					}]
+				});
+				if (!existing) throw error;
+				if ((await ctx.adapter.findMany({
+					model: "member",
+					where: [{
+						field: "organizationId",
+						value: existing.id
+					}]
+				})).some((m) => m.userId !== userId)) organizationId = (await ctx.adapter.create({
+					model: "organization",
+					data: {
+						...orgData(),
+						slug: `personal-${userId}-${crypto.randomUUID()}`
+					}
+				})).id;
+				else organizationId = existing.id;
+			}
+			try {
+				await ctx.adapter.create({
+					model: "member",
+					data: {
+						organizationId,
+						userId,
+						role: "owner",
+						createdAt: /* @__PURE__ */ new Date()
+					}
+				});
+			} catch (error) {
+				if (!await ctx.adapter.findOne({
+					model: "member",
+					where: [{
+						field: "organizationId",
+						value: organizationId
+					}, {
+						field: "userId",
+						value: userId
+					}]
+				})) throw error;
+			}
+			this.#orgCache.set(userId, organizationId);
+			return organizationId;
+		} catch (error) {
+			console.warn(`[BetterAuth] Failed to bootstrap personal organization for user ${userId}. The user will see organization_required until this succeeds.`, error);
+			return;
+		}
+	}
+	/**
+	* Whether the user holds an admin-equivalent role (`owner` or `admin`) in
+	* the organization. Provider errors resolve to `false`.
+	*/
+	async isOrganizationAdmin(organizationId, userId) {
+		try {
+			await this.#ensureDbReady();
+			const ctx = await this.getAuthContext();
+			if (!ctx) return false;
+			const membership = await ctx.adapter.findOne({
+				model: "member",
+				where: [{
+					field: "organizationId",
+					value: organizationId
+				}, {
+					field: "userId",
+					value: userId
+				}]
+			});
+			return membership?.role === "owner" || membership?.role === "admin";
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Check if sign-up is enabled.
+	* Implements ICredentialsProvider.isSignUpEnabled.
+	*/
+	isSignUpEnabled() {
+		return this.signUpEnabledConfig;
+	}
+	/**
+	* Get current user from request.
+	* Implements IUserProvider for EE user awareness in Studio.
+	*
+	* Supports both cookie-based sessions and `Authorization: Bearer <token>`
+	* requests (e.g. API clients using the token returned by `signIn`).
+	*
+	* @param request - Incoming HTTP request
+	* @returns EE User object or null if not authenticated
+	*/
+	async getCurrentUser(request) {
+		try {
+			await this.#ensureDbReady();
+			const headers = new Headers(request.headers);
+			const authHeader = headers.get("Authorization");
+			const bearerToken = authHeader && authHeader.slice(0, 7).toLowerCase() === "bearer " ? authHeader.slice(7).trim() : void 0;
+			await this.ensureSessionCookie(headers, bearerToken);
+			const result = await this.auth.api.getSession({ headers });
+			if (!result?.user) return null;
+			return mapBetterAuthUserToEEUser(result.user);
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Get user by ID.
+	* Implements IUserProvider for EE user awareness.
+	*
+	* Uses Better Auth's internal adapter to look up the user record,
+	* so it works with whichever database Better Auth is configured with.
+	*
+	* @param userId - User identifier
+	* @returns EE User object or null if not found
+	*/
+	async getUser(userId) {
+		try {
+			const ctx = await this.getAuthContext();
+			if (!ctx) return null;
+			const user = await ctx.internalAdapter.findUserById(userId);
+			if (!user) return null;
+			return mapBetterAuthUserToEEUser(user);
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Get multiple users by ID.
+	* Optional IUserProvider method used for batch author enrichment.
+	*
+	* @param userIds - User identifiers
+	* @returns EE User objects (null for missing users, order preserved)
+	*/
+	async getUsers(userIds) {
+		return Promise.all(userIds.map((userId) => this.getUser(userId)));
+	}
+	/**
+	* Get URL to user's profile page.
+	* Optional IUserProvider method.
+	*/
+	getUserProfileUrl(user) {
+		return `/profile/${user.id}`;
+	}
+	/**
+	* Get the resolved Better Auth context, or null when unavailable
+	* (e.g. a partial mock without `$context`).
+	*/
+	async getAuthContext() {
+		try {
+			return await Promise.resolve(this.auth.$context) ?? null;
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Ensure the Cookie header on `headers` carries a Better Auth session cookie
+	* for the given token.
+	*
+	* Better Auth's `getSession` reads the session from a *signed* cookie
+	* (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the
+	* raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens
+	* are signed with the instance secret before being set as the session cookie.
+	*/
+	async ensureSessionCookie(headers, token) {
+		if (!token) return;
+		const ctx = await this.getAuthContext();
+		const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;
+		const secret = ctx?.secret;
+		const cookieHeader = headers.get("Cookie");
+		if (!!cookieHeader?.split(";").some((pair) => {
+			const [key] = pair.trim().split("=");
+			return key?.trim() === cookieName;
+		})) return;
+		let cookieValue = token.includes(".") ? token.includes("%") ? tryDecode(token) : token : token;
+		if (!token.includes(".") && secret) cookieValue = `${token}.${await (0, better_auth_crypto.makeSignature)(token, secret)}`;
+		const existingCookies = cookieHeader ? `${cookieHeader}; ` : "";
+		headers.set("Cookie", `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);
+	}
+	/**
+	* Authenticate a bearer token by verifying the session with Better Auth.
+	*
+	* This method extracts the session from the request headers using
+	* Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —
+	* as returned by `signIn`/`signUp` — are signed before being passed to
+	* Better Auth as a session cookie, matching the bearer plugin's semantics.
+	*
+	* @param token - The bearer token (session token) to authenticate
+	* @param request - The request containing headers
+	* @returns The authenticated user and session, or null if authentication fails
+	*/
+	async authenticateToken(token, request) {
+		try {
+			await this.#ensureDbReady();
+			const headers = new Headers();
+			const cookieHeader = getRequestHeader(request, "Cookie");
+			if (cookieHeader) headers.set("Cookie", cookieHeader);
+			await this.ensureSessionCookie(headers, token);
+			const result = await this.auth.api.getSession({ headers });
+			if (!result || !result.session || !result.user) return null;
+			return {
+				session: result.session,
+				user: result.user
+			};
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Authorize a user for access.
+	*
+	* By default, any authenticated user with a valid session is authorized.
+	* You can override this behavior by providing a custom `authorizeUser` function
+	* in the constructor options.
+	*
+	* @param user - The authenticated user and session
+	* @returns True if the user is authorized, false otherwise
+	*/
+	async authorizeUser(user) {
+		return !!user?.session?.id && !!user?.user?.id;
+	}
+	/**
+	* Sign in with email and password.
+	* Implements ICredentialsProvider for EE credentials auth.
+	*
+	* @param email - User email
+	* @param password - User password
+	* @param request - Incoming HTTP request
+	* @returns Result with user and session cookies
+	* @throws Error if credentials are invalid
+	*/
+	async signIn(email, password, request) {
+		const headers = request?.headers ?? new Headers();
+		const response = await this.auth.api.signInEmail({
+			body: {
+				email,
+				password
+			},
+			headers,
+			asResponse: true
+		});
+		if (!response.ok) {
+			const errorData = await response.json().catch(() => ({}));
+			throw new Error(errorData.message || "Invalid email or password");
+		}
+		const result = await response.json();
+		if (!result?.user) throw new Error("Invalid email or password");
+		const cookies = [];
+		const setCookieHeader = response.headers.get("set-cookie");
+		if (setCookieHeader) cookies.push(...setCookieHeader.split(/,(?=\s*\w+=)/));
+		return {
+			user: mapBetterAuthUserToEEUser(result.user),
+			token: result.token ?? void 0,
+			cookies
+		};
+	}
+	/**
+	* Sign up with email and password.
+	* Implements ICredentialsProvider for EE credentials auth.
+	*
+	* @param email - User email
+	* @param password - User password
+	* @param name - Optional display name
+	* @param request - Incoming HTTP request
+	* @returns Result with new user and session cookies
+	* @throws Error if sign up fails
+	*/
+	async signUp(email, password, name, request) {
+		const displayName = name ?? email.split("@")[0] ?? "User";
+		const headers = request?.headers ?? new Headers();
+		const response = await this.auth.api.signUpEmail({
+			body: {
+				email,
+				password,
+				name: displayName
+			},
+			headers,
+			asResponse: true
+		});
+		if (!response.ok) {
+			const errorData = await response.json().catch(() => ({}));
+			throw new Error(errorData.message || "Failed to create account");
+		}
+		const result = await response.json();
+		if (!result?.user) throw new Error("Failed to create account");
+		const cookies = [];
+		const setCookieHeader = response.headers.get("set-cookie");
+		if (setCookieHeader) cookies.push(...setCookieHeader.split(/,(?=\s*\w+=)/));
+		return {
+			user: mapBetterAuthUserToEEUser(result.user),
+			token: result.token ?? void 0,
+			cookies
+		};
+	}
+	/**
+	* Get the underlying Better Auth instance.
+	* Useful for accessing Better Auth APIs directly.
+	*/
+	getAuth() {
+		return this.auth;
+	}
+	/**
+	* Get headers to clear the session cookies on logout.
+	* Partial ISessionProvider implementation for logout support.
+	*
+	* Clears Better Auth's default session cookies.
+	*/
+	getClearSessionHeaders() {
+		const sameSite = this.#crossSite ? "None; Secure" : "Lax";
+		return { "Set-Cookie": [`${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`, `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`].join(", ") };
+	}
 };
-
+//#endregion
 exports.MastraAuthBetterAuth = MastraAuthBetterAuth;
-//# sourceMappingURL=index.cjs.map
+
 //# sourceMappingURL=index.cjs.map